PrivacyCloud

Terms of Service

RINDOGATAN LLC · PrivacyCloud edition of 5 November 2026

These terms govern your use of PrivacyCloud products and services, operated and sold by Rindogatan LLC. Last updated: 10 October 2026

1. Acceptance of terms

By accessing or using the services provided by RINDOGATAN LLC ("we," "us," or "our"), you agree to be bound by these Terms of Service. RINDOGATAN SL (Madrid, Spain) does not provide or sell the services: it acts only as RINDOGATAN LLC's representative in the Union for the purposes of Article 27 GDPR. If you do not agree to these terms, please do not use our Services.

2. Description of services

We provide PrivacyCloud, a cloud service with which an organization runs its privacy program and its AI governance program, with a catalog of information about vendors. Services may include websites, applications, APIs, and related documentation. Some features are free, while others require payment or subscription.

3. Not legal advice

PrivacyCloud products are tools that assist with legal workflows. They do not constitute legal advice and do not create an attorney-client relationship. The outputs generated by our tools are informational only and should not be relied upon as a substitute for qualified legal counsel. You are responsible for obtaining independent legal advice where appropriate.

4. AI-generated content

Our products use artificial intelligence to generate suggestions, draft language, risk assessments, and other outputs. AI-generated content is provided for informational purposes only and is not guaranteed to be accurate, complete, or current. You are solely responsible for reviewing, verifying, and approving any AI-generated output before relying on it. We make no representations regarding the legal validity or enforceability of AI-generated content.

5. Your data and AI training

We do not use your data, documents, or inputs to train our AI models. Your data is processed solely to deliver the requested service functionality. For details on how we handle your personal data, please refer to our Privacy Policy.

6. User responsibilities

You agree to:

• Use the Services in compliance with all applicable laws and regulations
• Provide accurate information when required
• Maintain the security of your account credentials
• Not use the Services for any unlawful or unauthorized purpose
• Not interfere with or disrupt the Services or servers

7. Intellectual property

Our core software is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) unless otherwise specified. Premium skills and add-on modules are proprietary and licensed separately. All content, documentation, and materials published on our websites are licensed under Creative Commons Attribution-NoDerivatives 4.0 (CC BY-ND). Trademarks, logos, and the TODO.LAW and PrivacyCloud brands are owned by Rindogatan and may not be used without prior written consent.

8. Open-source licensing

The AGPL-3.0 license requires that if you modify and deploy our software as a network service, you must make the modified source code available to users of that service. Self-hosted deployments are subject to the full terms of the AGPL-3.0 license. Hosted (SaaS) usage through our platform does not impose source-code disclosure obligations on you. Premium skills are not covered by the AGPL-3.0 license and are governed by their own license terms. Premium skills and modules for self-hosted deployments are sold as per-deployment annual licences: DRM-free bundles with a signed licence file that is validated locally at installation, never over the network. Each licence entitles you to twelve months of updates. If a licence lapses, software you have already downloaded and installed keeps working; you stop receiving updates. Licences never gate runtime; we do not build remote-disable mechanisms.

9. Disclaimer of warranties

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE. WE DISCLAIM ALL WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

10. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR TOTAL LIABILITY ARISING FROM OR RELATED TO THESE TERMS OR YOUR USE OF THE SERVICES SHALL NOT EXCEED THE GREATER OF (A) ONE HUNDRED US DOLLARS ($100) OR (B) THE TOTAL FEES PAID BY YOU TO US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.

11. Governing law

For users based in the United States: these Terms shall be governed by the laws of the State of California, without regard to conflict of law principles. Any dispute shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, with proceedings held in California. For all other users: these Terms shall be governed by the laws of Spain. Any dispute shall be submitted to the exclusive jurisdiction of the Courts of Madrid, Spain.

12. Modifications

We reserve the right to modify these Terms of Service at any time. We will provide at least thirty (30) days' prior notice of material changes by posting the updated terms on our website or notifying you by email. Your continued use of the Services after such changes constitutes acceptance of the modified terms.

13. Contact us

If you have any questions about these Terms of Service, please contact us at: RINDOGATAN LLC, 2120 Carey Avenue, Cheyenne, WY 82001, United States RINDOGATAN SL (EU representative, Article 27 GDPR), C/ Ponzano 51, 28003 Madrid, Spain

14. Language

If you are in Spain, the Spanish version of these terms prevails. Elsewhere, the English version prevails.

EU Subscription

If you take out the EU Subscription, its terms and its data processing agreement also apply:

Product-specific terms

Privacy program

Privacy compliance management platform

• Scope. The privacy program provides tools for privacy compliance management, including data mapping, record-of-processing activities (ROPA), and compliance assessments under GDPR, CCPA, and similar frameworks.
• Processing role. When processing personal data through the privacy program, we act as a data processor on your behalf. You remain the data controller and are responsible for the lawfulness of your data processing activities.
• Data mapping accuracy. Data maps, risk scores, and compliance status indicators are generated based on the information you provide. We do not independently verify the accuracy or completeness of your inputs.
• Breach notification relay. The privacy program may assist in documenting and tracking data breach incidents. This does not substitute your legal obligation to notify supervisory authorities and affected individuals within the timeframes required by applicable law.

AI governance program

AI governance and risk assessment tool

• Scope. The AI governance program helps organizations assess AI system risks, map regulatory obligations under the EU AI Act and similar frameworks, and document compliance measures.
• Risk classification. Risk levels and categories assigned by the AI governance program are guidance only and do not constitute official regulatory classification. Final classification responsibility rests with the deploying organization.
• Regulatory changes. AI governance regulations are evolving rapidly. The AI governance program reflects our current understanding of applicable rules but may not immediately reflect newly enacted or amended legislation.
• Audit trail retention. Compliance audit trails and assessment histories are retained for five (5) years or the duration of your subscription, whichever is longer, to support regulatory accountability requirements.

Vendor catalog

Vendor risk monitoring platform

• Scope. The vendor catalog provides automated monitoring and risk scoring of third-party vendors based on publicly available information and data you provide about your vendor relationships.
• Third-party data. Risk assessments incorporate data from public sources, regulatory databases, and news feeds. We do not guarantee the accuracy, timeliness, or completeness of third-party information.
• Scoring methodology. Risk scores are calculated using proprietary algorithms and are intended as decision-support indicators, not definitive risk determinations. You should conduct your own due diligence before making vendor management decisions.
• Vendor notification. The vendor catalog does not notify monitored vendors of their risk scores or assessment status. Sharing risk reports with vendors is your responsibility and should be done in accordance with your contractual obligations.