Terms, Privacy & Data Processing

These Terms of Service ("Terms") govern the use of the VAKEVA service ("Service") provided by create.repeat Oy (Business ID 2662670-6, Eteläinen Hesperiankatu 26 E 63, 00100 Helsinki, Finland) ("we", "us"). By creating an account, placing an order or using the Service you ("Customer", "you") agree to these Terms on behalf of the company or organisation you represent, and you confirm you have the authority to do so.

1. Business customers only

The Service is offered to companies, organisations and sole traders acting in the course of their business. It is not offered to consumers, and consumer-protection rules (including the 14-day right of withdrawal for distance sales) do not apply. If you are a consumer, do not use the Service.

2. What the Service is

VAKEVA lets you compose teams of AI agents from a role and an open-weight language model, connect them to data resources you choose, and run them as workflows on a schedule you set, managed from the VAKEVA mobile app and the web. The language models your agents use run on servers we operate in the European Union; the website, the apps' connection to it and the scheduling of your workflows run on servers of our hosting provider, Vercel, in the United States (Privacy Policy, sections 3 and 4). You own your configuration, your inputs and your outputs. AI outputs are generated by statistical models and can be wrong, incomplete or unsuitable; you decide how they are used and you review them before relying on them.

3. Presale, plans and payment

• During the presale the only purchasable option is a Prepurchase of a monthly plan. The presale discount of 20 % applies to your first month only; from the second month the plan is charged at its list price. A presale purchase opens your account immediately so you can create your team, agents and workflows; paid agent runtime starts when the beta opens, at the time shown on the pricing page.
• A plan is compute hours per week on our GPU machines for your team: a minimum of 15 hours a week, in steps of five hours, up to 165 hours. Use is counted in whole hours and always rounded up to the next full hour. The monthly price is computed ahead for the coming month as your weekly hours × the hourly price × the number of days in that month ÷ 7, so a week that straddles a month boundary is split by days and months with more days cost proportionally more. The hourly price is stated on the pricing page and includes the model runtime on our GPU machines for the plan's hours; we may change it for future months with notice. Unused weekly hours reset at the start of each week and do not carry over.
• Prices are shown in euro excluding VAT. VAT at the rate stated at checkout is added to every invoice and shown on your receipt. Payment is processed by SumUp on its own payment page; we never see or store your card number. A receipt is issued for every payment the moment it lands, sent to your email and kept under Receipts on your account page.
• Cancellation: you may cancel at any time before your next payment date, which is shown on your team page to the second. The month you have paid for always runs to its end; the next month is not started and not charged. A cancellation made before the next payment date, however close to it, takes effect.
• A Prepurchase is a binding order. Because the Service is opened for you at once, it is refundable only if we fail to open the beta within 60 days of the announced date, in which case you may cancel for a full refund. Later plan changes take effect from the next billing period.
• The free tier: one compute hour a week for one team on our shared instance, at no charge, with queues at busy hours. During the beta the hour is not enforced; the Service tells you when you have passed it. We may change or withdraw the free tier with notice.

4. Your account

Keep your credentials confidential and use multi-factor authentication where offered. You are responsible for everything done under your account and by the people you invite. Tell us at once at the address below if you suspect misuse.

5. Your data and your responsibilities as controller

You decide what data your agents receive, which systems they connect to and what they produce. For any personal data in that material you are the controller within the meaning of the EU General Data Protection Regulation (GDPR) and we are your processor under the Data Processing Addendum below. Because we cannot know what you put in, you are responsible for meeting every legal requirement that applies to your data and your use of the outputs, including as applicable:

• GDPR (EU 2016/679) and the Finnish Data Protection Act (1050/2018): a lawful basis for each processing purpose, transparency to the people concerned, honouring their rights, records of processing, data-protection impact assessments where required, data minimisation, and lawful transfer mechanisms for any data you move outside the EU/EEA.
• Special categories of personal data (health, biometrics, beliefs, sexual orientation and the like), criminal-record data and data about children may be processed only where you have a specific legal basis, and you must tell us in writing before you do.
• Payment-card data (PCI DSS) and other regulated financial data must not be entered into the Service.
• Employee data: the Finnish Act on the Protection of Privacy in Working Life (759/2004) and co-determination rules where agents process data about your staff.
• Marketing and electronic communications law (the ePrivacy rules, the Finnish Act on Electronic Communications Services 917/2014) and the Consumer Protection Act for anything your agents send to your prospects or customers.
• The EU Artificial Intelligence Act (EU 2024/1689): as the deployer of AI systems you must not use them for prohibited practices, must apply human oversight, must tell people when they interact with an AI where the Act requires it, and must not use the Service for a high-risk purpose under Annex III without our prior written agreement.
• The EU Data Act (EU 2023/2854) and sector rules on data sharing and access where your data resources come from connected products or regulated sources; the Digital Services Act where you publish agent outputs.
• Intellectual-property and trade-secret law for your inputs and outputs, contractual confidentiality you owe to third parties, and the terms of every external system or API you connect.
• Export-control and sanctions law, and any professional-secrecy duty (legal, medical, financial) attached to the material you process.

6. Acceptable use

You will not use the Service to break the law, to infringe rights, to generate or send unsolicited bulk messages, to attack or probe systems you are not authorised to test, to process data you have no right to process, or to attempt to extract our models, prompts or infrastructure details. We may suspend an account that puts other customers, the people whose data is processed or the platform at risk, and we will tell you why.

7. Our commitments

We run the language models of your agents on servers we control in the EU, with encryption at rest for external credentials, per-team namespacing of data resources, a plain-language audit trail of every access your agents make, and no use of your data to train models. We aim for high availability but do not promise a particular uptime during the beta. Support is by email and through the support chat in the app, in English and Finnish, on business days.

8. Confidentiality

Each party keeps the other's non-public information confidential and uses it only to perform under these Terms. Your inputs and outputs are your confidential information. We may disclose information where the law compels it, telling you first where permitted.

9. Intellectual property

You retain all rights in your inputs and, as far as the law allows, in the outputs generated for you. We retain all rights in the Service, its software, its roles and skills library and its documentation. You grant us only the licence needed to run the Service for you. Open-weight models are used under their own licences, which you agree to respect.

10. Warranties and liability

The Service is provided as described, with reasonable skill and care. To the fullest extent the law allows, we exclude other warranties, including any warranty that outputs are accurate or fit for a particular purpose. Neither party is liable for indirect or consequential loss, lost profits or lost data beyond our backup obligations. Our total liability under these Terms in any twelve-month period is limited to the fees you paid us in that period. Nothing limits liability for fraud, wilful misconduct, gross negligence, death or personal injury, or breach of the Data Processing Addendum to the extent the GDPR does not permit such limitation.

11. Term, termination and your data

These Terms apply while you hold an account. Either party may terminate for convenience at the end of a paid period, and at once for a material breach not cured within 30 days of notice. On termination you may export your configuration and data for 30 days, after which we delete them, keeping only what the law requires us to keep, for as long as it requires.

12. Changes

We may update these Terms and the Service as the beta develops. We will announce material changes by email at least 30 days before they take effect; continued use after that date is acceptance. We will not reduce the minutes or the discount of a Prepurchase you have already made.

13. Governing law and disputes

These Terms are governed by the laws of Finland, excluding its conflict-of-law rules and the CISG. Disputes are settled first by good-faith negotiation and otherwise in the Helsinki District Court (Helsingin käräjäoikeus) as the court of first instance.

14. Contact

create.repeat Oy, Eteläinen Hesperiankatu 26 E 63, 00100 Helsinki, Finland · hello@vakeva.app

This Privacy Policy explains how create.repeat Oy (Business ID 2662670-6, Eteläinen Hesperiankatu 26 E 63, 00100 Helsinki, Finland) processes personal data as CONTROLLER when you visit vakeva.app, use the VAKEVA mobile app, contact us, create an account or buy a plan. Personal data your agents process inside the Service is processed on your instructions as your processor under the Data Processing Addendum, not under this Policy. Contact for all data-protection matters, including under the GDPR and the EU Data Act: privacy@vakeva.app (section 10).

1. What we collect and why

• Account and billing data — company name, your name, work email, username and account id, hashed password, orders, invoices, payment status (never the card number, which SumUp handles). Basis: performance of the contract; legal obligation for bookkeeping (Finnish Accounting Act, 6 years).
• Service configuration — teams, agents, roles, workflows, schedules, connected data-resource settings (external credentials encrypted at rest and shown only as a fingerprint). Basis: contract.
• Usage and change history — the compute time your team's agents use, how long each answer took, and the history of changes to your teams (who changed what, and when), shown to you in the Service. Basis: contract.
• The VAKEVA mobile app (iPhone and Android) — the account and service data above, sent to our servers when you use the app. On the phone the app keeps only your sign-in cookie, in the phone's own cookie store, and your settings (language and appearance). The app contains no advertising, analytics or crash-reporting code, reads no advertising or device identifier, does not track you across apps or websites, and sends no push notifications. Basis: contract.
• Phone number (optional) — if you give one when you sign up, we keep it with your account and use it only to reach you about your account. We send no text messages today; before we start confirming numbers by text message, we will name the provider that sends them in section 3. Kept while your account exists. Basis: contract.
• Connected mailbox settings — when you connect a company mailbox to a workflow: the mailbox address, the provider (Microsoft or IMAP in the app; Google as well on the website) and the sign-in the provider gives us, which is an access token for Google and Microsoft, and for IMAP the server name, username and password you enter. The token or password is encrypted at rest (AES-256-GCM), shown to you only as a fingerprint, and used only to read that mailbox. Disconnecting the mailbox deletes the token or password at once. What is read from a mailbox, and what happens to mail already read when you disconnect it, is in section 8. Basis: contract.
• Audit and security logs — which agent accessed which resource under which right, sign-ins, IP addresses, errors. Basis: legitimate interest in security and accountability, and your contract's audit view. Kept 12 months, then aggregated or deleted.
• Website measurement — with your consent at the level you choose in the banner: none, anonymous (random visitor and session ids, page, referrer, campaign) or personalised (linked to your account). No third-party analytics or advertising script is loaded at any level; the data passes through the website's servers, which Vercel runs in the United States (section 4), to our own servers in the EU, where it is kept. Your choice is kept for 180 days and can be changed from “Cookie settings” in the footer. Basis: consent.
• Correspondence — emails you send us and our replies. Basis: legitimate interest in answering you; kept 24 months.
• Support conversations and reports on AI answers — what you write in the support chat in the app, our replies, and the text of any report you make on an AI answer, together with the answer it concerns. Each new message and report notifies our support team by email, and a person reads it: only our administrator reads them, and no AI tool does. They are kept in our database while your account exists and deleted from it with your account. Basis: legitimate interest in answering you and in correcting answers that are wrong.
• Transactional email — order confirmations, account and security notices, sent through our own mail server with Resend as fallback. Basis: contract. Marketing email only with consent, revocable in every message.

2. Cookies

One strictly necessary cookie keeps you signed in. The consent cookie remembers your banner answer. Measurement identifiers exist only if you allow them. Nothing is set for advertising. The mobile app uses the same sign-in cookie, kept in the phone's own cookie store, and sets no other cookie.

3. Recipients and sub-processors

These partners process personal data for us as our processors: Vercel Inc. (United States: it hosts the website and the connection the mobile app uses and runs their server code, so every request, and every check of a connected mailbox, is handled on its servers in the United States); Supabase Pte. Ltd. (Singapore: the managed PostgreSQL database, kept in its EU region); and Plus Five Five, Inc., trading as Resend (United States: fallback email delivery). Vercel, Supabase and Resend are each bound by a written agreement under GDPR Article 28(3) that gives your data the same protection as this Policy; where one of them engages a processor of its own, it must bind that processor to the same obligations (Article 28(4)). The language models of the agents that run your teams run only on our own servers, and those agents never use an outside AI provider. SumUp (SumUp Payments Limited, SumUp Limited and SumUp EU Payments UAB) takes a payment on its own payment page as an independent controller under its own privacy policy: we send it only the order's reference, amount and description, and you give your card details to SumUp directly. Apple and Google distribute the mobile app: they process the data of your download as independent controllers under their own privacy policies, and we receive from them only aggregated statistics and, where you allow it in your phone's settings, crash reports. We do not sell personal data and we do not share it with advertisers.

4. Transfers outside the EU/EEA

Our database is in the EU and the language models run there, but not all processing is: Vercel handles every request to the website and to the mobile app's connection on its servers in the United States. Where a partner processes data outside the EU/EEA we rely on the European Commission's Standard Contractual Clauses with supplementary measures, or on an adequacy decision (including the EU–US Data Privacy Framework where the partner is certified). Vercel Inc. processes those requests in the United States under the Standard Contractual Clauses in its data processing addendum. Resend delivers fallback email from the United States under the EU–US Data Privacy Framework and the Standard Contractual Clauses in its data processing addendum. Supabase Pte. Ltd. is a Singapore company that keeps our database in its EU region; any access to that data from outside the EU/EEA, for example by its support staff, is covered by the Standard Contractual Clauses in its data processing addendum.

5. Your rights

Under the GDPR you may ask for access to, correction or deletion of your personal data, restriction of processing, portability of data you gave us, and you may object to processing based on legitimate interest and withdraw consent at any time. Write to privacy@vakeva.app; we answer within one month. To have some of your data deleted without deleting your account, write to the same address. To delete your account, see section 9. You may also lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland, or with the supervisory authority of your own EU member state.

Withdrawing a consent: you can withdraw any consent at any time, and withdrawing does not affect what was done before. Website measurement: change it under “Cookie settings” in the site's footer. Marketing email: use the link in any message.

6. Security

Encrypted transport (TLS), encryption at rest for secrets, per-team isolation, least-privilege access for our staff, multi-factor authentication for administrators, and a complete audit trail. We will notify you and, where required, the supervisory authority of a personal-data breach without undue delay.

7. Children

The Service is for business use and is not directed at anyone under 18.

8. Connected mailboxes and Google user data

When you connect a company mailbox to a workflow, VAKEVA reads the mail in it on your instruction: senders, recipients, subjects, dates, message text and attachments. It starts with mail that was already in the mailbox when you connected it and then reads each new message as it arrives: for Google, the latest inbox messages of the past 30 days (up to 50); for Microsoft, the messages in the inbox; for IMAP, every message in the connected folder, normally the inbox, oldest first. It never sends, moves or deletes anything in the mailbox. Google and Microsoft mailboxes are connected with read-only permission (for Gmail gmail.readonly, for Microsoft Mail.Read). An IMAP mailbox is reached with the username and password you give us, and your mail server marks each message VAKEVA fetches as read, as it does when you open a message yourself, so mail you had not opened yet, the older mail included, will show as read. Replies you write in AI Mailboxes are sent from your workflow's own VAKEVA address, never from a connected mailbox. VAKEVA fetches the mail through the website's servers, which Vercel runs in the United States (section 4), and stores it in our database in the EU. The copies kept with the mailbox connection and among the workflow's inputs are encrypted by VAKEVA itself (AES-256-GCM); the copy on the workflow's AI Mailboxes threads is kept as plain text, so that you can read it there. The mail is used only as the input of the workflow you connected it to, processed by your team's agents, whose language models run on our own servers in the EU. It is not sent to any third-party AI provider, not used to train AI models, not used for advertising, and not read by our staff unless you ask us to for support or the law requires it. Mail your agents process is Customer Data under the Data Processing Addendum. You can disconnect a mailbox at any time. VAKEVA then stops reading it and at once deletes its stored sign-in and the copy of each message kept with the connection. Mail that had already reached your workflow stays with the workflow, because it is part of your team's work: on its AI Mailboxes threads, among the workflow's inputs and in what your agents made from it. It is deleted with the team when the account that owns the team is deleted (section 9), or sooner if you ask us at the address in section 10.

Google mailboxes can be connected on the website; the mobile app offers Microsoft and IMAP mailboxes. VAKEVA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Deleting your account

You can delete your account in the app (Account → Delete account) or on the web at vakeva.app/account/delete, where a signed-out request is confirmed through a one-time link we email to the account's address. The app asks for your password, or your authenticator code, again first. Deletion is refused while you own an account that other people are members of: remove them or hand the account over first, so that their work is not deleted with yours. When you confirm, we cancel every plan you pay for, sign you out everywhere and email you the date. Deletion is completed within 30 days. Then:

• your profile (name, email, phone, password, authenticator), your sessions, your chats with the Assistant and with agents, your support conversations and your reports on AI answers are deleted;
• teams you own alone are deleted with their agents, workflows, mailbox connections and stored mail; roles and skills you created are deleted, unless an agent of another account uses them, in which case they pass to that account's owner;
• if you are a member of someone else's account, the teams, roles and skills you made there pass to that account's owner, with what their agents have learned, because they are that company's work;
• orders, receipts and subscription records are kept for the 6 years the Finnish Accounting Act requires, attached to an anonymised account record. A receipt keeps the billing name and email printed on it, because the law requires the receipt as it was issued. A team a receipt refers to is emptied and kept only as “Deleted team”;
• technical activity records (which step ran, its status and its duration; no content) are kept without any link to you;
• security logs are kept no longer than the 12 months in section 1.

10. Privacy contact

create.repeat Oy, Eteläinen Hesperiankatu 26 E 63, 00100 Helsinki, Finland · privacy@vakeva.app. Write to this address about anything in this Policy, to use any of your rights or to withdraw a consent.

11. Changes

We will post changes here with a new date and email account holders about material changes.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer (as CONTROLLER) and create.repeat Oy (as PROCESSOR) and meets Article 28 of the GDPR. It applies to all personal data the Customer, its users or its connected data resources make available to the Service ("Customer Data"). Where the Customer is itself a processor for its own clients, we act as sub-processor and the same terms apply. Messages sent to our support and reports on AI answers are not Customer Data: we process them as controller under the Privacy Policy. If such a message quotes Customer Data, we use that part only to resolve the message and delete it with the message.

1. Subject matter, duration, nature and purpose

Processing of Customer Data by AI agents, workflows and data resources configured by the Customer, for the Customer's own business purposes, for the term of the Terms of Service. Categories of data subjects and data are determined solely by the Customer, who confirms it will not upload special categories of data or data about children without our written agreement.

2. Instructions

We process Customer Data only on the Customer's documented instructions — the configuration the Customer sets in the Service is the primary instruction — and never for our own purposes, never to train models, and never to build profiles across customers. We will tell the Customer if, in our opinion, an instruction infringes data-protection law.

3. Confidentiality and personnel

Our personnel with access to Customer Data are bound by confidentiality and receive data-protection training. Access is granted on a need-to-know basis and is logged.

4. Security (Article 32)

• Open-weight models running on servers in the EU operated by us, with no Customer Data sent to third-party model providers; the web service that carries requests to them is hosted by Vercel (section 8).
• Encryption in transit (TLS 1.2+) and at rest for external credentials (AES-256-GCM); per-team namespacing of data resources; runtime isolation between teams.
• Rights granted one resource at a time; every access recorded with agent, workflow, step and right, and shown to the Customer in the audit view.
• Multi-factor authentication for administrative access; least privilege; patching; backups with restore testing; incident-response procedure.

5. Sub-processors

The Customer authorises the sub-processors listed in the Privacy Policy (website hosting, database, fallback email). We will announce any addition or replacement by email at least 30 days in advance; the Customer may object on reasonable data-protection grounds, in which case either party may terminate the affected part of the Service. We remain fully liable for our sub-processors.

6. Assistance

Taking into account the nature of processing, we assist the Customer with data-subject requests (the Customer can export, correct and delete data within the Service; requests reaching us are forwarded to the Customer within 5 business days), with security, breach notification, data-protection impact assessments and prior consultation.

7. Personal-data breach

We notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal-data breach affecting Customer Data, with the information Article 33(3) requires as it becomes available, and we cooperate in the Customer's own notifications.

8. Transfers

Customer Data is stored in the EU, and the language models process it there. The web service through which the Customer, its users and its connected mailboxes reach the Service is hosted by Vercel Inc., which processes each request in the United States under the Standard Contractual Clauses in its data processing addendum. Any other transfer outside the EU/EEA happens only on the Customer's instruction (for example a data resource the Customer connects) or under a valid Chapter V mechanism.

9. Deletion and return

On termination, or earlier at the Customer's request, we return Customer Data in a machine-readable form and delete all copies within 30 days, unless EU or member-state law requires storage, and we confirm the deletion on request.

10. Audit

We make available the information necessary to demonstrate compliance with Article 28 and allow audits, including inspections, by the Customer or an auditor mandated by it, once a year on 30 days' notice or at once after a breach, at the Customer's cost, under confidentiality, without disrupting other customers.

11. Liability and precedence

Liability follows the Terms of Service, save that the limitations do not apply where the GDPR does not permit them. In case of conflict this DPA prevails over the Terms for data-protection matters.

12. Contact for the Customer's DPO or supervisory authority

create.repeat Oy, Eteläinen Hesperiankatu 26 E 63, 00100 Helsinki, Finland · privacy@vakeva.app