Karmaflow.ai — Terms of Service

These Terms of Service (“Terms”) govern access to and use of Karmaflow’s websites, platform, APIs, widgets, and related services (collectively, the “Services”) by the customer identified in an order, sign-up flow, or statement of work (“Customer,” “you”). By creating an account, clicking “I agree,” or using the Services, you accept these Terms.

Linked Policies

Certain data protection, acceptable use, and telephony terms are incorporated by reference (the “Linked Policies”):

• Data Processing Addendum (DPA): https://karmaflow.ai/compliance_dpa
• Acceptable Use Policy (AUP): https://karmaflow.ai/compliance_aup
• Telephony & Messaging Addendum: https://karmaflow.ai/compliance_telephony

If you sign a separate Order Form or SOW with Karmaflow that expressly references these Terms, both documents apply. If they conflict, see §21 (Order of Precedence).

• “AI Outputs” or “Outputs” means content generated by the Services (e.g., text, audio, images, transcriptions, summaries).
• “Core Platform” means Karmaflow’s hosted control plane, orchestration/routing, agent runtime, conversation state store, and first-party web chat/voice widgets. It excludes third-party carriers, LLM/model APIs, email/SMS gateways, external CRMs, and other non-Karmaflow systems.
• “Customer Data” means data, prompts, instructions, audio, transcripts, identifiers, and other content submitted to or collected by the Services for you, including Personal Data.
• “Personal Data” has the meaning under applicable privacy laws.
• “Professional Services” means implementation, configuration, prompt/flow engineering, consulting, training, and similar services described in an SOW.
• “Third-Party Services” means products/services not provided by Karmaflow (e.g., LLMs from OpenAI/Google, telephony carriers, audio services, CRMs).
• “Usage Metrics” are units used to meter use (e.g., conversations, minutes, actions, images).

Billable Conversation (definition). A billable chat conversation occurs when there is ≥1 agent response and either (i) ≥10 total message turns (user+agent) or (ii) >3 minutes elapsed from the first agent response, with a 30-minute inactivity timeout. Retries due to platform errors are non-billable.

You must provide accurate registration information and keep credentials secure. You are responsible for activity in your account and for your users’ compliance with these Terms and the Linked Policies.

1. Provision. Karmaflow will provide access to the Core Platform during your subscription term and any agreed Professional Services.
2. Changes. We may enhance or modify features to improve security, performance, or user experience. Material reductions of core subscribed functionality will be announced in advance; if unresolved, you may terminate the impacted Order Form with a pro-rata refund of prepaid base fees.
3. Beta/Trials. Pre-release features are provided AS IS, may change or be withdrawn, and are excluded from SLA credits and indemnities.

You will comply with the AUP. Do not submit prohibited or highly sensitive data (e.g., health/biometric, payment card data, children’s data) unless we’ve expressly agreed in writing. You must maintain human oversight when relying on AI Outputs, especially for consequential decisions.

1. Default ON. Given the nature of the Services, recording and/or transcription are enabled by default for supported channels (e.g., voice, chat, SMS, email) to provide conversation quality, analytics, and safety features.
2. Notices & Opt-Out Intent. The Services provide built-in notices and configurable announcements. We support end-user opt-out intents (e.g., “do not record,” “stop recording”) recognized by the platform. When an opt-out intent is detected—or when you configure recording off for a channel—the Services will stop recording/transcription going forward for that interaction (technical limits may require a short buffer).
3. Consent & Evidence. You are responsible for configuring channel-appropriate notices/consents to meet applicable laws (e.g., PIPEDA/CASL, U.S. one- or two-party consent, GDPR). The platform can log consent or opt-out signals (timestamp, prompt text, channel, outcome) and retain this evidence per your settings.
4. Surface Responsibility. For interactions occurring on Customer-controlled surfaces or via Third-Party Services (e.g., your website, telephony routes, CRM), you must ensure the required notices/consents are displayed and honored.
5. Feature Effects. If recording/transcription is disabled or an end-user opts out, certain features may degrade or become unavailable (e.g., QA, analytics, safety review).

1. Compliance. You must comply with applicable laws (e.g., CASL/CAN-SPAM/TCPA), including consent, identification, opt-in/opt-out, quiet hours, and DNC lists. You’re responsible for required registrations (e.g., A2P 10DLC) and associated fees.
2. No Emergency Services. The Services do not support emergency calling (e.g., 911/112). Do not market or rely on the Services for emergency communications.
3. Third-Party Carriers. Telephony, transcription, and speech features may rely on carriers and audio vendors; availability and latency are outside our direct control.

Your use of Third-Party Services is governed by their terms. We are not responsible for their availability or data handling. You are responsible for enabling, configuring, and paying for any Third-Party Services you choose to use.

1. Fees. You agree to pay subscription fees, usage-based fees (e.g., conversations, minutes, actions, images), and any pass-through fees (e.g., carrier registrations) as stated in your plan, Order Form, or SOW.
2. Invoicing & Payment. Unless otherwise stated, subscriptions are billed in advance; usage and time-and-materials services in arrears. Net 30 from invoice date for invoiced plans; for card-on-file plans, charges occur automatically.
3. Budget Cap & Auto-Pause (optional). If enabled, a monthly hard cap will auto-pause non-critical channels at the cap and send alerts to named recipients. No billing beyond the cap without written approval.
4. Pass-Through Changes. We will provide advance notice of pass-through rate changes. You may disable affected features before new charges apply.
5. Late Fees; Taxes. Overdue amounts may accrue 1.5%/month (or the maximum lawful rate). Fees are exclusive of taxes; you are responsible for taxes except those on our net income.

1. Monthly Plans. Renew automatically month-to-month until cancelled. You must cancel in-app before the next billing cycle to avoid renewal charges.
2. Annual Plans. Annual terms renew only after a review and confirmation at least 90 days before the end of the then-current term. If not confirmed by that date, the annual plan ends at term expiry and the account reverts to month-to-month at then-current standard pricing starting the day after term end.
3. Termination for Cause. Either party may terminate for material breach not cured within 30 days (10 days for non-payment).
4. Effect of Termination. You remain responsible for fees through the effective termination date. Except as stated in §12 (SLA Credits) or a signed Order Form/SOW, prepaid amounts are non-refundable.

1. Export Window. After expiration or termination, you have 90 days to export Customer Data via self-service or request a one no-cost bulk export (secure transfer).
2. Deletion. We will delete Customer Data and backups within 30 days after the export window, except where retention is legally required, and provide a deletion certificate on request.
3. Data Location. Default processing occurs in the United States. Optional region selection (e.g., Canada) is available as a paid add-on by written agreement. Processing outside the U.S./Canada requires your written consent and appropriate transfer safeguards.
4. Privacy Terms. The DPA applies where we process Personal Data on your behalf and controls in the event of a conflict with these Terms on data protection matters.

1. Program. We maintain administrative, technical, and physical safeguards appropriate to the Services (encryption in transit, least-privilege access, logging/monitoring, vulnerability management, change management, SDLC, vendor risk).
2. Incident Notice. We will notify you within 72 hours of discovery of a confirmed Security Incident affecting Customer Data and provide daily updates until containment.
3. Transparency. Annually, we will provide available compliance artifacts: SOC 2 Type II when available (target Q2 2026). Until then, we will provide a third-party penetration-test executive summary (next scheduled mid-Jan 2026) and respond to reasonable security questionnaires.
4. Sub-processors. We remain responsible for sub-processors. We maintain an online list and provide 30 days’ prior notice of additions. You may object on reasonable data-protection grounds; if unresolved, you may terminate impacted workloads with a pro-rata refund of prepaid base fees.

1. Support. Standard support is 9 am–6 pm ET, Mon–Fri. Targets: P1 acknowledge 4 business hours; P2 1 business day; P3 3 business days. Enterprise on-call 24×7 for P1 is available as an add-on.
2. Status Page. We post incidents and history at status.karmaflow.ai and may also notify by email.
3. Uptime & Credits. Monthly uptime target is 99.9%, excluding: planned maintenance (48-hour notice; off-peak), Customer systems/Internet, Third-Party Services (e.g., carriers, LLM/model APIs, email/SMS gateways, external CRMs), Beta, and force majeure. Credits per month against the Monthly Platform Fee: 99.0%–99.89% → 10%; 98.0%–98.99% → 25%; <98.0% → 50%. Chronic failure: any 2 months <99.0% or 3 months <99.9% in a rolling 6-month period → you may terminate the affected Order Form for cause with a pro-rata refund of prepaid base fees. Provider monitoring logs are authoritative; third-party/Customer-caused incidents don’t count as downtime. Request credits within 30 days after the month closes.

1. Customer Data. You own Customer Data. You grant us a limited license to process it to provide the Services and as otherwise permitted by the DPA and these Terms.
2. Services. We own the Services and all related IP.
3. Outputs. To the extent permitted, we assign to you all right, title, and interest in AI Outputs generated for you. Where assignment isn’t permitted by a model provider, we grant you a perpetual, worldwide, royalty-free license for your business purposes.
4. No-Train (Default). We do not use Customer Data, prompts, embeddings, retrieval context, or Outputs to train or improve foundation models (including third-party models). We may use aggregated, de-identified telemetry to operate and improve the Services. We flow down these restrictions to sub-processors and model vendors.
5. Feedback. You grant us a perpetual, royalty-free license to use suggestions to improve the Services without identifying you as the source without consent.
6. Professional Services Deliverables. We retain generic frameworks/know-how. You own Customer-specific prompts, retrieval configurations, system instructions, conversation flows, custom schemas/mappings, and UI copy developed for you; we assign these upon payment.

Each party will protect the other’s Confidential Information using reasonable care, use it only to perform under these Terms, and disclose it only to those who need to know under confidentiality obligations. Usual exclusions and compelled-disclosure rules apply.

1. Authority. Each party represents it has authority to enter these Terms.
2. Conformance. The Core Platform will materially conform to the Documentation during the subscription term; Professional Services will be performed in a professional and workmanlike manner. Remedies: re-performance/correction or pro-rata refund of prepaid base fees for the non-conforming portion.
3. Malware/Backdoor. We warrant we will not intentionally include malware, backdoors, or logic bombs in our code.
4. Disclaimer. Except as stated, the Services, Outputs, and Documentation are provided AS IS and AS AVAILABLE, without warranties of merchantability, fitness for a particular purpose, non-infringement, or that Outputs will be error-free or suitable for legal, medical, or financial advice. You are responsible for human review and decisions.

1. By Karmaflow — Services IP. We will defend and indemnify you against third-party claims that your authorized use of the Services infringes IP rights.
2. By Karmaflow — Outputs IP. We will defend and indemnify you against third-party claims alleging AI Outputs, when used as provided with required human review, infringe IP rights.
3. By Karmaflow — Security Incident. We will defend and indemnify you for third-party claims and government fines to the extent caused by our breach of our security obligations resulting in a Security Incident.
4. By Customer. You will defend and indemnify us for claims arising from (a) Customer Data/content; (b) your violation of laws (including CASL/CAN-SPAM/TCPA, call-recording/consent requirements); or (c) your use of Third-Party Services.
5. Process. Prompt notice, control of defense, and cooperation are required; no settlements imposing an admission or obligation without consent.

Except for (a) IP indemnities, (b) data-breach indemnity for our failure to comply with §11/DPA, (c) confidentiality breach, (d) gross negligence/willful misconduct, or (e) your unpaid fees, each party’s total liability is capped at 2× the total fees paid or payable under the impacted Order Form in the 24 months preceding the claim. No party will be liable for indirect, incidental, special, consequential, or punitive damages, or lost profits, revenue, goodwill, or data.

We will not use your name, logo, or case studies without your prior written consent.

Either party may assign to an affiliate or in connection with a merger or sale, provided the assignee is not a direct competitor of the non-assigning party and assumes all obligations. We may use subcontractors and remain responsible for their performance.

Each party will comply with applicable laws (including PIPEDA/GDPR/CCPA/CPRA; CASL/CAN-SPAM/TCPA; export controls and sanctions; anti-corruption). You are responsible for providing legally required recording/monitoring notices and for maintaining consent or opt-out evidence appropriate to your jurisdictions.

1. Law & Venue. Ontario law governs; the parties submit to the exclusive jurisdiction of the provincial/federal courts in Ottawa, Ontario.
2. Dispute Resolution. Before filing suit, executives will meet in good faith within 30 days of a written dispute notice.
3. Order of Precedence. On data protection matters, the DPA controls. Otherwise: (1) any signed Order Form/SOW (including any SLA schedule it attaches); (2) these Terms; (3) the Linked Policies; (4) the Documentation.

Notices must be in writing and delivered by personal delivery, reputable courier, or email. Notices to Karmaflow: legal@karmaflow.ai (with a copy to the address above). Notices are deemed received on delivery, or for email when sent without bounce if followed by one of the foregoing methods.

Neither party is liable for delays or failures due to causes beyond reasonable control (e.g., acts of God, labor disputes, Internet or cloud outages not in a party’s control, DDoS, war, government actions), provided it uses reasonable efforts to mitigate.

We may update these Terms from time to time. For material changes, we will provide advance notice by email or in-product. If you object and we cannot resolve within 30 days, you may terminate the impacted Order Form and receive a pro-rata refund of prepaid base fees for the unused portion.

Independent contractors; no joint venture or agency. If any provision is unenforceable, it will be modified to reflect the parties’ intent while the remainder stays in effect. These Terms, the Linked Policies, and any Order Form/SOW are the entire agreement. They may be executed electronically.

Linked Policy Snapshot

(for convenience only; the posted policies control)

• AUP highlights: prohibited data/uses; opt-in/opt-out and unsubscribe mechanisms; DNC scrubs; quiet hours; no safety-critical uses; no reverse-engineering of models.
• Telephony Addendum highlights: no emergency calling; pass-through fees with prior notice; number licensing and port-out; billing increments; recording/transcription default ON with opt-out intent support and logged evidence.
• DPA highlights: processor obligations; sub-processing and notices; SCCs/UK IDTA as needed; deletion/return; security measures; No-Train default and flow-downs.

Exhibit A — Product-Level Definitions (Reference)

• Core Platform uptime is measured by Karmaflow’s production monitoring of the control plane, orchestration/routing, agent runtime, and first-party web chat/voice widgets.
• Service Credits apply only to the Monthly Platform Fee (not usage or third-party pass-throughs), must be requested within 30 days after the affected month, and cannot exceed the fee for that month.
• Third-Party Services include, without limitation: LLM/model providers (e.g., OpenAI/Google/Anthropic), carriers and messaging providers (e.g., Twilio), speech/audio partners (e.g., Deepgram, Cartesia), and customer-enabled integrations (e.g., Shopify, HubSpot).

Optional Order Form Fields

• Plan: Monthly / Annual
• Region: Default US □ / Canada □ / Other (quote) □
• Support Tier: Standard □ / Enterprise 24×7 P1 □
• Recording Defaults: Voice ON □ Chat ON □ SMS ON □ Email ON □ (opt-out intent honored)
• Budget Cap: $__________ / month; Auto-pause channels: __________; Alerts to: __________
• Model Usage: No-Train (default) □ / Opt-ins (specify) □
• Sub-processor Notices: Send to: __________

For legal notices or contract questions, contact legal@karmaflow.ai.