Terms of Service

Version 1, in force from 11 October 2026.

We publish these terms in English and Polish. The Polish version is a translation of the English one; where the translation differs from the English text, the English text applies.

1. Who you are contracting with

Daidala AI Konrad Makowski, Snopków 20, 21-002 Jastków, Poland.
Polish tax identification number (NIP) 713-274-23-92.
Email: support@daidala.tech.

Below, "we" and "us" means Daidala AI Konrad Makowski, and "you" means the business buying the service. The service is Daidala.

2. Who can buy

We sell Daidala to businesses only. You can buy if you run a business - a company, a partnership or a sole trader - and you are buying for that business. We do not offer this service to consumers.

To buy, you give us your business name and your tax identification number. We may check the number. If we find out after the sale that the buyer was in fact a consumer, we may end the contract and refund what was paid.

By buying, you also confirm that neither you nor anyone who owns or controls your business is on a sanctions list that applies to us - an EU, United Nations or Polish one - and that you will not make Daidala available to anyone who is. We may ask you for what we reasonably need to check this, and we may refuse to sell to you before the contract is made. If sanctions law later stops us from providing the service to you, section 7 says what happens.

3. What you get

• your own Daidala instance at an address you choose, your-name.daidala.tech;
• an admin panel at panel.your-name.daidala.tech;
• your own GitLab™ at gitlab.your-name.daidala.tech;
• Redmine inside your instance, in the language you picked when you bought - the purchase page says which languages we offer.

You use all of it in a web browser. One account can run one instance.

We set up your instance right after your payment. Your account then shows the access details for your instance one time only, so save them when they appear.

It can also be the other way round: we set your instance up for you before you bought anything, you worked on it while it was free of charge, and then you bought a subscription for it in our shop. Your subscription then carries on with the instance you already have - we do not set up a second one, and nothing on it is lost. Its address, its Redmine language and the accounts it was handed over on are from the day we set it up, so the purchase page does not offer them and you do not choose them there.

4. What you need

A current web browser, a working internet connection and an email address you can receive mail at. We sign you in with a code sent to that address, so without it you cannot get in.

You also need your own paid access to an AI provider - a subscription on your own account with that provider. It is not part of what you pay us and we do not sell it. Until you connect it, your instance runs but its AI side does nothing: the agents cannot work. The purchase page says which providers Daidala supports. Section 18 explains how this works.

5. How the contract is made

You sign in with your email address, fill in the purchase form and pay by card. Payments go through Stripe: your card details go to Stripe and never reach us. The contract is made when your payment goes through. We then email you a confirmation of what you agreed to. Keep that email - it is your copy of the contract.

This is also how the contract is made when your instance was already running free of charge: it is made when your payment goes through, and not earlier. What we agreed with you by email for that free period was a separate contract; from this purchase on it no longer applies to what comes next, and what happened under it before that stays as it was. From that moment these terms are the whole of what applies between us. The purchase page tells you which instance you are buying the subscription for; you do not pick its address or its language there, because they are from the day we set it up.

6. Price, tax and invoices

The price is 249 EUR net per month, unless we agreed a different net price with you before your purchase. Before you place your order, the purchase page shows the price that applies to you and the exact amount you will be charged; our confirmation email repeats that amount. What you pay on top of the price depends on where your business is and on the tax number you gave us:

• business in Poland: 23% Polish VAT - at 249 EUR that comes to 306.27 EUR;
• business in another EU country, with a VAT number we can confirm: no VAT charged - you account for the tax yourself under the reverse charge;
• business outside the EU: no VAT charged.

We issue an electronic invoice for every period and send it to the invoice email address you gave us. By buying, you agree to receive invoices electronically.

If we cannot confirm your EU VAT number because the EU checking service does not answer at that moment, we charge 23% Polish VAT. If you confirm the number to us later, we issue a corrected invoice and refund the difference.

The price is net of any tax that the law of your country requires you to deduct from what you pay us. Where such a deduction applies, you pay us whatever more is needed for us to receive the full amount on the invoice, and you send us the official confirmation that the deducted tax was paid. You cannot take that tax off a later payment to us or set it off against anything we owe you.

If you need a certificate of our tax residence to deduct less, write to support@daidala.tech. We will apply for it to the Polish tax authority and send it to you as soon as we have it.

7. How long the contract runs and how it ends

The contract runs month to month. At the start of each new period we charge the same amount to the card you paid with. There is no minimum term, and you do not have to give us notice.

You end it by turning off renewal in your account. Your service keeps running to the end of the period you have already paid for, at no extra cost. You can turn renewal back on until that period ends.

We end it in these cases and no others. We never end your contract just because we decide to:

• your payment fails. Your service keeps running for 3 days after the first failed payment. If the payment still has not gone through by then, we switch your instance off. If it has not gone through 14 days after the first failure, the contract ends;
• you break section 9, we ask you to stop, and you do not stop;
• the law, a court or a public authority stops us from providing the service to you;
• your instance is putting other systems at risk - it has been broken into, or it is being used to attack other systems or to send spam - and there is no other way to stop it. This is not the same as breaking section 9: there it has to be your fault and we have to ask you to stop first, while here what counts is the risk itself;
• we can no longer provide the service at all - the company we rent our servers from stops providing them for good and we have no replacement, or we stop running Daidala as a product;
• we find out after the sale that the buyer was in fact a consumer, as section 2 describes;
• your business is outside the European Economic Area and you break the standard contractual clauses in section 10, in the cases those clauses set out.

How we end it. If your payment fails, the contract ends once the days set out above have run out, and we send you no email beforehand. In every other case we email you first, at the address on your account. That email says which of the cases above applies and the day your contract ends. That day is at least 14 days after we send the email, and your contract ends on that day, not before.

In two of the cases we end it straight away, without those 14 days: where the law, a court or a public authority stops us from providing the service, and where your instance is putting other systems at risk. You still get the email, and it still says which case applies.

Moving to another provider. Ending the contract this way takes nothing away from what section 16 gives you: you can still ask for the time to move to another provider, and we keep your service running while you use it. The two cases where we end it straight away are the exception - there we cannot keep your service running.

What you get back. When we end the contract, we pay you back the part of what you paid that covers the days you no longer get. It goes back to the card you paid with, within 14 days of the day your contract ends. Two of the cases work differently: where your payment failed there is nothing to pay back, and where the buyer was in fact a consumer we pay back everything that was paid, as section 2 says.

Your data. Nothing changes here, in any of these cases. Your data package, and the days you have to download it, are the same as at any other ending - the rest of this section and section 16 apply just as they do otherwise.

Section 8 is a separate right that the law gives you, and nothing in this section takes it away or makes it harder to use. Your data package reaches you there too - section 8 says how.

While the contract runs, you can ask us at any time for a copy of your data, and we give it to you in the same formats, at no charge.

When the contract ends, we take your instance down. Before the server goes, we pack what it held - your Redmine database, your Daidala state database with the keys that unlock its encrypted parts, the files uploaded to Redmine, your GitLab data and the server configuration - into one archive, your data package, and put it in your account.

You can download it for at least 30 days. Those days are counted from the end of the time you got to move to another provider (section 16) or, if you did not ask for that time, from the day the contract ended. If your data package only reaches your account later than that, they are counted from the day it appears there. The same goes if we complete a package that was missing something (section 16). Your account shows the last day you can download it. After that we erase the package and cannot bring it back.

Section 16 sets out how you move to another provider or to your own infrastructure, and what we hand over.

Sometimes the law forbids us to pay money to you - this happens where you are on a sanctions list, or where a court or a public authority tells us we must not pay you. Then we do not pay it back for as long as that lasts. The money stays yours: we do not use it, we keep a record of it, and we pay it to you as soon as the law lets us, or we pay it where the law tells us to. We email you that this has happened and why, unless the law does not allow us to tell you.

8. Right of withdrawal

This section does not give you any right beyond what the law gives. It applies only where the law gives you a right of withdrawal: when you are a sole trader and your purchase is not connected with the trade you carry on (art. 7aa of the Polish Consumer Rights Act). If you buy for a company, or as a sole trader for your own trade, you have no right of withdrawal and this section does not apply to you.

Where it applies:

• you can withdraw from the contract within 14 days without giving a reason. The 14 days run from the day the contract was made, which is the day your payment went through;
• to withdraw, send us a clear statement that you are withdrawing - by email to support@daidala.tech, or by post to the address in section 1. You can use the model form below, but you do not have to. It is enough to send the statement before the 14 days are over - it does not matter when we read it;
• we refund what you paid within 14 days of receiving your statement, to the card you paid with, at no cost to you. If the law forbids us to pay money to you, the last paragraph of section 7 applies here too;
• if you asked us to start the service straight away, or to carry on with an instance that was already running - you do this by ticking the box on the purchase page - you pay for the part of the service provided from the day you paid up to the time you withdraw. That amount is a proportion of the full price you paid. We deduct it from the refund and pay you the rest. Time your instance ran free of charge before you paid is not part of that amount, however long it was;
• withdrawing ends your service and we take your instance down with everything on it - including the work you did on it before you bought, if it was running free of charge before then. Before the server goes, we pack up your data and put the package in your account, just as at any other ending: what is in it, and how long you have to download it, are the same as sections 7 and 16 describe. Taking your instance down takes none of that away from you.

9. What you may not do

You may not put unlawful content on your instance, or use it to break the law or to harm other people's systems. You are responsible for what you, and the people you give access to, put there.

If we are notified that your instance holds unlawful content, the law may require us to act on that notice. We will tell you when we do, unless the law does not allow us to.

The "(AI)" marking. Every agent account on your instance carries "(AI)" in its name, and its login begins with "agent-". That marking is how anyone reading what an agent wrote can tell that they are reading the work of an AI system and not of a person. You are the admin of your instance, so you can change it - you may not. You may not remove it, hide it, or rename an agent so that it looks like a human being.

What you may not use Daidala for. You may not use Daidala, or what it produces, to take or prepare decisions about people in the areas EU law treats as high risk (Annex III to Regulation (EU) 2024/1689, the AI Act):

• recruiting or selecting people, targeting job adverts, filtering applications, evaluating candidates;
• deciding on someone's pay, promotion, tasks or dismissal, or monitoring or evaluating people at work;
• deciding who gets essential private or public services and benefits, including credit scoring and the pricing of life and health insurance;
• deciding on access to education, grading people, or watching them during tests;
• identifying or categorising people by biometric data, or recognising emotions;
• running critical infrastructure as a safety component;
• law enforcement, migration, asylum or border control;
• the administration of justice, democratic processes, or influencing how people vote.

This applies whether Daidala takes the decision or only feeds into one that a person then takes. Having a person in the loop does not make it allowed.

You also may not rebuild or reconfigure Daidala into a system that does any of this. As Article 25(2) of that Regulation allows us to, we state it plainly: Daidala is not to be turned into a high-risk AI system. If you do it anyway, the law may treat you as the provider of the system you made, with everything that follows from that for you.

The GitLab trademark notice and logo on your instance. Your instance runs GitLab software. Because of that it carries a notice saying that the product is based on GitLab software and that GITLAB is a trademark of GitLab Inc., and it carries our logo where GitLab's own logo would otherwise be. GitLab's trademark guidelines require this of whoever hosts the software as part of a paid service, so the duty is ours - but the settings that hold it are in your hands, because you are the admin of your instance. You may not remove the notice or change its wording, and you may not put GitLab's logo back in place of ours. We restore both whenever we deploy your instance.

10. Data processing agreement

This section covers the data you keep on your instance. If that includes personal data, you decide what happens to it, and we handle it only to run the service for you. In GDPR terms, you are the controller and we are the processor. This section is the agreement between us that the GDPR requires for that (art. 28(3)).

What we handle and for how long. Whatever you, and the people you give access to, put on your instance - usually data about your staff, your clients and your other contacts. We store it and keep your instance running. We do this while the contract runs and for as long as your data package is available afterwards (section 7). Anything you, or the people you give access to, delete from your instance can still be in the daily copies of the server (section 11). We cannot take a single item out of a copy: what you deleted is gone from them once a newer copy has replaced every copy that held it. When we take your instance down at the end of the contract, the copies go with it (sections 11 and 16). Bear that in mind when you answer someone asking you to erase their data.

Your instructions. These terms, and what you do in the service, are your instructions to us.

We:

• handle personal data on your instance only to provide the service, and only on your instructions. If the law requires us to do something else with it, we tell you first, unless the law does not allow us to;
• tell you if we think an instruction of yours breaks data protection law;
• give access to it only to the people who need it to run the service, and make sure each of them is bound to keep it confidential;
• protect it with measures appropriate to the risk (art. 32 GDPR);
• help you answer requests from the people the data is about, as far as the service allows;
• help you meet your obligations on security, personal data breaches and data protection impact assessments (arts. 32-36 GDPR), as far as the service and the information we have allow;
• tell you without undue delay if we learn of a personal data breach affecting your instance;
• when the contract ends, either hand the data back to you in the data package described in section 7 or erase it - whichever you asked us for (section 16). If you asked for the package, we erase what is left once the time for downloading it is over; if you asked us to erase your data, there is no package and we erase all of it at the end of the contract;
• give you, on request, the information you need to show that we meet this section, and allow and contribute to audits, including inspections, by you or an auditor you appoint.

Where the data is and who else handles it. Your instance runs on a server we rent from Hetzner Online GmbH (Gunzenhausen, Germany), in one of its data centres in the European Union. Your data package is kept on our own servers in Poland. The data on your instance leaves the European Union in three cases: it goes to you, if your business is established elsewhere; it goes to the AI provider whose access you connected, because that is where your agents' work runs; and it goes to an AI client that you connect to your instance yourself. We do not move it out of the European Union in any other way. The paragraph "If your business is outside the European Economic Area" below says what covers the first case. Section 18 says what the other two are.

You agree to us using Hetzner for this. Any company that handles the data on your instance for us is bound by the same data protection obligations as we are under this section, and we remain responsible to you for what it does. We will email you at least 14 days before we add or replace such a company, so that you can object. If you object and we still go ahead, you can end the contract before the change takes effect.

We do not use the content of your instance for anything else. We do not train models on it.

If your business is outside the European Economic Area. You, and the people you give access to, reach your instance from wherever you are. The European Economic Area is the European Union plus Iceland, Liechtenstein and Norway. If your business is established outside it, then our making the data on your instance available to you is a transfer of personal data to a third country under Chapter V of the GDPR: you are the controller of that data and we are your processor in the European Union. That transfer covers your instance while the contract runs, the copy of your data we give you on request and your data package (sections 7 and 16).

What covers that transfer. We use the standard contractual clauses the European Commission adopted for exactly this case: Module Four (transfer processor to controller) of the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. Their full text is on EUR-Lex, the European Union's official law database. They apply between us and you as part of this contract, in the wording the Commission adopted - we do not change a word of it. Where they say something different from the rest of these terms, they apply on that point and these terms do not (their Clause 5). You accept them when you accept these terms, which is when you pay for the service (section 5). If the Commission has decided that your country protects personal data adequately, that decision covers the transfer as well; we apply the clauses either way, so that the same rules cover every buyer outside the European Economic Area.

What the clauses leave to us and you to fill in. The clauses leave some entries to the two sides. For this contract:

• who the parties are (their Annex I.A): we are the data exporter and the processor - our name, address and email are in section 1. You are the data importer and the controller - your business name, address and tax identification number are the ones you gave us with your order, and the email address on your account is where we write to you about data protection. It is also the contact point for complaints that their Clause 11 asks you to give the people the data is about. We both enter into the clauses by accepting these terms, on the day the contract is made (section 5);
• what is transferred (their Annex I.B): whatever you, and the people you give access to, keep on your instance - usually data about your staff, your clients and your other contacts, including any special categories of data you choose to keep there, which we protect as this section says. We make it available to you continuously, by running your instance and through the copy of your data we give you on request and your data package (sections 7 and 16), only to provide the service to you, and for as long as this section says we handle it;
• whose law and whose courts (their Clauses 17 and 18): Polish law and the Polish courts, as in section 14. Polish law lets the people the data is about enforce the clauses against us and against you, which is what the clauses require;
• nothing else is open: Module Four leaves their Annex I.C, Annex II and Annex III blank, we do not use their optional docking clause (their Clause 7), and we do not name the optional dispute resolution body they let us name (their Clause 11). If you break the clauses, they require us to stop making the data on your instance available to you until you put it right, and they let us end the contract if you do not - section 7 says how.

11. Availability, backups and our liability

We owe you the service described in section 3, working as described. We do not promise any particular level of availability, and we do not guarantee that the service is free of faults. We carry out maintenance and fix the faults we know about.

Backing up your data is up to you. Our hosting provider does copy the server your instance runs on once a day, and keeps the last seven copies, each new one replacing the oldest. Those copies are ours: we have them so that we can bring the service back after a failure on our side, and whether we use one is our call. We do not promise to put your instance back to how it was - not when you ask us to, not to a moment you choose, and not within any set time. You can ask us for a copy of your data at any time (section 7), but that is a copy of how things stand when you ask. The copies are tied to that server: when we take your instance down at the end of the contract, we erase them too (sections 7 and 16).

Our liability to you for anything connected with this contract is limited to the amount you paid us for the period in which the problem happened. We are not liable for your lost profits, or for losses we could not have foreseen. None of this limits our liability for damage we cause deliberately or through gross negligence, or where the law does not allow it to be limited.

12. Complaints

Write to support@daidala.tech. Tell us what is not working and what you would like us to do. We reply to complaints within 14 days.

13. Changes to these terms

We may change these terms where there is a reason to - a change in the law, in the service itself, or in what it costs us to run it. We will email you at least 14 days before a change takes effect, and the new version will be on this page. If you do not accept the change, turn off renewal before it takes effect - your service then runs to the end of the period you have paid for, on the old terms.

We may change the price in the same way. A new price never applies to a period you have already paid for.

14. Law and courts

Polish law applies to this contract. Disputes go to the Polish court with jurisdiction over our registered address.

15. Your personal data as our customer

Section 10 covers the data on your instance. The data we hold about you as our customer - your name, address, tax number, email and payment records - is described on our privacy page, along with how long we keep it and what you can ask us for.

16. Moving to another provider and leaving

You can move to another provider of a service like this one, or to your own infrastructure, whenever you want. We will not put commercial, technical, contractual or organisational obstacles in your way.

How you start, and how soon you can leave. Turn off renewal in your account, or email support@daidala.tech and tell us you are leaving. The contract then runs to the end of the period you have already paid for, so you never wait more than a month to leave.

The time you get to move. If you ask us, we keep your service running for up to 30 days after the day your contract would have ended, so that you have time to move. This contract still applies during that time, and we:

• help you, and any provider you are moving to, as far as is reasonable;
• keep the service running as it ran before, and take care that it keeps running;
• keep the same level of security, while your data is being moved and during the days you have to download your data package;
• tell you about anything we know of that could get in the way.

You can extend this time once, for as long as you need - email us and say so. You pay the normal monthly price for as long as the service keeps running. Moving itself costs you nothing.

Help with the move. If you ask, we give you what you need to know to move: how your data is arranged, what formats it is in, and anything we know of that could get in the way. You can get your data during this time too, not only after your instance is taken down. Our switching page goes through all of this step by step.

What we hand over. This list is complete - these are all the categories of data and digital assets we hand over:

• your Redmine database;
• your Daidala state database;
• the keys that unlock the parts of your Daidala state database we store encrypted;
• the files uploaded to Redmine;
• your GitLab: your repositories and the data GitLab keeps with them;
• the configuration of your server, without the access details to your instance - section 3 says how you get those.

You get all of it in one package, as SQL dumps, tar archives, git bundles and plain text files. Our register of data structures and formats describes them in full, and we keep that page up to date.

What we keep back. Nothing of yours. The only things not in your package are the Daidala software itself and our own records of running the service - the credentials, keys and settings we use to run our own infrastructure. Those are ours, not yours, and keeping them back never holds up your move. The keys that unlock your own data are not among them: they are in your package. The access details to your instance are not in your package either, and they are not held back: you get them from us once, when we hand your instance over (section 3).

If something is missing from your package. We build your package from what we can read on your instance. If we cannot read one of the things listed above when we build it, we build the package from the rest, and we tell you straight away - in your account and by email - what is missing and whether we can still get it.

If we can still read it on your instance, we add it to your package. That costs you nothing and we do it without delay, and your 30 days then run from the day the completed package appears in your account. If your instance is already gone, that data is gone with it: we say so, and we do not leave you waiting for it.

If you tell us your package is not complete (section 12), we do not erase it while that is open, and we erase it once it is settled. None of this changes what section 11 says about our liability.

Telling us what you want, and the end of the contract. Before the day your contract would have ended, email support@daidala.tech and tell us which of these you want:

• to move to another provider - then give us that provider's details;
• to move to your own infrastructure;
• to have your data erased.

If you tell us nothing, we do what section 7 describes: your data package goes to your account and waits there for you. You can change your mind at any time until the contract ends. The contract ends when your move is done or, if you asked us to erase your data, at the end of the period you have paid for. We email you to confirm that it has ended.

Getting your data afterwards. If you asked us to erase your data, there is no package: we erase your data when the contract ends, and the email we send you says so. Erasing covers everything on your instance and your data package. It does not cover your orders and invoices, which the law makes us keep (section 15).

Otherwise your data package waits in your account for at least 30 days, counted from the end of the time you got to move or, if you did not ask for that time, from the day the contract ended. After that we erase all of it for good and cannot bring it back. Section 7 says how these days are counted if the package reaches your account later than that.

What this costs. Moving to another provider costs you nothing, and we charge you nothing for handing over your data. There is no penalty for ending the contract early. Our switching page sets out what we charge and whose law applies to the infrastructure your data sits on, including how we keep data that is not personal data out of the reach of authorities outside the EU.

Section 8 is a separate right that the law gives you, and nothing in this section takes it away or makes it harder to use. Your data package reaches you there too - section 8 says how.

17. Daidala as an AI system, and who answers for what

Daidala is an AI system as EU law defines it (Regulation (EU) 2024/1689, the AI Act). We are its provider. You, using it in your business, are its deployer. That split decides who answers for what: we answer for the software, you answer for what you use it for and for what you do with what it produces.

Daidala works through agents. An agent is a user account run by an AI system, not by a person. Everything agents produce - notes and descriptions of issues, wiki pages, descriptions of changes to your repositories, source code - is produced by an AI system. Agent accounts are marked so that anyone can tell: "(AI)" in the name, "agent-" at the start of the login. Section 9 says you may not take that marking off.

If you publish what your agents produce, the law puts duties on you, not on us:

• text you publish to inform the public on a matter of public interest has to say that it was generated by an AI system - unless a person has reviewed it and someone takes editorial responsibility for publishing it;
• images, audio or video that are deep fakes have to say that they were generated or manipulated.

This matters most if you run marketing agents, or anything else that produces content you publish. We do not see what you publish, we do not do this for you, and we cannot do it on your behalf. The marking on the agent accounts is not that disclosure, and it does not travel with text you copy out of your instance. Do not assume that anything in the content carries the disclosure for you.

You also have to see to it that the people who work with Daidala on your side know enough about AI to use it sensibly. The AI Act calls this AI literacy (Article 4).

18. The AI access you connect

Daidala does not come with access to AI models. You connect your own - a subscription on your own account with an AI provider that Daidala supports. You can connect more than one account: Daidala uses the connected accounts in turn and does not tie any of them to a particular person, so work done by anyone in your instance may run on any account you have connected. We do not sell that access, we do not resell anyone's subscription, and we are not anyone's agent, reseller or partner.

What your agents do is charged to the account it runs on, and runs under that provider's prices, limits and terms. For your agents to work at all, Daidala sends what they are working on to that provider - the content of your instance that the work needs: issues, notes, wiki pages and whatever else the agent reads or writes while doing it. That content leaves your instance and goes to the account you connected, including outside the European Union, if that is where the provider works. We send it to carry out your instructions: you choose the provider and the account, and connecting that access is your instruction to us to run your agents' work on it (art. 28(3)(a) GDPR, section 10). That provider is not one of the companies that handle your data for us under section 10 - it is your own, it handles what we send under your own agreement with it, and it is for you to decide whether you may send your data there.

By connecting your access, you tell us that:

• it is yours and you are allowed to use it;
• you have read your provider's terms and will keep to them, including what they say about sharing an account;
• you may use what you connect for work done by everyone in your instance, not only by the person the access is issued to;
• you will not connect several accounts with the same provider to get around limits that apply to one account, and will not get around that provider's rules in any other way.

What you connect is stored in your instance and used only to carry out your instructions there. We do not use it for ourselves or for anyone else. You can disconnect it whenever you want; what needs it then stops working.

If your provider suspends, limits or blocks your account, if you use up your limits, or if the provider changes its prices or terms or has an outage, your Daidala keeps running, but what needs that provider does not work until you connect access that works. That is not a fault in our service and we do not answer for it, unless we caused it. We also do not answer for what happens to you if you break your provider's terms. None of this limits our liability for damage we cause deliberately or through gross negligence, and none of it takes away rights the law gives you and does not allow us to exclude.

Connecting an AI client to your instance. It also works the other way round. Your instance can let an AI client of your own - the app or website you use to talk to your AI provider - reach the Redmine inside it: read what is there, and create and change issues. This is off until someone with an account in your instance turns it on. Turning it on means signing in to your instance and granting that client access to that person's own Redmine account; the client can do no more there than that account can. Whoever granted it can withdraw it in their Redmine account at any time, and the client then stops reaching your instance.

What that client asks for leaves your instance and goes to the account you connected it to, and your provider handles it under your own agreement with that provider - including outside the European Union, if that is where the provider works. This is you sending your own data to your own provider: you choose the client and the account, and you are instructing us to make the data available to it (art. 28(3)(a) GDPR, section 10). That provider is not one of the companies that handle your data for us under section 10. We are not a party to your agreement with it, we do not choose it for you, and we do not answer for what it does with what you send it. The data on your instance is data you are the controller of, so it is for you to decide whether you may send it there.