Terms of Service

2.1 License

Subject to the Agreement and timely payment, Renocount grants you a non-exclusive, non-transferable, revocable right to access and use the Services for your internal business purposes.

2.2 Accounts

You will provide accurate registration data, maintain security of credentials, and remain responsible for activities under your accounts.

2.3 Acceptable Use

You will not: (i) violate law; (ii) infringe IP, privacy, or publicity rights; (iii) bypass security, rate limits, or RLS policies; (iv) overload, disrupt, or scrape; (v) use the Services/Outputs to build or train a competing product or model; (vi) upload harmful code; or (vii) misuse communication channels (e.g., spam or unauthorized outreach).

2.4 Changes

We may improve or modify the Services. Non-material changes may occur without notice; material adverse changes will be notified at least 14 days in advance.

3.1 User Content

You retain ownership of User Content. You grant Renocount a non-exclusive, royalty-free, worldwide, sublicensable license to host, process, transmit, display, and modify User Content solely to provide, secure, support, and maintain the Services.

3.2 No Model Training

We expressly guarantee that Customer personal data (including chat logs and call transcripts) is not used to train, retrain, or fine-tune public or foundation AI models.

3.3 Knowledge Base Ownership

The knowledge base and its content are the exclusive property of the Customer and remain under its control. When the system extracts facts to update the knowledge base, personal data is automatically filtered out and only anonymized building- and property-level facts are stored, after the Customer's manual review and approval. We do not use the knowledge base for our own purposes or for the benefit of other customers, and we hand it over in a machine-readable format on request and when the Agreement ends.

3.4 Outputs (Self-Service Platform)

Unless otherwise agreed in writing, you own the Outputs you generate. You grant us a limited license to use Outputs internally for quality, security, abuse detection, and support. We will not publicly showcase Outputs in a way that identifies you without your prior consent.

3.5 Deliverables (Managed Services)

Upon full payment, you own Deliverables, excluding Renocount's software, models, tools, and methodologies. We retain a non-exclusive, royalty-free, perpetual license to use Deliverables internally for quality and security, and externally for marketing only with your prior written consent if you can be identified.

4.1 Scope & Fees

Scope, pricing, and term are set out on our website or in an order form/proposal.

4.2 Initial Minimum Term

Unless the order form states otherwise, subscriptions/retainers have a minimum initial commitment of six (6) months ("Initial Term").

4.3 Renewal

After the Initial Term, subscriptions renew monthly unless either party gives 30 days' notice to not renew.

4.4 Cancellation

You may cancel effective at the end of the current term. Early cancellation during the Initial Term does not relieve payment for the remainder of the Initial Term.

5.1 Export Anytime

You may download or request a copy of data you provided (User Content and associated metadata we store for you) at any time during the term.

5.2 On Termination

Upon termination/expiry, we will, at your choice, securely delete or return all personal data and the knowledge base in a machine-readable format within 30 days, unless EU or Finnish law requires longer retention. Any data in backups is deleted in the normal backup cycle within 90 days and remains subject to the DPA until deleted.

5.3 What You Can Export

You can export a copy of Customer Data that you provided or connected through the Services, subject to applicable legal limits and third-party platform constraints.

6.1 GDPR and the DPA

Where we process personal data on your behalf, you are the controller and we are the processor. The DPA, which meets the requirements of Article 28(3) GDPR, forms part of this Agreement. We process personal data only on your documented instructions; your use and configuration of the Services constitute those instructions. We will inform you without delay if, in our view, an instruction infringes data protection law.

6.2 Data Residency and Secure Storage

EU data sovereignty: the primary database and storage infrastructure (Supabase / AWS) is located in Stockholm, Sweden (EU/EEA), and application logic is hosted on Fly.io with regional processing in the EU.

Security measures (Article 32 GDPR): encryption at rest (AES-256) and in transit (TLS 1.2 or newer); role-based access control and least privilege, with production data accessible only to named, trained personnel using multi-factor authentication; logging and regular monitoring of access and processing; and backups, recoverability, and regular testing of these measures. All personnel authorized to process personal data are bound by confidentiality obligations.

Data isolation: your data and knowledge base are technically isolated and are never shared with, or used to generate answers for, other customers.

6.3 Web-Chat Widget

The widget runs in the visitor's browser and communicates with Renocount over encrypted connections. Chat transcripts and any attachments uploaded in chat are stored in your CRM within Renocount. The widget does not load third-party advertising or cross-site tracking scripts.

6.4 AI Phone Assistant: No Audio Recordings

Inbound calls are received via Twilio. Depending on business-hours and routing rules configured in the order form, the call is either forwarded to a human number or handled by the AI assistant. The phone assistant does not record calls: call audio is processed only momentarily for real-time speech-to-text conversion, and no raw audio recordings (e.g., MP3/WAV) are stored by Renocount or its sub-processors. As audio is neither stored nor used to uniquely identify individuals, no biometric data within the meaning of Article 9 GDPR is processed. The only output is a text transcript, which is handled as described in §6.5.

6.5 Retention of Communication Logs

Chat transcripts and call transcripts are stored securely in your CRM within Renocount and retained for 12 months after the matter is resolved, after which they are irreversibly deleted or anonymized. You may delete them earlier at any time or set a shorter retention period.

6.6 Financial Data (Real-Time Lookup Without Storage)

For questions about invoices or rent status, Renocount may retrieve information from your connected financial management software through a secure API solely to answer the question in real time. We do not store, cache, or save residents' financial history or bank account details in our own databases.

6.7 Human Oversight and Automated Decisions

Knowledge base updates require your (the property manager's) manual review and approval before they are saved. The Services only provide customer-service guidance and forward inquiries; they do not make automated decisions producing legal or similarly significant effects on data subjects (Article 22 GDPR).

6.8 Sub-Processors

You give general prior authorization for the following sub-processors: Supabase / AWS (data storage and database services, Stockholm, EU); OpenAI (AI-based text processing and speech transcription; under OpenAI's Enterprise DPA, data is not retained or used for model training); Twilio (voice and telecommunications routing, under EU Standard Contractual Clauses); Fly.io (application hosting, regional processing in the EU); and Resend (delivery infrastructure for service-related transactional email notifications). We bind each sub-processor in writing to data protection obligations at least equivalent to the DPA and remain responsible for their performance as for our own.

We will notify you in writing at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we cannot reach agreement, you may terminate the affected Services without penalty. The current Sub-processor List is incorporated into this Agreement by reference.

6.9 International Transfers

To the extent personal data is transferred outside the EU/EEA, the transfer is based on the European Commission's Standard Contractual Clauses (SCC) or another transfer mechanism under Chapter V GDPR.

6.10 Personal Data Breaches

We will notify you of a personal data breach without undue delay and in any event within 24 hours of becoming aware of it. The notice will include the information required by Article 33(3) GDPR to the extent available to us, and we will assist you in investigating and containing the breach and in notifying supervisory authorities and data subjects.

6.11 Assistance, Data Subject Requests, and Audits

We assist you, through appropriate technical and organizational measures, in meeting your obligations under Articles 32–36 GDPR and in responding to data subject requests (access, rectification, erasure, restriction, portability, and objection). The platform lets you immediately identify, export, or delete all data concerning an individual resident. If a data subject contacts us directly, we forward the request to you without delay instead of answering it ourselves.

We make available all information necessary to demonstrate compliance with Article 28 GDPR and allow audits by you or an auditor you appoint, with at least 30 days' written notice and no more than once per year, unless a personal data breach or a supervisory authority requires otherwise.

11.1 By Customer

You will indemnify and hold Renocount harmless from third-party claims arising from (i) your breach of the Agreement or law; (ii) your User Content; or (iii) misuse of the Services.

11.2 By Renocount

We will defend and indemnify you against third-party claims alleging that the Services (as provided by us) infringe EU or Finnish IP rights, provided you: (a) promptly notify us; (b) allow us sole control of the defense; and (c) cooperate reasonably. We may procure rights, modify, or terminate the affected portion with a pro-rata refund. Exclusions: your unauthorized modifications/combinations or misuse.