Terms and Conditions.

1. Scope

These General Terms and Conditions ("Terms") apply to all services provided by Nextaim GmbH, Steinerstraße 15, 81369 München ("Supplier") under the brand "Noirdoc" — in particular the Noirdoc gateway — to businesses, self-employed persons and legal entities under public law ("Customer"). They do not apply to consumers within the meaning of § 13 BGB (German Civil Code).

Deviating terms and conditions of the Customer are not recognised unless expressly agreed to in writing.

2. Description of services

Under the brand "Noirdoc", the Supplier makes available an OpenAI-compatible API gateway (endpoint https://api.noirdoc.de/v1) through which the Customer can send requests to AI language models. The services include in particular:

• Access to managed models ("Managed Models")AI models from various Model Developers that the Supplier makes available via infrastructure providers ("Providers") with processing in the EU. The Customer does not need its own account with a Provider for this.
• Use of the Customer's own provider keys ("BYOK")The Customer can store its own keys for external Providers; requests are then executed via the Customer's respective Provider. A stored BYOK key takes precedence over Managed Models.
• Routing, control and governancemanagement of API keys with budget, provider and model restrictions, and audit logs.
• Optional pseudonymisation ("Masking")a feature that can be switched on (see § 7).

The models, Model Developers, Providers and prices currently available are shown in the model and price overview; this overview or the individually agreed offer is authoritative. The Supplier is entitled to develop the range of models and Providers further, and to add, replace or — in particular where they are discontinued by the respective Model Developer or Provider — phase out individual models; material changes are announced with reasonable advance notice.

3. Conclusion of contract and access

The contract is concluded by registration in the portal (portal.noirdoc.de) with acceptance of these Terms or by acceptance of an individual offer from the Supplier. Access credentials and API keys must be treated as strictly confidential and protected against unauthorised access. The Customer is liable for all acts performed under its access credentials.

4. Remuneration

The remuneration is determined by the individually agreed offer. Unless otherwise agreed, the following applies:

• When Managed Models are used, billing is usage-based according to the price overview valid at the time of the request (e.g. per token, per image or per audio minute). If the Providers change their prices, the Supplier is entitled to pass this change on with effect for future use.
• All prices are exclusive of statutory VAT.
• In the case of usage-based billing, the measurement kept by the Supplier is binding unless the Customer objects in writing within 30 days.
• Pilot or test deployments may be provided free of charge if expressly agreed.

Prepaid credit. Unless billing by invoice has been agreed, the Customer pays for usage in advance through credit per organisation (the Customer's own tenant in the portal):

• The Supplier continuously debits usage from the credit of the respective organisation.
• New organisations may receive a one-off starter credit without any entitlement to payout. The Supplier may change or discontinue the amount and availability of the starter credit at any time.
• The Customer tops up the credit in the portal. The payment is processed by the payment service provider Mollie B.V., currently by credit card or bank transfer. Minimum and maximum amounts and the available payment methods are shown in the portal before each top-up. The credit is booked after receipt of payment; the Customer receives an invoice for each top-up.
• If a payment is charged back or refunded, the Supplier reverses the corresponding credit.
• The Supplier is entitled to let the credit of an organisation expire if neither requests nor top-ups have been made through that organisation for 365 days. Expired credit is not refunded.
• Once the credit has been used up, the Supplier is entitled to reject further requests from the Customer; this does not put the Supplier in default.
• If usage in an individual case exceeds the available credit (e.g. for requests in progress), the difference is offset against the next top-up; otherwise it is payable on demand and at the latest at the end of the contract.
• On termination of the contract, the Supplier refunds credit that was acquired against payment and has been neither used nor expired; the starter credit is excluded from refund. For offsetting purposes, the starter credit is deemed to be used first.

Billing by invoice. If billing by invoice has been agreed, invoices are payable without deduction within 14 days of receipt.

5. Permitted use

The Customer uses the gateway exclusively for its own business purposes and in compliance with applicable law. In particular, use is prohibited

• for generating or distributing unlawful, infringing, harmful to minors or harmful content;
• for circumventing security, usage or billing restrictions;
• for applications, websites or services that are aimed at persons under 18 years of age or are recognisably used by them;
• for clinical purposes, in particular as a substitute for medical advice, diagnosis or treatment, or as a medical device requiring approval;
• for training or developing AI models that compete with the respective model or with offerings of its Model Developer, including by using outputs;
• for reverse engineering, extracting or replicating the models or their components;
• for reselling or passing on access to the gateway or to the models to third parties as a stand-alone service without the Supplier's prior consent in text form (integration into the Customer's own applications remains permitted);
• from countries or regions that the Model Developer of the respective model does not support under its terms (§ 6);
• in a manner that violates the usage policies or licence terms of the Model Developers and Providers (§ 6).

Obligations in the Customer's applications. Where the Customer uses the models in its own applications used by third parties, the following applies:

• Chatbots and agents that communicate with persons outside the Customer disclose that the users are interacting with an AI system. The Model Developer or model need not be named in doing so.
• The Customer provides a means by which users can report misuse or problematic outputs.
• The Customer informs its users that outputs may be inaccurate and must be checked before use.
• The Customer binds the users of its applications to the prohibitions of this § 5 and the terms under § 6.

The Customer is responsible for all content transmitted and all outputs generated via its keys. In the event of a justified suspicion of misuse, a threat to operations or at the request of a Model Developer or Provider, the Supplier may temporarily block individual keys, models or access; the Customer will be informed of this where possible and legally permissible.

6. Third-party models and BYOK

The models available through the gateway are developed by third parties ("Model Developers") and made available via Providers (§ 2); which these are for a given model is shown in the model and price overview. In addition to these Terms, the usage policies and licence terms of the Model Developer and the Provider of the respective model apply in their current version; the Customer complies with them.

• Managed Models. The Supplier contracts with the respective Providers and makes their services available in its own name. Conditions, availability and functionality are governed by the requirements of the Providers and may change.
• BYOK. Where the Customer uses its own provider keys, the model service is provided directly between the Customer and the respective Provider; the Customer is itself responsible for its contract with that Provider, that Provider's costs and the admissibility of the processing under data protection law. To that extent, the Supplier merely forwards the requests.

If a Model Developer or Provider blocks, throttles or discontinues a service, the Supplier is entitled to pass this on to the Customer accordingly; liability for this exists only within the scope of § 13.

7. AI output, accuracy and pseudonymisation

Automated output. Language models generate outputs probabilistically. The Supplier gives no warranty for the correctness, completeness, timeliness or suitability of the outputs generated via the gateway; outputs may be inaccurate or fabricated ("hallucinations"). The outputs do not constitute legal, tax, medical or other professional advice. The Customer is obliged to check outputs on its own responsibility before any use, disclosure or publication and to ensure appropriate human oversight. This provision concerns exclusively the content of the model outputs and does not affect the warranty for the functioning and availability of the gateway or § 13.

Pseudonymisation (optional masking). Masking is a feature that can be switched on and is disabled by default. If it is disabled, the unaltered request content is transmitted to the respective Provider. If it is enabled, the following applies: complete detection of personal or business-critical data cannot be guaranteed; the Customer remains responsible for the lawfulness of the processing and for checking the results.

8. Availability and maintenance

The Supplier endeavours to ensure high availability of the gateway. Availability also depends on the Model Developers and Providers; outages, throttling or maintenance by these Model Developers and Providers are beyond the Supplier's control. A specific availability guarantee (SLA) arises only by express written agreement. Planned maintenance windows are announced with reasonable advance notice; unplanned maintenance is permitted within the scope of IT security operations.

9. Customer's duties to cooperate

• Provision of the necessary configuration data and — for BYOK — provision and management of its own provider keys.
• Maintaining the confidentiality of access credentials and API keys.
• Checking AI outputs and ensuring appropriate human oversight (§ 7).
• Independent classification and legally compliant design of the respective use case, in particular under the EU AI Act (§ 10).
• Compliance with the usage and licence terms of the Model Developers and Providers (§ 6).
• Notification of the use to its own employees where required under co-determination or employment law.
• Compliance with statutory requirements when processing personal data (e.g. legal basis vis-à-vis end users).

10. EU AI Act

With the gateway, the Supplier makes available a generally usable technical tool; it is the provider of this system but, as a rule, not the provider of the underlying AI models within the meaning of Regulation (EU) 2024/1689 ("AI Act"). The models have not undergone a conformity assessment for any specific regulated or high-risk purpose.

The Customer warrants that it will, on its own responsibility, assess the specific deployment as to whether it constitutes a prohibited (Art. 5 AI Act) or high-risk (Annex III AI Act) use case, and will itself fulfil the resulting deployer obligations — including human oversight as well as transparency and labelling obligations towards affected persons. If a model used changes, the Customer reassesses the classification. The Customer indemnifies the Supplier against claims by third parties and authorities resulting from use by the Customer that violates the AI Act.

11. Licence, intellectual property and output

All rights to the Noirdoc software, its documentation and its design remain with Nextaim GmbH or its licensors. For the term of the contract, the Customer receives a non-exclusive, non-transferable right of use to the agreed extent.

Parts of Noirdoc are published as open source on GitHub (github.com/noirdoc-ai); their use is governed by the licence terms stated there. The commercial components of the gateway are not covered by this.

Rights to the inputs transmitted by the Customer remain with the Customer. The Supplier claims no rights of its own to the generated outputs; in relation to Model Developers and Providers, the rights to inputs and outputs are governed by their terms (§ 6). The Supplier does not use customer content for its own purposes beyond the performance of the contract (§ 12).

12. Data protection, confidentiality and no use for training

For content that the Customer transmits via the gateway, the Supplier is a processor. Upon acceptance of these Terms, the Data Processing Agreement (DPA) becomes part of the contract. The subprocessors engaged are listed in Annex 4 of the DPA; the Supplier gives notice of changes in accordance with the DPA. With BYOK, the Provider engaged by the Customer processes the data directly in its relationship with the Customer. Confidentiality under § 203 StGB (German Criminal Code) is governed by the DPA.

For personal data that the Supplier processes as controller (account, billing, website and usage metadata for billing and security), the Privacy Policy applies.

The Supplier does not use customer content to train AI models and contractually ensures that the subprocessors do not do so either (clause 3.5 DPA). Pseudonymisation (§ 7) replaces neither anonymisation nor the Customer's responsibility under data protection law or professional law.

13. Warranty and liability

The services are provided with the care customary in the industry. The following applies to liability:

• The Supplier is liable without limitation for intent and gross negligence, for injury to life, body or health, under the Product Liability Act (Produkthaftungsgesetz) and to the extent of an expressly assumed guarantee.
• In the case of simple negligence, the Supplier is liable only for breach of a material contractual obligation, and then limited to the foreseeable damage typical for the contract. Material contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the Customer may regularly rely.
• Otherwise, liability for simple negligence is excluded.

Insofar as the Supplier is liable for simple negligence under the foregoing, this liability is additionally limited in amount to the remuneration paid by the Customer to the Supplier in the twelve months preceding the event giving rise to the damage. This limitation in amount does not apply in the case of intent and gross negligence, injury to life, body or health, under the Product Liability Act or to the extent of an assumed guarantee.

Liability for damage resulting from incomplete or incorrect pseudonymisation (§ 7) beyond the foregoing framework is excluded. For the content and correctness of the AI outputs (§ 7) and for service disruptions on the part of the Model Developers and Providers (§ 6), the Supplier is liable only within the foregoing framework; § 7 remains unaffected.

Claims of the Customer become time-barred within twelve months from the start of the statutory limitation period. This does not apply to claims arising from intent and gross negligence, from injury to life, body or health, under the Product Liability Act or from an assumed guarantee; in these cases the statutory limitation periods remain unaffected.

14. Term and termination

Unless otherwise agreed, the period of notice for ordinary termination is 30 days to the end of a month. The right to extraordinary termination for good cause remains unaffected; good cause exists in particular in the event of material breaches of these Terms. After the end of the contract, the Customer ceases using the gateway. The refund of unused prepaid credit is governed by § 4.

15. Governing law and place of jurisdiction

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for all disputes arising from or in connection with this contract is — to the extent legally permissible — Munich.

16. Final provisions

Amendments or supplements to these Terms require text form. The Supplier may amend these Terms with effect for the future, in particular to adapt them to a change in the legal situation or to changes in the range of services, models or Providers. Changes are notified to the Customer in text form with reasonable advance notice and are deemed approved if the Customer does not object within 30 days of receipt; the Supplier will point this out separately in the notification.

Should any provision of these Terms be invalid, the validity of the remaining provisions remains unaffected.

For questions about these Terms: hello@noirdoc.de.