AIR-Core Terms and Conditions of Use

Version 2026-11. In force since [EFFECTIVE DATE]. Replaces the “Terms of Service” of 29-10-2019.

The essentials

• AIR-Core is a cloud platform for analysing data and creating machine learning models without coding. It is provided by AIR Institute from the European Union (AWS, Frankfurt).
• Your data is yours. We process it only to provide the service to you, as a data processor, and we do not use it to train AI models.
• You can export your data and leave whenever you like, at no cost.
• If you are a consumer, you have 14 days to withdraw and all the legal guarantees, which these terms do not limit.
• Generative AI features can make mistakes: check their results. On the Free plan you can only use them with your own API key.
• We change prices or terms with 30 days' notice and you can always cancel beforehand.
• Free accounts unused for 12 months are deactivated after two notices.

This summary does not replace the full text.

1. Who we are

1.1. The AIR-Core service (https://app.air-core.io, the API and the MCP server) is provided by:

• INSTITUTO INTERNACIONAL DE INVESTIGACIÓN EN INTELIGENCIA ARTIFICIAL Y CIENCIAS DE LA COMPUTACIÓN (“AIR Institute”, “we”).
• Tax ID (NIF) G37571627.
• Address: Av. Santiago Madrigal, 39, 37003 Salamanca (Spain).
• Registration: registered on 01/08/2018 under protocol 2609 (according to the data protection policy of air-institute.com). [PENDING: name of the register and registration number].
• Contact: info@air-institute.com (opens your email app) (legal matters), info@air-institute.com (opens your email app) (support), phone +34 983 642 099.

1.2. Full details are in the Legal notice (https://air-core.io/aviso-legal).

2. Purpose, scope and definitions

2.1. These Terms govern access to and use of AIR-Core, including the web interface, the API, the MCP server, the connectors and the AI features. The following form part of the contract:

• the Data Processing Agreement (DPA), annexed to these Terms;
• the Privacy Policy and the Cookie Policy, for information purposes;
• the pricing page in force at the time of subscription;
• where applicable, a signed specific contract or order form, which prevails in what it expressly regulates.

2.2. Definitions:

• Customer: the natural or legal person who owns the Organization that subscribes to AIR-Core.
• Consumer: a Customer who is a natural person acting for purposes outside their trade, business, craft or profession (TRLGDCU art. 3). Rules marked “Consumers” apply only to them.
• Professional Customer: any Customer who is not a Consumer. Rules marked “Professionals” apply only to them.
• User: each person with login credentials for an Organization. It may be the Customer itself or someone the Customer has invited.
• Organization: the account space, with its workspaces, members, plan and billing.
• Customer Data: everything the Customer or its Users upload, connect or generate in AIR-Core: sources, datasets, models, predictions, visualizations, dashboards, alerts, conversations with the assistant and Results.
• Results: what AIR-Core produces from Customer Data: models, predictions, explanations and AI-generated content.
• AI Features: the conversational assistant, the “Do it with AI” features, the generation of text or configurations through language models, and model explainability.
• AIR-Core AI: AI Features run with models that AIR Institute contracts and pays for (Amazon Bedrock, EU region) and that are charged with AI Credits.
• BYOK (“bring your own key”): use of the AI Features with the Customer's own API key with a Third-Party AI Provider of its choice.
• Third-Party AI Provider: OpenAI, Anthropic, Groq, Google (Gemini) or any OpenAI API-compatible endpoint that the Customer sets up.
• External MCP Application: a third-party AI application (for example Claude or ChatGPT) that the User authorizes through OAuth to act on their account through the AIR-Core MCP server.
• AI credits: prepaid units for using AIR-Core AI.
• Plan: the subscription option chosen (Free, Starter, Professional, Business or Enterprise) with its limits and price.

3. Capacity, subscription and acceptance

3.1. To use AIR-Core you must be over 18 and have the capacity to enter into contracts. Anyone who signs up on behalf of a company or entity declares that they have the power to bind it. In that case the Customer is the entity.

3.2. Subscription process (LSSI-CE art. 27):

1. Sign-up with email or with Google or GitHub.
2. Reading and express acceptance of these Terms (unticked box) and access to the Privacy Policy.
3. For paid plans, choice of plan and billing period. Before payment, the total price, taxes and duration are shown.
4. Payment through Stripe with the “Pay” or “Subscribe with obligation to pay” button.
5. Confirmation by email within 24 hours at most, with these Terms in PDF and the invoice.

Before confirming, input errors can be corrected by going back to the previous step. The contract is concluded in Spanish or English, at the Customer's choice. AIR Institute archives the electronic contract document and the Customer can request a copy at info@air-institute.com (opens your email app).

3.3. Acceptance is recorded with the version of the Terms, the date and time, the user and the technical data of the session.

4. Account, access and security

4.1. The Customer and its Users must provide truthful data and keep it up to date, keep their credentials and API tokens secret, and notify us without delay at info@air-institute.com (opens your email app) if they suspect unauthorized access. We recommend enabling two-step verification.

4.2. If you log in with Google or GitHub, that provider authenticates the User under its own terms. AIR-Core receives only the data indicated in the Privacy Policy.

4.3. The Organization's administrators decide who has access and with what permissions, and are responsible for how their Users use it. With each significant change to the account we send an email to the User concerned.

4.4. API tokens and OAuth authorizations (including those of the MCP server) act with the permissions of the User who issued them. They can be revoked at any time from “Account → Applications and tokens”.

5. The service and how it evolves

5.1. Depending on the Plan, AIR-Core lets you:

• import and connect data sources;
• transform and visualize them;
• train and apply machine learning models and explain them;
• create dashboards and alerts by email or webhook;
• use the AI Features and access through the API and MCP.

The features and limits of each Plan are on the pricing page and in “Organization → Quota”.

5.2. We may modify the service, and add, replace or withdraw features, for justified reasons:

• security;
• legal changes;
• changes to or discontinuation of a provider (for example, of an AI model);
• technical obsolescence;
• product improvement.

Improvements and neutral changes are simply applied. If a change significantly harms the Customer (for example, withdrawing a main feature of its Plan), we will give at least 30 days notice. The Customer may then terminate the contract at no cost and receive the proportional part of what was paid for unused periods and of unused AI Credits. For Consumers, this includes the provisions of art. 126 bis TRLGDCU. If the change is necessary for an urgent security or legal reason, we will give notice as soon as possible.

5.3. The specific AI models we offer may change to others with equivalent or better performance, because their makers withdraw or update them. Such changes are not considered harmful unless they substantially reduce the subscribed functionality.

6. Prices, payment, renewal and invoicing

6.1. Prices. The prices of each Plan, of additional users and of AI Credits are shown in euros on the pricing page.

• Consumers: the price shown is the final price including VAT and any other applicable tax.
• Professionals: the price is shown excluding VAT. If the Customer provides a valid intra-Community VAT number from another Member State, the reverse charge applies.

6.2. Payment. Payments are processed with Stripe (Stripe Payments Europe, Ltd.). AIR Institute neither stores nor sees the full card number or the CVC.

6.3. Renewal. Monthly or yearly subscriptions renew automatically for equal periods, at the price in force under clause 7, unless cancelled before the end of the current period from “Organization → Billing”. Cancelling is as easy as subscribing and takes effect at the end of the paid period. For yearly plans we send an email reminder at least 15 days before renewal.

6.4. Strong authentication. Your bank may ask you for strong authentication (for example 3-D Secure) when subscribing. Renewals and usage charges are merchant-initiated charges under the mandate you give when subscribing.

6.5. Plan changes.

• An upgrade applies immediately and the proportional difference for the current period is charged.
• A downgrade takes effect at the start of the next period. If the new Plan's limits are exceeded, the Customer must reduce usage or export the surplus data before that date. Otherwise, the excess resources become read-only, without being deleted, for 90 days.

6.6. Non-payment. If a charge fails, we notify you by email and retry for 14 days. If it remains unpaid, the Organization moves to the Free Plan (or is suspended if its data exceeds the Free limits), without deleting data for 90 days. During that period the Customer can settle or export.

6.7. Invoices. They are issued electronically and sent to the billing email. They can also be downloaded from the account. Tax data is used only for invoicing and to meet legal obligations.

6.8. Charge disputes.

• Professionals: must report any billing error within 90 days of the charge.
• Consumers: may claim within the legal time limits.

7. Price changes

7.1. The prices of the Plans and of AI Credits, and the table of credit consumption per model, may be changed only for objective reasons:

• (a) changes in cloud infrastructure costs;
• (b) changes in the prices of AI model providers;
• (c) changes in payment processing costs;
• (d) the creation or modification of taxes, fees or legal charges;
• (e) significant changes to the service that extend its features.

Price reductions apply immediately and without prior notice.

7.2. Increases are announced by email and in the application at least 30 calendar days in advance. The notice states the new price, the reason and the date it applies from.

7.3. They do not affect periods already paid. They apply from the first renewal after the date they take effect. For yearly plans, from the next yearly renewal.

7.4. If the Customer does not agree, it can cancel the renewal before the date the change applies without penalty and keeps using the service until the end of the paid period at the previous price.

7.5. If the credit consumption table changes, AI Credits already purchased keep their value in euros. If the change reduces what unused top-up credits can buy and the Customer does not accept it, it can request a refund of those unused credits within 30 days of the notice.

8. AI credits

8.1. AIR-Core AI is charged with AI Credits. The pricing page and the “AI usage” screen show:

• the equivalence of credits in euros: 1 credit = €1;
• consumption per model and operation;
• the available balance.

An estimate is shown before a high-consumption operation. The Customer can set spending caps.

8.2. Credits included in the Plan: they renew at the start of each monthly billing period (also on yearly plans) and expire at the end of that month without carrying over.

8.3. Top-up credits (bought separately): expire 12 months after purchase. We send an email 30 days before top-up credits expire.

8.4. Order of consumption: first the included credits and then the top-up credits, oldest first.

8.5. No refunds. AI Credits are not refunded or exchanged for money, with these exceptions:

• (a) Consumers: right of withdrawal (clause 19). On withdrawal, unused credits are refunded.
• (b) Lack of conformity of the service.
• (c) Termination of the contract by AIR Institute for reasons not attributable to the Customer, or discontinuation of AIR-Core AI.
• (d) Termination by the Customer because it does not accept a change to the Terms (clause 24) or to prices (clause 7).
• (e) Any other case where the law requires it.

In cases (c) and (d), unused and unexpired top-up credits are refunded.

8.6. If an operation fails for a reason attributable to AIR-Core, the credits it used are restored.

8.7. Credits are assigned to the Organization. They cannot be transferred to other organizations or to third parties.

8.8. AI Credits only entitle you to use AIR-Core services. They are not electronic money or a means of payment.

9. AI Features

9.1. What they are. AIR-Core integrates language models to:

• chat with an assistant that looks things up and proposes actions on your account;
• generate configurations, transformations, alerts and texts from natural-language instructions (“Do it with AI”);
• explain models and predictions.

Explainability (SHAP values) is an approximate statistical calculation and does not use generative AI.

9.2. AIR-Core AI (Amazon Bedrock, EU). When you use AIR-Core AI:

• requests are processed with Anthropic models (Claude family) served by Amazon Web Services through Amazon Bedrock with a European Union inference profile, so the data is processed in AWS regions in the EU;
• AWS does not store the requests or use them to train models, and the model maker has no access to them;
• AIR Institute does not use Customer Data to train or improve AI models.

To respond, the model receives the User's instruction and the necessary context: schemas, column names, statistics and, if needed, limited samples of rows.

9.3. Free Plan. The Free Plan does not include AIR-Core AI. On the Free Plan, generative AI features can only be used through BYOK. All other Free Plan features remain available.

9.4. BYOK (own key). If the Customer sets up a key from a Third-Party AI Provider:

• (a) AIR-Core sends that provider, on the Customer's instructions, the instruction and context necessary for each request. That data is processed under the contract, terms and privacy policy the Customer has with that provider, which is chosen by the Customer and is not a sub-processor of AIR Institute.
• (b) The Customer must make sure it can send that data to that provider: legal basis, processing agreement with the provider and, if it is outside the EEA, safeguards for the international transfer.
• (c) The provider invoices the Customer directly. AIR Institute is not responsible for the provider's availability, cost, security or results.
• (d) The key is stored encrypted and used only for the Customer's requests. The Customer can delete it at any time and must revoke it with the provider if it suspects it has been compromised.
• (e) The Customer must comply with the provider's usage policies.

9.5. External MCP Applications. If a User authorizes an external application through OAuth:

• that application can read, or read and modify depending on the permission granted, what the User can see and do in the chosen Organization;
• the data the application obtains is sent to its provider and is governed by the User's contract with it;
• the actions the application performs are attributed to the User who authorized it.

The MCP server offers no delete tools and logs every call. The authorization can be revoked at any time.

9.6. Transparency.

• AIR-Core always indicates that you are interacting with an AI system and which model is responding.
• It labels the content it generates as “Generated with AI”.
• It includes the ai_generated flag and the model in API responses, webhooks and exports that contain generated content.

If the Customer publishes that content to inform the public on matters of public interest, it is responsible for complying with the obligation to disclose it (Regulation (EU) 2024/1689, art. 50.4), unless there is human review and editorial responsibility.

9.7. Human oversight and limits. AI Results may be incomplete, inaccurate or unsuitable. The User must review them before using or applying them. Actions proposed by the assistant that modify the account are carried out only after the User's express confirmation. Results are not professional advice (legal, medical, financial or otherwise).

9.8. Prohibited uses and high risk. AIR-Core may not be used for:

• the practices prohibited by art. 5 of Regulation (EU) 2024/1689 (subliminal manipulation or exploitation of vulnerabilities, social scoring, crime prediction based solely on profiling, facial recognition databases built by untargeted scraping, emotion recognition at work or in education, biometric categorization of sensitive data, real-time remote biometric identification for law enforcement, among others);
• taking decisions with legal or similarly significant effects on people without human involvement, unless the Customer complies with art. 22 GDPR.

If the Customer uses models created in AIR-Core as a high-risk AI system (annex III of the Regulation), for example in employment, credit, education, access to essential services or critical infrastructure:

• the Customer is its provider or deployer and assumes the obligations of the Regulation;
• AIR-Core is offered as a general-purpose tool and is not designed or assessed for that purpose;
• each model's automatic model card states its limitations and out-of-scope uses.

9.9. AI literacy. AIR Institute trains its staff in AI and makes documentation available to Customers on how the AI Features work and their limits. Each Customer is responsible for training its own Users when it acts as deployer.

10. Customer Data and data protection

10.1. Ownership. The Customer keeps all rights to Customer Data and Results. AIR Institute receives only the licence necessary to host, process and display them in order to provide the service, following the Customer's instructions.

10.2. Roles.

• With regard to personal data contained in Customer Data, the Customer is the controller and AIR Institute is the processor. The processing is governed by the Data Processing Agreement, which is accepted together with these Terms.
• With regard to account, usage and billing data, AIR Institute is the controller under the Privacy Policy.

10.3. Customer warranties. The Customer warrants that it has the right to use the data it uploads or connects and that processing it in AIR-Core is lawful. This includes:

• having a legal basis under art. 6 GDPR, which may be consent or another (contract, legitimate interest, legal obligation…);
• where applicable, an exception under art. 9 for special categories;
• having informed the data subjects;
• not infringing third-party rights.

10.4. Access by AIR Institute. AIR Institute staff do not access the content of Customer Data except in these cases:

• (a) to provide the service in an automated way (for example, when training a model or sending context to the AI model the Customer invokes);
• (b) when the Customer expressly authorizes it to resolve a support ticket, with the scope and duration stated in that authorization;
• (c) when necessary for the security of the service;
• (d) when required by law or by an order of a competent authority, in which case the Customer will be notified if the law allows it.

10.5. Aggregate statistics. AIR Institute may produce aggregate, anonymous statistics on use of the service, without the content of Customer Data, to operate and improve AIR-Core.

10.6. Your own copies. We keep backups in accordance with the DPA. Even so, we recommend that the Customer keep copies of data that is critical to its business.

10.7. Confidentiality. AIR Institute treats Customer Data as confidential and does not sell or transfer it to third parties except as provided in the DPA.

11. Acceptable use

11.1. It is prohibited to use AIR-Core to:

• (a) store, disseminate or process content that is illegal or that infringes intellectual or industrial property rights, image rights, privacy or data protection;
• (b) carry out fraudulent activities, send unsolicited communications or impersonate others;
• (c) introduce malware or attack third-party systems, including through connectors, webhooks or external sources;
• (d) circumvent Plan limits, access controls or security measures, or share credentials between people;
• (e) carry out vulnerability testing without prior written authorization. Vulnerabilities can be reported responsibly to info@air-institute.com (opens your email app);
• (f) generate a disproportionate load or carry out mass scraping of the interface;
• (g) carry out the practices described in clause 9.8;
• (h) develop a competing service by copying AIR-Core.

11.2. Decompilation or reverse engineering is not permitted except where the law authorizes it (Spanish Intellectual Property Law, art. 100).

12. Notice of illegal content and moderation (Digital Services Act)

12.1. Points of contact. For Member State authorities, the Commission and the European Board for Digital Services: info@air-institute.com (opens your email app). For recipients of the service: info@air-institute.com (opens your email app) and info@air-institute.com (opens your email app). Languages: Spanish and English. These communications are not handled by automated tools alone.

12.2. Notices. Anyone can report allegedly illegal content hosted on AIR-Core (for example, a public dashboard or download link) at info@air-institute.com (opens your email app) [or using the form at https://air-core.io/denuncia — PENDING]. The notice must include:

• (a) a reasoned explanation of why the content is illegal;
• (b) the exact URL;
• (c) the name and email of the person giving notice (except for child sexual abuse offences);
• (d) a statement of good faith.

We will acknowledge receipt and respond diligently, without arbitrariness and with human review.

12.3. Measures. In response to content that is illegal or contrary to these Terms, we may, proportionately:

• remove the content or disable public access to it;
• suspend features;
• suspend the account.

Automated tools are used only to detect technical abuse, such as excessive load or malware, and every measure on content is reviewed by a person.

12.4. Statement of reasons. When we restrict content or an account, we will inform the person affected of:

• the measure and its scope;
• the facts and the basis (legal or contractual);
• whether automated means were used;
• the means of redress: reply to info@air-institute.com (opens your email app), complaint to the competent authority, and the courts.

We will not do so when an authority prohibits it.

12.5. If we become aware of information giving rise to a suspicion of a criminal offence that threatens the life or safety of persons, we will inform the competent authorities.

12.6. AIR-Core is a data hosting service. Public dashboards and links are an ancillary feature of the analysis service. [If AIR Institute is not a micro or small enterprise: the transparency report under art. 15 DSA will be published annually.]

13. Public dashboards, shared links and third-party analytics

13.1. By default, dashboards and data are private. If the Customer makes them public or enables download links, anyone with the link can view or download their content. The Customer decides what it publishes and is responsible for it, including any personal data it contains.

13.2. If the Customer sets up a Google Analytics ID or another analytics tool on a shared dashboard:

• the Customer is the controller of that data;
• AIR-Core loads the tool only after the visitor gives consent in the dashboard's cookie notice;
• if the notice cannot be shown (for example, on an embedded dashboard), the tool is not loaded.

14. Intellectual property and licence

14.1. AIR-Core, its software, its design, the documentation and the trademarks belong to AIR Institute or its licensors. For the term of the contract, AIR Institute grants the Customer and its Users a non-exclusive, non-transferable licence, limited to the Plan's limits, to use AIR-Core for their personal or professional purposes, including commercial ones.

14.2. Models downloaded as an executable application may be used freely by the Customer.

14.3. Suggestions the Customer sends us may be used to improve AIR-Core without any obligation to compensate. They will never include Customer Data.

14.4. AIR-Core includes open-source components governed by their own licences.

15. Availability and support

15.1. We take reasonable steps to keep AIR-Core continuously available. Interruptions are possible:

• scheduled maintenance: we will give reasonable advance notice if it has a significant impact;
• updates;
• provider incidents;
• force majeure.

15.2. Support is provided through the channels and within the times of each Plan. Guaranteed service levels (SLAs), with compensation, exist only if agreed in writing (Enterprise Plan or specific contract).

16. Inactivity of free accounts

16.1. Scope. This clause applies to Organizations on the Free Plan without an active paid subscription.

16.2. Inactivity. An Organization is inactive when, for 12 consecutive months, none of its Users has logged in to the website or used the API or the MCP server with their credentials. The following do not count as activity:

• automatic processes set up within AIR-Core (scheduled updates, alerts, real-time ingestion);
• visits to public dashboards.

16.3. Notices. We will email the owner and the administrators 30 days and 7 days before deactivation. The notice will state the date and how to avoid it.

16.4. Deactivation. Once the period has passed without activity, the Organization is deactivated:

• public dashboards and links are no longer accessible;
• scheduled tasks, alerts, webhooks and real-time ingestion are stopped;
• API tokens and OAuth and MCP authorizations are suspended.

The data is kept for 90 days from deactivation. We will confirm this by email, stating the date from which it may be deleted.

16.5. Reactivation. Simply log in (or subscribe to a paid Plan) within those 90 days. The account is restored with its data. Scheduled tasks and alerts stay paused until the Customer re-enables them.

16.6. Deletion. After 90 days without reactivation, AIR Institute may permanently delete the Organization and its data. Backups are deleted in the ordinary rotation cycle, within [35] days at most. Data that the law requires to be kept (for example, billing data) remains blocked for the legal period.

16.7. Export. The Customer can export its data at any time before deletion (clause 18).

16.8. Exceptions. Data subject to a request from an authority, an ongoing claim or a legal retention obligation will not be deleted.

16.9. Transition. For Organizations that are already inactive when this version comes into force, the first notice will not be sent before that date and deactivation will not take place until at least 30 days later.

17. Suspension and termination

17.1. By the Customer. The Customer can:

• cancel its subscription at any time, effective at the end of the paid period;
• delete its account from “Account → Delete account”.

Before deleting it, it must export anything it wants to keep: deletion is irreversible after the period in clause 18.4.

17.2. Suspension by AIR Institute. We may suspend access in whole or in part, proportionately, for these reasons:

• (a) non-payment (clause 6.6);
• (b) serious breach of these Terms, in particular clauses 9.8 and 11;
• (c) risk to the security or integrity of the service or of third parties;
• (d) order of a competent authority.

Except in urgent cases or where legally prohibited, we will give notice first, allow a reasonable period to remedy and explain the reasons (clause 12.4). The suspension is lifted when the cause ends.

17.3. Termination by AIR Institute.

• With cause: for a serious breach not remedied within 15 days of notice, or a repeated breach.
• Without cause: with at least 60 days notice, in which case the proportional part of paid but unused periods and unused top-up Credits are refunded.

17.4. Effects. When the contract ends, clause 18 (data retrieval and deletion) applies. Account and billing data is processed under the Privacy Policy. Clauses that by their nature must survive remain in force, in particular clauses 10, 14, 21, 23 and 28.

18. Portability, switching provider and exit (Regulation (EU) 2023/2854, Data Act)

18.1. Export at any time. On any Plan, the Customer can export:

• (a) the complete workspace in a ZIP containing:
  • the sources (data in CSV and metadata in JSON);
  • the models (signed);
  • the visualizations, dashboards and alerts (configuration in JSON);
• (b) the data of each source in CSV, JSON, XLSX or SQL dump, from the interface or through the API.

The formats are open, structured and commonly used.

18.2. Exportable data. All Customer Data is exportable:

• source data;
• metadata;
• models;
• configurations;
• visualizations, dashboards and alerts;
• assistant history (on request);
• AI activity log (for administrators).

Not exported, for security reasons or because they are part of AIR-Core's internal workings: internal encryption keys, credentials for external connections and BYOK keys (they are entered again at the destination), and the platform's internal technical logs.

18.3. Request to switch or exit. The Customer can ask at any time, from the account or at info@air-institute.com (opens your email app), to switch to another provider, move to its own infrastructure or simply delete its data.

• Notice: the maximum notice period is 2 months. The Customer can choose a shorter period.
• Transition: this is followed by a transition period of up to 30 calendar days. During it the service is maintained, reasonable assistance is provided, known risks to continuity are reported and an appropriate level of security is kept.
• Extension: the Customer can extend the transition period once, for as long as it considers appropriate.
• If it is not technically feasible: we will say so within 14 working days of the request, give our reasons and propose an alternative period of up to 7 months.

18.4. Retrieval and deletion. After the transition period, the Customer has at least 30 calendar days to retrieve its data. At the end of that period, if the switch has been completed or the Customer has asked only for deletion, AIR Institute deletes all exportable data and assets, notifies the Customer and treats the contract as terminated. Backups are deleted in the ordinary rotation cycle.

18.5. No exit fees. AIR Institute charges no fees for switching provider, exporting or data egress.

18.6. Information. The export documentation (procedures, formats, structures and known limitations) is at [documentation URL]. The infrastructure is in the EU (AWS, Frankfurt). The Privacy Policy describes the measures against access by authorities of third countries.

18.7. For custom-built services (Enterprise Plan or private deployments), the provisions of their contract apply, within what the Data Act allows.

19. Right of withdrawal (Consumers only)

19.1. The Consumer may withdraw from the contract within 14 calendar days of its conclusion (or of the purchase of each credit top-up), without giving a reason and without penalty. To withdraw, they can use:

• the “Withdraw from the contract here” button in “Organization → Billing”, available during that period;
• the form in Annex A, sent to info@air-institute.com (opens your email app);
• any other unequivocal statement.

19.2. Immediate performance. If the Consumer expressly asks when subscribing for the service to start during the withdrawal period, they keep the right to withdraw, but will pay the proportional part of the service provided until they communicate the withdrawal. The same applies to AI Credits already used (TRLGDCU art. 108.3).

If the service has been fully provided (for example, if all the credits of a top-up have been used) with their express consent and acknowledgement that they lose the right of withdrawal, that right ends (TRLGDCU art. 103.a).

19.3. Refund. We will refund the amounts due within 14 days at most of the communication, by the same means of payment and at no cost.

20. Guarantees and conformity

20.1. Consumers. AIR Institute is liable for any lack of conformity of the digital service under arts. 114 to 127 bis TRLGDCU throughout the period of supply. This includes the updates necessary to maintain conformity. The Consumer can require the service to be brought into conformity, a price reduction or termination of the contract. Nothing in these Terms limits these rights.

20.2. Professionals. The service is provided with the diligence of a professional provider and in accordance with its description. Except as expressly provided in these Terms and to the extent permitted by law, there is no guarantee:

• that AIR-Core will meet particular needs not agreed;
• that it will work without interruption;
• that the Results, in particular predictive and AI models, will be accurate.

20.3. For all Customers: the accuracy of the models and Results depends on the Customer's data and configuration. Decisions taken with them are the responsibility of whoever takes them.

21. Liability

21.1. Consumers. AIR Institute is liable for damage it causes by breaching its obligations under the law. It is not liable for damage not attributable to AIR Institute, damage caused by force majeure or damage resulting from the Consumer's own breach of these Terms.

21.2. Professionals. To the extent permitted by law:

• (a) AIR Institute is not liable for loss of profit, loss of business, revenue or reputation, or for indirect or consequential damage;
• (b) AIR Institute's total liability for all claims arising from the contract in each 12-month period is limited to the amount paid by the Customer in the 12 months before the event giving rise to the claim. For Organizations on the Free Plan, the limit is 100 €.
• (c) AIR Institute is not liable for third-party services chosen by the Customer: Third-Party AI Providers in BYOK, External MCP Applications, external sources and webhook destinations.

21.3. The above limitations do not apply in these cases:

• damage caused by wilful misconduct or gross negligence;
• personal injury;
• breach of the duty of confidentiality;
• cases where the law does not allow liability to be limited.

22. Indemnity (Professionals only)

The Professional Customer will indemnify AIR Institute against third-party claims, penalties and reasonable costs, including defence costs, arising from:

• (a) Customer Data that infringes the law or third-party rights;
• (b) use of AIR-Core by the Customer or its Users contrary to clauses 9.8 or 11.

AIR Institute will give notice of the claim without delay and allow the Customer to conduct the defence.

23. Confidentiality

Each party will keep confidential the other's non-public information that it learns through the contract and will use it only to perform the contract. This obligation lasts while the contract is in force and for five years afterwards; for trade secrets and Customer Data, without time limit.

24. Changes to these Terms

24.1. We may change these Terms for these reasons:

• changes in the law or in the authorities' guidance;
• security;
• changes to the service or to providers;
• new features;
• correction of errors.

Each version is identified by a number (YYYY-MM) and an effective date. Previous versions are available at [version archive URL].

24.2. We will announce changes by email and in the application at least 30 days in advance, with a summary of what changes. Changes that only extend the Customer's rights, add optional new features or are urgently required by law may apply sooner, with notice.

24.3. New acceptance. From the effective date, to keep using AIR-Core you must accept the new version in the application (box and “Accept and continue” button). Continued use without accepting does not count as acceptance. In Professional Customers' Organizations, an administrator of the Organization accepts on behalf of the Customer and each User accepts the terms of use that affect them. API or MCP access for an Organization whose administrator has not accepted the new version may be limited to reading and exporting [30] days after the effective date.

24.4. If you do not accept, you can:

• export your data (clause 18) at any time;
• terminate the contract at no cost, with a refund of the proportional part of paid but unused periods and of unused top-up Credits.

Until you terminate, and for a maximum of [60] days from the effective date, the previous version will continue to apply to what you have already subscribed to.

25. Communications

Contractual communications are made by email to the Customer's account or billing address, and in the application. Communications from the Customer to AIR Institute are sent to info@air-institute.com (opens your email app) or info@air-institute.com (opens your email app). The Customer must keep its email up to date. Notices of this kind (changes to prices or Terms, inactivity, suspension) are not marketing communications and cannot be turned off.

26. Accessibility

AIR Institute works to make sign-up, subscription and use of AIR-Core meet the applicable accessibility requirements (Spanish Law 11/2023, standard EN 301 549). The accessibility statement, with the compliance status and a channel to report barriers, is at [URL]. [VERIFY the micro-enterprise exemption.]

27. General provisions

27.1. Force majeure. Neither party is liable for failures caused by events beyond its reasonable control, for as long as they last.

27.2. Assignment. AIR Institute may assign the contract to an entity that continues to provide AIR-Core, with 30 days' prior notice. The Customer may terminate the contract if it does not agree, with the effects of clause 24.4. The Professional Customer may assign the contract with the consent of AIR Institute, which will not be refused without reason.

27.3. Subcontracting. AIR Institute may use providers to deliver the service. For Customer Data, the rules of the DPA apply.

27.4. Partial invalidity. If a clause is invalid, the rest remains in force and the invalid clause is replaced by the applicable legal provision.

27.5. No waiver. Not exercising a right does not mean waiving it.

27.6. Language. If language versions conflict, the Spanish version prevails.

28. Governing law, jurisdiction and complaints

28.1. These Terms are governed by Spanish law. A Consumer residing in another Member State will not be deprived of the protection granted by the mandatory rules of their country of residence.

28.2. Jurisdiction.

• Consumers: the courts of the Consumer's place of residence have jurisdiction.
• Professionals: the parties submit to the courts of the city of Salamanca.

28.3. Complaints can be sent to info@air-institute.com (opens your email app); we will reply within one month at most. [AIR Institute is not a member of any alternative consumer dispute resolution body / is a member of: PENDING.] The Consumer can also go to the consumer services of their autonomous community or to the Consumer Arbitration Boards.

Annex A. Withdrawal form (Consumers only)

(Complete and return this form only if you wish to withdraw from the contract.)

To: INSTITUTO INTERNACIONAL DE INVESTIGACIÓN EN INTELIGENCIA ARTIFICIAL Y CIENCIAS DE LA COMPUTACIÓN (AIR Institute), Av. Santiago Madrigal, 39, 37003 Salamanca, info@air-institute.com (opens your email app).

I hereby give notice that I withdraw from my contract for the provision of the following service: ______ (plan / credit top-up).

• Subscribed on: ______
• Name of consumer: ______
• Account email: ______
• Address of consumer: ______
• Signature of consumer (only if this form is submitted on paper): ______
• Date: ______

Annex B. Plans (reference)

Current prices, in euros and including VAT for Consumers, are on the pricing page. This table is for information: the pricing page in force at the time of subscription prevails.