Terms of Service

1. Definitions

• "Agreement": these Terms, the Data Processing Agreement, and any Order Form.
• "Order Form": a document signed by both parties setting out the subscription, fees, term, service levels and any terms that differ from these Terms.
• "Customer Content": the documents and other material the Customer or its Users place in the Service, uploaded or synchronised from a connected system, and everything the Service derives from it.
• "Output": text, files and other material the Service generates for a User.
• "Users": the individuals the Customer authorises to use the Service under its account, including employees of its Affiliates and the contractors and project participants it invites.
• "Affiliate": an entity that controls, is controlled by or is under common control with a party.

2. The Service

Stoa lets the Customer's Users search, retrieve and ask questions about construction project documentation to which they have been granted access, and receive answers that cite the source documents. The Service reads documents from the systems the Customer connects and from direct upload; it never modifies documents in those systems. Answers are generated by large language models, and every statement derived from the Customer's documents carries a reference to the page it came from.

The Service is for business use only. The person accepting these Terms confirms that they have authority to bind the Customer and that each User is at least 18 years old. Stoa may improve and change the Service; Section 12 sets out the notice given.

3. Accounts, Users and access

The Customer's administrators invite Users, place them in access groups and grant those groups access to projects and folders. Access is denied by default: a User sees only the folders the Customer has granted, and nothing about the rest, including their names. The Customer decides who may see what, keeps those grants in line with its source systems, and deactivates Users who leave. Stoa cannot widen access beyond what the Customer has granted and does not share Customer Content outside the Customer's workspace.

Users keep their credentials confidential. Where the Customer enables single sign-on, its own identity provider controls authentication, including multi-factor and conditional access, and Stoa honours its decisions. The Customer is responsible for activity under its account and notifies Stoa promptly of unauthorised use.

4. Fees and payment

The Service is provided on a paid subscription unless an Order Form says otherwise. Fees, billing period and term are set in the Order Form or in the pricing accepted when the account was created. Invoices are payable within fourteen (14) days and exclude value added tax. Fees are non-refundable except where these Terms or mandatory law provide otherwise. If an undisputed invoice is more than thirty (30) days overdue, Stoa may suspend access after ten (10) days' written notice and restores it on payment.

5. Customer Content and Output

The Customer owns its Customer Content and grants Stoa a non-exclusive licence to store, process, index, analyse, display and transmit it solely to provide, secure and support the Service, for the term and the deletion period after it. Stoa does not use Customer Content or Output to train, fine-tune or improve any model, its own or a third party's.

Output belongs to the Customer. To the extent any right in Output vests in Stoa, Stoa assigns it to the Customer on creation or, where assignment is not possible, grants a perpetual, irrevocable, royalty-free licence. Output derived from similar documents may be similar for other customers; Stoa does not warrant that Output is unique.

The Customer is responsible for having the right to place Customer Content in the Service and to share it with the Users it invites, and for complying with data protection law as controller of any personal data in it. The Data Processing Agreement governs Stoa's processing of that data.

6. AI, intended purpose and excluded uses

The Service is an AI system under Regulation (EU) 2024/1689 (the AI Act). Its intended purpose is to let authorised personnel of a construction project search, retrieve and obtain natural-language answers about project documentation to which they have been granted access, with references to the source documents. Output is informational and preparatory. The Service is not intended to produce assessments, scores, rankings, predictions or recommendations concerning any natural person, or to make or materially influence any decision. Stoa is the provider and the Customer the deployer.

Users are told in the Service that they are interacting with an AI system. Output can be wrong, incomplete or out of date and is not professional advice. The Customer and its Users check Output against the cited sources before relying on it and remain responsible for their decisions and for compliance with the laws that apply to their projects.

The Customer must not use, configure or extend the Service, or allow its Users to:

• recruit, select, screen or evaluate candidates for employment;
• make or prepare decisions on the terms, promotion or termination of a work-related relationship;
• allocate tasks to persons on the basis of their behaviour, traits or characteristics;
• monitor or evaluate the performance or behaviour of a person in a work-related relationship;
• act as a safety component of critical infrastructure, or generate any automated instruction to a plant, machine or control system;
• process biometric data, infer emotions or categorise natural persons;
• produce any score, ranking or profile of a natural person; or
• otherwise make the Service a high-risk AI system under Annex III of the AI Act.

Under Article 25(1)(c) of the AI Act, a deployer that changes an AI system's intended purpose so that it becomes high-risk is treated as its provider.

7. Acceptable use

The Customer and its Users must not:

• use the Service unlawfully or in breach of a third party's rights;
• place material in the Service they have no right to place there, or share it with persons who have no right to see it;
• interfere with the operation or security of the Service, test it for vulnerabilities without Stoa's written agreement, or attempt to access another customer's data;
• reverse engineer, decompile or copy the Service, except where mandatory law allows;
• build a competing product with it, or resell it without Stoa's written agreement.

Vulnerabilities may be reported to eino@stoabuild.com. Stoa acknowledges reports within one business day and does not pursue good-faith research that respects other customers' data and does not degrade the Service.

8. Security and data protection

Stoa protects Customer Content with the measures in Annex III of the Data Processing Agreement: encryption in transit and at rest, deny-by-default access control enforced inside every retrieval query, separated environments, tested backups and a documented incident process. Customer Content and AI inference stay in the EU/EEA; the only processing outside it is listed in the Data Processing Agreement, and none of it involves Customer Content.

Stoa notifies the Customer of a security incident affecting its data within forty-eight (48) hours of becoming aware of it and follows up with a written report. Stoa gives thirty (30) days' notice before adding or replacing a sub-processor or changing the AI inference region or provider, with the right to object set out in the Data Processing Agreement. Security documentation and completed questionnaires are available on request.

9. Availability and support

Stoa aims to keep the Service available at least 99 % of each calendar month, excluding scheduled maintenance, which is announced in advance and scheduled outside Finnish working hours where practical. Service credits and tighter commitments apply only where an Order Form provides for them. Support is available in Finnish and English by email on working days from 08:00 to 16:00 Finnish time, and by telephone where an Order Form provides for it.

10. Export and deletion

Users can download original documents at any time, and Stoa produces a structured export of the Customer's data on request, free of charge, within thirty (30) days. The Customer can delete Customer Content at any time. A Customer that wants its data exported requests the export before the Agreement ends. On termination or expiry, Stoa deletes all Customer Content from its production systems within thirty (30) days and issues a certificate of deletion; backups expire within a further thirty (30) days. Stoa retains only what mandatory law requires.

11. Intellectual property and confidentiality

Stoa and its licensors own the Service and all improvements to it. The Customer receives a non-exclusive, non-transferable right to use the Service for its internal business during the term. Feedback may be used by Stoa without obligation, provided it contains no Customer Content.

Each party keeps the other's confidential information confidential, uses it only for the Agreement, and discloses it only to personnel and advisers who need it and are bound by confidentiality, or where the law requires. Customer Content is the Customer's confidential information; Stoa's non-public documentation, pricing and security information are Stoa's. The obligation lasts five (5) years after the Agreement ends, and for Customer Content and trade secrets without time limit.

12. Changes

Stoa gives the Customer's administrators at least thirty (30) days' notice by email before a change to these Terms takes effect and publishes the new version, with its version number and effective date, at stoabuild.com/terms. A change that materially reduces the Customer's rights or Stoa's obligations does not apply to a Customer with an Order Form before its next subscription term, and any Customer that does not accept it may terminate before it takes effect and receive a refund of fees prepaid for the period after termination. An Order Form prevails over these Terms where the two differ.

Stoa gives at least ninety (90) days' notice before discontinuing the Service or removing a material capability.

13. Term and termination

The Agreement runs for the term in the Order Form or, absent one, until either party terminates on thirty (30) days' written notice. Either party may terminate on written notice if the other materially breaches the Agreement and does not cure within thirty (30) days of notice, or becomes insolvent. Stoa may suspend access immediately, for as long as necessary, where there is a serious risk to the security of the Service or other customers' data, or where use violates Section 6 or 7, and informs the Customer without delay. On termination the licences end, fees due up to termination are payable, and Section 10 applies.

14. Warranties

Stoa provides the Service with reasonable skill and care and in accordance with the Agreement. Otherwise the Service is provided as is, without warranties of any kind, express or implied. Stoa does not warrant that Output is accurate or complete, that the Service will be uninterrupted or error-free, or that it will find every relevant document.

15. Liability

Neither party is liable to the other for indirect or consequential loss, loss of profit, business or goodwill. Each party's total liability under the Agreement, including the Data Processing Agreement, in any twelve (12) month period is limited to the fees paid or payable by the Customer in the twelve (12) months preceding the event giving rise to the claim.

These limits do not apply to death or personal injury, fraud, gross negligence or wilful misconduct, a party's deliberate disclosure of the other party's confidential information, the Customer's payment obligations, liability towards data subjects under Article 82 of the GDPR, or any liability that cannot be limited by law.

16. Indemnities

Stoa defends the Customer against third-party claims that the Service, used in accordance with the Agreement, infringes an intellectual property right, and pays the damages and costs finally awarded or agreed, provided the Customer gives prompt notice, control of the defence and reasonable assistance. This excludes claims arising from Customer Content, from Output to the extent it reproduces Customer Content, or from use in breach of the Agreement.

The Customer defends Stoa on the same conditions against third-party claims arising from Customer Content, from use of the Service in breach of the Agreement, or from the Customer's breach of applicable law. Data protection indemnities are in the Data Processing Agreement. Both indemnities are subject to Section 15.

17. General

The Agreement is the entire agreement on its subject matter. If documents conflict, the Data Processing Agreement prevails on data protection, then the Order Form, then these Terms. Neither party assigns the Agreement without the other's written consent, except to an Affiliate or a successor to its business on written notice. Neither party is liable for delay caused by events beyond its reasonable control, except for payment. If a provision is invalid, the rest remains in force. The Agreement is governed by the laws of Finland, and disputes are resolved in the courts of Finland, with the District Court of Helsinki as the court of first instance.

Contact

Stoa Technologies Oy (Business ID 3633842-5)
Kampinkuja 2
00100 Helsinki
Finland
Email: info@stoabuild.com