Semantic Rails Cloud subscription terms

Version 2026-09-12. These terms take effect for Customer when accepted through the Service or incorporated in a signed order.

1. Agreement and workspaces

These terms are between Semantic Rails, Inc. (Semantic Rails, we, us) and the business or professional customer identified in the subscription (Customer, you). They cover Semantic Rails Cloud, its hosted interface, API and MCP services (the Service). Contact us at will.tremml@semantic-rails.com.

The Service is for business and professional use by adults able to enter a contract. A person accepting for a business must have authority to bind it. A workspace is a shared product account, not a separate legal entity. People may belong to multiple workspaces. Joining a workspace does not itself authorize a person to purchase for, or bind, its owner. Customer controls its authorized users, roles and connected systems and is responsible for their authorized use.

The agreement includes these terms, the accepted subscription offer or signed order, and the Data Processing Addendum where Customer Personal Data is processed. Mandatory transfer terms prevail where applicable; the DPA controls conflicting personal-data provisions, and a signed order controls commercial departures it expressly identifies. The Privacy Notice explains our own information practices. Acknowledging it is not marketing consent.

2. Service access and safe use

We grant authorized users access during the subscription within the purchased limits. Secure your identity-provider accounts, email accounts, sign-in links, machine credentials and devices. Give each person and warehouse connection only the permissions needed for its task. Promptly report suspected compromise to our contact above, and revoke affected credentials at their source.

Cloud verifies workspace membership and permissions for supported operations. Revoking membership does not automatically revoke separately issued machine keys, and permission changes may not cancel operations already running. You must manage those keys separately. Do not place secrets in project source, assistant prompts, support messages or public Sandbox content.

You must have authority to connect each warehouse, repository and AI client and to process the information you supply. Do not bypass access or usage controls, access another person's data without permission, distribute malware, infringe rights or disrupt the Service. Do not submit payment-card authentication data, health information requiring a business associate agreement, special-category personal data under GDPR, or criminal-offence data unless we expressly agree in writing to support that use with appropriate safeguards.

Review consequential assistant actions and validate important outputs. Draft, Review and Live are product stages, not promises of independent human approval for every change. Future features, customer-selected engine version pinning, and unreleased integrations are not included unless expressly agreed.

3. Customer Data and confidentiality

Customer Data includes your project definitions, configuration, credentials, queries and other information supplied by or for you, including warehouse data processed and results returned through the Service. You retain your rights in Customer Data. You authorize us to process it only as needed to provide, maintain, secure and support the agreed Service, follow your lawful instructions and meet applicable legal obligations. We do not acquire ownership of your data.

Each party will protect the other's nonpublic business information with reasonable care and disclose it only to people and providers who need it for these purposes and are subject to appropriate confidentiality obligations. This duty excludes information lawfully available without restriction, independently developed, or received lawfully from another source. Legally required disclosure is permitted, with prior notice when lawful and practicable and reasonable steps to limit the disclosure.

We will not sell Customer Data, use it for targeted advertising, or use it to train general-purpose AI models. Limited account, security, billing and product measurement records used for our separate business purposes are described in the Privacy Notice; they are not permission to repurpose warehouse content.

Warehouse queries and results pass through Cloud to the requesting browser or MCP client. Your chosen AI client and model provider may receive tool descriptions, project information and returned data and handle them under their own terms. Review those settings and authorize only appropriate tools and data. We do not promise that data never leaves your warehouse or control an independently chosen AI provider's retention or training practices.

4. Security and operation

Cloud is hosted on infrastructure operated by Semantic Rails. We maintain the safeguards described in the DPA, including workspace authorization, restricted service roles, encrypted stored warehouse credential payloads and encrypted backups. Access to decrypted credentials is limited to authorized service operations and support/security needs under confidentiality obligations. Credentials may remain available to an active warehouse connection until it is released; encryption does not eliminate risk from a compromised running host or authorized account.

We will notify affected customers of a personal data breach as described in the DPA and cooperate in response. Customer remains responsible for its own source projects, warehouse backups and permission choices. The Service has no uptime SLA, service credits or guaranteed recovery time. Semantic Rails has no SOC 2 attestation. These limitations do not remove our agreed security duties or liability that cannot lawfully be excluded.

We may update and maintain the Service. For a planned material reduction of contracted functionality or discontinuation, we will ordinarily give at least 30 days' notice and a reasonable exit opportunity. Urgent security or legal changes may require shorter notice. If we discontinue the paid Service without your breach, we will refund prepaid fees for the unused discontinued period.

5. Charges, renewal and cancellation

Your accepted offer identifies the currency, recurring fees, billing interval, included allowance, metered unit and rate, trial limits and any discount's scope and expiry. Only that accepted offer creates the charges; this document does not set prices. Applicable taxes and independently incurred warehouse, model or network charges are additional as disclosed. Metered usage is charged at the accepted rate for the period in which it occurs.

A subscription renews for the interval stated in the accepted offer unless cancelled. A free trial does not authorize paid conversion without a disclosed and accepted paid offer. We will give at least 30 days' notice of a price increase, which applies only to a future renewal; completed usage is not repriced.

You may cancel through the billing portal when available or by contacting us from an authorized billing account. Cancellation prevents the next renewal and normally takes effect at the end of the current paid period. We will confirm its effective date. If a portal setting offers immediate cancellation, its effect must be disclosed before you confirm it. Accrued usage and amounts validly owed remain payable. Except where law requires otherwise, ordinary cancellation does not refund a partially used billing period. Contact us promptly about disputed charges so we can investigate and correct errors.

6. Suspension, termination and data exit

We may restrict access reasonably necessary to address an immediate security risk, unlawful use or material disruption. For a remediable material breach or nonpayment, we will ordinarily give notice and 10 days to remedy it before termination, unless delay would create material risk or violate law. We will scope restrictions to the issue where practicable and restore access once it is resolved. Either party may terminate for an uncured material breach after that notice period.

You may request an export of project package artifacts and non-secret workspace configuration available through supported interfaces during the subscription and for 30 days after termination. We provide those objects in their existing machine-readable formats through support; ordinary exports exclude stored credential payloads and usable secrets. You can revoke or replace warehouse credentials at the warehouse and reconnect as needed. This is not a promise to export your external warehouse, all internal service records or a live full-system image.

We delete or return Customer Data from active systems within 30 days of a verified deletion instruction, or within 60 days after termination if no earlier instruction is received. Backup copies expire within 90 days after removal from active systems and are restricted to recovery until expiry. Limited billing, security and legal records may remain under the Privacy Notice or applicable law; they are not used to reactivate your workspace or for unrelated purposes. The DPA governs personal-data return and deletion.

7. Evaluation and open source

Shared Sandbox and public demonstrations use sample data and are not durable storage. Do not submit confidential or personal data there. Development, preview and beta environments may change or reset; their evaluation status does not remove applicable confidentiality and privacy duties.

We retain rights in proprietary Cloud software and documentation. Separately distributed open-source components retain their own licenses, including Apache License 2.0 where supplied. This subscription does not restrict rights under those licenses or turn an open-source license into a hosted-service entitlement.

8. Warranties and liability

Each party has authority to enter this agreement. We will provide the contracted Service with reasonable skill and care. If you identify a material failure of that commitment, we will use reasonable efforts to correct it; if we cannot within a reasonable time, you may terminate the affected Service and receive prepaid fees for its unused period. This remedy does not limit non-excludable rights or our DPA duties.

Except for express commitments and to the extent law permits, the Service is provided without implied warranties of merchantability, fitness for a particular purpose or non-infringement. We do not warrant uninterrupted operation or the accuracy or suitability of every query or AI-assisted result.

To the extent law permits, neither party is liable for indirect or consequential loss, lost profits or lost business opportunity. Direct reasonable costs of responding to a confidentiality or data-security breach are not excluded merely because they involve third-party response services.

Each party's total liability arising from this agreement is limited to the greater of US$1,000 and the fees paid or payable under it in the 12 months before the event giving rise to the claim. For breach of confidentiality or the DPA, the limit is instead twice that amount. These limits do not apply to fraud, willful misconduct, your valid payment obligations, or liability that law does not allow the parties to limit. Nothing limits an individual's statutory data protection rights or a regulator's powers. No contractual indemnity is created by these terms; ordinary applicable remedies remain subject to this section.

9. Notices and general terms

Send contractual, privacy and security notices to will.tremml@semantic-rails.com. We send material notices to the billing or administrative contact on record; keep that contact current. We will provide at least 30 days' notice of a material terms change, except where law or urgent security needs require otherwise, and obtain new acceptance where required. Changes do not retroactively expand rights to use Customer Data.

Neither party may assign the agreement without the other's consent, except in connection with a merger, reorganization or sale of substantially all relevant assets to a successor that assumes the obligations. Invalid provisions are limited only as necessary, and the remaining provisions continue. Neither delay in enforcement nor a single waiver waives another breach. Confidentiality, accrued payment, data-exit obligations and appropriate limitations survive termination. No mandatory arbitration or class-action waiver applies. Governing law and court jurisdiction are determined by applicable law unless a signed order expressly and lawfully agrees otherwise.