Terms of Service

Last updated: [DATE]

These Terms are an agreement between [COMPANY LEGAL NAME], Commercial Registration [NUMBER] ("Ehkam", "we", "us"), and the organisation that subscribes to Ehkam ("Customer", "you"). Section 3 sets out what the person who accepts them confirms.

1. Definitions

Service: the Ehkam platform, its websites, mobile apps, APIs and related support.
Workspace: the Customer's own space in the Service, including its address on ehkam.net or a custom domain.
Users: the people the Customer invites or allows to use its Workspace.
Customer Data: everything the Customer or its Users put into the Service. This includes records, forms, files and comments, and submissions the Customer collects through public forms.
Packs: ready-made sets of resources, workflows and settings available in the Ehkam marketplace.
Order: the plan, quantities and price the Customer selects in the Service or agrees with us in writing.
Agent: any software, script, integration or automated tool that uses the Service on the Customer's behalf, including through our API.
Credentials: passwords, sign-in tokens, API keys and any other secret used to reach the Service.
DPA: our Data Processing Addendum, which forms part of these Terms [PLACEHOLDER: where the DPA is published, or how a Customer signs it].

2. The Service

We provide the Service described in the Customer's Order, under these Terms.

We may improve and change the Service over time. If we remove a feature that is material to a paid plan, we will give reasonable notice.
Some features, such as machine translation or AI-assisted search, use third-party providers and are off until the Customer turns them on.

3. Accounts, Users and your representations

The Customer is responsible for its Users and everything done under its Workspace. It decides who has access and with which roles.
Users must keep their sign-in details confidential, and tell us promptly at support@ehkam.net about any unauthorised access.
The Customer may enforce two-factor authentication and other security settings for its Users, and should use them.
Users must be at least [18] years old.

The person who accepts these Terms confirms that:

they have authority to bind the Customer, and accept these Terms for it;
they are at least [18] years old and have legal capacity to enter into a contract;
the details given to us at sign-up and in the Order are accurate, and the Customer will keep them up to date;
the Customer is using the Service for its business, not as a consumer.

4. Trials, plans and payment

Trials: a free trial lasts [14] days unless the Order says otherwise. When it ends, the Workspace continues only on a paid plan or a free plan, if one is offered.
Fees:
- Fees are as shown in the Order, in [SAR], and exclude VAT and other taxes, which the Customer pays.
- Payments are processed by Stripe.
Automatic renewal:
- A paid subscription renews automatically at the end of each billing period (monthly unless the Order says otherwise) for another period of the same length, and the fee for that period is charged to the payment method on file.
- [PLACEHOLDER: for annual or other long terms, how many days before renewal we send a reminder, if any]
Cancellation timing:
- The Customer may cancel at any time in the Service's billing settings or by writing to us.
- Cancellation stops the next renewal. The Workspace keeps its paid features until the end of the period already paid for.
- To avoid the next charge, the Customer must cancel before the renewal date [PLACEHOLDER: confirm "any time before the renewal date" (the code default), or set a minimum notice period].
Plan changes: if the Customer moves to a different plan during a billing period, the difference is prorated and shown on the next invoice.
Price changes: we may change our prices. A new price applies from the Customer's next renewal after we give at least [PLACEHOLDER: N days] notice by email or in the Service. If the Customer does not accept the new price, it may cancel before that renewal.
Plan limits: plans may limit users, storage and features. If the Customer exceeds a limit, we may ask it to upgrade or reduce usage.
Late payment: we may suspend paid features after [a grace period of N days] and written notice.
Refunds:
- Fees already paid are not refunded, in whole or in part, when the Customer cancels, downgrades, or stops using the Service before the end of a billing period.
- Exceptions: where the law requires a refund; where we terminate under section 18 for a reason other than the Customer's breach, in which case we refund the unused part of any prepaid fees; and [PLACEHOLDER: any other refund commitment, for example a money-back period on a first annual plan].
- Approved refunds go back to the original payment method.

5. Customer Data

Ownership: the Customer owns its Customer Data. It gives us the rights needed to host, process, transmit and display that data only to provide and support the Service, keep it secure, and comply with the law.
No other use: we do not sell Customer Data, use it for advertising, or use it to train AI models.
AI features (applies when AI features ship): if we offer features that use AI models to generate content or take actions, we will not use Customer Data to train general-purpose models, ours or a provider's, without the Customer's prior agreement. [PLACEHOLDER: counsel to confirm this commitment and how agreement is given]
Data protection:
- For personal data in Customer Data, the Customer is the controller and Ehkam processes it on the Customer's instructions.
- The DPA, our Privacy Policy and our Cookie Policy apply.
- The Customer is responsible for having a lawful basis for the personal data it collects and for giving people the notices the law requires.
Public forms:
- If the Customer publishes a public intake form or tracking link, it is responsible for the form's content and for what it collects.
- It must show its own privacy notice to the people who submit.
- It must not use forms to collect special categories of data, such as health, biometric or financial data, unless the law allows it and it has the required safeguards.
Export: the Customer can export its Customer Data at any time while its subscription is active, using the export tools in the Service.
Deletion:
- When the Customer closes its Workspace, we permanently delete its Customer Data 72 hours after the request.
- Exceptions: records we must keep by law, and audit records kept for [PERIOD] for accountability.
- Backups are overwritten on their normal cycle.

6. Acceptable use

The Customer and its Users must not:

break any law or infringe anyone's rights, or use the Service to store or send unlawful, harmful or deceptive content;
try to access another Workspace, probe or bypass security, or interfere with the Service or other customers;
send spam or unsolicited messages through the Service's email, SMS, or notification features;
reverse-engineer the Service, except where the law allows it despite this restriction;
resell or provide the Service to third parties, except as the Order allows;
use the Service to build a competing product;
upload malware, or overload the Service with automated requests beyond documented limits.

We may suspend access that breaches this section, or that puts the Service, other customers, or third parties at risk. Where reasonable, we will tell the Customer first and give it a chance to fix the problem.

7. API access and Agents

Same permissions as a person: a request through the API, or from an Agent, acts with the permissions of the User or Credential that authorised it, and no more. The Service checks those permissions on every request, as it does for a person, and records changes in the audit trail.
The Customer is responsible for its Agents: everything an Agent does with the Customer's Credentials is treated as done by the Customer. The Customer is responsible for choosing, configuring and supervising its Agents, and for reviewing what they do before relying on it.
Rate limits: we apply rate and usage limits to protect the Service. A request over a limit may be slowed or refused. [PLACEHOLDER: where the current limits are documented]
Credentials: the Customer must keep Credentials confidential, give each Agent only the access it needs, and revoke a Credential promptly if it may have been exposed. We may revoke a Credential that we reasonably believe is compromised or being misused, and will tell the Customer when we do.
Changes: we may change or retire API endpoints. Where a change would break an integration in use, we will give reasonable notice where practical.

8. Marketplace Packs

Packs install resources, workflows, and settings into the Workspace.
Once installed, their content becomes part of the Customer's configuration, and the Customer may change it.
A Pack's description is a summary; the Customer should review a Pack before relying on it for any regulated or critical process.
Packs from third parties, if offered, may carry their own terms, shown before installation.

9. Third-party services and links

The Service connects with third-party services, such as email and SMS delivery, payment processing, mapping, and, if the Customer enables them, translation and AI providers. Their availability is outside our control. We are not responsible for a third-party service the Customer chooses to connect, beyond our own obligations under these Terms.
The Service, our websites and Customer content may contain links to websites we do not run. We do not control or endorse them and are not responsible for their content or their privacy practices. Visiting them is at the visitor's own choice, under those sites' own terms.

10. Our intellectual property

We and our licensors own the Service, including its software, design, and documentation. Subject to these Terms and payment of fees, we give the Customer a non-exclusive, non-transferable right to use the Service for its internal business purposes during its subscription.
Feedback the Customer gives us may be used to improve the Service, with no obligation to the Customer.
Testimonials (optional clause, for use only if we publish customer testimonials): we will name the Customer, quote it, or use its logo in our marketing only with its prior written permission, which it may withdraw for future use at any time. [PLACEHOLDER: keep or remove. The site publishes no testimonials today.]

11. Copyright and intellectual property complaints

If you believe content in the Service infringes your copyright or other intellectual property rights, send a notice to [PLACEHOLDER: IP notice address, for example legal@ehkam.net] that includes:

your name and contact details, and your authority to act for the rights holder if you are not the rights holder;
a description of the work or right you say is infringed;
where the content is, with enough detail for us to find it (for example, the link);
a statement that you believe in good faith the use is not authorised, and that the information in your notice is accurate.

Because Customer Data belongs to our customers, we will usually pass the notice to the Customer concerned and ask it to respond. We may remove or disable access to content that we reasonably believe infringes, and will tell the Customer when we do. A Customer that believes content was removed by mistake may reply with its explanation, and we will review it. We may close the accounts of repeat infringers. Nothing in this section limits any procedure the law of the Kingdom provides.

12. Confidentiality

Each party will:

keep the other's non-public information confidential;
use it only to perform under these Terms;
protect it with at least reasonable care.

This does not apply to information that is public, was already known, is independently developed, or must be disclosed by law. Where the law allows, the party disclosing will give notice before doing so.

13. Security and availability

We maintain reasonable technical and organisational measures to protect the Service and Customer Data, as described in our Privacy Policy and the DPA.
We aim to keep the Service available, but do not guarantee uninterrupted or error-free operation. Planned maintenance will be announced where practical.
If a security breach affects Customer Data, we will notify the Customer without undue delay and help it meet its own obligations, as the DPA sets out.

14. The Customer's compliance with law

The Customer is responsible for running its own business lawfully, including the processes, records, approvals and decisions it manages in the Service.
The Customer must comply with the laws that apply to its use of the Service, including the Personal Data Protection Law, rules on commercial and electronic messages, consumer and employment law, and any licensing or sector rules that apply to it.
The Service is a tool. Configuring it, installing a Pack, or following a workflow in it does not by itself make the Customer compliant with any law or standard, and we do not give legal, regulatory, tax or accounting advice.

15. Warranties and disclaimers

We will provide the Service with reasonable skill and care, and substantially as described in its documentation.
Except as stated in these Terms, the Service is provided "as is", to the extent the law allows.
The Customer is responsible for the decisions it makes using the Service, including decisions based on reports, scores, workflow outcomes, translations, or AI-generated suggestions.
Results vary: we do not promise any particular business result from using the Service, such as savings, revenue, efficiency, audit outcomes or certification. Results depend on how the Customer configures and uses the Service, on its own data and people, and on matters outside our control. Examples, demos, Pack descriptions and marketing material illustrate what the Service can do; they are not a promise of what it will achieve for the Customer.

16. Limitation of liability

To the extent the law allows:

neither party is liable for indirect, incidental, special, or consequential losses, or for lost profits, revenue, or data;
each party's total liability under these Terms is capped at the fees the Customer paid for the Service in the 12 months before the event giving rise to the claim [PLACEHOLDER: confirm the cap, or set a fixed minimum amount for customers on the free plan, who pay nothing].

These limits do not apply to the Customer's payment obligations, to breach of section 6, or to liability that cannot be limited by law.

17. Indemnity

The Customer will defend and indemnify Ehkam against third-party claims arising from Customer Data, from its Agents' actions, or from the Customer's or its Users' breach of section 6, section 14 or data protection law.

We will defend and indemnify the Customer against third-party claims that the Service, as we provide it, infringes their intellectual property rights.

18. Term, suspension, and termination

These Terms apply from acceptance until the subscription ends.
Either party may terminate for material breach not remedied within 30 days of written notice.
The Customer may cancel at any time; cancellation takes effect at the end of the paid term, as section 4 explains.
We may end a free plan, or stop offering the Service, with at least [PLACEHOLDER: N days] notice.
After termination, the Customer's access ends. It may export its Customer Data for [30] days, unless it asked for immediate deletion. After that, we delete it as described in section 5.

19. Changes to these Terms

We may update these Terms. We will tell the Customer of material changes at least [30] days before they take effect, by email or in the Service. If the Customer does not agree, it may cancel before the change takes effect. Continuing to use the Service after that means acceptance.

20. Governing law and disputes

These Terms are governed by the laws of the Kingdom of Saudi Arabia.
The parties will first try in good faith to resolve any dispute, starting with a written notice describing it, for at least [PLACEHOLDER: N days].
Failing that: [PLACEHOLDER: counsel to choose one]
- Option A, courts: the competent courts of [CITY] have exclusive jurisdiction.
- Option B, arbitration: the dispute is finally resolved by arbitration administered by the Saudi Center for Commercial Arbitration (SCCA) under its rules, seated in [CITY], before [one / three] arbitrator(s), in [Arabic].
Either party may ask a competent court for urgent interim measures, such as an order to protect confidential information or intellectual property, whichever option applies.

21. Electronic communications and signature

The Customer agrees to receive notices, invoices and other communications from us electronically, by email to its account owner or in the Service. Communications given that way satisfy any requirement that they be in writing.
Accepting these Terms or an Order electronically, for example by clicking to accept, signing up, or placing an Order in the Service, has the same effect as a handwritten signature, as the Electronic Transactions Law of the Kingdom allows [PLACEHOLDER: counsel to confirm the reference].
Our electronic records of acceptance, orders and notices are evidence of them.

22. General

Language: these Terms are offered in Arabic and English. If they differ, the [Arabic] version prevails [PLACEHOLDER: counsel to confirm; proposed: Arabic prevails for customers in the Kingdom].
Assignment:
- The Customer may not assign or transfer these Terms without our prior written consent.
- We may assign them to an affiliate, or to a successor in a merger, reorganisation or sale of all or most of our business or assets, by giving the Customer notice. The successor takes on our obligations.
Force majeure: neither party is responsible for a delay or failure to perform caused by events beyond its reasonable control, such as natural disasters, epidemics, war, civil unrest, government action, or failures of utilities, telecommunications or hosting providers that are not caused by that party. The affected party will tell the other promptly and resume as soon as it reasonably can. This does not excuse payment of fees for the Service already provided.
Severability: if a court or tribunal finds any part of these Terms invalid or unenforceable, that part is limited to the minimum extent needed, and the rest of the Terms continues in full force.
No waiver: a party that does not enforce a right, or delays doing so, has not waived it. A waiver is effective only in writing.
Entire agreement: these Terms, the Order, the DPA, the Privacy Policy and the Cookie Policy are the entire agreement between the parties about the Service, and replace any earlier proposals, statements or understandings about it. If they conflict, the Order prevails, then the DPA (for personal data), then these Terms.
Survival: sections that by their nature should continue after termination do so, including sections 4 (unpaid fees), 5 (deletion), 10, 12, 15, 16, 17, 20, 21 and this section.
Notices: to us at [legal@ehkam.net] and [ADDRESS]; to the Customer at the email of its account owner.

Contact

[COMPANY LEGAL NAME], [ADDRESS], Kingdom of Saudi Arabia. support@ehkam.net