Terms of Service — Kolaboreyt

These terms govern your use of Kolaboreyt — the web application, the API, the AI features, and the integrations. Please read them; they set out what you can expect from us and what we expect from you.

In short

Your content stays yours. You give us only the permission needed to store, display, and process it so the service works for you and the people you share it with.
Use the service for legitimate work. Do not attack it, do not try to reach other tenants’ data, and do not upload things you have no right to upload.
AI output can be wrong. Check it before you rely on it, and remember the assistant acts with your permissions — you are responsible for what it does on your behalf.
The service is currently provided at no charge. We will give notice before that changes.
Security researchers are welcome, within the boundaries set out in section 6.

The agreement

These Terms of Service form a binding agreement between you and Kolaboreyt(“we”, “us”) governing your access to and use of Kolaboreyt (the “Service”), including app.kolaboreyt.com, the API at api.kolaboreyt.com, and any related documentation and clients.

You accept these terms by creating an account, by accepting an invitation, or by using the Service. If you accept them on behalf of an organisation, you confirm you have authority to bind that organisation, and “you” means that organisation.

Our Privacy Policy is part of this agreement and describes how we handle personal information. Where a separate written agreement or data-processing agreement exists between us and your organisation, that agreement governs any conflict with these terms.

Eligibility and your account

Age. You must be at least 16, or the higher age of digital consent where you live, and legally able to enter into this agreement.
Accurate details. Register with a real email address you control and keep your account details current. We require email verification before an account becomes usable, and one email address corresponds to one identity.
Credentials. Passwords must be at least 12 characters and include upper case, lower case, a digit, and a symbol. Keep your password and API keys secret, do not share your account, and do not let anyone else use your credentials.
Tell us about compromise. If you believe your account, a session, or an API key has been compromised, change your password — which revokes every existing session — and notify us at security@kolaboreyt.com.
Responsibility. You are responsible for activity under your account and under any API key or service account issued to you, except to the extent it results from our breach of this agreement.

Accounts, workspaces, and administrators

The Service is organised into accounts. An account owns its workspaces, boards, items, documents, and files, and controls who may reach them through roles, memberships, and permission grants. Data is isolated per account and is not shared across accounts.

If you use the Service through an organisation’s account — your employer, a client, or anyone who invited you — you should understand and accept that:

that organisation, not you, controls the workspace content created in its account, and its administrators can view, modify, export, and delete it;
administrators can change your role, restrict your access, remove you from the account, and delete your identity within it;
administrators can see the account’s activity log, which records who did what and when; and
administrators can set account policies — including permitted email domains for invitations, whether guests may be invited, whether new memberships need approval, and restrictions on API credentials.

Guests are external collaborators with access limited to the specific boards they were invited to. Invite guests only where you are entitled to disclose the content of those boards to them.

Your content

You keep ownership. Everything you put into the Service — items, cell values, documents, comments, files, templates, automations, and forms (“Your Content”) — remains yours. We claim no ownership of it.

The permission you give us. You grant us a worldwide, non-exclusive, royalty-free licence to host, store, copy, transmit, display, and process Your Content, and to make derivative technical copies such as backups, search indexes, thumbnails, and cached renderings, strictly for the purpose of operating, securing, and supporting the Service for you and the people you share it with. This licence exists only so the Service can function; it ends when Your Content is deleted, subject to the backup window described in our Privacy Policy. We do not use Your Content to train machine-learning models.

Your responsibility for it. You represent that you have the rights needed to upload Your Content and to let us process it as described, and that doing so does not infringe anyone’s rights or breach any law or duty of confidence. If Your Content includes personal information about other people, you are responsible for having a lawful basis to collect and share it — this applies in particular to public forms, where anyone with the link can submit information into your board.

Keep your own copies. We take and verify regular backups, but they exist for our disaster recovery, not as a substitute for your own records. Keep independent copies of anything you cannot afford to lose.

Acceptable use

You agree not to, and not to allow anyone else to:

Attack, probe, or circumvent

access or attempt to access any account, workspace, board, document, or file you have not been granted access to, or attempt to defeat the Service’s tenant isolation or permission checks;
probe, scan, or test the vulnerability of the Service or its infrastructure except as expressly permitted in section 6;
circumvent or attempt to circumvent rate limits, upload size limits, board capacity limits, authentication, session handling, or any other technical control;
interfere with the Service’s operation, including through denial-of-service traffic, resource exhaustion, or deliberately abusive automation;
reverse engineer, decompile, or disassemble the Service except where that restriction is unenforceable under applicable law;
use the Service to attack, scan, or send unsolicited bulk messages to any third party.

Content and conduct

upload or transmit malware, exploit code intended for unauthorised use, or content that is unlawful, infringing, defamatory, harassing, or sexually exploitative of minors;
impersonate any person or misrepresent your affiliation, including by inviting people under a false identity;
use the Service in violation of export controls, sanctions, or any other applicable law;
upload regulated data — such as payment card data, government identity numbers, or protected health information — unless you have a separate written agreement with us that covers it. The Service is not designed or certified for those categories.

Automated access and resale

scrape or bulk-extract data other than through the documented API, within its published rate limits and versioning rules;
share, sell, publish, or embed an API key or session token, or use one on behalf of a principal it was not issued to;
resell, sublicense, or provide the Service to third parties as your own service, unless we have agreed to it in writing.

Security research and disclosure

We welcome good-faith security research and will not pursue legal action against a researcher who follows the boundaries below. This section is the only authorisation for security testing of the Service.

Authorised, if you keep within all of these: test only against accounts and data you own or have explicit written permission to test; stop at proof of a vulnerability rather than pivoting further; do not access, modify, exfiltrate, or retain another user’s data; do not degrade the Service for others; and report what you find to security@kolaboreyt.com with enough detail to reproduce it, then give us a reasonable opportunity to remediate before any public disclosure.

Never authorised: denial-of-service or load testing; social engineering, phishing, or physical attacks against us, our users, or our providers; attacks against our third-party providers’ own systems; automated scanning that generates disruptive traffic; and any access to another tenant’s content.

We do not currently operate a paid bug bounty. We will acknowledge reports and credit researchers who ask to be credited.

AI features

The Service includes AI features: an assistant, AI-computed board columns, and generated summaries and briefings. By using them you accept the following.

Output can be wrong. Generated text may be inaccurate, incomplete, outdated, or misleading, and may be presented confidently regardless. Review AI output before relying on it or acting on it.
Not professional advice. AI output is not legal, medical, financial, tax, or other professional advice, and must not be used as a substitute for a qualified professional.
The assistant acts as you. When you ask it to change something, it acts under your own permissions and its actions are recorded against your identity in the activity log. You are responsible for the changes it makes on your instruction, exactly as if you had made them yourself.
Choosing a provider has consequences. By default, inference runs on infrastructure we operate. If you explicitly select a third-party model provider, the prompt and the board context accompanying it are transmitted to that provider and handled under their terms.
Conversations are not saved. Interactive AI transcripts exist only in your browser tab and are lost on refresh, reset, or sign-out. Neither you nor we can recover them. Copy anything you want to keep.
Output is not guaranteed to be unique. Other users may receive similar or identical output from similar prompts.
Fair use. AI features consume significant compute. We may apply quotas, queue requests, restrict specific providers, or change or withdraw AI features.

The API, keys, and service accounts

Keys are shown once. An API key’s plaintext value is displayed at creation and never again — we store only a hash. Treat a key like a password; if one leaks, revoke it immediately.
Key scope is real. A key carries the scopes and, for personal keys, the permissions of the person who owns it. Issue the narrowest scope that works, and set an expiry. An administrator may require expiries, forbid write scopes on personal keys, and require an IP allowlist on service-account keys.
Service accounts are non-human principals for integrations. They must have an accountable owner, and they do not depend on any individual’s employment or session.
Rate limits and idempotency. API traffic is rate-limited and responses carry the relevant limit headers. Use idempotency keys for writes so retries do not duplicate data. Do not engineer around limits by rotating keys or addresses.
Versioning. Requests carry an API version. When we deprecate a version we signal it with a sunset header and endeavour to give reasonable notice before removal.
Revocation. We may revoke a key that is leaked, abused, or used in breach of these terms, and we may do so without notice where there is an active risk.

Third-party services and integrations

You may connect third-party services, such as signing in with Google or linking a GitHub organisation. Those services are operated by their providers under their own terms and privacy policies. Connecting one authorises the exchange of data described at the point of connection and in our Privacy Policy.

We are not responsible for third-party services, and a change, outage, or discontinuation on their side may affect the corresponding feature here. You may disconnect an integration at any time.

Fees and plan limits

The Service is currently provided at no charge. We do not take payments and do not store payment card details. If we introduce paid plans, we will give notice before any charge applies to you, and continued use after a paid plan begins will require your agreement to the applicable pricing terms.

Usage limits apply regardless of price. The limits enforced today include:

Limit	Value
Maximum size of a single uploaded file	50 MiB
Items per board	10,000 (higher on enterprise entitlements)
Rate limits	Applied to sign-in, sign-up, password reset, verification email, public form submission, and API traffic

We may adjust these limits. Where a change would reduce a limit you are already relying on, we will give reasonable notice.

Availability, changes, and early features

We work to keep the Service available and monitor it continuously, but we do not currently offer a service-level agreement or an uptime commitment. The Service may be unavailable for maintenance, upgrades, provider outages, or events outside our control.

We improve the Service continuously and may add, change, or remove features. Some features are explicitly early or experimental; they may change substantially or be withdrawn. We will not remove a feature that a material part of your workflow depends on without reasonable notice where it is practical to give it.

Suspension and termination

By you. You may stop using the Service at any time. To delete your identity or an account, contact your account administrator or write to privacy@kolaboreyt.com. Section 13 of our Privacy Policy describes exactly what deletion does and what is retained.

By an administrator. An account administrator may deactivate or remove your access to that account at any time.

By us. We may suspend or terminate access where you materially breach these terms, where your use poses a security risk to the Service or to other users, or where we are legally required to. Except where an active risk requires immediate action, we will give notice and, where the breach can be cured, a reasonable opportunity to cure it.

Effect. On termination, your right to use the Service ends. Provisions that by their nature should survive — content ownership, disclaimers, limitation of liability, indemnification, and governing law — survive. Backups continue to hold data for the window described in the Privacy Policy.

Our intellectual property and your feedback

The Service, its software, design, and the Kolaboreyt name and marks are ours or our licensors’. These terms grant you a limited, non-exclusive, non-transferable, revocable right to use the Service in accordance with them, and nothing more. All rights not expressly granted are reserved.

If you send us feedback, ideas, or suggestions, we may use them without restriction or obligation to you. This does not give us any rights in Your Content.

Copyright complaints

If you believe content on the Service infringes your copyright, send a notice to legal@kolaboreyt.com identifying the copyrighted work, the material you say infringes it and where to find it, your contact details, a statement of good-faith belief that the use is unauthorised, and a statement — made under penalty of perjury where that applies — that your notice is accurate and that you are authorised to act for the rights holder.

We will review valid notices and may remove content or suspend accounts in response. Submitting a knowingly false notice may make you liable for damages.

Disclaimers

To the fullest extent permitted by law, the Service is provided “as is” and “as available”, without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade.

We do not warrant that the Service will be uninterrupted, error-free, or secure against every threat, that defects will be corrected, or that AI output will be accurate or fit for any purpose. We describe our security measures honestly, including their current limits, in our Privacy Policy — and no set of measures makes any system perfectly secure.

Some jurisdictions do not allow the exclusion of certain warranties, so parts of this section may not apply to you, and nothing here limits rights that cannot lawfully be limited.

Limitation of liability

To the fullest extent permitted by law, neither we nor our suppliers will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for loss of profits, revenue, goodwill, business, or data, or for the cost of substitute services, however caused and on any theory of liability, even if we have been advised of the possibility of such damages.

To the fullest extent permitted by law, our total aggregate liability arising out of or relating to this agreement or the Service will not exceed the greater of (a) the total amounts you paid us for the Service in the twelve months before the event giving rise to the claim, or (b) one hundred US dollars (USD 100). You acknowledge that where the Service is provided at no charge, this limit reflects the allocation of risk that makes it possible to offer it that way.

Nothing in this section excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited. Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you.

Indemnification

You will defend, indemnify, and hold us harmless from any third-party claim, and any resulting loss, liability, damage, cost, or reasonable legal fee, arising out of Your Content, your use of the Service, or your breach of these terms or of any applicable law — except to the extent the claim arises from our own breach or negligence. We will notify you promptly of any such claim and give you reasonable cooperation in defending it; you will not settle a claim in a way that imposes an obligation on us without our written consent.

Governing law and disputes

Nothing in this agreement deprives you of the protection of the mandatory consumer-protection rules of the country in which you are resident, or of your right to bring proceedings before the courts of that country.

Before starting formal proceedings, please contact us at legal@kolaboreyt.com. Most disputes can be resolved that way, and we commit to engaging in good faith.

Changes to these terms

We may update these terms. The version number and dates at the top of this page always show the current text. For material changes we will give notice in the application or by email before they take effect. Continuing to use the Service after that date means you accept the updated terms; if you do not accept them, stop using the Service and ask us to delete your identity.

General terms

Entire agreement. These terms and the Privacy Policy, together with any separate written agreement between us, are the entire agreement about the Service and supersede prior discussions about it.
Severability. If a provision is held unenforceable, it is modified to the minimum extent needed to be enforceable, or severed, and the rest remains in force.
No waiver. Not enforcing a provision on one occasion does not waive it.
Assignment. You may not assign this agreement without our written consent. We may assign it in connection with a merger, acquisition, or sale of assets, on notice.
Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control.
Notices. We may give notice by email to the address on your account or in the application. Send legal notices to legal@kolaboreyt.com.
Relationship. Nothing here creates a partnership, joint venture, agency, or employment relationship between us.

Contact

General and legal: legal@kolaboreyt.com
Privacy: privacy@kolaboreyt.com
Security: security@kolaboreyt.com