Terms of Service

In these Terms of Service ("Terms"), the following defined terms apply:

• "Keypra" or "we" — Keypra OÜ, a private limited company registered in the Republic of Estonia, with registered address at Sepapaja tn 6, 15551 Tallinn, Estonia, Tallinn, Estonia, and registry code 17502390. • "Service" — the Keypra web application accessible at keypra.com and all associated APIs, tools, and documentation. • "Customer" or "you" — the natural or legal person who creates an account and uses the Service. • "Customer Data" — all text, documents, prompts, context profiles, and other content you create, upload, or store within the Service. • "Authorised User" — any individual granted access to the Service under your account. • "AI Features" — functionality powered by third-party large language models, including prompt composition assistance, competence scoring, and crafting fluency analytics. • "Anonymised Data" — data derived from Customer Data that, assessed against all means reasonably likely to be used by Keypra or by any third party (having regard to cost, available technology and the time required), cannot be attributed to an identifiable individual or Customer. Data that is merely pseudonymised, key-coded or otherwise de-identified while a route to re-identification remains reasonably available is not Anonymised Data and remains personal data under these Terms and our Privacy Policy. • "Behavioural Telemetry" — automatically collected typing metrics (keystroke timing, pause duration, revision counts, thinking ratios) used to generate Crafting Fluency scores. • "Subscription Plan" — the tier of Service access (Free, Pro, or Enterprise) selected by the Customer. • "Sub-Processor" — a third-party service that processes Customer Data on behalf of Keypra (see Section 8).

By creating an account, accessing, or using the Service, you agree to be bound by these Terms and our Privacy Policy (/privacy). Certain operational usage limits, technical restrictions, and service-specific rules may also be published on supplementary pages such as /usage-policy. Those supplementary pages explain how the Service is operated and enforced, but these Terms remain the primary legal agreement governing your use of the Service. If you do not agree, you must not use the Service.

Eligibility. You must be at least 16 years old (per GDPR Article 8) and have the legal capacity to enter into a binding agreement. If you are using the Service on behalf of an organisation, you represent that you have the authority to bind that organisation to these Terms.

Modifications. We may update these Terms from time to time. Material changes will be communicated at least 30 days in advance via in-app notification and/or email. Continued use of the Service after the effective date of updated Terms constitutes acceptance. If you do not agree with updated Terms, you may terminate your account before the effective date.

Annual price indexation (carve-out). Routine annual price adjustments that are (i) indexed to the Eurostat Harmonised Index of Consumer Prices (HICP — All Items, EU average) or (ii) capped at a fixed percentage, applied at most once per calendar year, are not treated as "material changes" for the purposes of this Section. They follow the 30-day written notice procedure in §5.8 and do not, on their own, give rise to an implied right to terminate beyond what §5.8 already provides. All other changes to fees outside this carve-out remain "material changes" and follow the full Modifications procedure above.

Keypra is a knowledge management and AI prompt engineering platform. The Service includes:

• Markdown Editor — create and format documents with rich markdown support. • Wiki-Style Linking — interconnect documents using [[wiki-links]] to build a personal knowledge graph. • Knowledge Graph Visualisation — explore connections between documents in an interactive graph view. • Context Profiles — create reusable context cards (persona, tone, style) to personalise AI interactions. • AI Prompt Composition — leverage AI Features to draft, refine, and test prompts with selected context. • Practice Lab — hands-on prompt engineering workspace with field-specific analysis and crafting tools. • Competence Scoring — AI-powered assessment of prompt engineering skills across defined competency areas. • Crafting Fluency Analytics — behavioural analysis of your writing process (typing patterns, revision habits) to provide fluency insights. • Classroom Mode — instructor-led training sessions with slides, exercises, and real-time participant management. • Organisation Management — create and manage organisations with member roles, content libraries, and usage reporting. • Data Export — export your data in JSON format via Settings → My Data (/settings/my-data).

Feature availability may vary by Subscription Plan.

4.1 Registration. You must provide accurate, current, and complete information during registration. You agree to update your information promptly if it changes.

4.2 Security. You are responsible for safeguarding your password and for all activities that occur under your account. You must notify us immediately at security@keypra.com if you suspect unauthorised access.

4.3 One Account Per Person. Account sharing is prohibited. Each Authorised User must have their own account.

4.4 Suspension. We reserve the right to suspend or terminate accounts that violate these Terms, engage in fraudulent activity, or pose a security risk to the Service or other users.

5.1 Free Tier. The Free tier provides limited access to core features with usage caps on AI Features and storage.

5.2 Paid Tiers. Learner, Builder, and Expert plans unlock additional features, higher AI usage limits, and advanced tools. Details are available on our Pricing page (/pricing).

5.3 Enterprise Tier. Enterprise customers access the Service under a separately negotiated Order Form which sets out the applicable fees, seat limits (which may be unlimited), shared credit pool allocation, contract term, and any custom terms. The Service Level Agreement applicable to Enterprise customers is available at /legal/sla. Enterprise customers may also request a signed Data Processing Agreement at /legal/dpa.

5.4 Billing. Paid subscriptions are billed in advance on a monthly or annual basis in Euros (€). Payment is processed via Stripe. By subscribing, you authorise us to charge your payment method on each renewal date.

5.5 Automatic Renewal. Subscriptions renew automatically at the end of each billing period unless cancelled before the renewal date. The renewal date is visible in your account settings. For consumers resident in the European Union, the United Kingdom, Switzerland, Norway, Iceland or Liechtenstein who hold an annual subscription, we send a courtesy reminder email approximately 30 days before each renewal, in line with French Consumer Code Art. L215-1 and Italian Consumer Code Art. 65-quater. Monthly subscriptions and Free-tier accounts are not subject to this reminder.

5.6 Failed Payments & Dormant Free Accounts. If a payment fails, we will attempt to retry. If payment remains unsuccessful after 7 days, your account may be downgraded to the Free tier. Your data will be preserved. Free-tier accounts that remain inactive for 5 months will receive a warning email; if they remain inactive for 6 months and the warning was sent at least 30 days earlier, the account will be permanently deleted under our storage-limitation policy (Privacy Policy §17). Active paid subscribers, organisation administrators, protected staff roles, and accounts under a Legal Hold (DPA §8b) are exempt. A single sign-in resets the timer.

5.7 Cancellation. You may cancel your subscription at any time via Settings → Subscription. Cancellation takes effect at the end of the current billing period. You retain access to paid features until the period expires. No refunds are provided for partial billing periods.

5.8 Price Changes. We will provide at least 30 days' written notice before any price increase takes effect. You may cancel before the new pricing applies.

5.9 EU Consumer Right of Withdrawal and Express Waiver. If you are a consumer resident in the European Union within the meaning of Directive 2011/83/EU (the Consumer Rights Directive) and its Polish implementation, you have the right to withdraw from a paid digital-service purchase within 14 days of the purchase date, without giving any reason.

Because our Service is a digital service that begins immediately on purchase, Article 16(m) of that Directive permits the loss of this withdrawal right only where you (a) have given express prior consent to the immediate performance of the Service and (b) have acknowledged that you thereby lose your right of withdrawal once performance has begun.

For that reason, we collect this consent as a separate, explicit checkbox at the point of payment — distinct from your acceptance of these Terms and our Privacy Policy. If you do not provide this consent, the Service is not activated immediately and the purchase cannot be completed through self-service checkout; please contact billing@keypra.com to arrange a delayed-activation purchase.

This waiver does not apply to business customers who select "Buying as → Company" at checkout, as the statutory right of withdrawal under the Consumer Rights Directive applies only to natural persons acting outside their trade, business, craft, or profession.

The record of your express consent (including the version of the waiver text, timestamp, and purchase context) is retained in our legal acceptance ledger and is also confirmed in your purchase confirmation email, as required by Article 8(7) of the Directive. To exercise statutory consumer rights that survive the waiver, or to dispute the waiver, contact billing@keypra.com. Statutory consumer rights under your country of residence remain unaffected.

5.10 Buying as a Company (B2B Invoicing). If you select "Buying as → Company" at checkout, Stripe Checkout collects your legal company name, optional VAT/Tax identification number, and registered billing address directly. By proceeding, you represent and warrant that (a) you are duly authorised to act for that legal entity and (b) the data you provide is accurate and complete. Keypra does not store these fields in its own database; they are held by Stripe Payments Europe Ltd as our payment processor and can be viewed or edited at any time via Settings → Billing → Manage in Stripe, which opens the Stripe Customer Portal. Invoice records are retained by Stripe and our accountant (Xolo OÜ) for 7 years as required by the Estonian Accounting Act §12, even after account deletion. Full details are in Section 2a of our Privacy Policy (/privacy).

5.11 VAT Number Warranty. If you subscribe to Keypra as a business customer and provide a VAT registration number to receive invoices under the EU reverse-charge mechanism, you represent and warrant that (a) the VAT number you provide is valid, accurate, and registered in your name at the time of subscription and throughout the duration of your subscription, and (b) you will notify Keypra promptly at billing@keypra.com if your VAT registration is cancelled, suspended, or otherwise invalidated.

Keypra reserves the right to verify your VAT number against the European Commission's VIES system at the time of subscription and periodically thereafter. If your VAT number is found to be invalid, or has been marked as invalid by a national tax authority (including, from 1 July 2026, pursuant to Swedish anti-fraud legislation administered by Skatteverket), Keypra may: (i) reclassify your account as a non-business (B2C) customer; (ii) apply the applicable VAT rate to any outstanding or future invoices; and (iii) issue a corrected invoice for any period during which an invalid VAT number was used. You are solely responsible for any VAT, penalties, or interest arising from the provision of an invalid or inaccurate VAT number.

6.1 Your Ownership. You retain full ownership of all Customer Data. Keypra claims no ownership rights over your content.

6.2 Limited Licence to Keypra. By using the Service, you grant Keypra a non-exclusive, royalty-free licence to host, store, display, and process your Customer Data solely for the purpose of providing and operating the Service for you.

6.3 No Training on Customer Data. Keypra does not use your Customer Data to train, fine-tune, or improve AI or machine learning models for Keypra's own benefit. Third-party AI providers process prompts and outputs under their applicable service terms. Where a provider states, as of the date shown at the top of these Terms, that API customer content is not used for model training by default, Keypra relies on that provider statement. Keypra reviews applicable provider data-processing commitments at least annually and promptly upon becoming aware of a material change to a provider's stated data-use commitments, and will update the Sub-Processors page (/legal/sub-processors) accordingly. Where a provider offers additional retention controls, those controls apply only if they are available to Keypra and enabled for the relevant production environment.

6.4 No Sale of Data. Keypra will never sell, rent, or trade your Customer Data to third parties.

6.5 Anonymised Data. Keypra may generate Anonymised Data from aggregate usage patterns (never from Customer Data content) for the sole purpose of improving the Service.

6.6 Anonymisation Standard. Before treating any derived dataset as Anonymised Data, Keypra (a) removes direct and indirect identifiers, (b) reports results only at a level of aggregation at which no individual or Customer can be singled out, and (c) retains no key, mapping or other means enabling reversal. Keypra does not attempt, and contractually requires its sub-processors not to attempt, to re-identify Anonymised Data or to combine it with other datasets for that purpose. Where a derived dataset does not meet this standard, Keypra treats it as personal data and deletes it in accordance with Section 13.3.

7.1 "As Is" Output. AI-generated content is provided "as is" without any warranty of accuracy, completeness, or fitness for any particular purpose. Large language models may produce incorrect, misleading, or fabricated information ("hallucinations").

7.2 No Professional Advice. AI output does not constitute legal, medical, financial, or other professional advice. You are solely responsible for evaluating and verifying any AI-generated content before relying on it. Where you publish or externally share AI-assisted text outputs, you do so as the human author with editorial responsibility for the content (EU AI Act Art. 50(2) — human-editorial exception).

7.3 User Responsibility. You are responsible for all content you create using AI Features, including ensuring it does not violate applicable laws, third-party rights, or these Terms.

7.4 Usage Limits. AI Features are subject to rate limits and credit quotas based on your Subscription Plan. We reserve the right to throttle or temporarily restrict AI access to maintain Service stability.

7.5 Availability. AI Features depend on third-party infrastructure and may experience interruptions or degraded performance outside our control. We do not guarantee uninterrupted availability of any specific AI model.

8.1 Infrastructure. The Service is hosted on Lovable Cloud, which is built on Supabase's foundation and provides database, authentication, storage, and backend services. Keypra uses EU regional hosting in Lovable Cloud where configured.

8.2 AI Data Flow. When you use AI Features, your prompt data is transmitted through the following chain:

Your Browser → Keypra Backend → Lovable AI Gateway → AI Model Provider (Google Gemini or OpenAI)

8.3 Sub-Processors. A complete, continuously maintained list of every Sub-Processor that Keypra engages — including processor name, purpose, data categories processed, location, transfer safeguard, and a 30-day change-notice changelog — is published at /legal/sub-processors and forms part of these Terms by reference. At the date of these Terms, our Sub-Processors include providers for: cloud infrastructure, database, authentication and storage (Lovable Cloud / Supabase); AI request routing (Lovable AI Gateway); AI inference (Google Gemini, OpenAI); payment processing and invoice record-keeping (Stripe); statutory bookkeeping and accounting (Xolo OÜ, Estonia); transactional email delivery (Resend); inbound and internal company email (Zoho Mail); and optional workflow-node providers used only where the relevant feature is enabled (Perplexity AI, Firecrawl, ElevenLabs, Linear). We will provide at least 30 days' advance notice before engaging a new Sub-Processor or materially changing how an existing Sub-Processor handles personal data, via the channels described on the Sub-Processors page.

8.4 AI provider processing. Keypra does not use Customer Data to train Keypra's own AI models. Third-party AI providers process prompts and outputs under their applicable service terms. The commitments, review cadence, and update mechanism that apply to those provider statements are set out in §6.3 (No Training on Customer Data) and on the Sub-Processors page (/legal/sub-processors). Any additional provider-specific retention controls apply only where they are available to Keypra and enabled for the relevant production environment.

8.5 Further Details. For a complete description of sub-processors, data categories processed, and applicable transfer safeguards, see our Privacy Policy, Section 6 (/privacy).

9.1 Privacy Policy. Our processing of personal data is governed by our Privacy Policy (/privacy), which forms part of these Terms.

9.2 Consent Categories. Keypra operates a granular consent management system with five opt-in categories, each based on your explicit consent (GDPR Article 6(1)(a)):

• Behavioural Telemetry — typing metrics and crafting fluency data. • Competence Retention — spaced-repetition retention checks and long-term skill tracking. • Product Analytics — feature usage and error tracking. • Documentation Tracking — page views on help and documentation pages. • Marketing — promotional communications.

9.3 Managing Consent. You can view and modify your consent preferences at any time via Settings → Privacy. Changes take effect immediately.

9.4 Consent Renewal. Consents are subject to a 12-month renewal cycle. You will be prompted to reconfirm your preferences annually.

9.5 Feature Gating. Certain features (e.g., Crafting Fluency analytics, Competence Scoring, Retention Dashboard) require specific consents to function. If you withdraw consent, these features will be disabled until consent is re-granted. You may also request purging of historical data for any withdrawn category.

9.6 Data Subject Rights. You may exercise your rights under GDPR (access, rectification, erasure, portability, restriction, objection) as described in the Privacy Policy. Keypra will respond within 30 days.

You agree NOT to use the Service to:

• Attempt prompt injection attacks, jailbreaking, or other adversarial techniques against AI Features. • Reverse-engineer, decompile, or attempt to extract the underlying models, algorithms, or weights of AI Features. • Use automated tools (bots, scrapers, crawlers) to access the Service without prior written authorisation. • Generate content that is illegal, harmful, abusive, defamatory, discriminatory, or that promotes violence or hatred. • Circumvent consent gates, feature locks, or usage limits through technical manipulation. • Share account credentials or allow unauthorised third parties to access your account. • Upload malware, viruses, or any code designed to disrupt or damage the Service. • Infringe on the intellectual property rights of Keypra or any third party. • Use the Service in any manner that could disable, overburden, or impair its functioning. • Paste, upload, or otherwise submit special-category personal data within the meaning of Article 9 GDPR — including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a natural person, data concerning health, or data concerning sex life or sexual orientation — into prompts, documents, context cards, or any other field. If you nonetheless do so, you act as the sole controller of that content and remain solely responsible for it, and you indemnify Keypra against any third-party claim arising from that submission to the extent permitted by Section 14.6.

Violation of this policy may result in immediate account suspension or termination without prior notice.

10a.1 No employment decisions. Customers and Organisations shall not use the Service, or any data derived from it — including ALI scores, Crafting Fluency metrics, behavioural telemetry, retention check results, competence assessments, lesson progress, and any aggregate or individual report generated by the Service — as the basis, in whole or in part, for hiring, promotion, demotion, compensation, performance evaluation, disciplinary action, termination, or any other employment-related decision affecting a natural person.

10a.2 Self-led training only. The Service is a self-led professional development tool. It is not a recruitment system, an evaluation system within the meaning of Annex III §3 of Regulation (EU) 2024/1689 (the EU AI Act), or a worker-monitoring system within the meaning of Annex III §4 of that Regulation. Customers and Organisations are responsible for ensuring that their internal use of the Service remains consistent with this characterisation.

10a.3 No emotion recognition use. The Behavioural Telemetry feature (typing cadence) is a deterministic writing-process counter. Customers and Organisations shall not represent it, internally or to third parties, as an emotion-recognition or affect-inference system, nor combine it with other systems to that effect, in workplace or education contexts where Article 5(1)(f) of the EU AI Act applies.

10a.4 Visibility limits. Keypra does not expose per-person behavioural telemetry, per-person Crafting Fluency, per-person ALI scores, per-person mastery status, per-person tier labels, or any equivalent classification to organisation administrators, managers, lecturers or any other employer-side role. Aggregate metrics are k-anonymised at k≥3. Customers and Organisations shall not request, build, or attempt to derive such per-person views by indirect means.

10a.5 Breach. Breach of this section constitutes a material breach of these Terms and may result in immediate suspension or termination of the affected accounts, in addition to any other remedies available at law.

This Section 10b applies to Enterprise Customers only.

When an Enterprise Customer (a) integrates Keypra outputs into its own business workflows, decisions, or downstream AI-assisted processes, or (b) makes Keypra available to its workforce as part of an employment, training, or operational programme, the Enterprise Customer acts as a deployer of an AI system within the meaning of Article 3(4) of Regulation (EU) 2024/1689 (the EU AI Act).

As a deployer, the Enterprise Customer is responsible — independently of Keypra's own provider-side obligations — for ensuring a sufficient level of AI literacy among its staff and other persons dealing with the operation and use of AI systems on its behalf, taking into account their technical knowledge, experience, education and training, and the context in which the AI systems are to be used (Art. 4 EU AI Act, in force since 2 February 2025).

Keypra discloses its own internal Art. 4 measures in the public DPIA Summary (/compliance/dpia-summary §5a) and publishes the AI Literacy Index methodology (/compliance/ali-methodology) as a reference framework the Customer may, but is not obliged to, adopt for documenting its own staff-literacy programme. Keypra does not act as the Customer's deployer-side compliance officer for Art. 4 and assumes no liability for the Customer's discharge of that obligation.

The Customer's risk-tier classification of its own internal Keypra deployment (limited-risk, minimal-risk, or — where the Customer integrates Keypra into a high-risk system listed in Annex III of the AI Act — high-risk) is the Customer's own determination. Keypra's product-level self-classification is published at /compliance/ai-act-risk-classification and is provided for transparency, not as legal advice on the Customer's deployment.

11.1 Keypra Platform IP. The Service — including its source code, user interface, design, algorithms, branding, trademarks, and documentation — is and remains the exclusive property of Keypra OÜ and its licensors. These Terms do not grant you any rights to Keypra's intellectual property except the limited right to use the Service as described herein.

11.2 Customer Content Excluded. For the avoidance of doubt, Customer Data is not Keypra intellectual property. Your content remains yours (see Section 6).

11.3 Aggregated Data. Keypra retains all rights to Anonymised Data generated from aggregate usage patterns, which may be used solely for Service improvement and benchmarking. This clause applies only to data that meets the anonymisation standard in Section 6.6; data failing that standard remains personal data and is deleted with the account.

11.4 Feedback. If you provide suggestions, feature requests, or other feedback about the Service, Keypra may use such feedback without restriction or obligation to you.

12.1 Export Right. In accordance with GDPR Article 20, you have the right to export your Customer Data at any time in a structured, commonly used, machine-readable format (JSON). You can do this via Settings → My Data (/settings/my-data).

12.2 Data Included. Export includes: documents, prompts, context cards, tags, folders, profile information, lesson progress, consent records, research canvases, competence assessments, behavioural telemetry (crafting sessions), organisation membership data, team membership and shared resources, and audit log entries pertaining to your account.

12.3 Post-Termination Window. After account termination or cancellation, you have a 30-day grace period to export your data before it is permanently deleted.

12.4 Organisation Data. When you leave an organisation, your personal content remains yours. Resources you published to the organisation's content library may be retained by the organisation. Organisation-level data is strictly isolated between tenants.

12.5 Public Sharing. Keypra allows you to generate publicly accessible links to Research Canvas content. When you create a share link: the shared content is accessible to anyone with the link; you are solely responsible for ensuring shared content does not violate applicable laws; share links expire after a configurable period (24 hours to 30 days); and organisation policies may restrict or disable public sharing.

13.1 By You. You may terminate your account at any time via Settings. We recommend exporting your data before termination (see Section 12).

13.2 By Keypra. We may suspend or terminate your account if you:

• Breach these Terms or the Acceptable Use policy. • Engage in illegal activity using the Service. • Fail to pay subscription fees after the grace period. • Pose a security risk to the Service or other users.

Where practicable, we will provide reasonable notice before termination, except in cases of serious breach or security risk.

13.3 Post-Termination. Upon termination:

• Where Keypra terminates for your material breach (including non-payment after the grace period), your access to the Service ceases on the effective date of termination stated in our notice. • Where Keypra terminates for any other reason, or where you exercise a statutory right of termination as a consumer (including under Articles 43h–43m of the Polish Consumer Rights Act of 30 May 2014 transposing Directive (EU) 2019/770), you will retain access until the end of your current paid billing period, or receive a pro-rata refund of unused prepaid fees, paid within 14 days using the same payment method used for the original transaction. • For 30 days following termination, you retain read-only access to export Customer Data via Settings → My Data. • After 30 days, all Customer Data is permanently and irreversibly deleted, except Anonymised Data derived prior to termination, which may be retained. • Recurring Stripe subscriptions are cancelled at the end of the current billing period unless termination is for your material breach, in which case they are cancelled immediately and any prepaid time forfeited only to the extent permitted by mandatory law. • We will issue a data deletion confirmation upon request to privacy@keypra.com.

14.1 Disclaimer of Warranties. The Service is provided on an "as is" and "as available" basis. To the extent permitted by applicable law, and solely with respect to business users, Keypra disclaims all warranties, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, and non-infringement. If you are a consumer within the meaning of EU law, this disclaimer does not apply to you: Keypra remains liable for the conformity of the digital service under Directive (EU) 2019/770 and its national implementations (in Poland, Articles 43h–43m of the Consumer Rights Act of 30 May 2014), including the obligation to provide updates necessary to keep the Service in conformity for the duration of the contract or, for one-off supplies, for the period the consumer may reasonably expect. Keypra does not warrant that the Service will be uninterrupted, error-free, or secure, or that AI Features will produce accurate or reliable output.

14.2 Liability Cap. To the maximum extent permitted by applicable law, Keypra's total aggregate liability arising out of or related to these Terms or the Service shall not exceed the greater of: (a) the total fees paid by you to Keypra in the 12 months preceding the claim; or (b) one hundred Euros (€100).

Consumer exception to 14.2. The cap in this Section 14.2 does not apply to a consumer within the meaning of EU law in respect of: (i) death or personal injury caused by Keypra's negligence; (ii) gross negligence, wilful misconduct, or fraud; (iii) liability under the GDPR (Article 82) or under Directive 85/374/EEC on product liability; (iv) Keypra's obligation to bring the Service into conformity, or to refund, under Directive (EU) 2019/770 and its national implementations; and (v) any other liability that cannot be limited under the mandatory law of the consumer's country of habitual residence.

14.3 Exclusion of Indirect Damages. To the extent permitted by applicable law, Keypra shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, business opportunities, or goodwill.

14.4 Mandatory Law Carve-Out. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including under the GDPR, or in cases of gross negligence, wilful misconduct, or fraud. If you are a consumer within the meaning of EU law, your statutory rights remain unaffected.

14.5 AI Output. Keypra bears no liability for decisions made or actions taken based on AI-generated content (see Section 7).

14.6 Indemnification. This Section 14.6 applies to business users only and does not apply to a consumer within the meaning of EU law.

You agree to indemnify and hold harmless Keypra from claims, liabilities, damages, and expenses arising from: your use of the Service in violation of these Terms; Customer Data that infringes third-party rights; your breach of the Acceptable Use policy; or third-party claims arising from content you create using AI Features. Keypra will (a) promptly notify you in writing of any indemnified claim, (b) give you sole control of the defence and settlement (provided that no settlement admits liability on Keypra's behalf or imposes non-monetary obligations on Keypra without Keypra's prior written consent), and (c) reasonably cooperate at your expense. Your aggregate indemnification liability under this Section 14.6 is capped at the amount set out in Section 14.2 for business users. This indemnification does not apply to the extent the claim arises from Keypra's own negligence, wilful misconduct, or breach of these Terms.

15.1 Governing Law. These Terms are governed by and construed in accordance with the laws of the Republic of Estonia, without regard to its conflict-of-laws principles.

15.2 Jurisdiction. Any disputes arising out of or in connection with these Terms shall be submitted to the exclusive jurisdiction of Harju County Court (Harju Maakohus), Tallinn, Estonia.

15.3 Consumer Protection. If you are a consumer residing in the European Union, nothing in these Terms deprives you of the protection afforded by the mandatory provisions of the law of your country of habitual residence. You may also bring proceedings in the courts of your country of residence.

15.4 Informal Resolution. Before initiating formal proceedings, the parties agree to attempt to resolve any dispute through good-faith negotiation for a period of 30 days.

15.5 Supervisory Authorities. Nothing in these Terms prevents you from lodging a complaint with your local data protection supervisory authority (GDPR Article 77). Keypra's lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). For UK residents, the relevant supervisory authority is the UK Information Commissioner's Office (ICO, ico.org.uk). For Swiss residents, the relevant authority is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). For Canadian residents in Quebec, the relevant authority is the Commission d'accès à l'information (CAI, cai.gouv.qc.ca). In the United States there is no single federal data-protection authority; the relevant enforcers are State Attorneys General and, in California, the California Privacy Protection Agency (CPPA, cppa.ca.gov).

15.6 Out-of-court consumer dispute resolution.

• EU Online Dispute Resolution platform. The European Commission's ODR platform was discontinued on 20 July 2025 and is no longer available.

• Germany (§36 Verbraucherstreitbeilegungsgesetz / VSBG). Keypra OÜ is neither willing nor obliged to participate in dispute-resolution proceedings before a consumer arbitration board (Verbraucherschlichtungsstelle) within the meaning of the German Consumer Dispute Resolution Act. Consumers may still bring proceedings before the competent ordinary court of their country of residence.

• Austria, Belgium, Netherlands and other EU member states. Keypra does not currently participate in any national alternative dispute resolution scheme. Statutory consumer rights and the right to bring judicial proceedings in your country of habitual residence are unaffected.

16.1 Severability. If any provision of these Terms is found to be unenforceable, the remaining provisions shall continue in full force and effect.

16.2 Force Majeure. Keypra shall not be liable for any failure or delay in performance caused by events beyond its reasonable control, including natural disasters, pandemics, war, acts of terrorism, government actions, widespread internet infrastructure failures beyond Keypra's reasonable control, or third-party service failures that Keypra could not reasonably prevent or mitigate. Keypra will notify affected users of a force majeure event without undue delay through the Service or by email, and will take reasonable steps to mitigate its impact and resume performance. This clause does not limit (a) any consumer's mandatory statutory rights, including the right to a refund or price reduction for service not provided, (b) liability for damage caused by Keypra's wilful misconduct or gross negligence, or (c) liability under Regulation (EU) 2016/679 (GDPR) Article 82 or Directive (EU) 2019/770 (DCSD) conformity remedies.

16.3 Entire Agreement. These Terms, together with the Privacy Policy, constitute the primary legal agreement between you and Keypra regarding the Service. Supplementary operational pages, including /usage-policy, may describe current technical limits, service rules, and enforcement processes, but do not override these Terms unless expressly stated.

16.4 Assignment. You may not assign or transfer your rights under these Terms without our prior written consent. Keypra may assign these Terms in connection with a merger, acquisition, or sale of assets, provided the assignee assumes all obligations under these Terms.

16.5 Waiver. Failure to enforce any provision of these Terms shall not constitute a waiver of that provision.

16.6 Notices. Notices to you will be sent to the email address associated with your account. Notices to Keypra should be sent to legal@keypra.com.

16.7 Language. These Terms are drafted in English. If translated into another language, the English version shall prevail in the event of any inconsistency.

Keypra OÜ Sepapaja tn 6, 15551 Tallinn, Estonia, Tallinn, Estonia Registry code: 17502390

For questions about these Terms:

• Legal inquiries: legal@keypra.com • Privacy inquiries: privacy@keypra.com • Security issues: security@keypra.com • General support: support@keypra.com

These Terms were last updated in May 2026.

This Section sets out additional terms that apply to users located in specific jurisdictions, in addition to the rest of these Terms. In case of conflict between this Section and the rest of these Terms, this Section prevails for users located in the relevant jurisdiction.

18.1 United Kingdom

• Your data-protection rights are governed by the UK GDPR (as retained in UK law by the Data Protection Act 2018) and supervised by the UK Information Commissioner's Office (ICO, ico.org.uk). You may lodge a complaint at https://ico.org.uk/make-a-complaint. • The Consumer Rights Act 2015 applies to UK consumers in respect of digital content and services supplied by Keypra. • International transfers out of the UK are governed by the UK International Data Transfer Addendum issued by the ICO under s.119A of the Data Protection Act 2018, used alongside the EU Standard Contractual Clauses where relevant. • UK Article 27 representative status. Keypra OÜ is established in Estonia and does not currently target the UK market. Keypra has not appointed a UK GDPR Article 27 representative. UK residents may contact Keypra on data-protection matters at privacy@keypra.com and may always complain to the ICO. • Operational note (temporary). Paid plans are temporarily unavailable in the United Kingdom pending VAT registration. Free features remain available.

18.2 Switzerland

• Your data is processed in accordance with the revised Swiss Federal Act on Data Protection (nFADP), in force since 1 September 2023, and supervised by the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). • International transfers out of Switzerland are governed by the Swiss Addendum to the EU Standard Contractual Clauses, with the FDPIC named as the competent authority. • Swiss Article 14 nFADP representative status. Keypra OÜ has not appointed a Swiss representative under Article 14 nFADP. Swiss residents may contact Keypra on data-protection matters at privacy@keypra.com and may always complain to the FDPIC. • Operational note (temporary). Paid plans are temporarily unavailable in Switzerland pending VAT registration. Free features remain available.

18.3 United States — California (CCPA / CPRA)

• No sale. Keypra does not sell your personal information for monetary or other valuable consideration, as defined by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). • No sharing for cross-context behavioural advertising. Keypra does not share personal information for cross-context behavioural advertising. To honour this commitment, the Google Analytics 4 tag, Google Ads conversion tag, LinkedIn Insight Tag, and X (Twitter) Pixel (named in full in Privacy Policy §10 and the Cookie Policy) are disabled at the consent layer for visitors whose IP is geolocated to California and for any browser sending the Global Privacy Control (GPC) signal — meaning ad_storage, ad_user_data, and ad_personalization remain denied for Google Ads, and the Google Analytics, LinkedIn and X scripts are not loaded (or are unloaded and their cookies cleared if already loaded), regardless of the user's analytics- or marketing-cookie choice. Google Signals and ads personalisation are switched off on Keypra's Google Analytics property, so Analytics data is not used for cross-context behavioural advertising. • Your rights. You have the right to know what personal information Keypra holds about you, to request correction or deletion, to opt out of any sale or sharing, and to receive equal service and pricing when you exercise these rights. • How to exercise. Email privacy@keypra.com. Keypra will respond within 45 days, extendable by a further 45 days upon notice as permitted by Cal. Civ. Code §1798.130(a)(2). • Right to appeal. You may appeal a denied request by replying to Keypra's decision within 60 days. If still unresolved, you may file a complaint with the California Privacy Protection Agency (CPPA, cppa.ca.gov) or the California Attorney General. • Non-discrimination. Keypra does not discriminate against users who exercise their CCPA/CPRA rights.

18.4 United States — Other States

• Keypra extends the equivalent of the rights described in §18.3 (access, correction, deletion, portability, opt-out of sale or targeted advertising, and right to appeal) to residents of every US state with a comprehensive consumer-privacy statute in force, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Delaware (DPDPA), Indiana (ICPA), Tennessee (TIPA), New Jersey (NJDPA), Minnesota (MCDPA), Maryland (MODPA), Rhode Island (RIDTPPA), New Hampshire (NHPA), Kentucky (KCDPA), Nebraska (NDPA), and any subsequently enacted state law. • To exercise these rights, contact privacy@keypra.com. The same Global Privacy Control (GPC) honouring described in §18.3 applies wherever the signal is received. • Complaints may be filed with the relevant State Attorney General.

18.5 Canada — Quebec (Law 25 / Act 64)

• Your personal information is processed in accordance with Act 64 — An Act to modernise legislative provisions as regards the protection of personal information (commonly "Law 25"). • Designated Privacy Officer. As required by Article 3.1, Keypra's designated person in charge of the protection of personal information is Ferenc Szilágyi, Director, Keypra OÜ, reachable at privacy@keypra.com. • Your rights. You have the right to access, correction, and deletion of your personal information, the right to data portability (Article 27, in force since September 2024), the right to de-indexing or cease dissemination (Article 28.1), and the right to withdraw consent at any time. • Automated decision-making transparency (Article 12.1). Certain Keypra features — Crafting Fluency analytics and Competence Scoring — involve automated processing as described in Section 11 of the Privacy Policy (/privacy). You may request human review and may contest any individual outcome by contacting privacy@keypra.com. • Privacy incidents. In the event of a confidentiality incident presenting a risk of serious injury, Keypra will notify affected individuals and the Commission d'accès à l'information (CAI, cai.gouv.qc.ca) as required by Law 25.

19.1 Hosting service provider status. Keypra OÜ operates as a hosting service provider within the meaning of Regulation (EU) 2022/2065 (the Digital Services Act, "DSA"). User-generated content accessible to the public via Keypra share links (including Research Canvas share links) falls within the scope of the DSA's notice-and-action regime.

19.2 Notice and action (DSA Art. 16). Any person may notify Keypra of content accessible via a Keypra share link that they consider to be illegal by emailing legal@keypra.com with the subject tag [DSA-REPORT] (the tag is preferred but not mandatory — a notice will not be rejected solely for a missing subject tag). A web reporting page is also available at /legal/dsa-report. To enable Keypra to obtain actual knowledge of the alleged illegality, a valid notice should include:

• A sufficiently substantiated explanation of why you consider the content to be illegal (including, where relevant, the legal provision allegedly infringed). • The exact electronic location of the content (the full share-link URL). • Your name and email address. Notices may be submitted anonymously where they concern offences referred to in Articles 3 to 7 of Directive 2011/93/EU (child sexual abuse material). • A statement confirming that you hold a good-faith belief that the information and allegations in the notice are accurate and complete.

19.3 Decision and statement of reasons (DSA Art. 17). Keypra will process valid notices in a timely, diligent, non-arbitrary and objective manner. We will send an acknowledgement of receipt without undue delay and, where feasible, a reasoned decision within 14 business days. Both the notifier and the affected user will be informed of the decision and of the redress options available to them.

19.4 Redress for affected users (DSA Arts. 20 & 21). A user whose content has been restricted or whose share link has been disabled may submit an internal complaint to legal@keypra.com with the subject tag [DSA-APPEAL] within six months of the decision. In addition, affected users may refer the dispute to a certified out-of-court dispute-settlement body in their EU Member State, and retain all rights to bring judicial proceedings.

19.5 Misuse safeguard (DSA Art. 23). Following a prior written warning, Keypra may suspend, for a reasonable period of time, the processing of further notices or complaints submitted by a person, entity or complainant that frequently submits notices or complaints that are manifestly unfounded. A single unfounded notice will not, by itself, result in suspension.

19.6 Content-moderation measures (DSA Art. 14). Where Keypra acts on a valid notice, the measures available to us include disabling the share link, restricting visibility of the content, terminating the share token, and — in cases of serious or repeated breach of these Terms — suspending the user's account in accordance with §13. Each moderation decision is recorded in the user's audit log.

19.7 Authority and recipient contact points (DSA Arts. 11 & 12). Until a dedicated channel is published, Member State authorities, the European Commission and the European Board for Digital Services may contact Keypra at legal@keypra.com with the subject tag [DSA-AUTHORITY]. Recipients of the Service may contact Keypra on DSA matters at the same address using the subject tags above. All DSA correspondence is accepted in English.

This Section reflects Keypra's obligations under Regulation (EU) 2023/2854 (the EU Data Act), in force since 12 September 2025, as a provider of a "data processing service".

20.1 Right to switch. You have the right to switch to another data processing service or to an on-premises ICT infrastructure of your choice, and to terminate this contract for that purpose, in accordance with Article 25 of the Data Act.

20.2 Maximum transition period. Keypra will support a maximum 30-day transition window following your notice of switching, during which the Service remains available so you can complete the migration. On request, Keypra will provide an additional 6-month extended assistance period to help you re-establish functional equivalence with the destination service.

20.3 Self-serve export. Customer Data exportable in machine-readable form is available at any time via Settings → My Data (/settings/my-data) and includes documents, prompts, context cards, research canvases, learning progress, organisation membership records, and audit-log entries pertaining to your account. Default export formats are JSON for structured data and plain Markdown for documents. Keypra will use commercially reasonable efforts to support common interoperability standards where relevant equivalent destination services exist.

20.4 Switching charges. Keypra applies €0 switching charges. Keypra voluntarily applies the post-12-January-2027 zero-charge regime of Article 29 today; we do not charge an early-switching fee, an exit fee, or any other charge for the act of switching itself. Standard usage fees for the Service during the transition window remain payable.

20.5 No obstacles. Keypra will not impose technical, contractual or commercial obstacles that inhibit you from terminating the contract, switching to another provider, or porting your Customer Data. Open formats, documented APIs, and self-serve export tools are provided to that end.

20.6 B2B contractual obstacles. Enterprise Customers entitled to additional contractual or operational switching assistance under Article 25–30 of the Data Act should refer to the corresponding clause in the Data Processing Agreement (/legal/dpa §8a) and contact enterprise@keypra.com.

20.7 How to initiate a switch. To initiate a switch, contact enterprise@keypra.com (Enterprise) or privacy@keypra.com (other plans) with the subject tag [SWITCH]. We will acknowledge within 72 hours, agree on the migration plan within 7 days, and execute the transition within the 30-day window.

Keypra can be used by e-mail. When you write to ask@in.keypra.com, our AI assistant replies with a prompt review, a persona draft, a lesson, a practice slot, a digest, or a help guide. This Section governs that channel and applies in addition to Sections 7 (AI Features), 9 (Privacy) and 10 (Acceptable Use).

21.1 Enrolment and consent. If you are not already a Keypra user, we do not enrol you in the channel until you reply "I CONSENT". You can leave at any time by replying STOP.

21.2 Credits. Requests sent by e-mail consume credits from your plan on exactly the same basis as requests made inside the application. Where no credits are available, we reply telling you so rather than processing the request.

21.3 No response-time commitment. The email channel is provided on a best-effort basis. It is not covered by any Service Level Agreement, including the SLA at /legal/sla, and no response time, availability, or delivery guarantee applies. Mail can be delayed, filtered, or lost by systems outside our control. Do not rely on it for anything time-critical.

21.4 Content you must not send. You must not send through the email channel: special categories of personal data within the meaning of Art. 9 GDPR; health, biometric, or financial-account data; legally privileged material; information subject to professional secrecy (including material covered by §203 StGB); classified or export-controlled material; or credentials and API keys. E-mail is not an end-to-end encrypted channel. Use the signed-in application instead.

21.5 Third parties and colleagues. You may invite a colleague into a thread by placing them in CC. You warrant that you are entitled to share the contents of that thread with them and to disclose their address to us for that purpose. Generic role and group addresses (for example info@, hr@, legal@, support@) are refused. Invited people receive their own consent request and are not enrolled until they confirm. You can list participants with WHO and remove one with REMOVE <address>.

21.6 Fair use and abuse. You must not use the channel to send bulk or automated mail, to impersonate another person or organisation, to relay third-party mail, to create mail loops or point auto-responders at our address, or to attempt to extract data belonging to other users or to manipulate the assistant into disregarding these Terms. Per-sender rate limits apply.

21.7 Suspension. We may refuse, delay, or stop replying to an address, and may suspend the channel for an account, where we reasonably believe this Section has been breached or where continuing would threaten the deliverability or security of the service. Section 13 otherwise applies.

21.8 Retention and records. What we store from the channel, and for how long, is set out in the Privacy Policy §2b, §2c and §17. Signed-in users can read their conversations at /email-inbox and their email projects at /email-projects.

21.9 Enterprise customers. Where you use Keypra under an Enterprise Agreement, the channel is additionally governed by the DPA §3 and §3a, and it is disabled by default where §203 StGB professional-secrecy mode is active.