Business Terms of Service

These Business Terms of Service (the "Terms") are an agreement between Kyra.bot Ltd, a company registered in England and Wales under company number 17408470, whose registered office is at 66 Paul Street, London, EC2A 4NA, United Kingdom ("KYRA", "we", "us" or "our"), and the business or sole trader that accepts them ("Customer", "you" or "your").

These Terms govern access to and use of KYRA's multi-tenant, AI-assisted IT-support platform and related websites, portals, channels, APIs and services (the "Service"). The Service is supplied only for business use, principally to managed service providers ("MSPs") supporting their own client organisations ("End Customers").

The agreement between you and KYRA comprises these Terms, each applicable Order Form, the Billing and Fair Usage Schedule, the Data Processing Addendum ("DPA"), the Voice and SMS Service Schedule where telephony is enabled, and any other document that expressly says it forms part of the agreement (together, the "Agreement").

By creating an account, signing an Order Form, or otherwise accepting these Terms through an authorised acceptance flow, you confirm that you have authority to bind the Customer. If you do not have that authority, do not accept or use the Service.

• "Account" means an MSP portal or staff account authorised to use the Service.
• "AI Feature" means a feature that uses a machine-learning or generative-AI model, including answer generation, retrieval, summarisation, classification, ticket enrichment, knowledge assistance and proposed Microsoft 365 actions.
• "Authorised User" means a person whom you authorise to access the MSP portal or use the Service on your behalf.
• "Customer Data" means data, content, documents, configurations, credentials, messages, audio, transcripts and other material submitted to or processed by the Service for you or your End Customers. Customer Data excludes Service telemetry that has been irreversibly anonymised and aggregated so that no person, Customer or End Customer can reasonably be identified.
• "Documentation" means the user, technical, security and integration documentation that KYRA makes available for the Service.
• "End User" means a person who interacts with KYRA through Teams, Slack, SMS, phone, web chat or another enabled channel.
• "Input" means content submitted to an AI Feature; "Output" means content generated by an AI Feature in response to Input.
• "Order Form" means a signed order, online plan selection or other order record specifying the purchased Service, plan, fees and term.
• "Plan" means a Launch, Growth, Enterprise, design-partner or other service plan shown in an Order Form or the MSP portal.
• "Third-Party Service" means a service not operated by KYRA that connects to, hosts, supports or is used by the Service, including Microsoft Azure, Microsoft Teams and Graph, Slack, Stripe, Twilio, AI-model providers, PSAs and documentation platforms.

3.1 KYRA provides AI-assisted first-line IT support across the channels and integrations enabled by you. Depending on configuration, the Service may retrieve information from a tenant-scoped knowledge base, propose answers, create or enrich tickets, surface Microsoft 365 information, or propose or perform approved actions.

3.2 Features, channels and integrations depend on the Plan, Customer configuration and availability of relevant Third-Party Services. We do not promise that every feature is available in every country, language, tenant, channel or plan.

3.3 We may improve or change the Service. We will not materially reduce the core functionality of a paid Plan during its current committed term without reasonable advance notice, except where a change is reasonably required to address security, safety, law, provider deprecation or a material operational risk.

3.4 We may provide previews, betas or experimental features. We will label them where reasonably practicable. Unless an Order Form states otherwise, they are supplied for evaluation, may change or be withdrawn, and are excluded from service-level commitments.

4.1 KYRA uses AI. End Users must be informed that they are interacting with an AI system. You must not remove or obscure disclosures supplied by KYRA and must provide any additional notice required for your jurisdiction or workforce.

4.2 Outputs are probabilistic. They may be incomplete, inaccurate, outdated, inappropriate or non-unique. The Service is designed to assist IT-support workflows, not replace competent human judgment for material, privileged, safety-critical or legally significant decisions.

4.3 You are responsible for selecting appropriate knowledge sources, integration permissions, action modes, approval policies and human oversight. You must review Outputs and proposed actions to the degree reasonably appropriate to their risk.

4.4 KYRA will enforce the technical capability and approval controls described in the Documentation. You must not use an AI Feature to make solely automated decisions producing legal or similarly significant effects on individuals unless that use has been separately assessed, configured and documented in compliance with applicable law.

4.5 KYRA is not an emergency, medical, legal, financial, physical-security or life-safety service. End Users must be directed to appropriate emergency or professional services where required.

4.6 Further information is provided in the AI Transparency and Acceptable Automation Notice.

5.1 You must provide accurate registration and billing information and keep it current.

5.2 You are responsible for Authorised Users, role assignments, customer scope, approval policies and actions taken through your Accounts. Accounts must be individual and must not be shared except where the Documentation expressly permits a non-human service identity.

5.3 You must use strong authentication, enable single sign-on and multi-factor authentication where available, protect credentials and API keys, and promptly remove access that is no longer required.

5.4 You must notify KYRA promptly at [email protected] if you reasonably suspect unauthorised Account access, credential compromise or misuse of the Service.

5.5 KYRA may require a password reset, session revocation, authentication step-up or temporary restriction where reasonably necessary to protect the Service, Customer Data or other customers.

6.1 You are responsible for:

• having an appropriate contract and authority to provide the Service to each End Customer;
• giving End Users required privacy, monitoring, AI, recording and employment notices;
• obtaining any consent or other authority required for Customer Data, telephony and connected systems;
• ensuring instructions and configurations are lawful and proportionate;
• the accuracy, quality and lawful origin of Customer Data and knowledge content;
• maintaining your PSAs, directories, channels and other customer-controlled systems;
• reviewing permissions and disabling integrations or actions no longer needed;
• handling first-line complaints and rights requests from End Users where you or an End Customer is controller.

6.2 You must not use the Service to:

• violate law, third-party rights or the Agreement;
• process data unrelated to legitimate IT service management without our written agreement;
• submit secrets, passwords, payment-card data or special-category data unless necessary, lawful and supported by an agreed configuration;
• develop malware, evade security controls, facilitate unauthorised access or conduct harmful surveillance;
• make emergency calls or route calls to prohibited, premium, service or short-code destinations;
• reverse engineer or extract models, source code or security mechanisms except where law expressly permits and cannot be excluded;
• conduct load, penetration or vulnerability testing against production without written authorisation;
• use the Service to train or develop a competing foundation model or substantially similar hosted service using non-public KYRA materials;
• resell or sublicense the MSP portal itself except as expressly permitted by the Plan.

6.3 You must not represent an AI Output as verified human advice where it has not been appropriately reviewed.

7.1 You must pay the fees in the Order Form and Billing and Fair Usage Schedule. Unless stated otherwise, recurring subscription fees are billed monthly in advance and metered usage is billed monthly in arrears.

7.2 Prices exclude VAT and similar taxes. You are responsible for applicable taxes other than taxes on KYRA's net income. Where required, KYRA will add VAT or other taxes to the invoice.

7.3 You authorise KYRA and its payment processor to charge the payment method associated with your Account for properly due amounts. KYRA does not directly receive or store complete payment-card details.

7.4 You must raise a good-faith billing dispute within 30 days after the relevant invoice, explaining the disputed item. You must pay undisputed amounts when due. The parties will work reasonably to resolve the dispute and correct substantiated errors.

7.5 If an undisputed invoice remains overdue 14 days after written notice, KYRA may suspend paid features or the Account. We will not suspend where the overdue amount is subject to an unresolved good-faith dispute and undisputed amounts have been paid.

7.6 We will give at least 30 days' written notice of a price increase or reduction in an included allowance, unless the increase is required solely by a change in tax or a customer-requested feature or order. A price increase takes effect no earlier than the end of the notice period and, for a fixed committed term, ordinarily at renewal unless the Order Form states otherwise.

8.1 As between the parties, you retain rights in Customer Data and Inputs. You grant KYRA a non-exclusive, worldwide, limited licence to host, copy, transmit, transform and otherwise process Customer Data only to provide, secure, maintain and support the Service, comply with documented instructions, prevent abuse, and meet legal obligations.

8.2 KYRA will not sell Customer Data, use it for third-party advertising, or use identifiable Customer Data to train general-purpose models for other customers.

8.3 KYRA may generate and use irreversibly anonymised and aggregated statistics for capacity planning, security, service improvement and business reporting. KYRA will not attempt to re-identify that information or disclose it in a manner that identifies a Customer, End Customer or individual.

8.4 Subject to your compliance with the Agreement and to any rights of third-party model providers, KYRA grants you a non-exclusive licence to use Outputs for your internal business and customer-support purposes. Outputs may not be unique; other users may receive similar material.

8.5 You must not rely on Output ownership or non-infringement without appropriate review. If an Output substantially reproduces Customer Data or third-party content, rights in that underlying material remain unaffected.

9.1 KYRA and its licensors retain all rights in the Service, KYRA software, interfaces, designs, workflows, Documentation and improvements ("KYRA Technology"). KYRA Technology excludes Customer Data and third-party AI models or Third-Party Services.

9.2 If you provide feedback, you grant KYRA a perpetual, irrevocable, royalty-free right to use it without identifying you or disclosing your confidential information.

9.3 No rights are granted except those expressly stated in the Agreement.

10.1 The Service interoperates with Third-Party Services. Their availability, data practices, terms and technical behavior are outside KYRA's direct control.

10.2 Where you select, contract for or configure your own PSA, documentation platform, Microsoft tenant, Slack workspace or other customer-controlled service, you are responsible for that relationship, its licences and permissions. KYRA acts on your instruction when transmitting Customer Data to it.

10.3 KYRA remains responsible for subprocessors it appoints as required by the DPA. The current list is in the Subprocessor Notice.

10.4 A failure of a Third-Party Service will not by itself make KYRA liable for matters outside its reasonable control, but KYRA will use commercially reasonable efforts to mitigate, communicate and restore the affected integration.

11.1 "Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or should reasonably be understood as confidential, including Customer Data, credentials, security information, pricing, product plans and source code.

11.2 The receiving party will use Confidential Information only to perform or exercise rights under the Agreement, protect it with at least reasonable care, and disclose it only to personnel, professional advisers and subcontractors who need it and are bound by confidentiality obligations.

11.3 Confidential Information excludes information the receiving party can demonstrate: was lawfully known without restriction; becomes public without breach; is received lawfully from a third party without duty; or is independently developed without use of the discloser's information.

11.4 A party may disclose Confidential Information where legally required, provided it gives advance notice where lawful and reasonably assists protective measures.

11.5 Confidentiality obligations survive for five years after termination and, for trade secrets, credentials and personal data, for so long as the information remains protected or confidential by nature or law.

12.1 Each party will comply with data-protection law applicable to its role.

12.2 KYRA acts as controller for its own account, billing, security, service-administration and direct business relationship data, as described in the Privacy Notice.

12.3 Where KYRA processes personal data for you or an End Customer, the DPA applies. If you act as processor for an End Customer, you appoint KYRA as your subprocessor and warrant that you are authorised to do so.

12.4 International transfers and subprocessors are governed by the DPA and Subprocessor Notice.

13.1 KYRA will maintain appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in the Security Measures Schedule to the DPA.

13.2 No online service is completely secure. You are responsible for using available security controls and for promptly reporting suspected incidents.

13.3 KYRA may update security measures to reflect risk, technology and law, provided the overall protection is not materially reduced during a paid term.

14.1 KYRA targets 99.5% monthly availability for the production API and MSP portal. This is a service objective, not a service-credit commitment, unless an Order Form expressly includes an SLA.

14.2 Availability excludes scheduled maintenance notified at least 48 hours in advance where practicable; emergency security maintenance; Customer or End-Customer systems and configurations; suspension under the Agreement; and events outside KYRA's reasonable control.

14.3 Standard support is provided through the portal and [email protected] during UK business hours, Monday to Friday, 09:00–17:30 UK time, excluding public holidays in England. We aim to acknowledge standard requests within one business day. An Order Form may specify enhanced support.

15.1 Each party warrants that it has authority to enter the Agreement.

15.2 KYRA warrants that it will provide the paid Service with reasonable care and skill and substantially in accordance with the Documentation.

15.3 If KYRA materially breaches clause 15.2 and does not remedy the breach within a reasonable period after notice, your exclusive contractual remedy is re-performance or, if re-performance is not reasonably possible, termination of the affected Service and a pro-rata refund of prepaid unused fees for that Service.

15.4 Except as expressly stated and to the maximum extent permitted by law, the Service, AI Features, Outputs and Third-Party Services are provided without implied warranties of uninterrupted operation, error-free output, fitness for a particular purpose or non-infringement. Nothing in this clause excludes obligations that cannot lawfully be excluded.

16.1 KYRA may suspend affected access where reasonably necessary to address: a material security risk; unlawful use; a material Acceptable Use breach; provider or legal restriction; or overdue undisputed fees under clause 7.5.

16.2 Where practicable, KYRA will give notice, limit suspension to the affected feature or tenant, and restore access promptly when the issue is resolved.

16.3 Emergency suspension may occur without advance notice where delay would materially increase risk.

17.1 The Agreement starts when you first accept it or the Order Form begins and continues for the term stated in the Order Form. If no committed term is stated, it continues monthly.

17.2 For a monthly agreement, either party may terminate on 30 days' written notice. A committed agreement may be terminated for convenience only as stated in its Order Form.

17.3 Either party may terminate for material breach if the other does not remedy a remediable breach within 10 business days after written notice. A party may terminate immediately for insolvency, unlawful performance, or an irremediable material breach.

17.4 On termination:

• access ends on the effective termination date, subject to any agreed transition period;
• accrued fees remain due;
• you may export Customer Data during the 30-day period before deletion, unless immediate deletion is requested;
• KYRA will delete or return processor data as described in the DPA;
• each party will return or destroy the other's Confidential Information, subject to legal retention and protected backups.

17.5 Clauses intended by nature to survive do so, including accrued payment, IP, confidentiality, data protection, liability, indemnities and general terms.

18.1 Nothing limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, wilful misconduct, or liability that cannot lawfully be limited.

18.2 Subject to clause 18.1, neither party is liable for indirect or consequential loss, or loss of profit, revenue, goodwill, anticipated savings or business opportunity, except that amounts properly payable to a third party under an indemnity are treated as direct loss.

18.3 Subject to clause 18.1, each party's aggregate liability arising from the Agreement in any rolling 12-month period will not exceed the fees paid or payable for the Service during the 12 months preceding the first event giving rise to liability.

18.4 The exclusions and caps apply regardless of cause of action and reflect the fees and risk allocation agreed by the parties.

19.1 You will defend KYRA against a third-party claim that Customer Data, your instructions or your unlawful use of the Service infringes that third party's IP, privacy or other rights, and indemnify KYRA for court-awarded damages and reasonable settlements, provided KYRA promptly notifies you, gives reasonable control of the defence, and cooperates at your expense.

19.2 KYRA will defend you against a third-party claim that unmodified KYRA Technology, used as permitted, infringes a UK patent, copyright or registered trade mark, and indemnify you for court-awarded damages and reasonable settlements on the same procedural conditions.

19.3 KYRA has no obligation under clause 19.2 to the extent a claim results from Customer Data, Third-Party Services, unauthorised modification or use, combination not supplied by KYRA, or continued use after KYRA offers a reasonable non-infringing alternative.

19.4 If an infringement claim is likely, KYRA may procure continued use, modify or replace the affected feature, or terminate it and refund prepaid unused fees. This clause states the exclusive remedy for third-party IP infringement.

20.1 KYRA may update online terms on at least 30 days' notice for a material adverse change. Security, legal or provider-required changes may take effect sooner where reasonably necessary.

20.2 If a material change substantially and adversely affects a monthly Service, you may terminate before it takes effect. Changes to a committed Order Form require agreement unless the Order Form expressly permits them.

20.3 KYRA will retain the version accepted by each Customer. Publication of a new Privacy Notice does not by itself create consent or amend the parties' data-protection roles.