Terms of Service

1.1 Acceptance

By registering for an account, accessing www.spyral.lu, or using any of the Services — including any demonstration, pilot, evaluation or trial environment we make available to you — you confirm that you have read and agree to be bound by these Terms and by our Privacy Policy.

1.2 Organisations

If you use the Services on behalf of an organisation, you represent that you have authority to bind that organisation, and “you” means that organisation. The organisation is the customer and is responsible for the acts and omissions of its users.

1.3 Record of Acceptance

We record each acceptance of these Terms, including the accepting user, the date and time, and the version accepted, and we archive each published version. We will provide you with the record of your own acceptance, and a copy of the version you accepted, on request.

1.4 Incorporation and Transfer of Rights

Spyral is in the process of being incorporated. Acts performed in the name of Spyral before registration are performed on behalf of the company in formation and will be taken over by SPYRAL S.à r.l.-S upon its registration with the RCS Luxembourg, with effect from the date those acts were performed.

You agree in advance to the transfer of this agreement, and of all rights and obligations under it, to SPYRAL S.à r.l.-S on registration, and no further consent or formality is required from you. On and from that transfer, the rights under section 4.2 and section 15 accrue to, and are enforceable by, the registered company, including in respect of any breach occurring before registration. We will publish the registration details in these Terms once registration completes, and this does not count as a material change under section 17.1.

3.1 Registration

You must provide accurate and current registration information and keep it up to date. You are responsible for the confidentiality of your credentials and for activity under your account.

3.2 Your Security Obligations

• Use a strong, unique password and keep it confidential
• Enable two-factor authentication, particularly for administrator accounts
• Review and remove user access promptly when someone leaves your organisation
• Configure document visibility and roles appropriately for your firm
• Notify us without delay at security@spyral.lu if you suspect unauthorised access

3.3 Named Users

Access credentials are personal to each named user and may not be shared, transferred, or used concurrently by more than one individual. You are responsible for ensuring that each individual accessing the Services under your account does so under their own credentials, and you remain liable for their acts and omissions as if they were your own.

3.4 Access Logging

You acknowledge that we log access to and activity within the Services, including the identity of the acting user, the time of access and the actions performed. These logs form part of our security and audit measures, are available to you for your own tenant under section 14.4, and may be relied upon as evidence in connection with any alleged breach of these Terms.

3.5 Suspension

We may suspend an account or specific access where necessary to protect the Services or others — for example on evidence of compromise, abuse, unlawful use, or non-payment after notice. We will limit suspension to what is necessary, notify you as soon as reasonably practicable with the reason, and restore access once the cause is resolved. Suspension does not extend your subscription term.

4.1 Acceptable Use

You agree not to:

• Use the Services unlawfully, or to store or transmit unlawful content
• Attempt to gain unauthorised access to the Services, other tenants, or any underlying system
• Interfere with the integrity, availability or performance of the Services, including by circumventing rate limits or usage controls
• Upload malicious code
• Use automated means to access, scrape, index or extract data from the Services, other than through interfaces we expressly make available for that purpose or as necessary to exercise your rights under section 14
• Resell, sublicense or provide the Services to a third party as a service bureau, except to your own clients in the ordinary course of your professional practice
• Use the Services to build a competing product, or to extract the Services' outputs systematically to train a competing model

Nothing above restricts what you are permitted to do under mandatory law, including the rights to observe, study and test software under Article 5(3) and to decompile for interoperability under Article 6 of Directive 2009/24/EC, or any right you have under Regulation (EU) 2023/2854 to switch to another provider.

4.2 Restrictions on Analysis and Derivation

This section concerns trade secrets. It is separate from, and additional to, both the acceptable-use rules in section 4.1 and the confidentiality obligations in section 15, and it applies to information you obtain by using the Services as well as to information disclosed to you.

You agree that you will not, and will not permit or assist any third party to:

• Attempt to derive the underlying structure, algorithms, models, prompts, rules, mappings, taxonomies, thresholds or know-how of the Services
• Observe, study, test, analyse, benchmark or probe the Services for the purpose of acquiring, deriving or reconstructing any Confidential Information or trade secret of Spyral
• Use the Services, or information acquired through use of the Services, to design, develop, commission, fund or assist in the development of any product, service or internal system that performs functions substantially similar to those of the Services
• Publish or otherwise make available to any third party the results of any benchmarking, performance testing, accuracy evaluation or comparative analysis of the Services without our prior written consent
• Publish, demonstrate, record or describe to any third party the non-public functionality of the Services, including screenshots and screen recordings of interfaces not reachable without an account, without our prior written consent

You will ensure that every person to whom you give access to the Services is bound by obligations equivalent to this section and to section 15, and you remain liable for their compliance as if it were your own.

Acknowledgement.You expressly acknowledge that, in respect of Spyral's trade secrets, you are subject to a legally valid duty limiting their acquisition within the meaning of Article 3(1)(b) of Directive (EU) 2016/943 and the Luxembourg Law of 26 June 2019 on the protection of undisclosed know-how and business information, and that observation, study, testing and analysis of the Services for the purposes described above accordingly does not constitute lawful acquisition of those trade secrets.

This section concerns the acquisition of trade secrets and is not intended to restrict, and does not restrict, the rights preserved by the final paragraph of section 4.1, which continue to apply in full.

The obligations in this section survive termination, for the duration set out in section 15.6.

4.3 Non-Solicitation

During your use of the Services and for twelve (12) months following termination, you will not directly or indirectly solicit for employment or engagement any employee or contractor of Spyral with whom you had contact in connection with the Services, except through a general public advertisement not targeted at that person.

4.4 Your Content

You are responsible for the content you upload or connect (“Customer Content”). You represent that you have the rights and the lawful basis necessary to upload it and to have us process it, and that it does not infringe third-party rights.

4.5 Restricted Content

Do not upload special category data under GDPR Article 9 or criminal offence data under Article 10 unless you have a lawful basis and have agreed the necessary additional measures with us in writing. The platform is not designed for such data.

4.6 Professional Secrecy

If you are subject to a professional secrecy or banking secrecy obligation, you are responsible for confirming that using the Services is permitted under the law and regulatory guidance that applies to you, and for obtaining any consent or authorisation that law requires before you upload data covered by that obligation. On request we will enter into the additional written terms your regulator requires, including those addressed in section 6.

4.7 Competitor Access

You represent that you are not, and are not acting on behalf of or at the direction of, a person who offers or is developing a product or service that competes with the Services. If that ceases to be true, tell us. We may refuse or withdraw access where this representation is or becomes untrue, and may terminate on written notice; where we do, we will refund fees covering the unused remainder of your current subscription period. This section does not restrict your rights under section 14.

5.1 Roles

For Customer Content, you are the controller and Spyral is the processor. You are responsible for the lawfulness of what you upload and for informing your own data subjects. For account administration, billing, support, security and marketing, Spyral is an independent controller.

5.2 Data Processing Agreement

A Data Processing Agreement meeting GDPR Article 28(3) forms part of these Terms for every EU/EEA customer and prevails over these Terms in the event of conflict on data protection matters. Request a copy at privacy@spyral.lu.

5.3 Sub-processors

You give general written authorisation for Spyral to engage sub-processors. We maintain a current list, provide it on request, and notify you in advance of any intended addition or replacement so that you may object on reasonable data protection grounds. If we cannot resolve a reasonable objection, you may terminate the affected Services.

5.4 Privacy Policy

Our handling of personal data is described in our Privacy Policy.

7.1 Spyral's Rights

The Services, including all software, designs, interfaces, trademarks, models, taxonomies, rules, mappings and documentation (excluding Customer Content), are owned by or licensed to Spyral and protected by copyright, trademark, trade secret and other intellectual property law. We grant you a non-exclusive, non-transferable right to use the Services during your subscription, for your internal business purposes and for serving your own clients. Nothing in these Terms transfers any other right, title or interest in the Services to you.

7.2 Your Content

You retain all rights in Customer Content. You grant us a limited, non-exclusive, royalty-free licence to host, copy, transmit, display and process Customer Content strictly to the extent necessary to provide the Services to you, to keep them secure, and to comply with law. This licence ends when the content is deleted or the agreement terminates.

We do not use Customer Content to train or improve AI models— not ours, and not any provider's. We do not use Customer Content to develop or improve our Services generally, beyond providing them to you. Aggregate operational metrics that identify neither you nor any individual, and contain no Customer Content, may be used to monitor and improve the Services.

7.3 Review Signals

By way of a single, narrow exception to section 7.2, we may retain and use the record of what your users do with automated output — whether a classification, extraction or proposed entry was confirmed, corrected, rejected or overridden, and the confidence and routing signals attached to it — in order to measure and improve the accuracy of the Services.

This exception covers the decision, not the document. It does not extend to Customer Content itself, to any text or value drawn from your documents, or to any personal data, none of which we retain or use for this purpose. Review signals are held in de-identified form, are never disclosed in any form that identifies you, your clients or any individual, and are never used to train or fine-tune a general-purpose model. Section 7.2 governs everything this exception does not expressly cover.

7.4 AI Output

As between you and Spyral, you own the output the AI features generate from your inputs and Customer Content, and you may use it without restriction. Output is generated from statistical models: similar inputs may produce similar output for other customers, and we make no representation that output is unique or that it is protectable by copyright in any jurisdiction.

7.5 Feedback

If you send us suggestions, we may use them freely to improve the Services, without obligation to you and without any claim on your intellectual property.

8.1 AI Output Requires Review

The Services use AI to classify documents, extract data, prepare bookkeeping entries, draft filings and answer questions. All AI output is a proposal, not a professional conclusion. It can be incomplete, out of date or wrong. You must review it before relying on it, and you remain solely responsible for anything you file, sign, send to a client or act upon.

8.2 Not Professional Advice

Spyral is a tool, not an adviser. Nothing produced by the Services is accounting, tax, legal, audit or regulatory advice, and using the Services does not create any professional relationship between you and us. Responsibility for professional judgement, for the accuracy and completeness of any filing, and for compliance with the rules of your profession, remains entirely yours.

8.3 Transparency

Interfaces where you interact with an AI system are identified as such, and AI output is labelled in the interface and carries citations to its sources. Output you export or send on carries no such labelling once it leaves the platform, so if you pass AI output to a third party, any disclosure your own obligations require is yours to make.

8.4 Human Oversight

You must keep meaningful human oversight over AI-assisted workflows, ensure that the people operating them are competent to evaluate the output, and not configure the Services to remove review steps for filings or client deliverables.

8.5 Usage Limits

AI features carry usage limits to keep the service available and costs predictable. Current limits are documented in the application. We will give reasonable notice before tightening a limit in a way that materially affects your use.

9.1 Subscription

Paid features require a subscription. Applicable fees, the billing period and any included usage are those shown at the point of purchase and in your account. Fees are exclusive of VAT and other taxes, which you are responsible for. Where the reverse charge applies, you are responsible for providing a valid VAT identification number.

9.2 Billing

Subscriptions are billed in advance for the selected period. Payments are non-refundable except where these Terms or mandatory law provide otherwise. Where seat counts change during a period, the subscription is adjusted accordingly.

9.3 Late Payment

Undisputed invoices unpaid after their due date may attract statutory interest for late payment in commercial transactions under Directive 2011/7/EU as implemented in the applicable jurisdiction. We will give at least 7 days' written notice before suspending Services for non-payment.

9.4 Price Changes

We may change fees with at least 30 days' notice before the change takes effect. Changes do not apply to a subscription period already paid for. If a price increase is unacceptable to you, you may terminate with effect from the date the increase would apply, without penalty.

11.1 What We Warrant

We warrant that:

• The Services will be provided with reasonable skill and care and in a professional manner
• We will maintain technical and organisational measures appropriate to the risk, as described in the Privacy Policy and the Data Processing Agreement
• We have the right to grant the rights we grant under these Terms

11.2 What We Do Not Warrant

We do not warrant that the Services will be uninterrupted or error-free, that every defect will be corrected, or that the Services will meet requirements we have not agreed in writing. In particular, and as set out in section 8, we do not warrant the accuracy, completeness or fitness for any purpose of AI-generated output.

11.3 Disclaimer

Except as expressly stated in section 11.1, and to the fullest extent permitted by applicable law, the Services are provided without further warranties of any kind, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose and non-infringement.

15.1 Definition

“Confidential Information” means information disclosed by one party (the “disclosing party”) to the other (the “receiving party”), whether before or after acceptance of these Terms, in any form, that is either identified as confidential or that a reasonable person would understand to be confidential given its nature or the circumstances of disclosure.

Confidential Information of Spyral includes the non-public functionality, architecture, data models, database schemas, document taxonomies and classification rules, extraction and prompting methods, verification and quality-control logic, confidence thresholds, filing-format mappings, model selection and routing, operational metrics, unit economics, pricing construction and product roadmap of the Services.

Confidential Information includes information the receiving party obtains by observing, using, testing or analysing the Services, whether or not it was expressly disclosed. Information does not cease to be Confidential Information merely because it was not marked or identified as confidential when it became known to the receiving party.

Customer Content is your Confidential Information, as is non-public information concerning your clients, mandates, internal processes and business.

15.2 Obligations

The receiving party will:

• Use Confidential Information solely to exercise its rights and perform its obligations under these Terms
• Not disclose it to any third party without the disclosing party's prior written consent
• Limit access to those of its personnel and professional advisers who need it for that purpose and who are bound by obligations no less protective than these, and remain responsible for their compliance
• Protect it with at least the degree of care it applies to its own confidential information of like importance, and in any event no less than a reasonable degree of care
• Notify the disclosing party promptly on becoming aware of any unauthorised use or disclosure

15.3 Exclusions

This section does not apply to information the receiving party can demonstrate:

• Was lawfully in its possession without restriction before disclosure
• Is or becomes public other than through breach of these Terms
• Is lawfully received from a third party without restriction and without breach of any obligation of confidence
• Was independently developed without use of or reference to the disclosing party's Confidential Information

15.4 Compelled Disclosure

The receiving party may disclose Confidential Information to the extent required by law, regulation or court order, provided that, where lawful and practicable, it gives the disclosing party prior notice and reasonable assistance in seeking protective treatment.

15.5 Trade Secrets

The parties acknowledge that certain Confidential Information of Spyral constitutes a trade secret within the meaning of Directive (EU) 2016/943 and the Luxembourg Law of 26 June 2019, and that the obligations in this section, together with section 3.4 and section 4.2, form part of the reasonable steps taken by Spyral to keep that information secret.

15.6 Duration

These obligations continue for five (5) years from termination. They continue indefinitely in respect of Customer Content covered by a professional secrecy obligation, and in respect of any Confidential Information that constitutes a trade secret, for as long as that information retains the character of a trade secret.

15.7 Remedies

Each party acknowledges that a breach of this section, or of section 4.2, may cause harm for which damages are an inadequate remedy, and that the other party may seek injunctive or other interim relief in addition to any remedy otherwise available to it.

16.1 Governing Law

These Terms are governed by the law of the Grand Duchy of Luxembourg, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. This choice does not deprive you of the protection of mandatory provisions of the law of your own country that would otherwise apply.

16.2 Disputes

The parties will first attempt to resolve any dispute in good faith, with escalation to senior representatives, within 30 days of written notice of the dispute. Failing that, the courts of Luxembourg City have jurisdiction.

16.3 Interim Relief

Nothing in section 16.2 prevents either party from applying at any time to any competent court, including the President of the Tribunal d'arrondissement de Luxembourg sitting in commercial matters, for interim or protective relief, including injunctive relief, in respect of an actual or threatened breach of section 4.2 or section 15, without first exhausting the escalation process.

17.1 Changes to These Terms

We may update these Terms. We will give reasonable notice of a material change — normally at least 30 days — by email to account administrators and by notice in the application. If a material change is unacceptable to you, you may terminate before it takes effect. Prepaid fees are not refunded. Continued use after the notice period constitutes acceptance. A change required by law, or needed to address a security risk, may take effect sooner.

17.2 Order of Precedence

Where documents conflict, the order is: a signed written agreement between us; the Data Processing Agreement and any regulatory addendum, on their subject matter; these Terms; then the documentation in the application.

17.3 Entire Agreement

These Terms, the Privacy Policy, the Data Processing Agreement and any agreement expressly incorporated form the entire agreement between us on their subject matter, and supersede prior discussions. Nothing limits liability for fraudulent misrepresentation.

17.4 Severability and Waiver

If a provision is invalid or unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed, and the rest continues in force. A failure to enforce a right is not a waiver of it.

17.5 Assignment

You may not assign these Terms without our prior written consent, which will not be unreasonably withheld. We may assign to an affiliate or in connection with a merger or sale of substantially all assets, on notice to you; if such an assignment materially prejudices you, you may terminate within 30 days of the notice.

17.6 Force Majeure

Neither party is liable for failure to perform caused by events beyond its reasonable control, provided it notifies the other and mitigates. This does not excuse payment obligations already due, and does not suspend your rights under section 14.

17.7 Notices

Notices to us go to contact@spyral.lu. Notices to you go to the email address of your account administrators and, for material changes, are also posted in the application.

17.8 No Partnership

Nothing in these Terms creates a partnership, joint venture, agency or employment relationship between the parties.