Master User Agreement (Terms, Privacy & NDA)

Preamble

This Master User Agreement ("Agreement") creates a binding legal contract between APP DEVELOPER STUDIO LIMITED (company number 13590871), a company incorporated under the laws of England and Wales ("Provider," "we," "us"), and the individual or entity accessing the Service ("User," "you").

Part 1: Terms of Service & Acceptable Use

1.1 Service Description

The Service consists of a web-based artificial intelligence platform comprising:

• Phase 1 (Ideation): An interactive chat interface where your conversation is processed through Provider-controlled infrastructure (our website and self-hosted ChatKit server on Google Cloud, UK region) and stored in our Supabase database so you can continue the session, before relevant text is sent to third-party Large Language Models (LLMs) to generate text, strategies, and concepts. Before you submit the PRD form below, your session is identified by a visitor cookie rather than an account. Session tokens are created server-side; your browser does not receive API keys or session JWTs. File attachments you upload may be stored in Supabase Storage via the ChatKit server.
• Phase 2 (Submission): A secure database facility allowing Users to format, finalize, and store their concepts on the Provider's CRM infrastructure (Supabase, UK-hosted).

1.2 The Nature of AI & Disclaimer of Warranties

The User acknowledges that the Service utilizes experimental Generative Artificial Intelligence technologies.

1. Accuracy Warning: The AI Output is generated based on probabilistic patterns and may contain factual errors, "hallucinations," or misleading information. The Provider does not warrant that the Output is accurate, complete, or current.
2. No Professional Advice: The Service does not provide legal, financial, medical, or other professional advice. The User uses the Output at their own risk and should verify all information independently.
3. Limitation of Liability: To the maximum extent permitted by law, the Provider shall not be liable for any direct, indirect, incidental, or consequential damages (including loss of profits or business opportunities) arising from the User's reliance on the AI Output.

1.3 Prohibited Uses and Anti-Reverse Engineering

To protect the integrity of the Service and the underlying AI models, the User agrees NOT to:

1. Reverse Engineer: Decompile, disassemble, decode, reproduce, or attempt to derive the source code, underlying algorithms, or trade secrets of the Service or the AI models.
2. Prompt Injection: Engage in "jailbreaking," "prompt injection," or any adversarial attacks designed to manipulate the AI into ignoring its safety guidelines or revealing its system instructions.
3. Automated Scraping: Use bots, scrapers, or automated tools to access the Service without express permission.

Part 2: Non-Disclosure Agreement (NDA) & Intellectual Property

2.1 Definition of Confidential Information

"Confidential Information" means all proprietary data disclosed by the User to the Provider through the Service, including:

1. User Inputs: The text prompts, business ideas, and context data entered during Phase 1.
2. User Outputs: The AI-generated strategies resulting from User Inputs.
3. Submission Data: The finalized concepts stored during Phase 2.

2.2 Obligations of the Provider

The Provider agrees:

1. Strict Confidence: To hold Confidential Information in strict confidence and not to disclose it to third parties, except to Authorized Sub-Processors (defined in Part 3) strictly required to operate the Service.
2. No Training Warranty: The Provider warrants that User Inputs processed via the OpenAI API are configured to opt-out of model training. Your data will not be used to improve OpenAI's foundational models. Chat traffic is routed through Provider-controlled servers before reaching OpenAI; the browser does not connect to OpenAI directly.
3. Security: To maintain industry-standard technical safeguards (encryption at rest and in transit) to protect Confidential Information.

2.3 Intellectual Property Rights

• Assignment to User: The Provider assigns to the User all right, title, and interest in the User Outputs generated by the Service.
• Ownership of Input: The User retains full ownership of all User Inputs.

Part 3: Privacy Policy (GDPR & International)

3.1 Scope and Controller

This policy applies to "Personal Data" as defined by the UK General Data Protection Regulation (UK GDPR).

• Data Controller: APP DEVELOPER STUDIO LIMITED (company number 13590871).
• Contact: admin@appdeveloperstudio.co.za.

3.2 Sub-Processors and International Transfers

Your data is processed in the UK and transferred to the following trusted sub-processors. We ensure all transfers are legally safeguarded.

Note on Supabase: While your data is physically stored on servers located in the United Kingdom, the legal entity controlling the infrastructure is Supabase, Inc. As they are not currently on the Data Privacy Framework list, we protect this transfer using the UK Addendum to EU Standard Contractual Clauses (SCCs).

Note on Google Cloud Platform: Our self-hosted ChatKit server runs on Google Cloud Run in the United Kingdom. It processes your conversation in order to generate responses and read from or write to our Supabase database; it does not itself keep a separate durable copy of your conversation.

3.3 Data Retention

• Ideation / chat data: Retained in our Supabase database (primarily UK-hosted) until you request erasure. Relevant text is transmitted to OpenAI's API for inference only; OpenAI does not use API data to train its models. Before you submit the PRD form, your session is identified by a visitor cookie rather than an account, so there is currently no self-serve deletion for this stage — email admin@appdeveloperstudio.co.za to request erasure.
• Uploaded documents: Attachments are stored in private Supabase Storage; text may be extracted server-side to inform the interview. Retained on the same basis as Ideation / chat data above.
• Submission Data: Retained in our secure CRM database until you delete your account from the ChatStack portal, or email admin@appdeveloperstudio.co.za to request erasure. Account deletion removes your portal profile, projects, and artifacts; it does not reach any earlier pre-submission chat session, which is erased separately on request as described above.
• Analytics: Aggregated and anonymized data is retained as per Google Analytics policies (consent-gated).

3.4 Cookies and Analytics

We use Google Analytics to monitor traffic.

• Consent Mode: We employ Google Consent Mode v2. No analytics cookies are written to your device unless you explicitly click "Accept" on our banner.
• Opt-Out: You may opt out at any time via the "Cookie Settings" link in the footer.

Part 4: General Provisions

4.1 Governing Law

This Agreement is governed by the laws of England and Wales. Any dispute shall be subject to the exclusive jurisdiction of the courts of London, UK.

4.2 Entire Agreement

This document constitutes the entire agreement between the parties and supersedes all prior understandings.