Software-as-a-Service Agreement

1. Parties

This Software-as-a-Service Agreement (the “Agreement”) is entered into on the Effective Date, by and between:

Smartdoxx BV, a private limited liability company (besloten vennootschap / BV) organized under the laws of Belgium, with registered office at Zwijnaardsesteenweg 653, 9000 Gent, Belgium, registered with the Crossroads Bank for Enterprises under number 1033830156, VAT BE1033830156 (the “Provider”);

and

the Customer, being the individual or legal entity that registers for, accesses, or uses the Service and accepts this Agreement (the “Customer”). The Customer provides its legal name, registered office, company registration number, VAT number, and other identifying details during account registration, and is responsible for keeping that information accurate and up to date. By registering for, accessing, or using the Service, the Customer agrees to be bound by this Agreement. Where an individual accepts this Agreement on behalf of a company or other legal entity, that individual warrants that they have authority to bind that entity, which is then the Customer.

Each a “Party” and together the “Parties”.

2. Definitions

In this Agreement, the following terms have the following meanings:

• “Affiliate” – in relation to a Party, any entity that directly or indirectly controls, is controlled by, or is under common control with that Party, where “control” means the ownership of more than fifty percent (50%) of the voting securities or equivalent rights.
• “Agreement” – this master agreement and all Annexes attached to it, together with the Subscription Plan.
• “AI Processing Costs” – the per-token, per-request, or other variable fees paid by the Provider to its AI sub-processors (including the AI gateway, underlying model providers, and any infrastructure providers offering AI model hosting) for the processing of Customer requests. AI Processing Costs are expressed as a per-unit-of-work rate (such as cost per million tokens or cost per request) and are calculated as a weighted average across the AI models and providers actually used by the Provider during the relevant period, weighted by total usage volume across all Customers. AI Processing Costs do not include the Provider’s internal costs (such as development, evaluation, testing, or monitoring) or fees paid for non-customer-facing activities.
• “AUP” – the Acceptable Use Policy set out in Annex C.
• “Authorized Users” – the Customer’s employees and contractors permitted to use the Service.
• “Connected Publishing Tools” – the third-party documentation platforms supported by the Service to which the Service publishes Generated Documentation, plus the Provider’s built-in SmartViewer.
• “Connected Repositories” – the code repositories supported by the Service that the Customer connects to the Service.
• “Customer Data” – any data, content, or information made available by the Customer to the Provider through the Service, including source code from Connected Repositories.
• “Derived Technical Outputs” – technical artifacts generated and stored by the Service from the Customer’s source code to enable, improve, and maintain documentation generation, including technical summaries, structural representations, indexes, metadata, validation information, and other derived outputs. Derived Technical Outputs may include limited code-level references and technical implementation details, such as component, function, class, file and dependency names, API routes or endpoints, database table and field names, schemas, configuration key names, references to authentication and authorization flows, logging and observability references, and other architecture-relevant information, where reasonably necessary to provide the Service. Derived Technical Outputs do not include complete copies of repository source files.
• “Documentation” – Provider’s then-current user documentation for the Service.
• “Effective Date” – the date on which the Customer first accepts this Agreement by registering for, accessing, or using the Service.
• “Generated Documentation” – documentation produced by the Service from the Customer’s source code and configuration.
• “Service” – the Smartdoxx SaaS platform, including the web application, APIs, integrations, and the built-in SmartViewer.
• “Subscription Plan” – the plan the Customer selects when registering for or upgrading the Service, which specifies the subscription, features, usage entitlements, Fees, any setup work, and the Term, as presented through the Service at the time of selection and as recorded in the Customer’s account.
• “Subscription Term” – the period during which the Customer is entitled to access the Service, consisting of the Initial Term and any Renewal Terms.

3. Service Description and Scope

3.1 The Service. The Provider offers a SaaS platform that: (a) connects to the Customer’s Connected Repositories; (b) automatically generates documentation from the source code using AI-based processing; (c) publishes Generated Documentation to the built-in SmartViewer and/or to Connected Publishing Tools selected by the Customer; and (d) provides configuration tools for layout, tone of voice, generation triggers, and publishing rules.

3.2 Subscription. The Customer’s specific subscription (plan, included features, limits, setup work, and pricing) is set out in the Subscription Plan.

3.3 Updates. The Provider may update, enhance, or modify the Service from time to time, provided that no such change shall materially reduce the principal functionality of the Service as described in Section 3.1 during the Subscription Term, except to the extent such reduction is required by law, is necessary to address a security or legal issue, or results from changes to or discontinuation of third-party services, APIs, or integrations on which the Service depends (including Connected Repositories, Connected Publishing Tools, sub-processors, and underlying AI model providers), which are outside the Provider’s control and further addressed in Section 7.

3.4 Trials, betas, and evaluation features. The Provider may make trial, beta, preview, proof-of-concept, or evaluation features available to the Customer. Unless expressly agreed otherwise in the Subscription Plan, such features:

(a) are provided for evaluation purposes only and may not be used for production purposes or to process production data; (b) may be modified, suspended, or discontinued at any time without notice; (c) are provided “as is” without warranties of any kind; (d) are not subject to the service availability commitments in Section 12 or the security commitments in Section 16; (e) are not covered by the indemnification obligations in Section 20.1; (f) the Provider’s liability in connection with such features is limited to the maximum extent permitted by law and, to the extent any liability arises, is included within the aggregate cap in Section 19.2.

3.5 Professional services. Any setup, implementation, configuration, migration, training, key-user enablement, follow-up sessions, adoption support, or other professional services will be described in the Subscription Plan, including the applicable scope and Fees. Unless expressly agreed otherwise, professional services are performed on a reasonable-efforts basis and do not include custom software development, legal advice, or formal acceptance obligations. The Customer shall provide timely cooperation, access, information, and decisions reasonably required for the Provider to perform the services. Any change to scope, timeline, assumptions, or deliverables, including delays caused by the Customer or by circumstances reasonably outside the Provider’s control, must be agreed in writing and may result in additional Fees or extended timelines.

4. Right to Use (License Grant)

4.1 Subject to the Customer’s compliance with this Agreement and payment of applicable Fees, the Provider grants the Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Service during the Subscription Term, for the Customer’s internal business purposes, which include the Customer’s use of the Service to generate documentation for its own clients as permitted under the Acceptable Use Policy (Annex C).

4.2 Authorized Users and access.

(a) The Customer may permit Authorized Users to access and use the Service. Each Authorized User account must use unique credentials, and credentials may not be shared between Authorized Users.

(b) Where the Service allows the Customer to share Generated Documentation hosted in the SmartViewer with additional individuals (such as employees, contractors, or clients of the Customer) for viewing purposes, such individuals are not considered Authorized Users for purposes of this Section 4.2, but the Customer remains responsible for their compliance with this Agreement and the Acceptable Use Policy.

(c) The Customer is responsible for:

(i) all acts and omissions of its Authorized Users and any individual accessing the Service or Generated Documentation through the Customer’s account or instance;

(ii) assigning and managing access rights, including promptly disabling access for any person who is no longer authorized to use the Service or to access Generated Documentation through the Customer’s account;

(iii) ensuring that Authorized Users and any individuals with access to Generated Documentation comply with this Agreement and the Acceptable Use Policy.

4.3 Restrictions. The Customer shall not: (a) reverse engineer, decompile, or attempt to derive the source code of the Service, except to the extent expressly permitted by mandatory law; (b) resell, sublicense, or make the Service available to third parties other than Authorized Users; (c) use the Service to build a competing product; (d) circumvent technical limits or usage caps; (e) use the Service in violation of applicable law.

5. Access to Customer Repositories and Source Code

5.1 Authorization and read-only access. (a) To enable the Service, the Customer authorizes the Provider to access the Connected Repositories via the credentials or integration tokens that the Customer provides. (b) The Customer shall provide credentials or integration tokens with read-only access to the Connected Repositories. The Customer warrants that the credentials or tokens provided do not grant the Provider any rights to modify, write to, delete from, or otherwise alter the content of the Connected Repositories. The Customer is solely responsible for ensuring that the credentials or tokens provided have the appropriate scope, and bears the consequences of providing credentials or tokens with a broader scope than required.

5.2 Scope of access. The Provider’s access is limited to the repositories and files that the Customer enables in the Service’s Database Settings, and is used solely to provide the Service.

5.3 Processing and retention of source code and Derived Technical Outputs.

(a) The Provider processes the Customer’s raw source code in transit only, for the purpose of generating documentation and producing Derived Technical Outputs. Raw source code is temporarily processed on infrastructure located within the European Union and is kept logically separated from the data of other customers. The Provider does not store complete repository source files as such in persistent storage; raw source code is deleted from the generation environment once the relevant generation process and the creation of the associated Derived Technical Outputs are complete.

(b) To provide, maintain, and improve the Service – including incremental generation, change detection, search, navigation, and consistency of documentation across releases – the Service generates and stores Generated Documentation and Derived Technical Outputs. The Customer acknowledges that Generated Documentation and Derived Technical Outputs are retained in persistent storage on infrastructure located within the European Union for the duration of the Subscription Term and are deleted in accordance with Section B.13 of the DPA.

(c) The Provider uses commercially reasonable technical measures, including automated scanning prior to storage, to detect and exclude secret values (such as passwords, access tokens, private keys, and API secrets) from Derived Technical Outputs, and does not intentionally store such secret values. Where a configuration key or an authentication or authorization flow is referenced, the Provider stores the parameter name, reference, or structural description rather than the secret value itself.

(d) Generated Documentation and Derived Technical Outputs are stored using application-level encryption with keys managed on infrastructure separate from the database in which the encrypted data resides. Navigational metadata (such as titles, identifiers, and display order) is stored in unencrypted form to enable the operation of the Service. Raw source code is protected by encryption in transit. All stored data is kept logically separated per customer.

(e) The no-training commitments in Section 5.4 apply to raw source code, Generated Documentation, and Derived Technical Outputs.

5.4 No use for AI training. The Provider shall not use the Customer’s source code, Generated Documentation, Derived Technical Outputs, or other Customer Data to train, fine-tune, or improve any AI models of its own. The Provider shall configure its AI sub-processors so that Customer Data is not used by them to train, fine-tune, or improve any AI models, and shall use commercially reasonable efforts to verify that this configuration is honored.

5.5 Revocation. The Customer may revoke access at any time by disconnecting the integration in the Service or by revoking the relevant credentials. The Customer acknowledges that: (a) revocation may suspend or terminate the Provider’s ability to provide all or part of the Service to the Customer; (b) revocation is the Customer’s unilateral act and does not constitute a breach of the Agreement by the Provider, a termination of the Agreement, or a basis for the Customer to terminate the Agreement; (c) the Customer remains liable for all Fees due under the Agreement for the remainder of the then-current Subscription Term, and is not entitled to any refund of prepaid Fees, notwithstanding any reduction or suspension of the Service resulting from revocation.

6. AI Processing and Ownership of Generated Documentation

6.1 AI processing. The Service uses AI-based processing to generate documentation. The Customer acknowledges that: (a) AI-generated output is inherently probabilistic and may contain inaccuracies, omissions, outdated information, misinterpretations of code, or other errors; (b) Generated Documentation reflects the Service’s interpretation of the source code at the moment of generation and is not a substitute for the source code itself; (c) the source code, not the Generated Documentation, is the authoritative source of truth regarding the actual behavior of the Customer’s systems.

6.2 Ownership of Generated Documentation. As between the Parties, all Generated Documentation produced from the Customer’s source code is owned by the Customer. The Provider hereby assigns to the Customer all right, title, and interest the Provider may have in such Generated Documentation, to the extent such rights arise.

6.3 Provider tooling. Nothing in this Section transfers ownership of the Service, the underlying models, prompts, templates, or any improvements thereto, all of which remain the property of the Provider. Derived Technical Outputs that form part of the Service’s internal tooling (such as indexes and internal technical representations) remain part of the Provider’s tooling under this Section 6.3 and Section 14.1. This does not affect the Customer’s ownership of Generated Documentation under Section 6.2, nor the treatment of Derived Technical Outputs as Customer Confidential Information under Section 13.

6.4 AI sub-processors. The Provider uses a combination of third-party AI providers and, where applicable, internal models to perform AI processing. The current list of AI sub-processors is set out in Annex D – Sub-processor List, which the Provider keeps up to date. The Provider configures its AI sub-processors so that Customer Data is not used by them to train their models, and uses commercially reasonable efforts to verify that this configuration is honored, as further described in Section 5.4.

6.5 Validation. Generated Documentation may be marked as “Validated” or “Not Validated” depending on review status. Validation status is informational only, reflects whether a review workflow has been completed, and does not constitute a warranty of correctness, completeness, or fitness for any purpose.

6.6 Customer responsibility for decisions. (a) The Service is a decision-support tool that assists the Customer in producing documentation. The Service is not a decision-making tool. The Customer is solely responsible for any decision made or action taken on the basis of, or in reliance on, the Generated Documentation. (b) For decisions where the consequences of an error would be safety-critical, security-critical, business-critical, or would affect regulatory or legal compliance, the Customer remains responsible for the decision and for ensuring that the decision is based on appropriate information, of which the Generated Documentation may be one input among others. (c) The Customer shall ensure that its Authorized Users and any third parties to whom the Customer makes Generated Documentation available are aware of the matters set out in this Section 6. (d) Subject to the Provider’s other obligations under this Agreement, the Provider is not responsible for decisions taken by the Customer, an Authorized User, or a third party in reliance on Generated Documentation.

6.7 Design intent. The Provider designs and operates the Service to produce high-quality documentation that reflects the Customer’s source code. The acknowledgments in this Section 6 are not a statement that the Service is unreliable, but a recognition that AI-generated content – like any documentation – should be treated with professional judgment appropriate to the significance of the decision being made.

6.8 High-risk use restriction. The Service is not designed, intended, or warranted for use as the sole basis for safety-critical, life-critical, emergency, medical, security-critical, or other high-risk decisions, or for decisions where an error or omission could reasonably be expected to result in death, personal injury, material property damage, material business interruption, or material legal or regulatory non-compliance. The Customer shall not use the Service, or rely on the Generated Documentation, as the sole basis for such decisions, and remains responsible for appropriate human review and independent verification.

7. Third-Party Integrations

7.1 Publishing Tools. The Service can publish Generated Documentation to Connected Publishing Tools. The Customer is responsible for: (a) maintaining valid credentials and permissions for each Connected Publishing Tool; (b) complying with the terms of service of each Connected Publishing Tool; (c) any fees owed to the operators of Connected Publishing Tools.

7.2 No Provider responsibility. The Provider is not responsible for the availability, performance, or content of Connected Repositories or Connected Publishing Tools operated by third parties.

8. Customer Obligations and Acceptable Use

8.1 The Customer shall: (a) provide accurate account information and keep it up to date; (b) safeguard credentials and notify the Provider promptly of any suspected unauthorized access; (c) not upload or process any content that infringes third-party rights, contains malware, or is unlawful.

8.2 Customer warranties regarding repository contents. The Customer warrants and undertakes that: (a) the Customer has taken reasonable steps to avoid the inclusion of hardcoded credentials, API keys, access tokens, private keys, internal IP addresses, or other sensitive infrastructure information in the Connected Repositories, and has not intentionally included such information; (b) the Customer has taken reasonable steps to avoid the inclusion of personal data of identifiable individuals (such as names, email addresses, phone numbers, or other identifiers) beyond what is intrinsic to source code repositories (such as commit author metadata, copyright notices, and code comments). In particular, the Customer warrants that no special categories of personal data within the meaning of Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person’s sex life or sexual orientation) are intentionally included in the Connected Repositories; (c) the Customer has all necessary rights and consents to grant the Provider access to the Connected Repositories and to have documentation generated from their content; (d) the Customer shall promptly notify the Provider, and take reasonable remediation steps, on becoming aware that personal data, special categories of personal data, or sensitive infrastructure information is present in a Connected Repository; (e) for Connected Repositories that contain third-party or open-source code, the Customer has the right to have AI-generated documentation produced from such code, including compliance with any applicable license obligations of that third-party or open-source code.

8.3 The Customer acknowledges that the Service is designed to process source code and is not intended for the processing of personal or other sensitive data. The Customer remains solely responsible for the content of the Connected Repositories.

8.4 Acceptable Use Policy. Use of the Service is also subject to the Provider’s Acceptable Use Policy, attached as Annex C.

9. Fees, Billing, and Payment

9.1 Fees. The Customer shall pay the fees set out in the Subscription Plan (the “Fees”) in the currency specified in the Subscription Plan. The Subscription Plan sets out the applicable pricing structure (including any setup fees, recurring fees, and other charges).

9.2 Billing schedule. The billing schedule, including invoice timing and payment milestones, is set out in the Subscription Plan.

9.3 Payment terms. Invoices are payable within thirty (30) days of invoice date. Late payments bear interest at the rate set by the Belgian Act of 2 August 2002 on combating late payment in commercial transactions, plus a flat indemnity of EUR 40 and reasonable recovery costs.

9.4 Taxes. Fees are exclusive of VAT and any other applicable taxes, which the Customer shall bear.

9.5 Price changes at renewal. The Provider may adjust the Fees applicable to any Renewal Term by providing the Customer with at least sixty (60) days’ prior written notice before the start of that Renewal Term. If the Customer does not wish to accept the adjusted Fees, the Customer may give notice of non-renewal in accordance with Section 10.2. If the Customer does not give notice of non-renewal, the Agreement renews at the adjusted Fees.

9.6 AI processing cost pass-through. The Customer acknowledges that a significant portion of the Provider’s cost of delivering the Service consists of AI Processing Costs. The Provider absorbs ordinary fluctuations and increases in AI Processing Costs during the Subscription Term up to the threshold set out below, without passing those costs on to the Customer.

Only if the Provider’s aggregate AI Processing Costs increase by more than thirty percent (30%) compared to the AI Processing Costs at the start of the Subscription Term (or the date of the last adjustment under this Section, whichever is later), the Provider may increase the monthly Fee by a percentage no greater than the percentage increase in the AI Processing Costs. Any such Fee adjustment applies prospectively from the effective date of the adjustment only, and does not result in any retroactive charges for prior periods. The adjustment is subject to the following conditions:

(a) the Provider gives the Customer at least thirty (30) days’ prior written notice of the adjustment, identifying the percentage increase and the effective date;

(b) the Customer may, within thirty (30) days of receiving such notice, terminate this Agreement by written notice effective on the date the adjusted Fee would otherwise take effect. In such case, the Provider shall refund any prepaid Fees for the unused portion of the Subscription Term (notwithstanding Section 10.6);

(c) the Provider shall, on the Customer’s reasonable written request, provide a written summary of the basis for the cost increase, including a high-level description of the weighted average methodology used and the resulting percentage change. The Provider is not required to disclose its specific commercial arrangements with AI providers, the identity of individual providers contributing to the calculation, or per-provider pricing data, which remain Confidential Information.

9.7 Usage monitoring, overages, and verification.

(a) Monitoring. The Provider may monitor usage of the Service to verify compliance with the Subscription Plan, applicable usage limits, and this Agreement.

(b) Usage limits and Fee adjustments for overages. The Subscription Plan may specify usage limits, including a codebase size range (minimum and maximum) and a maximum number of releases. If the Customer’s actual usage exceeds the maximum codebase size or the maximum number of releases set out in the Subscription Plan, the Provider may adjust the Fees in accordance with the surplus rates set out in the Subscription Plan, subject to the following:

(i) the Provider notifies the Customer in writing of the overage and the adjusted Fees, including the basis for the adjustment; (ii) the adjusted Fees apply from the date the overage was first identified, unless the Subscription Plan specifies a different effective date; (iii) the Customer may, within thirty (30) days of receiving such notice, either reduce usage below the applicable limit (in which case the original Fees resume from the date the Customer demonstrates compliance) or terminate this Agreement by written notice. In case of termination, the Provider shall refund any prepaid Fees for the unused portion of the then-current Subscription Term that have not been used to cover the overage.

(c) Verification. On reasonable notice and no more than once per twelve (12) month period (except where a specific verification need arises in connection with an apparent overage or underpayment), the Provider may request information reasonably necessary to verify usage and Fees, including data about codebase size, number of releases, and other usage metrics. The Customer shall respond to such requests within fifteen (15) days. If verification identifies an underpayment of Fees, the Customer shall pay the underpaid Fees within thirty (30) days of being notified, together with any applicable late payment interest under Section 9.3.

10. Term, Renewal, and Termination

10.1 Term. This Agreement starts on the Effective Date and continues for an initial Subscription Term of twelve (12) months (the “Initial Term”), unless otherwise specified in the Subscription Plan.

10.2 Renewal. This Agreement automatically renews for successive twelve (12) month periods (each a “Renewal Term”), unless either Party gives written notice of non-renewal at least one (1) month before the end of the then-current term. The Provider shall send the Customer a reminder of the upcoming renewal at least sixty (60) days before the end of the then-current term.

10.3 Termination for cause. Either Party may terminate this Agreement with immediate effect by written notice if the other Party: (a) commits a material breach not cured within thirty (30) days of written notice; (b) becomes insolvent, files for bankruptcy, or ceases to do business.

For purposes of Section 10.3(a), “material breach” includes (i) failure to pay undisputed Fees that remain outstanding more than thirty (30) days after the due date, (ii) breach of confidentiality obligations under Section 13, (iii) breach of intellectual property obligations, (iv) violation of Section 4.3 (Restrictions) or of the Acceptable Use Policy that is serious or repeated, or (v) breach of the Customer’s warranties in Section 8.2. A single isolated incident of unavailability, error, or non-conformity of the Service that is promptly remedied does not, by itself, constitute a material breach.

10.4 No termination for convenience. Neither Party may terminate this Agreement for convenience during the Initial Term or any Renewal Term. Termination is only available as set out in Section 10.3 or by non-renewal under Section 10.2.

10.5 Effect of termination. Upon termination: (a) the Customer’s right to access the Service ends; (b) the Customer is responsible for having exported Generated Documentation during the Subscription Term in accordance with Section B.13 of the DPA; (c) the Provider will return or delete Customer Data in accordance with Section B.13 of the DPA; (d) all provisions that by their nature should survive termination shall do so, including without limitation Sections 6 (AI Processing and Ownership of Generated Documentation), 9 (with respect to any amounts due and unpaid), 10.6, 13 (Confidentiality), 14 (Intellectual Property), 18 (Disclaimers), 19 (Limitation of Liability), 20 (Indemnification), 22 (Notices), and 24 (Governing Law and Jurisdiction).

10.6 Refund, no refund, and acceleration. (a) Termination by the Provider for the Customer’s breach does not entitle the Customer to a refund of prepaid Fees. (b) If this Agreement is terminated by the Provider for the Customer’s material breach (including but not limited to non-payment), all Fees that would otherwise have become due for the remainder of the then-current Subscription Term shall become immediately due and payable as liquidated damages, without prejudice to any other remedies available to the Provider. The Parties agree that this sum is a reasonable estimate of the Provider’s loss and is not a penalty. (c) If this Agreement is terminated by the Customer for the Provider’s material breach under Section 10.3(a), the Provider shall refund any prepaid Fees for the unused portion of the then-current Subscription Term, calculated on a pro-rata basis from the effective date of termination.

11. Suspension

11.1 The Provider may suspend the Service immediately if: (a) the Customer fails to pay undisputed Fees and has not cured within fifteen (15) days of notice; (b) the Customer’s use poses a security risk to the Service or third parties; (c) suspension is required by law.

11.2 The Provider shall use commercially reasonable efforts to limit the scope and duration of suspension.

12. Service Levels and Support

12.1 Service availability. The Provider uses commercially reasonable efforts to make the Service available and targets 99.0% availability per calendar month, excluding scheduled maintenance, deployments, third-party service issues, Customer-caused issues, force majeure, and other matters outside the Provider’s reasonable control. This is a service target only and does not constitute a service level commitment. Failure to meet this target does not give rise to service credits, refunds, penalties, or any other remedy.

12.2 Support. The Customer may contact the Provider for support via info@smartdoxx.com or any other support channel made available by the Provider. Standard support is available on Belgian business days between 09:00 and 17:00 CET, excluding Belgian public holidays.

The Provider uses commercially reasonable efforts to respond to support requests within the following target timeframes:

(a) one (1) business day, or sooner where reasonably possible, for critical production unavailability or suspected security incidents materially affecting Customer Data; (b) two (2) business days for material service impairments where a workaround exists; (c) five (5) business days for general questions, configuration assistance, minor defects, or non-urgent issues.

These are response targets only and not resolution commitments. Failure to meet these targets does not give rise to service credits, refunds, penalties, or any other remedy.

12.3 Maintenance. The Provider may perform scheduled maintenance, with reasonable prior notice where feasible. Emergency maintenance may be performed without notice.

13. Confidentiality

13.1 Confidential Information means non-public information disclosed by one Party to the other that is marked confidential or that a reasonable person would understand to be confidential. Customer source code, and the Provider’s models, prompts, and pricing, are Confidential Information. Customer source code is also acknowledged to constitute trade secrets within the meaning of applicable law (including Directive (EU) 2016/943 on the protection of undisclosed know-how and business information).

13.2 Each Party shall: (a) use the other Party’s Confidential Information only to perform this Agreement; (b) protect it with at least the same degree of care it uses for its own confidential information, and in any event no less than reasonable care; (c) disclose it only to employees, contractors, and advisors who need to know and are bound by confidentiality obligations.

13.3 Exclusions. Information that is or becomes public without breach, was lawfully known prior to disclosure, is independently developed, or is rightfully obtained from a third party, is not Confidential Information.

13.4 Required disclosure. A Party may disclose Confidential Information to the extent required by law, provided it gives the other Party prompt notice where legally permitted.

13.5 Survival. Confidentiality obligations survive for five (5) years after termination, or indefinitely for trade secrets.

14. Intellectual Property

14.1 Provider IP. The Service, the Documentation, all underlying software, models, prompts, templates, configurations, and any improvements thereto, are and remain the exclusive property of the Provider.

14.2 Customer IP. The Customer retains all right, title, and interest in (a) Customer Data, including the source code contained in the Connected Repositories, (b) the Generated Documentation (per Section 6.2), and (c) all derivative works, trademarks, and goodwill associated with the foregoing.

14.3 Feedback. Any feedback or suggestions the Customer provides regarding the Service may be used by the Provider without restriction or obligation.

15. Data Protection

15.1 Where the Provider processes personal data on behalf of the Customer, it does so as a processor under the GDPR (Regulation (EU) 2016/679).

15.2 The Parties’ rights and obligations regarding personal data are set out in Annex B – Data Processing Agreement (DPA), which forms an integral part of this Agreement.

15.3 The respective responsibilities of the Parties regarding personal data are set out in the DPA.

16. Security

16.1 The Provider shall maintain commercially reasonable technical and organizational security measures designed to protect Customer Data against unauthorized access, loss, or alteration. Current measures include: (a) encryption of data in transit; (b) logical separation of each customer’s data; (c) access controls limiting access to authorized personnel on a need-to-know basis; (d) secure storage of credentials and access tokens; (e) processing of Customer raw source code in transit only, with deletion from the generation environment once generation and creation of the associated Derived Technical Outputs are complete; Generated Documentation and Derived Technical Outputs are stored using application-level encryption with keys managed separately from the database, logically separated per customer, on infrastructure located within the European Union, and deleted in accordance with the DPA; (f) hosting on infrastructure located within the European Union.

16.2 The Provider’s security program is set out in Section 16.1 above and is reviewed periodically.

16.3 Incident notification. The Provider shall notify the Customer without undue delay after becoming aware of a security incident affecting Customer Data, and shall cooperate in investigation and remediation. Notification of Personal Data Breaches is further governed by Section B.11 of the DPA.

16.4 Backups and business continuity. The Provider shall maintain commercially reasonable backup, business continuity, and disaster recovery procedures appropriate to the nature of the Service and the Customer Data processed by it. The Provider maintains backups of hosted application data on a regular basis, periodically tests restoration procedures, and uses commercially reasonable efforts to restore the Service following a material outage. The Provider does not commit to specific recovery time or recovery point objectives, except as may be expressly set out in the Subscription Plan.

17. Warranties

17.1 Each Party warrants that it has the legal capacity and authority to enter into this Agreement.

17.2 The Provider shall use commercially reasonable efforts to operate the Service in accordance with this Agreement during the Subscription Term. The Customer’s sole remedy for breach of this Section 17.2 is, at the Provider’s option, repair, replacement, or termination with a pro-rata refund of prepaid Fees for the affected period.

17.3 Malicious code. The Provider shall use commercially reasonable measures designed to prevent the Service from intentionally introducing malware, viruses, worms, ransomware, or other malicious code into the Customer’s systems. The Customer’s obligations regarding malicious code in Connected Repositories or other content processed through the Service are set out in Section 4.3 and Annex C. The Customer shall promptly notify the Provider if it becomes aware of malicious code in a Connected Repository. Each Party shall reasonably cooperate to investigate and remediate any malicious-code incident affecting the Service.

18. Disclaimers

18.1 Except as expressly set out in Section 17, the Service is provided “as is”. To the maximum extent permitted by law, the Provider disclaims all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted or error-free.

18.2 The Provider does not warrant the accuracy, completeness, currency, or suitability of the Generated Documentation for any particular purpose. The Customer’s responsibility for decisions taken in reliance on Generated Documentation is set out in Section 6.6.

19. Limitation of Liability

19.1 To the maximum extent permitted by law, neither Party shall be liable for any indirect, incidental, consequential, special, or punitive damages, or for loss of profits, revenue, data, or goodwill.

19.2 Cap. Subject to Sections 19.4 and 19.5, the Provider’s total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort, negligence, breach of statutory duty or otherwise, for all claims arising in any twelve (12) month period, shall not exceed the Fees actually paid by the Customer to the Provider under the applicable Subscription Plan during the twelve (12) months immediately preceding the event giving rise to the claim. In no event shall the Provider’s aggregate liability under this Agreement exceed five hundred thousand euros (€500,000) in any twelve (12) month period.

19.3 Insurance. The Provider maintains, at its own expense, (i) professional liability insurance with coverage of €500,000 and (ii) cyber security insurance with coverage of €500,000. The Provider shall maintain such insurance, or substantially equivalent coverage, throughout the term of this Agreement.

19.4 Carve-outs. The limitations in this Section do not apply to: (a) infringement of the other Party’s intellectual property; (b) fraud or willful misconduct; (c) liability that cannot be limited by mandatory law.

19.5 Cap for gross negligence. Where, despite Section 19.4, a court finds that a Party’s conduct constitutes gross negligence (grove fout / faute lourde) under Belgian law, the aggregate liability of that Party for such conduct shall not exceed the cap in Section 19.2, except in cases of fraud or willful misconduct.

19.6 Cap on indemnification. The Provider’s indemnification obligations under Section 20.1 are not subject to a separate cap and are included within the aggregate cap in Section 19.2, except in cases of fraud or willful misconduct.

20. Indemnification

20.1 By the Provider. The Provider shall defend and indemnify the Customer against third-party claims alleging that the Service, as provided and used in accordance with this Agreement, infringes the third party’s intellectual property rights, and shall pay damages finally awarded by a court or in settlement, subject to the cap in Section 19.2.

20.2 By the Customer. The Customer shall defend and indemnify the Provider against third-party claims arising from (a) Customer Data, (b) the Customer’s lack of rights in the Connected Repositories, or (c) the Customer’s breach of Section 8.1, 8.2, or 8.3.

20.3 Procedure. The indemnifying Party’s obligations are conditional on prompt notice, sole control of defense, and reasonable cooperation by the indemnified Party.

20.4 Infringement remedies. If the Service is, or in the Provider’s reasonable opinion is likely to become, the subject of an infringement claim, the Provider may, at its option and expense: (a) procure for the Customer the right to continue using the affected Service; (b) modify the affected Service so that it is non-infringing without materially reducing its core functionality; (c) replace the affected Service with a substantially equivalent non-infringing service; or, if options (a), (b), and (c) are not commercially reasonable, (d) terminate the affected Subscription Plan and refund any prepaid Fees for the unused portion of the then-current Subscription Term. To the maximum extent permitted by law, this Section 20 states the Customer’s sole and exclusive remedy for third-party IP infringement claims.

21. Force Majeure

21.1 Neither Party is liable for failure to perform due to events beyond its reasonable control – including natural disasters, war, terrorism, civil unrest, labor disputes, power or telecommunications failures, governmental actions, or third-party service outages – provided the affected Party gives prompt notice and uses reasonable efforts to mitigate.

21.2 If a force majeure event materially prevents performance for more than thirty (30) consecutive days, either Party may terminate this Agreement on written notice without further liability. Force majeure does not excuse the Customer’s obligation to pay Fees for the Service actually provided before the event.

22. Notices

22.1 Notices under this Agreement shall be in writing and sent to the Provider at the address set out in Section 1 and to the Customer at the contact details provided during account registration, by email or by registered post. Notices by email are deemed received on the next business day after sending, unless the sender receives an automated bounce or out-of-office reply. Notices of termination, material breach, or other formal notices materially affecting the Parties’ rights must be sent by registered post or signed-for courier in addition to email.

22.2 For non-formal communications, the Provider may also be contacted at info@smartdoxx.com. This does not replace the formal notice requirements in Section 22.1.

23. Assignment and Subcontracting

23.1 Neither Party may assign this Agreement without the prior written consent of the other, except that either Party may assign it to an Affiliate or in connection with a merger, acquisition, or sale of substantially all its assets, on notice.

23.2 The Provider may engage sub-processors and subcontractors to provide the Service, provided it remains responsible for their performance. Sub-processors of personal data are addressed in the DPA.

24. Governing Law and Jurisdiction

24.1 This Agreement is governed by the laws of Belgium, excluding its conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods.

24.2 Any dispute shall be submitted to the exclusive jurisdiction of the courts of the judicial district of Ghent, Belgium.

25. Miscellaneous

25.1 Entire agreement. This Agreement (including its Annexes and the Subscription Plan) constitutes the entire agreement between the Parties and supersedes all prior agreements on its subject matter.

25.2 Amendments. Except as expressly permitted by this Agreement (including Sections 9.5, 9.6, clause C.10 of Annex C, and clauses B.8.3, B.8.3bis, and B.8.5 of Annex B), any amendment must be in writing and agreed by both Parties.

25.3 Severability. If any provision is held invalid, illegal, or unenforceable, that provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable, and the remaining provisions shall remain in full force.

25.4 No waiver. Failure to enforce a provision is not a waiver.

25.5 Independent contractors. The Parties are independent contractors; nothing creates a partnership, agency, or employment relationship.

25.6 Electronic acceptance. This Agreement is accepted electronically when the Customer registers for, accesses, or uses the Service, or otherwise indicates acceptance through the Service. The Parties agree that such electronic acceptance has the same legal effect as a handwritten signature and that no physical or counterpart signature is required for this Agreement to be binding.

25.7 Reference rights. The Customer grants the Provider the right to use the Customer’s name and logo on the Provider’s website, in customer lists, and in marketing materials, to identify the Customer as a user of the Service. The Customer may withdraw this right at any time on written notice, in which case the Provider will remove the reference from its website and active marketing materials within thirty (30) days. The Provider is not obliged to recall or destroy materials already in circulation in physical form, or to remove archived web pages from third-party search engines or web archives.

25.8 Language. This Agreement is executed in English. The Parties confirm that they understand the English language and agree that this Agreement and all related contractual documents may be validly drafted and executed in English.

25.9 Execution. This Agreement is accepted by the Customer through electronic acceptance when registering for, accessing, or using the Service and, where applicable, by selecting and confirming a Subscription Plan. By doing so, the Customer accepts and is bound by the terms of this Agreement and its Annexes. Electronic acceptance and electronic signatures have the same legal effect as handwritten signatures in accordance with Regulation (EU) No 910/2014 (eIDAS) and applicable Belgian law.

25.10 Purchase orders. Any purchase order, vendor portal terms, procurement terms, or similar document issued by the Customer is for administrative convenience only and does not add to, amend, or override this Agreement, even if accepted, processed, or referenced by the Provider. Any such terms are expressly rejected unless the Parties expressly agree otherwise in a written amendment agreed by both Parties.

25.11 Compliance. Each Party shall comply with applicable anti-bribery, anti-corruption, sanctions, and export-control laws in connection with this Agreement. Neither Party shall offer, promise, authorize, or provide anything of value to any official or private person for the purpose of improperly influencing a decision or obtaining an improper advantage. Either Party may suspend performance or terminate the affected Subscription Plan on written notice if continued performance would violate applicable sanctions or export-control laws.

25.12 Order of precedence. If there is a conflict between the documents forming this Agreement, the following order of precedence applies:

(a) the Subscription Plan, but only for the commercial terms, subscription scope, pricing, billing, and term expressly set out in it;

(b) Annex B (Data Processing Agreement), but only for matters relating to the Processing of Personal Data;

(c) this main Agreement (Sections 1 through 25);

(d) Annex C (Acceptable Use Policy).

Annex D (Sub-processor List) is informational and is updated by the Provider in accordance with Sections B.8.3 and B.8.3bis of Annex B.

Acceptance

By registering for, accessing, or using the Service, the Customer acknowledges that it has read, understood, and agrees to be bound by this Agreement, including its Annexes and the Subscription Plan. Where an individual accepts this Agreement on behalf of a company or other legal entity, that individual warrants that they are authorized to bind that entity to this Agreement.

Annexes

• Annex B – Data Processing Agreement (DPA)
• Annex C – Acceptable Use Policy
• Annex D – Sub-processor List
• Subscription Plan – selected by the Customer through the Service

Annex B – Data Processing Agreement (DPA)

This Data Processing Agreement (this “DPA”) forms an integral part of the Software-as-a-Service Agreement (the “Agreement”) between Smartdoxx BV (the “Processor”) and the Customer (the “Controller”), and governs the Processing of Personal Data by the Processor on behalf of the Controller in connection with the Service.

In case of conflict between this DPA and the body of the Agreement on matters relating to the protection of Personal Data, this DPA prevails.

B.1 Definitions

Terms used but not defined in this DPA have the meaning given in the Agreement or in the GDPR. In particular:

• “GDPR” – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
• “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” – have the meanings given in the GDPR.
• “Sub-processor” – any third party engaged by the Processor to process Personal Data on its behalf in connection with the Service.

B.2 Subject Matter, Nature, Purpose, and Duration

B.2.1 Subject matter. Processing of Personal Data by the Processor in connection with the provision of the Service.

B.2.2 Nature of processing. Collection, storage, transmission, organization, structuring, generation of derived content (including Derived Technical Outputs), application-level encryption and decryption, hosting, display, deletion, and other operations necessary to provide the Service.

B.2.3 Purpose of processing. (i) Managing the Controller’s account and Authorized Users; (ii) generating documentation from the Controller’s source code; (iii) hosting and displaying Generated Documentation through the SmartViewer, where the Controller chooses to use this feature; (iv) publishing Generated Documentation to Connected Publishing Tools selected by the Controller; (v) sending notifications to designated recipients; (vi) providing support; (vii) complying with legal obligations.

B.2.4 Duration. Processing continues for the duration of the Agreement and for any post-termination period set out in Section B.13.

B.3 Categories of Data Subjects

The Personal Data processed under this DPA may relate to the following categories of Data Subjects:

(a) Authorized Users of the Controller (administrators and other account holders); (b) End-users of the SmartViewer (individuals who access Generated Documentation hosted by the Processor); (c) Notification recipients (individuals whose email addresses are provided by the Controller to receive notifications, even if they are not Authorized Users); (d) Contributors to the Connected Repositories – individuals whose information is intrinsically present in version control metadata of the Connected Repositories (such as commit author names, commit author email addresses, commit messages, and commit timestamps); (e) Incidental data subjects – any individuals whose Personal Data the Controller has, in breach of Section 8.2 of the Agreement, allowed to be present in the Connected Repositories or otherwise made available to the Service, beyond what is intrinsic to source code repositories as described in subsection (d) above.

B.4 Categories of Personal Data

The Personal Data processed under this DPA may include:

(a) Identification and contact data: name, email address, account ID; (b) Authentication data: hashed passwords, access tokens (in encrypted or hashed form), session identifiers; (c) Technical and log data: IP addresses, browser and device information, access logs, audit logs; (d) Notification data: email addresses of notification recipients; (e) Version control metadata: commit author names, commit author email addresses, commit messages, and commit timestamps that are intrinsically present in the Connected Repositories; (f) Incidental data: any other Personal Data that may, in breach of Section 8.2 of the Agreement, be present in source code, code comments, or Generated Documentation beyond the version control metadata in subsection (e) above; (g) Derived Technical Outputs: Derived Technical Outputs (as defined in Section 5.3 of the Agreement) may contain, in derived form, incidental Personal Data of the kinds described in (e) and (f) above, including commit author names, developer identifiers, or other Personal Data that was present in the source code from which the Derived Technical Outputs were generated.

No special categories of Personal Data (Article 9 GDPR) are intended to be processed. The Controller warrants under Section 8.2 of the Agreement that no such data is intentionally included in the Connected Repositories.

B.5 Roles and Responsibilities

B.5.1 The Controller is the controller of the Personal Data. The Processor processes Personal Data only on behalf of, and on the documented instructions of, the Controller.

B.5.2 The Agreement (including this DPA, the Subscription Plan, the Controller’s account and Service configuration settings, and any written instructions agreed between the Parties) constitutes the Controller’s complete and documented instructions to the Processor.

B.5.3 The Processor shall inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

B.5.4 The Controller warrants that: (a) it has a valid legal basis for the processing it instructs the Processor to perform; (b) it has provided all required information and notices to Data Subjects; (c) it has complied with the warranties in Section 8.2 of the Agreement regarding the contents of the Connected Repositories; (d) it has the right to enter notification recipients’ email addresses into the Service and has informed those recipients as required by applicable law.

B.6 Obligations of the Processor

The Processor shall:

(a) process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which it is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

(b) ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) implement and maintain appropriate technical and organizational measures as set out in Section 16 of the Agreement;

(d) respect the conditions referred to in Section B.8 of this DPA for engaging Sub-processors;

(e) taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller’s obligation to respond to requests for exercising Data Subject rights (Section B.10);

(f) assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, prior consultation) taking into account the nature of processing and the information available to the Processor;

(g) at the choice of the Controller, return or delete all Personal Data after the end of the provision of services relating to processing, as set out in Section B.13;

(h) make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits as set out in Section B.12.

B.7 Security

B.7.1 The Processor shall implement and maintain the technical and organizational security measures set out in Section 16 of the Agreement.

B.7.2 The Processor shall regularly review and, where appropriate, update those measures to take account of the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

B.8 Sub-processors

B.8.1 General authorization. The Controller grants the Processor general written authorization to engage Sub-processors, subject to the conditions of this Section B.8.

B.8.2 Current list. The current list of Sub-processors is set out in Annex D – Sub-processor List, which the Processor keeps up to date.

B.8.3 Notification of changes. The Processor shall notify the Controller of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance, thereby giving the Controller the opportunity to object to such changes before the engagement of the relevant Sub-processor. Notification may be given by updating the Sub-processor List, by email to the Controller’s contact, or through the Service.

B.8.3bis Emergency replacement. Where circumstances reasonably require the Processor to engage a new Sub-processor or to replace an existing Sub-processor more quickly than the notice period in Section B.8.3 allows, including in cases of:

(i) cessation, suspension, or material disruption of services by the existing Sub-processor; (ii) a material security incident or Personal Data Breach affecting the existing Sub-processor; (iii) unilateral changes to the existing Sub-processor’s terms that affect compliance with Data Protection Laws or the security of Personal Data; (iv) regulatory or court action affecting the existing Sub-processor or the transfer mechanism on which the engagement relies; (v) any other urgent circumstance where delay would materially harm the Controller’s interests or the security of Personal Data,

the Processor may engage or replace the Sub-processor on shorter notice or without prior notice. In such case, the Processor shall:

(a) notify the Controller as soon as reasonably practicable, and in any event within seven (7) days of the engagement or replacement; (b) explain the circumstances justifying the accelerated change; (c) confirm that the new Sub-processor provides at least equivalent data-protection commitments to the Sub-processor it replaces; and (d) treat the Controller’s right to object under Section B.8.4 as applying retroactively from the date of notification under (a) above, with reasonable adjustments to the timelines in Section B.8.4 to reflect the accelerated circumstances.

B.8.4 Objection. The Controller may object to a new Sub-processor on reasonable data-protection grounds within fifteen (15) days of notification. The Parties shall in good faith seek a solution, which may include the Processor not engaging the proposed Sub-processor or providing the Controller with an alternative.

If no solution is found within sixty (60) days, and the Sub-processor change affects a separable portion of the Service, the Controller may terminate that separable portion with a pro-rata refund of prepaid Fees for the unused portion.

If no separation is technically or commercially feasible, the Controller may terminate this Agreement on sixty (60) days’ written notice, effective at the earlier of (i) the end of the notice period or (ii) the date the new Sub-processor begins processing. In such case, the Processor shall refund any prepaid Fees for the unused portion of the then-current Subscription Term, calculated from the effective date of termination.

This Section B.8.4 sets out the Controller’s sole and exclusive remedy for an objection to a new Sub-processor.

B.8.5 AI model changes within named sub-processors. The Processor uses multiple AI sub-processors (currently Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd., and Amazon Web Services EMEA SARL) for AI processing, each providing access to one or more underlying AI models. The Processor may, without prior notice to the Controller: (a) change which underlying AI models are used within each named AI sub-processor (including models made available through that sub-processor’s platform from third parties); (b) shift Customer Data processing between the named AI sub-processors listed in Annex D; provided that (i) the named AI sub-processors remain those listed in the Sub-processor List, (ii) the change does not result in Personal Data being transferred to a country outside the EEA that was not previously covered by an appropriate transfer mechanism, and (iii) the no-training and zero-data-retention commitments referenced in Section B.8.6 continue to apply.

B.8.6 No use for AI training. The Processor configures its AI sub-processors so that Customer Data is not used to train, fine-tune, or improve any AI models, and so that input data is not retained beyond what is necessary to deliver the requested response. The Processor uses commercially reasonable efforts to verify that these configurations are honored.

B.8.7 Flow-down. The Processor shall impose on each Sub-processor data protection obligations that are materially equivalent to those set out in this DPA, it being understood that, for hyperscale providers (such as Microsoft, Google, and similar large-scale infrastructure providers), the standard data processing terms offered by those providers shall be deemed materially equivalent.

B.9 International Transfers

B.9.1 Hosting of the Service is on infrastructure located in the European Union, with no transfer of the underlying hosted Personal Data outside the EEA for hosting purposes.

B.9.2 For AI processing, the Processor uses EU-established AI sub-processors (Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd., and Amazon Web Services EMEA SARL) and selects EU-hosted endpoints from these sub-processors so that AI inference processing occurs within the EEA. The Processor configures these sub-processors to use only models that operate under zero-data-retention terms and do not use input data for model training.

B.9.3 Where the provision of the Service involves a transfer of Personal Data to a country outside the EEA (including any onward transfer by a Sub-processor to its US-based parent or affiliate), the Processor ensures that an appropriate transfer mechanism under Chapter V GDPR is in place. Depending on the Sub-processor concerned, the applicable mechanism is one or more of:

(a) an adequacy decision by the European Commission; (b) certification of the data importer under the EU-US Data Privacy Framework, where applicable; (c) the Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision (EU) 2021/914), including modules 1 and 2 where applicable, supplemented as necessary by additional safeguards following a transfer impact assessment.

B.9.4 The transfer mechanism applicable to each Sub-processor located outside the EEA is identified in the Sub-processor List (Annex D).

B.9.5 The Processor periodically reviews its model usage and Sub-processors to maintain the quality of the Service. Customer Data is only processed via providers that offer appropriate contractual and compliance safeguards.

B.10 Data Subject Rights

B.10.1 The Controller is responsible for handling Data Subject requests in respect of Personal Data processed under this DPA.

B.10.2 If a Data Subject submits a request directly to the Processor relating to Personal Data processed on behalf of the Controller, the Processor shall promptly forward the request to the Controller and shall not respond to the Data Subject directly, except to acknowledge receipt and refer the Data Subject to the Controller, unless instructed otherwise by the Controller or required by law.

B.10.3 The Processor shall, taking into account the nature of the processing, provide reasonable assistance to the Controller in fulfilling its obligations to respond to Data Subject requests, including requests for access, rectification, erasure, restriction, portability, and objection. Such assistance is provided at no additional charge, except where the assistance requested materially exceeds routine support, in which case the Parties shall in good faith agree on cost allocation.

B.10.4 Erasure requests affecting service provision. Where the Controller instructs the Processor to delete Personal Data of an Authorized User or other identified individual in response to a Data Subject request, and such deletion has the effect that the Processor can no longer provide all or part of the Service to the Controller, the Controller remains responsible for the Fees due under the Agreement for the remainder of the Subscription Term. Such a request and the resulting impact on the Service shall not be deemed a termination of the Agreement, and the Controller shall not be entitled to any refund. For clarity, this provision does not affect Section 10.2 of the Agreement (Renewal); the Provider may decline to renew this Agreement if the Service cannot be meaningfully provided as a result of the Controller’s instructions.

B.11 Personal Data Breach

B.11.1 The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.

B.11.2 The notification shall include at least: (a) a description of the nature of the Personal Data Breach; (b) the categories and approximate number of Data Subjects and Personal Data records concerned, to the extent known; (c) the likely consequences of the breach; (d) the measures taken or proposed to address the breach and to mitigate its possible adverse effects; (e) the name and contact details of a contact point for further information.

B.11.3 Where, and insofar as, the information cannot be provided at the same time, it may be provided in phases without further undue delay.

B.11.4 The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach, to the extent such assistance does not impose a disproportionate burden on the Processor; the Parties shall in good faith agree on cost allocation for assistance that materially exceeds routine cooperation.

B.12 Audit Rights

B.12.1 The Processor shall make available to the Controller, on written request, the information necessary to demonstrate compliance with this DPA. The Processor shall respond to such a request within thirty (30) days.

B.12.2 The Controller may exercise this right no more than once per twelve (12) month period, except where (i) required by a competent supervisory authority, or (ii) following a Personal Data Breach affecting the Controller’s Personal Data that has been substantiated by the Processor or by a competent authority.

B.12.3 On-site audits or inspections at the Processor’s premises may only be conducted (i) following a Personal Data Breach affecting the Controller’s Personal Data that has been substantiated by the Processor or by a competent authority, or (ii) where required by a competent supervisory authority. Any on-site audit shall be conducted during normal business hours, on at least thirty (30) days’ prior written notice, in a manner that does not unreasonably disrupt the Processor’s operations, and subject to confidentiality obligations.

B.12.4 The Controller bears its own costs of audits. The Processor bears its own internal costs of cooperating with audits up to a reasonable level; additional or excessive cooperation may be charged to the Controller at the Processor’s then-current rates.

B.13 Return and Deletion of Personal Data

B.13.1 Customer responsibility to export. The Controller is responsible for exporting any Generated Documentation and other content it wishes to retain during the Subscription Term. The Controller acknowledges that, upon the end of the Subscription Term, the Controller’s access to the Service will end.

B.13.2 Deletion. The Processor shall delete all Personal Data processed under this DPA within sixty (60) days of the end of the Subscription Term, except: (a) backups, which are deleted in the ordinary course of the Processor’s backup rotation and in any event within ninety (90) days from the date of the original processing, and are not restored or used during their remaining retention period; (b) records the Processor is required to retain under applicable law (in particular, accounting and invoicing records under Belgian tax law, which must be retained for seven (7) years); (c) anonymized data that no longer permits identification of any Data Subject.

B.13.3 On the Controller’s written request made within sixty (60) days of the end of the Subscription Term, the Processor shall confirm the completion of deletion in writing.

B.14 Data Protection Contact

B.14.1 The Processor has assessed that it is not required to appoint a Data Protection Officer under Article 37 GDPR. The Processor has appointed a contact point for data protection matters reachable at info@smartdoxx.com.

B.14.2 The Controller’s data protection contact is the contact set out in the Controller’s account registration or, failing that, the Controller’s primary administrative contact.

B.15 Liability

B.15.1 Each Party’s liability under this DPA forms part of, and is included within, that Party’s aggregate liability under the Agreement. The limitations and exclusions in Section 19 of the Agreement (including the cap in Section 19.2, the carve-outs in Section 19.4, and the cap for gross negligence in Section 19.5) apply to liability under this DPA on the same terms.

B.16 Term and Termination

B.16.1 This DPA takes effect on the Effective Date of the Agreement and continues until the end of the Processor’s processing of Personal Data under the Agreement.

B.16.2 Sections that by their nature should survive termination (in particular, those relating to confidentiality, liability, audit relating to past processing, and deletion) survive termination of this DPA.

Annex C – Acceptable Use Policy

C.1 Purpose

This Acceptable Use Policy (the “AUP”) sets out rules for the use of the Service. It forms an integral part of the Agreement. In case of conflict between this AUP and the body of the Agreement, the body of the Agreement prevails.

C.2 Permitted Use

The Customer may use the Service only for the purposes set out in Section 4 of the Agreement.

The Customer may use the Service to generate documentation for its own customers in an agency, consulting, or services capacity (for example, where the Customer is a software development agency or documentation services provider generating documentation for its own clients’ codebases). In doing so, the Customer remains fully responsible under the Agreement, including the warranties in Section 8.2 regarding repository contents.

The Customer may not, however, offer the Smartdoxx platform itself – or any rebranded, white-labelled, or repackaged version of it – as a standalone product or service to third parties.

C.3 Prohibited Activities

The Customer shall not, and shall not permit any Authorized User or third party to:

(a) use the Service in violation of any applicable law, including export controls, economic sanctions (including those of the European Union, the United Nations, and Belgium), anti-spam laws, anti-discrimination laws, or intellectual property laws;

(b) connect to the Service, or have documentation generated from, any code repository that the Customer does not own or does not have explicit permission to access and process;

(c) upload, transmit, generate, or process through the Service any content that: (i) is unlawful, defamatory, harassing, obscene, or otherwise objectionable; (ii) contains malware, viruses, worms, ransomware, or other malicious code; (iii) infringes any third party’s intellectual property, privacy, or other rights; (iv) contains hardcoded credentials, API keys, access tokens, private keys, internal IP addresses, or other sensitive infrastructure information; personal data or special categories of personal data beyond what is intrinsic to a source-code repository (such as commit author metadata, copyright notices, and code comments); or trade secrets, confidential information, or other materials of any third party in respect of which the Customer does not have the right to grant the Provider access for the purposes of providing the Service. For clarity, this provision does not restrict the Customer’s right to process its own source code, technical information, trade secrets, or confidential information through the Service (Section 8.2 of the Agreement);

(d) use the Service to develop, distribute, or facilitate cyber attacks, exploits, surveillance tooling, or other malicious software;

(e) use the Service to facilitate activities that promote violence, exploitation, terrorism, child sexual abuse, or other serious harm;

(f) reverse engineer, decompile, or attempt to derive the source code of the Service (Section 4.3 of the Agreement);

(g) resell, sublicense, white-label, rebrand, or otherwise make the Smartdoxx platform itself available to third parties as a standalone product or service (Section C.2 above);

(h) conduct security testing, penetration testing, vulnerability scanning, or load testing on the Service without the Provider’s prior written permission (Section C.4 below);

(i) use any automated means (bots, scrapers, scripts) to access the Service in a manner that circumvents technical limits, exceeds usage entitlements set out in the Subscription Plan, or interferes with the operation of the Service;

(j) provide access to the Service to, or use the Service on behalf of, persons or entities subject to applicable economic sanctions or in violation of applicable export control laws;

(k) use the Service for safety-critical, life-critical, emergency, medical, security-critical, or regulated-decision purposes without appropriate human review and independent verification (Section 6.8 of the Agreement);

(l) publish, disclose, or make available to any third party any benchmark, performance test, load test, security test, vulnerability scan, model-output comparison, or similar evaluation of the Service without the Provider’s prior written consent, except to the extent disclosure is required by law or by a competent authority.

C.4 Security Testing

The Customer may request the Provider’s written permission to conduct security testing, penetration testing, or vulnerability scanning on the Service. Requests must be submitted to info@smartdoxx.com in advance and may be granted subject to conditions agreed between the Parties (scope, timing, methodology, confidentiality, reporting). Conducting such testing without the Provider’s prior written permission may, depending on its scope and impact, constitute a material breach of the Agreement.

C.5 Responsible Disclosure

If the Customer or any Authorized User identifies a security vulnerability in the Service, the Provider requests that it be reported to info@smartdoxx.com and not be disclosed publicly, exploited, or used to access data or systems that the Customer is not authorized to access. The Provider will acknowledge such reports and will work in good faith to investigate and remediate validated issues.

C.6 Customer Warranties

The Customer’s warranties in Section 8 of the Agreement (in particular Section 8.2 regarding the contents of Connected Repositories, including the open-source license warranty in Section 8.2(e)) apply in full to use of the Service under this AUP.

C.7 Reporting Violations

Any person may report a suspected violation of this AUP, abuse of the Service, copyright complaint, or other concern about misuse of the Service to info@smartdoxx.com.

C.8 Investigation

The Provider may investigate suspected violations of this AUP. Although the Provider does not retain source code (which is processed in transit only), the Provider may review Generated Documentation hosted in the SmartViewer, access logs, audit logs, account activity, and other data that remains accessible to it, to the extent necessary to investigate a suspected violation.

C.9 Enforcement

The Provider may enforce this AUP in accordance with Sections 10 and 11 of the Agreement. In particular:

(a) for serious violations – including those that create a security or legal risk to the Provider, other customers, or third parties, those that are required by law to be addressed immediately, or those that cause material reputational harm arising from an objectively wrongful use of the Service – the Provider may suspend access to the Service immediately, without prior notice;

(b) for other violations, the Provider will give the Customer reasonable opportunity to cure before suspending or terminating the Service.

C.10 Updates

The Provider may update this AUP from time to time. The Provider will give the Customer at least thirty (30) days’ prior written notice of any material change. If the Customer does not accept a material change, the Customer’s sole remedy is to terminate the Agreement before the change takes effect, with refund of any prepaid Fees for the unused portion of the then-current Term.

Annex D – Sub-processor List

This Annex D lists the Sub-processors engaged by Smartdoxx BV in connection with the Service, as referenced in Section B.8 of the DPA. Smartdoxx maintains this list and updates it in accordance with Sections B.8.3 and B.8.3bis.

Last updated: 21 June 2026

D.1 Sub-processors

Infrastructure and storage

Database and backend

AI processing

Business operations

All AI processing sub-processors are configured to operate under zero-data-retention terms and to exclude input data from model training, fine-tuning, or improvement.