Terms of Service & Data Processing (MVP)

Version v0.1 · 22 October 2026

1. Parties and scope

These terms govern the use of Agent Workspace (the “Service”) provided by FLAI Studio, a sole proprietorship under German law (the “Operator”, “we”; legal details in the Imprint). The Service is offered only to businesses (entrepreneurs within the meaning of § 14 BGB), not to consumers. You accept these terms by ticking the box when you sign up. A person who creates a company workspace accepts them on behalf of that company (the “Customer”) and confirms being authorised to do so. The Customer's own terms do not apply.

2. The Service

The Service is a pilot / minimum viable product, provided “as is” and “as available”. We give no commitment on availability, uptime, response times or support, and may change, limit or discontinue features. Maintenance may interrupt the Service. The Customer keeps its own copies of important data. The pilot is free of charge; any paid plan requires a separate order.

3. Accounts and companies

Provide accurate details and keep your credentials secret. You are responsible for activity under your account, including actions of AI assistants you connect. The Customer's owner decides who is invited and what roles and folder permissions they have, and the Customer is responsible for its members and their assistants. Tell us without delay at office@flaistudio.de about any unauthorised use.

4. Acceptable use

You must not: upload unlawful, infringing or harmful content (including malware); store or share personal data of others without a legal basis; try to break security or the separation between companies; overload, scrape or probe the Service; or use it for spam or fraud. We may suspend an account or company if we reasonably suspect a breach or to prevent harm, and will notify you where possible.

5. AI assistants

Members connect their own AI assistants (for example Claude or ChatGPT) under their own subscriptions and the provider's terms. We do not call AI models on your behalf and do not use Customer content to train any model. We are not responsible for third-party AI services or their output; the Customer reviews what its assistants do.

6. Data processing agreement (Art. 28 GDPR)

For content the Customer stores in the Service (“Customer Data”) the Customer is the controller and we are the processor. This section is the data processing agreement. For account data we are the controller — see the Privacy Policy.

• Subject, nature, purpose, duration: hosting and providing the Service (storing, organising, transmitting and deleting data) for the term of these terms.
• Data and data subjects: names, email addresses, roles and permissions of the Customer's members; files, tasks, approvals and playbooks; audit records of human and agent actions; any personal data the Customer puts into its content.
• Instructions: we process Customer Data only on the Customer's documented instructions, given by configuring and using the Service or in writing, and inform the Customer if we consider an instruction unlawful.
• Confidentiality: only persons bound to confidentiality have access, and only as needed.
• Security (Art. 32): hosting in the EU; TLS for all connections; files encrypted at rest with a per-company key; database-level isolation of each company; append-only audit log; least-privilege access; regular backups.
• Sub-processors: the Customer authorises those listed below. We announce changes by email at least 14 days in advance; the Customer may object and, if no solution is found, terminate.
• Assistance: we reasonably help with data subject requests and with Art. 32–36 GDPR, and report personal data breaches without undue delay.
• Return and deletion: the owner can export company data at any time from the admin area and request deletion of the company. After termination we delete Customer Data within 30 days, unless law requires retention; backups are overwritten in their regular rotation.
• Audits: we provide the information needed to show compliance; inspections by prior arrangement, at most once a year, at the Customer's cost.
• Location: Customer Data is stored in the EU. Transfers outside the EU/EEA only under Art. 44 ff. GDPR.

7. Liability

We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the Product Liability Act and under any guarantee we gave. For slight negligence we are liable only for breach of an essential obligation (one whose fulfilment makes the contract possible and on which the Customer may rely), limited to the typical, foreseeable damage and in total to the fees paid by the Customer in the 12 months before the event — during the free pilot, zero. Otherwise liability is excluded. For loss of data we are liable only for the cost of restoring it from copies the Customer should reasonably keep.

8. Term and termination

These terms run for an indefinite period. The Customer may terminate at any time by closing its company or by email. We may terminate the pilot with 14 days' notice by email, and immediately for good cause. Section 6 (return and deletion) and section 7 survive termination.

9. Changes

We will email changes to the account address at least 14 days before they take effect. If you do not object before then and keep using the Service, the new version applies; we will point this out in the email. If you object, either side may terminate. Changes required by law or for security may apply sooner.

10. Final provisions

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. Exclusive place of jurisdiction is the Operator's place of business, to the extent legally permitted. These terms are written in English; a German version can be provided on request. If a provision is invalid, the rest remains in force. Contact: office@flaistudio.de.

Agent Workspace · Privacy Policy · Imprint