Legal

Terms of Service

Version 2026-05-15 · template document — the operating company must review before treating this as a negotiated MSA.

1. Who we are

These Terms of Service ("Terms") govern your access to and use of the Intramedial Agent Coordination Plane, related APIs (REST, OneMCP, OAuth), and related products (collectively, the "Service") operated by [Operating company legal name], [entity type] registered in [jurisdiction] with its principal place of business at [address] ("we", "us", or "our").

By creating an account you accept these Terms. If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity.

2. The service

The Service is the Intramedial Agent Coordination Plane: fleet map, admission, mandates, and receipts for agent coordination. The Service stores the records it produces in a tenant-scoped store in the region selected for the workspace.

We do not train models on Customer data or use Customer data for a secondary purpose.

3. Accounts

You are responsible for safeguarding your account credentials, workspace tokens, and access keys, and for all activity that occurs under your account. You must be at least 18 years old to use the Service. You must promptly notify us of any unauthorized access at security@intramedial.com.

4. Acceptable use

You agree not to:

• Reverse engineer, decompile, or disassemble the Service for the purpose of building a competing product or service;
• Use the Service to violate any applicable law, including export-control, anti-discrimination, or privacy laws;
• Submit data that violates third-party rights or applicable law;
• Attempt to access another tenant's data, or interfere with the integrity or performance of the Service;
• Use the Service to track or surveil individuals in ways that violate the GDPR, CCPA/CPRA, or any other applicable privacy law.

The Acceptable Use Policy is incorporated by reference.

5. Plans, fees, and auto-renewal

Paid subscriptions are billed monthly or annually in advance via Stripe in [billing currency]. Applicable sales tax or VAT may be added by Stripe Tax depending on your billing address. Metered overage is itemised on the Stripe invoice when billing keys are live.

Auto-renewal disclosure. Subscriptions automatically renew at the end of each billing period at the then-current rate. You may cancel renewal at any time through the Stripe Customer Portal accessible from your dashboard. Cancellation takes effect at the end of the current billing period. We do not provide pro-rated refunds for partial periods except where required by law.

Checkout is not live on this fleet until Stripe keys are configured. Public pricing lookup stays 501. After sign-in, MCP tool discovery.plans.list returns the live catalogue.

6. Your data; our records

You retain all rights to Customer data you submit through the Service. We process Customer data as your service provider (CCPA) or processor (GDPR). Records produced by Intramedial are append-only and hash-linked where the evidence path is enabled.

7. Intellectual property

We retain all right, title, and interest in the Service and related documentation, except for the limited license to use the Service granted under these Terms. You retain all right, title, and interest in your Customer data and any configurations you create within the Service.

8. Beta features

Features marked "beta", "alpha", "early access", or "preview" are provided as-is and may change or be withdrawn at any time.

9. Service levels

No SLA is published on this origin. [State, per plan, whether the Service is best-effort or carries an uptime target once measured.]

10. Disclaimers

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

We do not warrant that the Service will satisfy any specific regulatory obligation on your behalf — it produces inputs to your compliance programme. The Service is not legal advice.

11. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUES, DATA, OR BUSINESS OPPORTUNITIES, ARISING FROM OR RELATING TO THESE TERMS OR THE SERVICE.

OUR AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE AMOUNTS YOU PAID TO US UNDER THESE TERMS IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR [liability floor], WHICHEVER IS GREATER.

12. Indemnification

You will defend, indemnify, and hold harmless us from and against any third-party claims arising from (a) your use of the Service in violation of these Terms or applicable law, (b) your Customer data, or (c) your AI agents' actions or outputs.

13. Governing law

These Terms are governed by the laws of [governing-law jurisdiction], without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

14. Arbitration and class action waiver

Please read this section carefully — it affects your legal rights.

Any dispute, claim, or controversy arising out of or relating to these Terms or the Service that is not resolved through good-faith negotiation within [N] days will be resolved by binding arbitration administered by [arbitration body] under its commercial arbitration rules. The arbitration will be conducted in [seat of arbitration], before a single arbitrator, in [language].

Class action waiver. You and we agree that any dispute will be resolved on an individual basis only.

Opt-out. You may opt out of this arbitration agreement by sending written notice to legal@intramedial.com within [N] days of first accepting these Terms.

15. Termination

You may terminate by cancelling your subscription at any time. We may terminate or suspend your access for material breach (after reasonable opportunity to cure where possible), for non-payment, or if continued provision would expose us to legal liability.

16. Changes to these Terms

We may update these Terms from time to time. For material changes, we will provide [notice period] notice via email to the workspace owner. Continued use of the Service after the effective date of changes constitutes acceptance.

17. Contact

legal@intramedial.com · [Operating company legal name] · [Jurisdiction].

Privacy Policy

Version 2026-05-15 · template document — the operating company must review before treating this as a filed policy.

1. Who is responsible

This Privacy Policy explains how [Operating company legal name] ("we", "us") handles personal information ("PI") collected through the Service. For data submitted through our clients about your end users, we act as a service provider (under California CCPA/CPRA) and processor (under EU/UK GDPR).

2. Personal information we collect

Account data — name, work email, workspace name, billing country, plan. Usage data — dashboard activity, IP address, user-agent for security and abuse prevention. Support data — what you send us when you contact support. Workspace records — the contents of your ledger live in your tenant; we only see aggregate run counts for billing and quota.

We do not knowingly collect personal information from children under 16. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. Categories under CCPA/CPRA

Categories collected in the last 12 months: identifiers (name, email, IP), commercial information (subscription, billing records), internet activity (usage metrics, error logs), professional information (workspace, role). Sources: directly from you, from your use of the Service, and from Stripe for billing data when keys are live. We do not sell or share PI as those terms are defined under CCPA/CPRA.

4. Your rights under CCPA/CPRA (California)

If you are a California resident, you have the right to:

• Know what PI we hold about you and how we use it;
• Delete your PI, subject to legal-retention exceptions;
• Correct inaccurate PI;
• Opt-out of sale or sharing — N/A, we don't do either;
• Limit the use of sensitive PI — N/A, we don't process sensitive PI;
• Non-discrimination for exercising your rights.

To exercise rights, email privacy@intramedial.com from the address on your account.

5. Your rights under GDPR (EU / UK / EEA)

If you are in the EU, UK, or EEA, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with your local data protection authority.

Lawful bases we rely on: performance of the contract (Art. 6(1)(b)), our legitimate interest in operating the Service securely (Art. 6(1)(f)), compliance with legal obligations (Art. 6(1)(c)), and your consent for non-essential analytics (Art. 6(1)(a)) which you can withdraw at any time.

6. Where we store data

Your records and content reside with Cloudflare (Workers, D1, R2, KV, Durable Objects, Queues, Vectorize, Workflows, Workers AI) in the region selected for the workspace. AWS Object Lock witness, Stripe, and Resend are not processing customer data on this fleet yet — see [/.well-known/sub-processors.json](/.well-known/sub-processors.json).

International transfers. Where personal data of EU/UK individuals is processed by US sub-processors, transfers rely on the EU Standard Contractual Clauses with additional technical and organizational measures.

7. Sub-processors

See [/.well-known/sub-processors.json](/.well-known/sub-processors.json). We notify customers of changes [notice period] in advance.

8. Retention

[State the retention period for each category: account data, support tickets, workspace records per plan, and billing records.]

9. Cookies

We use one essential cookie for authentication. We do not use advertising cookies.

10. Security

We protect personal information with technical and organizational measures appropriate to the risk: encryption in transit and at rest, workspace-scoped access tokens, append-only hash-linked records where enabled, least-privilege access. See [/security](/security).

11. Changes

We may update this Policy. Material changes will be notified by email to the account owner [notice period] before taking effect.

12. Contact

privacy@intramedial.com · [Operating company legal name] · [Jurisdiction].

Acceptable Use Policy (AUP)

Version 2026-07-31 · binding on all plans · template document.

This policy applies to every use of Intramedial, by you and by any agent, automation or person acting on your account. Breach is grounds for suspension under section 15 of the Terms of Service.

1. Prohibited AI practices

You may not use Intramedial, or any output of Intramedial, in connection with a practice prohibited by Article 5 of Regulation (EU) 2024/1689. That includes:

• subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour so as to cause significant harm;
• exploiting vulnerabilities of age, disability, or a specific social or economic situation;
• social scoring — evaluating or classifying natural persons in ways that lead to detrimental treatment in unrelated contexts, or treatment that is unjustified or disproportionate;
• predicting the risk that a person will commit a criminal offence, based solely on profiling or on personality traits;
• untargeted scraping of facial images to build or expand facial-recognition databases;
• inferring emotions in the workplace or in education, other than for medical or safety reasons;
• biometric categorisation to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;
• real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes.

This clause is not boilerplate imported from the Regulation for appearance. It is here because Article 5 has applied since 2 February 2025, it binds you whatever we write, and because we hold the same line ourselves — our own Article 5 screening is published in the EU AI Act Role Declaration.

2. Integrity of disclosure and marking

Intramedial exists to make AI interaction and provenance provable. You may not use it to do the opposite. Specifically, you may not:

• remove, alter, forge, suppress or conceal a content provenance marker, an AI-disclosure label, or an Intramedial receipt or signature;
• present an Intramedial artifact as attesting to something it does not attest to, or represent an unverified artifact as verified;
• use the Service to help a third party do either of the above.

Intramedial ships no capability that removes a content marker.

3. Lawful use

• You may not use the Service to violate applicable law, or the rights of any third party.
• You are responsible for having a lawful basis for the data you bring into your workspace, and for the AI systems you point Intramedial at.
• You may not use the Service to process personal data of a category, or in a manner, that your own agreements with your data subjects do not permit.

4. Security

• No attempt to access another workspace, another customer's data, or Intramedial infrastructure beyond your entitlement.
• No circumvention of quota, metering, tier gating or authentication.
• No sharing of workspace credentials or API keys outside your organisation.
• Security research is welcome under the Responsible Disclosure Policy at [/security/disclosure](/security/disclosure).

5. Agents and automation

• Agents acting on your account act as you, and you are responsible for what they do.
• You may not operate agents through Intramedial that themselves breach this policy, third-party rights or applicable privacy law.
• Automated use must stay within your published plan limits unless we have agreed an exception in writing.

6. Competitive use

You may not reverse engineer the Service for the purpose of building a competing product. Benchmarking for your own evaluation is permitted, and you may publish the results.

7. Enforcement

We investigate before we act, and we tell you what we found. Where a breach is ongoing and causing harm we may suspend first and explain immediately after. Suspension for breach of section 1 or section 2 is not subject to a cure period.

Report a suspected breach: legal@intramedial.com

AI Act Value-Chain Agreement

Article 25(4), Regulation (EU) 2024/1689

the platform operator ("Intramedial", "we") and the customer accepting these terms ("you") agree as follows.

1. Why this agreement exists

Article 25(4) of Regulation (EU) 2024/1689 requires that where a third party supplies an AI system, tools, services, components or processes that are used or integrated in a high-risk AI system, that third party and the provider of the high-risk system must, by written agreement, specify the information, capabilities, technical access and other assistance — based on the generally acknowledged state of the art — needed for the provider to comply with the Regulation.

If you integrate any part of Intramedial into an AI system that is high-risk under Article 6, you are that provider and we are that third party. This agreement is the written agreement Article 25(4) requires.

We offer it to every customer, not only those who tell us their system is high-risk. We cannot see your classification, and an obligation we owe should not depend on us guessing correctly.

2. What we supply

Intramedial supplies runtime components, evidence-generating services and programmable interfaces. We do not supply a general-purpose AI model, and we do not train models on your data.

3. Information we will provide

On written request to legal@intramedial.com, and without additional charge, we will provide:

(a) a description of the intended purpose, capabilities and known limitations of each Intramedial component you have integrated; (b) the technical documentation of interfaces, data formats and the meaning of each output field, sufficient for you to interpret our outputs correctly in your own conformity assessment; (c) the accuracy characteristics and known failure modes of any classification or detection component you rely on, including the conditions under which it is designed to fail closed; (d) a description of the logging and record-keeping our components perform, the fields recorded, and the retention applied; (e) the cybersecurity measures relevant to the integrated component; (f) notice of any change to a supplied component that could reasonably affect your compliance, before that change takes effect, other than a change made to remediate an active security incident — which we will notify as soon as it is safe to do so.

4. Technical access

We will provide the technical access needed for you to exercise oversight over the integrated component: programmatic retrieval of the records our components generate about your workspace, the ability to reproduce a decision from its recorded inputs where the component is deterministic, and export of that material in a machine-readable format.

Where an Intramedial component emits signed evidence, we will provide the means to verify those signatures independently of Intramedial, including after termination.

5. Assistance

We will provide reasonable assistance to you and, at your direction, to a notified body, market surveillance authority or auditor acting in relation to your system, including responding to documented technical questions about the supplied component.

We will not, and cannot, perform your conformity assessment, sign your declaration of conformity, or determine the risk classification of your system. Those are the provider's own acts.

6. What this agreement does not do

This agreement does not make Intramedial the provider of your AI system, and it does not transfer any obligation of yours to us. It does not alter the roles either party holds under the Regulation. If your use of an Intramedial component puts our name or trade mark on a high-risk AI system, or substantially modifies one, Article 25(1) may apply on its own terms and neither party can contract out of it.

7. Duration and survival

This agreement runs for as long as you use any Intramedial component in your AI system, and Sections 3 and 4 survive termination for the period you are required to retain documentation under the Regulation.

8. Relationship to the other terms

This agreement supplements the Terms of Service and the Data Processing Addendum. Where it conflicts with them on a matter Article 25(4) governs, this agreement prevails.

9. Contact

legal@intramedial.com — mark the subject line "Article 25(4) request". We aim to respond substantively within 15 working days.

AI System Transparency Notice

Articles 50(1), 50(2) and 50(5), Regulation (EU) 2024/1689

This notice describes the AI systems the platform operator operates in the Intramedial service, and how we meet the transparency duties that apply to them. It concerns our own systems. It is not advice about yours.

1. You are interacting with an AI system

Number One is an AI system. When you use it, you are interacting with a machine, not a person.

It says so itself, before you exchange anything with it: the disclosure sits above the conversation, on every visit, in the clear and distinguishable manner Article 50(5) requires. It is not dismissible — a notice you cleared weeks ago informs nobody at the interaction it is meant to cover — and it is shown in your own language, carrying who operates the system and on whose instructions it acts.

Number One can answer questions about your workspace, look records up deterministically, and — where you grant it permission — carry out actions in your workspace on your instruction. It is not a compliance determination, a legal conclusion or an audit sign-off, and it is designed to refuse rather than guess.

2. Machine-readable marking of generated text

Where Number One's answer is composed by a language model, that output is marked in a machine-readable format and is detectable as artificially generated, as Article 50(2) requires. The marking is applied:

- in the JSON response envelope and in HTTP response headers on the API; - as an in-band event on the streaming interface, delivered with the first token of generated text; - on the stored message, so a later read or export of the conversation carries the same marking rather than re-deriving it.

The marker carries the IPTC digital source type trainedAlgorithmicMedia — the identifier used by C2PA and the wider content provenance ecosystem — so any consumer that already understands content credentials understands ours.

Where the marking does not reach. If you select text in the interface with your mouse and paste it into another document, the marking does not travel with it. Carrying it would require embedding an invisible watermark in the prose itself. Any reformatting removes such a watermark, it corrupts text you may put in front of a regulator, and a hidden channel is the wrong thing to add to a product whose value is that nothing is hidden. Article 50(2) requires marking that is effective and robust as far as technically feasible; this is the edge of that, and we would rather state it than let you assume otherwise.

We do not over-mark. Fixed text — a refusal, a quota notice, an error, a plan description — is written by people and selected by a program. It is not marked as artificially generated, because it is not. Every response carries an explicit origin so you can tell the difference rather than infer it.

3. Our own published material

Where we publish text on this site that was generated or materially assisted by an AI system and concerns a matter of public interest, we disclose that on the page, as the second subparagraph of Article 50(4) requires.

4. Our role

the platform operator declares itself both provider and deployer of the AI systems it operates in Intramedial, and discharges both duty sets. Our full role declaration, the per-system risk screening and the resulting obligations are published in the EU AI Act Role Declaration section of this page.

5. Contact

legal@intramedial.com

AI Literacy Statement

Article 4, Regulation (EU) 2024/1689 (as replaced by Regulation (EU) 2026/1744)

Article 4 requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. It has applied since 2 February 2025.

The replaced text does not require guaranteeing any specific level of literacy for any individual. It requires measures. This statement records ours.

Measures in place

1. Role declaration. Every person building on the platform works against a published, tested declaration of which of our systems are AI systems, at what risk tier, and what each one owes. It is code, not a memo, so it does not drift from the product.

2. Determinations are written down and challenged. Classification decisions are recorded with the provision relied on and the basis, and are reviewed adversarially — specifically for readings that are convenient to us. Where a reading is not settled, the record says so.

3. Two arguments are banned. "It doesn't learn, so it isn't an AI system" and "it's deterministic, so it isn't an AI system" are both legally worthless — Article 3(1)'s adaptiveness element is permissive, and Recital 12 names logic- and knowledge-based approaches. Neither may appear in any determination, and a test enforces it.

4. Legal basis travels with the evidence. Every compliance artifact the platform emits carries the interpretation profile it was produced under, and marks any claim resting on non-binding guidance as such. Nobody working here can mistake guidance for statute, because the artifacts do not let them.

5. Gates where classification could change silently. Where connecting a model would change a product's status under the Act, the code path is closed behind a gate that states the regulatory consequence and the steps required before it opens.

6. Customer-facing literacy. Number One's interface states what it is, what it will not do, and when an answer is illustrative rather than determinative. Literacy is not only an internal duty.

Review

This statement is reviewed when the role declaration changes, and at least annually. Questions: legal@intramedial.com

1. The declaration

the platform operator declares itself both a provider and a deployer of the AI systems it operates in Intramedial, within the meaning of Article 3(3) and Article 3(4) of Regulation (EU) 2024/1689, and discharges both sets of obligations. Declared role: provider+deployer.

2. Establishment

the platform operator is a Delaware, United States company with no establishment, branch or subsidiary in the Union. Art. 2(1)(a) and Art. 2(1)(c) still reach us.

No system currently screens high-risk or undetermined, so Article 22 authorised-representative is not required on these facts.

3. Per-system determination

4. Article 5 screening

5. Attaching duties

Open (undischarged) duties — honest, not hidden:

• Art. 50(4) 2nd subpara — Deployers publishing AI-generated or AI-manipulated TEXT to inform the public on matters of public interest must disclose that it is artificially generated. This reaches OUR OWN published output, not a customer's.

The full DPA template lives on the OpenNext marketing hub. Live processors on this fleet are listed at /.well-known/sub-processors.json. AWS Object Lock witness, Stripe, and Resend are omitted until they process customer data.

Machine-readable inventory: /.well-known/sub-processors.json. Cloudflare is the only live processor today.

No SLA is published on this fleet. Do not treat an unpublished uptime target as a contractual figure.

This origin sets an essential authentication cookie. It ships no advertising or third-party tracking cookies.

No US Copyright Office designation of agent is published on this fleet. Notices: security@intramedial.com.

[Operating company legal name] · [Entity type] · [Registered jurisdiction]. Product brand: Intramedial.

• Support: support@intramedial.com
• Security: security@intramedial.com
• Legal / privacy: security@intramedial.com until a dedicated mailbox is live

EU Article 27 representative: not appointed. EU/UK data subjects may contact security@intramedial.com.