Terms of Use

Section 1 Scope

These Terms of Use (hereinafter the “Terms”) apply to all agreements on the use of the Smartwebchat platform concluded between

Mark Heinsohn
Osterdeich 34
28203 Bremen
Email: info@smartwebchat.eu

(hereinafter "Smartwebchat" or "Provider") and the customer (hereinafter "Customer") regarding the use of the Smartwebchat SaaS platform. Deviating terms of the Customer shall not apply unless Smartwebchat expressly agrees to their validity in writing.

These Terms do not govern the purchase agreement for a paid subscription. That agreement is concluded exclusively between the Customer and Digistore24 GmbH (Hanover, Germany), which sells the subscriptions in its own name and for its own account as a reseller (merchant of record). Price, payment, invoicing, VAT and any right of withdrawal are governed exclusively by the terms and conditions of Digistore24 GmbH. Details are set out in Sections 3, 5 and 6.

Smartwebchat is addressed exclusively to businesses within the meaning of Section 14 of the German Civil Code (BGB), i.e. to natural or legal persons who, when concluding the contract, act in the exercise of their commercial or self-employed professional activity. By registering, the Customer expressly confirms that they are acting in that capacity. Contracts with consumers within the meaning of Section 13 BGB are not envisaged.

Section 2 Subject Matter of the Agreement

Smartwebchat is a Software-as-a-Service (SaaS) platform that enables customers to create, configure, and embed individual AI-powered chat assistants (hereinafter "Assistants") for their business on their own website.

Access to the platform is provided via the web-based dashboard at smartwebchat.eu as well as via a chat widget code (embed code) embedded by the Customer on third-party websites. Smartwebchat provides the necessary infrastructure, the AI processing capacity, and the dashboard as a service.

Smartwebchat is not the manufacturer of the underlying AI language models. Text generation is provided by third-party providers: by default via Mistral (processing in the EU); optionally, premium providers (OpenAI, Anthropic — processing in the USA, safeguarded by EU Standard Contractual Clauses) can be selected per Assistant. Smartwebchat is obligated to provide the platform, not a specific outcome of individual AI responses.

Section 3 Formation of Contract and Contracting Parties

The usage agreement between the Customer and Smartwebchat is formed when the Customer registers at smartwebchat.eu and expressly accepts these Terms during the registration process. Registration is free of charge.

The purchase agreement for a paid subscription is not formed with Smartwebchat but with Digistore24 GmbH (Hanover, Germany). Digistore24 purchases the service from Smartwebchat and resells it to the Customer in its own name and for its own account. Digistore24 is therefore the Customer's legal counterparty under the purchase agreement, issues the invoice and remits value added tax. In this respect, the terms and conditions of Digistore24 GmbH apply exclusively; they are displayed to the Customer during the order process.

After a 14-day free trial period, continued access requires a paid subscription. The Customer selects a plan at smartwebchat.eu and is forwarded to the Digistore24 order process; the purchase agreement is formed upon its completion pursuant to paragraph 2. The usage agreement under paragraph 1 continues to exist independently of this.

By way of derogation from paragraph 3, the following applies to organisations that Smartwebchat has admitted to its support programme for non-profit organisations after reviewing official proof of charitable status: use to the extent of the “Single Customer” plan is free of charge for at least twelve months from activation; to that extent, continued access is not conditional on a paid subscription. There is no automatic renewal. Smartwebchat will decide anew on any further support period after the twelve months have elapsed; there is no entitlement to admission or renewal.

Smartwebchat stores the text of these Terms; the Customer may retrieve it at any time at smartwebchat.eu/en/terms. Digistore24 is responsible for storing and providing the text of the purchase agreement.

Section 4 Services

Smartwebchat offers the following subscription plans. The fees follow from the price list in force at the time at smartwebchat.eu/en/pricing; decisive for the purchase agreement are the prices displayed during the Digistore24 order process (Section 5).

Free Trial (14 Days)

• Up to 5,000 messages/month (standard model)
• 1 Assistant
• GDPR-compliant hosting in Germany
• Duration: 14 days; a paid plan must be selected afterward

Single Customer

• 1 Assistant (fixed; additional assistants require the Agency plan)
• Up to 5,000 messages/month included (standard model); additional messages are billed per token according to the price list in force at the time
• Premium models optional, billed on usage (separate credit balance)
• Knowledge base & RAG, analytics, own branding
• GDPR-compliant hosting in Germany

Agency

• 15 assistants included; additional assistants are subject to a charge according to the price list in force at the time
• Up to 25,000 messages/month included (standard model: Mistral Small, EU hosting; quota pooled across all assistants); additional messages are billed per token according to the price list in force at the time. Premium models (e.g. GPT-4o, Claude) and embedding requests consume the included quota faster (higher token rate); beyond that, the same excess-usage rate applies.
• Central multi-tenant dashboard, own knowledge base per client
• API & webhooks, priority support
• GDPR compliance & sub-processing for healthcare clients on request

White Label — on request

• Scope of the Agency plan without Smartwebchat branding
• Terms individually agreed; inquiries via info@smartwebchat.eu

Smartwebchat reserves the right to adjust the scope of services of the individual plans. Material changes will be announced to the Customer pursuant to Section 12 of these Terms.

Section 5 Prices, Payment and Invoicing

The prices stated at smartwebchat.eu are in euros (€) plus statutory value added tax and are addressed to businesses. Decisive for the purchase agreement are the prices and tax details displayed during the Digistore24 order process.

Billing takes place monthly or annually in advance, depending on the billing period selected. Digistore24 GmbH is the seller, the issuer of the invoice and the party liable for value added tax; payment is made to Digistore24. The accepted means of payment depend on its offering (including credit card, SEPA direct debit, PayPal); the available payment mix may change.

Dunning and collection are the responsibility of Digistore24. If a due payment fails to arrive and Digistore24 notifies Smartwebchat accordingly, Smartwebchat is entitled to temporarily suspend access to the platform after prior notice and a reasonable grace period.

Smartwebchat may change the fees for future billing periods. Any change is announced to the customer in text form at least 30 days before it takes effect and applies at the earliest from the next billing period. The customer may terminate the agreement under Section 6 until the change takes effect; for periods already paid for, the agreed fee remains unaffected.

Section 6 Term and Termination

Paid subscriptions run for an indefinite period. The Customer may terminate them at any time with a notice period of no more than two months; this also applies to annual billing (Section 11). Termination is effected via the dashboard or by email to info@smartwebchat.eu; Smartwebchat then arranges for billing at Digistore24 to end. Any refund of fees paid in advance for the unused remainder forms part of the purchase agreement and is handled by Digistore24 as the seller.

Smartwebchat may terminate the usage agreement without notice for cause, in particular in the event of serious breaches of these Terms by the Customer.

Right of withdrawal: Any statutory right of withdrawal exists vis-à-vis Digistore24 GmbH as the seller, not vis-à-vis Smartwebchat. Digistore24 provides information on the existence, conditions and exercise of the right of withdrawal during the order process, where the withdrawal instructions are also available. As the offer is addressed to businesses within the meaning of Section 14 BGB, a right of withdrawal generally does not exist.

Section 7 Obligations of the Customer

The Customer undertakes to

• use the platform exclusively for lawful purposes and in accordance with these Terms;
• not distribute content that violates applicable law, the rights of third parties, or public policy (in particular no unlawful, misleading, defamatory, or copyright-infringing content);
• not send spam messages or unsolicited bulk communications via the platform;
• operate its Assistant in a GDPR-compliant manner if personal data of third parties (e.g., end customers) is processed via the embedded chat. In this case, the Customer is the controller within the meaning of Art. 4 No. 7 GDPR and must independently ensure the lawfulness of the processing under data protection law;
• keep access credentials (password, API key) confidential and notify Smartwebchat immediately if unauthorized access is suspected.

Section 8 Availability

Smartwebchat aims for high availability of the platform (best-effort basis). A guaranteed minimum availability or a 24/7 SLA is not owed — in particular during the free trial period.

Planned maintenance work will, where possible, be carried out outside normal business hours and announced in advance. Unplanned outages due to force majeure, third-party attacks, or disruptions of upstream infrastructure (e.g., hosting provider, AI API) are not within Smartwebchat's area of responsibility.

Section 9 Liability

Smartwebchat is liable without limitation for intent and gross negligence, as well as for culpable injury to life, limb, or health.

In the case of simple negligence, Smartwebchat is only liable to the extent that a material contractual obligation (cardinal obligation) — one whose fulfillment is essential for the proper performance of the contract in the first place and on whose observance the Customer may regularly rely — is breached. In such cases, liability is limited to the typical, foreseeable damage at the time the contract was concluded.

Otherwise, liability for simple negligence is excluded. This limitation of liability does not apply to claims under the German Product Liability Act (Produkthaftungsgesetz) or other mandatory statutory provisions.

Smartwebchat assumes no liability for the accuracy, completeness, or timeliness of the responses generated by the AI. The Customer is solely responsible for the configuration of its Assistant and the information conveyed through it.

Section 10 Data Protection and Processing on Behalf

The processing of personal data in connection with the use of the Smartwebchat platform is governed by Smartwebchat's privacy policy, available at smartwebchat.eu/en/privacy.

Insofar as the Customer processes personal data of visitors to their own website via the embedded chat assistant, the Customer is the controller and Smartwebchat is the processor within the meaning of Art. 28 GDPR. The required data processing agreement forms Annex 1 to these Terms and is concluded upon their acceptance; no separate conclusion is required. The Customer may retrieve, print and save the text at any time at smartwebchat.eu/en/terms.

Section 11 Switching Providers, Data Export and Termination

The Customer may terminate the usage agreement with a notice period of no more than two months. Switching to another provider or to the Customer's own IT infrastructure requires no justification and must not be impeded by Smartwebchat.

Once the termination takes effect, a transition period of 30 calendar days applies, during which Smartwebchat maintains access to the Customer's data for the purpose of switching. At the Customer's request, the transition period may be extended by mutual agreement.

Smartwebchat provides the Customer's data in a structured, commonly used and machine-readable format (JSON). Assistant configurations, conversation histories, contact enquiries and bookings are available via the documented interface at smartwebchat.eu/api/v1 using the API key generated in the dashboard. Knowledge base content is provided by Smartwebchat on request during the transition period as a file in the same format.

Smartwebchat does not charge any fee for switching or for the data export. This provision implements Chapter VI of Regulation (EU) 2023/2854 (Data Act).

After the transition period has expired, Smartwebchat deletes the Customer's data in accordance with Annex 1, item 8.

Section 12 Amendments to the Terms

Smartwebchat reserves the right to amend these Terms with a notice period of at least 4 weeks. Notice is given by email to the address stored in the account and by a notice in the dashboard.

If the Customer does not object to the amended Terms within 4 weeks of receipt of the notice of amendment, they are deemed to have been accepted. Smartwebchat will expressly inform the Customer of this effect of silence in the notice of amendment. If the Customer objects, Smartwebchat is entitled to terminate the agreement by ordinary notice with effect from the date on which the new version takes effect.

Section 13 Jurisdiction and Governing Law

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). The choice-of-law and jurisdiction clauses of Digistore24 GmbH apply to the purchase agreement concluded with it.

For contracts with businesses (Section 14 BGB), the exclusive place of jurisdiction is the Provider's place of business: 28203 Bremen, Germany.

For consumers, the statutory place of jurisdiction applies; no restriction to a specific place of jurisdiction is imposed on consumers.

Section 14 Final Provisions

Should individual provisions of these Terms be or become invalid or unenforceable in whole or in part, the validity of the remaining provisions shall remain unaffected (severability clause). The statutory provision shall take the place of the invalid provision.

Amendments or additions to these Terms must be made in text form. This also applies to any waiver of this text form requirement.

Annex 1 — Data Processing Agreement (Art. 28 GDPR)

This annex forms part of these Terms and is concluded upon their acceptance between the Customer (hereinafter the “controller”) and Smartwebchat (hereinafter the “processor”). No separate conclusion is required; on request, Smartwebchat provides a signed copy in text form.

1. Subject matter, duration, nature and purpose of the processing. The subject matter is the operation of the Smartwebchat platform for the controller, in particular the operation of the chat assistant embedded by the controller, the storage of the controller's knowledge base and the generation of responses by means of AI language models. The sole purpose is the provision of the services described in Sections 2 and 4 of these Terms. Processing is automated and lasts for the term of the usage agreement, including the transition period under Section 11.

2. Types of data and categories of data subjects. The data processed comprises in particular chat inputs and conversation histories, contact details voluntarily provided (name, email address, telephone number), appointment and booking data, technical connection data and the knowledge base content uploaded by the controller. Data subjects are the controller's website visitors, prospects and customers, as well as the controller's employees insofar as they operate the platform.

3. Instructions. The processor processes personal data exclusively on documented instructions from the controller. Instructions are given through the controller's configuration in the dashboard and, in addition, in text form to privacy@smartwebchat.eu. If the processor considers an instruction to be unlawful under data protection law, it shall inform the controller without delay and may suspend its execution. Processing for the processor's own purposes, in particular for training AI models, does not take place.

4. Confidentiality. The processor uses only persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

5. Technical and organisational measures (Art. 32 GDPR). The processor maintains measures appropriate to the risk, in particular: transport encryption (TLS) for all connections; storage of credentials exclusively as a cryptographic hash; tenant-separated data storage with server-side verification of tenancy on every access; role-based access control with personal credentials; operation of the application, database and file storage in data centres within the Federal Republic of Germany, whereby backups may be replicated within the hosting provider's EU network zone; an automated deletion procedure for expired retention periods; and regular, encrypted backups with a documented restore test. The automated deletion procedure deletes conversation data — chat transcripts, ratings, conversation categories and triggered proactive triggers — 30 days after it arises, as it does the conversation extract, together with the stated handover reason, contained in a handover to a member of the controller's staff. Enquiries, appointment requests and handovers are deleted no later than the period the controller sets for each assistant in the dashboard; the default is 365 days. A handover in which, once the conversation extract has been cleared, neither a name nor an email address nor a processing note remains is deleted after 30 days. Security logs are deleted 30 days after they arise, and review-request dispatches together with the recipient address 90 days after their scheduled dispatch time, provided the dispatch has completed or failed. Processing by sub-processors is governed by item 6. The measures are subject to technical development; the processor may change them provided the level of protection is not reduced.

6. Sub-processors. The controller grants general authorisation for the use of the following sub-processors (Art. 28(2) GDPR):

• Hetzner Online GmbH, Gunzenhausen, Germany — hosting and data centre operations; processing in Germany.
• Mistral AI SAS, Paris, France — generation of chat responses and text embeddings; the default setting; processing within the EU.
• OpenAI, Inc., USA — only where a premium OpenAI model has expressly been selected for the assistant concerned; safeguarded by EU standard contractual clauses and, in addition, the EU-US Data Privacy Framework.
• Anthropic PBC, USA — only where a premium Anthropic model has expressly been selected for the assistant concerned; safeguarded by EU standard contractual clauses.
• Brevo GmbH, Berlin, Germany — dispatch of transactional and informational emails; processing within the EU.

The processor informs the controller in text form of intended changes to this list, giving four weeks' notice (Art. 28(2) sentence 2 GDPR). Within that period, the controller may object on important data protection grounds; if no agreement is reached, either party may terminate the usage agreement with effect from the date of the change. Every sub-processor is bound to a level of protection equivalent to that of this annex. Digistore24 GmbH is not a sub-processor; it acts as an independent controller within the scope of the purchase agreement.

6.1 The controller's own access keys. If the controller stores its own access key of the respective provider for a messaging channel (clause 6.4) or for a destination it has configured (clause 9), the contractual relationship with that provider exists between the controller and the provider. To that extent the provider is not a sub-processor of the processor, and the list in clause 6 does not apply to it. The controller concludes the contract required under Art. 28 GDPR itself and names the provider in its own privacy policy. This option does not exist for language models; responses are generated exclusively via the providers listed in clause 6.

6.2 Services expressly not covered. The following are not sub-processors: Digistore24 GmbH, Hanover — it acts as an independent controller within the purchase contract (Art. 6(1)(b) GDPR), as do its own service providers; Calendly, Inc. and Cal.com, Inc. — where the assistant offers appointment booking, it outputs a booking link which the data subject opens itself, and no data of the data subject is transmitted to those providers by the processor; and the providers of availability monitoring, source code management and deployment, because they have no access to personal data of data subjects.

6.3 Dormant integrations. The platform contains features that are not in operation, whose providers are therefore not sub-processors. Their activation by the processor requires a change to the list under clause 6 with four weeks' notice.

6.4 Channels using the controller's own provider key. The platform allows messaging channels to be connected — currently WhatsApp via a business solution provider established in the European Union. The controller enables the connection itself for each assistant and stores its own access key when doing so. clause 6.1 applies accordingly: the contractual relationship with the business solution provider and with the operator of the messaging service behind it exists between the controller and those companies. The controller concludes the required contracts itself and names both in its own privacy policy. For controllers under clause 8 the connection is blocked; this block is implemented technically.

7. Transfers to third countries. By default no transfer to a third country takes place; all processing under clause 6 occurs within the European Union. If the controller expressly selects a premium model of a provider processing in the United States for an assistant, the following applies: the transfer is safeguarded by the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR. For OpenAI, Inc. certification under the EU-US Data Privacy Framework applies in addition; Anthropic PBC is not certified under that framework, and the transfer there relies on the standard contractual clauses alone. The selection constitutes an instruction of the controller within the meaning of clause 3; the controller assesses on its own responsibility whether it is permissible for the data it processes. Controllers under clause 8 are prohibited from making that selection; this block is implemented technically.

8. Special categories of personal data and professional secrecy. If the controller belongs to a healthcare profession or is subject to a duty of confidentiality under § 203 of the German Criminal Code, the restrictions of Annex 3 apply in addition. In particular, it is prohibited from selecting language models and channels processing outside the European Union. The automatic classification based on the stored industry currently covers healthcare professions with a link to Art. 9 GDPR; it does not cover other professions bound by secrecy — in particular lawyers, notaries, tax advisers and auditors — where the controller's declaration under Annex 3 clause 1 alone applies. Irrespective of this, the assistant is configured not to ask for health data and to remove such data before forwarding it to notifications. The controller works towards ensuring that data subjects do not transmit data under Art. 9 GDPR via the assistant.

9. Destinations configured by the controller. The controller may configure destinations to which the processor transmits data: a Slack address to which, upon handover to a human, the name, the contact details, the reason, a pseudonymous session identifier and the last messages of the conversation verbatim are sent; a webhook address for forwarding enquiries with the same details; an identifier for a web analytics service, to which only event signals are sent; and a messaging channel using the controller's own provider key, to which clause 6.1 applies accordingly. The configuration is an instruction within the meaning of clause 3. The controller selects the destination and bears responsibility for its permissibility, including any transfer to a third country; the recipient is a processor of the controller, not of the processor. The controller names the recipient in its own privacy policy and has the required legal basis. The processor checks technically that the destination does not lie within an internal network range; no assessment of the destination's content or legality takes place. Only for the transmission to a web analytics service are exclusively pseudonymous identifiers, event names and event-related category details transmitted; message contents, names, email addresses and telephone numbers are not transmitted there. This does not apply to the other destinations under this clause — there the enquiry data is transmitted in full.

10. Assistance to the controller. The processor assists the controller, to the extent reasonable, in responding to requests from data subjects (Art. 12–23 GDPR), in ensuring the security of processing and in carrying out data protection impact assessments and prior consultations (Art. 35, 36 GDPR). If the processor becomes aware of a personal data breach, it shall inform the controller without undue delay, and no later than 48 hours after becoming aware of it, in text form, providing the information required under Art. 33(3) GDPR.

11. Deletion and return. After termination of the usage agreement and expiry of the transition period under Section 11, the processor deletes all personal data processed on behalf of the controller or returns it, at the controller's choice, unless a statutory retention obligation applies. The controller communicates its choice in text form before the transition period expires; without such notice, the data is deleted. Independently of this, the controller may export the data itself pursuant to Section 11 until the transition period expires. Deletion covers all copies; backups are overwritten as part of the regular backup cycle.

12. Evidence and audits. On request, the processor provides the controller with the information necessary to demonstrate compliance with this annex (Art. 28(3)(h) GDPR). On-site audits are permitted following reasonable prior notice, during normal business hours and without disrupting operations; the processor may substitute current evidence or certificates of its sub-processors where these suffice for the review.

14. Relationship to the Terms. In all other respects, these Terms apply. In the event of contradictions, this annex takes precedence in matters of data protection law. Liability is governed by Art. 82 GDPR and, in addition, by Section 9 of these Terms.