Terms of Service

These Terms of Service ("Terms") govern your access to and use of the XAIO platform and any related services (collectively, the "Service") provided by XAIO FlexCo, Liechtensteinstraße 22a / 4, 1090 Wien, Austria, registered with the Commercial Register of the Vienna Commercial Court under FN 672857x ("XAIO", "we", "us"). They apply alongside our Privacy Policy, Acceptable Use Policy, Data Processing Agreement, and the current Sub-Processor List. By creating an account, accessing or using the Service, you accept these Terms.

1. Definitions

• Account means the personal or organizational account used to access the Service.
• AI Output means code, text, designs, configurations, documentation or other content generated by the AI features of the Service in response to your prompts or instructions.
• Consumer means a natural person acting outside their trade, business, craft or profession within the meaning of § 1 KSchG.
• Customer means a user who is not a Consumer (B2B).
• Credits means usage units consumed by AI Gateway, build, hosting or compute features as described in your subscription plan.
• Order Form means a written order, online purchase, or signed quotation that references these Terms and specifies plan, seats, term, and fees.
• Project means a workspace, generated application, agent flow or published site you create on the Service.
• Published Site means an application or website you publish through the Service to a subdomain of *.xaio.app or a custom domain.
• Sub-Processor means a third-party processor engaged by us to process Personal Data on your behalf (see Sub-Processor List).
• User Content means any data, code, prompts, files, configurations, secrets, or other material you submit to, upload, generate, or store on the Service, including AI Output.
• XAIO Materials means the Service itself, including all software, models, documentation, templates, trademarks, logos, designs, and content owned or licensed by XAIO.

2. Acceptance and Eligibility

By creating an Account or using the Service you confirm that you are at least 18 years old (or have reached the age of majority in your jurisdiction) and have the legal capacity to enter into a binding contract. If you accept on behalf of a legal entity, you warrant that you are authorised to bind that entity.

The Service is not directed at, and not intended for, minors. We do not knowingly collect personal data from persons under 18 years of age.

3. The Service

XAIO provides an AI-powered platform that supports the creation, publication, operation and maintenance of digital applications and websites, including (without limitation): AI-assisted code generation, requirements analysis, agent flows, project and team management, collaboration, publishing and hosting on *.xaio.app or custom domains, and integrations with third-party services.

The available features, plan limits and quotas are described on our website and in your Order Form or subscription plan. We may add, modify, deprecate or remove features over time; material changes will be communicated in advance under Section 27.

4. Accounts and Credentials

• You must provide accurate, current and complete information during registration and keep it up to date.
• You are responsible for safeguarding your credentials and for all activity carried out under your Account, except where caused by our wilful misconduct or gross negligence.
• You must notify us at security@xaio.dev without undue delay of any suspected unauthorised access, breach or compromise of your Account.
• Account sharing across distinct individuals is only permitted within the seats included in your plan.

5. License to Use the Service

Subject to your compliance with these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service for your personal or internal business purposes during your subscription term.

All right, title and interest in and to the XAIO Materials remain with XAIO and our licensors. Nothing in these Terms grants you any ownership of the Service itself.

6. License Restrictions

You shall not, and shall not permit anyone else to:

• copy, modify, distribute, sell, sublicense or otherwise commercialise the Service or XAIO Materials, except for AI Output and User Content as expressly permitted;
• resell, time-share or otherwise provide the Service to third parties outside your organisation, except for end users of your Published Sites;
• reverse engineer, decompile or disassemble any part of the Service, except to the extent expressly permitted by mandatory law (e.g. § 40d/40e UrhG for interoperability);
• bypass, disable or interfere with security, rate-limiting or access controls;
• use bots, crawlers, scrapers or other automated means to access the Service without our prior written permission;
• introduce malicious code, viruses or any other harmful material into the Service;
• impersonate any person or entity or misrepresent your affiliation with any person or entity;
• use the Service to train, develop or improve any AI model that competes with the Service;
• attempt to extract or reconstruct model weights, system prompts, internal logic or training data of the Service.

Further AI-specific obligations and prohibitions are set out in the Acceptable Use Policy, which forms an integral part of these Terms.

7. User Content and AI Output

Ownership. As between you and us, you retain all rights, title and interest in and to your User Content, including any AI Output generated for you. We claim no ownership of your User Content.

License to us. You grant us a worldwide, non-exclusive, royalty-free, sublicensable (only to our Sub-Processors) license to host, store, transmit, process, display, and back up your User Content solely as necessary to provide, secure and improve the Service for you. This license terminates when you delete the User Content or close your Account, subject to retention required by law or to defend legal claims.

No training on User Content. We do not use your User Content (including prompts, code, secrets, files or AI Output) to train, fine-tune or otherwise improve foundation models, whether ours or those of third parties, and we do not share User Content with any AI model provider for training purposes. Anonymous, aggregated usage telemetry (e.g. counts of tokens, latency, error rates) may be used to operate and improve the Service.

Caveats on AI Output. AI Output is generated probabilistically and may contain errors, security vulnerabilities, license-incompatible patterns, or content similar to other works. AI Output is not guaranteed to be unique, accurate, complete, lawful or fit for any particular purpose. You are responsible for reviewing, testing, securing and licensing-compliant use of AI Output before deploying it in production, in regulated or safety-critical contexts. See Acceptable Use Policy.

Feedback. If you voluntarily submit suggestions, ideas or feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free license to use such feedback without any obligation to you.

8. Beta and Experimental Features

We may make pre-release, beta, preview or experimental features ("Beta Features") available to you. Beta Features are provided "as is", without warranty of any kind, may be modified, deprecated or removed at any time and without notice, and are excluded from any service credits, SLA commitments or refund obligations. Use of Beta Features is voluntary.

9. Subscription Plans, Credits and Billing

• Fees, plan limits, included Credits and Term are described in the applicable Order Form or, for self-service plans, on our website at the time of purchase.
• You authorise us and our payment processor (currently Stripe) to charge your selected payment method for recurring fees.
• Fees are exclusive of VAT, sales taxes, withholding taxes or other public charges, which are added in accordance with applicable law.
• Credits not used during a billing period roll over only as expressly stated in your plan; expired Credits forfeit without compensation.
• Where included, our metering and usage records are deemed accurate absent manifest error.

Late payment (Customers). For Customers (B2B), in case of payment default, we may charge default interest of 9.2 percentage points above the base rate of the European Central Bank in accordance with § 456 UGB, plus reasonable collection costs. The right to set off claims against ours is excluded; rights of retention are limited to undisputed or adjudicated counter-claims.

10. Auto-Renewal, Cancellation, and Withdrawal

Unless your Order Form states otherwise, paid subscriptions renew automatically for successive periods equal to the previous Term. You may cancel renewal at any time through your account settings or by written notice to billing@xaio.dev. Cancellation takes effect at the end of the then-current billing period. Fees already paid for the current period are non-refundable except as expressly required by law (see Consumer withdrawal below).

Consumer right of withdrawal (FAGG). Consumers entering into a distance contract have the right to withdraw within 14 days of contract conclusion without giving reasons (§§ 11 et seq. FAGG). For paid digital services or digital content, the right of withdrawal expires when full performance has begun and you have:

• expressly requested the immediate provision of the digital service or content before expiry of the withdrawal period;
• expressly acknowledged that the right of withdrawal lapses upon full performance (or, for digital content, upon commencement of performance); and
• received our confirmation of the contract on a durable medium (typically the sign-up confirmation email) containing these acknowledgements (§ 7 (3) and § 18 FAGG).

If any of these conditions is not met, the 14-day withdrawal right remains in force. We will provide a withdrawal form (Annex II FAGG) on request at legal@xaio.dev.

11. Price Changes

We may modify fees for recurring subscriptions with at least 30 days' advance notice by email or in-product notification. If you do not accept the change, you may cancel the subscription before the new fees take effect; continued use of the Service after the effective date constitutes acceptance.

12. Service Availability and Dependencies

The Service is hosted on AWS infrastructure in the European Union (region eu-central-1, Frankfurt) and depends on third-party AI model providers, payment processors, email and domain providers (see Sub-Processor List). We strive for high availability but do not guarantee uninterrupted, error-free or secure operation, except where committed in writing in an applicable Service Level Agreement (SLA).

13. Force Majeure

Neither party shall be liable for any failure or delay in performance, except for payment obligations, caused by events beyond its reasonable control, including acts of war, terrorism, civil unrest, natural disasters, epidemics, governmental action, internet or power outages, third-party platform failures, or denial-of-service attacks. The affected party shall notify the other promptly and use reasonable efforts to mitigate the impact.

14. Suspension and Termination

We may suspend or terminate your Account, in whole or in part, with or without notice as reasonable under the circumstances, if (a) you materially breach these Terms and fail to cure within a reasonable period after written notice (or immediately for breaches that cannot be cured or that pose immediate risk), (b) you fail to pay undisputed fees when due, (c) suspension is required by law, court order or regulator, or (d) we reasonably suspect fraudulent, abusive or unlawful activity.

You may terminate your subscription as described in Section 10. Upon termination, your access to the Service ends, and we will delete your User Content in accordance with our retention policy described in the Privacy Policy and DPA, unless retention is required by law or to defend legal claims.

15. Subdomain and Username Management

When you publish a Project, you may receive a subdomain in the form <your-name>.xaio.app. You acknowledge that:

• all rights in *.xaio.app remain with XAIO;
• we may reclaim, reassign, suspend or terminate a subdomain or username with 7 days' advance notice (and immediately in cases of trademark infringement, impersonation, abuse, illegal content, security risks or as required by law);
• inactive subdomains may be recycled;
• where we reclaim or disable a subdomain due to your breach of these Terms, the Acceptable Use Policy or third-party rights, no refund is due;
• where we reclaim or disable a subdomain for reasons not attributable to you (e.g. recycling, internal trademark conflict, change of platform architecture), we will refund the pre-paid fees for the unused remaining period of the subscription pro rata or, at your option, migrate your Published Site to an alternative subdomain at no additional cost;
• for mission-critical Published Sites, we strongly recommend connecting a custom domain that you own.

16. Custom Domains

You may connect a custom domain you own to a Published Site. You are responsible for domain registration, DNS configuration, renewal, trademark clearance and compliance of all content served on the custom domain. We provide TLS certificates via our infrastructure providers where technically supported.

17. Data Protection

Our processing of personal data is governed by the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and, where applicable, the e-Commerce-Gesetz (ECG). Details of our processing as controller are set out in the Privacy Policy. Where we process personal data on your behalf as processor under Art. 28 GDPR (e.g. data your application stores in our infrastructure), the Data Processing Agreement applies. The current list of Sub-Processors is published at /sub-processors.

18. Confidentiality (B2B)

For Customers (B2B), each party shall treat as confidential all non-public information of the other party that is identified as confidential or that should reasonably be understood as confidential. The receiving party shall use such information only to perform under these Terms and shall protect it with at least the same degree of care it uses for its own confidential information, but in no event less than reasonable care. This obligation survives for two (2) years after the end of the contract. It does not apply to information which is or becomes public without breach, is independently developed, or whose disclosure is required by law.

19. Publicity and References

For Customers, we may, until you object in writing, identify you as a customer of XAIO (e.g. by name and logo) on our website, in pitch decks, investor materials and in product marketing. You can revoke this permission at any time at legal@xaio.dev; we will then cease use in newly produced materials within a reasonable time.

20. Warranty and Statutory Rights

We provide the Service with due care and warrant that it materially conforms to its documentation. We do not warrant that the Service will be uninterrupted, error-free, secure or that AI Output will be accurate, reliable or fit for any particular purpose.

Statutory warranty rights of Consumers under Austrian law (Konsumentenschutzgesetz, ABGB, VGG) remain unaffected. For Customers (B2B), the warranty period is twelve (12) months from the date the defect is reasonably discoverable, and remedies are limited to repair, replacement or, after two failed cure attempts, price reduction or rescission of the affected service portion.

21. Limitation of Liability

To the maximum extent permitted by applicable law, neither party is liable for indirect, incidental, special, consequential or punitive damages, lost profits, loss of revenue, lost data, lost business opportunities, or loss of goodwill, even if advised of the possibility.

Our aggregate liability under these Terms is capped at the total fees paid or payable by you to XAIO in the twelve (12) months preceding the event giving rise to the claim. For free-tier use, our aggregate liability is capped at EUR 100.

The above limitations do not apply to: (a) liability for wilful misconduct or gross negligence, (b) liability for personal injury or death, (c) mandatory product-liability claims, (d) liability that cannot be limited or excluded under applicable mandatory law.

For Consumers, our liability for slight negligence in breach of material contractual obligations (cardinal obligations — those whose fulfilment makes proper performance of the contract possible in the first place and on whose observance you may regularly rely) is limited to typical, foreseeable damages. The above caps do not apply to the extent such limitation would be invalid under mandatory consumer-protection law.

22. Indemnification

You shall defend and indemnify XAIO, its affiliates, officers, employees and agents against third-party claims, damages, losses and reasonable expenses (including legal fees) to the extent you culpably caused them through (a) your User Content, (b) your use of AI Output in violation of these Terms or law, (c) your breach of these Terms or the Acceptable Use Policy, or (d) your violation of third-party rights, including intellectual-property or data-protection rights.

For Consumers, this obligation is limited to damages caused by your intent or gross negligence and applies only to the extent permitted by mandatory consumer-protection law.

We will notify you promptly of any such claim, give you reasonable control of the defence (with our reasonable involvement) and provide reasonable cooperation at your expense.

23. Export Controls and Sanctions

You represent and warrant that you are not located in, ordinarily resident in, or a national of a country or region subject to comprehensive EU or US sanctions (currently including Cuba, Iran, North Korea, Syria, the Crimea, so-called Donetsk and Luhansk People's Republics, and other Russian-occupied regions of Ukraine), and that you are not listed on any EU, UN, UK or US sanctions or denied-party list. You shall not use the Service in violation of applicable export-control or sanctions laws.

24. Governing Law and Jurisdiction

These Terms and any non-contractual obligations arising out of or in connection with them are governed by the substantive laws of Austria, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

For Customers (B2B), the exclusive place of jurisdiction for all disputes arising out of or in connection with these Terms, including any disputes concerning their formation, validity or termination, is the competent court at the seat of XAIO in Vienna, Austria (Handelsgericht Wien). For Consumers, the mandatory consumer-protection provisions of their country of habitual residence remain unaffected; Consumers may bring proceedings in the courts of their place of residence.

Before initiating litigation, the parties will use reasonable efforts to resolve disputes through good-faith negotiation, and, if unsuccessful, mediation under the rules of an Austrian mediation institution.

25. Online Dispute Resolution

Consumers in the EU may submit complaints to the European Commission's online dispute resolution platform at ec.europa.eu/consumers/odr. We are neither obliged nor willing to participate in dispute-resolution proceedings before a consumer arbitration board.

26. Notices

We may send notices to the email address registered with your Account, by in-product notification, or by posting on our website. You may send legal notices to legal@xaio.dev or to the postal address in the introduction. Notices are deemed received on the next business day after dispatch (email) or on the third business day after posting (registered mail).

27. Changes to These Terms

We may modify these Terms in text form, with at least 30 days' advance notice by email or in-product notification, in the following cases:

• (a) adapting to changes in applicable law, court rulings or supervisory-authority decisions;
• (b) closing regulatory gaps or correcting errors;
• (c) introducing new functionality of the Service that does not adversely change your core rights and obligations;
• (d) adjusting to verifiable changes in our costs (e.g. infrastructure pricing, AI-provider fees, statutory levies), passed on transparently and proportionally;
• (e) adapting to security or data-protection requirements.

For Consumers, changes that are not purely beneficial or technical require your express consent. We will request consent in-product and treat continued use after the effective date as consent only where the change is in your favour or purely technical. If you do not accept a material change that disadvantages you, you may terminate the affected subscription with effect from the date the change would take effect; pre-paid fees for the unused remaining period will be refunded pro rata.

28. Assignment

You may not assign or transfer these Terms or any rights and obligations under them without our prior written consent. We may assign these Terms in connection with a corporate reorganisation, merger, acquisition, sale of substantially all assets, or spin-off; we will notify you at least 30 days in advance.

For Consumers: if we transfer the contract to a third party, you may terminate the contract within 30 days of the notification with effect from the date of transfer; pre-paid fees for the unused remaining period will be refunded pro rata.

29. Order of Precedence and Customer Terms

In the event of a conflict, the following order of precedence applies: (1) the Order Form, (2) the Data Processing Agreement, (3) these Terms, (4) the Acceptable Use Policy, (5) the Privacy Policy.

Any general terms and conditions of the Customer are expressly excluded and do not become part of the contract, even if we do not object to them.

30. Miscellaneous

Entire agreement. These Terms, together with the documents referenced above and any Order Form, constitute the entire agreement between you and XAIO regarding the Service and supersede prior agreements on the same subject.

Severability. If any provision is held to be invalid or unenforceable, the remaining provisions remain in full force and effect; the parties shall replace the invalid provision with a valid provision closest to the intended economic effect.

Written form. Modifications or amendments require text form (e.g. email is sufficient), including any modification of this written-form requirement.

Waiver. Failure to enforce a right does not constitute a waiver of that right.

Survival. Sections 5–7, 17–24, 26 and 30 survive termination.

31. EU AI Act — Allocation of Roles

(a) Platform provider. XAIO provides an AI-supported development platform. For the AI features of the Service (including chat-based building, code generation and Agent Flows), XAIO acts as the provider of an AI system within the meaning of Regulation (EU) 2024/1689 (the "AI Act") that integrates general-purpose AI models of third-party model providers via API. The obligations of those model providers under the AI Act remain with them.

(b) Customer as deployer. You use the Service and operate applications created with it under your own responsibility. With respect to applications and AI features that you configure, deploy or operate, you act as the deployer (operator) of those systems within the meaning of the AI Act.

(c) Downstream providers. If you use the Service to develop your own AI systems or make them available to third parties (including Agent Flows or applications with AI features), you may yourself qualify as the provider of such downstream AI systems under the AI Act. In that case you are responsible for the resulting obligations, including the transparency obligations under Article 50 AI Act towards your end users (such as informing them that they are interacting with an AI system and marking AI-generated content).

(d) Use-case classification. You are solely responsible for assessing and classifying your specific use cases under the AI Act (prohibited practices, high-risk, limited or minimal risk) and for complying with all obligations resulting from that classification.

(e) Prohibited practices. Using the Service for practices prohibited under Article 5 AI Act is not permitted. Details are set out in our Acceptable Use Policy.

(f) High-risk applications. You may operate high-risk AI systems within the meaning of Annex III AI Act created with the Service only in compliance with the requirements applicable to you. XAIO does not represent or warrant that the platform satisfies requirements that apply to specific high-risk uses.

32. Contact

For questions about these Terms, contact:

XAIO FlexCo
Liechtensteinstraße 22a / 4
1090 Wien, Austria
Legal: legal@xaio.dev
Support: support@xaio.dev
Security: security@xaio.dev