Terms of Service

Version 1.2.0 — Last updated: September 9, 2026

1. Acceptance of Terms

By accessing or using the Aqvori platform ("Service"), you agree to be bound by these Terms of Service. If you do not agree, do not use the Service.

Aqvori is a product of Pontos Platforms LLC, a limited liability company. Throughout these Terms, "Aqvori" or "the Service" refers to the platform itself, while "Company," "we," "us," and "our" refer to Pontos Platforms LLC as the legal entity providing the Service.

2. Description of Service

Aqvori is an AI-native consulting operations platform that provides client management, project tracking, document intelligence, workflow automation, meeting intelligence, compliance management, and related tools for client-facing professionals across industries. The Service includes an AI-powered assistant ("Vori") that assists with analysis, summarization, recommendations, document generation, and workflow automation.

3. Beta Disclaimer

The Service is under active development. Features may be added, modified, deprecated, or removed. Except as expressly stated in these Terms or in a separate written agreement between the Company and your organization, the Service is provided "as-is" and the Company does not warrant uninterrupted or error-free operation. Any feature expressly identified in the Service as a preview, beta, or experimental feature is provided without any guarantee of stability or continued availability.

4. Accounts and Registration

To use the Service, you must create an account with a valid work email address. You are responsible for maintaining the confidentiality of your credentials and for all activities under your account. You must notify us immediately of any unauthorized use. Personal email domains (e.g., Gmail, Yahoo, Outlook) cannot be used to create organizations but may be invited to existing ones.

5. Organizational Accounts

When creating an organization, the registrant becomes the organization owner ("Tenant Owner"). The Tenant Owner is responsible for managing their organization's users, data, and compliance settings. Each organization operates within a separate, isolated data environment.

6. Acceptable Use

You agree not to:

• Use the Service for any unlawful purpose or in violation of any applicable law
• Attempt to gain unauthorized access to other organizations' data or accounts
• Attempt to bypass, circumvent, or exploit tenant isolation boundaries
• Scrape, crawl, or programmatically extract data from the Service without written authorization
• Reverse engineer, decompile, or disassemble any part of the Service
• Upload malicious code, viruses, or harmful content
• Circumvent security measures, rate limits, or access controls
• Use the Service to store regulated data (e.g., PHI, PCI cardholder data) unless your compliance settings are appropriately configured
• Use AI features to generate content that is illegal, harmful, or violates third-party rights
• Resell or sublicense access to the Service without written authorization

7. Your Data

You retain ownership of all data you upload, create, or generate through the Service ("Your Data"). We do not sell Your Data or use it for purposes beyond providing the Service. We implement commercially reasonable security measures to protect Your Data.

8. Data Processing and Storage

Your Data is stored and processed within a multi-tenant architecture hosted in the United States (Oregon region). Each organization's data is logically isolated at the database query level, API middleware level, and session management level. Tenant isolation is enforced at the application query layer and by PostgreSQL row-level security. No security control is absolute. All data is transmitted over encrypted connections (TLS) and stored on managed PostgreSQL infrastructure with disk-level encryption at rest.

9. AI Usage Disclaimer

The Service includes AI-powered features branded as "Vori." Vori operates across two processing layers:

• Deterministic, rules-based processing operated by the Company on its own infrastructure (pattern matching and database queries) used for structured lookups and simple classification. This processing does not involve a machine-learning model, and Your Data processed this way stays within the Company's infrastructure and is not transmitted to any third-party AI provider.
• A third-party AI provider of your organization's choosing, used for higher-complexity reasoning tasks (summarization, drafting, analysis, recommendations, document generation). The Service supports several providers; your organization selects one and supplies its own API key under the Bring Your Own Key model described in Section 10. Your Data processed by that provider is transmitted to it and is subject to that provider's data handling and usage policies and your organization's separate agreement with it. The current list of supported AI providers is available in the Service under Organization Settings.

By using AI features, you acknowledge and agree to the following:

• All AI-generated content, including summaries, recommendations, action items, drafted documents, classifications, and analysis results, is advisory only and does not constitute professional, legal, financial, medical, or any other form of regulated advice
• You are solely responsible for reviewing, verifying, and approving all AI-generated outputs before relying on them or distributing them to third parties
• AI may produce inaccurate, incomplete, or misleading results; the Company makes no representations regarding the accuracy or reliability of AI outputs from either the local models or Claude
• The Company does not train any machine-learning model on Your Data
• The Company does not authorize any third-party AI provider to use Your Data for model training; the terms of your organization's own agreement with the provider it selects govern that provider's conduct
• The Company is not responsible for any decisions, actions, or consequences arising from reliance on AI-generated content
• The Company is not responsible for the availability, latency, accuracy, billing, or terms of any third-party AI provider whose API key you provide under BYOK

10. Bring Your Own Key (BYOK) — Required for AI Features

To use any AI feature that depends on a third-party AI provider, your organization must provide a valid API key for a supported provider. The Service does not provide a shared platform key as a fallback. The deterministic, rules-based features described in Section 9 remain available without any AI provider key.

• Your API key is encrypted using AES-256-GCM before storage and is never stored in plain text
• Your organization is solely responsible for all charges, usage limits, rate limits, suspensions, and fees incurred on its AI provider key by any use of the Service. The Company does not monitor, manage, or pay any portion of that billing
• Your organization is solely responsible for maintaining a valid agreement with its chosen AI provider and for confirming that provider's suitability for the data your organization submits
• You may revoke or rotate your API key at any time. While no valid provider key is configured, AI features that depend on a provider will be unavailable to your organization; the deterministic features in Section 9 remain available
• The Company is not liable for any disruption, data loss, or AI output gap resulting from your provider key being invalid, revoked, suspended, rate-limited, or out of credits

11. Confidential Information

The Secure Vault feature stores credentials and sensitive information with PIN-based encryption. You acknowledge that the security of vault contents depends on the strength of your PIN and access controls. We are not liable for unauthorized access resulting from weak or shared PINs.

12. Service Availability

We strive to maintain high availability but do not guarantee uninterrupted access. The Service may be temporarily unavailable due to maintenance, updates, or circumstances beyond our control. We will make reasonable efforts to provide advance notice of planned maintenance. During the beta period, unscheduled downtime may occur more frequently.

13. Termination

Where a customer has entered a separate written agreement with the Company, the term and termination provisions of that agreement control. Otherwise, either party may terminate the relationship at any time. You may request deletion of your account and associated data by contacting support@aqvori.com. Upon termination, we will delete Your Data within 30 days, except where retention is required by law or legitimate business purposes (e.g., audit logs).

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

• THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
• THE COMPANY DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT ANY AI-GENERATED CONTENT WILL BE ACCURATE OR RELIABLE.
• IN NO EVENT SHALL THE COMPANY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, BUSINESS OPPORTUNITIES, OR GOODWILL, ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE.
• THE COMPANY'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING FROM OR RELATED TO THE SERVICE SHALL NOT EXCEED THE AMOUNTS PAID BY YOU TO THE COMPANY IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED US DOLLARS ($100), WHICHEVER IS GREATER.
• SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES. IN SUCH JURISDICTIONS, THE LIMITATIONS ABOVE SHALL APPLY TO THE MAXIMUM EXTENT PERMITTED BY LAW.

15. Indemnification

You agree to indemnify, defend, and hold harmless Pontos Platforms LLC and its officers, directors, employees, and agents from any claims, damages, losses, liabilities, or expenses (including reasonable attorneys' fees) arising from your use of the Service, violation of these Terms, infringement of any third party's rights, or your reliance on AI-generated content.

16. Modifications

We may update these Terms at any time. Material changes will be communicated via the Service or email at least 15 days before they take effect. Continued use after changes take effect constitutes acceptance of the updated Terms.

17. Governing Law

These Terms are governed by the laws of the State of Florida, United States, without regard to conflict of law principles. Any disputes shall be resolved in the state or federal courts located in Pinellas County, Florida.

18. Protected Health Information and Other Regulated Data

The Service is not offered as a HIPAA-compliant service, and the Company does not currently offer a Business Associate Agreement. The Company makes no representation that the Service has been audited against the HIPAA Security Rule or is suitable for Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996.

• No PHI without a separate written agreement: You may not use the Service to upload, store, transmit, or process PHI unless the Company and your organization have executed a separate written agreement expressly permitting it. Doing so without such an agreement is a material breach of these Terms and may result in suspension.
• Determining your own status: Your organization is responsible for determining whether HIPAA, state health-privacy law, or any other regulatory regime applies to the data it submits, and for obtaining its own legal advice on that question. The Company does not make that determination for you and has made no representation about it.
• Sensitive data generally: The Service may be used to store sensitive personal information. Regardless of whether HIPAA applies, the Company's confidentiality and security obligations in these Terms and in any executed Data Processing Addendum apply to that information in full.
• Subprocessors: The Company uses Render (hosting and managed database), Resend (transactional email), Sentry (error monitoring), and, where your organization connects them, Google Workspace, Calendly, and Twilio. AI features use the third-party AI provider your organization selects and supplies a key for. The current subprocessor list for a customer organization is set out in that organization's Data Processing Addendum.
• Breach notification: If the Company becomes aware of a security incident affecting Your Data, the Company will notify the Tenant Owner without undue delay and in any event within seventy-two (72) hours of confirming a breach, or as otherwise specified in an executed agreement with your organization.
• Compliance settings: The Service includes compliance configuration at the Organization, Client, and Project levels. These are organizational tracking and configuration tools; enabling a framework in the Service is not a certification, an audit, or a representation of compliance by the Company.
• Audit logs: The Service maintains audit logs of staff access to your data. Retention is as specified in the Data Processing Addendum executed with your organization, and logs are available to you on request.

Where the Company and your organization have executed a separate written agreement addressing regulated data, that agreement controls over this Section as to the data it covers.

19. SMS / Text Messaging Program

If your organization enables SMS and you opt in, you agree to receive recurring transactional text messages (such as appointment reminders, case or status updates, document requests, and service-ready alerts) from or on behalf of your service provider through the Service. SMS is off by default and is sent only after you opt in.

• Consent: consent to receive text messages is not a condition of any purchase or service. You opt in expressly within the Service, and your consent is recorded with a timestamp.
• Frequency: message frequency varies based on your activity and your provider's configuration.
• Rates: message and data rates may apply and are charged by your mobile carrier. The Company and your service provider are not responsible for these charges.
• Opt out: reply STOP to any message to cancel. You will receive one confirmation message and then no further texts. For help, reply HELP or contact your service provider.
• Delivery: mobile carriers are not liable for delayed or undelivered messages. Your mobile information is handled as described in our Privacy Policy, which confirms that mobile opt-in and consent data are never shared with third parties or affiliates for marketing or promotional purposes.

20. Contact

For questions about these Terms, contact us at support@aqvori.com.