Contract document — informative translation

Terms of Use of the SureDocs Redact Service

1. Contracting parties and definitions

Provider:
InnovativeIT, s.r.o.
Registered office: Častkovce 61, 916 27 Častkovce, Slovak Republic
Registered in the Commercial Register of the District Court Trenčín, section: Sro, file no. 47355/R
Company ID (IČO): 56427689 | Tax ID (DIČ): 2122313380 | VAT ID: SK2122313380
E-mail: [email protected]
(the "Provider" or "SureDocs")

User — a business (a natural person acting as an entrepreneur, in particular a sole trader, or a legal entity) that registers and uses the SureDocs Redact service for business, professional or commercial purposes (the "User"). The Service is not intended for consumers — see Art. 3.1a.

Service — the SureDocs Redact web application, enabling automatic detection and anonymisation of personal data in documents using artificial intelligence.

Document — a file in PDF, PNG or JPG format uploaded by the User to the Service for processing.

2. Subject and nature of the Service

2.1 SureDocs Redact is a tool supporting compliance with obligations under Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) — specifically the anonymisation of personal data in documents.

2.2 The Service uses third-party artificial intelligence models (Anthropic Claude, Mistral AI) to analyse the text of documents. The Document is processed in the working memory of the Provider's server. So that work in progress survives a restart of the service, a temporary copy of it (including the content of the Document) is kept in an internal database on the same server, reachable only locally, for at most 12 hours (4 hours for the API); it is deleted on logout or when the work ends. Documents are not stored permanently in the Service's database or by sub-processors after processing is completed (except as stated in Art. 2.2b). Traces of the temporary copy may remain in the server's technical journal until the system overwrites them automatically (usually days to weeks).

2.2a The Provider has integrated these AI models with regard to the requirements of Regulation (EU) 2024/1689 on artificial intelligence (AI Act). As regards the use of User data for training models: Anthropic declares in its commercial (API) terms that it does not use customer data to train models. Mistral AI excludes this in its Data Processing Agreement only if the customer has activated the so-called training opt-out — the Provider has this opt-out activated for its entire organisation (Admin → API → Privacy, verified directly on 2026-08-25).

2.2b Notwithstanding Art. 2.2, these sub-processors may, in accordance with their own trust & safety policies and independently of the no-training agreement, retain processing inputs/outputs for a short time for the purpose of abuse monitoring — as a rule up to 30 days, and in exceptional cases of a detected breach of their terms of use also longer (according to the current terms of the respective provider). The wording "not stored permanently" in Art. 2.2 refers to standard processing outside this exception.

2.3 The results of the automatic analysis are an auxiliary tool — not a legal assessment. The final review and approval of the anonymisation is always carried out by the User. The Provider is not liable for incomplete detection of personal data if the User did not review and correct the output before downloading it.

3. Registration and account

3.1 Use of the paid part of the Service requires registration with a valid e-mail account.

3.1a The Service is intended exclusively for business, professional or commercial purposes. Only a business (a natural person acting as an entrepreneur, in particular a sole trader, or a legal entity) may be a User of the Service. By accepting these Terms at registration, the User expressly declares that it does not order the Service as a consumer, but within the scope of its business or other commercial activity.

3.1b Authority of the person acting on behalf of the User. The natural person who fills in the User's (legal entity's) details at registration and accepts these Terms including the DPA thereby declares and warrants that they are authorised to do so — whether as the User's statutory body or on the basis of another valid authorisation (e.g. power of attorney, employment/internal authorisation) to act on its behalf. The Provider does not verify this authority against a public register or otherwise — responsibility for its existence lies solely with the person who carried out the registration and the User on whose behalf it was carried out. If it subsequently turns out that the registering person lacked such authority, this does not affect the obligation to pay for performance of the Service already provided (Art. 6) to which the registration related.

3.2 The free trial lasts 30 days from registration and is limited to 25 pages per day and 250 pages in total (the pages of newly uploaded documents are counted; the day is determined by Europe/Bratislava time), whichever occurs first. A document that would exceed the limit is not processed and the User is informed. At registration the User chooses the method of document analysis — either using artificial intelligence (Mistral, processing in the EU), or exclusively local recognition without sending data outside the Service ("No AI"). Output documents in trial mode carry visible watermarks and are provided as image PDFs without a text layer. The SureDocs Print driver is also available in the trial; a trial organisation has one approver (the main administrator), more on request.

3.2a Before the trial expires, the User will be invited by e-mail to conclude a contract. Continued use of the Service after the trial expires requires concluding a contract under Art. 6.

3.2b Temporary pilot testing. Until 31 Dec 2026 the Provider does not apply the restrictions under Art. 3.2 (duration and page limit) to the Trial and makes paid add-on components (in particular the choice of AI provider beyond Mistral/"No AI", SureDocs Print driver, API access) available to Trial accounts free of charge, for the purpose of piloting the Service. Visible watermarks on output documents under Art. 3.2 remain in place during the pilot period as well (except for an exemption that the application administrator may grant to a specific User). After the pilot period ends, the Trial is governed by Art. 3.2 without further notice — this provision is a temporary exception to Art. 3.2, not a permanent amendment of it.

3.3 The User is responsible for the security of its login credentials and for all activities performed under its account.

3.4 A legal entity may set up a company account with multiple users. The administrator of the company account is responsible for assigning access rights.

4. Authorisation to process documents

4.1 The User expressly declares and warrants that:

a) it is entitled to handle the documents it uploads to the Service and has an appropriate legal basis for doing so within the meaning of the GDPR or other applicable regulations;

b) the persons whose personal data are contained in the documents have been informed about the processing, or the User has another lawful basis for processing them;

c) uploading and anonymising the documents complies with the User's internal rules and applicable legislation.

4.2 The User may not upload to the Service documents containing personal data of third parties without appropriate authorisation.

4.3 The processing of personal data contained in Documents uploaded by the User is governed by the Data Processing Agreement (DPA), which forms an integral Annex No. 1 to these Terms (see also Art. 10.2).

4.4 The Service is not an archive or backup storage. An uploaded Document is processed in the working memory of the Provider's server and is deleted after processing is completed or the session ends (temporary copy and its time limits under Art. 2.2). The User is solely responsible for keeping its own copy of the original (non-anonymised) Document in accordance with its own archiving obligations. The anonymised output never replaces the original document as a legal/accounting record.

5. Prohibited use

The User is prohibited from:

a) using the Service for purposes other than the anonymisation and management of documents;

b) uploading documents containing special categories of personal data under Art. 9 GDPR (health data, biometric data, genetic data, data relating to criminal convictions) — this prohibition is absolute and without exception; the Provider does not and cannot grant consent to such an upload (see Art. 9.5 below);

c) attempting to recover the original data from anonymised documents;

d) circumventing the trial limits by creating multiple accounts;

e) reselling access to the Service without the Provider's written consent;

f) using the Service in a way that could damage, overload or disrupt its operation.

6. Conclusion of the contract, plans and payment terms

6.1 Moving from the trial to the paid Service. After the trial ends (Art. 3.2), the User concludes a contract with the Provider by selecting a plan and the required services via a form in the application. The contract is compiled from the User's data available in public registers (business name, registered office, company ID, tax ID), supplemented by data not available from the registers (in particular the bank account/IBAN and, where applicable, a billing e-mail and premises address if they differ from the registered data).

6.2 Activation of the Service. The selected paid services are activated ONLY AFTER confirmation of payment of the one-off set-up fee on the first order and the flat fee/credit for the first billing period according to the current Price List (Art. 6.3). Until payment is confirmed, the User remains under the trial conditions.

6.2a Unpaid proforma invoice at activation. If the User does not pay the proforma invoice under Art. 6.2 within 14 days of its issue, the proforma invoice expires and the incomplete registration is suspended — the User has a further 30 days to complete the payment and reactivate without repeating the entire registration. If payment is not made within this additional period either, the organisation is closed (not deleted — retention under Art. 12.3 and the Privacy Policy, as for a duly activated account closed later). Renewed interest after closure is only possible through a new registration.

6.3 Reference to the Price List. All prices for the Service — the one-off set-up fee on the first order, the organisation flat fee, the approver fee, the per-page processing rates depending on the AI backend used, one-off credit top-ups and optional components — are set out in the current Price List of the Service. The Price List forms a separate and severable Annex No. 2 to these Terms and is continuously available at /legal/cennik.html.

6.3a VAT and documents. The Provider is a VAT payer. All prices in the Price List are EXCLUDING VAT. Before payment the Provider issues a proforma invoice, which is not a tax document; once the payment is received it issues a tax document (invoice for the payment received) dated with the day of the payment. VAT is added at the currently applicable standard rate in the Slovak Republic (23 % in 2026). If the User is a taxable person registered for VAT in another Member State of the European Union and its VAT ID is valid in the VIES system on the day the payment is received, the tax document is issued without VAT, stating “reverse charge”, and the VAT is accounted for by the User. Documents always show the tax base, the VAT rate and amount, and the total amount. The set-up fee on the first order and the flat fee/credit for the first billing period are stated on a single document.

6.4 Right to change the Price List. The Provider reserves the right to change the Price List unilaterally (e.g. due to inflation, changes in the prices of third-party AI models or the addition of new features).

6.5 Effective date of a new price. A change to the Price List takes effect for the User from the beginning of the next billing period (according to the chosen billing period) following publication of the new Price List. The price change does not affect the currently prepaid period or a one-off credit top-up already purchased.

6.6 Disagreement with the price. If the User does not agree with a change to the Price List, it has the right to terminate the contract free of charge (cancel the subscription) with effect from the last day of the currently prepaid period (Art. 6.11). Continued use of the Service after the new Price List takes effect is deemed acceptance of the new prices.

6.7 Payment methods. Bank transfer, QR payment (simplified entry of a bank transfer by scanning — in the PAY by square format for Slovak Users, in the SPAYD format according to the Czech Banking Association standard for Czech Users), payment card (Stripe).

6.8 Organisation flat fee and approver fee. The User pays a monthly flat fee for the organisation (main user — organisation administrator), which is converted in full into credit for document processing in the given credit period (always 30 days, regardless of the chosen billing period). The organisation administrator may increase the monthly credit budget above the flat fee at any time (at least equal to the flat fee, with no upper limit); the increased budget is invoiced as the flat fee. For each additional approver the User pays a monthly access fee and, when the approver is added, a one-off set-up fee on the first order according to the Price List — the approver fee does not increase the credit. The billing period is monthly, quarterly, half-yearly or annual, with a discount according to the Price List. Optional components (e.g. local "No AI" processing, API access) are charged with a setup fee and, where applicable, a monthly rate according to the Price List. Unused monthly credit is neither carried over to the next credit period nor refunded. There are no plan tiers or fixed page packages.

6.9 Processing rate and one-off credit top-up. For each processed page of a Document, the rate for the AI backend actually used for the processing is deducted from the credit (see the Price List). If the monthly credit is used up before the end of the credit period, the User may top up the credit once by any amount from the minimum amount according to the Price List, without permanently increasing the flat fee. Top-up credit is valid for 365 days from being credited; any unused balance carries over between credit periods and is used only after the monthly credit has been used up. No interest is paid on the credit deposit.

6.10 Unused credit in case of long-term inactivity. If the User does not use the Service for 6 months, the Provider informs it by e-mail about the remaining credit. If the User does not confirm its interest in continuing within 7 days, the Provider refunds the unused balance of the one-off credit top-up (Art. 6.9) to the User's bank account, reduced by a fee covering the cost of the refund according to the Price List (the amount paid out must reach the minimum amount under the Price List), and the User's account is closed (not deleted — retention of the remaining data is governed by the retention rules under Art. 12 and the Privacy Policy). Monthly credit from the flat fee (Art. 6.8) is not refunded.

6.11 Cancellation of the subscription by the User. The User may cancel the subscription at any time (Art. 12); access to the Service remains until the end of the currently prepaid period. In this case the unused balance of the one-off credit top-up is refunded without waiting under Art. 6.10, immediately after the cancellation request is confirmed, under the same conditions (fee covering the cost of the refund according to the Price List); neither the flat fee for the current period nor the monthly credit derived from it is refunded.

6.12 Late payment. If a payment fails when the subscription is renewed, the Provider informs the User without delay. The User has an additional period of 7 days to resolve the payment, during which access to the Service is maintained. If this period expires without payment, the renewal proforma invoice expires and access to the Service is suspended (with a notice at sign-in and by e-mail). The User has a further 30 days to pay and restore access; if this period also expires without payment, the account is closed with a notice (retention under Art. 12.3 and the Privacy Policy) — renewed interest after closure is only possible through a new registration.

6.13 Payment gateway. Card payments are processed by Stripe.

7. Availability and support

7.1 The availability of the Service is derived from the availability guaranteed by the operator of the server infrastructure (Hetzner) — the Provider does not promise higher availability than that guaranteed to it by its own infrastructure provider. An individual SLA for the Premium plan is agreed within the contract under Art. 6.1, within this scope.

7.2 Planned maintenance will be announced at least 24 hours in advance by e-mail or in the application.

7.3 Support is available at: [email protected], on working days.

7.4 Scope of support. Support covers the technical functionality of the Service (availability, errors, questions about operation). Support does not include legal advice on the interpretation of the GDPR or other regulations and does not replace the User's data protection officer (DPO) — the User remains solely responsible for assessing whether a specific use of the Service fulfils its own legal obligations (in accordance with Art. 2.3).

8. Intellectual property

8.1 All rights to the Service, its code, design and documentation belong to the Provider or its licensors.

8.2 By uploading a Document, the User does not grant the Provider any rights to the content of the Document other than those necessary to provide the Service.

8.3 Outputs (anonymised documents) belong to the User.

9. Liability and limitation of liability

9.1 The Provider is responsible for the proper functioning of the Service in accordance with these Terms.

9.2 The Provider does not warrant that:

a) the automatic detection will identify all personal or sensitive data in every Document without exception;

b) the result will, without further review by the User, be legally sufficient to fulfil its obligations under the GDPR or other regulations;

c) OCR text recognition (for scans/photographs) will achieve 100 % accuracy, especially with poor-quality input.

9.3 The Provider is not liable for:

a) inaccuracy or incompleteness of the automatic detection of personal data that the User did not correct before approval;

b) damage caused by an outage of the Service exceeding the value of the User's credit or flat fee for the last 30 days;

c) acts or omissions of the User in breach of these Terms;

d) damage caused by a third party (including AI API providers);

e) indirect damage, lost profit or loss of data arising from the use of or inability to use the Service.

9.4 The Provider's total liability to the User for any claims is limited to the amount of credit or fees paid by the User in the last 12 months.

9.5 Health data and other special categories of data (Art. 9 GDPR). The Service includes an automated filter that tries to recognise Documents containing health/medical data and to refuse their processing instead of (incorrectly) anonymising them — in line with the prohibition in Art. 5(b) of this document. The filter first evaluates the text of the Document directly on the Provider's server, before anything is sent to a sub-processor (for scans and photos the text is read locally first); on clear signs of health data the Document is sent to no one and is refused. If the signs are only weak (e.g. a single word such as a company name), the Document may be processed and the AI model itself additionally checks for health data. The same check applies to text that the User marks manually. This filter is not and cannot be 100 % reliable (the same limitation as for the automatic detection of ordinary personal data, Art. 9.2(a) above) — the User therefore must not upload at all Documents containing health records, diagnoses or other medical documentation, regardless of whether the filter catches them correctly. If the filter does not catch such a Document and the Service nevertheless processes it, responsibility for the upload and its consequences lies solely with the User who uploaded it — as with any other breach of the prohibition under Art. 5(b).

10. Protection of personal data

10.1 When processing the User's personal data (registration data, audit log), the Provider acts as a Controller. The processing conditions are set out in the Privacy Policy, which forms part of the Data Processing Agreement (DPA), Annex No. 1 to these Terms.

10.2 When processing personal data contained in Documents uploaded by the User, the Provider acts as a Processor. The conditions are set out in the Data Processing Agreement (DPA), which forms Annex No. 1 to these Terms (Art. 4.3) and which the User accepts at registration.

11. Changes to the Terms

11.1 The Provider is entitled to change these Terms unilaterally. It informs the User of a change by e-mail at least 15 days before it takes effect.

11.2 If the User does not agree with a change, it may stop using the Service and request a refund of the unused one-off credit top-up (Art. 6.11).

12. Termination

12.1 The User may cancel the subscription at any time in the application settings or by e-mail — the settlement of unused credit is governed by Art. 6.11.

12.2 The Provider may terminate the account in the event of a breach of these Terms, after prior notice with a 14-day period to remedy it (except for a serious breach), or in the event of long-term inactivity under Art. 6.10.

12.3 After the subscription ends, the account is closed, not deleted. The reasons are (a) the Provider's obligation to demonstrate compliance of personal data processing also retrospectively (accountability principle under Art. 5(2) and Art. 30 GDPR) and (b) the need for an evidentiary record in case of a dispute concerning processed documents. The record of processing activities (audit log) is kept for 3 years from the respective processing (the same period as the general limitation period under the Slovak Civil Code), after which it is permanently and automatically deleted. During this period the specific approver can be traced from the stamp on the anonymised document; after it expires, only the organisation remains traceable (details in the Privacy Policy).

13. Governing law and dispute resolution

13.1 These Terms are governed by the law of the Slovak Republic.

13.2 Disputes shall be resolved primarily amicably. If no agreement is reached, disputes shall be decided by the competent court in the Slovak Republic.

13.3 Since only a business may be a User of the Service (Art. 3.1a), the provisions on alternative resolution of consumer disputes do not apply to the contractual relationship established by these Terms.

14. Final provisions

14.1 These Terms take effect on the date of their publication in the SureDocs Redact application.

14.2 If any provision of these Terms is invalid, the remaining provisions remain in force.

14.3 The User confirms that it has read and understood these Terms and agrees to them by ticking the relevant box at registration.

14.4 This agreement may also be made available in translation into other languages. The translation is for information only; in the event of any conflict between the Slovak version and the translation, the Slovak version always prevails. The User's consent applies to the Slovak version; the accepted Slovak version is stored as the official document in the User's account (Dashboard → Orders) together with the translation the User had displayed when consenting.