Product Terms for Waterglass Waves

§ 1 Application and Relationship to the General Terms

(1) These product terms govern the use of the Waterglass Waves platform (hereinafter "Waves") of Waterglass FlexCo (hereinafter "we"). Our address and contact details are stated in the legal notice. Waves comprises the console at waves.waterglass.ai, the application programming interface, the command-line tools and the execution environments in which AI agents run.

(2) Part A of our General Terms and Conditions (General Terms) applies in addition. Part B of the General Terms does not apply to Waves, with the exception of the onboarding and support services of the "Managed" plan and other separately agreed services. In case of conflict these product terms prevail over the General Terms.

(3) Waves is offered exclusively to entrepreneurs within the meaning of § 1 UGB (Austrian Commercial Code) for use in the course of their business. By registering, the Client confirms that it is acting as an entrepreneur. § 1 paragraph 2 of the General Terms applies accordingly.

§ 2 Formation of Contract, Account and Credentials

(1) The contract for the use of Waves is formed upon registration of an account and acceptance of the General Terms. A paid plan is concluded upon completion of the checkout in the console. The "Managed" plan is agreed separately. The information duties under §§ 9 and 10 ECG (Austrian E-Commerce Act) are excluded to the extent permitted by law. Receipt of the registration is confirmed to the Client by the email confirming its email address.

(2) Each user account is assigned to exactly one organisation. The Client is the organisation. The person who creates the organisation is its owner and may invite further members. Only owners manage payment methods, the plan and API keys.

(3) The Client is responsible for all actions carried out through its organisation, its user accounts and its API keys. API keys are displayed once when created and must be kept secret. The Client keeps the group of authorised persons up to date and revokes keys and memberships that are no longer needed. Two-factor authentication is available for user accounts, and we recommend activating it. The Client reports the loss or misuse of credentials without delay to support@waterglass.ai.

(4) The Client ensures that the persons it invites are authorised to represent it and comply with these terms.

§ 3 Subject Matter, Right of Use and Support

(1) We provide Waves as software as a service over the internet for the term of the contract. The Client can define its own AI agents, equip them with tools, knowledge bases and connected services, and run them in isolated execution environments. The scope of functions follows from the current product description and the documentation. We are not obliged to hand over the software, to install it on the Client's systems or to release source code.

(2) For the term of the contract, the Client receives a non-exclusive, non-transferable right to use Waves within the scope of these terms for its own business purposes.

(3) The Client's content, data, configurations and work results remain its own. We receive only those rights in them that are necessary to provide the service. We do not use the Client's content to train or fine-tune AI models. This does not apply where the Client expressly orders such a service, in particular the distillation or fine-tuning of a model on its own content. Scope, remuneration and the rights in the result follow from the individual agreement. Such a model is trained exclusively on content of the ordering Client.

(4) We may use the Client's suggestions and feedback on Waves without remuneration to improve the service. Functions marked as preview or beta are provided for trial. They may be changed or discontinued at any time, and no warranty applies to them.

(5) We provide support by email and through the console on business days. Response or resolution times are owed only where expressly agreed.

(6) The console includes an assistant that, on the Client's instruction, reads and changes settings, creates agents or starts runs. It acts on behalf of the person operating it. Its actions count as actions of the Client. Before actions that affect costs, access rights or stored data, the assistant asks for confirmation.

(7) The "Managed" plan additionally includes onboarding and support services that we agree separately. Part B of the General Terms applies to them. They are services unless the individual agreement defines work results subject to acceptance.

§ 4 Plans, Credit, Payment and VAT

(1) The list prices published on the product page apply in their current version. Which plans exist, which monthly credit a plan includes and which credit packages can be purchased follow from the price overview published there. Self-service plans are billed monthly in advance through our payment service provider. The "Managed" plan is agreed and invoiced separately.

(2) All prices are net. Statutory VAT is added during checkout on the basis of the billing address provided there. Businesses in other member states of the European Union may provide a valid VAT identification number and are then invoiced under the reverse charge procedure. For Clients established in Austria, Austrian VAT applies even where a VAT identification number is provided. Clients established outside the European Union are invoiced without VAT and are themselves responsible for taxes in their country of establishment.

(3) Use of the AI models is billed by consumption against credit. Credit can be purchased in the packages named in the price overview and requires an active plan. The net amount is credited in each case. VAT is collected on behalf of the state and is not part of the credit. Purchased credit is valid for twelve months from purchase. Purchased credit not used by the end of that period lapses. Credit granted free of charge, in particular starter credit and the monthly credit included in a plan, is time-limited and expires at the end of the stated period. It is consumed before purchased credit. Credit is not paid out in money.

(4) Where offered, we grant starter credit once per organisation. Its amount and validity period follow from the product page. It requires a stored payment method and a confirmed email address, but not a paid plan. No charge is made in the process.

(5) Automatic credit top-up is deactivated by default. If the Client activates it, the Client sets the threshold, the amount and the monthly cap itself, within the limits stated in the console. Consent to recurring charges can be withdrawn at any time. We deactivate the top-up ourselves if a charge is declined, if charges fail repeatedly or if the plan ends.

(6) There is no claim to a refund of purchased credit unless the law provides otherwise. If we refund a payment for credit or it is charged back, we reverse the credit granted from it in proportion to the net amount. Purchased credit already consumed is recorded as an outstanding amount and offset against future credit. If the fee for a plan is refunded, we withdraw the monthly credit included in it without recording an outstanding amount. New runs are started only if a minimum credit balance stated in the console is available.

(7) We may change the list prices and the composition of the plans. We announce changes at least 30 days in advance in the console and in text form and apply them only from the next billing period. Credit already purchased is unaffected. If continuation at the changed price is unreasonable for the Client, the Client may terminate the contract with effect from the date the change takes effect.

(8) For self-service plans we may change the list price under paragraph 7 instead of applying indexation under § 7 of the General Terms. Only one of the two applies to any billing period, and a list-price change resets the indexation base. The termination right under paragraph 7 exists to the extent the increase exceeds the change in the index since the last adjustment. § 7 of the General Terms applies to the "Managed" plan.

§ 5 Term, Termination, End of Contract and Data Export

(1) Self-service plans run for one month and renew for one further month at a time unless terminated by the end of the current billing period. Termination is made through the payment service provider's self-service portal linked in the console or in text form to support@waterglass.ai. There is no pro-rata refund of the monthly fee. The agreed term applies to the "Managed" plan. An account without a plan may be terminated at any time.

(2) The right to terminate for good cause remains unaffected. § 22 paragraph 2 of the General Terms applies accordingly. Unused credit lapses at the end of the contract. No refund is made.

(3) When the termination takes effect, use of the platform for new runs ends. The export of data, the transitional period, the retrieval period and the subsequent deletion are governed by § 5a. The Client may request deletion earlier at any time.

(4) We retain invoices and the associated records for seven years (§ 132 BAO, Austrian Federal Fiscal Code). Data in encrypted backups is deleted at the end of the backup cycle.

§ 5a Switching Providers and Data Portability

(1) The Client is entitled at any time to switch to another data processing service, to take its data into its own infrastructure or to use Waves alongside other services. Switching is initiated by ordinary termination under § 5 paragraph 1, and no notice period longer than that need be observed. Termination may also be declared without switching to another service. This section implements Chapter VI of Regulation (EU) 2023/2854 (Data Act).

(2) The transitional period is 30 days from the date the termination takes effect. During the transitional period, access to the account, the organisation and the data remains in place for the purpose of export, and we support the Client to a reasonable extent in migrating the exportable data to the new service or its own infrastructure. Where the transitional period cannot be met for technical reasons, we notify the Client with reasons within 14 working days of receipt of the termination and state an alternative transitional period of no more than seven months. At the Client's request, the transitional period is extended once by a reasonable period.

(3) Exportable data is all data and content the Client has brought into Waves or that arose during use, in particular the configurations of the AI agents including system instructions, notes and skills, the documents of the knowledge bases, the trails, artifacts and working directories of runs, and the consumption and credit history. Not exportable are the software and the execution environments of the platform and data subject to third-party rights, in particular vector representations generated by a model provider. Exportable data is provided in structured, commonly used and machine-readable formats, uploaded files in their original format, through the application programming interface and the command-line tools or, on request, as a complete export.

(4) After the transitional period we keep the exportable data available for retrieval for a further 30 days (retrieval period). Retrieval must be requested in text form. After the retrieval period we delete the account, the organisation and the content completely unless a statutory retention obligation applies. Data in encrypted backups is deleted at the end of the backup cycle.

(5) No fees are charged for switching, the transitional period or the export. Fees for services the Client uses during the transitional period beyond the export remain unaffected.

§ 6 Acceptable Use and Suspension

(1) The Client may not use Waves to generate, store or distribute unlawful or infringing content, to infringe the rights of third parties, to intrude into third-party systems or impair their availability, to send unsolicited bulk communications, to mine cryptocurrencies, or to circumvent the platform's security and isolation mechanisms, in particular the restriction of network traffic and the separation of execution environments.

(2) The Client does not use Waves for practices prohibited by Article 5 of the AI Act, and for high-risk applications within the meaning of Annex III of the AI Act only after express agreement with us. The Client is obliged to comply with the usage policies of the operator of the respective endpoint and of the developer of the selected model, which are linked in the console, and passes these obligations on to the persons to whom it opens access to its agents.

(3) Regardless of the model selected, it is not permitted to circumvent the safety and content filters of the models, to train or improve competing AI models with the outputs, to present AI-generated content to third parties as created by humans, to make decisions with legal effect or similarly significant impact on natural persons on a solely automated basis, to use results in the fields of law, health, finance, employment, housing and insurance without review by a qualified professional or to use them to provide services that require a professional licence, or to make consumer-facing applications available to persons under 18 years of age.

(4) The Client processes special categories of personal data within the meaning of Article 9 GDPR in Waves only where it has a valid legal basis and has taken the necessary measures.

(5) Passing access to third parties or reselling the service requires our consent in text form.

(6) In the event of a material breach, and in the event of acute security, abuse or legal risks, we are entitled to terminate individual runs, to remove content or restrict its visibility, to restrict functions or to suspend access temporarily. We inform the Client without delay in accordance with paragraph 8 and lift the measure as soon as its cause has ceased to apply. Where the Client is responsible for the suspension, the fee remains owed for its duration.

(7) Unlawful content stored in Waves may be reported to us at support@waterglass.ai. A report should contain the reasons why the content is considered unlawful, the precise designation or location of the content, the name and email address of the reporting person, and a statement that the information provided is accurate and complete to the best of that person's knowledge. We confirm receipt, examine the report diligently, impartially and without undue delay, and inform the reporting person of our decision.

(8) Where we remove content, restrict its visibility or suspend the account or individual functions, the Client receives a statement of reasons. It names the relevant facts, the contractual or legal basis of the measure, whether the measure is based on a report, and the possibility of raising objections against the decision at support@waterglass.ai. We examine objections within a reasonable period and lift the measure where it was not justified. Recourse to the courts remains unaffected. Paragraphs 6 to 8 implement Articles 14, 16 and 17 of Regulation (EU) 2022/2065 (Digital Services Act).

§ 7 AI Agents: Autonomy, Responsibility and Transparency

(1) AI agents in Waves act autonomously. They execute program code and commands in an isolated environment, create and modify files, retrieve websites where enabled by the Client, and act in connected third-party services. The Client determines which tools, network destinations and credentials are available to an agent and which AI model it uses. The Client is responsible for the instructions, configurations and credentials it stores, and for the consequences of its agents' actions.

(2) The results of AI agents may be incomplete, incorrect or unsuitable. § 5 of the General Terms applies in addition. The Client reviews results before use and does not base decisions with legal or economic effect on unreviewed results. For processes that should not run without human control, the Client provides such control.

(3) Where the Client uses agents towards its own customers, employees or other third parties, it is the deployer within the meaning of the AI Act. It clearly indicates in its applications and user interfaces that those persons are interacting with an AI system or that content is AI-generated, where the AI Act so requires (Article 50), marks AI-generated image, audio and video content in machine-readable form where prescribed, and fulfils the other deployer obligations, in particular the obligation of human oversight and of training the persons dealing with the system.

(4) Where an agent is given credentials and open internet access at the same time, instructions hidden in retrieved content may cause it to disclose those credentials or to carry out unwanted actions. We mask stored values in logs and trail data, but we cannot exclude this risk. The Client separates credentials and open internet access where it does not wish to bear this risk.

(5) The Client indemnifies us against third-party claims arising from its instructions, configurations and stored credentials or from the actions of its agents, and reimburses us the reasonable costs of legal defence. This does not apply to the extent we caused the claim through gross negligence or intent.

§ 8 Connected Services, Own Tool Servers and Model Providers

(1) The Client may connect third-party services to Waves. The connection is made through the Client's own authorisation in the respective service and with the permissions displayed in the process. The agent then acts with the identity and the permissions of the person who established the connection. The respective service's own terms apply to its use. We are not a party to those terms and owe neither the availability nor the functional scope of those services.

(2) We keep the access tokens of connected services in encrypted form and make them available to the respective run. For certain services it is not the execution environment but our platform that calls the service on the Client's behalf and stores the selection made by the Client for that purpose, such as shared files or permission scopes. The console states which variant applies when the connection is made.

(3) The Client may configure its own tool servers (MCP servers) and network destinations. The Client determines these recipients and the websites an agent retrieves. They are not subprocessors engaged by us. The Client is responsible for their selection, their lawfulness and the data transmitted to them.

(4) The Client determines which AI model provider processes the content of a run through its choice of model for each agent. The console states the provider and the country of processing for every model and warns where a configured fallback model is processed in a different country. We may adjust the selection of available models, in particular where a provider discontinues a model or changes its terms. § 5 paragraph 5 of the General Terms applies.

§ 9 Availability, Maintenance, Security and Changes to the Service

(1) We operate Waves with the diligence of a prudent businessperson and endeavour to achieve high availability. No particular level of availability is promised, not even under the "Managed" plan. An availability agreement exists only where it has been made expressly in text form. Periods during which Waves is unavailable or only partly available because of announced maintenance, faults at model providers, connected services or network operators, force majeure or causes attributable to the Client do not constitute a defect of the service.

(2) The platform's computing capacity is provided at one location in the European Union, and encrypted backups are kept at a second location in the same country. A failure of the operating location may lead to a complete interruption. We create backups of the database daily. They serve recovery after a failure, not the restoration of individual data deleted by the Client.

(3) Maintenance and update work may lead to interruptions. We endeavour to schedule plannable work at times of low use and, where reasonable, to give advance notice. We remedy defects in the service within a reasonable period. The Client's statutory rights in respect of continuing obligations remain unaffected.

(4) We develop Waves continuously. We may add, change or discontinue functions. We announce changes that materially restrict the contractually agreed use at least 30 days in advance in the console and in text form. Where continuation thereby becomes unreasonable for the Client, the Client may terminate the contract with effect from the date the change takes effect.

(5) Technical limits apply to use, in particular to the number of concurrent runs, the duration of a run, the resources of an execution environment, the number of stored objects and the frequency of requests. The applicable limits are published in the console and in the documentation. Higher limits may be agreed separately.

(6) We take technical and organisational security measures appropriate to the risk. They are described in the data processing agreement. We notify the Client of personal data breaches in accordance with the rules set out there.

§ 10 Customer Data, Data Processing and Subprocessors

(1) Where the Client processes personal data in Waves, it is the controller within the meaning of the GDPR and we are the processor. We process such data only to provide the service and in accordance with the Client's instructions. The Data Processing Agreement for Waterglass Waves is concluded upon acceptance of these terms. It prevails over these terms in matters of data protection.

(2) We engage subprocessors to provide the service. The current list, with purpose and country of processing, is published at subprocessors and forms an annex to the data processing agreement. We announce changes on that page and by email at least 14 days before they take effect. The Client may object to a change on compelling data protection grounds and, where no agreement can be reached, terminate the contract with effect from the date the change takes effect.

(3) To operate, secure and develop the platform, we evaluate usage data of runs, such as the model used, the number and type of steps, the type of trigger, token counts, duration, cost and whether a run succeeded. The content of a run is not part of this evaluation.

(4) We may additionally introduce an automated classification of content that assigns runs to fixed usage categories and quality indicators. Before we activate it, we inform the Client in the console and in text form. Personal information is removed before the classification as far as possible, the evaluation takes place exclusively within the European Union, only categories and indicators are retained and not the content, and no profiles of individual persons are formed. The Client may switch the classification off at any time in the settings with effect for the future. The provision of the service does not depend on it. For this evaluation for our own purposes we are the controller. Any use of content beyond this, in particular for training models, is governed exclusively by § 3 paragraph 3.

(5) Which data the platform processes in detail is described in the Privacy Notice for Waterglass Waves.

§ 11 Liability for Waves

(1) § 8 of the General Terms applies. Where the individual agreement provides for liability for slight negligence in deviation from § 8 paragraph 2 of the General Terms, the liability cap is the sum of the net fees the Client paid for Waves in the twelve months preceding the event giving rise to the damage, including purchased credit.

(2) For the loss of content we are liable, to the extent we are liable under § 8 of the General Terms, only to the extent the content could have been restored under the backup regime described in § 9 paragraph 2. The Client itself exports content it needs outside the platform.

§ 12 Changes to These Terms

§ 14 of the General Terms applies to changes to these product terms. We additionally point out changes in the console. An acceptance declared there is sufficient.