Terms of Service

1. Who these terms are between

The Service is provided by Heplon UG (haftungsbeschränkt), Kolonnenstraße 8, 10827 Berlin, Germany ("Heplon", "we", "us"). Full provider details are in our legal notice.

"You" means the person or organisation that accepts these Terms and uses the Service. You may use the Service either as a business or as a consumer:

• As a business, if you use the Service for your trade, business, or profession, or on behalf of an organisation. Where you use the Service in connection with your job, these Terms bind your employer or the organisation you act for, not you personally, and you confirm you are authorised to bind it.
• As a consumer, if you use the Service wholly or mainly for purposes outside your trade, business, or profession. These Terms then bind you personally, and the additional protections in section 18 apply to you.

The free self-serve plan is open to businesses and to consumers. The 30-day trial and paid plans are offered to businesses only.

2. How you accept these terms

You accept these Terms in any of the following ways:

• By ticking a box or clicking a button that says you accept them.
• By signing or otherwise agreeing to an order form that refers to them.
• By using the Service.

However you accept, these Terms then bind you and us as a contract. Where you also sign an order form, that order form and these Terms apply together.

If you accept these Terms on behalf of an organisation, you confirm that you are authorised to bind that organisation. If you are not, do not accept them and do not use the Service.

3. Free access

We offer the Service free of charge in two distinct forms: a business trial and an ongoing free self-serve plan. Different terms apply to each form as set out below.

Trial. The trial runs for 30 days from the day we give you access, and we may extend it, once or repeatedly, by notice to you in writing, including by email. It is offered to businesses for evaluation purposes. When the trial ends, your access stops. The trial does not convert into a paid plan or any other continuing arrangement, whether automatically, by expiry, or by continued use, and neither of us owes the other any fee, notice period, or compensation. Any further use of the Service requires a separate agreement. We may change or end the trial at any time, for any reason, and with immediate effect. Support is provided on a best-effort basis and we make no promises about availability, uptime, performance, or response times during the trial.

Free self-serve plan. The free self-serve plan is open to businesses and to consumers. It runs on an ongoing basis with no fixed end date, until you or we end it under section 14. We may gate sign-up behind an invite code. Invite codes are personal to the recipient and their organisation and may not be transferred.

For the free self-serve plan, support is offered on a best-effort basis and we do not commit to a particular uptime percentage, performance level, or support response time. We may change the plan only as set out in section 13, and may end it only as set out in section 14.

If you are a consumer, you also have a statutory right to withdraw from the contract within 14 days. See section 18 and our withdrawal policy.

4. Paid plans and order forms

Paid use of the Service is agreed in an order form. The order form sets the scope, the number of seats or other usage limits, the price, the billing period, and the contract term.

These Terms apply to every order form unless the order form says otherwise. Where an order form and these Terms conflict, your order form prevails.

Fees are exclusive of VAT and other applicable taxes. Invoices are payable within 30 days of the invoice date unless the order form says otherwise.

5. Your account

You are responsible for your account and for all activity under it, including managing who has access, removing users who leave, and keeping credentials secure. You will use strong authentication and enforce multi-factor authentication where available.

Notify us without undue delay at security@heplon.com if you believe an account has been compromised.

6. What you may not do

You may not:

• Use the Service unlawfully, or in a way that breaks the rights of anyone else.
• Resell, sublicense, or provide the Service to anyone outside your organisation.
• Reverse engineer, decompile, or try to extract the source code or model weights behind the Service, except where the law says you may.
• Use the Service to build a competing product.
• Deliberately overload the Service, work around usage limits, or interfere with its security.
• Feed the Service data you have no right to share with us.

You must not include secrets, credentials, or API keys in the prompts, chat, or other content you ask the Service to process. This does not cover the credentials you enter while connecting Heplon to your systems, or secrets the Service reads from those systems while carrying out the actions you have configured.

7. Connecting your systems

The Service connects to your repositories, cloud accounts, CI systems, chat tools, and other parts of your platform. You designate which systems to connect and the scope of the automated actions the Service may take in them. When you set up a connection, you instruct us to access that system, and you warrant that you are entitled to give us that access.

You control the scope. Heplon acts with the permissions of the role you configure and can only reach what that role can reach.

You stay responsible for the systems you connect. That includes the access you grant, your own backups and recovery, and your own change control and release processes.

Where Heplon works alongside third-party services, those services are governed by their own terms and privacy policies. We are not responsible for how they behave or whether they stay available.

8. Where the service runs

We run the Service for you as a managed service on Amazon Web Services, within the European Union.

AI processing happens through managed inference with providers that operate within the European Union. Those providers are named in our data processing agreement. Your data is not sent to any model provider outside that list.

Your data is encrypted in transit and at rest. The technical and organisational measures we apply, and the subprocessors we use, are listed in our data processing agreement.

9. Your data and who owns it

You keep ownership of everything you put into the Service and everything we read from your connected systems, including your source code, configuration, telemetry, and documents ("Customer Data"). Nothing here transfers any of it to us.

You grant us a limited, non-exclusive licence to host, copy, process, and display Customer Data to run the Service for you, to support you, to keep the Service secure, and to check that the Service works as intended. That licence ends when your access ends.

To check that the Service works as intended, a limited number of our authorised staff may review samples of what the Service produces for you and the material needed to judge it. Those samples can include findings, proposed fixes, the surrounding code and configuration they relate to, and telemetry about how the Service ran, which may contain snippets of Customer Data. Access is restricted to staff who need it and is logged, and samples are kept only for as long as that review needs them. We do not use Customer Data to train or fine-tune any machine learning model.

We do not sell Customer Data or disclose it for advertising purposes.

We may create and use anonymised data about how the Service is used to operate, secure, and improve it, and we may share that data without restriction. Such data does not identify you and does not contain Customer Data.

We keep all rights in the Service, including in every improvement to it. If you send us feedback, you grant us a perpetual, irrevocable, worldwide, royalty-free right to use it to develop and improve the Service, with no obligation to credit or pay you.

10. AI output and your responsibility for it

The Service uses artificial intelligence and other automated methods to analyse your platform and generate output for you, such as reviews, answers, and proposed changes ("Output"). Output may be incomplete, outdated, or incorrect.

You are responsible for reviewing Output before you merge it, deploy it, or otherwise act on it. You must not rely on the Service as the sole control over any change affecting production, security, or compliance.

We do not warrant that Output is accurate, complete, current, or fit for any particular purpose.

As between you and us, you own the Output generated for you. Because models produce similar answers to similar questions, Output is not exclusive, and comparable Output may be generated for other customers.

11. Confidentiality

Each side may receive non-public information from the other in connection with the Service, including your code and infrastructure on our side and the internal workings of the Service on yours. Each side will keep that information confidential, use it only for the purposes of this contract, including the review described in section 9, and disclose it only to personnel and subcontractors who need it and who are bound by equivalent obligations.

This does not cover information that is or becomes public without a breach of these Terms, was lawfully known beforehand, is lawfully received from a third party, or was developed independently. Disclosure required by law or by a court or authority is permitted, and the other side will be told in advance where that is lawful and practical.

Each party may use the general knowledge, skills and experience retained in the unaided memory of its personnel as a result of exposure to the other party's Confidential Information, provided that it does not reproduce that Confidential Information and does not use it to reproduce the other party's products or services.

These obligations remain in force for three years after your access ends.

12. Data protection

Where we process personal data contained in Customer Data, you act as controller or processor, as applicable, and we act correspondingly as processor or sub-processor. Our data processing agreement governs that processing, meets Art. 28 GDPR, and forms part of these Terms. By accepting these Terms you also accept it.

How we handle personal data collected through our website is described in our privacy policy. What our agents can access, and how we secure the Service, is described on our security page.

13. Availability, support, and changes to the service

We work to keep the Service available and to fix problems quickly, but we do not guarantee uninterrupted access unless an order form says otherwise. Maintenance, third-party outages, and factors outside our control can all interrupt it.

The Service changes over time. We may add, alter, or remove features where there is a valid reason, including to maintain or improve the Service, respond to changes in law, security risks or abuse, adapt to new technologies or technical environments, or change the services and infrastructure on which the Service depends. A change will not result in an additional charge unless you agree to it.

We will inform you clearly about changes. If a change materially reduces the value of a paid plan, you may terminate that plan on notice and receive a refund of fees covering the unused remainder of the term.

If you are a consumer and a change impairs your access to or use of the Service by more than a minor amount, we will give you reasonable advance notice on a durable medium, including by email. The notice will describe the change, when it takes effect, and your rights. You may terminate the affected contract free of charge within 30 days after you receive the notice or, if later, after the change takes effect, unless we allow you to keep using the unchanged Service without additional cost.

We may suspend access without notice if there is a security risk, unlawful use, or a serious breach of these Terms. We will restore access as soon as the reason for the suspension is resolved.

14. Term and termination

These Terms apply for as long as you use the Service. The trial runs as described in section 3. Paid plans run for the term set in the order form.

You may end the free self-serve plan at any time by closing your account. We may close your free self-serve account, whether or not it has been inactive, on 30 days notice to you in writing, including by email. We may act with immediate effect where section 13 allows suspension or where the law requires it. Your rights as a consumer are unaffected.

Either side may terminate immediately for good cause. Either side may also terminate for a material breach that the other does not remedy within 30 days of being notified of it. Notice is given in writing, including by email.

When access ends, you can ask us to export your Customer Data. We will provide it in a reasonable machine-readable format if you ask before or within 30 days after access ends. We delete Customer Data from active systems within 30 days after access ends, except where the law requires us to keep particular records. Backup copies are deleted as they expire, within a further 35 days. Access and security logs follow their separate 90-day retention period. If you ask for immediate deletion instead of an export, we begin deletion without waiting for the export period to end.

The 30-day export period is an additional contractual service and does not limit any mandatory right a consumer has to receive eligible content after termination. We do not continue to use consumer-provided or consumer-created non-personal content after termination, except where the law permits it.

The sections on data ownership, confidentiality, liability, and governing law survive termination.

15. Warranties

For paid plans, we warrant that we will provide the Service with reasonable skill and care. The business trial is provided for evaluation on an as-is basis, without warranty as to availability or as to the accuracy of Output. If you use the free self-serve plan as a consumer, we provide the Service in accordance with the mandatory conformity, update, remedy, and other rights that apply to digital products.

Beyond that, and as far as the law allows, we give no other warranties, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. In particular, we do not warrant that the Service will be error free, that it will find every problem in your code or platform, or that its Output will be correct.

16. Liability

Nothing in these Terms limits or excludes our liability for damage caused intentionally or by gross negligence, for injury to life, body, or health, under the German Product Liability Act, or for anything else that cannot be limited by law.

For paid plans, in cases of slight negligence we are liable only where we breach a material contractual obligation, meaning an obligation whose fulfilment is essential to performing this contract properly and on which you may reasonably rely. In that case our liability is limited to the foreseeable damage typical for a contract of this kind.

For business use of the trial or free self-serve plan, our liability is limited to intent and gross negligence. The exceptions in the first paragraph of this section are unaffected. For consumer use of the free self-serve plan, this limitation applies only to the extent permitted by mandatory law.

Subject to the paragraphs above, our total aggregate liability for paid plans, arising out of or relating to these Terms, is limited to the fees you paid us in the 12 months before the event that caused the liability.

Neither side is liable for indirect or consequential loss, lost profits, lost revenue, or lost data, again subject to the paragraphs above.

The caps above do not apply to breaches of section 11 (confidentiality). Each side's aggregate liability for such breaches is limited to EUR 50,000, except for breaches caused intentionally. The same limitations apply in your favour.

17. Changes to these terms

We may update these Terms to reflect changes to the Service, to our operations, or to the law. Every version carries a version number and an effective date. We retain earlier versions and provide them on request; contact hello@heplon.com.

For material changes we will give you at least 30 days notice in writing, to your account administrators or through the Service. If you do not accept a material change, you may terminate before it takes effect. For paid plans, we refund fees covering the unused remainder of the term.

Changes apply going forward only. Anything that happened before a new version took effect is governed by the version that applied at the time.

18. If you are a consumer

This section applies only if you use the Service as a consumer, meaning wholly or mainly for purposes outside your trade, business, or profession. Where it conflicts with another part of these Terms, this section prevails for consumers.

Your statutory rights. Nothing in these Terms limits the mandatory rights the law gives you as a consumer. Where these Terms would give you less than the law requires, the law applies.

Right of withdrawal. You have a statutory right to withdraw from the contract within 14 days, without giving any reason. How to exercise it, and the model withdrawal form, are set out in our withdrawal policy. You can use the "Withdraw from contract" function under Settings and Account in the application, or notify us by email or post. We confirm an in-app withdrawal immediately by email. Because the Service is free and you make no payments, withdrawal ends the contract, closes your account, and starts deletion as described in section 14.

Liability. The limitations in section 16 apply only to the extent permitted by mandatory consumer law. The exceptions in the first paragraph of section 16, including for injury to life, body, or health and under the German Product Liability Act, apply to you in full.

Governing law and jurisdiction. German law applies, but you also keep the protection of any mandatory consumer provisions of the country in which you live. The choice of Berlin as the place of jurisdiction (section 19) does not apply to you. You may bring claims, and claims may be brought against you, at the courts having jurisdiction for your place of residence under the applicable law.

Dispute resolution. We are not obliged and not willing to participate in dispute resolution proceedings before a consumer arbitration board.

19. General

These Terms, together with any order form and our data processing agreement, are the entire agreement between us on this subject. Amendments must be in writing, which includes email.

If a provision turns out to be invalid, the rest stays in force. Neither side may assign this contract without the other's consent, except to a successor of its business. We may use subprocessors and subcontractors, and we stay responsible for what they do.

These Terms are governed by German law, excluding its conflict of law rules and the UN Convention on Contracts for the International Sale of Goods. The place of jurisdiction is Berlin, as far as jurisdiction can be agreed. If you are a consumer, section 18 applies instead in respect of governing law and jurisdiction.

20. Contact

Questions about these Terms can be sent to hello@heplon.com.