Kanbrio Terms of Service

Version 1.0 · Effective 29 September 2026

Published at: https://kanbrio.com/terms

These Terms are an agreement between you and [to be confirmed] (ABN [to be confirmed]), trading as Kanbrio, of [to be confirmed] ("Kanbrio", "we", "us", "our").

1. About these Terms

1.1 What these Terms cover. These Terms govern your use of the Kanbrio hosted service: the web application at app.kanbrio.com, the sign-in service at auth.kanbrio.com, the application programming interfaces at api.kanbrio.com (including the REST API, the GraphQL API and the Model Context Protocol ("MCP") server at api.kanbrio.com/mcp), our website at kanbrio.com, and any related support we provide (together, the "Service").

1.2 Accepting these Terms. You accept these Terms when you tick the acceptance box at sign-up, when you accept an invitation to an organisation, when you place an order, or when you first use the Service, whichever happens first. We record the version you accepted and when.

1.3 Using Kanbrio for an organisation. If you accept these Terms for a company or other organisation, "you" means that organisation, and you confirm that you have authority to bind it. If you do not have that authority, do not accept these Terms or use the Service.

1.4 Other documents that form part of these Terms. The following documents are part of this agreement and are published at the addresses shown:

1.5 Order of precedence. If documents conflict, this order applies, highest first: (a) a signed order form or written agreement between you and us that expressly overrides these Terms; (b) the Data Processing Agreement, for matters of personal data; (c) these Terms; (d) the other documents listed in clause 1.4. As an exception, where the Refund and Cancellation Policy gives you a more favourable outcome on a refund or cancellation than these Terms, the Refund and Cancellation Policy applies.

1.6 Self-hosted software. If you download and run Kanbrio software on your own infrastructure, that software is governed by the licence that comes with it, not by these Terms. These Terms apply only to the Service we host and operate.

2. Definitions

In these Terms:

• Account means an individual sign-in to the Service.
• Agent means an automated program, including an AI system, that acts in the Service through an Agent Key or through another credential you or your Users provide.
• Agent Key means an API key that Kanbrio issues for an Agent.
• AI Features means features of the Service that use artificial intelligence or machine learning, including the hosted coding executor, hosted AI calls and semantic search.
• Credits means the units described in clause 9.5 that are used to pay for hosted AI and compute.
• Customer Data means all data and content that you, your Users or your Agents put into the Service or that the Service generates for you from it, including cards, comments, attachments, documents, time entries, code and task instructions, and AI Output.
• AI Output means content produced for you by an AI Feature or by an Agent.
• Organisation means the top-level customer space in the Service. An Organisation contains workspaces, teams, projects and boards.
• Plan means the subscription tier you are on (for example Free, Starter, Team, Business or Enterprise), with the prices, limits and features described on the pricing page or in your order.
• Pricing page means https://kanbrio.com/pricing, or the pricing shown in the app at the time of purchase.
• User means a person who has an Account in your Organisation, including owners, admins, members and guests.

3. Accounts, organisations and eligibility

3.1 Business and professional use. The Service is designed for businesses, teams and individuals working in a professional capacity. You must be at least 18 years old to create an Account.

3.2 Accurate information. You must give accurate sign-up and billing details and keep them up to date. We send important notices to the email address on the Account of your Organisation's owner, so please keep it current.

3.3 One person per Account. Each Account is for one person. Do not share sign-in details. People who need access should be invited as Users, and automated tools should be connected as Agents.

3.4 Roles and control. The owner and admins of an Organisation control who has access, what each User and Agent can do, and the Organisation's settings and data. If you join an Organisation that someone else controls (for example your employer's), that Organisation's owner and admins can manage, restrict or remove your access to it and can access content you add to it.

3.5 Guests. Guests have read-only access to your Organisation: they can view the content their role allows but cannot create, change or delete it. You are responsible for choosing whom you invite as a guest and what they can see.

3.6 Keeping access secure. You are responsible for keeping your Accounts, passwords, passkeys and Agent Keys secure, and for everything done with them. Tell us promptly at [email protected] if you believe any of them has been compromised, and revoke the affected Agent Key or reset the credential straight away.

3.7 Your responsibility for your Users. You are responsible for making sure your Users and Agents comply with these Terms.

4. The Service

4.1 What we provide. Kanbrio is a work-management service in which people and AI Agents work on the same boards, cards and projects. It includes boards and views, time tracking, flow analytics and forecasts, audit logs and a REST interface. It will also include the features below. Each of them is being implemented, is not part of the Service until it is available, and has its status shown on kanbrio.com:

• knowledge pages and semantic search: being implemented;
• automation rules: being implemented;
• webhooks: being implemented;
• real-time updates and presence: being implemented;
• importers from other tools: being implemented;
• an outbound MCP client: being implemented;
• a hosted coding executor: being implemented;
• a GraphQL interface: being implemented; and
• an MCP interface: being implemented.

Which features you can use depends on your Plan.

4.2 Changes to the Service. We improve Kanbrio continuously, so features will change. We will not materially reduce the core functionality of a paid Plan during a period you have already paid for. If we do materially reduce a feature you rely on, we will give you at least 30 days' notice where we reasonably can, and you may cancel and receive a pro-rata refund of any prepaid period you have not used.

4.3 Availability. We aim to keep the Service available at all times, apart from planned maintenance and events outside our reasonable control. We do not currently offer a service level agreement or service credits. We will try to schedule maintenance for low-traffic times and to announce significant planned maintenance in advance.

4.4 Where the Service runs. Your Customer Data is stored on servers we operate in Australia, and our backups are kept in Australia. The coding executor runs on infrastructure in Sydney, Australia. Some data passes through, or is processed by, the service providers named on our sub-processor list, including providers in the United States and the global network of our content-delivery and security provider. We may move hosting to a different provider or location in future. If we do, we will update the sub-processor list and give you 30 days' notice as described in the Data Processing Agreement.

4.5 Plan limits and fair use. Each Plan has limits, for example on human members, guests, active Agent Keys, Credits, storage, file size, executor concurrency and API request rates. The limits are shown on the pricing page. When you reach a limit, the Service will tell you and will stop that particular action (for example adding another member) until you are back under the limit or change your Plan. Reaching a limit never causes us to delete your data.

5. AI agents and AI features

5.1 Your Agents. You can connect Agents to your Organisation, for example a coding assistant connected through our MCP server or a script using our API.

(a) Agents are always labelled. Each Agent is a member of your Organisation with the "agent" role. The Service shows it as an agent wherever it appears, and every action it takes is recorded in the audit log as an agent action.

(b) Agent Keys. Agents sign in with Agent Keys that we issue. Only owners and admins of your Organisation can create Agent Keys. Each Agent Key is scoped to your Organisation, may have an expiry date, and can be revoked at any time. An Agent Key is shown in full only once, when it is created. Treat it like a password. Agent Keys are being implemented; meanwhile each Agent has its own separate credential, which only owners and admins can create and which they can revoke at any time.

(c) Human sponsor. Every Agent has a human sponsor in your Organisation. An Agent can never have more permissions than its sponsor currently has, and it can never be an owner or admin. If the sponsor leaves the Organisation or loses access, the Agent's keys stop working until a new sponsor is assigned. Sponsorship is being implemented together with Agent Keys.

(d) You are responsible for your Agents. An Agent acts on your behalf. As between you and us, everything your Agents do in the Service is treated as done by you, including anything they create, change, send or delete, and any Credits they use. You are responsible for the instructions you give your Agents, the permissions you grant them, the tools and data you connect them to, and complying with the terms of any third-party AI provider that powers them.

5.2 Human approval and controls.

(a) When an Agent tries to take a destructive action (for example deleting or archiving work), the Service does not carry it out straight away. It creates a suggestion that waits in your approval inbox until a person in your Organisation accepts or rejects it. Agents cannot approve suggestions, and they cannot request the erasure of personal data.

(b) Agent actions that the Service records as reversible can be undone by a person with the right permissions.

(c) Owners and admins can pause, resume or cancel an Agent's run. Pausing and cancelling are cooperative: the Agent stops at its next safe point, which may be after it finishes the step it is on. They do not stop an Agent instantly, and they do not stop programs running outside Kanbrio. To cut off an Agent immediately, revoke its Agent Key. Pause, resume and cancel are being implemented; meanwhile, to stop an Agent, revoke its credentials.

(d) These controls reduce risk, but they do not replace your own oversight. You should decide which actions your Agents may take and watch what they do.

5.3 Hosted coding executor. The hosted coding executor is being implemented and is not yet offered; this clause describes how it works once it is. On Plans that include it, you can ask Kanbrio to run a coding task against a code repository you choose. When you do:

(a) our executor retrieves the repository using the access you grant, for example a repository token;

(b) it sends the task title and instructions and relevant excerpts of files from the repository to our AI provider (currently Anthropic, in the United States) to plan the change, unless you have chosen to use your own AI provider key, in which case that key is used;

(c) it checks the proposed change in an isolated sandbox that has no network access and holds no credentials;

(d) it returns a proposed change for your review. A person in your Organisation must review and accept a change before it is merged. You decide whether to merge it.

You confirm that you are allowed to give us access to the repository and to have its contents processed in this way. Give the executor only the access it needs, and revoke that access when you no longer need it.

5.4 Bring your own AI key. Using your own AI key is being implemented; meanwhile no customer key can be added. If you give us an API key for your own account with an AI provider, we use it for your hosted AI calls. Your use of that provider is governed by your agreement with it, and any charges it makes are between you and it. Calls made with your own key do not use Credits.

5.5 AI Output.

(a) AI can produce content that is inaccurate, incomplete, insecure, biased or similar to content produced for other people. You must review AI Output, including code, before you rely on it, publish it or put it into production.

(b) As between you and us, AI Output is Customer Data and belongs to you, to the extent any rights exist in it. We do not promise that AI Output is original, that it does not infringe anyone's rights, or that it is compatible with any particular licence.

(c) Do not use AI Output as the only basis for a decision that has a legal or similarly significant effect on a person (for example about their employment, credit or access to services) without meaningful human review.

5.6 No training on your data. We do not use Customer Data to train artificial intelligence or machine-learning models, and we do not allow our AI provider to do so. Our AI provider's commercial terms exclude training on data sent through its API. Semantic search is being implemented; its indexes will be computed on our own servers. We keep a ledger of each hosted AI call's token counts and cost so that we can bill Credits accurately. The ledger does not store the prompt or the response. The ledger is being implemented; meanwhile no hosted AI call is billed in Credits.

5.7 Third-party AI you connect. If you connect an AI tool or agent that runs outside Kanbrio, that tool, and the provider behind it, is chosen by you and governed by your own terms with them. It is not one of our sub-processors.

6. Your data

6.1 You own your Customer Data. We do not claim ownership of Customer Data.

6.2 Licence to us. You give us a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit, display and back up Customer Data only as needed to: (a) provide, secure and support the Service for you; (b) carry out your instructions, including instructions your Users and Agents give through the Service; and (c) comply with the law. This licence ends when we delete the Customer Data under clause 13.

6.3 Personal data. Our Data Processing Agreement applies to personal data in Customer Data, and our Privacy Policy explains how we handle personal information for which we are responsible, such as Account and billing details.

6.4 Your responsibilities for Customer Data. You are responsible for the content of Customer Data, for having the rights and permissions needed to put it into the Service, and for having a lawful basis to process any personal data it contains, including telling people where the law requires it.

6.5 Sensitive and regulated data. The Service is not designed for payment card data, health records regulated by specific health-privacy laws, government identity numbers, or data subject to export controls. Do not put those kinds of data into the Service unless we have agreed in writing that you may.

6.6 Service data. We collect technical and usage information about how the Service is used (for example counts of actions, performance measurements, error reports and AI token counts). We use it to operate, secure, bill for and improve the Service. We may publish or share it only in an aggregated form that does not identify you, your Users or your Customer Data.

6.7 Audit records. The Service keeps an append-only audit log of actions taken in your Organisation. Before an entry is stored, free text is removed, so the log holds identifiers, action names and times, not the content of your work. We keep audit and security records for 7 years so that we and you can investigate security incidents and meet legal obligations, even after other data has been deleted. Our Privacy Policy explains this in more detail.

6.8 We never sell your data. We do not sell or rent Customer Data, and we do not use it for advertising.

7. Acceptable use

7.1 You must use the Service, and make sure your Users and Agents use it, in line with our Acceptable Use Policy at kanbrio.com/aup.

7.2 In particular, you must not, and must not let anyone else (including an Agent):

(a) break the law, infringe anyone's rights, or send spam through the Service;

(b) upload malware, or use webhooks, the outbound MCP client, the coding executor or any other feature to attack, probe or overload any system, including ours;

(c) use the coding executor to mine cryptocurrency, run a proxy, or do anything unrelated to developing your own software;

(d) try to get around Plan limits, Credit caps, rate limits, human-approval steps or security controls, or try to access another customer's data;

(e) resell or sublicense the Service except as we agree in writing; or

(f) copy, reverse engineer or build a competing service from the hosted Service, except to the extent the law allows this despite this restriction.

7.3 We use automated systems to detect abuse and protect the Service, in line with our Privacy Policy.

8. Third-party services and data you choose to send

8.1 The Service lets you connect other services, for example code hosts, tools you import from, webhook endpoints, MCP servers, AI providers and payment providers. Your use of each third-party service is governed by its own terms and privacy policy.

8.2 When you, your Users or your Agents set up a connection that sends Customer Data out of Kanbrio (for example a webhook, an outbound MCP connection, a push to your code host, or a call using your own AI key), the transfer happens at your direction. The receiving service is not our sub-processor, and you are responsible for whether that transfer is lawful and appropriate.

8.3 We are not responsible for third-party services, or for any change to or loss of Customer Data caused by them. We may stop supporting a connection if the third party changes or withdraws its service, or if keeping the connection would create a security risk.

9. Plans, fees and payment

9.1 Prices. Prices, what each Plan includes and its limits are shown on the pricing page or in your order. Prices are in US dollars unless the pricing page or your order says otherwise. The price that applies to you is the price shown when you buy or renew, subject to clause 9.8.

9.1A Who may buy. In Australia, the Service is sold to businesses and to individuals. Outside Australia, the Service is sold to businesses only, until we open sales to consumers in a jurisdiction and say so on the pricing page. If you buy from outside Australia, you confirm that you are buying for the purposes of a business, and you give us a valid business tax identification number when checkout asks for one. This clause does not reduce any right you have under consumer law (clause 17).

9.2 Free Plan and trials.

(a) The Free Plan costs nothing and has the limits shown on the pricing page. We may change those limits with at least 30 days' notice.

(b) We may offer a free trial of a paid Plan. We do not need payment details to start a trial. When the trial ends, your Organisation moves back to the Free Plan unless you have subscribed. Nothing is deleted and no one is removed when a trial ends, but features and limits of the Free Plan then apply.

9.3 Paying through PayPal. Paid subscriptions are billed through PayPal. PayPal handles your payment details under its own terms and privacy statement, and we do not receive your full card or bank details. By subscribing, you authorise PayPal to charge the subscription price, plus any applicable taxes, at the start of each billing period (monthly or yearly, as you choose) until you cancel. Subscriptions renew automatically. You can cancel at any time as described in clause 10.

9.4 Paying in cryptocurrency. If we offer cryptocurrency payment, it is available only for the prepaid purchases we list (for example an annual Plan or a Credit pack), and it is processed by the third-party payment processor named on our sub-processor list. For those purchases:

(a) the price is set in US dollars (or the currency shown at checkout), and the processor converts it to the cryptocurrency amount at checkout;

(b) a crypto purchase covers a fixed term and does not renew automatically. We will remind you before it ends. If you do not renew, your Organisation moves to the Free Plan without losing data;

(c) you pay any network or transaction fees charged for sending the payment;

(d) crypto payments cannot be reversed. You are responsible for sending the correct amount to the correct address. If we owe you a refund, we will refund the amount you were charged in US dollars (or the currency shown at checkout), not a number of crypto units, either to a wallet address you verify or by another method we agree; and

(e) we do not hold or transfer cryptocurrency for you.

9.5 Credits. Hosted AI and the hosted coding executor use Credits. Credits are being implemented; until they are, no Credits are sold or charged, and the rest of this clause describes how they work once they are available.

(a) What a Credit pays for. The pricing page explains how many Credits each hosted AI call and each unit of executor time uses. Ordinary actions through the API, including actions by your Agents, do not use Credits; rate limits apply to them instead.

(b) Included Credits. Paid Plans (and the Free Plan, where the pricing page says so) include a monthly allowance of Credits. The allowance resets at the start of each monthly period. Unused allowance does not carry over.

(c) Credit packs. You can buy extra Credits in packs. Pack Credits are shared across your Organisation and expire 12 months after purchase.

(d) Caps, not surprise bills. Your Organisation's Credit balance is a hard limit. Owners and admins can also set a budget for each Agent. When a limit is reached, hosted AI features stop until the balance is topped up, the budget is raised, the period resets, or you switch to your own AI key. We never charge automatic overage fees. The Service warns you before you reach a limit.

(e) No cash value. Credits have no cash value, cannot be transferred to another Organisation, and are not refundable except as set out in the Refund and Cancellation Policy or where the law requires.

9.6 Taxes. Prices do not include taxes unless we say so. You are responsible for all taxes, duties and levies on your purchases, other than taxes on our income. Where we are required to collect goods and services tax (GST), value-added tax (VAT), sales tax or a similar tax, we will add it to the price and show it on your invoice or receipt. If you give us a valid business tax identification number and the law allows, we will apply any reverse-charge or exemption that is available.

9.7 Failed payments. If a renewal payment fails, we will tell you and give you at least 14 days to fix it. If it is still unpaid after that, we may move your Organisation to the Free Plan. We will not delete your data because a payment failed.

9.8 Price changes. We may change our prices. We will give you at least 30 days' notice by email and in the app before a price change applies to you. A new price applies from your first renewal after the notice period ends. If you do not accept the new price, you can cancel before it applies and you will not be charged it. If a price change ever has to apply before your next renewal, you may cancel and we will refund the prepaid part of your current period that you have not used.

9.9 Payment disputes. If you think a charge is wrong, please contact us at [email protected] first, and we will try to resolve it quickly. This does not limit your right to raise a dispute with PayPal or your bank. While a dispute or chargeback is open, we may pause paid features for the disputed period, but we will not delete your data because of it.

10. Plan changes, cancellation and refunds

10.1 Upgrading. An upgrade takes effect straight away. The amount charged for the upgrade is shown at checkout before you confirm.

10.2 Downgrading. A downgrade takes effect at the end of your current billing period. If your Organisation is then over a limit of the new Plan, you keep all existing data, but you will not be able to add more of that item until you are back under the limit.

10.3 Cancelling. You can cancel a paid subscription at any time in the app. You can also stop automatic payments in your PayPal account, which ends future charges. When you cancel, you keep paid access until the end of the period you have paid for, and then your Organisation moves to the Free Plan.

10.4 Refunds. Our Refund and Cancellation Policy (kanbrio.com/refunds) forms part of these Terms. In summary:

(a) you may have a full refund of the first payment for any paid Plan if you ask within 14 days of that payment;

(b) otherwise, we do not refund part of a billing period when you cancel, except where the law requires it, or where we change prices or these Terms, or materially reduce features, in a way that you do not accept, in which case we refund the prepaid part of the period that you have not used;

(c) unused Credit packs are refundable if you ask within 14 days of purchase; and

(d) nothing in this clause or the Refund and Cancellation Policy limits the rights described in clause 17.

11. Suspension

11.1 We may suspend all or part of your access to the Service if we reasonably believe that:

(a) you, a User or an Agent has seriously breached these Terms or the Acceptable Use Policy;

(b) the use creates a security risk, or a risk of harm or legal liability, for the Service, us, other customers or anyone else;

(c) payment is overdue after the period in clause 9.7, in which case the suspension is limited to the paid features, by moving your Organisation to the Free Plan; or

(d) the law or an order of a court or regulator requires it.

11.2 We will keep any suspension proportionate. Where practical, we will suspend only what is needed, for example a single Agent Key, User, webhook or feature, rather than your whole Organisation.

11.3 Unless the situation is urgent or the law prevents it, we will tell you before we suspend, explain why, and give you a reasonable chance to fix the problem. If we suspend without notice, we will tell you as soon as we reasonably can afterwards.

11.4 We will restore access promptly once the reason for the suspension has been resolved. During a suspension, you can still ask us to export your Customer Data, unless giving you that export would itself be unlawful or would continue the harm that caused the suspension.

12. Term and termination

12.1 Term. This agreement starts when you accept it and continues until your Account or Organisation is closed.

12.2 Ending by you. You may stop using the Service and ask us to close your Organisation at any time. Cancelling a paid Plan moves you to the Free Plan (clause 10.3); to close the Organisation completely, ask in the app or email [email protected] from the owner's email address.

12.3 Ending by us for breach. We may end this agreement by written notice if you materially breach it and do not fix the breach within 30 days of our notice, or straight away if the breach is serious and cannot be fixed (for example repeated or deliberate abuse that harms other people).

12.4 Ending for other reasons. We may stop offering the Service, or a Plan, by giving you at least 90 days' notice. If we do, we will refund the prepaid part of any period that you have not used.

12.5 Ending under the law. Either party may end this agreement by notice if the other party becomes insolvent, or where continuing would break the law.

12.6 What happens when this agreement ends. Your right to use the Service stops (except for the export window in clause 13), unpaid fees for periods already used become due, and clauses 6.7, 9, 13, 14, 15.4, 17 to 20, 23 and 24 continue to apply.

13. Getting your data out, and deletion

13.1 Export during the agreement. While your agreement is active, you can export Customer Data through the features of the Service and through our APIs. If a type of Customer Data you need is not covered by the self-service export, ask us at [email protected] and we will provide it in a common machine-readable format (such as JSON or CSV), together with attachments in their original format, within 30 days and at no charge.

13.2 Export window after the agreement ends. After your Organisation is closed or this agreement ends for any reason, you have 30 days to request or download an export of your Customer Data. During that window we keep your Customer Data and will provide the export as described in clause 13.1.

13.3 Deletion. After the 30-day export window, we delete your Customer Data from the live Service within a further 30 days. Copies in our backups are deleted as the backups roll off, within 90 days after that deletion. We keep audit and security records (clause 6.7) and billing records for 7 years, and we may keep other information where the law requires us to or where it is subject to a legal hold. When the retention period ends, we destroy it.

13.4 Switching to another provider. We do not charge for exporting your data or for switching to another provider. If you are moving to another service, we will cooperate reasonably, including by answering reasonable questions about the format of your export. If your agreement allows a notice period for ending it, that notice period is never longer than 2 months.

13.5 Deleting data earlier. You can delete Customer Data yourself at any time. Some deletions are "soft" at first so that you can recover mistakes; the Service explains when this is so.

14. Confidentiality

14.1 Each party may receive non-public information from the other that is marked as confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Customer Data is your Confidential Information. Details of our non-public security measures and unreleased features are ours.

14.2 The receiving party must use the other's Confidential Information only for this agreement, protect it with at least reasonable care, and share it only with its personnel, contractors and advisers who need to know it and are bound by similar confidentiality obligations.

14.3 These obligations do not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already lawfully had or independently developed, or that it lawfully receives from someone else without a duty of confidence.

14.4 A party may disclose Confidential Information where the law or a court or regulator requires it. Where the law allows, it must give the other party prompt notice so that the other party can seek protection. If a government authority asks us for Customer Data, we will first try to redirect the request to you.

15. Intellectual property and feedback

15.1 Our property. We and our licensors own the Service, including its software, design, branding, documentation and everything we develop, other than Customer Data. "Kanbrio" and our logos are our trade marks. These Terms do not give you any rights in them except the right to use the Service.

15.2 Your right to use the Service. While this agreement is in force, we give you and your Users a non-exclusive, non-transferable right to use the Service for your internal business and professional purposes, in line with these Terms and your Plan. Your Agents may use the Service on your behalf within the same limits.

15.3 Open-source components. Parts of the Service may include open-source software. Where an open-source licence gives you rights that differ from these Terms, that licence prevails for that component.

15.4 Feedback. If you give us suggestions or feedback about the Service, we may use them freely and without payment to you. We will not identify you as the source of feedback publicly without your consent. Feedback does not include Customer Data.

15.5 Publicity. We will not name you as a customer or use your logo without your permission.

16. Security and incidents

16.1 We protect the Service and Customer Data with technical and organisational measures appropriate to the risk, as described on our security page and in the Data Processing Agreement. These include separating each customer's data at the database level, encrypting traffic in transit, recording actions in an append-only audit log, and taking regular backups.

16.2 No online service can be perfectly secure, and we cannot guarantee that unauthorised access will never happen. You are responsible for the security of your own devices, credentials, Agents, connected services and code repositories.

16.3 If we become aware of a security breach that affects your Customer Data, we will tell your Organisation's owner without undue delay and in any case within 72 hours of becoming aware of it. We will give you the information we reasonably can to help you meet your own obligations, and we will make any notifications to regulators and affected people that the law requires of us.

16.4 If you find a security vulnerability in the Service, please report it as described on our security page and at kanbrio.com/.well-known/security.txt. Do not access other customers' data or disrupt the Service while testing.

17. Your rights under consumer law

17.1 Australian Consumer Law. Our services come with guarantees that cannot be excluded under the Australian Consumer Law. Nothing in these Terms excludes, restricts or changes any right or remedy, or any guarantee, warranty or other term or condition implied or imposed by any law, that cannot lawfully be excluded or limited ("Non-excludable Rights"). This includes the guarantees that our services will be provided with due care and skill, will be reasonably fit for any purpose you make known to us, and will be supplied within a reasonable time.

17.2 Limiting our liability where the law allows. If the Service is not of a kind ordinarily acquired for personal, domestic or household use or consumption, then, to the extent the law allows, our liability for failing to comply with a consumer guarantee is limited, at our option, to supplying the services again or paying the cost of having them supplied again.

17.3 Rights in other countries. If you are a consumer, or otherwise have rights under the mandatory laws of the country where you live that cannot be excluded by agreement (for example the right to withdraw from a contract in the European Union or the United Kingdom), you keep those rights.

17.4 How these Terms should be read. Every limitation, exclusion and disclaimer in these Terms applies only to the extent the law allows, and is subject to this clause 17.

18. Warranties and disclaimers

18.1 What we promise. We will provide the Service with reasonable care and skill, and the Service will perform materially as described in its documentation. If it does not, tell us, and we will make reasonable efforts to fix it. If we cannot fix it within a reasonable time, you may end the affected subscription and receive a refund of the prepaid part of the period that you have not used. This is in addition to your rights under clause 17.

18.2 What we do not promise. Except as stated in clauses 17 and 18.1, and to the extent the law allows, the Service is provided "as is" and "as available". In particular, we do not promise that:

(a) the Service will be uninterrupted or error-free;

(b) AI Output or anything an Agent does will be accurate, complete, secure, suitable for your purpose, or free of third-party rights;

(c) code produced by the coding executor will work, will be secure, or will be safe to merge; or

(d) third-party services connected to the Service will be available or will behave as expected.

18.3 Backups are not a substitute for your own. We back up the Service regularly, but you should keep your own copies of any Customer Data that is critical to you, for example by using the export features.

19. Limitation of liability

19.1 Nothing limits liability that cannot be limited. Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by its negligence, for fraud, for wilful misconduct, or for anything else that cannot lawfully be limited or excluded, including your Non-excludable Rights.

19.2 Indirect losses. Subject to clauses 17 and 19.1, neither party is liable to the other for any loss of profit, revenue, business opportunity or goodwill, or for any indirect or consequential loss, however it arises.

19.3 Overall cap. Subject to clauses 17, 19.1 and 19.4, each party's total liability to the other arising out of or in connection with these Terms or the Service, whatever the cause (including negligence), is limited to the greater of:

(a) the total amount you paid us for the Service in the 12 months before the event that gave rise to the liability; and

(b) US$100.

19.4 What the cap does not cover. The cap in clause 19.3 does not apply to: (a) your obligation to pay fees that are due; (b) amounts payable under an indemnity in clause 20; or (c) a party's liability for breaching clause 14 (Confidentiality), which is instead capped at three times the amount in clause 19.3.

19.5 Contribution. Each party's liability is reduced to the extent the other party, or its Users or Agents, caused or contributed to the loss.

19.6 Mitigation. Each party must take reasonable steps to reduce any loss it suffers.

20. Indemnities

20.1 By you. You will defend us against any claim by a third party, and pay any amounts finally awarded against us or agreed in a settlement you approve, to the extent the claim arises from:

(a) Customer Data, including a claim that Customer Data infringes someone's rights, or that processing it in line with your instructions breaks the law;

(b) the conduct of your Users or your Agents in breach of these Terms or the Acceptable Use Policy; or

(c) a third-party service that you connected to the Service or sent data to.

20.2 By us. We will defend you against any claim by a third party that your use of the Service in line with these Terms infringes that party's intellectual property rights, and pay any amounts finally awarded against you or agreed in a settlement we approve. This does not cover claims arising from Customer Data, AI Output, third-party services, open-source components used under their own licences, or your combination of the Service with things we did not provide. If such a claim is made or seems likely, we may change the Service so that it no longer infringes, get you the right to keep using it, or, if neither is reasonably possible, end the affected subscription and refund the prepaid part of the period that you have not used.

20.3 How indemnities work. The party seeking protection must tell the other party promptly about the claim, let it control the defence and any settlement (a settlement cannot impose an admission or obligation on the protected party without its consent), and give reasonable help at the other party's cost. A failure to tell the other party promptly reduces the indemnity only to the extent the delay caused prejudice.

20.4 Consumers. Clause 20.1 does not apply to you if you use the Service as a consumer, except to the extent the law allows.

21. Beta and preview features

21.1 We may offer features labelled "beta", "preview" or similar. They are optional, may change or be withdrawn at any time, may be less reliable than the rest of the Service, and may not be supported.

21.2 Subject to clause 17, we give no promises about beta features beyond using reasonable care and skill, and they are not included in any availability commitment.

21.3 We will not charge for a beta feature without telling you first, and your Customer Data in a beta feature is protected in the same way as the rest of your Customer Data.

22. Changes to these Terms

22.1 We may update these Terms, for example to reflect changes to the Service, to the law, or to how we run our business. Each version is dated and numbered, and previous versions and a change log are available from kanbrio.com/terms.

22.2 For a change that materially affects your rights or obligations, we will give you at least 30 days' notice by email to your Organisation's owner and in the app before the change takes effect. Changes that benefit you, or that are needed urgently for legal or security reasons, may take effect sooner, and we will tell you about them as soon as we reasonably can.

22.3 If you do not agree to a change, you may end this agreement before the change takes effect, or within 30 days after it takes effect, and we will refund the prepaid part of any period that you have not used. If you keep using the Service after the change takes effect, the updated Terms apply to you, and we will ask you to confirm your acceptance and record it.

22.4 Changes do not apply retrospectively to disputes that arose before the change.

23. Governing law and disputes

23.1 Law. These Terms are governed by the law of Queensland, Australia.

23.2 Courts. Each party submits to the non-exclusive jurisdiction of the courts of Queensland and of the courts that hear appeals from them.

23.3 Consumers. If you are a consumer, you may also bring proceedings in the courts of the place where you live, and you keep the protection of the mandatory laws of that place.

23.4 Talk to us first. If a dispute arises, please email [email protected] with the details. Both parties will try in good faith to resolve it within 30 days before starting court proceedings. This does not stop either party from seeking urgent relief from a court, and it does not affect your right to complain to a regulator or consumer body.

24. General

24.1 Entire agreement. These Terms, together with the documents listed in clause 1.4 and any order form, are the whole agreement between you and us about the Service. They replace any earlier understanding about the same subject. Nothing in this clause limits liability for fraud.

24.2 Notices. We send notices to the email address of your Organisation's owner, and we may also show them in the app. You send notices to [email protected], or, for privacy matters, to [email protected]. An email notice is received when it is sent, unless the sender receives a message that it was not delivered.

24.3 Transfer of this agreement. You may transfer this agreement to someone else only with our written consent, which we will not unreasonably withhold. We may transfer it to a business that takes over all or most of the Service, provided we give you notice and the new provider takes on our obligations under it. If you object to such a transfer, you may end this agreement and receive a refund of the prepaid part of any period that you have not used.

24.4 Subcontractors. We may use subcontractors and service providers to help provide the Service. Those that process personal data are listed on our sub-processor list. We remain responsible for their performance of our obligations.

24.5 Events outside our control. Neither party is liable for a delay or failure caused by an event outside its reasonable control, such as a natural disaster, a widespread power, internet or telecommunications failure, a failure of an upstream provider, or government action, provided it takes reasonable steps to limit the effect and resumes performance as soon as practical. This clause does not excuse your obligation to pay for periods in which the Service was available to you. If such an event prevents us from providing the Service for more than 30 days in a row, you may end this agreement and receive a refund of the prepaid part of the period that you have not used.

24.6 Sanctions and export control. You must not use the Service in breach of any sanctions or export control law that applies to you or to us, and you confirm that you are not a person with whom such a law prohibits us from dealing.

24.7 Severability. If any part of these Terms is found to be unenforceable, it is read down to the extent needed to make it enforceable, or, if that is not possible, removed. The rest of these Terms continues to apply.

24.8 No waiver. If a party does not enforce a right straight away, that does not mean it has given up that right.

24.9 Relationship. The parties are independent contractors. These Terms do not create a partnership, employment or agency relationship.

24.10 No third-party rights. Only you and we have rights under these Terms, except where they expressly say otherwise.

24.11 Language. These Terms are written in English. If we provide a translation, the English version prevails to the extent the law allows.

25. Contact us

[to be confirmed] (ABN [to be confirmed]), trading as Kanbrio [to be confirmed]

• Legal notices, billing questions and disputes: [email protected]
• Privacy and data requests: [email protected]
• Security vulnerabilities: see kanbrio.com/security

Change log