Terms of Use

These Terms of Use ("Terms") are a binding agreement between you and ORGANIZING GROUP SRL, a Romanian limited liability company, registered with the Romanian Trade Registry under no. J22/1300/2015, having CUI/CIF 34809309 and VAT ID RO34809309, with registered office at Str. Mihail Sadoveanu 44, Valea Ursului, Iași, Romania ("CrystalSpec", "we", "us" or "our"). They govern your access to and use of CrystalSpec, available at https://crystalspec.com, including its web application, APIs, MCP server, browser extension, hosting and related services (the "Service").

By creating an account, accepting an invitation to a workspace, signing in with a third-party provider, or using the Service, you agree to these Terms. If you do not agree, do not use the Service. If you use the Service on behalf of an organization, "you" means that organization, and you confirm that you are authorized to accept these Terms for it.

CrystalSpec is designed for businesses and professionals. If you use it as a consumer, the mandatory protections of the consumer law that applies to you prevail over any conflicting part of these Terms. A written agreement or order form signed by us, or a separate data processing agreement signed by us, prevails over these Terms where they conflict. Our Privacy Policy and Cookie Policy explain how we handle personal data and cookies.

If you accepted an earlier version of these Terms, this version applies to you 15 days after we notify you of it, or earlier if you expressly accept it.

1. Key Clauses You Expressly Accept

In accordance with Article 1203 of the Romanian Civil Code, by ticking the acceptance box when you sign up or by otherwise expressly accepting these Terms, you confirm that you have read and that you specifically and expressly accept the following clauses:

• you are solely responsible for the content, software, sites, shops, sales, messages, documents, signatures, domains and other results you create, publish, sell, send or sign with the Service, and we are not a party to your dealings with your End Users (Sections 4 to 17);
• the restrictions on how you may use the Service (Section 18);
• our right to change, limit, suspend or discontinue the Service or your access, to remove or disable content, and to terminate these Terms (Sections 19, 25 and 26);
• the automatic renewal of subscriptions and domain registrations, and our right to charge your payment method for renewals, seats, add-ons and automatic top-ups (Sections 13 and 20);
• the disclaimers and the exclusions and limitations of our liability (Sections 29 and 30);
• your obligation to indemnify us (Section 31);
• our right to change these Terms (Section 34);
• the choice of Romanian law and of the courts of Iași, Romania (Section 35).

Nothing in this Section limits the rights that consumers have by law.

2. Definitions

• Workspace means a team account in the Service and everything in it.
• Members means the people a Workspace admits, including owners, administrators, members, guests and invited users.
• Customer Content means everything you, your Members or your End Users submit to, store in or generate with the Service, including prompts, specifications, tasks, messages, files, code, Output, products, orders, contacts, invoices, documents, signatures and form responses.
• Customer Applications means everything you build, generate, configure, host, deploy or publish with the Service, including backends and their APIs and data, apps, prototypes, landing pages and sites, shops, forms, lead forms, booking pages, help centers, public share pages, automations, workflows, integrations and source code.
• End Users means anyone other than you and your Members who uses or interacts with a Customer Application, or receives something you send through the Service, including buyers, visitors, form submitters, booking guests, signers, recipients of invoices and emails, leads, application users and API callers.
• AI Features means features that use artificial intelligence models, including Spec, chat, Cofounder, research, voice, agents, and code, content and image generation. Output means anything AI Features produce.
• Third-Party Services means services we do not provide, including AI model providers, Stripe, Cloudflare, Google, GitHub, GitLab, Slack, Linear, ClickUp, ANAF, domain registries and registrars.

3. Accounts, Workspaces and Members

• You must be at least 16 years old, or the minimum age required in your jurisdiction to use online services, and capable of entering into a binding agreement.
• You must provide accurate account information, keep it up to date, keep your credentials secure and not share your login with others.
• Workspace owners and administrators control their Workspace. They decide who joins, what Members can access, which tools are enabled, what is made public and how the Workspace is billed. The Workspace, not the individual Member, controls the content added to it, and a Member who leaves or is removed may lose access to that content.
• If you accept an invitation to a Workspace, you agree to these Terms, and the Workspace's owners and administrators can see and manage what you add to it.
• You are responsible for everything done under your account, by your Members and by anyone using your credentials or API tokens, as if it were done by you. Tell us promptly at support@crystalspec.com about any suspected unauthorized access.

4. Our Role

We provide software tools and the infrastructure to run them. Unless we expressly agree otherwise in writing:

• we are not a party to any agreement, sale or other dealing between you and your End Users, Members, clients, suppliers or contractors;
• we are not your developer, contractor, merchant of record, payment institution, escrow agent, accountant, tax adviser, lawyer, employer of your staff, domain registrant or trust service provider, and we are not the sender of the messages you send;
• we do not review, approve or verify Customer Content, Customer Applications, products, documents or messages before you use, publish, sell or send them, and we have no general obligation to monitor them;
• templates, examples, defaults, suggestions, tax settings, policy text, checklists and similar aids are conveniences, not advice, and you decide whether they suit your situation.

Some features are available only on certain plans, in certain countries, or once we enable them for your Workspace.

5. Customer Content

As between you and us, you retain ownership of Customer Content. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit, display, back up and secure Customer Content, and to make it available as you direct, to the extent needed to provide, support, secure and improve the Service, including its AI Features, for as long as we provide the Service to you and afterwards as described in our Privacy Policy.

You are responsible for Customer Content. You must have all rights, permissions, notices and consents needed to submit it and to have it processed and published through the Service.

We may use aggregated or de-identified data about how the Service is used, which does not identify you, your Members or your End Users, to operate, secure and improve the Service.

Keep your own copies of the Customer Content you need. The backups we keep exist for our own recovery from incidents and are not a backup service for you.

6. AI Features, Output and Automations

• CrystalSpec sends prompts, project context and related Customer Content to AI model providers to generate responses, proposals and other Output.
• Output can be inaccurate, incomplete, outdated, duplicative, insecure, biased or unsuitable for your use. You must review and validate Output before you rely on it, publish it, deploy it or send it.
• Output is not legal, financial, tax, security, medical or other professional advice.
• Subject to our rights in the Service and third-party rights, as between you and us, you may use Output produced for your Workspace for your business purposes. We do not claim ownership of Output, but we do not represent that Output is unique, protectable by copyright or free of third-party claims.
• You are responsible for deciding whether to approve, reject, edit, publish, deploy, send or otherwise use any Output or proposed action. Where the Service asks a person to review or approve something, that approval is your decision, not ours.

Managed AI requests, including Free-plan requests, exclude providers that collect data for training. Provider retention and abuse-monitoring terms still apply.

We do not use Customer Content to train CrystalSpec-owned AI models.

Automations. Some features act on your behalf without asking for approval each time once you enable or configure them, for example automatic task exports to GitHub, GitLab, Linear or ClickUp, pull request reviews and comments posted by our integrations, repository sync, scheduled Cofounder and competitor research, workflows and runs, scheduled backend jobs and automatic top-ups. Actions taken by features you enabled, configured or approved, by agents or tools you connect through our API or MCP server, and by anyone using your tokens, are your actions, and you are responsible for their results, including the AI credits they consume.

Your own AI keys. If your Workspace uses its own AI provider key, the provider bills you directly under its terms, and you are responsible for that account, its limits and its charges.

Research. Research features may summarize public web sources. We do not verify those sources, and you must use the results lawfully and respect the rights of others.

AI and your End Users. If you make AI Features or Output available to End Users, for example AI answers on public pages, AI-written emails, AI-generated images or AI-built sites, you are responsible for complying with the laws that apply to you, including any obligation under the EU Artificial Intelligence Act to tell people that they are interacting with an AI system or that content was generated by AI.

7. What You Build Is Your Responsibility

You are solely responsible for your Customer Applications and for everything they do, whether you wrote them yourself, generated them with AI Features, or both. In particular, you are responsible for:

• their design, code, configuration, data models, data migrations, content and behaviour;
• reviewing, testing and securing them before you deploy, publish or rely on them. Passing tests, acceptance cases or checks in the Service does not mean that an application is correct, secure, lawful or fit for its purpose;
• their compliance with the laws that apply to them and to your business, including data protection, consumer protection, e-commerce, accessibility, product safety, AI and sector-specific rules;
• your own terms, privacy notice, cookie and consent mechanisms and other notices to End Users, and the support, refunds and remedies you owe them;
• the licences of any code, libraries, fonts, images or other material they use, including open-source licence obligations;
• the secrets, keys and credentials they use, and the accounts and permissions of the application users you create;
• keeping your own exports and backups of their code and data.

Hosting. We run Customer Applications on infrastructure from our providers, which currently include Cloudflare, within the limits of your plan and of the Service. We may throttle, pause or stop a Customer Application that exceeds those limits, endangers the Service, our providers or others, or breaches these Terms, and we will tell you where reasonably possible.

Environments and data. You manage your development and production environments and their data. Rolling back, deleting, re-deploying or migrating an environment can change or delete data, and we do not guarantee that data can be recovered.

No high-risk use. Do not use the Service or Customer Applications where a failure could lead to death, personal injury, or serious physical, environmental or property damage, such as medical devices or diagnosis, emergency services, or the control of vehicles, aircraft or critical infrastructure, and do not use them to make decisions with legal or similarly significant effects on people without the human review the law requires.

Your End Users. We have no relationship with your End Users and no obligations towards them. You handle their questions, requests, complaints and claims about your Customer Applications.

8. Public Pages, Sharing and Hosting

You can make content public, for example through share links, landing pages, shops, forms, lead forms, booking pages, help centers, public app addresses, custom domains and backend endpoints. When you do:

• anyone who has the link or address can see the content without an account, and anything public can be copied, indexed and stored by others, including search engines and AI crawlers;
• public project shares may be listed in our sitemap and indexed by search engines;
• visitors may be able to ask AI questions about shared content, and those requests use your Workspace's AI allowance or AI key;
• you are responsible for what you make public and for having the right to publish it;
• you can stop new access by disabling the link or page, but copies already made by visitors, search engines or others may persist outside our control.

Public pages and messages may show that they are powered by or sent "via CrystalSpec". That attribution does not mean that we sell, endorse or are responsible for your content, products or services.

9. Selling and Getting Paid

When you sell goods or services, take payments or request payment through the Service, including through Shop, Invoices and payment links:

• you are the seller and the merchant of record. Every sale is a contract between you and your buyer;
• card payments are processed by Stripe through your own Stripe account, under your agreement with Stripe. Your buyers pay you through Stripe; we do not receive, hold or transfer those funds, and we are not a payment service provider, payment institution or escrow agent. Payments you collect by other means are entirely between you and your buyer;
• you are responsible for your products and services, including their legality, safety, descriptions, images, prices, currencies, availability, delivery, returns, refunds, warranties, chargebacks, disputes and customer service;
• you are responsible for your obligations to buyers, including consumer pre-contractual information, withdrawal rights, accessibility requirements, and the terms of sale, returns, shipping and privacy policies you publish. The Service does not check that your policies exist, are complete or are lawful;
• you decide and are responsible for taxes, including VAT registration, rates, exemptions, invoices and filings. Tax rules, tax quotes, Stripe Tax, currency conversion and exchange rates in the Service apply your settings or third-party data; they are not tax advice, and we do not guarantee that they are correct or complete;
• refunds, credit notes and returns you record or initiate through the Service are your decisions and your obligations;
• you are the controller of your buyers' personal data, which we process for you under Section 23, and you handle their privacy requests.

10. Invoices and e-Factura

• You are responsible for the content, numbering, accuracy, timing, delivery and legal compliance of every invoice, proforma, credit note and receipt you issue through the Service, and for the client and business details you enter.
• If you connect ANAF e-Factura, you authorize us to transmit your invoices and retrieve their status on your behalf using the authorization you grant through ANAF. You remain responsible for submitting invoices on time, checking their status, and correcting invoices that are rejected. Sending an invoice by email is not a submission to ANAF. We are not liable for rejections, delays or unavailability of ANAF systems, or for fines or penalties imposed on you.
• Exchange rates, including National Bank of Romania rates, come from third parties and may be delayed, unavailable or wrong.
• The Service is not a legal archive. Keep your own copies of accounting and tax documents for the periods required by law.
• If a Workspace enables personal invoicing, invoices between a Member and the Workspace are a matter between them.

11. Electronic Signatures

• Unless a signer signs with their own qualified certificate, signatures made with Sign are simple electronic signatures under Regulation (EU) No 910/2014 (eIDAS). Under eIDAS, only a qualified electronic signature has the legal effect of a handwritten signature. Whether a simple electronic signature is sufficient for a particular document, and how a court or authority will assess it, depends on the law that applies.
• If a signer uses their own certificate, we check the signature cryptographically but do not validate the certificate against trusted lists, revocation services or trusted timestamps, and we do not confirm its qualified status.
• You are responsible for choosing the right type of signature, for the content of your documents and templates (including contracts drafted with AI Features and starter templates, which are examples, not legal advice), for identifying your signers, for obtaining their agreement to sign electronically, and for any form, witness, notarization, registration or other legal requirement.
• The evidence we record, such as email verification, IP address, device information, timestamps and document hashes, is provided as is, and we do not guarantee that any court or authority will accept it.
• Download and keep your own copies of signed documents and their evidence.

12. Emails, CRM, Forms and Bookings

• When you send emails or other messages through the Service, including invoices, signature requests, order and booking messages, Sales replies, campaigns and notifications, you are the sender, and you are responsible for their content, recipients and lawfulness. Messages may be sent from our infrastructure, showing your name "via CrystalSpec", or from a mailbox you connect.
• You must have a lawful basis and any required consent to contact your recipients, honour unsubscribe and objection requests, and comply with anti-spam, e-privacy, marketing, consumer and data protection laws, including the GDPR and Romanian Law no. 506/2004. You must not send unsolicited bulk messages, use bought or harvested contact lists, or mislead recipients about who you are.
• We may apply sending limits, and we may delay, block or stop messages, or disconnect a mailbox or integration, to protect recipients, deliverability or the Service. We do not guarantee that messages will be delivered.
• Forms, lead forms and booking pages collect information from End Users for you. You decide what to collect, you write the information and consent texts they display, and you respond to submissions. Confirming a booking is your decision and your commitment.
• Contacts, leads, clients and conversations in Sales and other tools are your data, and you are their controller.
• If you connect a Google account, we use it only to send the messages you write or approve, as described in our Privacy Policy, and your use of Gmail remains subject to Google's terms.

13. Domains, DNS and Custom Domains

• Registration. We register domains through Cloudflare Registrar on your Workspace's behalf. Your Workspace is the registrant and holder of the domain and must keep accurate, current registrant information. Registrations are subject to the policies of ICANN, the relevant registry and the registrar, including dispute resolution policies such as the UDRP, which form part of the conditions of each registration.
• Price and refunds. The price shown before purchase includes our service fee on top of the registrar's cost and is charged to your Workspace's payment method before we request the registration. If the registration fails, we refund the charge. Once a domain is registered, its fee is non-refundable, except where the law requires otherwise.
• Renewal. Domain registrations renew automatically. You authorize us to charge each renewal, at the registrar's then-current cost plus our service fee, to your Workspace's payment method around the expiry date. If a renewal cannot be charged, or your account is suspended or closed, we may let the domain expire, after which it may be lost, require extra redemption fees, or be registered by someone else. Keeping your domains renewed is your responsibility.
• Your name, your rights. You are responsible for choosing a domain name you are entitled to use, including with respect to trademarks and other rights. We do not check names for conflicts.
• Transfers. You can ask us to help transfer a domain to another registrar, subject to registry rules, transfer locks and payment of any amounts you owe.
• DNS and custom domains. DNS hosting, email forwarding and custom domains for your Customer Applications are provided through Cloudflare. You are responsible for your DNS records and their effects; a wrong record can make your sites, email or other services unavailable.
• We are not liable for the actions of registries, registrars or authorities, for domain disputes, or for the suspension, deletion, loss or expiry of a domain.

14. People, Time and Inventory Data

When you use Time, compensation settings, time off and approvals, calendars, schedules, reports or Inventory, you, as the employer or organization, are the controller of your Members' personal data. You are responsible for informing them, for the lawful basis of any reporting or monitoring, and for complying with employment law. Hourly rates, salaries and estimated costs are confidential data you choose to enter; reports and estimates are not payroll, accounting or legal records.

15. Integrations, API, MCP and Webhooks

• You may connect Third-Party Services, AI agents and other tools through integrations, API tokens, our MCP server, webhooks and our browser extension. You are responsible for the tokens you create, the permissions you grant, who and what can use them, and everything done with them. Keep tokens secret and revoke them if they may be compromised.
• Data you send to a Third-Party Service, and actions an integration takes there, such as creating issues, posting comments or approving pull requests, are governed by that service's terms and are your responsibility.
• Webhooks are sent to endpoints you control. We do not guarantee their delivery, order or retry, and you must verify their signatures.
• We may apply rate limits and may revoke tokens or disconnect integrations that put the Service or others at risk.

16. Chat, Calls and Voice

• You are responsible for your conduct and for what you share in chat, forums, audio and video calls and screen sharing. Do not record, transcribe or share other people's calls or messages without the notice and consent the law requires.
• Voice features send audio to AI providers to produce responses and transcripts, and transcripts may be stored in your Workspace.
• The Service is not a telephone service and cannot be used to contact emergency services.

17. Outsource Requests

If you submit an Outsource request, you agree that we may share your brief and contact details with our delivery team and with the providers we select to prepare a proposal. A proposal is not binding until you and the provider, which may be us or an independent third party, sign a separate agreement covering scope, price, timing, intellectual property and liability. Unless that agreement says otherwise, independent providers are solely responsible for their services, and we are not liable for their work. Providers are admitted to our directory at our discretion.

18. Acceptable Use

You must not, and must not allow anyone to, use the Service or Customer Applications to:

• break the law, infringe intellectual property, privacy, publicity or other rights, or process content you are not permitted to process;
• publish, store, sell or send illegal content, goods or services, including child sexual abuse material, terrorist content and illegal hate speech;
• send spam, phishing, scams or other deceptive messages, or impersonate any person or organization;
• distribute malware, run cryptocurrency mining, botnets, open proxies or relays, or attack, scan or overload any system or network;
• sell or advertise goods or services that our payment, hosting or other providers prohibit;
• collect personal data without a lawful basis, carry out unlawful surveillance or profiling, or process special categories of personal data or children's data without the safeguards the law requires;
• create deceptive deepfakes or use AI for practices prohibited by the EU Artificial Intelligence Act;
• access another user's account, Workspace or data without authorization, or interfere with, probe, overload, reverse engineer or bypass the security or usage limits of the Service;
• use automated scraping, bulk extraction or unauthorized copying of CrystalSpec's software, interface, documentation, outputs or datasets to build, train or improve a competing service, except where permitted by law;
• resell or sublicense the Service itself, or offer it to others as a standalone service, unless we agree in writing (this does not restrict the Customer Applications you build);
• create multiple accounts or Workspaces to evade limits, free allowances, payments or suspensions;
• breach sanctions or export controls (Section 33).

19. Reporting Illegal Content and Moderation

• How to report. Anyone can tell us about content in the Service that they believe is illegal or breaches these Terms by writing to support@crystalspec.com with the subject "Content report". A report should explain why the content is illegal, give its exact location, such as its URL, include your name and email address (except for reports of child sexual abuse material), and confirm that you believe in good faith that the report is accurate and complete. Notices of intellectual property infringement can be sent the same way.
• What we do. Our staff review reports in a timely, diligent, non-arbitrary and objective manner, taking into account the rights and legitimate interests of everyone involved, including freedom of expression. We may remove content, disable access to it or restrict its visibility, pause Customer Applications, messages or other features, or suspend or terminate accounts. We confirm receipt of reports and tell the reporter what we decided.
• Statement of reasons. When we restrict content or an account, we tell the affected user what we restricted, why, and how to contest the decision, unless the law prevents it.
• Contesting a decision. You can contest a decision by replying to our notice or by writing to support@crystalspec.com, and a person who was not involved in the original decision where possible will review it. You may also have the right to go to court.
• Repeat infringers. We may terminate the accounts of users who repeatedly provide illegal content or repeatedly send unfounded reports.
• Serious crimes. Where we become aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of persons, we inform the competent authorities.
• Points of contact. Our single point of contact for users, and for the authorities of EU Member States, the European Commission and the European Board for Digital Services under Regulation (EU) 2022/2065 (Digital Services Act), is support@crystalspec.com. We communicate in English and Romanian.

20. Plans, Billing, AI Credits and Taxes

• Plans. Plans, seats, prices, quotas, AI credits and add-ons are described in the Service and at checkout. We process payments for our fees through Stripe.
• Automatic renewal. Unless stated otherwise, subscriptions renew automatically for successive periods of the same length until cancelled. You authorize us and our payment provider to charge the applicable fees and taxes to your payment method at each renewal and when you add seats, Members or add-ons.
• Cancellation. Cancellations take effect at the end of the current billing period unless the checkout or billing portal states otherwise.
• AI credits. AI credits are prepaid units for using AI Features. They are not money, electronic money or a deposit, have no cash value, cannot be transferred, sold or exchanged, and are non-refundable except where the law requires otherwise. Credits are consumed at rates we set, which may differ by model, mode and feature and are not a pass-through of provider prices. Included credits reset each billing period, and purchased credits expire as stated at purchase.
• Automatic top-ups. If you enable automatic top-ups, you authorize us to charge your saved payment method, without asking each time, whenever your credit balance falls below the threshold you set, up to the monthly limit you set. You can turn automatic top-ups off at any time.
• Price changes. We may change our prices. We will tell you at least 30 days in advance about an increase in a recurring fee, which then applies from your next renewal; you can cancel before it applies. Domain prices follow Section 13.
• Failed payments. If a payment fails, we may retry it, and we may suspend paid features, downgrade the Workspace or suspend access until it is paid.
• Refunds, reversals and chargebacks. Except where required by law or expressly stated in writing, fees are non-refundable. If a payment is refunded, reversed or charged back, we may remove the credits or features it paid for, and credits already used become an amount you owe, which we may charge or deduct from future credits.
• Billing questions. If you believe a charge is wrong, contact us within 30 days of the charge.
• Taxes. Taxes are calculated at checkout from the billing information you provide, which must be accurate. You are responsible for taxes, duties, bank charges and similar amounts associated with your purchases, other than taxes on our income.
• Consumers. If you are a consumer in the European Union, you may withdraw from a paid subscription within 14 days of purchase. If you ask us to start the paid service during that period, you will pay for the service provided until you tell us you are withdrawing. You lose the right of withdrawal for digital content, such as AI credits, once you have used it after expressly agreeing that its supply may start immediately.

21. Free Plans, Trials and Beta Features

• Free plans and trials are provided as they are, may have lower limits, may route AI requests as described in Section 6, and may be changed, limited or ended at any time. When a trial ends, paid features stop or the paid plan starts, as shown when the trial began.
• Features labelled beta, preview, experimental or similar may be incomplete, may change or be withdrawn without notice, and are provided without any commitment.
• If a free Workspace has been inactive for 12 months, we may delete it after giving its owners at least 30 days' notice by email.

22. Third-Party Services

CrystalSpec relies on Third-Party Services for hosting, storage, payments, email, domains, AI models and integrations. Some features require you to accept a provider's terms, for example Stripe for payments or Google for Gmail. Third-Party Services are provided by their operators under their own terms; we do not control them and are not responsible for their availability, security, accuracy or changes, or for losses they cause. If a Third-Party Service changes or stops, the related features may change or stop.

23. Data Protection and Processing Terms

For account registration, billing, service administration, security, support, our website and our own analytics, we act as controller, as described in our Privacy Policy. For personal data in Customer Content, you are the controller (or a processor acting for your own clients) and we act as your processor (or sub-processor). Unless we have signed a separate data processing agreement with you, which then prevails, this Section is the data processing agreement between you and us under Article 28 of the GDPR.

• Scope. We process personal data in Customer Content to provide the Service, including hosting, storage, transmission, AI processing, messaging, payment features, support and security, for as long as we provide the Service to you and until deletion under Section 26. The data concerns whatever you choose to submit, and the data subjects are your Members, End Users, clients, contacts, staff and anyone else whose data you submit.
• Instructions. We process that data only on your documented instructions. These Terms and your use and configuration of the Service, including your choice of plan and of the AI routing described in Section 6, are your instructions. If the law requires other processing, we will tell you first unless the law prohibits it.
• Confidentiality and security. People we authorize to process the data are bound by confidentiality, and we apply appropriate technical and organizational measures under Article 32 of the GDPR.
• Sub-processors. You give us general authorization to use sub-processors. Our current list is available on request at support@crystalspec.com. We will inform you of intended changes and you may object on reasonable grounds; if we cannot address your objection, you may stop using the affected feature or terminate. We bind sub-processors to equivalent data protection obligations and remain responsible for them.
• Assistance. Taking into account the nature of the processing and the information available to us, we assist you with requests from data subjects, mainly through the Service's own tools, and with your obligations on security, breach notification, impact assessments and prior consultation.
• Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting your data.
• Deletion. When the Service ends, we delete or return the data as described in Section 26 and our Privacy Policy, unless the law requires us to keep it.
• Audits. We make available the information reasonably necessary to demonstrate compliance with Article 28, primarily through documentation and answers to reasonable written questions. Inspections take place only where required by law or a supervisory authority, on reasonable notice, at most once a year, under confidentiality and at your cost.
• Transfers. Where data is transferred outside the European Economic Area, we rely on adequacy decisions, Standard Contractual Clauses or other safeguards permitted by the GDPR.
• Your obligations. You are responsible for the lawfulness of your instructions, for having a lawful basis, for informing data subjects through your own privacy notices, and for not submitting special categories of data unless that is necessary and lawful.

24. Security and Access

• We use reasonable technical and organizational measures to protect the Service. No system is perfectly secure, and we cannot guarantee that unauthorized access will never happen.
• You are responsible for your Members' access and permissions, for strong credentials, for your devices and tokens, for how you configure public sharing and Customer Applications, and for telling us promptly about suspected unauthorized access or vulnerabilities.
• Our authorized staff may access your Workspace and Customer Content, including by acting as a user, only where needed to provide support you request, keep the Service secure, investigate abuse or breaches of these Terms, or comply with the law. That access is restricted and logged.

25. Service Changes, Availability and Support

We may improve, change, limit, suspend or discontinue parts of the Service. If we discontinue a paid feature you have prepaid for, we will give you reasonable notice and, where appropriate, a pro-rata credit or refund for the unused prepaid period. We try to keep the Service reliable, but we do not guarantee that it, or your Customer Applications, will be available without interruption or error. Unless we sign a service level agreement with you, we make no commitment on availability, response times or support. Maintenance, provider outages and incidents may make the Service or your Customer Applications unavailable. Support is provided by email on a reasonable-efforts basis.

26. Suspension and Termination

• By you. You may stop using the Service at any time, cancel paid plans through the billing flow, and delete your account from your profile. Workspace owners can delete their Workspaces.
• Suspension by us. We may suspend or restrict all or part of the Service, a Customer Application, a public page, a domain service or an account, with immediate effect where reasonably necessary, if you breach these Terms or the law, fail to pay, create a risk to the security or operation of the Service, our providers, Members, End Users or others, engage in fraud or abuse, or if the law, an authority or one of our providers (such as Stripe, Cloudflare or a registry) requires it. Where reasonably possible, we will tell you and give you a chance to fix the problem.
• Termination by us. We may terminate these Terms or close a Workspace with immediate effect for a serious or repeated breach, or for any other reason with at least 30 days' notice, in which case we refund any prepaid fees for the unused period.
• Effect. When access ends, Customer Applications and public pages stop, and you remain responsible for amounts you owe. Domains stay registered to your Workspace until they expire, and you can ask to transfer them under Section 13. We delete or anonymize Customer Content as described in our Privacy Policy. Export what you need before you close your account; once a Workspace or account is deleted, its content may not be recoverable. If we terminate for a reason other than your breach, we will give you a reasonable opportunity to export your data first.
• Survival. Sections that by their nature should survive termination survive, including those on payment, Customer Applications and End Users, intellectual property, confidentiality, data protection, disclaimers, limitation of liability, indemnity and governing law.

27. Intellectual Property and Feedback

CrystalSpec, including its software, interface, design, documentation, trademarks and underlying technology, is owned by us or our licensors. These Terms do not transfer ownership of any of it to you. You receive a limited, revocable, non-exclusive, non-transferable right to use the Service under these Terms and your selected plan. If you send us ideas, suggestions or other feedback, we may use them without restriction or compensation to you.

28. Confidentiality

Each party may receive non-public information from the other. The receiving party will use reasonable care to protect that information and will use it only for purposes related to the Service, except where disclosure is required by law.

29. Disclaimers

To the maximum extent permitted by law, the Service, Output and all features are provided "as is" and "as available". We disclaim all implied warranties, including merchantability, fitness for a particular purpose, non-infringement, and uninterrupted, secure or error-free operation. We do not warrant that Output, Customer Applications, generated code, tax calculations, exchange rates, signature evidence, research results or third-party data are accurate, complete, lawful or fit for your purpose, or that the Service will meet your requirements or legal obligations. Mandatory consumer rights are not limited by this Section.

30. Limitation of Liability

To the maximum extent permitted by law:

• neither we nor our affiliates, staff or suppliers will be liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, sales, business, goodwill or anticipated savings, loss or corruption of data, business interruption, the cost of substitute services, or fines and penalties imposed on you, however caused, even if they were foreseeable;
• we are not liable for losses caused by Customer Content, Customer Applications, Output you chose to use, automations or integrations you enabled, Third-Party Services, your End Users, or your breach of these Terms;
• our total aggregate liability for all claims arising out of or relating to these Terms or the Service will not exceed the amounts you paid us for the Service in the twelve months before the first event giving rise to liability, or EUR 100 if you have not paid us anything.

Nothing in these Terms excludes or limits liability for damage caused intentionally or through gross negligence, for death or personal injury, for fraud, or any other liability that cannot be excluded or limited by law, including under mandatory consumer law. These limits do not limit your obligation to pay fees, your indemnity obligations, or remedies for unauthorized use of the Service, infringement of our intellectual property or breach of confidentiality.

31. Indemnity

You will defend, indemnify and hold harmless us, our affiliates and our staff from and against all third-party claims, including claims by your End Users, Members, buyers, signers, recipients, payment providers, registries and authorities, and against related losses, damages, fines, penalties, costs and reasonable legal fees, arising from your Customer Content or Customer Applications; goods and services you sell and your dealings with End Users; messages you send; domains you register or use; documents you send for signature; your use of Output; automations and integrations you enable; your breach of these Terms or of the law; or your violation of the rights of others. We will tell you promptly about a claim, let you control its defence, and cooperate reasonably at your cost, but you may not settle a claim in a way that imposes obligations on us without our written consent. If you are a consumer, this Section does not apply, and your liability is governed by applicable law.

32. Force Majeure

We are not responsible for any failure or delay caused by events beyond our reasonable control, including force majeure within the meaning of Article 1351 of the Romanian Civil Code, natural disasters, war, terrorism, epidemics, labour disputes, failures of power or networks, cyberattacks, failures or changes of Third-Party Services, and acts of authorities.

33. Sanctions and Export Controls

You confirm that neither you nor your Workspace's owners or Members are subject to sanctions of the European Union, the United Nations, the United Kingdom or the United States, or located or ordinarily resident in a country or region subject to comprehensive sanctions. You will not use the Service to provide anything to such persons or places, or otherwise breach sanctions or export control laws. We may suspend or close accounts to comply with those laws.

34. Changes to These Terms

We may update these Terms to reflect changes to the Service, the law or our business. We will notify you of material changes by email or in the Service at least 15 days before they take effect, unless a change is required by law or needed to address security risks or abuse, in which case it may take effect sooner. If you do not agree, you may stop using the Service and cancel before the change takes effect; if you prepaid for a period, you may ask for a pro-rata refund of the unused part. Continued use after the effective date means that you accept the updated Terms. We may also ask you to accept updated Terms expressly.

35. Governing Law and Disputes

These Terms and any dispute relating to them or to the Service are governed by Romanian law, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. Before starting proceedings, the parties will try in good faith to settle a dispute amicably within 30 days of written notice. Disputes will be submitted to the competent courts of Iași, Romania. If you are a consumer, you may also bring proceedings in the courts of your country of residence, and the mandatory protections of that country's law apply. Consumers may also be entitled to use alternative dispute resolution; in Romania, the competent body is the National Authority for Consumer Protection (ANPC) — see anpc.ro/ce-este-sal.

36. General

• We may assign or transfer these Terms to an affiliate or in connection with a merger, acquisition or sale of assets. You may not assign them without our written consent.
• These Terms, together with the documents they refer to, are the entire agreement between you and us about the Service and replace any earlier version.
• If any provision is found invalid or unenforceable, it will be limited to the minimum extent necessary, and the rest of these Terms remain in effect.
• Not enforcing a provision is not a waiver of our right to enforce it later.
• We may send notices to the email address of your account or through the Service. You can send notices to support@crystalspec.com. Electronic notices and acceptance satisfy any requirement that they be in writing, to the extent permitted by law.
• The parties are independent contractors. These Terms create no partnership, agency or employment relationship and give no rights to third parties.
• These Terms are written in English. If we provide a translation, the English version prevails, except where the law requires otherwise.

37. Contact

Questions about these Terms can be sent to support@crystalspec.com or to ORGANIZING GROUP SRL, Str. Mihail Sadoveanu 44, Valea Ursului, Iași, Romania.