Shared Platform Terms

1. Who contracts with whom

1.1 The Customer contracts separately with the Supplier of each Product it orders or activates. A shared brand, website, login, support address or document does not merge the two Product Agreements. “We”, “us” and “Supplier” mean the relevant supplying company.

1.2 Each Supplier is responsible for its own commitments and subcontracted duties, including responsibility imposed by data-protection law. Neither guarantees the other merely because this framework is shared.

1.3 The Products are for UK business customers, including sole traders contracting in their own legal names. Other territories require agreement. A representative must have authority to bind the Customer.

2. Definitions

2.1 “Customer” is the legal person identified in the Order. “Order” includes an accepted order form, subscription checkout or recorded activation specifying the Customer, Product, Supplier, term and agreed commercial details, including any free or paid trial.

2.2 “Product Agreement” comprises the Order, these Terms, the applicable Product Schedule and the shared Data Processing Addendum (“DPA”). “Product” means Agents or OS. Roadmap features are not included until released and agreed.

2.3 “Authorised User” is a person the Customer permits to use a Product. A “Customer Administrator” has administrative permissions. The Customer Administrator who creates the Customer’s account, or who accepts these Terms for the Customer, confirms that they are authorised to bind the Customer.

2.4 “Customer Content” means records, files, prompts, outputs and other content supplied, connected or generated for the Customer. “AI Output” includes generated text, analysis and proposed record changes. “Customer Personal Data” is defined in the DPA.

2.5 “Subscription Fees” are base recurring fees; “Usage Charges” are metered charges; “Account Credit” is prepaid service usage; and an “Add-on” is a separately selected feature or service.

2.6 “Aulo” is the internal OS administrative AI agent supplied by Augora OS Limited, not the separate Agents Product.

2.7 “Service Data” means technical and usage information about how the Products operate and are used, such as feature use, performance, error rates and volumes, which does not contain Customer Content.

3. Acceptance and DPA availability

3.1 The Customer accepts these Terms and the DPA when a Customer Administrator accepts them in the account set-up or acceptance flow and confirms their authority to bind the Customer. One acceptance applies to both Suppliers. A Product Agreement with a Supplier comes into effect when the Customer first activates that Supplier’s Product, on the Terms and DPA versions accepted at that time. The DPA needs no separate signature.

3.2 The current Terms, DPA and subprocessor list are shown in the acceptance flow before acceptance, are available to signed-in users in the Products, and are available free of charge to prospective customers on request to support@augora.co.

3.3 The Supplier records each acceptance, including the Customer, the accepting Customer Administrator and their authority confirmation, the accepted Terms and DPA versions, and the date and time, and records the date each Product is activated. The Order records the price, billing start and any other customer-specific terms.

3.4 Each Authorised User must also accept these Terms before using a Product. A user’s acceptance confirms they will comply with them and does not vary the Customer’s contract. Shared login, an invitation or a Product tab does not alone create a subscription, authorise charges or give access to another Product’s records.

3.5 These Terms and the DPA must be accepted before any Customer Personal Data is processed, including during trials and pilots. Trial credit is available only after acceptance. No charge applies when a trial ends unless the Customer has agreed the post-trial price and actively chosen to continue.

4. Which provisions take priority

4.1 Mandatory transfer provisions govern their transfers. The DPA prevails on personal-data processing. Otherwise, a specifically identified Order variation prevails over the applicable Product Schedule and then Part A. Schedule 3 prevails only for its connected operation. No provision reduces mandatory legal protections.

4.2 Privacy notices explain controller activities; they are not contractual permission for unrestricted processing or changes to the Customer’s instructions.

5. Service and professional responsibility

5.1 The Suppliers provide technology, not regulated financial advice, professional advice, suitability approval or regulatory sign-off. The Customer remains responsible for its advice, professional decisions, client communications and regulatory obligations.

5.2 This does not remove the Supplier’s obligation to provide the contracted technology with reasonable skill and care, including OS’s agreed record-storage duties. Direct retail-client access requires a separately enabled feature and appropriate terms and controls.

6. Customer responsibilities

6.1 The Customer must have authority, lawful bases, notices and any special-category or criminal-offence conditions needed for its content and instructions. A Customer acting as processor must have the upstream controller’s authority.

6.2 The Customer must maintain relevant and accurate records, choose lawful retention settings, train users, review AI work, secure devices and credentials, and promptly remove unauthorised access and report compromise. Users must be at least 18; account sharing and unauthorised production-data testing are prohibited.

6.3 The Customer is responsible for its Authorised Users within the limits of law. Contractor or external-professional access requires its authorisation and a permitted account type.

7. Shared identity and access

7.1 Product entitlement, firm membership and permissions remain separate despite shared authentication. Access must be scoped to the correct firm and current user permissions. Shared identity is not permission to combine client databases.

7.2 Administrators manage supported access and settings. OS audit visibility does not automatically expose private Agents histories. A shared credential compromise may require proportionate restrictions on both Products; a payment dispute about one does not alone justify restricting the other.

8. Acceptable use

8.1 The Customer must not act unlawfully, fraudulently or abusively; submit malicious code; bypass permissions, security or billing controls; interfere with other tenants; extract protected platform materials; or infringe third-party rights.

8.2 The Customer must not present AI Output as approved by a Supplier or regulator, evade professional review, or use the Products for unauthorised decisions with legal or similarly significant effects on individuals. Supported, authorised automation is not prohibited simply because it is automated.

8.3 Protected platform technology must not be used to build a competing service except where mandatory law permits. This does not restrict use or export of the Customer’s own records and lawfully generated outputs.

9. Integrations

9.1 Connections operate only when available and properly enabled. The Customer must hold the required third-party rights. Material permissions, charges and limitations must be disclosed before activation.

9.2 Each connection must stay within its authorised purpose and current permissions. Cross-product operations follow Schedule 3. A third-party outage does not excuse the Supplier’s own reasonable-care and continuity obligations. Roadmaps do not promise release dates.

9.3 Where the Customer enables meeting recording, transcription, calendar, email or similar connections, it authorises the Supplier to access the connected accounts and content within the permissions granted. The Customer remains responsible for telling clients and other participants that meetings are recorded or transcribed, and for any notice or consent the law requires. Connected accounts, such as the Customer’s own email or calendar provider, are used on the Customer’s instruction under its own agreement with that provider.

10. AI outputs and actions

10.1 AI Output may be inaccurate, incomplete or unsuitable. Professional reports, advice wording and external communications require competent human review before reliance. Accuracy, uniqueness and fitness for an individual case are not guaranteed.

10.2 Aulo may query records and perform permitted administration. Initial OS writes require approval of the proposed change. Future automated modes must be clearly described and enabled by an authorised Customer representative, within appropriate permissions and safeguards.

10.3 Automation does not grant unrestricted authority. High-risk operations retain the controls specified for the feature, and material permission changes require the necessary notice and agreement. These limitations do not remove security, audit or data-processing obligations.

11. Customer Content and data protection

11.1 The Customer and its licensors retain their rights in Customer Content. The relevant Supplier may process it as necessary to provide, secure and support the agreed service, follow lawful instructions and fulfil the Product Agreement.

11.2 Both parties must comply with the data-protection laws applicable to their activities. The DPA governs processing for the Customer. Own-business controller activities require their own lawful bases, notices and procedures; calling client content “analytics” does not remove its protection.

11.3 The Supplier will not sell client records, market to the Customer’s clients or use Customer Content for AI training. Clause 12 sets out the only permitted improvement uses.

12. No AI training and service improvement

12.1 Neither Augora company will use Customer Content or Customer Personal Data, whether identifiable, pseudonymised or anonymised, to train, fine-tune or otherwise develop any AI model, or permit an AI provider to do so. “Develop” includes building training or evaluation datasets, distillation and reinforcement learning. It does not include indexing or embedding Customer Content used only to provide the Customer’s own service.

12.2 The Supplier may access Customer Content as processor under the DPA to provide support and to diagnose and fix faults affecting the Customer, including by reviewing or replaying the Customer’s own sessions. It may deploy the resulting software changes to all customers. Customer Content is not copied into any dataset, test library or other store for that purpose and is not used for any other customer.

12.3 The Supplier may collect Service Data and use it to operate, secure and improve the Products. It processes any personal data within Service Data, such as information about Authorised Users, as controller under its privacy notice. It shares Service Data outside the Augora companies only in aggregated form that identifies neither the Customer nor any individual.

12.4 The Customer may give suggestions or feedback about the Products. The Suppliers may use them freely and without obligation, provided they do not disclose the Customer’s confidential information.

13. Intellectual property

13.1 The Supplier and its licensors retain the Product’s technology and grant a non-exclusive business-use right for the agreement’s duration. The Customer may use, edit, export and retain its outputs. Any assignable Supplier-owned rights in those outputs transfer to the Customer, excluding pre-existing or expressly licensed technology and subject to third-party rights.

13.2 Similar outputs may be produced for others, and copyright in AI-generated content is not guaranteed. Ownership and licences between the Augora companies remain governed by their separate arrangements.

14. Confidentiality and publicity

14.1 Each party must protect the other’s non-public information, limit access to authorised purposes and people bound to confidentiality, and use it only as permitted by the agreement or law. This covers client records and non-personal confidential information.

14.2 Lawful compulsory disclosure requires prior notice where permitted and reasonable minimisation. Information independently developed, lawfully obtained without restriction or legitimately public is excluded. Confidentiality survives for five years; personal data, client files, trade secrets and sensitive security information remain protected while confidential.

14.3 Customer names, logos and case studies require authorised written permission for publicity. That permission does not permit disclosure of underlying client information.

15. Fees and credits

15.1 Each Supplier invoices its own Product through its own payment account. All prices, billable users, usage rates and Add-ons are customer-specific and stated in the Order, exclusive of VAT and applicable taxes. No fixed subscription price is set by these Terms.

15.2 The Order identifies any included allowance or Aulo fair-use access, metering, expiry and billing arrangements. Base fees are payable in advance unless agreed otherwise. Paid Add-ons, overages and automatic top-ups require prior authorisation and clear pricing.

15.3 Optional usage exhaustion may restrict the affected features, but not paid core OS access or standard export. Credits are Product-specific unless agreed otherwise. Aulo controls follow Schedule 2, section O5.

15.4 Billing disputes must be raised promptly with reasonable detail; the Supplier will investigate. Undisputed charges remain payable. Payment-related suspension follows clause 19.

15.5 Unless the Order, law or an express refund provision states otherwise, prepaid Subscription Fees and unused Account Credit are non-refundable on voluntary Customer cancellation without Supplier breach. Valid credit remains usable until the subscription ends, then expires; any earlier expiry must have been disclosed before purchase. Complimentary credit has no cash value. Clause 20.5 governs refunds following Supplier termination without cause. Statutory remedies and refunds expressly provided elsewhere are preserved.

15.6 Existing monthly prices may increase only on at least 30 days’ notice, from a subsequent billing period starting after that notice. The Customer may cancel first. Fixed-term prices change only under the agreed mechanism or applicable tax changes.

16. Term and early access

16.1 Unless the Order states otherwise, subscriptions roll monthly and Customer cancellation takes effect at the end of the paid billing period. The Customer may cancel through the account process or an authorised email to support@augora.co identifying the Product. Clause 20.4 permits earlier exit after a Supplier termination notice.

16.2 Any fixed term, renewal condition or minimum commitment must be expressly agreed. The Supplier’s clause 20.2 break right applies during fixed terms unless expressly varied in the Order. Cancelling one Product does not cancel the other.

16.3 Early-access limitations and charging must be disclosed. Pilots retain their existing primary records elsewhere unless production migration is expressly agreed following readiness checks. Early access does not remove confidentiality, security or DPA obligations.

17. Support, security and changes

17.1 The Supplier will provide the service with reasonable skill and care and use reasonable efforts to address material faults. Uninterrupted operation or perfect AI accuracy is not promised. All other warranties, conditions and terms implied by statute or common law are excluded to the fullest extent permitted by law.

17.2 Support requests are accepted at support@augora.co. The Supplier will use reasonable efforts to respond and assist. No fixed support hours, response or resolution deadline, 24-hour support availability or numerical uptime commitment applies unless expressly agreed in the Order or a service schedule. This does not postpone security-incident, DPA or statutory duties.

17.3 The Supplier may maintain and improve the Product, with reasonable notice of planned material disruption or adverse changes where practicable. Material removal of a core paid function without a reasonable substitute permits the Customer to end the affected service and obtain a proportionate unused-prepayment refund.

17.4 Urgent legal or security changes may take effect sooner where necessary. They do not authorise retrospective pricing or new personal-data purposes.

17.5 The Supplier must maintain appropriate technical and organisational security measures protecting the confidentiality, integrity and availability of Customer Content, and review them periodically and after material incidents.

17.6 Appropriate measures must address access, personnel, suppliers, development, vulnerabilities, logging, incidents and recovery. DPA Schedule B governs personal-data security. Changes must not materially reduce agreed protection.

17.7 Relevant security-assurance information must be available through proportionate, secure disclosure. Sensitive details and other customers’ information must be protected without defeating mandatory DPA audit rights. Intrusive testing requires agreed authority and scope.

17.8 The Suppliers do not claim ISO/IEC 27001 or other security certification unless they expressly state so in writing. A provider’s certification is not a Supplier certification.

17.9 The Supplier must notify the Customer without undue delay of a confirmed security incident materially compromising Customer Content or disrupting the contracted service, with impact information and updates. DPA personal-data-breach duties apply separately, without this materiality threshold.

18. Records and exit

18.1 OS may be the Customer’s main working record system within the agreed scope; Agents is not its regulatory record archive. On exit, the Customer chooses return or deletion under the DPA. Standard export covers its records and files in usable formats and the supported audit information, not source code, other tenants’ data or credentials.

18.2 Standard export must not be withheld merely to force payment of disputed fees. Bespoke migration may be charged by prior agreement without obstructing mandatory assistance.

18.3 The Customer has a 30-day limited return/export window after termination, unless it instructs earlier deletion or a different period is agreed. The 90-day Supplier notice period comes before that window. Active deletion must then take place without undue delay under the Customer’s instructions and the completed DPA Schedule D. That schedule records the actual maximum deletion and protected-backup periods; these Terms do not add a separate blanket deletion deadline.

19. Suspension

19.1 The Supplier may proportionately restrict an affected user, feature or Product for material payment breach, unauthorised activity, security risk, unlawful instructions or legal requirement. Where safe and lawful, it will give notice and an opportunity to resolve the issue.

19.2 Urgent containment may occur without advance notice. Restrictions must be reviewed and explained when practicable, with unaffected access restored when the reason ceases. Safe read-only access or export must be considered unless it would compromise containment or law.

19.3 A problem with one Product does not automatically affect the other. Shared-security controls must match the actual risk. Aulo fair-use controls follow section O5 and do not alone justify wider account suspension.

20. Termination

20.1 Either party may terminate the affected Product Agreement for material breach not remedied within 30 days’ written notice where capable of remedy. Immediate termination is permitted where continuation is unlawful or an irremediable material breach makes it unreasonable.

20.2 Unless the Order expressly provides otherwise, the Supplier may terminate without cause on at least 90 calendar days’ written notice under clause 22, including during a fixed term. No Customer breach is required.

20.3 The notice must identify the Supplier, Product Agreement and termination date. Supplier non-renewal must also respect that notice period. If necessary, service continues only to complete the notice period at existing rates, without a fresh minimum term.

20.4 Normal service and charges continue during notice, subject to separate lawful suspension or breach rights. The Customer may elect an earlier termination date by written notice without an early-termination charge.

20.5 Within 30 days after termination pursuant to clause 20.2, including an earlier Customer-elected date, the Supplier must refund unused prepaid Subscription Fees for the period after termination and unused purchased, unexpired credit. Promotional credit is excluded. Charges properly incurred remain due, but no remaining-term exit charge applies. Termination for Supplier breach preserves remedies available under law and any other express refund provision; it does not automatically extend this clause’s no-cause credit-refund promise.

20.6 Clause 18 and the DPA continue for return, deletion and limited export access. Ending one Product does not end the other; a combined notice must expressly identify both terminating Suppliers and agreements. Connected permissions must be revoked.

20.7 Insolvency rights apply only as permitted by law. Supplier dependencies do not remove reasonable continuity and export duties. Accrued rights, outstanding lawful charges, confidentiality, data protection, IP, clause 12 and liability provisions survive where necessary.

21. Liability

21.1 Nothing limits fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or liability that cannot lawfully be limited. Individuals’ statutory data-protection remedies and regulators’ powers remain unaffected.

21.2 Subject to clause 21.1 and any expressly agreed Order variation, each party’s total aggregate liability arising out of or in connection with each Product Agreement, including its DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of £100,000 and all fees paid or contractually due for the affected Product in the 12 months immediately before the first event giving rise to liability under that Product Agreement, excluding VAT. Fees include Subscription Fees, Usage Charges and agreed service charges; amounts that arise only from assumed future renewals or uncommitted future usage are excluded.

21.3 The clause 21.2 limit is a single aggregate limit for the relevant Product Agreement, not a separate amount for each claim, user, incident or document. Liability for breach of confidentiality, security or data-protection obligations, including under the DPA, is instead subject to a separate single aggregate limit of the greater of £250,000 and the fee amount in clause 21.2. This does not limit duties or liabilities that law does not allow the parties to limit.

21.4 Neither party is liable for indirect or consequential loss, or loss of profit, revenue, goodwill or anticipated savings, subject to clause 21.1. Reasonable direct data-restoration costs caused by Supplier breach are not excluded merely because they concern data, but remain subject to clause 21.2.

21.5 Caps are Product-specific and do not displace statutory allocation for the same processing or permit double recovery. Charges already due and express refund obligations are not reduced by the damages caps.

21.6 Each party remains responsible for third-party claims to the extent it is legally liable, with prompt notice and reasonable cooperation. No separate unlimited Customer indemnity or Supplier IP indemnity arises unless expressly agreed in an Order.

21.7 The limits in this clause 21 do not apply to the Customer’s obligation to pay charges properly due, or to its liability for breach of clause 8.1 or clause 8.3.

22. Notices and privacy contact

22.1 Notices to a Supplier go to support@augora.co or its registered office, identifying the Customer and Product. Customer notices go to its nominated legal, billing or administrator contact. In-product notices supplement rather than replace required direct notice.

22.2 A clause 20.2 notice must go to the nominated legal contact, or otherwise the Order’s account contact, copied to a different Administrator where available. Bounced notices must be resent to a valid contact or delivered by hand or tracked courier to the recorded business or registered address.

22.3 Termination/non-renewal emails to the correct address are deemed received at 9 am on the next Business Day after sending unless delivery failure is notified. Hand/courier notice is received on recorded delivery, or at 9 am next Business Day if outside 9 am–5 pm on a Business Day. Retain delivery evidence. A failed notice does not start time running.

22.4 Business Days exclude weekends and public holidays in England and Wales; times are UK local time. These receipt rules do not postpone statutory or DPA notifications or authorise email service of court proceedings.

22.5 Privacy requests and complaints may be sent to support@augora.co without an account or subscription. Each company must promptly route them to the responsible organisation.

22.6 For its own controller complaints, the responsible Augora company will acknowledge receipt within 30 days, make appropriate enquiries, provide progress information and communicate an outcome without undue delay. For Customer-controlled data it will promptly notify or refer to the Customer and assist under the DPA, unless prohibited by law.

22.7 Complaint handling does not extend individual-rights deadlines or restrict access to the ICO or legal remedies.

23. Changes to these Terms

23.1 A Supplier may change these Terms or the DPA by giving at least 30 days’ notice by email to the Customer’s administrator contact and in the Product, except earlier changes required by law or urgent security needs. Changes are prospective, and the Customer may cancel before a material adverse change takes effect. Where a change requires the Customer’s agreement, including any new processing purpose, a Customer Administrator will be asked to accept the new version in the Product. Fixed-term changes follow the Order.

23.2 New agreements, purposes or processing permissions require the appropriate process. Continued login does not retrospectively authorise new cross-company processing or a new paid Product. Accepted versions and valid changes remain recorded.

24. General

24.1 The Customer may not transfer a Product Agreement without the relevant Supplier’s written consent. A Supplier may transfer a Product Agreement to another Augora company or to a successor to its business on written notice, provided agreed protections and data-protection duties are preserved.

24.2 Events beyond reasonable control excuse affected performance only to the extent it could not reasonably be prevented or mitigated. Reasonable continuity and mitigation remain required; accrued payments and security, data-protection and agreed backup duties are not disregarded.

24.3 The Product Agreement is the entire agreement for its service. The Customer has not relied on any statement not set out in it, but nothing limits liability for fraud. Waivers must be clear; invalid terms are severed only where lawful. No partnership or general agency is created. Non-parties have no enforcement rights under the Contracts (Rights of Third Parties) Act 1999 except express or mandatory rights.

24.4 English and Welsh law and courts govern, without restricting mandatory rights or urgent protective relief in a competent jurisdiction.

O1. Scope

O1.1 Augora OS Limited supplies the CRM, client records, released document and workflow functions and other modules included in the Order. It supports a main working record system within that scope; the Customer determines regulatory retention requirements.

O1.2 Initial access is for authorised business users, not direct retail-client or regulator accounts. Customers may share authorised audit exports with reviewers. Later external access and integrations require appropriate terms, permissions and processing arrangements.

O2. Aulo and records

O2.1 Aulo assists with queries, field completion, cases and supported administration. It does not give product or investment advice; initial scope does not execute investment instructions or initiate payments. Approval and future automation follow clause 10.

O2.2 Supported human/agent audit records are available to authorised firm personnel. Coverage, export and retention follow the service information and DPA; no immutable or regulator-certified record is implied. Health, vulnerability, banking and identity records may be stored only where lawful and necessary.

O3. Pricing

O3.1 All OS pricing is customer-specific and recorded in the Order, together with the billable-user basis, term, usage model and Add-ons. No minimum user count applies unless expressly agreed. Prices exclude VAT and applicable taxes.

O3.2 Aulo access may be included on the section O5 fair-use basis without a fixed numerical allowance. Separately purchased capacity and Add-ons require agreed pricing; paid core CRM, manual records access and standard export are not disabled simply because optional usage is exhausted.

O4. Infrastructure and exit

O4.1 Augora Limited provides contracted shared infrastructure services to OS. Relevant providers and processing routes are identified in the DPA. OS retains its customer-facing obligations despite shared infrastructure.

O4.2 Security, recovery, retention and exports follow the completed DPA schedules. A separate database or use of AWS does not by itself promise a particular recovery level.

O5. Aulo fair usage policy

O5.1 Included Aulo access supports ordinary internal business administration on a fair-use basis. Unless the Order expressly states an allowance, no fixed number of prompts, tasks, tokens or processing hours is guaranteed. This is not unlimited capacity or a reduction of reasonable-care duties.

O5.2 Fair use is assessed reasonably and consistently against the plan, licensed users, advertised workflows, request volume, frequency, complexity, parallel activity, resources consumed and impact on capacity or other users. Materially disproportionate lawful usage may be limited; merely exceeding an average is insufficient.

O5.3 The Supplier may reasonably and proportionately rate-limit, queue or defer work, restrict concurrent tasks or temporarily limit affected Aulo functions to address disproportionate usage, abuse, security or service disruption. Restrictions must be no broader or longer than necessary.

O5.4 Relevant examples include excessive unattended, repeated or bulk runs, circumventing controls and general-purpose computing outside the agreed scope. Supported automation is not inherently misuse. Supplier-caused loops, faults or retries must not be attributed to Customer misuse.

O5.5 Where practicable, notify an Administrator before material restriction, explain it and allow adjustment. Urgent automated controls may operate immediately, followed by explanation, affected functionality and duration or resumption conditions. Review requests go to support@augora.co; restrictions must be adjusted or removed when unjustified. Sensitive detection details need not be disclosed.

O5.6 Internal thresholds may evolve within these criteria, not conceal a fixed contractual allowance, reduce purchased entitlements or impose retrospective charges. Material new recurring caps or reductions in normal permitted use follow clause 23. Additional capacity or charges require Customer approval.

O5.7 Fair-use controls alone do not restrict paid core CRM, manual records, supported audit access, standard export or separate Agents access. High usage alone does not bypass clause 20.2 notice. Persistent material withdrawal of normal functionality engages clause 17.3 remedies.

O5.8 Monitoring must be proportionate and consistent with the DPA and privacy notice. Fair use does not expand access to client content or training permissions.