Terms and conditions

Terms of use for ArduMaker VPS servers, panel and APIs: signing up and cancelling, billing, responsibilities and acceptable use.

Version 2 · Updated on 2026-09-20

Master Services Agreement between ArduMaker and its Customers

Please read these Terms carefully. They form a binding contract between you and ArduMaker. They explain what we provide, what you must do, what we must do, where our responsibility ends and where yours begins. The summary below is offered for convenience only and does not replace the clauses that follow.

Summary of the key points

• Who we are. ArduMaker is operated by Franco Nicolas Dorrego, established in Porto, Portugal.
• Written contact goes through developer@ardumaker.com.
• What we offer. Self-service cloud infrastructure and APIs: servers (VPS), deploys, databases,
• domains, email, WhatsApp API, Router IA, Search API, an MCP server for AI agents, team projects, a
• school program and custom development.
• You control your servers. You get real root access. We run the platform; you are responsible
• for what you install, configure, publish and send (Clause 10).
• Good faith, both ways. We provide the Services in good faith and with professional diligence,
• and we expect the same from you. Errors, gaps and bugs may never be used for advantage (Clauses 5
• and 11).
• Verification at any time. We may ask for additional verification of identity, company, payment
• method or eligibility at any moment. If it is not provided, we may restrict the Account (Clause
• 7).
• Bugs must be reported. Any bug, vulnerability or billing error you detect must be reported to
• us, including those in your favour. Exploiting them is Abuse (Clause 11).
• Abuse has clear consequences. The Terms of Use list the main abuse categories and what happens
• in each case, from a warning to immediate termination.
• Payments. Each Company has its own Balance. Monthly fees are charged on the 1st of each month
• and prorated by day; usage-based services are charged as consumed. Unpaid debts lead to a pause
• and, after 25 days, deletion, plus a surcharge of 85% of the debt (Payment Procedure). The Balance
• pays for Services and is not refunded in cash.
• Liability. Our liability is limited as set out in Clause 24, but never for intent, gross
• negligence or anything the law does not allow us to limit.
• Leaving. There is no lock-in. You can delete Services at any time, get your data out and
• switch provider (Clauses 21 and 22). Deleting a Company can be undone for 30 days, although the
• servers it contained are not recreated (Clause 21.6).
• Law. Portuguese law applies. If you are a consumer, you keep every mandatory protection of the
• law of your country of residence (Clause 30).

1. Provider identification and contact

1.1 Provider. The Services are provided by Franco Nicolas Dorrego, a natural person carrying on a professional activity in Portugal under the trade name ArduMaker, with professional address at [TO COMPLETE: professional address], Porto, Portugal, tax identification number (NIF) 322978254 ("ArduMaker", "we", "us" or "our").

1.2 Single contact address. ArduMaker handles every matter through developer@ardumaker.com. To route each message to the right process, the subject line should begin with one of the following tags. A missing or wrong tag never makes a communication invalid; it may only delay its handling.

1.3 Other channels. Telephone and WhatsApp support may be provided at +351 930 900 901 during business hours. Legal notices, complaints, appeals, verification documents and anything that must be proven in writing must be sent by email.

1.4 Business hours. Monday to Friday, 09:00 to 18:00 (Lisbon time), excluding Portuguese national public holidays ("Business Days" and "Business Hours").

1.5 Languages. ArduMaker communicates in Spanish, English and Portuguese.

2. Contract structure and order of precedence

2.1 Contract documents. The agreement between ArduMaker and the Customer (the "Agreement") consists of:

• (a) these Terms and Conditions, including Annex A (Data Processing Terms) and Annex B
• (Service-Specific Conditions);
• (b) the Terms of Use (Acceptable Use and Abuse Policy);
• (c) the Payment Procedure;
• (d) the plan, price, resources and characteristics shown in the Dashboard at the moment of each
• Order; and
• (e) any individual agreement signed between the parties, such as a school agreement, a custom
• development proposal or statement of work, or an enterprise agreement ("**Individual
• Agreement**").

2.2 Privacy Policy. The Privacy Policy explains how ArduMaker processes personal data as a controller. It is an information notice and does not restrict any right the Customer has under data protection law. Processing of Customer Data on behalf of the Customer is governed by Annex A.

2.3 Order of precedence. In case of conflict, the following order applies, from highest to lowest:

1. mandatory provisions of applicable law, including consumer protection law;
2. an Individual Agreement, only for the Services it covers;
3. Annex A, for the processing of Customer Data;
4. Annex B, for the specific Service concerned;
5. the Terms of Use, for conduct, abuse and enforcement;
6. the Payment Procedure, for billing, collection, credits and refunds;
7. the main body of these Terms and Conditions;
8. descriptions on the website, documentation, blog and marketing materials, which are informative.

2.4 Public descriptions. Website pages, FAQs, blog posts and documentation describe the Services in good faith but may simplify them. The characteristics shown in the Dashboard at the moment of an Order and this Agreement prevail, without prejudice to the rights that Consumers have regarding public statements under the applicable law on conformity of digital services.

3. Definitions

Capitalised terms have the following meaning, in the singular and the plural:

• Abuse: any conduct described as abuse, or prohibited, in the Terms of Use.
• Account: the personal user account registered on the Platform, protected by credentials.
• Agent: any AI assistant, automation or third-party software that the Customer or its
• Authorized Users connect to the Platform through the MCP server, the APIs or any other interface,
• including Claude, ChatGPT, Gemini, Cursor, Copilot or similar tools.
• API Credentials: API keys, tokens, SIDs and secrets, OAuth grants, bot account tokens and any
• other credential used for programmatic access.
• Authorized User: any person invited by the Customer to a Company or given access to the
• Customer's resources, with whatever role.
• Authorized Negative Balance: the negative amount that the Balance of a Company may reach
• before automatic collection starts, as described in the Payment Procedure.
• Balance: the prepaid funds and credits associated with a Company, as described in the Payment
• Procedure.
• Business Customer: a Customer acting for purposes relating to its trade, business, craft or
• profession, including freelancers, companies, schools and public bodies.
• Company: a workspace created on the Platform (shown in Spanish as "Empresa") that groups
• projects, Resources, Authorized Users, a Balance and billing details. Each Company is billed
• separately.
• Consumer: a natural person acting for purposes that are outside their trade, business, craft
• or profession.
• Customer or you: the natural or legal person who accepts this Agreement and on whose
• behalf a Company is created or Services are ordered.
• Customer Content: all software, code, files, websites, databases, messages, emails, prompts,
• instructions and other material that the Customer or its Authorized Users or Agents upload, store,
• run, send or generate through the Services.
• Customer Data: the personal data included in Customer Content, processed by ArduMaker on
• behalf of the Customer.
• Dashboard: the web control panel of the Platform, including the web terminal.
• Default: the situation described in the Payment Procedure in which a debt cannot be collected.
• Order: every contracting, activation, upgrade, top-up or usage of a paid Service, made through
• the Dashboard, the APIs, an Agent or an Individual Agreement.
• Platform: the ArduMaker software, infrastructure, website, Dashboard, APIs, MCP server and
• related systems.
• Resources: the servers, disk, memory, CPU, IP addresses, ports, domains, mailboxes, numbers,
• API keys, databases and any other capacity allocated to a Company.
• Security Incident: a breach of security leading to the accidental or unlawful destruction,
• loss, alteration, unauthorised disclosure of or access to data, or any event that compromises the
• integrity or availability of the Platform.
• Services: the services offered by ArduMaker, described in Clause 5 and Annex B.
• Status Page: https://status.ardumaker.com, or any page that replaces it.
• Third-Party Services: services provided by third parties that are integrated with, or
• reachable through, the Services.
• Vulnerability: any weakness, bug, error or misconfiguration that could allow a person to
• access data or Resources without authorization, obtain Services without paying, bypass limits, or
• affect the availability or integrity of the Platform.

4. Acceptance, eligibility and conclusion of the contract

4.1 Acceptance. The Agreement is accepted by expressly confirming acceptance when creating an Account or placing an Order. If the Customer does not accept this Agreement, it must not use the Services.

4.2 How the contract is concluded. The technical steps are: (i) registration of the Account; (ii) creation of a Company; (iii) selection of a Service, plan and options in the Dashboard, where the price, taxes and main characteristics are shown before confirmation; (iv) review and correction of the data entered, which can be done at any time before confirming; and (v) confirmation of the Order. ArduMaker acknowledges each Order without undue delay through the Dashboard and, where relevant, by email. The current version of this Agreement is always available at ardumaker.com, and previous versions are provided on request.

4.3 Eligibility. To use the Services, the person accepting this Agreement must:

• (a) be at least 18 years old and have full legal capacity to contract;
• (b) not be subject to sanctions or restrictive measures of the European Union or the United
• Nations, nor act on behalf of a sanctioned person;
• (c) not have been previously banned from the Platform, unless ArduMaker has given written consent
• to a new registration; and
• (d) provide true, accurate, complete and up-to-date information.

4.4 Acting on behalf of an organisation. A person who accepts this Agreement on behalf of a company or other organisation declares that they have authority to bind it. In that case, the organisation is the Customer. If the person lacks such authority, they are personally bound by this Agreement.

4.5 Consumer or business status. The Customer must declare truthfully whether it acts as a Consumer or as a Business Customer and keep that information updated. A Company whose billing details include a company name or a VAT number is presumed to be acting as a Business Customer. Provisions that apply only to Consumers are expressly identified.

5. Nature of the Services and good faith

5.1 The Services. ArduMaker provides a platform that allows freelancers, development teams and companies to centralise their technical work, including: virtual private servers ("VPS") and their management tools (Docker, n8n, deploys from GitHub, domains and SSL, email on custom domains, PostgreSQL, MySQL, Redis, a database manager, a web terminal, services and scheduled tasks, automatic backups and SSH tunnels); the WhatsApp Business API; Router IA; the Search API; the ArduMaker MCP server and its tools for AI agents; projects, stages, tasks, meetings and calendar synchronisation; the school program; and custom software development. The specific conditions of each Service are set out in Annex B.

5.2 Self-service infrastructure. Unless an Individual Agreement expressly provides a managed service, the Services are self-service. The Customer receives real administrative (root) access to its servers and is their administrator. The tools of the Dashboard and the MCP server are shortcuts that execute actions requested by the Customer. They do not transfer to ArduMaker the administration of the software, data or configuration inside the Customer's servers.

5.3 Good faith. ArduMaker provides the Services in good faith: it describes them honestly, operates them with the diligence expected of a careful professional provider, and acts on the reasonable presumption that the Customer uses them in good faith and for lawful purposes. The Customer undertakes to act in the same way. In particular, the Customer shall not take advantage of errors, gaps, misconfigurations, pricing mistakes, unintended behaviours or Vulnerabilities of the Platform. Good faith is a guiding principle for the interpretation and performance of this Agreement.

5.4 Obvious errors. If a price, discount, promotion or characteristic is displayed with an obvious error (for example, a paid plan shown at zero cost or a discount that no promotion justifies), ArduMaker is not bound by it. ArduMaker will inform the Customer and offer either to continue at the correct price or to cancel the affected Order with a full refund of any amount paid for it.

5.5 Evolution of the Services. The Services evolve continuously. Features may be added, improved or withdrawn in accordance with Clause 27.

5.6 Preview features. Features labelled "beta", "preview", "sandbox", "test" or similar are offered to test and evaluate them. They may change or be discontinued at any time and must not be used for critical production workloads.

5.7 No professional advice. Outputs of AI models, search results, recommendations about plans and any other information provided through the Services are informative. They do not constitute legal, financial, security or other professional advice.

5.8 Serving the Customer's own clients. The Customer may use the Services to provide its own services to third parties, such as hosting a client's application. In that case the Customer remains ArduMaker's sole counterparty, is fully responsible for the acts of those third parties as if they were its own, and must ensure that they comply with the Terms of Use. White-label resale of access to the Platform itself requires ArduMaker's prior written consent.

6. Accounts, Companies and Authorized Users

6.1 Registration. The Customer must register with accurate information and update it within 15 days of any change, including contact email, billing details and consumer or business status.

6.2 Companies. An Account may create or join one or more Companies. Each Company has its own Resources, Authorized Users, roles, Balance, billing details and activity log. The Customer is the holder of the Companies it creates or whose billing details identify it. The transfer of a Company to another holder requires a request from the current holder and may require Verification.

6.3 Authorized Users. The Customer may invite Authorized Users and assign them roles. The Customer is responsible for: choosing whom it invites; assigning the minimum role each person needs; removing access without delay when a person no longer needs it; and every act of its Authorized Users as if it were its own.

6.4 Credentials. Each Account is personal and credentials must not be shared. Integrations must use bot accounts, API Credentials or OAuth authorizations, never a person's password. The Customer must keep all credentials confidential, rotate them when appropriate, use the security features that the Platform offers, and notify ArduMaker immediately, and in any case within 24 hours, of any suspected compromise, using the [SECURITY] tag.

6.5 Activity under the Account. Every action performed with the Customer's credentials, API Credentials or Agent authorizations is attributed to the Customer until the Customer reports their compromise, unless the action was caused by a failure of ArduMaker. The Platform's activity logs record who did what and when, and are used as evidence of the actions performed, without prejudice to proof to the contrary.

6.6 Multiple accounts. A person may hold more than one Account only for legitimate separate purposes. Creating or using several Accounts to evade limits, promotions, school quotas, the Authorized Negative Balance, a suspension, a ban or a debt is Abuse.

6.7 Inactive accounts. ArduMaker may close Accounts that have had no active Services, no Balance and no login for 24 consecutive months, after giving 30 days' notice by email.

7. Verification at any time

7.1 Right to request verification. ArduMaker may request additional verification at any time during the relationship ("Verification"). Verification may be requested, among other situations: at registration; before activating, upgrading or restoring a Service; when adding or changing a payment method; when topping up the Balance or requesting a refund; after an abuse report, a chargeback or a Security Incident; when activity is unusual for the Account; before releasing data, backups or the control of a Company; and to confirm eligibility for the school program, a promotion or a discount.

7.2 Means of verification. Depending on the situation and applying the principle of proportionality, ArduMaker may request one or more of the following:

• (a) an identity document, or verification through a trusted identity service;
• (b) proof of address;
• (c) documents proving the existence of the company and the powers of its representative, and a
• valid VAT number;
• (d) verification of the payment method, such as strong customer authentication, a small temporary
• charge or evidence that the Customer is the cardholder;
• (e) verification of a telephone number or email address;
• (f) a short video call;
• (g) a description of the intended use of the Services, or of a specific activity;
• (h) proof of control over a domain, a telephone number or an external account; and
• (i) proof of enrolment in a school or program, including linking an account of the school's system
• (for example, the 42 Intra).

7.3 Deadline. The Customer must provide the Verification within 7 calendar days of the request, unless ArduMaker sets a longer period. When there is an active security risk, a suspicion of fraud or a risk to third parties, ArduMaker may restrict the affected Account, Company or Resources while Verification is pending.

7.4 Consequences. If the Customer does not complete the Verification, provides false or inconsistent information, or refuses it, ArduMaker may: refuse or delay an Order; keep Resources paused; cancel promotions, discounts or school benefits; limit refunds to the original payment method; suspend the Account; or terminate the Agreement in accordance with Clause 21.

7.5 Safeguards. ArduMaker requests only what is necessary for the stated purpose, processes it in accordance with the Privacy Policy and keeps it only as long as that Policy allows. ArduMaker will never ask for passwords, full card numbers or card security codes by email, chat or telephone. Verification requests are sent from an @ardumaker.com address and can be confirmed through the Dashboard.

7.6 Scope. Verification protects the Platform, its Customers and third parties. Completing it does not mean that ArduMaker vouches for the Customer or its activities. Verification may be repeated when circumstances change.

8. Obligations of the Customer

The Customer shall:

• (a) use the Services lawfully, in good faith and in accordance with the Terms of Use;
• (b) provide true information and keep it updated;
• (c) pay all amounts due in accordance with the Payment Procedure, keeping sufficient Balance or a
• valid payment method;
• (d) secure its servers and applications: keep the software it installs updated, use strong
• credentials and SSH keys, open only the ports it needs and to whom it needs, and remove what it no
• longer uses;
• (e) keep its own independent backups of any data it cannot afford to lose, in particular database
• dumps, in addition to the backups included in the Services;
• (f) hold all rights, licences and consents required for Customer Content, including the licences
• of the software it installs;
• (g) comply with data protection law as the controller of Customer Data, including having a legal
• basis, informing its end users and answering their requests;
• (h) comply with the terms and policies of the Third-Party Services it uses, as set out in Clause
• 13;
• (i) supervise its Agents and authorize only the permissions they need, as set out in Clause 12;
• (j) report bugs, Vulnerabilities and billing errors in accordance with Clause 11;
• (k) answer abuse notices and remedy the issues within the deadlines set out in the Terms of Use;
• (l) cooperate with Verification requests in accordance with Clause 7;
• (m) keep its contact email reachable and read the notices sent to it;
• (n) respect the limits of each Service and not attempt to bypass them;
• (o) configure spending limits and alerts for usage-based Services when it wishes to control its
• costs;
• (p) ensure that its own clients, end users and Authorized Users comply with the Terms of Use; and
• (q) comply with applicable export control and sanctions law.

9. Obligations of ArduMaker

ArduMaker shall:

• (a) provide the Services in accordance with this Agreement and the characteristics shown in the
• Dashboard at the time of the Order, in good faith and with professional diligence;
• (b) implement and maintain appropriate technical and organisational security measures, as set out
• in Annex A;
• (c) keep the Resources of each Company logically isolated from those of other Companies;
• (d) perform the backups included in each Service, as described in Clause 15 and Annex B;
• (e) publish incidents that affect the Platform on the Status Page and keep it updated;
• (f) give notice of planned maintenance in accordance with Clause 14;
• (g) provide support during Business Hours, in accordance with Clause 14;
• (h) process personal data in accordance with the Privacy Policy and Annex A;
• (i) not access Customer Content except in the cases permitted by Clause 15.7 and Annex A;
• (j) notify the Customer without undue delay of any Security Incident affecting Customer Data;
• (k) bill transparently: show prices before confirmation, itemise charges, and issue invoices in
• accordance with the Payment Procedure;
• (l) give advance notice of price increases and material changes, in accordance with Clauses 16 and
• 27;
• (m) provide a statement of reasons for any restriction it imposes and allow the Customer to appeal
• it, in accordance with Clause 20 and the Terms of Use;
• (n) allow the Customer to export its data and switch provider, in accordance with Clause 22;
• (o) answer complaints within 15 Business Days, in accordance with Clause 29; and
• (p) comply with the laws that apply to it as a provider of digital and hosting services.

10. Allocation of responsibility

10.1 Principle. ArduMaker is responsible for the Platform: the infrastructure, the systems and the tools it operates. The Customer is responsible for everything it puts into, runs on, configures in and sends through the Platform. The following table sets out this allocation, area by area.

10.2 Where ArduMaker's responsibility ends. ArduMaker is not responsible for:

• (a) Customer Content, its lawfulness, accuracy or quality;
• (b) the configuration, security and operation of the software that the Customer installs or runs,
• including software installed through the Dashboard at the Customer's request;
• (c) access to the Customer's Resources obtained with credentials that the Customer or its
• Authorized Users disclosed, reused or failed to protect;
• (d) actions performed by Agents authorized by the Customer;
• (e) outages, changes of terms, prices or policies, suspensions or decisions of Third-Party
• Services, such as Meta blocking a WhatsApp number, a model being withdrawn by its provider or a
• registrar failing to renew a domain;
• (f) loss of data that the Customer did not back up independently, subject to Clause 15;
• (g) decisions made on the basis of AI outputs, search results or other information provided
• through the Services;
• (h) the consequences of a suspension or restriction applied in accordance with this Agreement;
• (i) the consequences of the Customer failing to read notices sent to its registered email or
• failing to keep its contact details updated; and
• (j) the functioning of the Internet and networks outside ArduMaker's control.

10.3 Where ArduMaker remains responsible. ArduMaker remains responsible for failures of the Platform attributable to it, for its own breaches of this Agreement and for its own processing of personal data, within the limits of Clause 24 and without limiting any liability that cannot be limited by law.

11. Bugs, errors and vulnerabilities: duty to report

11.1 Duty to report. The Customer and its Authorized Users must report to ArduMaker promptly, and in any case within 72 hours of becoming aware of it:

• (a) any Vulnerability of the Platform;
• (b) any access, even accidental, to data or Resources that do not belong to the Customer;
• (c) any metering or billing error, including errors in the Customer's favour, such as a Service
• that is not being charged, a promotion or discount applied incorrectly, or a Balance that
• increases without reason;
• (d) any behaviour that allows limits, quotas or restrictions to be bypassed; and
• (e) any other behaviour of the Platform that appears unintended and could affect security,
• integrity, availability, billing or other customers.

11.2 How to report. Reports are sent to developer@ardumaker.com with the [SECURITY] tag, or [BILLING] for billing errors, or through the bug-reporting function available in the Dashboard or the MCP server. A useful report describes the problem, the steps to reproduce it, the affected Resources, the date and time, and any evidence. Reports must not include third parties' personal data beyond what is strictly necessary.

11.3 Rules of conduct. Whoever finds a Vulnerability must: not exploit it beyond the minimum needed to confirm it; stop immediately if they reach data of others, and not copy, keep or disclose that data; not disclose the Vulnerability publicly until it is fixed or until 90 days have passed since the report, whichever comes first, unless ArduMaker agrees otherwise; and follow the rules on security testing of the Terms of Use.

11.4 Safe harbour. ArduMaker will not take legal action against, nor suspend the Account of, a person who discovers and reports a Vulnerability in good faith and in compliance with this Clause and the Terms of Use. This safe harbour does not cover testing of third-party systems, which ArduMaker cannot authorise.

11.5 Exploitation is Abuse. Using a bug, error or Vulnerability to obtain an advantage, or knowingly failing to report it, is serious Abuse. In that case ArduMaker may, in addition to the measures of the Terms of Use: reverse credits, discounts or Resources obtained through it; charge the amounts that would have been due; suspend or terminate the Agreement; and claim compensation for the damage caused.

11.6 Correction of billing errors. When amounts were not charged or were charged incorrectly because of a technical error, ArduMaker may correct them with prior notice and an itemised explanation. If the Customer neither caused nor knowingly took advantage of the error, the correction covers at most the 90 days preceding the notice, and the Customer may choose to pay the difference in instalments over up to three months or to cancel the affected Service. Amounts charged in excess are returned to the Balance or, at the Customer's request, to the original payment method.

11.7 ArduMaker's commitments. ArduMaker acknowledges receipt of each report within 3 Business Days, keeps the reporter informed of its progress, fixes the issue within a period proportionate to its severity, and notifies the affected customers and authorities when required. ArduMaker may, at its discretion, recognise valuable reports with credits or public thanks, but it does not run a bug bounty program and has no obligation to reward reports.

12. AI agents, MCP and automated access

12.1 Connection of Agents. The ArduMaker MCP server and the APIs allow the Customer to connect Agents to its Account through a standard OAuth authorization or API Credentials, within the scope the Customer grants.

12.2 Agents act on behalf of the Customer. Authorizing an Agent is a mandate given by the Customer. Every action that an Agent performs with that authorization is deemed performed by the Customer, including irreversible actions (such as deleting a server, a database or a domain) and actions that generate costs (such as creating Resources, sending messages or consuming usage-based Services).

12.3 Customer duties regarding Agents. The Customer must: grant each Agent the minimum scope it needs; review and confirm irreversible or costly actions before the Agent performs them; monitor the activity log; and revoke authorizations that are no longer needed. The Customer acknowledges that content returned by tools, such as emails, logs, commit messages or command outputs, may contain instructions written by third parties that attempt to manipulate the Agent ("prompt injection"). ArduMaker marks such content as untrusted, but cannot guarantee how an Agent will behave.

12.4 ArduMaker's role. ArduMaker provides the authorization and revocation mechanisms, the activity log of every action and the labelling of untrusted content. ArduMaker is not responsible for the decisions or behaviour of Agents, nor for the processing that the Agent's provider performs on the data the Agent receives, which the Customer chooses to share with that provider under its own relationship with it.

12.5 Other automated access. Automated access to the Platform is permitted only through the APIs and the MCP server, within their rate limits. Scraping the Dashboard or automating it through other means is prohibited.

13. Third-Party Services

13.1 Integrations. Some Services depend on or integrate Third-Party Services, including: payment processing (Stripe); WhatsApp messaging (Meta and Twilio); AI models (OpenRouter and the model providers it routes to); web search and extraction (Tavily); calendar synchronisation (Google); source code repositories (GitHub); SSL certificates (Let's Encrypt); AI assistants authorized by the Customer; and infrastructure and data centre providers.

13.2 Third-party terms. When the Customer uses a Service that integrates a Third-Party Service, it must also comply with that third party's terms and policies that apply to its use, including the WhatsApp Business Messaging Policy and Commerce Policy, the usage policies of AI model providers, the Let's Encrypt Subscriber Agreement and the GitHub terms.

13.3 Independence of third parties. Third-Party Services are provided by their respective owners. ArduMaker does not control them and is not responsible for their availability, changes, prices, policies or decisions. Where a third party changes its prices, ArduMaker may pass the change on, and the price applicable is the one shown in the Dashboard at the time of use.

13.4 Changes to integrations. ArduMaker may replace a Third-Party Service provider, or modify or discontinue an integration, when the provider changes its terms or prices, ends its service, or for legal or security reasons. ArduMaker will give notice as early as reasonably possible.

13.5 Open-source software. Software installed through the Dashboard, such as Docker, n8n, PostgreSQL, MySQL, Redis, Nginx or WordPress, is provided by third parties under their own licences. ArduMaker installs it as a convenience, without warranty regarding that software. The Customer must comply with those licences, including any restriction on commercial use, such as the licence terms of n8n.

14. Availability, maintenance and support

14.1 Availability. ArduMaker operates the Platform to achieve high availability and publishes measured availability on the Status Page for information purposes. Unless an Individual Agreement provides otherwise, ArduMaker does not commit to a service level agreement (SLA) and does not grant automatic service credits.

14.2 Planned maintenance. When planned maintenance is expected to interrupt a Service, ArduMaker gives at least 48 hours' notice through the Dashboard, the Status Page or email, and performs it, where possible, at times of low activity.

14.3 Emergency maintenance. ArduMaker may carry out urgent maintenance without prior notice when necessary to protect the security or integrity of the Platform, the Customer or third parties. It will inform the Customer as soon as possible.

14.4 Support. Support is provided by email and the other channels shown on the website, during Business Hours. ArduMaker aims to give a first response within one Business Day. Support covers the functioning of the Platform, access and billing. It does not cover debugging the Customer's code, administering software beyond the features of the Dashboard, or recovering data deleted by the Customer other than from the included backups. Those services can be contracted as custom development.

14.5 Access by support staff. ArduMaker staff access a Customer's server only at the Customer's request or with its authorization, or in the cases of Clause 15.7. Such access is recorded.

15. Backups and Customer Data

15.1 Ownership. The Customer keeps ownership and control of Customer Content and Customer Data.

15.2 Included backups. Each VPS includes an automatic backup every 7 days, taken from a live snapshot without stopping the server. The last 4 copies are kept. Each copy includes the instance, its port forwards and plan limits, the Nginx configuration, the certificates of the Customer's own domains, a manifest and checksums, and restore instructions. Copies are stored on infrastructure separate from the host that runs the server.

15.3 Limitations of included backups. The Customer acknowledges that: copies are consistent at disk level, not at application level, so a database may need recovery on restore; the Customer must schedule its own database dumps; certificates of platform domains are not included; ArduMaker does not guarantee that a copy exists for a specific moment or that every restore will succeed; and an included backup is not a substitute for the Customer's own backups.

15.4 Final copy on deletion. When the Customer deletes a VPS, a final copy is made before deletion. If the final copy fails, the VPS is not deleted. The final copy is kept while the Account remains open, and the Customer may request its download or its erasure. After closure of the Account, Clause 22 applies. For servers deleted due to Default, the Payment Procedure applies.

15.5 Irreversible actions. Actions performed by the Customer, its Authorized Users or its Agents, such as deleting a server, dropping a database or deleting a domain together with its mailboxes, may be irreversible. ArduMaker is not obliged to recover data deleted in that way beyond the included backups.

15.6 Data location. Customer servers are hosted in data centres located in the European Economic Area. The location is shown when creating the server. Transfers to Third-Party Services located elsewhere are described in the Privacy Policy and Annex A.

15.7 Access to Customer Content by ArduMaker. ArduMaker does not access Customer Content except: (a) when the Customer requests or authorizes it, for example for support; (b) through the automated processes needed to provide the Service, such as backups, deploys, monitoring of resource usage or delivery of messages; (c) when strictly necessary to investigate Abuse, a Security Incident or a risk to the Platform or third parties; or (d) when required by law or by an order of a competent authority. Access under (c) and (d) is limited to what is necessary, recorded, and communicated to the Customer unless the law or the investigation prevents it.

16. Fees and payment

16.1 Fees. The fees for each Service are those shown in the Dashboard at the time of the Order. The Payment Procedure governs billing, collection, credits, refunds and Default, and forms part of this Agreement.

16.2 Main rules. In summary: each Company has its own Balance; fixed monthly fees are charged on the 1st of each month and prorated by day when a Service starts or ends mid-month; usage-based Services are charged as consumed; if the Balance is insufficient, it may become negative up to the Authorized Negative Balance, and beyond that limit the registered payment method is charged automatically.

16.3 Default. If a debt cannot be collected, ArduMaker retries the charge, pauses all the Services of the Company after three consecutive failed attempts and deletes them after 25 days in Default, as set out in the Payment Procedure. The debt remains due after deletion.

16.4 Taxes. Prices shown to Consumers include all applicable taxes. Taxes are applied according to the Customer's status and location and are shown before confirmation.

16.5 Price changes. ArduMaker gives at least 30 days' notice of any increase in the fixed monthly fees of Services already contracted. The Customer may cancel the affected Services before the new price applies, without any charge other than the Services used. Usage-based prices that depend on third parties follow the Payment Procedure.

17. Intellectual property

17.1 ArduMaker's property. The Platform, its software, design, documentation, trademarks, logos and content, and all related intellectual property rights, belong to ArduMaker or its licensors.

17.2 Licence to use. Subject to this Agreement, ArduMaker grants the Customer a non-exclusive, non-transferable, non-sublicensable and revocable licence to use the Platform for the duration of the Agreement, solely to use the Services.

17.3 Restrictions. The Customer shall not: copy, modify or create derivative works of the Platform; decompile or reverse engineer it, except to the extent expressly permitted by law; remove proprietary notices; frame or mirror the Platform; or use it to build a competing service by copying its features, interfaces or content.

17.4 Customer Content. The Customer keeps all rights over Customer Content. The Customer grants ArduMaker a worldwide, non-exclusive, royalty-free licence to host, copy, back up, transmit, display and process Customer Content only to the extent necessary to provide, secure and support the Services and to comply with the law. This licence ends when Customer Content is deleted, except for copies kept in backups until their rotation and copies that must be kept by law.

17.5 Feedback. If the Customer sends suggestions or feedback, ArduMaker may use them freely and without obligation.

17.6 Trademarks and references. The Customer may state truthfully that it uses ArduMaker. ArduMaker may mention the Customer or its projects as a reference or in its portfolio only with the Customer's prior consent.

17.7 Custom development. The intellectual property of deliverables created under custom development is governed by the proposal or statement of work. Unless it provides otherwise: (a) after full payment, the Customer becomes the owner of the deliverables created specifically for it; (b) ArduMaker keeps its pre-existing materials, tools, libraries and know-how, and grants the Customer a perpetual, non-exclusive licence to use those incorporated in the deliverables; and (c) open-source components remain subject to their own licences.

18. Confidentiality

18.1 Obligation. Each party shall keep confidential the non-public information of the other party that it receives in connection with this Agreement and that is marked as confidential or should reasonably be understood as such, and shall use it only to perform this Agreement.

18.2 Exceptions. The obligation does not apply to information that is or becomes public without breach, that the receiving party already knew or developed independently, or that it receives lawfully from a third party without a duty of confidentiality.

18.3 Compelled disclosure. A party may disclose confidential information when required by law or by a competent authority, limiting disclosure to what is required and, where allowed, informing the other party in advance.

18.4 Duration. This obligation survives for 3 years after the end of the Agreement, and indefinitely for trade secrets and for credentials.

19. Data protection

19.1 ArduMaker as controller. ArduMaker processes the personal data of the Customer, its Authorized Users and its contacts as a controller, in accordance with the Privacy Policy.

19.2 ArduMaker as processor. When ArduMaker processes Customer Data on behalf of the Customer, it acts as a processor and Annex A applies. Annex A forms part of this Agreement and fulfils the requirements of Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

19.3 Customer as controller. The Customer is the controller of Customer Data and is responsible for its lawfulness, for informing data subjects and for answering their requests.

19.4 Suitability for regulated data. The Customer is responsible for assessing whether the Services are suitable for special categories of personal data or for sector-specific regulations. The Customer must not store full payment card data on the Services unless it ensures compliance with the PCI DSS standard itself.

20. Suspension and restriction

20.1 Grounds. ArduMaker may suspend or restrict, in whole or in part, the Account, a Company or specific Resources when:

• (a) the Customer is in Default, in accordance with the Payment Procedure;
• (b) the Customer commits Abuse or breaches the Terms of Use, in accordance with the response
• matrix set out in them;
• (c) there is a security risk for the Platform, other customers or third parties, for example a
• compromised server attacking other systems;
• (d) the Customer fails to complete a Verification;
• (e) required by law or by an order of a competent authority;
• (f) required by a Third-Party Service provider for the specific integration concerned;
• (g) there are reasonable indications of fraud; or
• (h) the registration information is false or inaccurate.

20.2 Proportionality. ArduMaker applies the least restrictive measure that is effective. Where possible, it restricts the specific Resource concerned (a port, an IP, email sending, an API key, a number) before the whole Company or the Account, and only for as long as necessary.

20.3 Prior notice. When possible, ArduMaker notifies the Customer before the measure and gives it a deadline to remedy, in accordance with the Terms of Use. ArduMaker may act without prior notice when there is ongoing harm, serious or critical Abuse, a legal order, or a risk of fraud or of destruction of evidence. In that case it notifies the Customer immediately after acting.

20.4 Statement of reasons. Each restriction is communicated with a clear and specific statement of reasons that indicates: the measure adopted, its duration and, where relevant, its territorial scope; the facts and circumstances on which it is based; whether automated means were used to detect or decide it; where the measure concerns allegedly illegal content, the legal ground and why the content is considered illegal, and otherwise the contractual ground and why the conduct is considered incompatible with it; and the means of redress available.

20.5 Fees during suspension. A suspension caused by the Customer's breach does not suspend its payment obligations for Resources that remain reserved.

20.6 Reinstatement and appeal. ArduMaker lifts the measure when its cause has been removed. The Customer may appeal any measure in accordance with the Terms of Use.

20.7 No liability. ArduMaker is not liable for the consequences of a suspension or restriction applied in accordance with this Agreement.

21. Term, cancellation and termination

21.1 Term. The Agreement is concluded for an indefinite period. Each Service is contracted month to month with no minimum term, unless the Order or an Individual Agreement states otherwise.

21.2 Cancellation by the Customer. The Customer may delete any Service at any time from the Dashboard, and receives a proportional credit in accordance with the Payment Procedure. The Customer may close its Account after deleting its Services and settling its debts. Consumers also have the right of withdrawal described in the Payment Procedure.

21.3 Termination by ArduMaker for convenience. ArduMaker may terminate the Agreement, or discontinue a Service, by giving at least 30 days' notice. During that notice period the Customer can use its remaining Balance on its other Services, and ArduMaker assists the Customer in exporting its data in accordance with Clause 22. The Balance is not paid back in cash, as set out in Section 12 of the Payment Procedure.

21.4 Termination for cause. ArduMaker may terminate the Agreement with immediate effect, or with the notice it considers appropriate, when: the Customer commits serious or critical Abuse; the Customer repeatedly breaches this Agreement; there is fraud or false information; debts remain unpaid after the Services have been deleted due to Default; the Customer does not complete a Verification within the deadline; a competent authority orders it; or a Business Customer becomes insolvent. The Customer may terminate the Agreement for cause if ArduMaker materially breaches it and does not remedy the breach within 15 days of being notified.

21.5 Effects. When the Agreement ends: access to the Services ends; the Services are deleted after the retrieval period of Clause 22, except in the cases of Clause 22.5; all outstanding amounts become due immediately; the Balance is handled in accordance with the Payment Procedure; and the clauses that by their nature must survive remain in force, including Clauses 11, 17, 18, 24, 25, 29 and 30.

21.6 Deleting a Company can be undone. Deleting a Company does not erase it. The Company is marked as deleted, disappears from the Dashboard and stops operating, and can be restored for 30 days from the Dashboard by any of its administrators.

• (a) What comes back. The Company, its members, its billing history, its invoices and its
• Balance, exactly as they were.
• (b) What does not come back. The Services. Servers, databases, domains and mailboxes are
• deleted for real when the Company is deleted, and restoring the Company does not recreate them.
• What is restored is the Company, not what was running inside it. The final copies of Clause 15.4
• are the way to get the contents of a server back.
• (c) After 30 days. The Company can no longer be restored by the Customer. It is still not
• erased: the invoices and the accounting records are kept for the period required by law, as set
• out in the Privacy Policy. ArduMaker can restore it beyond that period at its discretion.
• (d) Companies deleted by ArduMaker. A Company whose Services were deleted for Default, or that
• was restricted for a failed Verification, stays visible so that the Customer can settle what is
• owed or complete what was asked. Paying the Debt in full restores it automatically (Payment
• Procedure, Section 11); completing a pending Verification lets ArduMaker restore it. Neither case
• is a permanent erasure, and neither happens without the reasons being communicated (Clause 20).

22. Data retrieval, export and switching

22.1 Export at any time. While the Services are active, the Customer can export its data at any time: through root access to its servers, the backup downloads available in the Dashboard, database dumps, IMAP access to mailboxes, the APIs and the export functions of the Dashboard.

22.2 Exportable data and digital assets. The exportable data and digital assets are the following: (i) full server images and backup archives, including files, application data and databases stored on the servers; (ii) the Nginx configuration and the certificates of the Customer's own domains; (iii) the DNS records managed on the Platform; (iv) mailboxes and their messages; (v) the WhatsApp conversation history kept on the Platform; (vi) project data (projects, stages, tasks, checklists, comments, attachments and meetings); and (vii) the usage and billing records of the Company. The following are excluded because they are ArduMaker's own assets or because their export would compromise security or the rights of others: the Platform's software and internal configuration; IP addresses and platform subdomains; ArduMaker's internal security logs; and data of other customers.

22.3 Switching. In accordance with Regulation (EU) 2023/2854 (the "Data Act"), the Customer may request to switch to another provider or to its own infrastructure, or to erase all its exportable data, by giving notice of up to 2 months. After the notice period, ArduMaker provides a transitional period of up to 30 calendar days, during which it gives reasonable assistance and maintains the continuity of the Services, and a subsequent data retrieval period of at least 30 calendar days. If the transitional period is technically unfeasible, ArduMaker will inform the Customer within 14 working days and propose an alternative period, which may not exceed 7 months. The Customer may extend the transitional period once, for a period it considers more appropriate. ArduMaker informs the Customer of any known risk to the continuity of the Services during the switching and of the security measures applied. The Agreement is deemed terminated, for the Services concerned, when the switching is successfully completed or, if the Customer asked only for the erasure of its data, at the end of the notice period. ArduMaker does not charge switching or data egress fees for the exercise of these rights, other than the regular fees of the Services that remain active.

22.4 Retrieval after termination. When the Agreement ends for any reason other than those in Clause 22.5 or Default, the Customer has a retrieval period of 30 calendar days to download its data. When the end is due to Default, the Payment Procedure applies.

22.5 Exceptions. No retrieval period applies to content whose retention or delivery is prohibited by law or by an order of a competent authority, such as child sexual abuse material or content subject to a seizure order.

22.6 Erasure. After the retrieval period, ArduMaker erases the Customer's exportable data, including the final copies. Copies kept in backups are erased within at most 35 days. ArduMaker keeps only the data it must retain by law, as set out in the Privacy Policy.

23. Warranties and statutory rights

23.1 ArduMaker's warranty. ArduMaker warrants that it will provide the Services with reasonable skill and care and in conformity with this Agreement.

23.2 Consumers. Consumers benefit from the legal guarantee of conformity of digital services under Decree-Law 84/2021 and other applicable law, including the rights to have the Service brought into conformity, to a price reduction and to terminate the contract. Nothing in this Agreement limits those rights.

23.3 Exclusions. To the extent permitted by law, and without prejudice to Clause 23.2, ArduMaker does not warrant that the Services will be uninterrupted or error-free, that they will be fit for a particular purpose not agreed in writing, that the outputs of AI models or search results will be accurate or complete, or that third-party software will function correctly.

23.4 Customer's warranties. The Customer warrants that: it has authority to accept this Agreement; it holds the rights over Customer Content; its use of the Services is lawful; and the information it provides is true.

24. Limitation of liability

24.1 General rule. Each party is liable for the damage caused by its breach of this Agreement, subject to this Clause.

24.2 Liability that is never limited. Nothing in this Agreement excludes or limits liability for: (a) intentional misconduct (dolo) or gross negligence; (b) death or personal injury; (c) breach of mandatory rules protecting Consumers; or (d) any other liability that cannot be excluded or limited by law, including under Article 18 of Decree-Law 446/85.

24.3 Excluded damage. Subject to Clause 24.2, ArduMaker is not liable to Business Customers for: loss of profits, revenue, business, contracts, goodwill or anticipated savings; indirect or consequential damage; the cost of substitute services; loss or corruption of data, except the reasonable cost of restoring it from the latest available backup when the loss was caused by ArduMaker; or damage arising from the circumstances listed in Clause 10.2.

24.4 Cap. Subject to Clause 24.2, ArduMaker's total aggregate liability to a Business Customer for all claims arising in any period of 12 months is limited to the greater of: (i) the amounts actually paid by the Customer for the affected Company during the 12 months before the event giving rise to the claim; and (ii) one hundred euros (EUR 100).

24.5 Consumers. ArduMaker's liability to Consumers is that provided by law. Clauses 24.3 and 24.4 apply to Consumers only to the extent permitted by the mandatory rules that protect them.

24.6 Customer's liability. The Customer is liable to ArduMaker for the damage caused by its breach, including the reasonable and documented costs of handling Abuse, of removing ArduMaker's addresses or domains from blocklists, of third-party claims, and of fines or sanctions imposed on ArduMaker because of Customer Content or activity. The cap of Clause 24.4 does not apply to the Customer's liability for Abuse, fraud, infringement of third-party rights, indemnification or payment obligations.

24.7 Claims by Business Customers. A Business Customer must notify any claim within 12 months of becoming aware of the facts that give rise to it.

25. Indemnification

25.1 Obligation. The Business Customer shall indemnify and hold harmless ArduMaker, its directors, employees and subcontractors against any claim, damage, fine, cost and reasonable legal fees arising from: Customer Content; the use of the Services by the Customer, its Authorized Users, its Agents or its own clients in breach of this Agreement or of the law; or the infringement of third-party rights by Customer Content.

25.2 Procedure. ArduMaker shall notify the Customer of the claim promptly, allow it to take part in the defence and cooperate reasonably. No settlement that imposes obligations on ArduMaker may be agreed without its consent.

25.3 Consumers. Consumers are liable in accordance with the law.

26. Force majeure

26.1 Events. Neither party is liable for delays or failures caused by events beyond its reasonable control, including natural disasters, fire, flood, epidemics, war, terrorism, riots, general strikes, acts of authorities, sanctions, failures of the electricity grid or of Internet backbones, failures of upstream data centre or network providers not caused by the affected party, and large-scale attacks that could not be reasonably prevented.

26.2 Effects. The affected party shall notify the other as soon as possible and take reasonable steps to mitigate the effects. Obligations are suspended while the event lasts. If it lasts more than 30 days, either party may terminate the affected Services, and ArduMaker refunds the prepaid fees for the period not provided. Force majeure does not release the Customer from paying for the Services actually provided.

27. Changes to the Services and to these Terms

27.1 Changes to the Services. ArduMaker may add, modify or remove features. When a change materially reduces the functionality of a paid Service or adversely affects the Customer, ArduMaker gives at least 30 days' notice. Consumers may terminate the affected Service free of charge within 30 days of the notice or of the change, whichever is later, in accordance with applicable law.

27.2 Changes to the Terms. ArduMaker may modify this Agreement for legal, regulatory, security, commercial or technical reasons. Changes that are materially adverse to the Customer are notified by email and in the Dashboard at least 30 days before they take effect. Changes that are favourable to the Customer, minor, or required by law or by an authority may take effect earlier. The Customer may terminate the Agreement before the changes take effect. A Business Customer that continues to use the Services after the effective date accepts the changes. Consumers are asked to accept materially adverse changes expressly; if a Consumer does not accept them, it may terminate the Agreement free of charge, and ArduMaker may terminate it by giving 30 days' notice.

27.3 Previous versions. Every version indicates its effective date. ArduMaker keeps previous versions and provides them on request.

28. Notices and communications

28.1 To the Customer. ArduMaker sends notices to the email address of the Account holder or of the Company's billing contact, and may also publish them in the Dashboard. An email notice is deemed received when it is delivered to the recipient's mail server, unless ArduMaker receives a delivery failure. The Customer must keep those addresses working and read the notices sent to them.

28.2 To ArduMaker. The Customer sends notices to developer@ardumaker.com using the tags of Clause 1.2. Legal notices must use the [LEGAL] tag.

28.3 Electronic communications. The parties agree that communications, notices, invoices and documents may be delivered electronically, and that emails and documents stored in the Dashboard constitute a durable medium.

28.4 Language. This Agreement may be offered in several languages. If there is a discrepancy, the English version prevails, except where the law of a Consumer's country requires a version in another language, in which case that version prevails to that extent.

29. Complaints and dispute resolution

29.1 Complaints. The Customer may submit any complaint to developer@ardumaker.com using the [LEGAL] tag. ArduMaker answers within 15 Business Days.

29.2 Complaints book. Consumers and customers may also use the electronic complaints book (Livro de Reclamações Eletrónico) at https://www.livroreclamacoes.pt.

29.3 Alternative dispute resolution for Consumers. In case of a consumer dispute, the Consumer may use the competent consumer dispute resolution entities, including CICAP – Tribunal Arbitral de Consumo (https://www.cicap.pt) and CNIACC – Centro Nacional de Informação e Arbitragem de Conflitos de Consumo (https://www.cniacc.pt). More information is available on the Portal do Consumidor (https://www.consumidor.gov.pt).

29.4 Negotiation between businesses. Before starting court proceedings, a Business Customer and ArduMaker shall try to resolve the dispute through good-faith negotiation for at least 30 days from the written notice of the dispute, without prejudice to urgent interim measures.

30. Governing law and jurisdiction

30.1 Governing law. This Agreement is governed by Portuguese law, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods.

30.2 Consumers. A Consumer keeps the protection of the mandatory provisions of the law of the country of its habitual residence. A Consumer resident in the European Union may bring proceedings before the courts of its domicile or of Portugal, and may be sued only before the courts of its domicile. Consumers resident outside the European Union keep the mandatory consumer protections of their country to the extent applicable.

30.3 Business Customers. For disputes with Business Customers, the courts of Porto, Portugal, have exclusive jurisdiction. ArduMaker may also bring claims for unpaid amounts before the courts of the Customer's domicile.

31. General provisions

31.1 Entire agreement. This Agreement is the entire agreement between the parties regarding its subject matter and replaces any previous agreement on the same subject.

31.2 Severability. If a clause is held invalid or unenforceable, the remaining clauses remain in force, and the invalid clause is replaced by a valid one whose effect is as close as possible to the original intention.

31.3 No waiver. Failure or delay in exercising a right does not constitute a waiver of it.

31.4 Assignment. The Customer may not assign the Agreement without ArduMaker's prior written consent. ArduMaker may assign it to a company of its group or to a successor in the event of a merger, acquisition or transfer of business, with notice to the Customer. Consumers may terminate the Agreement if the assignment reduces their guarantees.

31.5 Subcontracting. ArduMaker may use subcontractors to provide the Services and remains responsible for them, subject to Annex A.

31.6 Independent parties. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship between the parties.

31.7 Third parties. Nobody other than the parties has rights under this Agreement.

31.8 Interpretation. Headings are for convenience only. The word "including" means "including without limitation".

31.9 Evidence. The records of the Platform, including activity logs, metering and timestamps, are admissible as evidence of the actions performed and of the Services consumed, without prejudice to proof to the contrary.

Annex A — Data Processing Terms

A.1 Scope and roles. This Annex applies when ArduMaker processes Customer Data on behalf of the Customer. The Customer is the controller, or a processor acting on behalf of its own client, and ArduMaker is the processor or sub-processor. This Annex prevails over the rest of the Agreement regarding that processing.

A.2 Details of the processing.

A.3 Instructions. ArduMaker processes Customer Data only on documented instructions of the Customer. The Agreement, the configuration of the Services and the actions performed by the Customer, its Authorized Users and its Agents constitute the Customer's instructions. ArduMaker informs the Customer if, in its opinion, an instruction infringes data protection law. If the law requires ArduMaker to process Customer Data otherwise, it informs the Customer beforehand, unless the law prohibits it.

A.4 Confidentiality. ArduMaker ensures that persons authorized to process Customer Data are bound by confidentiality obligations.

A.5 Security. ArduMaker implements appropriate technical and organisational measures under Article 32 GDPR, which include: logical isolation between Companies; encryption in transit of the Dashboard and APIs; access to production systems limited to authorized personnel on a need-to-know basis and recorded; one-way hashing of Account passwords; mailbox passwords not stored in ArduMaker's database; API Credentials that are never exposed in logs and can be revoked at once; tokenized, expiring URLs for WhatsApp media; weekly backups stored on separate infrastructure, with integrity verification; monitoring of the Platform; and an incident response procedure. The Customer is responsible for the security of everything inside its servers and applications, in accordance with Clause 10.

A.6 Sub-processors. The Customer gives ArduMaker a general authorization to engage sub-processors. The list of current sub-processors is available in the Privacy Policy or on request. ArduMaker gives at least 30 days' notice, by email or in the Dashboard, of any intended addition or replacement. The Customer may object on reasonable data protection grounds within 15 days of the notice. If the parties cannot find a solution, the Customer may terminate the affected Service without penalty before the change takes effect. ArduMaker imposes on each sub-processor data protection obligations equivalent to those of this Annex and remains responsible for their performance.

A.7 International transfers. ArduMaker transfers Customer Data outside the European Economic Area only when a safeguard of Chapter V GDPR applies, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the standard contractual clauses approved by the European Commission.

A.8 Assistance with data subject requests. The Services give the Customer the means to access, correct, export and erase Customer Data. If ArduMaker receives a request from a data subject concerning Customer Data, it forwards it to the Customer without undue delay and does not answer it except on the Customer's instructions. ArduMaker gives reasonable additional assistance where needed.

A.9 Other assistance. Taking into account the information available to it, ArduMaker assists the Customer with its obligations regarding security, notification of breaches, data protection impact assessments and prior consultation with supervisory authorities.

A.10 Personal data breaches. ArduMaker notifies the Customer of any personal data breach affecting Customer Data without undue delay and, where feasible, within 48 hours of becoming aware of it. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. ArduMaker provides further information as it becomes available.

A.11 Return and erasure. At the end of the Services, the Customer may retrieve Customer Data in accordance with Clause 22. After that, ArduMaker erases it, unless the law requires its retention.

A.12 Audits. ArduMaker makes available the information necessary to demonstrate compliance with this Annex. The Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, at most once every 12 months, with at least 30 days' notice, during Business Hours, at its own cost and without disrupting the Services or compromising the security or confidentiality of other customers. Audits required by a supervisory authority or after a personal data breach are not subject to the annual limit.

A.13 Requests from authorities. If an authority requests access to Customer Data, ArduMaker informs the Customer, unless prohibited by law, discloses only the minimum required, and challenges the request where it has reasonable grounds to consider it unlawful.

A.14 Liability. Each party is liable in accordance with Article 82 GDPR and Clause 24.

Annex B — Service-Specific Conditions

The following conditions apply to each Service in addition to the rest of the Agreement. Prices, limits and resources are those shown in the Dashboard at the time of the Order.

B.1 VPS

B.1.1 Resources. Each plan allocates the vCPU, memory and NVMe disk shown in the Dashboard. There are no hidden quotas on inodes, processes or traffic. The Customer must nevertheless not use its server in a way that deliberately degrades the host or the network for other customers, in accordance with the Terms of Use.

B.1.2 Root access and operating system. The server is delivered with Linux, root access over SSH and the base tooling of the Platform installed. From delivery onwards, its administration belongs to the Customer.

B.1.3 Network. Ports are closed by default. The Customer decides which ports to open and to whom. IP addresses, port forwards and platform subdomains remain the property of ArduMaker and are assigned to the Customer only for the duration of the Service.

B.1.4 Platform components. The Customer must not disable, modify or interfere with the components the Platform needs to operate the Service, such as those used for backups, metrics, deploys or the Dashboard. If it does, the affected features may stop working, and ArduMaker is not responsible for the consequences.

B.1.5 Web terminal. Commands executed through the web terminal or through the MCP server run with the privileges of the chosen system user and are recorded in the command history of the server.

B.1.6 Plan changes. The Customer may change plan from the Dashboard. The new price applies from the moment of the change and is prorated in accordance with the Payment Procedure.

B.2 Automatic backups

Clause 15 applies. Backup archives can be downloaded from the Dashboard while they are kept. Each copy includes restore instructions written for the specific server.

B.3 Deploys from GitHub

By linking a repository, the Customer authorizes ArduMaker to access it only to clone, build and publish it on the Customer's server, and to show its commits and logs. The Customer is responsible for the code, its dependencies, its licences, the secrets it contains and the result of each deploy. The Customer may unlink the repository at any time.

B.4 Docker, n8n and other installable software

Clause 13.5 applies. Installation, updates and rollbacks offered by the Dashboard are conveniences and do not transfer to ArduMaker the administration of that software.

B.5 Domains and SSL

B.5.1 Platform subdomains. Subdomains of domains owned by ArduMaker (such as arducloud.com) are provided for the duration of the Service, cannot be transferred and may be withdrawn in case of Abuse or at the end of the Service.

B.5.2 Customer domains. The Customer must own or control the domains it connects. Unless the Dashboard expressly states otherwise, ArduMaker is not a domain registrar, and the registration, renewal and ownership of domains remain the Customer's responsibility with its registrar.

B.5.3 Certificates. SSL certificates are issued and renewed automatically through Let's Encrypt, subject to its terms. Certificates are recorded in public Certificate Transparency logs, so the domain names they cover become public.

B.6 Email on the Customer's domain

B.6.1 Activation. A domain is activated only after its DNS records (MX, SPF, DKIM and DMARC) are verified.

B.6.2 Limits. Sending is limited to 5 emails per minute per account; messages above that rate are queued. Attachments are limited to 25 MB per email. Mailbox quotas are those configured in the Dashboard.

B.6.3 Credentials. Mailbox passwords are transmitted to the mail server and are not stored in ArduMaker's database. Bot accounts are accessed with tokens that the Customer can regenerate at any time.

B.6.4 Deletion. Temporary aliases expire automatically. Deleting a domain deletes all its accounts and messages and cannot be undone.

B.6.5 Sending rules. The Customer may send only lawful email to recipients who have consented or with whom it has a relationship that allows it. ArduMaker may throttle or suspend sending in case of spam complaints, blocklisting or a compromised account, in accordance with the Terms of Use.

B.7 Databases and database manager

PostgreSQL, MySQL and Redis are installed and run on the Customer's server. The Customer is responsible for their credentials, their configuration, its own dumps and every query executed through the database manager, including destructive queries. Database credentials that the Customer chooses to save in the Dashboard are kept to operate the manager and are protected by the Platform's security measures.

B.8 Services, scheduled tasks and SSH tunnels

The Customer is responsible for the services and scheduled tasks it creates and for what they execute. SSH tunnels must not be used to bypass the network restrictions of third parties or to expose services unlawfully. The Customer is responsible for the keys it authorizes for each tunnel.

B.9 WhatsApp Business API

B.9.1 Providers. The Service connects the Customer to WhatsApp through Meta and Twilio. Meta may require the verification of the Customer's business.

B.9.2 Meta policies. The Customer must comply with the WhatsApp Business Terms, the WhatsApp Business Messaging Policy and the Commerce Policy, including obtaining the recipient's opt-in, respecting the 24-hour customer service window and using templates approved by Meta outside that window.

B.9.3 Decisions of Meta. Meta may reject templates, lower the quality rating of a number, limit its sending or block it. ArduMaker is not responsible for those decisions, although it will assist the Customer within its possibilities.

B.9.4 Webhooks and history. Events are delivered to the Customer's endpoint in the chosen mode (instant, debounce or interval). The Customer is responsible for the availability of its endpoint. Conversation history is kept on the Platform. Messages sent directly through the Twilio API with the Customer's own credentials are not synchronised with the Platform.

B.9.5 Media and transcription. Media files are served through tokenized URLs that expire. Voice notes may be transcribed automatically with AI to show their text on the Platform.

B.9.6 Charges and limits. Consumption is charged per use in accordance with the prices shown in the Dashboard and the Payment Procedure. The Customer may configure monthly limits and alerts. Sandbox numbers are for testing only.

B.10 Router IA

B.10.1 Operation. Router IA offers an API compatible with the OpenAI format that routes requests to AI models through OpenRouter.

B.10.2 Data flow. Prompts and outputs are transmitted to OpenRouter and to the provider of the model the Customer selects, whose data policies apply. The Customer chooses the model and is responsible for choosing one whose data policy is suitable for its data. ArduMaker records usage metadata (model, tokens, cost, key and time) for billing and monitoring, and does not use prompts or outputs to train models or for any purpose other than providing the Service.

B.10.3 Outputs. AI outputs may be inaccurate, incomplete or inappropriate. The Customer must review them before relying on them and is responsible for their use, including its obligations as deployer of AI systems under Regulation (EU) 2024/1689 (the AI Act) where applicable.

B.10.4 Models and prices. The availability and prices of models depend on their providers and may change. The applicable price is the one shown in the Dashboard at the time of use.

B.10.5 Keys and limits. Each Company has its own API keys, which can be revoked at once. The Customer may set spending limits per key. Consumption generated with the Customer's keys, including leaked keys, is the Customer's responsibility until it revokes them, unless the leak was caused by ArduMaker.

B.11 Search API

B.11.1 Operations. The Search API offers search, extraction, crawling and mapping operations, charged per operation in accordance with the price table shown in the Dashboard, which prevails over any other price reference.

B.11.2 Accumulated charges. Costs accumulate on each Search API token (the key used to authenticate requests) and are charged to the Balance when they exceed EUR 0.50, in accordance with the Payment Procedure.

B.11.3 Responsible use. The Customer must respect the terms of the websites it accesses, rights reservations for text and data mining expressed in machine-readable form (Article 4 of Directive (EU) 2019/790), copyright, and data protection law. ArduMaker may limit the depth or volume of crawls to prevent harm to target websites.

B.11.4 Results. Results and AI-generated answers come from third parties and may be inaccurate or incomplete.

B.12 MCP server and AI agents

The MCP server is included in every plan at no extra cost. Clause 12 applies. Every action is recorded in the activity log. Tools that create objects accept idempotency keys to prevent duplicates when a request is retried. Content written by third parties is returned marked as untrusted.

B.13 Projects, teamwork and calendar

B.13.1 Content of the Company. Projects, stages, tasks, checklists, comments, attachments and meetings belong to the Company in which they are created. When an Authorized User is removed, the content they created remains in the Company.

B.13.2 Google Calendar. The connection of a Google account is optional. It gives read and write access to the calendar to show events on the Platform and create the time blocks and meetings generated there. The shared calendar of a project shows the other members only the availability slots, never the content of personal events. The Customer may disconnect the account at any time. The Privacy Policy describes this processing and the Limited Use commitments.

B.14 School program

B.14.1 Eligibility. The school program is available to students of schools that have an agreement with ArduMaker. The student must prove enrolment, for example by linking an account of the school's system such as the 42 Intra. Verification may be repeated at any time.

B.14.2 Conditions. The discount, quota and duration are those of the school's agreement and are applied automatically when the student logs in. The general rule is one student, one server. The types of discount (fixed, time-limited, stepped, flexible quota, paid by the school and promotional link) work as described on the school program page. In a flexible quota, if the number of places decreases, there is a grace period of 24 hours, after which the oldest places are released first.

B.14.3 End of the benefit. When the student loses eligibility, when the agreement with the school ends or when a time-limited discount expires, the server is not switched off automatically: it continues at the list price. ArduMaker notifies the student at least 7 days before the first charge at the list price, so that the student can delete the server or export the data.

B.14.4 Purpose. School resources are intended for learning and personal projects. ArduMaker may ask that commercial workloads for third parties be moved to a regular plan.

B.14.5 Misuse. Sharing access with non-eligible persons, providing false enrolment information or creating several Accounts to obtain more places is Abuse. In that case ArduMaker may withdraw the benefit, charge the list price for the period improperly obtained and apply the measures of the Terms of Use.

B.15 Promotions and discount links

Each promotion is governed by the conditions shown when it is activated. Unless stated otherwise: it can be used once per Account and per person; it cannot be combined with other promotions; it cannot be transferred; it has no cash value; and when it ends, the list price applies. ArduMaker may stop offering a promotion to new activations at any time, while honouring those already activated under their conditions. Obtaining promotions through false information, multiple Accounts or the exploitation of errors is Abuse.

B.16 Custom development

B.16.1 Proposal. Each custom development project is governed by a proposal or statement of work that sets its scope, price, milestones, deadlines and acceptance criteria. This Agreement applies to everything the proposal does not regulate.

B.16.2 Cooperation. The Customer must provide in a timely manner the information, access, content and feedback that the project needs. Delays caused by the Customer extend the deadlines accordingly. Changes of scope are agreed in writing and may modify the price and deadlines.

B.16.3 Acceptance. Each deliverable is deemed accepted if the Customer does not report substantiated non-conformities within 10 Business Days of its delivery, or if it starts using it in production.

B.16.4 Warranty. Unless the proposal provides otherwise, ArduMaker corrects free of charge the defects of a deliverable that the Customer reports within 30 days of its acceptance. Defects caused by changes made by the Customer or third parties are excluded.

B.16.5 Payment and intellectual property. Payment follows the proposal and the Payment Procedure. Intellectual property follows Clause 17.7.