TOONAH Platform Usage Contract

1. Parties and definitions

This contract (the "Contract") is entered into between:

TOONAH SAS, [TO BE COMPLETED: legal form and share capital], registered with the [TO BE COMPLETED: Trade and Companies Register of … under number …], whose registered office is at [TO BE COMPLETED: registered office address] ("TOONAH");
the organisation that creates a space on the platform or subscribes to a plan (the "Customer"), represented by the person who accepts the Contract and declares that they are authorised to bind it.

In the Contract:

Platform: the TOONAH software service accessible online (app.toonah.io and its associated applications), its application programming interfaces (api.toonah.io) and the artificial intelligence assistant "Bernard".
Space: the isolated environment ("tenant") allocated to the Customer on the Platform.
Administrator: a user of the Customer holding the administration role for the Space.
User: any natural person to whom the Customer grants access to its Space (employee, agent, auditor, adviser, etc.).
Customer Data: all data, documents and content entered, imported, transmitted or generated in the Space by the Customer, its Users or at their request (risks, controls, audits, evidence, documents, transmitted logs, exchanges with Bernard, etc.).
AI Outputs: the content proposed by the artificial intelligence features of the Platform (answers, analyses, document drafts, proposed actions).
Plan: the subscription plan chosen (Starter, Professional, Enterprise or Custom) and any special terms attached to it.

2. Purpose and scope

2.1. The Contract sets out the terms on which TOONAH makes the Platform available to the Customer on a software-as-a-service (SaaS) basis, and the terms on which the Customer and its Users use it.

2.2. Professional use. The Platform is intended exclusively for organisations (companies, institutions, public administrations, associations, self-employed professionals) acting for the purposes of their professional activity. The Customer declares that it is acting for professional purposes. The provisions of the French Consumer Code specific to consumers do not apply to the Contract, [TO BE COMPLETED: subject to the provisions applicable to non-professionals and very small businesses, to be checked by counsel].

2.3. The Contract applies to all use of the Platform, during the free trial as well as during the subscription. The Customer's general terms of purchase do not apply, unless TOONAH agrees otherwise in writing.

3. Contractual documents

3.1. The Contract incorporates by reference, in the versions in force on the date of its acceptance, the following documents, which form an integral part of it:

the Terms of Use for Users, which each User accepts personally;
the Privacy Policy, which describes the processing for which TOONAH is the controller;
the Data Collection and Processing Policy, which describes the data processed on the Platform, the artificial intelligence processing, transfers, retention periods and the use of cookies and local storage;
the Data Processing Agreement ("DPA", Article 28 GDPR), with its annexes: description of the processing, list of sub-processors and technical and organisational measures.

3.2. Where applicable, the Plan subscribed to and any special terms signed by the parties supplement the Contract.

3.3. Order of precedence. In the event of conflict: (i) the signed special terms, (ii) the DPA for all matters relating to the processing of personal data on behalf of the Customer, (iii) this Contract, (iv) the other documents referred to in Article 3.1, (v) the Plan.

3.4. Each document bears a version number. The version accepted by the Customer is kept and can be consulted on the Platform ("My contracts" section).

4. Acceptance, evidence and capacity

4.1. The Contract is accepted online, by ticking a box that is not pre-ticked, when the Space is created. The person accepting it declares that they are authorised to bind the Customer. Acceptance of the Contract entails acceptance of the documents it incorporates (Article 3.1), in the versions displayed at that time.

4.2. TOONAH keeps evidence of the acceptance: account identity, organisation, versions accepted, digital fingerprint (SHA-256) of the text of each version, date and time, method of acceptance, language, and a cryptographic fingerprint (HMAC) of the IP address and browser, without storing them in clear. A summary e-mail is sent to the person who accepts. The parties agree that these records constitute evidence of acceptance, unless proven otherwise.

4.3. Users invited by the Customer personally accept the Terms of Use for Users when activating their account. The Customer remains responsible for the use of the Platform by its Users.

5. Accounts, access and security of credentials

5.1. The Customer appoints at least one Administrator. Administrators create, invite, modify and deactivate User accounts and assign roles and access rights (role-based access control).

5.2. Credentials are personal and confidential. The Customer and its Users take the necessary measures to protect them. TOONAH strongly recommends enabling two-factor authentication (TOTP app), offered on the Platform, and using single sign-on (SSO) where it is available in the Plan.

5.3. The Customer notifies TOONAH without delay of any unauthorised use or any security breach of which it becomes aware, at [TO BE COMPLETED: security contact address].

5.4. TOONAH may suspend an account where there is a serious indication of compromise, after informing the Customer where possible.

6. Description of the services

6.1. The Platform makes it possible, in particular, to manage regulatory compliance, internal control, audit, risk and strategic diagnosis, to keep evidence and documents, and to rely on the Bernard assistant. The exact content depends on the Plan subscribed to, as described on toonah.io.

6.2. The frameworks, texts and documentary content made available are provided as an aid. They replace neither consultation of the official texts nor the Customer's professional judgement.

6.3. TOONAH may develop the Platform. A change may not remove an essential feature of the Plan subscribed to without prior notice to the Customer.

7. Artificial intelligence features

7.1. Transparency. The Platform includes artificial intelligence systems, identified as such in the interface: the Bernard assistant and its specialised agents, document analysis, assisted drafting in the document studio and, on toonah.io, the public assistant. Users are informed that they are interacting with an AI system and that the content produced is AI-generated, in accordance with the transparency obligations of Regulation (EU) 2024/1689 (AI Act), to the extent that they apply.

7.2. Nature of AI Outputs. AI Outputs are proposals. They may be incomplete, inaccurate or unsuited to the Customer's situation. Bernard cites its sources where it has them. The Customer and its Users check AI Outputs before any use, decision or dissemination.

7.3. Human oversight. Actions that Bernard proposes to carry out in the Space (creation or modification of items, approvals) are subject to explicit confirmation by an authorised User before execution. The Customer retains control of, and responsibility for, the decisions taken.

7.4. No legal advice. Neither the Platform nor the AI Outputs constitute legal, accounting, financial or audit advice in the regulated sense. For any matter requiring such advice, the Customer consults a qualified professional.

7.5. Model providers. AI models are supplied by third-party providers, chosen according to the task and the region of the Space, on the terms described in the Data Collection and Processing Policy and in Annex 2 of the DPA. By default, processing is carried out by a European provider. Use of a provider whose processing may take place outside the European Union requires explicit activation by an Administrator in the AI settings of the Space.

7.6. Training. Customer Data is not used to train the providers' models [TO BE COMPLETED: to be confirmed in the light of the contracts concluded with each provider]. Bernard's Space-specific learning memory (preferences, terminology, corrections) is fed only with the consent of the organisation and of the User concerned, and can be disabled and erased. No knowledge derived from a Space is shared with other customers without anonymisation and human validation.

7.7. Prohibited uses. The Customer shall not use the AI features for any practice prohibited by Regulation (EU) 2024/1689, to take a decision producing legal effects concerning a person without human intervention, or in breach of Article 8.

8. Acceptable use

The Customer and its Users shall not, in particular:

use the Platform in breach of applicable laws and regulations, or to process data without a legal basis;
introduce unlawful, infringing or defamatory content, or malicious code;
attempt to access another customer's Space, circumvent security measures or usage limits, or test the security of the Platform without TOONAH's prior written consent;
carry out automated mass extraction, reverse engineering or reproduction of the Platform, except within the limits permitted by law;
resell, sublicense or make the Platform available to third parties outside the Space, except with written consent (for example an advisory-firm mandate provided for in the Plan);
introduce into the Platform special categories of data (Article 9 GDPR) or data relating to criminal convictions, except where necessary for its compliance mission and in compliance with applicable law;
submit authentication secrets (passwords, keys) to Bernard.

9. Customer Data

9.1. Ownership. The Customer remains the sole holder of the rights in the Customer Data. AI Outputs generated in its Space belong to it, subject to the rights of third parties and to TOONAH's reference content that they may reproduce.

9.2. Hosting licence. The Customer grants TOONAH, for the term of the Contract and the return period, the non-exclusive right to host, reproduce and process the Customer Data solely to the extent necessary for the provision, security and support of the Platform.

9.3. Statistics. TOONAH may produce aggregated and anonymised statistics on the use of the Platform, which do not make it possible to identify either the Customer or any individual.

9.4. Responsibility for content. The Customer is responsible for the lawfulness, accuracy and relevance of the Customer Data and holds the rights necessary to introduce it into the Platform.

10. Personal data protection

10.1. For Customer Data containing personal data, the Customer acts as controller and TOONAH as processor within the meaning of Article 28 GDPR. The DPA applies.

10.2. For the management of the commercial relationship, invoicing, the security of the Platform, its website and its prospects, TOONAH acts as controller, on the terms of the Privacy Policy.

10.3. The Customer informs its Users and the persons whose data it processes on the Platform, in accordance with Articles 13 and 14 GDPR.

10.4. Local law. A Customer established outside the European Union, in particular in a CEMAC or WAEMU (UEMOA) member state or in the Democratic Republic of the Congo, checks the requirements of its national data protection legislation (declarations, transfer authorisations, localisation). [TO BE COMPLETED: any specific clauses, to be drafted by counsel according to the countries concerned.]

11. Confidentiality

11.1. Each party keeps confidential the non-public information received from the other party in connection with the Contract, uses it only for the performance of the Contract and discloses it only to persons who need to know it and are bound by an equivalent obligation.

11.2. Information is not confidential if it is public through no fault of the receiving party, already known to it, or lawfully received from a third party. Disclosure required by law or by an authority remains possible, after informing the other party where the law permits.

11.3. This obligation continues for the term of the Contract and for [TO BE COMPLETED: duration] after its end.

12. Security

12.1. TOONAH implements the technical and organisational measures described in Annex 3 of the DPA, in particular: hosting in France, isolation of Spaces, encryption of communications, encryption at rest of secrets (two-factor authentication secrets, connector secrets), audit log, role-based access control, daily backups and restoration tests.

12.2. TOONAH may change these measures, without reducing the overall level of protection.

12.3. The Customer implements the security measures for which it is responsible: management of its Users' rights, protection of credentials, two-factor authentication, security of its workstations and networks.

13. Availability, maintenance and support

13.1. TOONAH endeavours to ensure that the Platform is accessible 24 hours a day, 7 days a week, except for maintenance, force majeure or failure of a network or third-party provider. The service level commitments (availability, response times, penalties, if any) are those of the Plan: [TO BE COMPLETED: service levels per Plan — Starter, Professional, Enterprise, Custom].

13.2. Scheduled maintenance operations are, as far as possible, announced in advance and carried out outside business hours.

13.3. Support is available at [TO BE COMPLETED: support channel and hours]; general contact: contact@toonah.io.

14. Plans, trial, prices and payment

14.1. Free trial. Creating a Space opens a 14-day free trial of the chosen Plan, without commitment. Reminders are sent before the end of the trial.

14.2. Subscription. The Plans, their features and their prices (exclusive of tax, in euros or US dollars) are presented on the Platform and on toonah.io. The subscription is [TO BE COMPLETED: monthly / annual, automatic renewal, price revision terms and notice].

14.3. Payment. Payment is made by card through the payment service provider Stripe; TOONAH neither receives nor stores card data. Invoices are [TO BE COMPLETED: invoicing terms, payment terms, late payment penalties and fixed recovery indemnity, applicable taxes].

14.4. End of trial and non-payment. At the end of the trial without a subscription, or in the event of non-payment not remedied within a grace period of [TO BE COMPLETED: length of the grace period], the Space becomes read-only: Customer Data remains viewable and exportable, but modifications are suspended until subscription or regularisation. Beyond [TO BE COMPLETED: duration], the provisions of Article 15 apply.

15. Term, suspension and termination

15.1. The Contract takes effect upon its acceptance and remains in force for as long as the Space is open, including the trial.

15.2. Termination by the Customer. The Customer may terminate its subscription [TO BE COMPLETED: terms and notice, effective at the end of the current period].

15.3. Termination for breach. In the event of a serious breach by a party that is not remedied within [TO BE COMPLETED: 30] days after formal notice, the other party may terminate the Contract automatically.

15.4. Suspension. TOONAH may suspend all or part of the access, proportionately, in the event of a serious breach of Article 8, a risk to the security of the Platform or of other customers, or on the order of an authority. Except in an emergency, the Customer is informed beforehand.

16. Return and deletion of data

16.1. Throughout the term of the Contract, the Customer may export its Customer Data from the Platform in the formats offered.

16.2. At the end of the Contract, the Customer has a period of [TO BE COMPLETED: duration] to export its data or request its return in a standard format. On expiry of that period, TOONAH deletes the Customer Data from its production environments, then from its backups at the end of their rotation cycle (14 days for local backups, [TO BE COMPLETED: duration for off-site copies]), unless there is a legal obligation to retain it.

16.3. TOONAH retains, for the applicable limitation period, the items needed to evidence the contractual relationship (proofs of acceptance, invoices, audit logs), on the terms of the Privacy Policy.

17. Intellectual property

17.1. TOONAH remains the holder of all rights in the Platform, its software, its trade mark, its reference content and its documentation. For the term of the Contract, the Customer enjoys a personal, non-exclusive and non-transferable right to use the Platform for its internal needs, through its Users, within the limits of the Plan.

17.2. The names of frameworks and standards cited belong to their respective publishers.

17.3. Suggestions for improvement voluntarily provided by the Customer may be freely used by TOONAH, without consideration and without reproducing any Customer Data.

18. Warranties and liability

18.1. TOONAH undertakes to provide the Platform with due care, in accordance with its documentation (obligation of means).

18.2. TOONAH is not liable for decisions taken by the Customer on the basis of AI Outputs or reference content, nor for damage resulting from use that does not comply with the Contract, from the Customer Data, or from a third-party service chosen by the Customer (connectors, webhooks, identity providers).

18.3. Cap. Except in the case of gross negligence or wilful misconduct, personal injury or a mandatory legal provision, each party's total liability under the Contract is limited to [TO BE COMPLETED: cap, for example the amount of sums paid over the last 12 months]. Neither party is liable for indirect damage [TO BE COMPLETED: definition to be validated].

18.4. [TO BE COMPLETED: any specific regime for breaches of the DPA and of confidentiality.]

19. Force majeure

Neither party is liable for a failure caused by an event of force majeure within the meaning of the French Civil Code, Article 1218. The affected party informs the other without delay. If the impediment lasts more than [TO BE COMPLETED: duration], either party may terminate the Contract without compensation.

20. Amendment of the Contract

20.1. TOONAH may amend the Contract and the documents it incorporates, in particular to reflect changes in the Platform, its providers or applicable law. Each new version receives a number, an effective date and a summary of changes.

20.2. Substantial amendment. Where an amendment affects the Customer's rights or obligations, the Administrators are informed by e-mail and on the Platform at least [TO BE COMPLETED: 30] days before it takes effect, unless the amendment is required by law or by an authority. An Administrator must accept the new version on behalf of the Customer. The other Users are informed.

20.3. Failing acceptance. If no acceptance is given by the end of a period of [TO BE COMPLETED: 30] days (configurable), modifications are suspended in the Space: Customer Data remains viewable and exportable until an Administrator accepts. A Customer who refuses the new version may terminate the Contract before it takes effect [TO BE COMPLETED: free of charge / pro rata refund terms].

20.4. Non-substantial amendments (editorial corrections, updated contact details, addition of a sub-processor under the DPA procedure) apply upon publication.

21. Assignment and subcontracting

21.1. The Customer may not assign the Contract without TOONAH's written consent. TOONAH may assign the Contract to a company taking over all or part of its business, after informing the Customer.

21.2. TOONAH may use providers for the performance of the Contract; for the processing of personal data, the DPA governs the use of sub-processors.

22. Governing law and jurisdiction

22.1. The Contract is governed by [TO BE COMPLETED: governing law, for example French law].

22.2. The parties seek an amicable solution before taking any action. Failing that, any dispute falls within the jurisdiction of [TO BE COMPLETED: competent court, for example the courts within whose jurisdiction TOONAH's registered office lies, or an arbitration clause for customers outside the European Union].

23. Miscellaneous

23.1. Notices. Notices are sent by e-mail: to TOONAH, at contact@toonah.io; to the Customer, at the address of its Administrators.

23.2. Language. The Contract is drawn up in French and in English. In the event of discrepancy, the French version prevails.

23.3. Entire agreement, severability. The Contract and the documents it incorporates constitute the entire agreement of the parties on its subject matter. The invalidity of one clause does not affect the others. Failure to rely on a clause does not constitute a waiver.

Annexes and incorporated documents

Terms of Use for Users
Privacy Policy
Data Collection and Processing Policy (including cookies and AI processing)
Data Processing Agreement (DPA): Annex 1 (description of the processing), Annex 2 (sub-processors), Annex 3 (technical and organisational measures)