Terms of Service — Intellayer

Version 2.2 · in force from 2 October 2026

1. Who you are contracting with

These Terms of Service (the “Terms”) are a binding agreement between:

AS Creative Technologies LTD, trading as Intellayer, a private limited liability company registered in the Republic of Cyprus, of Alamanas 50, Dali, Nicosia 2547, Cyprus (“Intellayer”, “we”, “us”); and

the organisation that subscribes to Intellayer (the “Customer”, “you”), together with every individual you authorise to use the Service on your behalf (each a “User”).

Full identification details are on the legal information page.

The Terms govern Intellayer — the product for businesses — however accessed: the portal at https://crm.intellayer.app, our mobile applications, our APIs, and the communications the platform sends as part of the service (together, the “Service”).

By subscribing or using the Service you agree to these Terms, to the Privacy Policy, and to the Data Processing Agreement (the “DPA”), each of which forms part of this agreement. The DPA is accepted by a separate confirmation at sign-up and is required by Article 28 of the GDPR — without it, neither of us may lawfully process your customers’ personal data through the platform.

2. Who may subscribe

To subscribe you must be a business — a company, partnership, sole trader or other organisation — acting in the course of your trade, business, craft or profession, and the person accepting must have authority to bind you.

You must also hold whatever registrations, permissions and safeguarding arrangements your activities require. We do not verify them, and nothing about your having an account represents that we have. If your organisation works with children or vulnerable adults, section 7.3 applies to you.

Every User must be at least 18.

3. Your account and your users

3.1 Your organisation. We create one organisation for you and an administrator account for the person who signs up. Administrators can invite further Users and set their roles.

3.2 Roles. The Service distinguishes administrative access — user management, billing, organisation settings, deletion — from ordinary operational access. Assigning roles correctly is your responsibility, and it is the main control you have over who inside your organisation can see what.

3.3 Security. Each User must use a password not used elsewhere, keep it confidential, enable two-factor authentication where offered, and report suspected compromise to [email protected].

3.4 You are responsible for your Users. You are responsible for everything done under your organisation’s accounts, and for all charges incurred under them, whether or not you authorised the particular act. You must remove access promptly when someone leaves or no longer needs it. We are not responsible for what a User does with access you failed to revoke.

3.5 Accurate details. Keep your legal name, registration and tax identifiers, address, billing details and admin contact email current. Notices we send to your admin contact address are effective whether or not anyone reads them.

4. What the Service is — and what it is not

4.1 What it does. The Service provides:

• a customer, member and lead database, with pipeline, quotations and custom fields;
• tasks, calendars and scheduling;
• invoicing and payment collection where you enable it;
• a shared team inbox, with optional connection of a Gmail or Microsoft 365 mailbox;
• reporting and analytics across your records;
• optional AI-assisted features, each of which is off until you switch it on.

4.2 What it is not. The Service is a business tool. It is not:

• a substitute for your own professional judgement, or for advice from someone qualified and regulated to give it;
• a guarantee of any commercial outcome;
• a safety-critical system;
• a compliance product. It does not make you compliant with anything, and we do not represent that using it discharges any obligation you have.

You remain solely responsible for your obligations to your members, customers and — where your organisation works with them — to children and their guardians. That includes safeguarding, duty of care, eligibility and registration rules, ticketing and crowd safety, and your own regulatory obligations. The Service records information; it does not discharge a duty.

4.3 Third-party data. Where the Service displays data obtained from a third party, we present what that third party provides. We do not independently verify it and we cannot correct it at source.

4.5 Beta and preview features. We may label a feature as beta, preview or early access. Those are provided as is, may change or be withdrawn without notice, are excluded from any availability target, and are used at your own risk. Do not rely on a beta feature for anything that matters.

4.6 Changes to the Service. We may add, change or remove features. If a change materially reduces a paid feature you are actively using, we will give you at least 30 days’ notice and you may terminate the affected part of your subscription and receive a refund of the unused portion.

5. Availability

5.1 What we aim for. We aim to keep the Service available 99.5% of each calendar month, measured outside announced maintenance windows.

5.2 What that is and is not. That figure is a target, not a warranty, and there is no service-credit scheme attached to it. We say this plainly rather than publishing a guarantee we have no mechanism to honour: we are a small operation and an uptime guarantee we could not stand behind would be worth less to you than an honest target. If you need a contractual availability commitment with credits, tell us before you subscribe and we will discuss whether we can offer one and at what price.

5.3 Prolonged outage. If the Service is unavailable for more than 72 consecutive hours, or for more than 5% of the hours in a calendar month, you may terminate your subscription immediately by written notice and we will refund the unused portion of anything you have prepaid, plus the fees attributable to the affected period.

5.4 Dependencies. The Service depends on the providers listed in section 10 and on the public internet. We are responsible for choosing and managing our suppliers; we are not responsible for their acts, omissions or outages beyond that, and such an outage is not a breach of these Terms by us.

5.5 Maintenance. We will give reasonable notice of planned maintenance where we can, and will schedule it outside normal Cyprus business hours where practical. Emergency maintenance may happen without notice.

6. Fees, VAT and payment

6.1 Fees. Fees are those shown for your plan at the time you subscribe, in euro, and exclusive of VAT unless stated otherwise.

6.2 VAT. Intellayer is not VAT-registered as at the date of this document.

Where VAT applies, it is charged in accordance with the VAT Law 95(I)/2000 and Directive 2006/112/EC. For a business customer established in another EU Member State that provides a valid VAT identification number, the general place-of-supply rule for business-to-business services applies and the supply is accounted for by you under the reverse charge; you are responsible for the accuracy of the number you give us and for accounting for the tax. If the number is invalid we may charge Cyprus VAT and you will pay it.

6.3 Payment. Fees are collected by Stripe Payments Europe, Ltd. on our behalf. We are the merchant of record. Subscriptions renew automatically at the end of each period until cancelled.

6.4 Failed and late payment. If a payment fails we may retry it. If an amount is more than 14 days overdue we may suspend the Service after giving you at least 7 days’ written warning, and may terminate if it remains unpaid.

Overdue amounts carry interest from the due date until payment at the European Central Bank main refinancing rate plus 8 percentage points per annum, together with reasonable recovery costs. That is the rate the Cyprus law transposing Directive 2011/7/EU on combating late payment in commercial transactions provides for, and we adopt it contractually so that it applies regardless of any change in that law. Interest accrues daily and compounds annually.

6.5 No withdrawal right; no refunds for part periods. Section 5.4 of the customer terms does not apply to you: there is no 14-day cooling-off period on a business contract. You may cancel at any time, effective at the end of the period you have paid for, and we do not refund part periods except where these Terms expressly say so.

6.6 Price changes. We will give existing paying Customers at least 60 days’ notice of a price increase. You may cancel before it takes effect.

6.7 Invoices and records. We issue an electronic invoice for each payment and keep invoices for seven years as section 62 of the VAT Law 95(I)/2000 requires. That obligation survives your account being deleted.

6.8 Your own taxes. You are responsible for all taxes arising from your own business, including on your invoicing of your own customers. Nothing the Service produces is tax advice, and the fact that the Service can generate an invoice does not mean the invoice meets your jurisdiction’s requirements — that is for you to check.

7. Data protection: who is responsible for what

7.1 The split. For personal data about your own customers, members, leads and contacts that you put into the Service, you are the controller and we are the processor. That processing is governed by the DPA, which forms part of these Terms.

For personal data about your own Users — their account, authentication, support and billing records — and for platform security logging, we are a controller in our own right, governed by the Privacy Policy.

7.2 We are not joint controllers. We and you are independent controllers of the data each holds in its own right, and controller and processor respectively for the data you put into the Service. We do not jointly determine the purposes and means of any processing. Section 3.4 of the DPA sets out what happens if a regulator or court takes a different view.

7.3 Your obligations as controller. You are responsible for:

• having a lawful basis for everything you instruct us to process;
• giving your own data subjects the information Articles 13 and 14 of the GDPR require, including that you use a processor and where to find our sub-processor list;
• honouring your data subjects’ rights, using the tools the Service provides;
• the accuracy and lawfulness of what you enter;
• not entering special-category or criminal-offence data without agreeing it with us first, as clause 4.3 of the DPA requires;
• what your staff type into free-text fields, which is the realistic route by which prohibited data enters any CRM.

If your organisation holds records about children, you are additionally responsible for meeting the heightened obligations the GDPR imposes — clear guardian-facing information, an appropriate lawful basis, tighter access controls inside your own organisation, and a considered retention period. Cyprus sets the age at which a child can consent to information-society services at 14 (Law 125(I)/2018, section 6); consent below that must come from a guardian. We can tell you what the platform does; we cannot make these decisions for you.

7.4 Employee monitoring. The Service keeps an audit trail of what each User does — the changes they make (with the values before and after), the requests they send, what they export or download, their sign-ins and the AI tool calls made for them — which your administrators can search and export, and some features record location or timing of work. Used against your own staff, that is employee monitoring, and it engages employment and data protection law. You are the controller for that, and it is your responsibility to have a lawful basis, to inform your staff, to consult where consultation is required, and to hold any impact assessment. We provide the log; we do not decide how you use it.

7.5 AI features. Every AI-assisted feature is off until you enable it, and each is enabled separately. Enabling one is your documented instruction to us, as controller, to process the relevant data through the AI sub-processor named in Annex III. Before doing so, satisfy yourself that you have a lawful basis and that your own privacy notices cover it.

If you ask us to run an AI-assisted import of your data during onboarding, that request is also a documented instruction under the DPA, limited to the files you provide and the purpose of loading them into your organisation.

7.6 Connected mailboxes and calendars. Connecting a Gmail or Microsoft 365 mailbox is optional, and so are sending from it and syncing its calendar, which you allow separately. If a User connects one, you confirm that you are entitled to grant us that access and to have its messages, the email sent from it and its calendar events processed inside your organisation. We never delete or alter messages in the mailbox, and we send only what a User sends. Disconnecting from settings revokes our access with the provider immediately. The Privacy Policy describes exactly what we do with mailbox and calendar data.

Remember that a mailbox contains the personal data of the people who wrote to it, who are not your employees and have not agreed anything with you. Filing their messages into your organisation is your processing and needs your lawful basis.

7.7 AI apps, API keys and connected services. You decide whether your Users may connect their own AI apps, create API keys and webhooks, or connect your accounting software, phone system or payment account. Each of those sends data you control to a third party you choose, on your instruction, and that third party is your supplier, not our sub-processor. You are responsible for having a lawful basis for it, for your agreement with that supplier, and for keeping API keys secret; a key acts with the access of the User who created it, so revoke it when that person leaves. You can disconnect any of them, and switch off AI app connections for your whole organisation, from settings.

8. Acceptable use

You and your Users must not:

1. use the Service unlawfully;
2. access, monitor or control any system, record or account you are not authorised to;
3. attempt to reach another organisation’s data, or probe, scan or test the platform’s security without our written permission (see the legal information page for how to report a vulnerability properly);
4. interfere with the Service or with the third-party services it connects to, including by automated request rates that degrade them;
5. upload malware or unlawful, defamatory or infringing content;
6. circumvent security controls, access controls, usage limits or rate limits;
7. reverse-engineer or decompile the Service, except to the extent Article 6 of Directive 2009/24/EC permits for interoperability despite this clause;
8. extract data other than through the export tools we provide;
9. use the Service, or anything it outputs, to build or train a competing product or a machine-learning model — other than an internal assistant used only inside your own organisation on your own data;
10. resell, sublicense or redistribute the Service, unless your plan expressly permits white-labelling and then only within its terms;
11. send unsolicited commercial messages through the Service, or use it in a way that damages the deliverability or reputation of our sending infrastructure.

Sending on your behalf. Where the Service sends email or SMS on your behalf, you are the sender in law. You must have a lawful basis and, where required, consent; you must honour unsubscribes; and you must comply with Directive 2002/58/EC as transposed in Cyprus by Law 112(I)/2004. Repeated complaints or a material rise in bounce rates from your organisation may lead us to suspend sending, and we may do so immediately where deliverability for other customers is at risk.

9. Content and intellectual property

9.1 Your data is yours. You keep ownership of the records, documents, media, branding and configuration you and your Users put into the Service (“Customer Data”). You grant us a non-exclusive, royalty-free licence to host, store, transmit, display and process Customer Data only as needed to provide the Service and to perform the DPA. It ends when the data is deleted, subject to backups and legal retention.

9.2 Our platform is ours. The Service and everything underlying it — software, interfaces, designs, models, algorithms, documentation — belongs to us or our licensors. You get a non-exclusive, non-transferable, revocable licence to use it for your internal business purposes during your subscription. No other rights are granted, expressly or by implication.

9.3 Aggregated statistics. We may derive statistics from Customer Data across organisations and use and publish them — for example benchmark performance, or how long a stage typically takes across a market. We may do so only where the result is genuinely anonymous: it must not identify you, any of your customers or any individual, directly or by combination with other information we hold or could reasonably obtain, and we will not attempt to re-identify it. Clause 8 of the DPA says the same thing and governs if the two differ.

We will not publish a statistic derived from a small enough number of organisations that yours could be inferred from it.

9.4 Feedback. We may use suggestions and feature requests freely and without obligation. This grants us nothing in your confidential information or trade secrets.

9.5 Your name and logo. You grant us a licence to display your name and logo inside the Service and in your own white-labelled outputs. We will not name you as a customer in our marketing without your prior written consent, and you may withdraw that consent at any time.

10. Third-party services

The Service depends on third parties. Those that process personal data on our behalf are our sub-processors and are listed, with locations and safeguards, at https://intellayer.app/legal/dpa/subprocessors/ — that list is part of the DPA and changes to it are notified in advance.

Some integrations are yours, not ours: where you connect your own account with a third party — a mailbox, a calendar, a payment account, a signature provider, accounting software, a phone system, an automation tool or an AI app — your relationship with that provider is direct, on their terms, and we are not a party to it. We do not answer for their service, their availability or what they do with data you send them.

11. Warranties and disclaimers

11.1 What we do warrant. We warrant that we will provide the Service with reasonable skill and care, and that we have the right to grant the licence in section 9.2.

11.2 What we do not. Beyond section 11.1, and to the fullest extent the law allows, the Service is provided “as is” and we exclude all other warranties, conditions and terms, whether express, implied by statute or common law, or otherwise — including as to merchantability, satisfactory quality, fitness for a particular purpose, accuracy, non-infringement and uninterrupted operation.

In particular we do not warrant that the Service will be error-free or uninterrupted, that any calculation, estimate, projection, recommendation or alert it produces will be accurate or suitable for any particular case, or that any third-party service it depends on will remain available or available on the same terms.

12. Liability

12.1 Not excluded. Nothing in these Terms limits or excludes either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything that cannot lawfully be limited or excluded.

12.2 Neither of us is liable for. Subject to 12.1, neither party is liable to the other for loss of profit, revenue, business, goodwill, contracts or anticipated savings; for loss or corruption of data other than where caused by that party’s failure to take the measures it has committed to; for wasted expenditure; or for any indirect or consequential loss, in each case however arising.

12.3 The cap. Subject to 12.1, each party’s total liability for all claims connected with these Terms and the Service in any 12-month period is limited to the greater of (a) the fees you paid us in the 12 months before the first event giving rise to a claim, and (b) one thousand five hundred euro (€1,500).

12.4 Why the cap is where it is. The fees for the Service are set on the basis of this allocation of risk. A higher cap is available: tell us before you subscribe what limit you need and we will quote for it. If you do not, the cap in 12.3 is the agreed allocation and both of us are taken to have accepted it as reasonable in light of the price.

12.5 Data protection claims. The cap in 12.3 applies to claims between us arising from data protection breaches, including claims for contribution. It does not limit either party’s liability to a data subject under Article 82 of the GDPR, or to a supervisory authority — nor could it.

12.6 Your indemnity. You will indemnify us against third-party claims, and reasonable legal costs, arising from: your breach of these Terms or the DPA; your use of the Service; your infringement of a third party’s rights; any claim by your own customer, member or employee arising from your obligations to them as controller or as their counterparty; and any claim by a tax authority arising from your own invoicing.

12.7 Our indemnity. We will defend you against a third-party claim that your permitted use of the Service infringes that party’s intellectual property rights, and will pay damages finally awarded or amounts we agree in settlement, provided you tell us promptly, let us control the defence and settlement, and give reasonable assistance. This does not apply where the claim arises from Customer Data, from your configuration, from combining the Service with something we did not supply, or from continued use after we asked you to stop. If the Service becomes the subject of such a claim we may, at our option, modify it, obtain a licence, or terminate the affected part and refund the unused portion of your fees — and that is your exclusive remedy for infringement.

13. Confidentiality

Each of us may receive the other’s non-public information. Each will use it only as these Terms require, protect it with at least reasonable care, and not disclose it except to people with a need to know who are under equivalent obligations, or where the law requires — with prior notice to the other party where giving notice is lawful.

These obligations last for three years after termination, and indefinitely for anything that is a trade secret for as long as it remains one.

Your Customer Data is your confidential information. Our pricing and non-public technical information about the Service is ours.

14. Suspension, term and termination

14.1 Term. These Terms apply from your first use of the Service until your subscription ends.

14.2 Suspension. We may suspend the Service, in whole or in part, where you are more than 14 days late in paying (after the warning in 6.4), where continuing would expose us, another customer or a third party to material risk, where required by law, or where you are in material breach. Except where the risk makes it impossible, we will tell you first and give you a chance to fix it. We will restore access as soon as the reason for suspension has gone. Suspension does not stop fees accruing unless the suspension was our fault.

14.3 Termination by you. Cancel at any time in the Service, effective at the end of your current period. To delete your organisation and everything in it, an administrator can schedule deletion, which starts a 30-day grace period before permanent deletion.

14.4 Termination by us for cause. We may terminate immediately if you materially breach these Terms or the DPA and either the breach cannot be remedied or you have not remedied it within 14 days of written notice; if you fail to pay after suspension; or if you become insolvent, enter administration or liquidation, make an arrangement with creditors, have a receiver appointed, or cease to carry on business.

14.5 Termination for convenience. Either of us may terminate on 60 days’ written notice ending at the end of a billing period. If we terminate for convenience we will refund the unused portion of anything you have prepaid.

14.6 What happens then. Access ends at the end of the notice or grace period. Your export tools stay available for 30 days after termination. After that, Customer Data is deleted in accordance with clause 11 of the DPA, apart from records we must keep by law. Fees already accrued remain payable.

14.7 Survival. Sections 1, 6.7, 9, 12, 13, 14.6, 15 and 16 survive termination, along with any clause that by its nature should.

15. Changes to these Terms

We may update these Terms. For corrections and clarifications we publish the new version. For material changes we will give at least 30 days’ notice to your admin contacts. If you do not accept a material change you may terminate before it takes effect and receive a refund of the unused portion of what you have prepaid. Continuing to use the Service after the effective date is acceptance.

We may make a change immediately where it is required to comply with a change in the law, and will tell you as soon as we can.

Superseded versions are available on request to [email protected].

16. General

16.1 Governing law. The law of the Republic of Cyprus. The UN Convention on Contracts for the International Sale of Goods does not apply.

16.2 Jurisdiction. The courts of Nicosia, Cyprus have exclusive jurisdiction, except that either of us may seek an injunction anywhere necessary to protect intellectual property or confidential information.

16.3 Escalation first. Before starting proceedings, send a written notice of dispute to [email protected] describing the issue and what you want. If it is not resolved within 30 days either of us may go to court. This does not delay an application for an injunction.

16.4 Assignment. You may not assign or transfer these Terms or your organisation without our written consent, not to be unreasonably withheld. We may assign to a successor to the business on notice to you.

16.5 Entire agreement. These Terms, the DPA, the Privacy Policy and any plan-specific terms shown to you at purchase are the whole agreement, and supersede anything said before. Neither of us relies on any statement not set out in them — but nothing excludes liability for fraudulent misrepresentation. Order of precedence: (1) the DPA; (2) these Terms; (3) the Privacy Policy; (4) anything else.

16.6 Force majeure. Neither of us is liable for a failure caused by an event beyond reasonable control, including war, civil unrest, natural disaster, epidemic, industrial action, regulatory action, and failure of electricity, telecommunications or internet infrastructure. The affected party must notify the other promptly and use reasonable efforts to resume. If it lasts more than 30 days either party may terminate and we will refund the unused portion of prepaid fees.

16.7 Severability and waiver. An unenforceable provision is cut back to the minimum extent necessary and the rest stands. Not enforcing something is not a waiver.

16.8 Independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship.

16.9 Third parties. Our staff and contractors may rely on sections 11 and 12. Nobody else acquires rights under these Terms.

16.10 Sanctions and export. You confirm that neither you nor anyone controlling you is subject to EU, UN, UK or US sanctions, and you will not make the Service available to anyone who is, or use it in a sanctioned territory.

16.11 Notices. To us: [email protected], copied by post to Intellayer, Alamanas 50, Dali, Nicosia 2547, Cyprus. To you: your organisation’s administrator email addresses. See the legal information page for when notice takes effect.

16.12 Language. These Terms are published in English and Greek. Both are authentic; if they differ, the English version governs this business agreement. (For consumer terms the position is different and more protective of the consumer — see clause 15.9 of the customer terms.)

16.13 Electronic acceptance. Accepting these Terms in the sign-up flow is binding, and we record it with a timestamp, the accepting user and the version.

17. Contact

Intellayer, Alamanas 50, Dali, Nicosia 2547, Cyprus.