Terms of Service

Version 2.0. Last updated: 11 September 2026.

The short version

This summary is for convenience only. It is not part of the Agreement and the full Terms below govern.

• Koalr is a business tool. By using it you confirm you are acting for a business, not as a consumer.
• Paid plans start with a 7-day free trial that needs a card. If you do not cancel before the trial ends, the plan you chose is charged automatically and then renews until you cancel.
• The owner of your organisation can cancel at any time from the billing page. Cancellation takes effect at the end of the period you have paid for. Apart from a few specific cases set out in the Terms, we do not refund time you have already paid for.
• Agencies pay per live client site each month. A site is live once its first analysis has started. Adding a site is charged straight away, pro rata. Removing one stops it being billed from the next period.
• You own what you put in and what Koalr produces for you. We own Koalr.
• AI answers change constantly, and nobody can promise a mention or a citation. Check anything Koalr writes before you publish it.
• Our liability to you is capped, and some kinds of loss are excluded, as set out in section 24.
• English law applies.

1. About these Terms and who we are

1.1 These Terms of Service ("Terms") are a legal agreement between Koalr Limited (trading as Koalr) and the organisation that creates an account or otherwise uses the Service ("Customer", "you", "your"). Koalr Limited is a private limited company registered in England and Wales under company number 17333455, with its registered office at Tagus House, 9 Ocean Way, Southampton, Hampshire, SO14 3TJ, United Kingdom ("Koalr", "we", "us", "our").

1.2 The Terms govern access to and use of the koalr.ai website, the Koalr application at app.koalr.ai, the Koalr documentation, the Koalr MCP server and connectors, and every related feature, report, output and service we provide (together, the "Service").

1.3 You accept these Terms by doing any of the following: ticking a box or clicking a button that refers to them, creating an account, running a scan, starting a trial or subscription, or otherwise using the Service. We may keep a record of the date and version you accepted. If you do not agree to these Terms, do not use the Service.

1.4 If you use the Service on behalf of a company or other organisation, you confirm that you have authority to bind that organisation, and "you" means that organisation. If you do not have that authority, you must not use the Service. A person invited into an existing Organisation as a User, including a Client User, is bound under section 5.3 and does not become a Customer.

1.5 Business customers only. The Service is offered only to businesses, organisations and individuals acting wholly or mainly in the course of a trade, business, craft or profession. It is not offered to consumers. By using the Service you warrant that you are acting for business purposes, and you agree that laws that protect consumers do not apply to the Agreement. If you are a sole trader, you confirm that you use the Service wholly or mainly for your business. The individual accepting these Terms on your behalf, and every User, must be at least 18 years old.

1.6 Our Privacy Policy at koalr.ai/privacy explains how we handle personal data and forms part of these Terms. Where we process personal data on your behalf, the Data Processing Addendum in Schedule 1 applies.

1.7 You can save or print a copy of these Terms from koalr.ai/terms. The version that applies to you is the version in force when you use the Service, as changed under section 25.

1.8 Regulations 9(1), 9(2) and 11(1) of the Electronic Commerce (EC Directive) Regulations 2002 do not apply to the Agreement.

1.9 Contact. Questions about these Terms: legal@koalr.ai. Support, billing questions and complaints: support@koalr.ai. Privacy: privacy@koalr.ai. Post: Koalr Limited, Tagus House, 9 Ocean Way, Southampton, Hampshire, SO14 3TJ, United Kingdom. We handle complaints under section 18.4.

1.10 Earlier versions. These Terms replace the Terms of Service dated 1 June 2026. For customers who accepted that version, these Terms take effect 30 days after we notify the Organisation owner by email, subject to sections 25.1 and 25.3, and continued use after that date is acceptance.

2. Definitions

In these Terms the following words have the following meanings.

"Agreement" means these Terms, the Privacy Policy, the Data Processing Addendum, any Order Form, and the Documentation, together.

"Affiliate" means any entity that controls, is controlled by, or is under common control with a party.

"Agency Customer" means a Customer that uses the Service to monitor or manage Sites belonging to its Clients under the agency terms in section 10.

"AI Engine" means a third-party AI assistant, answer engine or AI search feature that the Service queries or reports on, for example ChatGPT, Google AI Overviews, Google AI Mode, Gemini, Perplexity, Microsoft Copilot and Claude.

"Business Day" means a day other than a Saturday, Sunday or public holiday in England.

"Client" means a business that an Agency Customer provides services to and for which the Agency Customer uses the Service.

"Client Site" means a Site that an Agency Customer adds to the Service for a Client.

"Client User" means a User who is a member of a Client's staff and has been given a login to that Client's Client Workspace by an Agency Customer.

"Client Workspace" means the workspace for one Client inside an Agency Customer's Organisation.

"Customer Data" means all data, content and materials that you or your Users submit to, connect to, or make available through the Service, including domains, brand names, competitor lists, tracked prompts, tone-of-voice documents, uploaded logos, published page addresses, and data imported from accounts you connect (such as Google Analytics, Google Search Console or Bing Webmaster Tools).

"Documentation" means the descriptions, plan and pricing pages, limits, guides and policies we publish for the Service at koalr.ai, docs.koalr.ai and within the application, as updated from time to time.

"Fees" means the amounts payable for the Service under your Plan or Order Form.

"Order Form" means a written order, quote or proposal for the Service that we and you have both signed or accepted, including any Enterprise agreement.

"Organisation" means the account container in the Service that holds your Sites, Users, settings and billing, and to which a subscription belongs. An Agency Customer's Organisation includes its Client Workspaces.

"Outputs" means the results the Service generates for you from Customer Data and third-party data, including visibility scores, metrics, captured AI answers, citation and source data, competitor analysis, recommendations, audits, content briefs, drafts, rewrites, reports and exports.

"Plan" means a self-serve subscription tier (for example Starter, Growth or Business), the agency per-site plan, or an Enterprise plan, in each case with the limits and features described in the Documentation at the time you subscribe.

"Site" means one website, domain or brand in one country market that you configure in the Service for tracking.

"Subscription Term" means the period for which you have paid or agreed to pay for a Plan, whether monthly, annual, or as set out in an Order Form.

"Third-Party Platforms" means AI Engines, search engines, data providers, analytics platforms, AI clients and agents, and other services that we do not control, including accounts and tools you connect to the Service.

"Trial" has the meaning in section 7.

"User" means each individual who accesses the Service under your Organisation, including your staff and contractors, Client Users, and anyone using your API keys, connector keys or MCP connections.

3. Order of precedence

3.1 If there is a conflict between the documents that make up the Agreement, the following order applies, highest first: (a) an Order Form; (b) the Data Processing Addendum; (c) these Terms; (d) the Privacy Policy; (e) the Documentation.

3.2 Terms in a purchase order, vendor portal or other document you issue do not form part of the Agreement unless we have signed a document that says so.

4. The Service

4.1 What Koalr does. Koalr is an AI visibility platform. It tracks how AI Engines mention, recommend and cite the brands and websites you choose in response to prompts, benchmarks that against competitors, and produces analysis, recommendations, audits and content to help you improve. To do this the Service queries AI Engines, retrieves publicly available web content, imports data from accounts you connect, and uses large language models to analyse and generate material.

4.2 Free scan. We may let you run a free scan of a domain before you create an account. Free scans are provided as-is, may be limited in scope and frequency, and may be changed or withdrawn at any time. A draft created by a free scan belongs to the first account that claims it, and unclaimed drafts may be deleted without notice. Scanning a domain gives no rights over that domain or its brand.

4.3 Documentation. The Documentation describes the current features, Plans, limits and engine coverage. We update it as the Service evolves.

4.4 Beta and preview features. We may offer features labelled beta, preview, early access, experimental or similar. They are provided for evaluation, may be incomplete or change without notice, may be withdrawn at any time, and are excluded from the warranty in section 22.2 and from any availability commitment.

4.5 Complimentary access. We may grant free, discounted or complimentary access to some or all of the Service, for example to beta users, partners, prospective customers and pitch workspaces. We may limit, change or withdraw complimentary access at any time. Complimentary access does not convert into a paid Plan unless you subscribe.

4.6 Changes to the Service. We may add, change, replace or remove features, engines, limits and integrations from time to time. Where a change materially reduces the core functionality, limits or features of a paid Plan during your current Subscription Term, we will tell you, and you may cancel the affected subscription under section 9 and receive a pro rata refund of prepaid Fees for the remainder of the Subscription Term. Changes to engine coverage, capture methods and refresh cadence caused by Third-Party Platforms are dealt with in section 13 and are not a material reduction for the purposes of this section unless we say otherwise.

5. Accounts, Organisations and Users

5.1 Registration. You must give accurate, complete and current information when you register and keep it up to date, including a working billing email address.

5.2 Organisation owner. Each Organisation has an owner. The owner controls billing, plan changes, cancellation, member management and deletion. We may treat instructions from the owner as your instructions. To change the owner, contact support@koalr.ai from the owner's email address. If the owner is unavailable, a director or other authorised officer of the Customer may request the change with evidence of their authority, and we may verify it before acting.

5.3 Users. You may invite Users to your Organisation and assign them roles and site access as the Service allows. There is no limit on the number of Users unless your Plan says otherwise. Users, including Client Users, use the Service under your Agreement and are not themselves Customers; by signing in each User agrees to comply with sections 11 and 14. You are responsible for every User and for everything done under your Organisation, whether or not you authorised it (other than acts of our staff under section 5.6), and you must make sure your Users comply with these Terms.

5.4 Credentials. You and your Users must keep passwords, API keys, connector keys and MCP sign-ins confidential and must not share logins. Tell us at support@koalr.ai promptly if you suspect unauthorised access to your Organisation.

5.5 One login per person; no evasion. Each User must use their own login. You must not create accounts or Organisations by automated means, or create multiple Organisations or accounts to evade Trial limits, Plan limits, suspension or termination.

5.6 Staff access. Our staff may access your Organisation to provide support, investigate problems, keep the Service secure, or as the law requires. Such access is attributed to the staff member concerned and limited to what is necessary.

6. Plans, limits and fair use

6.1 Plans. The Service is sold as Plans. Each Plan includes a number of Sites, tracked prompts per Site, competitors per Site, content briefs per month, and the engine coverage and refresh cadence described in the Documentation. The limits that apply to you are the limits published for your Plan when you subscribe, as changed under sections 4.6 and 25.

6.2 Self-serve Plan Sites are for your own brand. On the Starter, Growth and Business Plans, the Sites in your Plan are for websites, brands and country markets that you own or operate. They are not client slots. If you use the Service to track or manage websites or brands for third parties in return for payment, you must do so as an Agency Customer under section 10 or under an Enterprise Order Form. If this rule is broken we may require you to move to the correct Plan, charge the difference from the date the breach began, or suspend the Organisation.

6.3 Enforcement. The Service enforces limits automatically. When you reach a limit you will be unable to add Sites, prompts, competitors or briefs until you upgrade or remove items. You cannot select a Plan with fewer Sites than your Organisation already has; remove Sites first. If you select a Plan with a lower prompt cap than a Site already uses, you choose which prompts to keep, and the rest are disabled, not deleted.

6.4 Fair use. Some allowances are shared or capped in ways described in the Documentation, for example branded prompt allowances, analysis run frequency, in-app assistant usage, audits and content generation. Usage that is excessive relative to your Plan, automated in a way the Service is not designed for, or that degrades the Service for others is not permitted. We may throttle, limit or suspend such usage, giving notice first where practicable.

6.5 Add-ons. Optional add-ons (for example a daily refresh for an engine that is otherwise refreshed weekly) are described in the Documentation, are billed with your Plan, and follow the same term and cancellation rules as your Plan unless the Documentation says otherwise.

6.6 Enterprise. Enterprise Plans are sold by Order Form and may include custom volumes, invoiced billing, custom terms and additional services. Where an Order Form is silent, these Terms apply.

7. Free trials

7.1 Trial period. Self-serve Plans and the agency per-site plan start with a free trial of 7 days, or such other period as we state at checkout ("Trial"). A valid payment card is required to start a Trial.

7.2 What you agree to at checkout. At checkout we show you the Plan, the price, the billing period, the currency, the date the Trial ends and the date of the first charge, and you give your consent to recurring billing by completing checkout. When your Trial starts we email you a confirmation of those details, including the date the Trial ends and the date and amount of the first charge, and for annual subscriptions we email you a reminder before each renewal.

7.3 Automatic conversion. Unless you cancel before the Trial ends, your subscription starts automatically at the end of the Trial and we charge the Fees for the Plan, billing period and currency you selected to the card you provided. Your subscription then renews under section 9.

7.4 How to cancel a Trial. Cancel from the billing page in the application at any time before the Trial ends and you will not be charged. If you cancel during a Trial your access continues until the Trial ends, after which your Organisation is locked under section 21.5.

7.5 One Trial per person. Trials are limited to one per person, identified by email address, regardless of how many Organisations that person creates or has created. If you have already had a Trial, a new subscription is charged from the day it starts. We may refuse, shorten or end a Trial where we reasonably believe it is being used to evade this rule or in breach of section 11.

7.6 Agency Trials. An Agency Customer is eligible for a Trial only where no more than 3 Client Sites are live at checkout. Before subscribing, an Agency Customer may start a limited number of first analyses free of charge, as shown in the application; Client Sites started that way count as live at checkout. Client Sites made live during a Trial are billed from the end of the Trial. We may withdraw or cap free first analyses at any time.

7.7 Trial data. Data collected during a Trial stays in your Organisation if you subscribe. If you do not subscribe, your Organisation is locked under section 21.5 and its data is handled under section 19.

8. Fees, payment and taxes

8.1 Fees. You must pay the Fees for your Plan, add-ons and any Order Form. Prices for self-serve Plans and the agency per-site plan are published at koalr.ai/pricing and in the application.

8.2 Payment processor. Payments are processed by Stripe. By providing a payment method you authorise us and Stripe to charge it for all Fees when they fall due, including recurring Fees on each renewal, pro rata charges for additions made during a billing period, and applicable taxes. We do not store full card details. Stripe's handling of your payment data is described in Stripe's own privacy policy.

8.3 Currency. We price in pounds sterling, euros and US dollars. Each currency price is a fixed price point, not a conversion of another currency. The currency in which you first subscribe becomes the currency of your Organisation for as long as it exists, including on renewal, plan changes and resubscription. If you need to change currency, contact support@koalr.ai; we may need to set up a new billing account for you.

8.4 Taxes. The published price of a self-serve Plan and of the agency per-site plan is the price you pay. It includes any VAT, or equivalent tax in your country, that we are required to charge. Tax is calculated at checkout and on each invoice by reference to the billing address and any tax identification number you provide, and is shown separately on your invoice. Where no tax is chargeable, for example where a valid reverse charge applies to a VAT-registered business outside the United Kingdom, the published price does not change. Provide your VAT or tax number at checkout: we are not obliged to reissue invoices or refund tax where your billing details were incomplete or incorrect when a charge was made. You are responsible for the accuracy of your billing details and for any taxes, duties or withholdings on Fees other than taxes on our income. Fees stated in an Order Form are exclusive of VAT unless the Order Form says otherwise.

8.5 Invoiced customers. Where an Order Form provides for invoicing, invoices are payable within 30 days of the invoice date, by bank transfer in the invoice currency, without set-off or deduction.

8.6 Late payment. If any amount is not paid when due we may claim interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998, and we may suspend the Service under section 20.

8.7 Failed card payments. If a recurring payment fails, Stripe retries it for a period and emails you. During that period your Organisation is locked under section 21.5, except that scheduled tracking continues so that your history is not broken. Update your card from the billing page to restore access. If payment is not collected by the end of the retry period, your subscription ends, your Organisation stays locked, scheduled tracking stops, and its data is handled under section 19.

8.8 Chargebacks. If you dispute a charge with your card issuer rather than with us, and the charge was made in accordance with the Agreement, we may suspend your Organisation until the dispute is resolved and recover the amount and our reasonable costs from you.

8.9 Invoice disputes. If you believe an invoice or charge is wrong, tell us at support@koalr.ai within 30 days of the invoice date and we will work with you in good faith to resolve it. Undisputed amounts remain payable.

8.10 Promotions. Promotion codes and other discounts apply only as stated in their own conditions and cannot be combined unless we say so.

8.11 Price changes. We may change our prices. A price change applies to you only from your next renewal after we have given you at least 30 days' notice by email to the Organisation owner. If you do not accept the new price, cancel before the renewal date.

9. Subscription term, renewal, changes and cancellation

9.1 Term and automatic renewal. Self-serve subscriptions run for a Subscription Term of one month or one year, as you select at checkout; the agency per-site plan is monthly only. Subscriptions renew automatically for successive periods of the same length at the price then in force for your Plan, unless cancelled under this section. Subscriptions under an Order Form renew as the Order Form states.

9.2 Cancelling. The Organisation owner may cancel a subscription at any time from the billing page in the application (or from Agency Admin for the agency per-site plan). Cancellation takes effect at the end of the current Subscription Term. You keep access until then and no further charges are taken. If you cannot reach the billing page, email support@koalr.ai from the owner's email address and we will cancel for you.

9.3 No refunds. Except where the Agreement says otherwise or the law requires, Fees are non-refundable, and we do not give refunds or credits for partial Subscription Terms, unused Sites, prompts or briefs, or periods in which you did not use the Service. Annual subscriptions cancelled part-way through the year are not refunded pro rata.

9.4 Upgrades. When you move to a larger Plan or add paid capacity during a Subscription Term, the change takes effect immediately and we charge the difference pro rata for the remainder of the Subscription Term, then the new Fees on each renewal. The renewal date does not change.

9.5 Downgrades. When you move to a smaller Plan, the change takes effect at the end of the current Subscription Term and we do not refund or credit the difference for the remainder of the current term. From the change, the smaller Plan's limits apply, subject to section 6.3.

9.6 Changing billing period. Moving from monthly to annual billing takes effect immediately, and the unused part of the current month is credited against the annual Fee. Moving from annual to monthly billing takes effect at the end of the current annual term.

9.7 Moving between self-serve and agency Plans. If we accept you onto the agency per-site plan while you hold a self-serve subscription, your self-serve subscription ends on the date your agency subscription starts and we credit the unused part of its Subscription Term against your agency subscription. Sites you transfer to Client Workspaces become Client Sites billable under section 10.2 from the date of transfer. An Agency Customer that wants to track its own brand does so by adding it as a Client Site.

10. Agency and partner customers

10.1 Eligibility. The agency per-site plan is for agencies, consultancies and other businesses that provide marketing, SEO or similar services to Clients. Access is by application. We may accept or decline applications at our discretion and may set or change the minimum number of Client Sites required to hold the plan (currently 3). If your live Client Sites fall below the minimum, we may ask you to add Client Sites or to move to a self-serve Plan; we will not charge you for Client Sites you do not have.

10.2 Per-site billing. Agency Customers pay a monthly fee for each live Client Site. A Client Site becomes live, and billable, when its first analysis is started. Client Sites that have been set up but never started are not billed. Pitch workspaces are not billed while they remain pitch workspaces (section 10.8).

10.3 Adding and removing Client Sites. When a Client Site becomes live during a billing period, we charge for it immediately, pro rata to the end of that period, and in full on each renewal. When you remove a Client Site, or pause or remove the Client it belongs to, the Client Site remains billed to the end of the current billing period and is not billed from the next period. No credit or refund is given for the remainder of the period in which it is removed. Your subscription quantity follows the number of live Client Sites and we may correct it at any time to reflect the true count; corrections that reduce the quantity take effect from the next period.

10.4 One subscription; the agency is our customer. All Client Sites in an Agency Customer's Organisation, including those in Client Workspaces, are billed on one subscription to the Agency Customer, which is responsible for all Fees. Clients are not customers of Koalr, do not contract with Koalr, have no rights under the Agreement, and cannot buy or manage the subscription for a Client Site.

10.5 Pooled allowances. Each live Client Site adds the number of tracked prompts and content briefs stated in the Documentation to a pool shared across all of the Agency Customer's Client Sites, which the Agency Customer may allocate between Clients as the Service allows. Competitor slots are per Client Site.

10.6 Client Workspaces and Client Users. An Agency Customer may create a Client Workspace for each Client and give Client staff logins scoped to that Client Workspace. The Agency Customer is responsible for Client Users as if they were its own staff, for deciding what each may see, and for removing access when the relationship ends. The Agency Customer must make sure that its Clients and Client Users comply with sections 11, 12.3, 14 and 15, and understand that they have no rights against Koalr under the Agreement (section 26.7).

10.7 White-label. The Service lets Agency Customers brand certain reports and outputs with their own name and logo and present them to Clients as the Agency Customer's own deliverable. The Agency Customer is responsible to its Clients for Outputs it delivers to them. White-labelling does not transfer any rights in the Service to the Agency Customer or its Clients, and the Agency Customer must not remove notices that the Service is designed to retain.

10.8 Pitch workspaces. We may allow Agency Customers to create a limited number of workspaces for prospective clients ("pitch workspaces") free of charge, with limited runs and capacity as shown in the application. Pitch workspaces are complimentary access under section 4.5. When you convert a pitch workspace into a Client Workspace, its Sites become live Client Sites on the date of conversion and are charged from that date under section 10.3.

10.9 Your Clients and their data. You warrant that you have authority from each Client to add its Sites, brands, competitors and connected accounts to the Service, to create logins for its staff, to receive Outputs about it, and to appoint us as a processor of any personal data it provides. As between you and Koalr, you are responsible for your relationship with each Client, including your own pricing, invoicing, service levels and advice. Requests from a Client or its staff about a Client Workspace, including requests to delete, export or transfer it to another Organisation, will be referred to you, and we will act only on your instructions as Organisation owner, except where the law requires us to act. If you become insolvent, cease trading, or do not respond to such a request within 30 days of our referring it to you, you authorise us, at our discretion, to export the Client Workspace's data to the Client or to transfer the Client Workspace to an Organisation the Client nominates.

10.10 Independent business. You act as an independent business, not as our agent, partner, franchisee or employee. You may not make commitments or representations about the Service on our behalf beyond the Documentation, and you may not give any warranty on our behalf.

10.11 Referral commission. Where you refer a Client to Koalr and that Client chooses to buy a self-serve Plan directly from us rather than through your agency subscription, we pay you a referral commission of 15% of the Fees we actually receive from that Client's subscription, net of taxes, refunds and chargebacks, for as long as that subscription remains active. Commission is not payable on your own Organisations, on businesses that were already Koalr customers or in a Trial when referred, or on Enterprise Plans, and a referral counts only where the Client subscribes using the referral link or code we issue to you. Commission is paid quarterly in arrears by bank transfer, against a valid invoice from you for the amount we confirm to you at the end of each quarter; balances under £50 roll into the next quarter. You must tell each Client you refer that you receive a commission from us. We may change or close the programme for future referrals on 30 days' notice; commission already accrued is unaffected.

10.12 Ending the agency subscription. Cancelling the agency subscription ends billing for all Client Sites at the end of the current billing period, after which the Organisation and its Client Workspaces are locked under section 21.5 and their data is handled under section 19. You are responsible for telling your Clients and for exporting anything they need before then.

11. Acceptable use

11.1 You must not, and must not allow any User to:

(a) use the Service in breach of any law or regulation, or of the rights of any person, including intellectual property, privacy, defamation and data protection rights;

(b) submit Sites, brands, prompts or content that you do not have the right to submit, or that are unlawful, defamatory, infringing or deceptive;

(c) use the Service to access systems, data or content you are not authorised to access, or to circumvent access controls, paywalls, rate limits or usage limits, including ours;

(d) probe, scan or test the vulnerability of, overload, disrupt or interfere with the Service or its infrastructure, or introduce malicious code;

(e) copy, modify, translate, reverse engineer, decompile or disassemble the Service, or attempt to derive its source code, models, scoring methods or internal system prompts, except to the extent the law allows despite this restriction;

(f) scrape, crawl or extract data from the Service by automated means other than through the Interfaces we provide under section 14, or use the Interfaces beyond their published limits;

(g) sell, resell, rent, lease, sublicense, share or otherwise make the Service available to third parties, except as expressly permitted for Agency Customers under section 10 or by an Order Form;

(h) use the Service or Outputs to build, train or improve a product or service that competes with the Service, or publish performance benchmarks of the Service without our written consent;

(i) use the Service to send spam, to generate or distribute unlawful, harmful, misleading or deceptive content, or to manipulate AI Engines or search engines in ways that breach their rules;

(j) create accounts, Trials or Organisations by automated means, or to evade a suspension, termination or limit;

(k) misrepresent your identity or affiliation, or impersonate any person or organisation;

(l) knowingly upload or process special category personal data, criminal offence data or personal data about children, or use the Service to make decisions that have legal or similarly significant effects on individuals.

11.2 You are responsible for making sure that you have all rights and permissions needed for the brands, websites, competitors and connected accounts you ask us to analyse. Tracking a competitor's public presence in AI Engines is expected use of the Service; using the Service to harass, defame or infringe the rights of a competitor is not.

11.3 We may investigate suspected breaches of this section and take any action we consider appropriate, including removing content, throttling, suspending or terminating access, and reporting to authorities.

12. Customer Data, Outputs and feedback

12.1 Your ownership. As between you and Koalr, you own Customer Data. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit, display and create derivative works from Customer Data to the extent needed to provide, secure, support, maintain and improve the Service, to comply with law, and as otherwise permitted by the Agreement. Data received from Google APIs is used only as described in section 14.1 and the Privacy Policy. This licence ends when Customer Data is deleted from the Service, except for copies in routine backups until they expire.

12.2 Outputs. As between you and Koalr, you own the Outputs generated for your Organisation, other than Third-Party Content within them, and may use them for your own business purposes and, if you are an Agency Customer, for your Clients' business purposes. "Third-Party Content" means AI Engine answers, citations, extracts of web pages and other material created by third parties that the Service captures or references. We grant you a non-exclusive licence to use Third-Party Content within and alongside your Outputs for those purposes, subject to the rights of its owners (section 15.5). Your rights in Outputs are also subject to: (a) our ownership of the Service, our methods, and the templates, models and scoring systems used to produce them; and (b) the fact that similar or identical Outputs may be generated for other customers, and that no exclusivity is given.

12.3 Your responsibility for Outputs. Outputs are generated automatically and may be inaccurate, incomplete, out of date, biased or unsuitable for your purposes. You must review Outputs before relying on them and before publishing any content produced or informed by the Service. You are solely responsible for anything you publish, including its accuracy and lawfulness, for checking that it does not infringe third-party rights (including where a draft was produced with reference to a third-party page you selected), and for any labelling or disclosure that the law or a platform requires for AI-generated content.

12.4 AI-generated content. The content-generation features of the Service produce AI-generated material and are presented as such. We will comply with the obligations of Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act) to the extent they apply to us. Where you export, edit or publish AI-generated material, you are its deployer or publisher, and any obligation to label or disclose it, including under Article 50(4) of that Regulation where you publish AI-generated text in the European Union to inform the public on matters of public interest without human editorial review, is yours.

12.5 Aggregated and service data. We may collect and use data about how the Service is used and performs, and may create aggregated or de-identified data from Customer Data and Outputs, to operate, secure, benchmark and improve the Service and to develop new features, provided that such data does not identify you, your Users or your Clients. This does not apply to data from Google accounts you connect, which we use only as described in the Privacy Policy. We do not use Customer Data, Outputs or data from your connected accounts to train generative AI models, and we do not allow our providers to do so.

12.6 Feedback. If you give us suggestions, ideas or feedback about the Service, we may use them without restriction or payment, and you assign to us any rights in them.

12.7 Your warranties. You warrant that Customer Data, and your use of it and of the Service, will not infringe any third-party right, breach any law or contract, or breach the terms of any account you connect to the Service.

12.8 Removal. We may remove or disable Customer Data or Outputs that we reasonably believe breach the Agreement or the law, or that we are required to remove. Where practicable we will tell you first.

13. AI features, accuracy and Third-Party Platforms

13.1 Nature of AI results. The Service reports on and generates material using AI systems that are probabilistic. Answers from AI Engines vary between requests, users, locations, devices and dates, and change over time. Scores, mentions, citations, sentiment, traffic estimates and other metrics are our measurements from the samples we capture. They are not a complete or definitive record of what any AI Engine says, of what any particular user sees, or of your market position.

13.2 No guarantee of results. We do not guarantee that using the Service, following its recommendations, or publishing content it produces will lead to any mention, citation, ranking, traffic, revenue or other outcome. Nobody can promise that an AI Engine will cite a page.

13.3 Not professional advice. Outputs are for information only and are not legal, financial, tax, regulatory, marketing or other professional advice. Decisions you make based on them are your own.

13.4 Dependence on Third-Party Platforms. The Service depends on AI Engines, data providers, search engines, analytics platforms and other Third-Party Platforms that we do not control. Those platforms may change, restrict, rate-limit, block, charge for or withdraw access, change their interfaces or answers, or impose terms, at any time and without notice to us. As a result we may need to change how we capture data, reduce refresh frequency, change the models or providers we use, or suspend or withdraw coverage of an AI Engine or integration. We are not liable for any of these things and they do not entitle you to a refund, except where section 4.6 applies.

13.5 Methods. To measure AI visibility we may query AI Engines and retrieve public web content directly, through data providers, and through automated tools, and we may change methods and providers at any time. We are responsible for our own methods of collecting data. Measurement methods and coverage will change over time, and historic data captured by one method may not be directly comparable with data captured by another.

13.6 No affiliation; third-party terms. We are not affiliated with, endorsed by or sponsored by any AI Engine or other Third-Party Platform. Accounts you connect to the Service and AI clients or agents you attach to it are governed by their own terms, which are between you and their providers, and you are responsible for making sure that your use of them with the Service complies with those terms. We are not responsible for Third-Party Platforms, their availability, their content, or their handling of your data.

13.7 AI providers. We use third-party large language model providers to analyse data and generate Outputs. We choose providers that commit not to train their models on data submitted through their APIs, and we send them only what is needed to produce the requested Output. Our current providers are included in our sub-processor list, available under section 17.3.

14. Integrations, MCP server, API and connector keys

14.1 Connected accounts. You may connect third-party accounts such as Google Analytics, Google Search Console and Bing Webmaster Tools. By connecting an account you confirm that you are authorised to do so and you instruct us to access the data described on the connection screen for that account and, for Google accounts, in the Privacy Policy, using the read-only permissions you grant. You may disconnect at any time from the application or from the third party's own permissions page. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14.2 Interfaces. We may provide an MCP server, connectors (for example for Looker Studio) and other programmatic interfaces (together, "Interfaces"). Interfaces are part of the Service, are licensed to you under these Terms, and are subject to the rate limits and other limits in the Documentation. You may use Interfaces only to access data for your own Organisation and Clients, only through clients and agents operated by you or on your behalf, and only for purposes permitted by the Agreement. Interfaces are read-only unless the Documentation says otherwise. We may change, deprecate or withdraw an Interface, giving reasonable notice where practicable.

14.3 Keys and tokens. API keys and connector keys are confidential, belong to the Organisation that created them, and may be revoked by the Organisation or by us at any time. MCP sign-ins and other OAuth grants belong to the User who created them and may be revoked by that User, by the Organisation owner, or by us. A User's grant reaches only the Organisations that User belongs to, and each Organisation is responsible for use of the grant in relation to its own data. You are responsible for all use of the Service through your Organisation's keys and your Users' grants.

14.4 Third-party AI clients. Where you connect the Service to a third-party AI client or agent (such as a desktop assistant or coding tool), that client is a Third-Party Platform. We are not responsible for what it does with data it retrieves, and you must make sure that its use complies with the Agreement.

15. Koalr intellectual property and publicity

15.1 Ownership. The Service, including its software, design, user interface, databases, scoring methods, models, internal system prompts, templates, algorithms and Documentation, all improvements and derivative works (other than Outputs, which section 12.2 governs), and the Koalr name, logos and marks, are owned by Koalr or its licensors and are protected by intellectual property laws. Except for the rights expressly granted in the Agreement, we reserve all rights.

15.2 Licence to you. Subject to the Agreement and payment of any Fees due, we grant you a limited, non-exclusive, non-transferable, non-sublicensable licence, for the term of the Agreement and while you have access to the Service, to access and use the Service for your internal business purposes and, if you are an Agency Customer, to provide services to your Clients.

15.3 Trademarks. You may not use our name, logos or marks without our prior written consent, except to identify Koalr accurately as a tool you use.

15.4 Publicity. We may identify you as a customer, using your name and logo, on our website and in marketing materials. We will not name your Clients. You may opt out at any time by emailing legal@koalr.ai, and we will stop new uses within a reasonable time. We will not publish case studies, quotes or your data without your separate consent.

15.5 Third-party content. Outputs may include content owned by third parties, such as AI Engine answers and extracts of web pages. Such content is provided for analysis and is not licensed to you for any other purpose.

16. Confidentiality

16.1 Each party ("Recipient") will keep confidential any non-public information disclosed by the other ("Discloser") that is marked confidential or that a reasonable person would understand to be confidential, including Customer Data (for us) and non-public details of the Service, pricing and roadmap (for you) ("Confidential Information").

16.2 The Recipient will use Confidential Information only to perform the Agreement, protect it with at least reasonable care, and disclose it only to its staff, Affiliates, advisers and subcontractors who need to know it and are bound by confidentiality obligations at least as protective.

16.3 Confidential Information does not include information that is or becomes public through no fault of the Recipient, was already lawfully known to the Recipient, is independently developed, or is lawfully received from a third party without restriction. A Recipient may disclose Confidential Information where required by law, regulation or court order, giving the Discloser notice where lawful.

16.4 These obligations last for 3 years after the Agreement ends, and for as long as the information remains a trade secret in the case of trade secrets and Customer Data.

17. Data protection

17.1 Roles. Koalr is an independent controller, and the Privacy Policy applies, for: (a) account data about all Users, including Client Users, such as names, email addresses, sign-in and usage data; and (b) AI Engine answers, citations and public web content that we capture into our own index. For personal data contained in Customer Data that we process on your behalf (such as data from your connected accounts and any personal data in prompts or documents you upload), you are the controller (or a processor acting for your Client) and Koalr is your processor, and the Data Processing Addendum in Schedule 1 applies.

17.2 Your obligations. You are responsible for having a lawful basis to provide personal data to us, for giving any notices and obtaining any consents required, and for your instructions to us being lawful.

17.3 Sub-processors and transfers. We use sub-processors, including hosting, database, authentication, email, analytics, monitoring, payment, AI and data providers, some of which are outside the United Kingdom. Our current sub-processor list is available on request from privacy@koalr.ai and, where published, in the Documentation. International transfers are made under the safeguards described in the Data Processing Addendum.

17.4 Security. We implement appropriate technical and organisational measures to protect personal data, as described in the Data Processing Addendum and the Documentation.

18. Security, availability and support

18.1 Security. We use reasonable industry measures to protect the Service and Customer Data, including encryption in transit and at rest, access controls and monitoring. No system is completely secure and we do not guarantee that unauthorised access will never occur.

18.2 Availability. We work to keep the Service available but provide it on an "as available" basis. We do not offer a service level agreement, uptime commitment or service credits unless an Order Form says so. We may take the Service down for maintenance. We try to schedule planned maintenance outside UK business hours and to give notice of significant planned downtime.

18.3 Scheduled tracking. Tracking runs on the schedule described in the Documentation. Runs may be delayed, skipped or partially completed when Third-Party Platforms are unavailable or when the Service is under maintenance. We aim to catch up missed runs where we can, but gaps in data are not a breach of the Agreement.

18.4 Support and complaints. We provide support by email at support@koalr.ai on Business Days and aim to respond within 2 Business Days. Complaints go to the same address and are handled promptly. Enterprise Order Forms may include additional support commitments.

18.5 Backups. We keep backups of the Service database for disaster recovery. Backups are not a substitute for exporting your own data.

19. Data retention, export and deletion

19.1 While you are a customer. Customer Data and Outputs stay with a Site for as long as the Site exists. Deleting a Site removes everything it holds.

19.2 After a subscription ends. When a subscription ends but your Organisation remains, we lock the Organisation and keep its data, until it is deleted under section 19.3 or 19.4, so that your history is intact if you return. We keep the data for at least 30 days after the subscription ends in every case; you can resubscribe at any time to regain access, or ask support@koalr.ai for an export.

19.3 Deletion on request. When the Organisation owner asks us to delete the Organisation, we delete Customer Data and Outputs within 90 days, except for data we must keep by law, billing records, and copies in backups until they expire.

19.4 Dormant Organisations. We may delete an Organisation that never subscribed, or that has been locked for more than 12 months, after giving 30 days' notice to the owner's email address.

19.5 Export. While you have access, you may export Outputs at any time using the reports, exports and Interfaces provided in the Service. We are not obliged to provide data in any other form unless the law requires.

20. Suspension

20.1 We may suspend or restrict access to all or part of the Service for your Organisation or a User where: (a) Fees are overdue; (b) we reasonably believe there has been a breach of section 11 or a security compromise of your account; (c) your use threatens the security, integrity or availability of the Service or of other customers' use of it; (d) we are required to by law, by a regulator, or by a Third-Party Platform; or (e) you exceed the limits of your Plan or breach section 6.2 and do not remedy it after notice.

20.2 Where practicable we will tell you before suspending and give you a chance to fix the problem. We will restore access once the issue is resolved. Suspension does not relieve you of the obligation to pay Fees for the Subscription Term, except that where a suspension not caused by you or your Users lasts more than 5 Business Days we will credit Fees pro rata for the excess. We are not liable for loss caused by a suspension made in accordance with this section.

21. Term and termination

21.1 Term of the Agreement. The Agreement starts when you first accept these Terms and continues while you have an Organisation or any subscription with us.

21.2 Termination by you. You may end the Agreement at any time by cancelling all subscriptions under section 9 and asking us to delete your Organisation under section 19.3. If a sole-trader Customer dies, their personal representatives may cancel, export or request deletion on their behalf.

21.3 Termination for cause. Either party may terminate the Agreement, or we may terminate an affected subscription, immediately by notice if the other party: (a) materially breaches the Agreement and, where the breach can be remedied, fails to remedy it within 14 days of notice; (b) becomes insolvent, enters administration or liquidation, or ceases trading; or, in our case, (c) if you breach section 11, or fail to pay Fees within 14 days of a reminder.

21.4 Effect. On termination or expiry: (a) your right to use the Service ends; (b) Fees that are due remain payable; and (c) sections that by their nature should survive continue, including sections 8, 9.3, 12, 13, 15, 16, 17, 19, 21.4 to 21.6, 22, 23, 24, 26 and 27.

21.5 Locking. When a subscription ends for any reason, a Trial ends without a subscription, or a payment fails under section 8.7, we lock the Organisation. A locked Organisation can still be signed into to manage billing and resubscribe, but cannot otherwise use the Service, except as sections 8.7 and 19.2 provide.

21.6 Refunds on termination. If you terminate under section 21.3 for our material breach or insolvency, or under sections 4.6, 22.2, 25.3 or paragraph 2.4 of Schedule 1, or if we terminate under section 23.2, we will refund prepaid Fees pro rata for the period after termination. Termination by us for cause, or by you in any other case, does not entitle you to a refund of prepaid Fees.

22. Warranties and disclaimers

22.1 Mutual. Each party warrants that it has the authority to enter into the Agreement.

22.2 Our warranty. We warrant that we will provide the Service with reasonable skill and care and substantially as described in the Documentation. If we breach this warranty, your remedy is for us to use reasonable efforts to correct the non-conformity and, if we cannot within a reasonable time, you may terminate the affected subscription and receive a pro rata refund of prepaid Fees for the period after termination. This is your sole remedy for breach of this warranty. It does not apply to beta features, complimentary access or Trials.

22.3 Disclaimer. Except as expressly stated in the Agreement, and to the fullest extent permitted by law, the Service, Outputs and all related materials are provided "as is" and "as available", and we exclude all other warranties, conditions and terms, whether express, implied or statutory, including implied terms of satisfactory quality, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted, error-free or secure, that Outputs will be accurate, complete or current, or that the Service will meet your requirements.

23. Indemnities

23.1 By you. You will defend, indemnify and hold harmless Koalr, its Affiliates and their officers, employees and contractors against all claims, losses, damages, liabilities, costs and expenses (including reasonable legal fees) arising from or connected with: (a) Customer Data; (b) content you publish that was produced or informed by the Service, except to the extent the claim arises from our breach of the Agreement; (c) use of the Service by you, your Users or your Clients in breach of the Agreement or the law; (d) your relationship with your Clients; or (e) any claim by a Client or other third party relating to services you provide using the Service.

23.2 By us. We will defend you against any claim by a third party that the Service, as provided by us and used in accordance with the Agreement, infringes that third party's intellectual property rights in the United Kingdom, the European Union or the United States, and we will pay damages finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, Outputs, content from Third-Party Platforms, your modifications, combinations with things we did not supply, or use in breach of the Agreement. If a claim is made or is likely, we may procure the right for you to continue using the Service, modify or replace it so that it does not infringe, or terminate the affected subscription and refund prepaid Fees for the period after termination. This section is your sole remedy for infringement claims.

23.3 Procedure. The indemnified party must notify the indemnifying party promptly of the claim, give it sole control of the defence and settlement (provided no settlement admits fault or imposes obligations on the indemnified party without its consent), and give reasonable assistance at the indemnifying party's expense.

24. Limitation of liability

24.1 Nothing excluded that cannot be. Nothing in the Agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law.

24.2 Excluded losses. Subject to section 24.1, neither party is liable under or in connection with the Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any: (a) loss of profits, revenue, sales or business; (b) loss of anticipated savings; (c) loss of or damage to goodwill or reputation; (d) loss of, corruption of, or inability to use data, except to the extent caused by our breach of section 17 or Schedule 1; (e) losses arising from reliance on Outputs, or from decisions made or content published on the basis of them, without prejudice to your remedy under section 22.2; (f) losses arising from the acts, omissions or unavailability of AI Engines, search engines, or any platform, account or tool you connect or attach to the Service; or (g) indirect, special or consequential loss.

24.3 Cap. Subject to sections 24.1 and 24.4, each party's total liability under or in connection with the Agreement, including for breach of section 16, section 17 or Schedule 1, in aggregate for all claims, is limited to the greater of: (a) the Fees paid and payable by you to us in the 12 months immediately before the first event giving rise to liability; and (b) £1,000.

24.4 Exceptions. The cap in section 24.3 does not apply to your obligation to pay Fees or to your indemnity under section 23.1.

24.5 Application. The limits in this section apply to the parties' Affiliates and to their combined liability. Any claim under the Agreement must be brought within 12 months of the date the claimant became aware, or ought reasonably to have become aware, of the facts giving rise to it.

25. Changes to these Terms

25.1 We may change these Terms. For changes that materially reduce your rights or increase your obligations, we will give at least 30 days' notice by email to the Organisation owner and by a notice in the application before the changes take effect, and changes to Fees or to the core commercial terms of a Plan take effect from your next renewal at the earliest. Other changes, including changes required by law, clarifications and changes to the Documentation, take effect when posted, except that a reduction in the limits or features of a paid Plan during your current Subscription Term is treated under section 4.6.

25.2 The current version, its version number and its effective date are always shown at koalr.ai/terms, and earlier versions are available on request.

25.3 If you do not accept a material change, you may cancel the affected subscription before the change takes effect and we will refund any prepaid Fees for the period after cancellation. Continued use after the change takes effect means you accept it.

26. General

26.1 Force majeure. Neither party is liable for delay or failure to perform (other than payment) caused by events beyond its reasonable control, including failure, blocking or restriction of Third-Party Platforms, internet or utility failures, cyber-attack, labour disputes, epidemic, government action or natural disaster.

26.2 Assignment. You may not assign, transfer or subcontract the Agreement without our prior written consent, except to an Affiliate or to a successor in a merger or sale of substantially all of your assets that agrees in writing to be bound. We may assign the Agreement to an Affiliate or to a successor of our business, and may subcontract our obligations while remaining responsible for our subcontractors.

26.3 Notices. Notices to us must be sent to legal@koalr.ai or to our registered office. Notices to you may be sent to the email address of your Organisation owner or shown in the application, or displayed in the application, and are deemed received when sent (email, unless we receive a delivery failure) or first displayed (in-app). Operational messages, such as run alerts and digests, are not notices.

26.4 Entire agreement and non-reliance. The Agreement is the entire agreement between the parties about its subject matter and supersedes all earlier agreements, proposals and representations. Each party confirms that it has not relied on, and has no remedy for, any statement not set out in the Agreement. Nothing in this section limits liability for fraud.

26.5 Severability. If any provision is found invalid or unenforceable, it will be modified to the minimum extent necessary and the rest of the Agreement remains in force.

26.6 Waiver. A failure or delay in exercising a right is not a waiver of it, and a waiver of one breach is not a waiver of any other.

26.7 Third parties. Except for Koalr's Affiliates and the persons indemnified under section 23, no person other than the parties, and in particular no Client of an Agency Customer, has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Agreement.

26.8 Relationship. The parties are independent contractors. Nothing in the Agreement creates a partnership, joint venture, agency, franchise or employment relationship.

26.9 Export controls and sanctions. You confirm that you and your Clients are not located in, organised under the laws of, or ordinarily resident in a country or territory subject to comprehensive sanctions of the United Kingdom, the European Union or the United States, and are not on any of their sanctions lists. You must comply with applicable export control and sanctions laws in using the Service.

26.10 Anti-bribery. Each party will comply with applicable anti-bribery and anti-corruption laws, including the Bribery Act 2010.

26.11 Language and interpretation. The Agreement is in English and any translation is for convenience only. Headings are for convenience only. "Including" means "including without limitation". References to a law include it as amended or replaced.

27. Governing law and disputes

27.1 The Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, is governed by the law of England and Wales.

27.2 Before starting proceedings, a party must notify the other of the dispute in writing, and the parties will attempt in good faith to resolve it through discussion between senior representatives for at least 30 days.

27.3 Subject to section 27.2, the courts of England and Wales have exclusive jurisdiction, except that either party may seek injunctive or other urgent relief in any competent court to protect its intellectual property or Confidential Information.

Schedule 1: Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Agreement and applies where Koalr processes personal data on behalf of the Customer as a processor. "Data Protection Law" means the UK GDPR and the Data Protection Act 2018, the EU GDPR where it applies to the processing, and any laws implementing or supplementing them. Terms defined in Data Protection Law have the same meaning here. "Customer Personal Data" means personal data contained in Customer Data that Koalr processes on the Customer's behalf under section 17.1 of the Terms. References to paragraphs are to paragraphs of this DPA.

1. Details of processing

1.1 Subject matter and duration: processing of Customer Personal Data in the course of providing the Service, for the term of the Agreement and until deletion under section 19 of the Terms.

1.2 Nature and purpose: hosting, storage, analysis, reporting, generation of Outputs, support and security, in order to provide the Service to the Customer, and the creation of aggregated or de-identified data under section 12.5 of the Terms.

1.3 Types of personal data: identifiers and aggregated metrics from connected analytics and search accounts; any personal data the Customer includes in prompts, documents, brand names, competitor lists or other Customer Data.

1.4 Categories of data subjects: the Customer's staff, contractors and customers, and staff of the Customer's Clients, to the extent their personal data appears in Customer Data rather than in account data under section 17.1(a) of the Terms; and any other individuals whose personal data appears in Customer Data.

2. Koalr's obligations as processor

2.1 Instructions. Koalr will process Customer Personal Data only on the Customer's documented instructions, which are the Agreement (including section 12.5 and section 19 of the Terms), the Customer's configuration and use of the Service, and any further written instructions agreed between the parties, unless required to do otherwise by law, in which case Koalr will inform the Customer before processing unless the law prohibits it. Koalr will tell the Customer if it believes an instruction infringes Data Protection Law.

2.2 Confidentiality. Koalr ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations.

2.3 Security. Koalr will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures in Annex 1.

2.4 Sub-processors. The Customer gives general written authorisation for Koalr to engage sub-processors. Koalr maintains a list of current sub-processors, available on request at privacy@koalr.ai or as published in the Documentation, and will give the Customer at least 30 days' notice of the addition or replacement of a sub-processor by email to the Organisation owner, or shorter notice where a change is needed urgently to maintain the security or availability of the Service. The Customer may object on reasonable data protection grounds within the notice period; if the parties cannot resolve the objection, the Customer may terminate the affected subscription and receive a pro rata refund of prepaid Fees. Koalr will impose data protection obligations on each sub-processor that are no less protective than this DPA and remains liable for its sub-processors' performance.

2.5 Assistance. Taking into account the nature of the processing, Koalr will assist the Customer by appropriate technical and organisational measures in responding to data subject requests, and in meeting the Customer's obligations regarding security, breach notification, data protection impact assessments and prior consultation, in each case to the extent the Customer cannot do so through the Service itself. Koalr may charge a reasonable fee for assistance that is excessive or repetitive.

2.6 Personal data breach. Koalr will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably required for the Customer to meet its own notification obligations as it becomes available.

2.7 Retention, deletion and return. The Customer instructs Koalr to retain Customer Personal Data after a subscription ends, as described in section 19.2 of the Terms, so that it can be restored if the Customer returns, until the Customer requests deletion or section 19.4 of the Terms applies. On the Customer's request, or on deletion of the Organisation, Koalr will delete Customer Personal Data in accordance with section 19 of the Terms, unless the law requires storage. The Customer may export Outputs using the Service before deletion.

2.8 Audit. Koalr will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, no more than once in any 12-month period (unless required by a supervisory authority or following a personal data breach), on at least 30 days' written notice, during Business Days, subject to reasonable confidentiality and security requirements, and at the Customer's cost. Koalr will first satisfy audit requests by providing documentation, certifications or third-party reports where available.

3. International transfers

3.1 Koalr's primary hosting and database are in the European Union. Some sub-processors process data in the United States or other countries.

3.2 Transfers of Customer Personal Data outside the United Kingdom will be made only: (a) to a country covered by UK adequacy regulations; (b) under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; (c) to a recipient certified under the UK Extension to the EU-US Data Privacy Framework; or (d) under another lawful transfer mechanism. Where the EU GDPR applies, transfers outside the European Economic Area will be made under the EU Standard Contractual Clauses (Module Two or Module Three as applicable, with the parties' details as set out in the Agreement), the EU-US Data Privacy Framework, or an equivalent mechanism.

4. Customer's obligations

4.1 The Customer warrants that it has all rights, consents and lawful bases needed to provide Customer Personal Data to Koalr and to instruct its processing, that it will comply with Data Protection Law, and that its instructions will be lawful. Where the Customer is itself a processor for a Client, it warrants that it has authority from the Client to appoint Koalr as a sub-processor on these terms.

5. Liability and conflict

5.1 The liability of each party under this DPA is subject to the exclusions and limits in section 24 of the Terms.

5.2 If there is a conflict between this DPA and the rest of the Agreement in relation to the processing of personal data, this DPA prevails.

Annex 1: Technical and organisational measures

• Encryption of data in transit and at rest.
• Hosting in the European Union with managed, access-controlled databases.
• Tenant isolation controls so that each Organisation can only reach its own data.
• Authentication through a dedicated identity provider, with organisation-level roles and per-site access levels.
• Encryption of stored credentials for connected accounts; API and connector keys stored only in hashed form.
• Security headers, rate limiting, and monitoring and alerting on production systems.
• Access to production systems restricted to named staff; staff access to customer Organisations attributed and limited to support and security purposes.
• Regular database backups and a documented recovery process.
• Vendor due diligence for sub-processors, including data processing terms and no-training commitments from AI providers.

Schedule 2: Billing rules summary

This schedule summarises the billing mechanics in sections 7 to 10. Prices and Plan limits are published at koalr.ai/pricing and in the Documentation and are not repeated here. If this schedule conflicts with sections 7 to 10, those sections prevail.