Terms of Service

Company details:

1. Name: Plumloom LLC
2. Address: 3654 Thornton Ave, Unit #702 Fremont, CA 94536
3. Website: https://plumloom.ai
4. Legal notices: legal@plumloom.ai • Support: support@plumloom.ai

1. Definitions

"Aggregated Data" means data derived from use of the Services that is de‑identified and combined so it cannot reasonably identify Customer, an Authorized User, or data subject.

"Applicable Data Protection Laws" means data‑protection, privacy, and security laws applicable to the Processing of Personal Data (e.g., GDPR, CCPA/CPRA).

"Authorized User" means Customer's personnel and contractors authorized to use the Services under Customer's account.

"Connected Account" means any third‑party system or model provider (e.g., OpenAI, Anthropic, Google) connected to the Services via integration or API.

"Customer Data" means data, prompts, test cases, inputs, configurations, datasets and other content submitted to or collected by the Services on Customer's behalf, excluding Service Data and Aggregated Data.

"Individual User" means a natural person who accesses or uses the Services for personal, non-commercial purposes and not on behalf of an entity or employer.

"Documentation" means Company‑provided user guides, SDK/API docs, and policies.

"Generic Tools/Validators" means Company's generalized validators, templates, patterns, workflows, prompts, code, and related know‑how used to evaluate or monitor LLM behavior across customers.

"Inputs" means information submitted to the Services for Processing (including validators/test definitions).

"Outputs" means results generated by the Services (e.g., scores, metrics, explanations, traces, dashboards, and reports).

"Personal Data" has the meaning given under Applicable Data Protection Laws.

"Processing" means any operation performed on Personal Data (collection, use, storage, disclosure, deletion, etc.).

"Service Data" means operational/telemetry data collected by Company (e.g., usage, performance, device/browser metadata) to operate and secure the Services.

"Services" means access to Company's LLM evaluation/observability platform and features described in an Order.

"Pricing Page" means Company's public pricing page at https://plumloom.ai/pricing (or successor URL) for self‑serve customers.

2. Access; Acceptable Use; Third‑Party Providers

2.1 Access License.

Subject to the Agreement and timely payment of Fees, Company grants Customer a non‑exclusive, non‑transferable right during the Order Term for Authorized Users to access and use the Services and Documentation solely for Customer's internal business purposes.

2.2 Accounts & Security.

Customer is responsible for configuration, use, and security of credentials and for its Authorized Users' compliance.

2.3 Acceptable Use.

Customer will not: (a) resell, sublicense, or provide service‑bureau access; (b) reverse engineer or bypass technical controls; (c) use the Services to build a competing product; (d) submit data that violates law or third‑party rights; or (e) interfere with or disrupt the Services.

2.4 Third‑Party Model Providers.

The Services may route Inputs/Outputs to third‑party providers (e.g., OpenAI, Anthropic, Google). Those providers process data under their own terms and privacy policies. Where such providers offer "no‑training"/"no‑retain" or similar controls, Company will enable those by default for Customer's workspace where commercially and technically feasible, and will disclose any exceptions. Company does not control and is not responsible for third‑party providers' handling; Customer may choose among supported providers subject to availability.

2.5 Individual Users; Consumer Rights.

Certain provisions of these Terms apply differently to Individual Users where required by applicable consumer protection laws. Nothing in this Agreement is intended to exclude, restrict, or modify any non-waivable statutory rights or remedies available to Individual Users under applicable law, including consumer protection laws in the United Kingdom, Australia, or similar jurisdictions.

To the maximum extent permitted by law, Individual Users acknowledge and agree that:

• (a) the Services are provided for informational and evaluation purposes only;
• (b) Outputs are probabilistic, may be inaccurate, incomplete, or misleading, and must not be relied upon for legal, medical, safety-critical, or other regulated decision-making; and
• (c) Company's liability to Individual Users is limited as set forth in this Agreement, subject to mandatory consumer law requirements.

3. Trials; Betas

3.1 Pilot Services.

Company may provide time‑limited trial or beta access ("Pilot Services"). Pilot Services are provided AS IS.

3.2 Conversion.

Trials expire unless Customer affirmatively purchases a paid plan or executes an Order before the end of the Pilot. No automatic conversion to paid will occur.

3.3 Trial Data.

Customer should export any needed data before a Pilot ends. Company may delete Pilot data after the Pilot unless otherwise agreed.

4. Data; Privacy; Security

4.1 Roles & DPA.

For Personal Data, Customer is the controller and Company the processor (or service provider). The DPA (Exhibit A) governs Processing and controls in any conflict on privacy/security topics.

4.2 Ownership; License to Provide Services.

As between the Parties, Customer owns Customer Data and Outputs. Customer grants Company a limited license to Process Customer Data and Outputs solely to (i) provide, maintain, secure, and support the Services; and (ii) perform internal analytics to maintain and improve the Services.

4.3 No Training by Company; Provider Policies.

Company will not use Customer Data or Outputs to train or fine‑tune Company‑owned foundation models. Use of third‑party model providers is subject to Section 2.4; Company will pass "no‑training/no‑retain" signals where available but cannot guarantee provider behavior.

4.4 Service Data.

Company may collect and use Service Data for operations, support, troubleshooting, capacity planning, security, and to improve the Services. Service Data will not be used to train foundation models.

4.5 Aggregated Data (Internal‑Only).

Company may create Aggregated Data from Service Data and Customer's use of the Services and may use such Aggregated Data internally to operate, analyze, and improve the Services. Company will not publicly disclose or commercialize Aggregated Data without Customer's prior written consent, and will not attempt to re‑identify any individual or Customer.

4.6 Sub‑processors & Transfers.

Company may use sub‑processors subject to written obligations consistent with the DPA. Company will maintain a sub‑processor list on its trust page and provide reasonable advance notice of material changes. Cross‑border transfers will be subject to suitable safeguards (e.g., SCCs/UK IDTA/adequacy).

4.7 Security & Breach Notice.

Company will maintain administrative, technical, and physical safeguards appropriate to the nature of the Services (see Exhibit B – Security Measures). Company will notify Customer without undue delay (and in any case within 72 hours) after confirming a breach of Company‑controlled systems that results in unauthorized access to unencrypted Customer Data.

4.8 Data Export & Deletion.

During the Order Term, Customer may export Outputs as PDF reports via the Platform. Following initial launch, Company intends to provide APIs for exporting prompts and test cases (subject to rate limits). Upon termination, Company will delete or return Customer Data within 30 days, unless retention is required by law or permitted by the DPA.

4.9 Confidentiality of Personal Data.

Customer Data (including Personal Data) is Customer Confidential Information under Section 10.

4.10 HIPAA.

No PHI will be Processed unless the Parties execute a BAA; the BAA will control for PHI.

4.11 Prohibited Data; Customer Responsibility.

Unless expressly agreed in writing (e.g., via a signed DPA or BAA), Customer will not upload, submit, or process through the Services:

• (a) sensitive personal data (including health data, biometric data, or government-issued identifiers);
• (b) personal data of children or minors where parental consent is required; or
• (c) any data subject to heightened regulatory obligations beyond those expressly supported by the Services.

Customer is solely responsible for the data it submits to the Services. If Customer submits Prohibited Data in violation of this Agreement, Company has no liability arising from such submission and may suspend or restrict processing of the affected data. Customer agrees to indemnify Company for claims arising from Customer's breach of this section.

5. Intellectual Property; Outputs; Generic Tools

5.1 Company IP.

The Services, Documentation, software, integration utilities, and Generic Tools/Validators, and all related IP rights are owned by Company and its licensors. No rights are granted except as expressly stated.

5.2 Customer IP; Outputs & Export.

Customer owns Customer Data and Outputs. Customer acknowledges that Outputs may not be unique and that similar or identical outputs may be generated for other customers or users based on similar inputs, prompts, models, or configurations. Company does not warrant that Outputs are exclusive, non-infringing, or suitable for any particular use.

5.3 Generic Tools/Validators.

Company may develop, reuse, and improve Generic Tools/Validators across customers, provided they do not include Customer Data or Customer Confidential Information.

5.4 Feedback.

Company may use and incorporate feedback without obligation.

5.5 AI-Specific Use Restrictions and Risk Allocation.

Customers acknowledge that the Services evaluate and analyze large language model behavior and do not provide deterministic, authoritative, or guaranteed results. Customer agrees that:

• (a) Outputs are generated based on probabilistic models and may vary between runs;
• (b) Outputs are not a substitute for professional judgment or human review;
• (c) Customer is solely responsible for validating Outputs before any reliance or downstream use;
• (d) the Services are not designed or intended for use in high-risk or regulated activities, including medical diagnosis, clinical decision-making, legal advice, financial decision-making, safety-critical systems, or autonomous production deployments, unless expressly agreed in writing by Company.

Company disclaims any responsibility for Customer's use of Outputs in violation of this Section.

6. Fees; Taxes; Payments; Suspension

6.1 Fees & Limits.

For contracted customers, Fees and usage limits are set in the Order. For self‑serve customers, Fees and limits are as shown on the Pricing Page at purchase. Except as expressly stated in the Agreement, Fees are non‑refundable.

6.2 Invoicing & Payment.

Unless otherwise stated in the Order, invoices are due Net 30 from invoice date and are payable via Stripe (credit card/ACH). Customer authorizes Company (or its processor) to charge the payment method on file on or after the due date for amounts then due.

6.3 Taxes.

Fees exclude taxes; Customer is responsible for applicable taxes other than Company's taxes on income.

6.4 Late Fees; Suspension.

Overdue amounts may accrue interest at 1.0% per month (or the maximum allowed by law). Company may suspend the Services for amounts more than 30 days past due after notice.

6.5 Price Changes.

For self‑serve plans, Company may update the Pricing Page prospectively. For contracted customers, pricing changes take effect at renewal (or as stated in the Order) with at least 30 days' prior notice.

7. Warranties; Disclaimers

7.1 Mutual Authority.

Each Party represents it has the right and authority to enter into the Agreement.

7.2 Service Warranty.

Company will provide the Services in a professional and workmanlike manner materially in accordance with the Documentation.

7.3 Outputs & Models.

Outputs are probabilistic and may be inaccurate or incomplete. Customer must validate Outputs for its use cases. Company does not warrant that Outputs (i) are accurate or fit for a particular purpose, (ii) constitute IP owned by Customer, or (iii) are non‑infringing.

7.4 General Disclaimer.

Except as stated in Section 7.2, the Services and Documentation are provided "AS IS" without warranties of any kind (express, implied, or statutory), including merchantability, fitness, non‑infringement, accuracy, or uninterrupted operation.

8. Limitation of Liability

8.1 Exclusion.

Neither Party is liable for indirect, incidental, special, consequential, punitive damages, or lost profits/revenues, even if advised of the possibility.

8.2 Cap.

Except for (a) breach of Section 10 (Confidentiality), (b) IP infringement/misappropriation, copyright willful misconduct or gross negligence, or (d) each Party's indemnification obligations, each Party's total liability under the Agreement will not exceed the Fees paid or payable for the Services giving rise to the claim in the 12 months preceding the event.

9. Indemnification

9.1 By Company (IP).

Company will defend Customer against third‑party claims alleging that the Services, as provided and used in accordance with the Documentation, infringe a U.S. patent, copyright, or trade secret. Company may (i) procure rights, (ii) modify/replace the Services, or (iii) terminate the affected Services and refund prepaid, unused Fees.

9.2 By Customer.

Customer will defend Company against claims arising from (i) Customer Data; (ii) Customer's use of Outputs (except to the extent caused by the Services' unauthorized processing); or (iii) Customer's breach of law or Section 2.

9.3 Procedure.

The indemnified Party must give prompt notice, reasonable cooperation, and grant sole control of defense/settlement to the indemnifying Party.

10. Confidentiality

10.1 Definition.

"Confidential Information" means non‑public information disclosed by a Party that is marked or reasonably understood as confidential, including Customer Data and Personal Data.

10.2 Protection.

Recipient will use the same care it uses to protect its own similar information (and at least reasonable care) and limit disclosure to personnel/sub‑processors with a need to know and confidentiality obligations.

10.3 Exceptions; Compelled Disclosure.

Standard exceptions apply; compelled disclosure permitted with notice (if lawful) and protective measures.

10.4 Return/Deletion.

Upon termination or request, each Party will return or delete the other's Confidential Information within 30 days, subject to legal retention and backup practices.

11. Term; Termination; Effect

11.1 Term & Renewals.

Each Order specifies its Initial Term and any auto‑renewal terms. Either Party may give 30 days' advance notice of non‑renewal.

11.2 Termination for Cause.

Either Party may terminate for material breach not cured within 30 days after written notice.

11.3 Suspension.

Company may suspend for security risks, unlawful use, or material breach (including non-payment) with prior notice where practicable.

Company may suspend access to the Services (in whole or in part, including specific workspaces, models, or integrations) immediately and without prior notice where reasonably necessary to address security risks, legal compliance obligations, suspected unlawful use, or material breach (including non-payment). Company will provide notice as soon as practicable following such suspension.

11.4 Effect.

Upon termination/expiration, access ends; Section 4.8 governs export/deletion. Sections intended to survive (including 1, 4–10, 12–18) survive.

12. Publicity

12.1 Publicity (Opt-Out).

Unless Customer provides written notice opting out, Company may identify Customer as a customer of the Services and may use Customer's name and logo on Company's website, marketing materials, and presentations, subject to Customer's brand guidelines. Customer may opt out of such use at any time by written notice.

13. Changes to Services & Terms

13.1 Services.

Company may update features and Documentation from time to time.

13.2 Terms Updates.

Company may update these Terms with 30 days' prior notice. If Customer reasonably objects and the Parties cannot resolve, Customer may terminate the affected Order before the effective date and receive a pro‑rata refund of prepaid, unused Fees. Pricing is governed by the Order or Pricing Page and is not changed by Terms updates except as provided in Section 6.5.

14. Governing Law; Dispute Resolution

14.1 Governing Law.

This Agreement is governed by the laws of the State of Delaware, excluding conflict‑of‑laws rules.

14.2 Arbitration.

Any dispute, claim, or controversy arising out of or relating to this Agreement shall be resolved exclusively by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules, including the Expedited Procedures where applicable. This Agreement evidences a transaction involving interstate commerce and shall be governed by the Federal Arbitration Act. The arbitrator shall have exclusive authority to resolve any dispute regarding the interpretation, applicability, enforceability, or formation of this agreement. The arbitration shall be before a single arbitrator seated in New Castle County, Delaware. Each Party pays fees per the Rules; the arbitrator may award fees/costs to the prevailing Party as permitted.

14.3 Equitable Relief; Small Claims; Waivers.

Either Party may seek injunctive relief for breach of IP or confidentiality; either Party may bring a qualifying matter in small claims court. CLASS ACTIONS AND JURY TRIALS ARE WAIVED.

15. Notices

Legal notices must be sent to the contacts set forth on the Order. For Company: legal@plumloom.ai and Plumloom LLC mailing address, California, USA. A Party may update its notice information by notice to the other Party.

16. Assignment

Neither Party may assign the Agreement without the other Party's consent, except to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets (with notice). The Agreement binds permitted successors and assigns.

17. Export; Sanctions; Anti‑Corruption

Each Party will comply with applicable export controls, sanctions, and anti‑corruption laws. No use in embargoed countries or prohibited end‑uses.

18. Entire Agreement; Order of Precedence; Miscellaneous

This Agreement is the entire agreement and supersedes prior discussions. Order of precedence: First DPA, Second Order, Third these Terms, 4th Documentation, fifth Pricing Page (self‑serve only). Force majeure, waiver, and severability apply in the ordinary course; the Parties are independent contractors.

Exhibit A — Data Processing Addendum (Summary)

Roles, lawful basis, subject‑matter and duration of Processing; cross‑border safeguards (e.g., SCCs/UK IDTA/adequacy); Technical & Organizational Measures; sub‑processor list and change notices; audit rights on reasonable notice; breach notice without undue delay; deletion/return of Personal Data at end of term.

Exhibit B — Security Measures (Summary)

Encryption in transit (and at rest where supported by infrastructure); key management; access control (least privilege; authentication controls); logging and monitoring; vulnerability management and secure development practices; incident response; third-party assessments where applicable.

Exhibit C — Service Level Agreement (Summary)

Uptime targets, maintenance windows, support tiers and response/restore times, and service credits (if any).