These Terms of Service (the “Terms”) are prepared for the Cyprus company being incorporated under the intended name KabData (“Provider”, “we”, “us”) and the business identified in an Order Form or when accepting these Terms (“Customer”, “you”). Before these Terms become effective, Provider’s full registered legal name, Cyprus registration number, registered office, and effective date will be inserted here.
Customer may be a company, partnership, sole trader or other person acting wholly for purposes relating to its trade, business, craft or profession. If an individual accepts these Terms for another entity, that individual represents that they have authority to bind it. KabData is offered for business use only and not for personal, household or consumer use.
These Terms, each Order Form, the Data Processing Addendum (“DPA”) and the Acceptable Use Policy (“AUP”) form the “Agreement”. The Privacy Policy explains Provider's processing as an independent controller and is not part of the negotiated commercial terms.
1. Definitions
“Affiliate” means an entity that controls, is controlled by or is under common control with a party, where “control” means ownership of more than 50% of the voting interests or the power to direct management.
“Authorised User” means an employee, contractor, agency, advertiser, publisher or other individual whom Customer authorises to use the Service under Customer's account.
“Customer Data” means data, content, files, credentials, workflow definitions, personal data and other information submitted to, imported into, generated for, or otherwise processed through the Service by or for Customer. Customer Data does not include Provider Materials or Usage Data that has been irreversibly anonymised.
“Documentation” means Provider's then-current user documentation for the Service.
“Order Form” means an ordering document, online subscription selection or other written order accepted by Provider that identifies the subscription, fees, term or any special terms.
“Provider Materials” means the Service, Documentation, software, user interfaces, workflows, templates, methods, models, know-how and other technology supplied by Provider, including improvements, but excluding Customer Data.
“Service” means the hosted KabData platform and the modules identified in the applicable Order Form, including attribution dashboards, AppsFlyer synchronisation, publisher access, tracking links, deals, caps, exports, notifications, automations and related features.
“Third-Party Service” means a product, account, API, platform or service supplied by a third party and connected to or used with the Service, including AppsFlyer, Microsoft Teams, Slack, Telegram and app-store services.
“Usage Data” means technical and operational information about use, performance and security of the Service. Usage Data is Customer Data to the extent it identifies Customer, an Authorised User or another individual.
2. Access to the Service
2.1 Subscription right
Subject to the Agreement and payment of all applicable fees, Provider grants Customer a limited, non-exclusive, non-transferable and non-sublicensable right during the subscription term for Authorised Users to access and use the Service for Customer's internal business operations. Customer may permit its publishers, advertisers and business partners to use designated functions only where the applicable role and permissions allow it.
2.2 Accounts, roles and permissions
Customer is responsible for:
- identifying its Authorised Users and assigning appropriate administrator, member, publisher and other permissions;
- ensuring that each Authorised User uses a unique account and keeps credentials and recovery codes confidential;
- promptly removing access when an Authorised User no longer requires it;
- reviewing permissions, token shares, connected chats, integrations and automations regularly; and
- all activity under its accounts, except to the extent caused by Provider's breach of the Agreement.
Customer administrators may access and manage Customer Data and Authorised User accounts. An Authorised User may belong to more than one organisation. Provider personnel may access an account or impersonate a user only when reasonably required for authorised support, security, troubleshooting or legal compliance and subject to Provider's access controls.
Customer must notify Provider promptly at [email protected] of suspected credential compromise, unauthorised access or an erroneous permission assignment.
2.3 Affiliates and contractors
Customer Affiliates and contractors may use the Service as Authorised Users within Customer's subscription limits. Customer remains responsible for their compliance. No Affiliate becomes a separate contracting party unless it signs an Order Form or joins the Agreement in writing.
2.4 Changes to the Service
Provider may improve, update or modify the Service. Provider will not materially reduce the core functionality purchased under an Order Form during its committed term, except where reasonably necessary to address security, law, third-party platform changes or end-of-life dependencies. Provider may discontinue beta, preview or free features at any time.
2.5 Support and availability
Provider will provide support through [email protected] using commercially reasonable efforts. Unless an Order Form expressly states otherwise, Provider does not commit to a response/resolution time, uptime percentage, service credit, recovery point objective or recovery time objective.
3. Customer responsibilities
3.1 Lawful use and instructions
Customer will use the Service and process Customer Data in accordance with the Agreement, Documentation, applicable law and third-party contractual restrictions. Customer is responsible for the accuracy, quality, legality and provenance of Customer Data and for all instructions given to Provider through account configuration, integrations, workflows and support requests.
3.2 Rights and notices
Customer represents that it has all rights, permissions, consents, notices and lawful bases required to:
- provide Customer Data and integration credentials to Provider;
- instruct Provider and its subprocessors to process Customer Data;
- access AppsFlyer accounts and reports and use attribution, campaign, publisher, device, event, revenue and fraud data;
- create and distribute tracking links and assign publisher identifiers;
- invite Authorised Users and send notifications to configured recipients; and
- use each Third-Party Service as configured.
Customer must not direct Provider to process special-category or highly sensitive personal data, children's data, precise location, payment-card data, government identifiers or protected health information unless Provider has expressly agreed in writing and the parties have documented appropriate safeguards.
3.3 Customer systems
Customer is responsible for its network, devices, browsers, identity systems, integration accounts and any code or service outside Provider's control. Customer will maintain commercially reasonable security, including strong passwords, multi-factor authentication where available and least-privilege access.
4. Customer Data
4.1 Ownership
As between the parties, Customer retains all right, title and interest in Customer Data. Provider does not acquire ownership of Customer Data.
4.2 Limited licence and instructions
Customer grants Provider and its authorised subprocessors a worldwide, non-exclusive right to host, copy, transmit, transform, display and otherwise process Customer Data only as necessary to:
- provide, maintain, secure and support the Service;
- follow Customer's documented instructions;
- prevent or address fraud, abuse, security or technical issues;
- comply with law; and
- exercise another right expressly permitted by the Agreement.
Customer's use and configuration of the Service, an Order Form, the Agreement and written support requests constitute documented instructions under the DPA.
4.3 Aggregated and anonymous information
Provider may create and use statistical information only where it has been irreversibly anonymised so that neither Customer nor an individual can reasonably be identified or re-identified. Provider will not sell Customer Data or use Customer Data to build advertising profiles.
4.4 Security and privacy
Provider will maintain appropriate technical and organisational measures designed to protect Customer Data against unauthorised or unlawful processing and accidental loss, destruction, alteration or disclosure, as described in the DPA. Provider will process personal data in accordance with the DPA and will provide the Service from the locations and through the subprocessors described there or in Provider's then-current subprocessor notice.
4.5 Data export
During the subscription term, Customer may use available export functionality. On written request made before termination or within 30 days after it, Provider will provide reasonable assistance to export available Customer Data in a commonly used format, subject to technical feasibility and any fees stated in an Order Form. Provider is not required to reconstruct deleted data, create a bespoke export or obtain data from a Third-Party Service. This post-termination window does not apply where Customer requests earlier deletion or where Provider must restrict access or retain/delete data sooner for law, security or Customer's material breach.
5. Third-Party Services and integrations
5.1 Customer-directed connections
The Service may interoperate with Third-Party Services. Customer authorises Provider to access, exchange and process Customer Data with each Third-Party Service that Customer or an Authorised User enables. Third-Party Services are governed by their own terms and privacy practices, and Customer is responsible for the accounts, permissions and licences required to use them.
5.2 AppsFlyer
Customer acknowledges that:
- the Service retrieves reports from Customer-authorised AppsFlyer accounts through an API or, where enabled, an automated browser session;
- report availability, accuracy, fields, quotas and delay depend on AppsFlyer and Customer's AppsFlyer plan and permissions;
- Customer is responsible for ensuring that Provider's access method and Customer's use of AppsFlyer data comply with Customer's AppsFlyer agreement and applicable law; and
- Provider is not responsible for AppsFlyer outages, API changes, rate limits, access restrictions, report discrepancies or source-data errors.
5.3 Messaging services
When Customer enables Microsoft Teams, Slack or Telegram, Provider may transmit notification content, recipient/channel identifiers and related metadata to that provider. Customer is responsible for selecting recipients and ensuring that messages do not expose Customer Data to unauthorised users.
5.4 No responsibility for third-party changes
Provider may suspend or modify an integration if a Third-Party Service changes or withdraws its API, terms, authorisation, functionality or security posture. Provider is not liable for a Third-Party Service, but this does not limit Provider's responsibility for its own processing or its obligations regarding a subprocessor under the DPA.
6. Customer-configured automations
Customer is responsible for workflows it creates, edits, activates or runs, including triggers, recipients, schedules, data mappings, third-party actions, tracking-link changes and system-tool operations. Customer must review and test material workflows before activation, monitor their operation and maintain meaningful human oversight where an automation may materially affect a person or business. Customer must not use the Service to make solely automated decisions producing legal or similarly significant effects on individuals unless lawful, expressly supported and agreed in writing by Provider.
Customer must not put passwords, secrets, API keys, authentication tokens or unnecessary personal data into workflow names, descriptions, notifications or other ordinary text fields. Provider may apply validation, confirmation requirements and safety restrictions and may refuse an unsafe or unsupported action.
7. Acceptable use
Customer and Authorised Users must comply with the AUP. Provider may investigate suspected violations and may remove or disable access to content or functionality where reasonably necessary to protect the Service, customers, third parties or the public. Provider will, where practicable and lawful, notify Customer and limit the action to the affected account, integration or data.
8. Fees and taxes
8.1 Fees
Customer will pay the fees stated in each Order Form. Unless an Order Form states otherwise, fees are denominated and charged in United States dollars (USD). Subscriptions are billed monthly or annually in advance through Stripe. Payment is due immediately when the subscription starts and on each renewal date, and Customer authorises Stripe to charge the payment method on file. There are no ordinary invoice-credit days for an automatically charged subscription. Fees are non-cancellable and non-refundable except as expressly stated in the Agreement or required by law.
Provider may change subscription fees by giving at least 30 days' notice. A change applies from Customer's next renewal occurring after that notice period. Customer may avoid the changed fee by cancelling before that renewal.
8.2 Usage and overages
If an Order Form includes usage, user, organisation, application, data-volume, export or other limits, Provider may invoice documented overages at the agreed rates or require Customer to upgrade. Provider will not impose an unlisted material overage charge without notice.
8.3 Taxes
Fees exclude VAT, sales, use, withholding and similar taxes. Customer is responsible for taxes arising from its purchase, excluding taxes based on Provider's net income. If Customer is legally required to withhold an amount, it will provide valid documentation and, to the extent permitted by law, increase the payment so Provider receives the amount it would have received without the withholding.
8.4 Late payment
Stripe may retry a failed charge and send payment reminders under Provider's configured billing settings. Undisputed overdue amounts may accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower, and Customer will reimburse reasonable collection costs. Provider may suspend affected access if payment remains overdue for 30 days and may, at its discretion, terminate the affected subscription if payment remains overdue for 60 days. Suspension or termination is not automatic, and Provider may restore access after cleared funds are received. Provider may act sooner where continued access creates material fraud, security or legal risk.
9. Confidentiality
9.1 Confidential Information
“Confidential Information” means non-public information disclosed by or for a party that is marked confidential or should reasonably be understood as confidential. Customer Data and credentials are Customer Confidential Information. Provider Materials, product plans, security information and pricing are Provider Confidential Information.
9.2 Obligations
The receiving party will:
- use Confidential Information only to perform or exercise rights under the Agreement;
- protect it with at least reasonable care and no less care than it uses for comparable information;
- disclose it only to personnel, Affiliates, professional advisers and subcontractors who need to know it and are bound by confidentiality obligations; and
- promptly notify the disclosing party of unauthorised disclosure where lawful.
9.3 Exclusions
Confidential Information does not include information the receiving party can document: (a) is public without breach; (b) was lawfully known without restriction; (c) was received lawfully from a third party without restriction; or (d) was independently developed without use of the disclosing party's Confidential Information.
9.4 Compelled disclosure
The receiving party may disclose Confidential Information where required by law or valid legal process, provided it gives advance notice where lawful and reasonable assistance, at the disclosing party's cost, to seek protection. It will disclose only what is legally required.
10. Intellectual property
10.1 Provider Materials
Provider and its licensors own all right, title and interest in Provider Materials, including all intellectual property rights. Except for the subscription right in section 2, no rights are granted by implication, estoppel or otherwise.
10.2 Restrictions
Customer will not, and will not permit anyone to:
- copy, modify, translate or create derivative works of Provider Materials except as expressly permitted;
- reverse engineer, decompile or attempt to discover source code, non-public APIs, models or security mechanisms, except to the limited extent law prohibits this restriction;
- sell, resell, rent, lease, sublicense, distribute or provide the Service as a service bureau without written permission;
- remove proprietary notices;
- use the Service to build or benchmark a competing product, or publish performance/security testing without responsible prior coordination; or
- circumvent technical, usage, role or permission limits.
10.3 Feedback
If Customer provides feedback, Provider may use it without restriction or payment, but will not identify Customer publicly as its source without permission.
10.4 Customer marks
Customer grants Provider a limited right to display Customer-provided names, logos and branding within Customer's configured Service. Provider may not use Customer's name or logo in marketing without prior written consent.
11. Warranties
11.1 Mutual warranties
Each party warrants that it has authority to enter into the Agreement and will comply with laws applicable to its performance.
11.2 Service warranty
Provider warrants that, during a paid subscription term, the Service will perform materially in accordance with the Documentation when used as permitted and that Provider will provide it using reasonable skill and care. Customer's exclusive remedy for a reproducible breach is for Provider to use commercially reasonable efforts to correct it. If Provider cannot do so within a reasonable time, Customer may terminate the materially affected Order Form and receive a pro-rata refund of prepaid unused fees for that part.
11.3 Exclusions
The warranty does not apply to issues caused by Customer Data, Customer systems, misuse, unauthorised modification, beta/free features, Third-Party Services or events outside Provider's reasonable control.
12. Disclaimers
Except for express warranties in the Agreement and to the maximum extent permitted by law, the Service, Documentation, beta features, data, reports, estimates, cap indicators, fraud indicators, attribution results and Third-Party Service integrations are provided “as is” and “as available”. Provider disclaims implied warranties of merchantability, fitness for a particular purpose, title, non-infringement and that the Service will be uninterrupted or error-free.
Provider does not warrant the accuracy, completeness or commercial outcome of AppsFlyer or other source data; that a cap, notification, automation or tracking link will prevent overspend or loss; or that a fraud signal identifies actual fraud. Customer must independently validate material business, payment, compliance and campaign decisions.
Nothing excludes a warranty or liability that cannot lawfully be excluded.
13. Indemnities
13.1 Provider IP indemnity
Provider will defend Customer against a third-party claim that authorised use of the paid Service infringes that third party's patent, copyright or registered trademark, and will pay damages finally awarded or settlements approved by Provider. Provider may: (a) obtain the right to continue use; (b) modify or replace the affected part without materially reducing functionality; or (c) terminate the affected Order Form and refund prepaid unused fees. Provider has no obligation for claims arising from Customer Data, Customer instructions, unauthorised use or modification, combination not supplied by Provider, Third-Party Services, or continued use after notice of an alleged infringement.
13.2 Customer indemnity
Customer will defend Provider and its Affiliates against a third-party claim arising from: (a) Customer Data or Customer's instructions; (b) Customer's or an Authorised User's unlawful use of the Service, tracking links, notifications or automations; or (c) breach of section 3 or the AUP, and will pay damages finally awarded or settlements approved by Customer.
13.3 Procedure
The indemnified party must promptly notify the indemnifying party, provide reasonable cooperation at the indemnifying party's cost, and allow it to control the defence and settlement. A delay in notice reduces obligations only to the extent materially prejudicial. No settlement may admit fault or impose non-monetary obligations on the indemnified party without consent, not to be unreasonably withheld.
14. Limitation of liability
14.1 Excluded loss
To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, exemplary or consequential loss, or for loss of profits, revenue, goodwill, business opportunity or anticipated savings, even if advised of the possibility. Provider is not liable for loss or corruption of data to the extent Customer could reasonably have avoided it by using available export or backup functionality, but this does not excuse Provider's DPA or security obligations.
14.2 General cap
Except as stated in section 14.3, Provider's aggregate liability arising out of or relating to the Agreement will not exceed the fees actually paid by Customer for the affected Service during the six months immediately before the first event giving rise to liability. Customer's aggregate liability will not exceed the fees paid or payable under the affected Order Forms during the 12 months immediately before that event.
14.3 Higher cap and uncapped matters
Provider's aggregate liability for breach of confidentiality, data-protection obligations and its IP indemnity will not exceed the fees actually paid by Customer for the affected Service during the 12 months immediately before the first event giving rise to liability. No limitation applies to: (a) Customer's payment, tax or collection-cost obligations; (b) Customer's indemnity obligations; (c) Customer's unlawful use, breach of section 3 or the AUP, or infringement or misappropriation of Provider's intellectual property; (d) a party's fraud, wilful misconduct or gross negligence; (e) death or personal injury caused by negligence; or (f) liability that cannot lawfully be limited.
14.4 Allocation of risk
The exclusions and caps apply regardless of the form of action and are an essential allocation of risk reflected in the fees. They apply in aggregate to the Agreement and DPA, not separately to each document.
15. Term, suspension and termination
15.1 Terms
These Terms begin when Customer first accepts them and continue while an Order Form is in effect.
15.2 Subscription term and renewal
Each subscription begins and continues for the monthly or annual term selected at checkout or stated in its Order Form. It renews automatically for successive periods of the same length until cancelled. Customer may cancel through the account billing controls or Stripe customer portal at any time before the next renewal; cancellation takes effect at the end of the then-current paid billing period and does not generate a pro-rata refund unless required by law. No separate 30-day non-renewal notice is required.
15.3 Suspension
Provider may suspend affected access where reasonably necessary because of: (a) a material AUP or security violation; (b) a credible threat to the Service or others; (c) unlawful processing; (d) a Third-Party Service restriction; or (e) undisputed overdue fees after notice. Where practicable, Provider will notify Customer, limit the suspension and restore access promptly after the issue is resolved. Suspension does not relieve Customer of fees unless caused by Provider's breach.
15.4 Termination for cause
Either party may terminate an affected Order Form or the Agreement if the other party materially breaches and does not cure within 30 days after written notice. Provider may terminate an affected subscription for non-payment under section 8.4 once payment remains overdue for 60 days. Either party may terminate immediately if the other becomes insolvent, ceases business, enters liquidation or is subject to a similar proceeding not dismissed within 60 days.
15.5 Effect of termination
On termination or expiry:
- Customer's access rights end and Customer must stop using Provider Materials;
- accrued payment obligations remain due;
- each party will return or destroy the other's Confidential Information as required by the Agreement;
- Provider will handle Customer Data under section 4.5 and the DPA; and
- sections intended by their nature to survive will survive, including fees, confidentiality, intellectual property, disclaimers, indemnities, liability, effect of termination and general terms.
Unless prohibited by law or subject to a legal hold, Provider will delete Customer Data, including raw-event archives, from active systems within 30 days after the 30-day post-termination export window. Data captured in Hetzner's seven daily rolling Cloud Backups will age out through the ordinary backup rotation, generally within seven daily backup cycles after active deletion. Deletion from a Third-Party Service controlled by Customer is Customer's responsibility.
16. Compliance
Each party will comply with applicable anti-bribery, anti-corruption, sanctions and export-control laws. Customer will not permit access from an embargoed jurisdiction or by a sanctioned person where prohibited. Customer will not use the Service for unlawful gambling, financial, health, employment, credit or other regulated activity unless it has all required licences and Provider has agreed that the proposed use is supported.
17. General
17.1 Notices
Legal notices must be in writing. Notices to Provider must be sent to [email protected] and, after incorporation, its registered office. Notices to Customer may be sent to the billing or administrator email in the Order Form or account. Notices are effective on confirmed delivery; email is effective on the next business day unless a delivery failure is received.
17.2 Assignment
Neither party may assign the Agreement without the other's prior written consent, not to be unreasonably withheld, except to an Affiliate or in connection with a merger, reorganisation or sale of substantially all relevant assets, provided the assignee is not a direct competitor of the other party and assumes the Agreement. An invalid assignment is void.
17.3 Subcontracting
Provider may use subcontractors and remains responsible for their performance to the extent required by the Agreement. Processing of personal data by subprocessors is governed by the DPA.
17.4 Force majeure
Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations. The affected party will take reasonable steps to mitigate and resume performance. If a material force-majeure event continues for more than 60 days, either party may terminate the affected Order Form on notice.
17.5 Changes to online terms
Provider may update the AUP, Privacy Policy and Cookie Policy to reflect law, technology or the Service. Material adverse changes to the AUP during a committed paid term will take effect on renewal unless needed sooner for law or security. Provider will give reasonable notice of material changes. Negotiated Terms or an Order Form may be changed only in writing signed by authorised representatives.
17.6 Order of precedence
If documents conflict: (a) the DPA controls for personal-data processing; (b) an Order Form controls over these Terms only where it expressly identifies the clause it overrides; (c) these Terms control over the AUP; and (d) the AUP controls over Documentation.
17.7 Entire agreement; no reliance
The Agreement is the entire agreement about its subject and supersedes prior proposals and discussions. Each party acknowledges it has not relied on a statement not set out in the Agreement, without limiting liability for fraud.
17.8 No partnership; third-party rights
The parties are independent contractors. The Agreement does not create a partnership, employment, fiduciary, franchise or agency relationship. No third party has rights under it except an indemnified Affiliate as expressly stated.
17.9 Waiver and severability
A waiver must be in writing and applies only to the stated instance. If a provision is unenforceable, it will be modified to the minimum extent needed to make it enforceable, and the rest remains effective.
17.10 Counterparts and electronic acceptance
The Agreement may be signed in counterparts and electronically. Clicking an acceptance control, signing an Order Form or using the Service after a valid acceptance flow has the same effect as a signature where permitted by law.
17.11 Governing law and courts
The Agreement and non-contractual obligations arising from it are governed by the laws of the Republic of Cyprus, without regard to conflict-of-laws rules. The courts of the Republic of Cyprus have exclusive jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply. Either party may seek urgent injunctive relief in any competent court to protect confidential information, personal data or intellectual property.
17.12 Dispute notice and good-faith resolution
Before commencing court proceedings, a party must give the other a written notice describing the dispute and requested remedy in reasonable detail. Authorised representatives will attempt in good faith to resolve the dispute for at least 30 days after receipt. This requirement does not prevent either party from seeking urgent injunctive relief, preserving a limitation period or pursuing undisputed payment obligations. Any applicable limitation period is suspended during the required 30-day discussion period to the extent permitted by law.