Terms of Service

1. Cofleet and this agreement

Cofleet AB, company registration number 559594-0965, Finn Malmgrens väg 52, 121 38 Johanneshov, Sweden (Cofleet, we or us), provides the hosted Cofleet service. Contact markus@cofleet.app about these Terms.

The Customer is the business organisation identified in the workspace onboarding and acceptance record. These Terms, the corresponding DPA and any expressly agreed Pilot Details form the Agreement. A person authorised to bind the Customer accepts the Agreement through Cofleet's sign-in or onboarding action with the acceptance wording and documents made available beforehand, or through another agreed written acceptance method. The Agreement begins when that acceptance is completed and recorded. An invitation, Google authentication consent, viewing a legal page or simply opening the app does not by itself establish company-authorised acceptance. Invited users join under their organisation's existing Agreement and do not enter a new DPA for it.

A separately accepted agreement for the same workspace takes priority for its duration. For personal-data matters, mandatory transfer clauses take priority, then the DPA. Expressly agreed Pilot Details govern commercial scope, followed by these Terms. A Privacy Policy explains processing and rights; linking it does not turn it into blanket consent to processing. Purchase orders and customer portals add no terms unless Cofleet expressly agrees to them in writing.

2. Service and accounts

Cofleet organises selected company knowledge and memory for authorised people and connected AI tools. The Service includes the hosted web and desktop applications, selected-source imports, quick-save capture, shared memory, questions and answers, and enabled API or MCP access. Customer Content means information supplied to the Service by or for the Customer, including selected source content, captures, prompts and associated outputs and derived records. It excludes feedback only to the limited extent explained in section 6.

During the agreed service period, the Customer and its authorised users may use the Service, included software and documentation for the Customer's internal business purposes, within any limits disclosed and agreed before acceptance. No other licence or ownership right is granted. Affiliates need their own agreement or express inclusion in the Customer's agreed scope.

The Customer is responsible for its users, lawful source selections, account details and permissions. Users must protect credentials, use only authorised accounts and promptly report suspected compromise. The Customer must keep its legal identity, administrator and notice address current. A connector does not authorise an entire account or all files in an organisation; access follows the selected scope. Cofleet does not promise continuous replication of permissions from every source system.

3. Pilot, pricing and cancellation

The free pilot lasts 30 consecutive calendar days from Cofleet's confirmation that the workspace is ready for the agreed use, unless accepted Pilot Details expressly state another start rule. Setup delays do not consume the pilot. The pilot costs EUR 0. The selected use case, users and sources are recorded during onboarding; any usage limits must be disclosed before acceptance.

The pilot does not automatically renew or convert to paid service. Paid continuation requires a separate explicit agreement to EUR 100 per month, excluding applicable VAT, and an agreed paid-service start date. Paid service then renews monthly until cancelled. Ordinary sign-in and acceptance of these Terms do not authorise paid continuation.

Cofleet invoices after each paid monthly period. Invoices are payable within 30 days. There is no automatic collection from a payment method and no undisclosed usage charge or additional implementation fee. Additional charges require prior express agreement. The Customer pays applicable taxes itemised on the invoice, excluding taxes on Cofleet's income. Notify Cofleet of a good-faith invoice dispute before payment is due, pay undisputed amounts on time, and cooperate to seek resolution within 15 days. Unresolved disputes retain the parties' lawful remedies.

Either party may cancel paid renewal by email before the next monthly period begins; service and fees continue through the current period. The Customer sends cancellation to markus@cofleet.app. Cofleet sends it to the Customer's designated notice address. Either party may end the free pilot earlier by email without fees. Cancellation, source disconnection and account closure are distinct actions; return and deletion follow section 12 and the DPA.

4. Support

Cofleet provides reasonable setup help for the first selected knowledge source and support by email or an agreed shared Slack channel during the service period. No response-time guarantee, service level or bespoke agent implementation is included.

Support messages and screenshots may contain Customer Content and personal data. They receive the applicable confidentiality, purpose and deletion protections; sending them to support does not grant a broader analytics or training licence. Share only what is needed to explain the issue and avoid credentials and prohibited data. Cofleet's engaged support providers and processing arrangements are identified in the DPA. In Slack Connect, each organisation may control its own messages and copies; Cofleet's deletion obligations cover the data it processes and controls, and it will coordinate where customer action is necessary.

5. Customer content and intellectual property

The Customer retains its rights in Customer Content. It authorises Cofleet to receive, copy, organise, transform, store and display that content only as needed to deliver, secure and support the agreed Service and carry out documented customer instructions, subject to the DPA. This includes generation, embeddings, memory and retrieval for the Customer. It does not authorise publishing confidential content, advertising use, selling personal data or using source content to improve a shared model.

The Customer must have the necessary rights and lawful basis to provide content, authorise connected tools and instruct processing. It remains responsible for the accuracy and lawful use of content. Cofleet retains its rights in its software, documentation and Service. Neither party obtains the other's rights except the limited permissions stated in this Agreement. Cofleet needs prior written permission to use the Customer's name or logo publicly.

6. Limited usage information and feedback

Cofleet may use only the product events, identifiers, fixed categories, counts, timings and AI-call/cost metadata described in DPA Annex III to operate and secure the Service, diagnose reliability, understand use and operating costs, improve its own Service across customers, and provide customer usage/cost information where offered. Customer source text, prompts, outputs, memory content, names, email addresses, URLs, window titles and raw error payloads must not enter that analytics stream. The DPA and Privacy Policy distinguish the purposes and roles; those labels do not remove the field limits, retention limits or protections.

There is no optional product-analytics opt-out at launch. This does not restrict any statutory right to object, request erasure or exercise other data-protection rights. Cofleet must assess such requests under applicable law and cannot rely on these Terms as a substitute for a lawful basis.

The Customer may voluntarily provide suggestions it is entitled to share. Cofleet may use those suggestions to improve the Service without payment. This permission excludes Customer Content, personal data and confidential information contained in a support report or screenshot; those remain protected. Feedback is provided without a warranty from the Customer. Survival of this section does not extend personal-data retention or the permitted purposes.

7. AI features

Cofleet will not use Customer Content or personal-data-bearing usage information to train general-purpose or shared AI models, or authorise providers to do so. Generation and embeddings needed to deliver the agreed Service remain permitted under the DPA. The DPA separately explains provider abuse monitoring; this is not permission for model training. Removing obvious identifiers does not by itself make content anonymous.

AI output can be inaccurate, incomplete or unsuitable and requires human review. It is not a substitute for professional judgment. The Customer must not use the Service in safety-critical activities where failure could reasonably lead to death, serious injury or severe environmental harm. Cofleet does not undertake to make solely automated decisions about people with legal or similarly significant effects.

8. Acceptable use and security research

The Customer and its users must not access another person's data without authority, bypass permissions, distribute malicious software, disrupt or overload the Service, misrepresent identity, infringe another person's rights or use the Service unlawfully. They must not resell or sublicense access, remove proprietary notices, copy or modify Cofleet software beyond the permitted use, reverse engineer it except where law protects that right, or use the Service to develop a competing service. They must observe agreed usage limits and applicable documentation.

The hosted pilot excludes GDPR special-category data, criminal-offence data, national identification numbers, payment-card credentials and other highly sensitive regulated data. Adding these requires a separate written agreement and appropriate safeguards. If such data is inadvertently submitted, promptly contact Cofleet to arrange restricted handling and removal; an accidental submission does not expand the authorised scope.

Good-faith vulnerability research confined to the researcher's own authorised workspace is permitted where it does not access other customers' data, disrupt the Service or harm others. Report findings to markus@cofleet.app, minimise any data encountered and allow reasonable time for remediation. Cofleet will not pursue a person for research complying with these conditions. Research outside this boundary requires prior written authorisation. This permission does not authorise access to a third party's systems.

9. Privacy and confidentiality

The corresponding Cofleet DPA forms part of these Terms when Cofleet processes personal data for the Customer. Both documents must be accessible before acceptance. No separate signature is required when validly incorporated and electronically accepted. A separately agreed DPA for the same processing takes priority.

Confidential Information is non-public information disclosed by either party in connection with the Agreement that is identified as confidential or should reasonably be understood to be confidential, including Customer Content, security information and non-public commercial terms. The receiving party may use it only to perform this Agreement or exercise its rights, must protect it with reasonable care and at least the care used for its own similar information, and may disclose it only to people who need it and are bound by appropriate confidentiality duties. Each party remains responsible for its recipients.

Confidentiality does not cover information the recipient can show was already lawfully known without restriction, independently developed without use of the confidential information, received lawfully from an authorised third party without restriction, or made public without a breach. Legally compelled disclosure must be limited to what is required; where permitted, give advance notice and reasonable assistance to seek protection. These exceptions do not remove independent data-protection duties. Return, deletion and permitted residual retention follow the DPA for personal data and the same restricted treatment for other Customer Content.

10. Warranties and liability

Each party confirms it has authority to enter and perform the Agreement and will comply with applicable law. Cofleet will not materially reduce the Service's general functionality during the agreed service period. The Customer must notify Cofleet of a breach of that functionality commitment within 45 days of discovering it and provide sufficient detail. Cofleet has 45 days after receiving that detail to attempt restoration. If it cannot restore the functionality, the Customer may terminate the affected service and receive a proportionate refund of prepaid unused fees. This is the exclusive contractual remedy for that functionality warranty, without limiting mandatory rights or the DPA.

Except for express commitments in the Agreement and rights that cannot lawfully be excluded, the Service is provided as available without additional implied warranties, including fitness for a particular purpose, merchantability, title or non-infringement. Cofleet does not guarantee uninterrupted or error-free operation or accurate AI outputs. The functionality warranty does not cover misuse, unauthorised modifications or third-party products. A separately identified experimental beta feature may change or be removed and is supplied without the functionality warranty; identifying a feature as beta does not remove data-protection, confidentiality or deletion obligations.

Each party's total cumulative liability under or in connection with the Agreement is limited to the higher of EUR 1,000 or the fees paid or payable by the Customer under the Agreement in the 12 months before the claim, excluding VAT. Neither party is liable to the other for lost profits or revenues or consequential, special, indirect, exemplary, punitive or incidental damages, except that this damages exclusion does not apply to breach of confidentiality. These limits apply regardless of the legal basis of a claim.

Neither the cap nor exclusions limit fraud, wilful misconduct, gross negligence or liability that cannot lawfully be limited. Nothing restricts individuals' data-protection rights, supervisory authorities' powers or liability protected by applicable transfer clauses. No separate increased-liability category applies.

11. Third-party claims

Cofleet will defend and indemnify the Customer against third-party claims that authorised use of the Service infringes intellectual-property rights, including resulting awards, agreed settlements and reasonable defence costs. This does not cover claims caused by unauthorised modifications or use, modifications made to the Customer's instructions, combinations with items not provided by Cofleet, or continued use of an old version when an available newer version would avoid the claim.

The Customer will defend and indemnify Cofleet against third-party claims arising from infringing Customer Content or breach of the restrictions in section 8, including resulting awards, agreed settlements and reasonable defence costs. This does not cover claims caused by Cofleet's unauthorised use of Customer Content.

The protected party must promptly notify the other, give reasonable assistance at the defending party's expense and allow that party to control the defence. It may participate through its own counsel at its expense. No settlement may admit fault for, or impose material adverse obligations on, the protected party without its prior written consent. For an infringement claim, Cofleet may obtain continued-use rights, modify or replace the affected part without materially reducing general functionality, or, if neither is reasonable, terminate it and refund prepaid unused fees. This section and the related termination right are the parties' exclusive contractual remedies for the covered third-party claims, subject to section 10's mandatory-rights exceptions.

12. Suspension, termination and deletion

Cofleet may suspend affected access for an undisputed payment more than 30 days overdue, a breach of section 8 or use that materially harms the Service or others. It will try to give advance notice where practical and restore access when the issue is resolved. Suspension does not erase deletion or mandatory assistance duties.

Either party may terminate for a material breach not cured within 30 days of written notice, an incurable material breach, dissolution or cessation without a successor, assignment for creditors, or insolvency proceedings continuing more than 60 days. If an unforeseen event beyond reasonable control prevents material operation for at least 30 consecutive days despite reasonable mitigation, either party may terminate affected service and Cofleet will refund prepaid unused fees. Such events do not excuse accrued payments or obligations that remain mandatory under law.

Ordinary access ends when the service ends. The Customer may request account closure and return or deletion by emailing markus@cofleet.app; workspace closure is handled on request, not through a self-service workspace-deletion control. At the Customer's choice, Cofleet will securely return the personal data and delete remaining copies, or delete it, under the DPA. Active Customer Content and associated personal records, including Cofleet-controlled customer support history, must be removed within 30 days after account closure. The DPA separately governs operational logs, restricted backups, provider residual copies and legally required retention. Cofleet must not recreate deleted content through retries, reimports or restoration.

Accrued fees, limited intellectual-property rights, confidentiality, lawful residual-data protection, liability, claims, governing law and provisions necessary to enforce or conclude the Agreement survive only to the extent relevant to their purpose. No general retention policy or surviving analytics licence overrides the DPA. There is no separate one-year minimum framework term after the agreed service ends.

13. Changes, notices and general terms

A new public agreement version applies to the Customer only when expressly accepted by an authorised representative. Publication or continued use alone does not amend an accepted Agreement. Material changes to personal-data processing follow the DPA and applicable notice and consent requirements. The subprocessor change procedure is in the DPA.

Legal notices must be in writing to markus@cofleet.app for Cofleet and the designated administrator's notice address in the Customer's record. Email notices take effect on confirmed delivery. These rules do not reduce required advance notice or statutory rights.

Swedish law governs the Agreement, with Swedish ordinary courts and Stockholm District Court as the first instance, without displacing mandatory law. A party may seek urgent protective relief for confidentiality or intellectual-property violations from a competent court. Unless an exclusive remedy is expressly stated, remedies are cumulative. An unenforceable provision does not invalidate the remainder, and failure to enforce a provision is not a waiver.

Neither party may transfer the Agreement without the other's written consent, except on notice in a merger, reorganisation, change of control or transfer of substantially all the relevant business or assets, subject to data-protection law and existing confidentiality duties. The parties are independent contractors; neither may bind the other. There are no third-party contractual beneficiaries except rights required by data-protection law or applicable transfer clauses. Each party must comply with applicable sanctions, export-control and anti-bribery law. Electronic acceptance and counterparts are permitted. The UN Convention on Contracts for the International Sale of Goods does not apply.

Drafting attribution

This standalone revision adapts Cofleet's version 1.2 and provisions of Common Paper Cloud Service Agreement Standard Terms 2.1, licensed under CC BY 4.0: https://commonpaper.com/standards/cloud-service-agreement/2.1/ and https://creativecommons.org/licenses/by/4.0/. It rewrites and consolidates those provisions, with Cofleet-specific acceptance, commercial, content/analytics, AI, support, audit/testing and lifecycle terms. The Common Paper standard terms are not incorporated into this version. Scape was used as a structural reference; its text and operational claims were not adopted.