SaaS Terms and Conditions

Effective 10 September 2026 · Version 2.1

These are the SaaS Terms and Conditions (the "Terms") for the Aitonomy service, offered by Baby Elephant B.V., a private limited company having its registered office at Emmastraat 23, 2282 AM Rijswijk, The Netherlands, registered with the Dutch Chamber of Commerce under number 27299029, trading under the name Aitonomy and in these Terms referred to as "Aitonomy".

These Terms govern access to and use of the Service. Advisory, assessment, design and implementation work, including a Scan, is governed separately by the Services Terms and Conditions. Where an engagement covers both, both apply, each to its own subject.

These Terms can also be viewed and downloaded from joinaitonomy.ai, and may be sent to the Customer on request.

1. Definitions

1.1 In these Terms, words written with capitals and not defined elsewhere have the following meaning:

1.1.1 Affiliate: an entity that directly or indirectly controls, is controlled by, or is under common control with a party.

1.1.2 Agent: an AI agent, model or automated process that is configured, run, governed or reviewed by the Customer through the Service.

1.1.3 Aggregate Data: aggregated statistics derived by Aitonomy from Service Metrics across multiple customers that are not attributable to or identifiable with any customer.

1.1.4 Anonymous Data: Service Metrics from which the identity of the Customer and its source has been completely removed and which do not relate to an identified or identifiable natural person or to an identifiable customer.

1.1.5 Business Day: any weekday (Monday to Friday) other than a public holiday in the Netherlands.

1.1.6 Confidential Information: any information, in any form, disclosed by one party to the other that is marked confidential or that should reasonably be understood to be confidential given its nature or the circumstances of disclosure, including the Service, Customer Data, business and technical information, and the terms of the Agreement.

1.1.7 Customer: the legal person that has accepted these Terms or an Order Form in order to access and use the Service.

1.1.8 Customer Data: all data, documents, records, source code, repositories, specifications, tickets, prompts, configurations and other materials that the Customer or its Users make available to the Service, or that are generated through the Customer's use of the Service, including output produced by Agents, but excluding Service Metrics, Anonymous Data and Aggregate Data.

1.1.9 Customer Environment: the Customer's own infrastructure or third party subscriptions (including, where the Order Form so provides, the Customer's own AI subscription) within or upon which the Service operates where the Order Form so specifies.

1.1.10 Documentation: the user and technical documentation for the Service that Aitonomy makes available on request.

1.1.11 Fees: the fees payable by the Customer for the Service as set out in the Order Form.

1.1.12 GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679).

1.1.13 Intellectual Property: all intellectual property rights, whether registered or unregistered, including patents, copyrights (including rights in source code and object code), database rights, design rights, trademarks, trade names, and rights in know-how and trade secrets.

1.1.14 Order Form: the order, quote or written agreement between the parties that references these Terms and sets out the Service subscribed for, the configuration, the Fees, the term and any other agreed terms.

1.1.15 Personal Data: personal data as defined in the GDPR.

1.1.16 Service: the Aitonomy software service through which the Customer deploys, configures, governs, audits and runs Agents (agents as a service), together with any related support and Documentation, in one of the configurations in clause 3.3.

1.1.17 Service Metrics: operational and performance metrics generated by or through the Service, such as cycle time, throughput, cost per unit of work, adoption, gate pass rates, token consumption and similar measures, which do not include Customer Data and from which Customer Data and source code cannot be reconstructed.

1.1.18 SLA: the Service Level Agreement published at joinaitonomy.ai/legal, which forms part of the Agreement where the Order Form so provides.

1.1.19 User: an individual authorised by the Customer to access and use the Service.

1.2 Unless the context requires otherwise, words in the singular include the plural and vice versa.

2. General

2.1 These Terms apply to all offers and quotes of, and agreements with, Aitonomy relating to the Service. By accepting an Order Form, the Customer accepts these Terms.

2.2 These Terms, together with the Order Form, any applicable SLA, and the Data Processing Agreement referred to in clause 8, constitute the entire agreement between the parties in relation to the Service (the "Agreement") and replace all previous oral or written agreements on the same subject.

2.3 The applicability of any purchase or other general terms of the Customer is expressly rejected. Additions to or deviations from these Terms apply only where agreed in writing in the Order Form.

2.4 In the event of a conflict, the Order Form prevails over these Terms in respect of commercial matters, the SLA prevails in respect of service levels, and the Data Processing Agreement prevails in respect of the processing of Personal Data.

2.5 If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in full force, and the invalid provision will be replaced by a valid provision that reflects the intention of the original as closely as possible.

2.6 The version of these Terms in force on the date of the Order Form applies for the duration of that Order Form's then-current term. Aitonomy may amend non-material provisions by notice; material provisions by at least thirty (30) days prior notice, during which the Customer may object in writing, in which case the parties will discuss the consequences in good faith.

2.7 Aitonomy may assign or transfer its rights and obligations under the Agreement to an Affiliate or in connection with a merger, reorganisation or sale of business. The Customer may not assign or transfer its rights or obligations without Aitonomy's prior written consent.

2.8 Aitonomy may engage Affiliates or third parties, including sub-processors, to perform parts of the Service, in accordance with the Data Processing Agreement.

2.9 These Terms are also made for the benefit of Aitonomy's Affiliates and the persons it engages, who may invoke them as a third party stipulation within the meaning of Section 6:253 of the Dutch Civil Code.

2.10 No failure or delay in exercising a right under the Agreement operates as a waiver of that right.

2.11 Notices under the Agreement must be in writing. Notices to Aitonomy may be sent to mik@joinaitonomy.ai.

3. The Service

3.1 The Service enables the Customer to deploy, configure, orchestrate, govern, audit and run Agents across its operations. The Service provides governance controls, guardrails, audit logging and delivery metrics intended to help the Customer control and understand what its Agents do.

3.2 The Service is model and tooling agnostic. Aitonomy does not build or train foundation models; it makes existing models available and configurable through the Service. Where the Service connects to third party models, tools or services, the terms of those third parties may additionally apply, and Aitonomy is not responsible for those third party services.

3.3 The Order Form specifies the configuration of the Service. This may be a configuration hosted by Aitonomy, where Aitonomy hosts the Service on infrastructure it operates and processes Customer Data on the Customer's behalf, or a configuration that runs on the Customer's own environment or AI subscription, where the Service provides a governed layer over the Customer's own tools. The Order Form sets out what is hosted where, and Aitonomy's access is limited to what is reasonably necessary to provide and support the Service.

3.4 Aitonomy is model-independent and aims to provide the Service with both European data residency and European data sovereignty, save where a specific model or provider established outside the European Economic Area is required or chosen for a given task. The data flows, hosting locations, and any providers outside the European Economic Area that apply are set out in the Data Processing Agreement and the Sub-processors list, so the Customer can see what applies to it.

3.5 After Aitonomy has accepted an Order Form, Aitonomy provides the Customer with access to the Service. Any dates or timelines stated by Aitonomy are target dates and are not binding.

3.6 Aitonomy may modify, add to, or discontinue features of the Service from time to time, and will not materially reduce the core functionality of the Service during a term without reasonable notice.

3.7 The Customer manages access to the Service for its Users, including issuing and revoking access and keeping credentials confidential, and is responsible for all activity under its account.

4. Fees and payment

4.1 The Customer will pay the Fees set out in the Order Form. The pricing model, the billable unit and the invoicing schedule are set out in the Order Form. Unless the Order Form states otherwise, clauses 4.2 to 4.5 apply.

4.2 All Fees are exclusive of VAT and other government levies, and are payable in euros.

4.3 Invoices are due within thirty (30) days of the invoice date. The Customer may not suspend payment or set off any amount.

4.4 Aitonomy may adjust the Fees once per calendar year in line with the CBS price index, on at least thirty (30) days prior notice, unless the Order Form provides otherwise.

4.5 If the Customer fails to pay on time, statutory commercial interest accrues without notice of default, and Aitonomy may, after notice, suspend or limit access to the Service until payment is made. The Customer is liable for the reasonable costs of collection.

5. Use of the Service

5.1 The Customer determines which Agents run through the Service, on what inputs, and under what policies, including the level of autonomy of each Agent and where human review or approval applies. Agents operate under the Customer's configuration and direction.

5.2 Actions taken by an Agent under the Customer's configuration are deemed authorised by the Customer, and the outputs of an Agent are deemed made by the Customer. The Customer is solely responsible for reviewing, approving and deciding what is put into use, and for maintaining human oversight appropriate to its use. Aitonomy does not produce the Customer's work product or make the Customer's operational decisions, and is not responsible for the output, content or decisions that the Customer puts into use.

5.3 The Customer is responsible for the Customer Data, including its accuracy, completeness and lawfulness, and for ensuring that its use of the Service and the Customer Data is lawful and does not infringe the rights of any third party. The Customer indemnifies Aitonomy against third party claims arising from the Customer Data or from the Customer's use of the Service in breach of these Terms.

5.4 Where the Service connects to systems of the Customer or of third parties, the Customer procures the necessary access, warrants that it is entitled to grant it, and indemnifies Aitonomy against third party claims arising from that access.

5.5 The Customer's use of the Service is subject to the Acceptable Use Policy published at joinaitonomy.ai/legal. The Customer warrants that it will not: use the Service for any unlawful, fraudulent or unauthorised purpose; sublicense, resell, copy, modify, decompile or reverse engineer the Service, except where mandatory law permits; infringe the Intellectual Property of Aitonomy or any third party; introduce malicious code or interfere with the security or integrity of the Service; or conduct load or penetration testing without Aitonomy's prior written consent.

5.6 Aitonomy may take proportionate measures, including suspending access, where it reasonably determines that the Customer is in material breach of this clause 5 or the Acceptable Use Policy, or that continued use poses a security or legal risk. Where practicable, Aitonomy will give prior notice and an opportunity to remedy.

5.7 The Customer uses the Service reasonably and in a manner consistent with the subscribed configuration set out in the Order Form. Aitonomy may set and enforce reasonable technical safeguards, including rate, concurrency and volume limits, quotas and anti-abuse controls, to protect the security, integrity, availability and performance of the Service for all customers. Aitonomy applies these so as not to materially degrade normal use within the subscribed configuration, and will, where practicable, give notice before applying a limit that materially affects the Customer's use. Use that materially exceeds normal patterns for the subscribed configuration, or that is designed to extract, mirror or replicate data in bulk other than through the export mechanism in clause 9, falls outside fair use; where it persists, the parties will agree the appropriate configuration or Fees, failing which clause 5.6 applies. Specific limits, where agreed, are set out in the Order Form or the Documentation.

5.8 The operations and access level available through the Service are those set out in the Order Form for the subscribed configuration. Where the Order Form specifies read-only access, the Service performs no create, update or delete operations on a connected source, except where the Order Form expressly provides for them and subject to the human oversight the Customer configures under clause 5.1.

6. Warranties and availability

6.1 Aitonomy will provide the Service with reasonable care and skill, and warrants that the Service will materially conform to the Documentation. Except as expressly stated in these Terms or an applicable SLA, the Service is provided on an "as is" and "as available" basis.

6.2 Aitonomy does not warrant that the Service will be uninterrupted or error free, or that the output of Agents will be accurate, complete or fit for a particular purpose. The Customer is responsible for reviewing and validating output in accordance with clause 5.

6.3 Aitonomy will use commercially reasonable efforts to make the Service available. Service levels, support response times and any related remedies are as set out in the SLA or the Order Form. Availability excludes planned maintenance, force majeure, the Customer's systems or breach, and third party providers on which the Service depends, including any AI subscription or services the Customer brings.

6.4 Force majeure means any event outside Aitonomy's reasonable control, including failures of the internet, telecommunications or cloud providers, cyber attacks, power failures, and the acts or omissions of suppliers prescribed by the Customer.

7. Intellectual property and Customer Data

7.1 All Intellectual Property in and relating to the Service, the platform, the software, the generic components and the Documentation vests exclusively in Aitonomy or its licensors. Subject to payment of the Fees, Aitonomy grants the Customer a non-exclusive, non-transferable and non-sublicensable right to use the Service for its internal business use during the term.

7.2 As between the parties, the Customer owns all Customer Data, including all Intellectual Property in it. Aitonomy claims no ownership of Customer Data and processes it only as needed to provide the Service, as set out in these Terms and the Data Processing Agreement.

7.3 The Customer-specific configuration created through the Customer's use of the Service (Agent definitions, skills, evaluation sets, guardrails, access mapping) is Customer Data and carries a lasting right of use and export for the Customer as set out in clause 9.

7.4 Aitonomy does not use Customer Data or source code to train, fine-tune or otherwise improve any general-purpose or third party AI model, and selects sub-processors and configurations that do not use Customer Data to train their models.

7.5 Aitonomy generates Service Metrics through the operation of the Service. Aitonomy may use Service Metrics as operational telemetry to provide, secure, maintain and improve the Service, and may retain, use, publish and share them in anonymised or aggregated form, including for benchmarking. Because such data contains no Customer Data and is not attributable to or identifiable with the Customer, this does not require the Customer's consent. Aitonomy will not publish or share data in a form that identifies, or could reasonably be used to identify, the Customer or any individual, and none of this extends to Customer Data or source code, or to anything from which either could be reconstructed.

7.6 Aitonomy identifies the Customer as a customer, and uses the Customer's name or logo as a reference, only with the Customer's prior written consent for each instance. The Customer may withhold that consent.

7.7 Where the Customer provides feedback or suggestions, Aitonomy may use them freely to improve the Service, without acquiring any rights in the Customer Data.

8. Confidentiality, security and data protection

8.1 Each party will keep the other party's Confidential Information confidential and will not use or disclose it except as reasonably necessary to perform the Agreement or as permitted by it. The confidentiality obligation does not apply to information that is or becomes public without breach, is independently developed, is rightfully obtained from a third party free of any duty of confidentiality, or whose disclosure is required by a competent authority or by law.

8.2 Aitonomy implements and maintains appropriate technical and organisational measures designed to protect Customer Data against loss and unlawful processing. The measures that apply are set out in Schedule 1 to the Data Processing Agreement.

8.3 To the extent Aitonomy processes Personal Data on behalf of the Customer in connection with the Service, the Data Processing Agreement applies and forms an integral part of the Agreement. In that processing Aitonomy acts as processor and the Customer as controller. The Customer is responsible for the lawfulness of the Personal Data it makes available and warrants that it is entitled to provide it for processing under the Agreement.

8.4 Aitonomy notifies the Customer without undue delay of a security incident that materially affects the confidentiality, integrity or availability of the Service or the Customer Data. Personal Data Breaches are handled under the Data Processing Agreement.

9. Term, termination and exit

9.1 The Service starts on the date set out in the Order Form and runs for the term stated there. Where the Order Form provides for a trial, pilot or other temporary or preferential arrangement, the terms of that arrangement prevail for its duration. Unless the Order Form states otherwise, the Service renews for successive periods equal to the initial term unless either party gives written notice of non-renewal at least one (1) month before the end of the then-current term. The Order Form may provide for no minimum term and no automatic renewal.

9.2 Either party may terminate with immediate effect by written notice if the other commits a material breach that, where capable of remedy, is not remedied within a reasonable period after written notice. Aitonomy may also terminate with immediate effect on the Customer's bankruptcy, suspension of payment, inability to pay its debts, or cessation of business.

9.3 On termination, the Customer's right to use the Service ends. The Customer is not entitled to a refund of Fees already due, except that on termination by the Customer for Aitonomy's uncured material breach any prepaid Fees for the period after termination are refunded pro rata.

9.4 On request, and in any event on termination, Aitonomy provides within ten (10) Business Days an export in readable, open formats of the Customer-specific configuration (Agent definitions, skills, evaluation sets, guardrails, access mapping excluding Aitonomy's own secrets), the event and audit log, and the Service Metrics for the Customer. Runtime and orchestration do not transfer. Aitonomy returns or deletes Customer Data in accordance with the Data Processing Agreement.

9.5 Provisions that by their nature survive termination, including those on Intellectual Property and Customer Data, confidentiality, liability and governing law, survive termination.

10. Liability

10.1 Aitonomy's total aggregate liability under or in connection with the Agreement, on any legal basis, is limited to the Fees (excluding VAT) received by Aitonomy from the Customer in the twelve (12) months before the event giving rise to the liability.

10.2 Aitonomy is not liable for indirect or consequential loss, including loss of profit, loss of revenue, missed savings, loss of goodwill, loss from business interruption, or loss or corruption of data.

10.3 Aitonomy is not liable for damage resulting from force majeure.

10.4 The limitations in clauses 10.1 to 10.3 do not apply in the event of intent or deliberate recklessness on the part of Aitonomy's management, or to liability that cannot be limited or excluded under mandatory law.

10.5 A claim for damages must be notified in writing as soon as reasonably possible after the loss arises, and in any event lapses twelve (12) months after the loss arose unless legal proceedings have been commenced before then.

11. Governing law and disputes

11.1 The Agreement is governed exclusively by the laws of the Netherlands.

11.2 Any dispute that cannot be resolved amicably will be submitted exclusively to the competent court of The Hague (Rechtbank Den Haag), the Netherlands.

Baby Elephant B.V., trading as Aitonomy · Emmastraat 23, 2282 AM Rijswijk, The Netherlands · KvK 27299029