Terms of Service

1. Acceptance of These Terms

These Terms of Service ("Terms") form a binding agreement between you and Apolaris AI ("Apolaris", "we", "us" or "our"), the operator of the website at apolaris.net and the software platform accessible at app.apolaris.net and related subdomains. The service is provided by Apolaris AI S.L., a company established in Spain; the registered entity offering this service is identified as APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain.

By creating an account, accessing the marketing website, subscribing to a plan, or otherwise using any part of the service, you accept these Terms and our Privacy Notice (aviso de privacidad). If you are entering into these Terms on behalf of a business or other organization, you represent that you have authority to bind that entity, and "you" and "your" refer to that entity.

If you do not agree to these Terms, you must not use the service.

2. Description of the Service

Apolaris AI is a multi-tenant Software-as-a-Service ("SaaS") platform for service and retail businesses, together with a public marketing website. Depending on your plan and configuration, the platform provides the following modules:

• Appointment booking and calendar management, with online booking pages for your clients;
• Point of sale (POS) and payment collection;
• Inventory and supply management;
• Human resources (HR) and payroll;
• Customer relationship management (CRM) and a loyalty program;
• An omnichannel WhatsApp contact center (via the Meta WhatsApp Cloud API or a self-hosted WAHA gateway) with an AI agent that answers customer messages;
• Voice telephony with an AI voice agent, including call recording and transcription;
• Customer-journey marketing automation across email, SMS and WhatsApp, with opt-out (STOP-word) handling;
• AI-assisted security cameras and computer vision (event detection, people counting and attendance);
• An AI copilot and an analytics/data explorer;
• Competitor intelligence: map-based discovery of nearby businesses from public map data (OpenStreetMap or, optionally, Google Places) and an AI advisor that combines it with your own figures;
• An AI-assisted automation builder with scheduled and event-triggered rules, conditional actions (manager tasks, customer email or contact-center message, and webhooks to external systems) that queue for human approval, and an audit trail;
• Advanced analytics and reporting with multi-format export (CSV, Excel, PDF, Word), saved reports, AI-assisted report building, and scheduled delivery;
• Multi-site and franchise management;
• A public website builder hosting tenant marketing sites on platform subdomains and custom domains (including domain purchase);
• Push notifications and transactional and marketing email;
• An optional Consents & Clinic History module for signed consent documents and clinical/treatment history (see Section 9);
• A token-authenticated REST API.

The service is delivered through the subdomains app.apolaris.net (application), portal.apolaris.net (staff portal), docs.apolaris.net (documentation) and support.apolaris.net (support). The platform interface is available in sixteen languages; these legal documents are maintained in English, Spanish and French, and the English version prevails in case of divergence. The platform is operated by us as a fully-managed cloud service. On-premise (self-hosted) deployment is offered only to large enterprise customers and is subject to review and approval. We may add, modify or discontinue features over time.

3. Accounts, Eligibility and Security

To use the platform you must register an account and may create additional user accounts for your staff. You must be of legal age to enter into a contract in your jurisdiction and must provide accurate and complete registration information and keep it current.

You are responsible for all activity that occurs under your account and the accounts you create. You agree to:

• Keep credentials and API tokens confidential and not share them;
• Use the role-based access controls to grant each user only the access they need;
• Enable available security measures, including optional two-factor authentication and passkey (biometric) sign-in, where appropriate; and
• Notify us promptly at [email protected] of any suspected unauthorized access or security incident.

We protect sign-in with hardened authentication, including an offline arithmetic challenge, a honeypot and failed-attempt throttling that operate without third-party CAPTCHA services or external trackers. Users may also enable passkey (WebAuthn) sign-in using a device fingerprint, face scan or PIN; the biometric is verified on the user's own device and is never transmitted to or stored by Apolaris — only a public-key credential is stored. We apply role-based access control with an activity audit log, strict per-tenant data isolation and encryption of data in transit. No method of transmission or storage is completely secure, and you remain responsible for safeguarding your own credentials and devices.

4. Acceptable Use

You agree not to use the service to, and not to permit any user to:

• Violate any applicable law or regulation, or infringe the rights of others;
• Upload or transmit malware, or attempt to gain unauthorized access to the platform, other tenants' data, or underlying infrastructure;
• Probe, scan or test the vulnerability of the service except as expressly authorized, or circumvent per-tenant isolation, rate limits or access controls;
• Send unlawful, deceptive or unsolicited messages through the WhatsApp contact center, SMS or email features, or otherwise violate the policies of the underlying messaging providers;
• Deploy the AI security cameras, computer vision, biometric or attendance features without a lawful basis and the notices and consents required where the cameras operate;
• Use the AI features to generate unlawful content or to make decisions about individuals without appropriate human oversight; or
• Resell, sublicense or provide the service to third parties except as permitted by your plan, or reverse engineer the platform except to the extent such restriction is prohibited by law.

You are solely responsible for the lawfulness of the data you collect and process through the platform, including obtaining any required notices, consents and legal bases from your end-customers and employees.

5. Customer Data and Ownership

As between you and Apolaris, you own all data that you and your users submit to or generate within the platform ("Customer Data"). This includes your business and account data, your end-customers' personal data (such as names, contact details and booking and purchase history), employee and HR data including payroll, WhatsApp message content, any camera footage or events, and AI prompts and queries.

For Customer Data that constitutes personal data of your end-customers and employees, you act as the data controller and Apolaris acts as a data processor that processes such data on your behalf and on your documented instructions, under our Data Processing Addendum ("DPA"), which forms part of these Terms. We grant ourselves no ownership of Customer Data. We use Customer Data only to provide, secure, maintain and improve the service, to comply with law, and as otherwise instructed by you.

Apolaris acts as the data controller for the marketing website, sales leads, and customer-account data (the information that identifies and administers your account with us). Our handling of that data is described in our Privacy Notice.

Payment card data is processed by our payment providers; Apolaris does not store full card numbers and handles only payment metadata necessary to operate billing and POS features. You may export your Customer Data through the platform's export features and the REST API during your subscription.

6. Data Protection, Privacy and AI Transparency

We process personal data in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR) and ePrivacy rules where they apply, and Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) as in force in 2026.

Data subjects retain their rights under applicable law. Under the LFPDPPP, individuals may exercise their ARCO rights — Access (Acceso), Rectification (Rectificación), Cancellation (Cancelación) and Opposition (Oposición). Under the GDPR, individuals retain rights of access, rectification, erasure, restriction, portability and objection. Where Apolaris acts as processor, requests from your end-customers and employees should be directed to you as controller, and we will assist you in responding. Where Apolaris acts as controller, requests may be sent to [email protected].

Our Privacy Notice explains where automated or AI-assisted decision-making is used and whether a human is involved. The platform's AI features — including the AI booking agent and chatbot in the WhatsApp contact center — are designed so that you can keep a human in the loop, and individuals are informed when they are interacting with an automated system, consistent with Article 50 of the EU AI Act. Where the camera features include biometric or emotion-related processing, such transparency and consent requirements apply and these features must be enabled and configured lawfully by you.

Users in the EU/EEA keep their GDPR rights, including the right to lodge a complaint with their local supervisory authority or, as Apolaris is established in Spain, with the Spanish Agencia Española de Protección de Datos (AEPD). Data subjects in Mexico may contact the Mexican data protection authority (INAI). Questions about data protection may be sent to [email protected].

7. Sub-processors and Third-Party Services

To deliver the service, Apolaris relies on the third-party providers below, which may process certain data as sub-processors or independent service providers. Your use of features that depend on these providers is also subject to their respective terms.

Provider	Purpose
Stripe; PayPal; Mercado Pago	Payment processing (card data handled directly by the provider)
Telnyx	Voice telephony carrier (phone numbers, calls and SIP trunking) for the voice module, including the AI voice agent, call recording and transcription
Meta Platforms (WhatsApp Business, via the WhatsApp Cloud API or a WAHA gateway)	WhatsApp messaging for the contact center
AI infrastructure operated by or for Apolaris, currently located in Spain (self-hosted language, vision, speech-to-text and text-to-speech models)	AI copilot, AI agents and other AI features; customer personal data is not sent to third-party AI cloud services
OpenStreetMap (Nominatim and Overpass); Google Places API (optional)	Geocoding and competitor discovery for the competitor-intelligence feature
Cloudflare	DNS, network, CDN, WAF/DDoS protection and secure tunnel
OVHcloud (OVH SAS, France)	SMS carrier (notifications, reminders and two-factor authentication codes); email hosting and relay for transactional, notification and support email; domain-name registration for tenant websites; EU edge server for network failover
Tailscale	Private encrypted network between our own servers (end-to-end-encrypted traffic only)
Browser push services (Google, Apple or Mozilla, depending on the user's browser)	Delivery of the encrypted push notifications users opt into

The platform is hosted on servers owned and operated by Apolaris in Spain (European Union); no public-cloud hosting provider is used for Customer Data. Where you connect your own account with a third-party service — for example your own SMS or telephony carrier account, your own Meta WhatsApp Business account, your own email relay or payment account, or a third-party scheduling or marketplace tool you synchronise with the platform — that provider acts for you under your own agreement with it and is not our sub-processor. We remain responsible for the performance of our sub-processors' obligations to the extent set out in the DPA. We are not responsible for the independent acts or omissions of payment processors, messaging platforms or other third parties, or for any service interruption caused by them. Where you choose to self-host the platform, you are responsible for the third-party services you connect and the infrastructure you operate.

8. AI Features

The platform includes AI-powered features, such as the AI copilot, the AI agents that answer WhatsApp messages and telephone calls, AI-assisted analytics, and computer vision on the security cameras. These features run on self-hosted models on AI infrastructure operated by or for APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain; customer personal data is not sent to third-party AI cloud services. Approved enterprise customers may instead run self-hosted models on their own infrastructure.

AI outputs are generated automatically and may be inaccurate, incomplete or otherwise imperfect. You should review AI outputs before relying on them, and human oversight is expected for any decision that affects individuals, finances, bookings, employment or compliance. You are responsible for your use of AI outputs and for the prompts and data you submit to the AI features. AI outputs are not professional, legal, financial or medical advice.

The automation builder can execute outbound actions — such as sending emails, contact-center messages or webhooks to external systems, or creating manager tasks — based on scheduled rules or real-time business events; high-impact and outward-facing actions are queued for manager approval before they run, and every run is logged in the audit trail. You are responsible for ensuring that the automations you configure comply with applicable law and with recipients' preferences.

Where an AI agent communicates with your end-customers, you must ensure those individuals are informed that they are interacting with an automated system, as required by applicable law.

9. Consents & Clinic History Module

The Consents & Clinic History module is optional add-on functionality that lets you collect signed consent documents from your clients — with the signature captured on screen, via QR code or through a remote signing link, and the document sealed as a PDF with a SHA-256 fingerprint and signature evidence (IP address, device, timestamps) — and keep a clinical/treatment history including allergies, medications, treatment notes, patch tests and clinical photographs. The platform provides tooling only; it does not provide healthcare, medical or legal services.

If you use this module, you are solely responsible for: (a) the medical-legal adequacy of the consent texts you use — any templates provided are generic starting points, not legal advice, and must be reviewed and adapted under your own responsibility; (b) holding the sanitary, professional or other authorizations required for the services you provide; and (c) the lawfulness of collecting and processing your clients' health data, including establishing the required legal basis and obtaining explicit (and, where required, express written) consent.

Signatures captured by the module are simple electronic signatures within the meaning of Regulation (EU) 910/2014 (eIDAS) and applicable e-commerce rules, accompanied by evidence records; you are responsible for assessing whether that signature level is adequate for your intended use. Health data in this module is processed by Apolaris as processor under the DPA, and is subject to statutory clinical-record retention periods that may override deletion requests, as described in the DPA and the Privacy Policy.

10. Messaging, Telephony and Marketing Compliance

When you use the contact-center, telephony, SMS, email or customer-journey marketing features, you must comply with applicable marketing, telecommunications and data protection law and with the policies of the underlying providers, including Meta's WhatsApp Business terms and policies. You must honor opt-outs and withdrawn consents: the platform enforces STOP-word suppression on outbound messaging, but you remain responsible for the lawfulness of your campaigns, for contacting only recipients you are entitled to contact, and for the content you send. Where calls are recorded or transcribed, you are responsible for informing call participants and obtaining any consent required by the law applicable to you.

11. Invoicing and Fiscal Compliance

Where the platform provides billing, invoicing or receipt features, these are tools that support your business, and you remain solely responsible for your own tax, invoicing and record-keeping obligations. Certified or verifiable invoicing formats — including Spain's Verifactu requirements (Royal Decree 1007/2023) and Mexico's CFDI electronic invoicing — are being incorporated into the platform in line with the applicable regulatory calendar. Until APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain announces certified support for a given format, the platform's invoicing features are not certified for it, and if you require Verifactu- or CFDI-compliant invoicing you must issue those invoices through compliant means.

12. Website Builder and Published Content

The website builder lets you publish a public marketing site on a platform subdomain or on a custom domain, which you may purchase through the platform via our domain registrar. You are solely responsible for the content published on your site — including text, images, offers and any material uploaded by you or on your behalf — and you represent that you hold the rights needed for all uploaded material. We may suspend or remove a site that is unlawful, infringes third-party rights or breaches these Terms, including in response to notices from competent authorities or rights holders.

13. Subscription, Plans and Fees

Access to the platform is provided on a subscription basis. Because the platform serves businesses of varying size, module mix and deployment model, pricing is tailored to your selected plan, modules, usage and configuration, as set out in your order, quote or subscription page.

Unless your order states otherwise:

• Fees are billed in advance for each subscription period and are non-refundable except where required by law;
• Usage-based charges (such as messaging, AI usage or additional sites) are billed in arrears according to your plan;
• Fees are exclusive of taxes, and you are responsible for applicable taxes other than taxes on our income; and
• Payment provider fees and the providers' own terms apply to payments processed through Stripe, PayPal or Mercado Pago.

We may change fees or introduce new charges for future subscription periods on reasonable prior notice. If you do not agree to a fee change, you may decline to renew. Late or failed payments may result in suspension as described below.

14. Intellectual Property

The platform, the marketing website, documentation, software, design, trademarks and all related intellectual property are owned by Apolaris AI or its licensors. Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the service for your internal business purposes during your subscription.

You retain all rights in your Customer Data. You grant us the limited rights to host, process and transmit Customer Data as necessary to provide the service and as described in the DPA. If you provide feedback or suggestions, we may use them without restriction or obligation to you.

Except as expressly permitted, you may not copy, modify, distribute, sell, lease or create derivative works of the platform, or remove any proprietary notices.

15. Service Availability and Support

We aim to keep the cloud-hosted platform available and performant, but the service is provided on an "as available" basis. Availability may be affected by maintenance, updates, third-party providers, and events beyond our reasonable control. Any specific availability or support commitments apply only if stated in your order or a separate service-level agreement.

Support is provided through support.apolaris.net, the documentation at docs.apolaris.net, and [email protected], according to your plan. Where you self-host the platform, availability depends on the infrastructure and services you operate, and our support is limited accordingly.

16. Warranties and Disclaimers

We warrant that we will provide the cloud-hosted service with reasonable skill and care. Except for that express warranty, and to the maximum extent permitted by law, the service is provided "as is" and "as available", and Apolaris disclaims all other warranties, whether express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty that the service will be uninterrupted, error-free or completely secure.

We do not warrant that AI outputs, analytics, computer-vision detections, attendance records or other automated results will be accurate or suitable for any particular purpose. Some jurisdictions do not allow the exclusion of certain warranties, so some of these exclusions may not apply to you, and you may have additional rights under mandatory consumer law.

17. Limitation of Liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, data, goodwill or business opportunity, arising out of or relating to the service or these Terms, even if advised of the possibility of such damages.

To the maximum extent permitted by law, Apolaris's total aggregate liability arising out of or relating to the service and these Terms will not exceed the total fees you paid to Apolaris for the service in the twelve (12) months immediately preceding the event giving rise to the claim.

Nothing in these Terms limits or excludes any liability that cannot be limited or excluded under applicable law, including liability for fraud, willful misconduct, or harm to natural persons where such limitation is prohibited.

18. Indemnification

You agree to indemnify and hold harmless Apolaris AI and its personnel from and against any third-party claims, damages, liabilities, costs and expenses (including reasonable legal fees) arising out of or relating to: (a) your Customer Data and your use of the service; (b) your violation of these Terms or of applicable law; (c) your failure to obtain required notices, consents or legal bases from your end-customers or employees; or (d) your configuration or use of the messaging, AI, camera, biometric or attendance features. We will notify you of any such claim and may participate in its defense with our own counsel.

19. Suspension and Termination

You may terminate your subscription as provided in your order. We may suspend or terminate your access if you materially breach these Terms, fail to pay fees when due, use the service in a way that poses a security, legal or operational risk, or if required by law or by a third-party provider.

Where practicable, we will give notice and an opportunity to cure before suspension or termination. Upon termination, your right to use the service ends. We will make Customer Data available for export for a limited period after termination, after which we may delete it in accordance with the DPA and applicable law, except where retention is required by law. Provisions that by their nature should survive termination (including ownership, confidentiality, disclaimers, limitation of liability, indemnification and governing law) will survive.

20. Changes to These Terms

We may update these Terms from time to time. When we make material changes, we will provide reasonable notice, for example by posting the updated Terms with a new effective date or by notifying you through the platform or by email. Changes take effect on the stated effective date. Your continued use of the service after that date constitutes acceptance of the updated Terms. If you do not agree, you should stop using the service before the changes take effect.

21. Governing Law and Dispute Resolution

These Terms are governed by the laws of Spain, without regard to conflict-of-laws rules, and the competent courts of Spain have jurisdiction over disputes — without prejudice to any mandatory consumer-protection rights you may have under the law of your place of residence. The service is provided from Spain to customers in the European Union, Mexico and other markets. Users and data subjects in Mexico retain their rights under Mexican law, including the LFPDPPP and the ARCO rights (Acceso, Rectificación, Cancelación, Oposición), and may contact Mexico's data protection authority (INAI). Users in the EU/EEA retain their rights under EU law, including the right to lodge a complaint with their local supervisory authority or the Spanish Agencia Española de Protección de Datos (AEPD).

The parties will first attempt to resolve any dispute amicably by contacting [email protected]. Nothing in this section deprives consumers or data subjects of protections that cannot be waived under applicable law.

22. Contact

For any questions about these Terms or the service, contact Apolaris AI at [email protected], or through support.apolaris.net. The registered entity providing the service is APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain.