# Involiqo Customer Terms

Version: **2026-10-02**. Published version for the legal-acceptance rollout. These terms take effect for a customer when accepted or incorporated into its order, not merely because the document is available to read.

These terms cover business use of Involiqo, including subscriptions, invoice processing, financial records and workforce tools. You can retain this version using the downloadable copy accompanying the Customer Terms page.

## 1 Who we are and who the customer is

Involiqo is provided by **KEY PILLAR AI LTD**, a company registered in England and Wales under number **16172894**, with its registered office at **25 Edmund Road, Southsea, England, PO4 0LL**. In these terms, “we”, “us” and “our” mean that company. Contact us at [keypillarailtd@gmail.com](mailto:keypillarailtd@gmail.com), through [involiqo.com/contact](https://involiqo.com/contact), or at our registered office.

“You” means the business or organisation identified as the customer when its authorised representative creates or subscribes to a workspace. A sole trader contracts in their own name. “Authorised users” are people you permit to access that workspace. You must have authority to enter this agreement for the customer; accepting as a representative does not make you a personal guarantor of its fees.

Involiqo is offered for business purposes, not personal or household use. These terms do not remove any consumer rights that apply by law despite that restriction.

An invited user must follow the account, security and acceptable-use requirements, but does not become the subscription customer or assume its payment obligations merely by joining a workspace. A person without purchasing authority must not order a subscription on behalf of the customer.

## 2 Your agreement and the service

Your agreement comprises these terms, Schedule 1 and any order expressly agreed with us. An order identifies the workspace, plan, billing period, price and any agreed variations. A written, individually agreed order overrides conflicting commercial terms; Schedule 1 takes priority for personal-data processing, subject to any mandatory transfer terms.

The agreement begins when your authorised representative accepts these terms through the service or signs an order incorporating them. A paid subscription begins as stated at checkout or in the order. A privacy-notice acknowledgement confirms that the notice was made available; it is not blanket consent to all processing.

We give you a non-exclusive, non-transferable right for your authorised users to use the subscribed service for your business during the agreement. Features, user numbers, extraction allowances and other limits depend on the plan and any additional features you order. Limits are per workspace unless expressly stated otherwise. We will not charge for unrequested additional services.

We may maintain and improve the service. We will not materially reduce the core functionality you purchased during a prepaid period without offering an appropriate remedy, which may include ending the affected service and refunding its unused prepaid fees. Separately identified trial or beta features may change or be withdrawn; their status must be disclosed before use.

## 3 Accounts and workspace management

Provide accurate account and billing details, keep contact details current and use individual logins rather than shared credentials. Keep passwords and authentication methods secure. Tell us promptly if you suspect account compromise.

You manage invitations, roles, permissions and removal of people who no longer need access. Workspace owners and administrators may manage workspace data and users according to their permissions. You are responsible for authorised users' use of the service, except to the extent a problem results from our breach or security failure.

Do not access another customer's data, evade access controls or plan limits, upload unlawful or malicious material, interfere with availability, or resell access without our written agreement. Report suspected vulnerabilities privately through our contact page; do not exploit them against other customers or their records.

## 4 Invoice extraction and financial information

Involiqo helps organise records, extract invoice information and produce calculations and insights. It is not an accountant, tax adviser, auditor or regulated financial adviser, and is not a bank or payment account. A displayed cash balance or forecast is calculated from available records, not a guarantee of funds or future results.

OCR and AI can misread suppliers, dates, tax, amounts and line items or produce plausible but incorrect information. Depending on the feature and its settings, eligible extraction results may be saved automatically. Saving a result does not certify its accuracy.

Check results against original documents before paying an invoice, submitting accounts or tax returns, or making another consequential decision. You remain responsible for complete records, accounting judgments, tax treatment and legally required retention. Keep appropriate copies and exports. These responsibilities do not excuse us from providing the service with reasonable care and skill or from our security and data-protection obligations.

Third-party AI or document-processing services may process uploaded information as described in Schedule 1. Assistant and insight features may also send user questions and relevant workspace facts to those services. Do not put unnecessary personal or sensitive information into prompts. These terms do not guarantee use of a particular model or provider, and we do not promise zero provider retention.

## 5 Rota and workforce information

If enabled for your workspace, Rota supports scheduling, availability, leave, time records and pay-related calculations. It does not itself guarantee compliant working hours, minimum pay, holiday entitlement, payroll submissions or employment decisions.

As employer or relevant organisation, you decide work arrangements, verify entries and calculations, apply applicable employment rules and give staff appropriate privacy information. A staff member's app acceptance does not replace your duty to establish a lawful basis for employment-data processing. Do not place unnecessary medical details or other sensitive information in free-text fields. The permitted scope of personal data is set out in Schedule 1.

## 6 Trials and subscriptions

The trial length and included features are shown when offered. A no-card trial does not by itself authorise a paid subscription. When a trial ends without a paid plan, access or features may become restricted.

Paid subscriptions renew for the same billing period unless cancelled before renewal or otherwise stated in your order. The price, currency, billing period, applicable taxes and renewal terms must be available before you confirm payment. Prices stated exclusive of VAT have applicable VAT added at checkout.

You authorise the payment provider to collect agreed recurring charges using your chosen payment method. We do not treat the payment provider's separate terms as permission to change our agreed price.

If you request a plan change, it may result in proportional charges or credits according to the change terms presented for approval. Contact us if a charge appears incorrect. We will investigate reasonably and will not suspend access solely for a promptly raised, genuine dispute while you cooperate and pay undisputed amounts.

We will give at least **30 days' advance notice** of a price increase. It takes effect no earlier than your next renewal after that notice period. You may cancel before it takes effect. No increase applies retrospectively to an already prepaid period.

## 7 Cancellation and refunds

You may cancel renewal through the available billing controls, or contact us for help. Ordinary cancellation takes effect at the end of the current paid billing period; included paid access continues until then. Cancellation is not the same as deleting a workspace.

After the paid period ends, a cancelled workspace remains read-only and its records are retained until its owner requests deletion. We do not automatically purge a cancelled workspace merely because it is inactive under this release's retention policy. The separate provisions for lawful restrictions, service closure and return or deletion of data still apply.

Unless your order or mandatory law says otherwise, choosing not to use the service or cancelling renewal does not automatically entitle you to a refund for an already started billing period. We will consider billing errors and exceptional refund requests individually. This does not remove remedies for our breach, including refunds expressly provided by these terms.

A confirmed permanent workspace-deletion request is different: it ends the workspace's active subscription and starts deletion without waiting for the paid period to finish. Export what you need first. Deletion does not automatically create a proportional refund; outstanding charges and any requested refund must be resolved separately. We will not collect renewal fees for a deleted workspace.

## 8 Availability and support

We will provide the service with reasonable care and skill and use reasonable efforts to resolve reported faults. Support is available through our contact page. No fixed response time, uptime percentage, recovery deadline or dedicated backup service is promised unless expressly agreed in an order.

Maintenance, internet problems and supplier failures can affect availability. Where reasonably practicable, we will give notice of planned work that materially interrupts the service. Using suppliers does not remove our responsibility for obligations we have undertaken to you.

## 9 Your data and our intellectual property

You retain your rights in uploaded documents, business records and other content you provide. You grant us permission to process that content only as needed to deliver, secure and support the service, follow your lawful instructions and comply with applicable law, subject to Schedule 1 and confidentiality obligations. You must have the rights and authority needed to provide it.

We retain rights in Involiqo's software, design and documentation. These terms do not assign ownership of your records to us. Generated material may not be unique or eligible for intellectual-property protection; you may use outputs supplied to you for your lawful business purposes, subject to others' rights.

We do not use customer content to train a general-purpose AI model or opt it into provider model training. Google Document AI does not train its models on our submitted documents, and OpenAI API data sharing for model improvement is disabled for our production project. Provider processing for delivery, security and abuse prevention is distinct from model training and is described in Annex A.

## 10 Confidentiality and privacy

Each party must protect the other's confidential information with reasonable care, use it only for this agreement and disclose it only to people who need it and are subject to suitable confidentiality duties. This does not cover information already lawfully known, independently developed, lawfully received without restriction, or public through no breach.

A party may disclose information when required by law, giving prior notice where lawful and limiting disclosure to what is required. Confidentiality continues after the agreement ends.

Our [Privacy Policy](https://involiqo.com/privacy) explains processing for which we determine the purposes, such as our account administration and billing. Schedule 1 governs personal data we process on your behalf. Accepting these terms is not a substitute for either party meeting its legal obligations.

## 11 Suspension and ending the agreement

We may restrict the affected access where reasonably necessary to address an active security threat, unlawful use, a legal requirement or a material breach. Except where urgency or law prevents it, we will explain the issue and provide a reasonable opportunity to resolve it. Restrictions should be proportionate and lifted when their justification ends.

Either party may terminate for a material breach that remains uncorrected **14 days** after written notice identifying it, or immediately where the breach cannot reasonably be remedied. We will refund unused prepaid fees for the affected service if you terminate for our material breach.

We may discontinue a paid service at the end of its billing period with at least **30 days' notice**. If we end it earlier for our convenience, we will refund the unused prepaid fees. Cancellation of a subscription does not itself terminate any continuing free or read-only workspace arrangement.

At the end of the agreement, your right to use the service ends except for any agreed export access. Where we initiate closure, we will provide a reasonable opportunity to retrieve your records unless prohibited by law or an immediate security risk. Data return, deletion and any retained copies are governed by Schedule 1. Do not assume a deleted workspace can be restored.

## 12 Responsibility and limits of liability

Nothing limits liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or anything else that cannot lawfully be limited. Neither party's direct statutory obligations to individuals or regulators are removed by these terms.

Subject to that protection, each party's total aggregate liability arising from or connected with this agreement is limited to the greater of **£1,000** and the fees paid or payable for the affected workspace during the **12 months immediately before the first event giving rise to the claim**. Related events are treated as one event. This is an aggregate cap, not a separate allowance for each claimant, legal argument or incident.

Neither party is liable to the other for indirect or consequential loss. Reasonable direct costs of restoring customer data lost because of our breach are not excluded merely because they concern data, but remain subject to the applicable cap. These exclusions and limits apply only to the extent lawful and reasonable. They do not limit your obligation to pay agreed fees or our obligation to pay an agreed or contractually required refund.

## 13 Changes to these terms

We will identify the version you accept and make a copy available to retain. For a material change, we will explain it and normally give at least **30 days' notice**. Material commercial changes apply from renewal, not retrospectively to a prepaid period, unless you expressly agree otherwise.

Changes required by law or necessary to address an urgent security issue may take effect sooner, with as much notice as reasonably possible. If such a change materially disadvantages you during a paid period, you may end the affected service before it takes effect and receive a refund of unused prepaid fees, unless law requires otherwise.

We will request fresh acceptance where required. You may choose not to renew rather than accept revised terms. A record of privacy-notice acknowledgement is not permission for unrelated use of your data.

## 14 Notices and other provisions

We may send contractual notices to the account contact you designate. You may give notices to [keypillarailtd@gmail.com](mailto:keypillarailtd@gmail.com), through our contact page or to our registered office; keep evidence of delivery. Please first contact us with any complaint so we can try to resolve it.

Neither party may transfer this agreement in a way that materially prejudices the other without consent. We may transfer it as part of a genuine business sale or restructuring if the successor assumes our obligations, your protections are preserved and we notify you.

A delay in enforcing a term does not waive it. If a provision is unenforceable, the remaining provisions continue so far as lawful. Neither party may exclude liability for fraudulent pre-contract statements. Except where law or mandatory data-transfer terms provide otherwise, third parties cannot enforce this agreement.

The agreement is governed by the law of **England and Wales**, and disputes are subject to the exclusive jurisdiction of its courts, except to the extent mandatory law requires otherwise.

## Schedule 1 Customer data processing

### A Scope and roles

For personal data you put into the workspace and direct us to process, you are the controller and we are your processor. If you act for another controller, you must have its authority to appoint us as a further processor; the corresponding obligations apply to you. Applicable data-protection law includes the UK GDPR and Data Protection Act 2018 as amended, and other data-protection law applicable to the processing.

Processing covers hosting, retrieval, invoice extraction, assistant responses, generated insights, calculation, organisation, display, export, support and deletion for the subscribed features. It lasts while we provide those services, including any agreed read-only access, and during the approved deletion period. Your agreement, authorised settings and documented support requests constitute instructions. You determine the business purposes and have the right to give lawful instructions.

Data subjects may include your users, staff, contractors, customers and suppliers. Data may include names and contact details, invoice and transaction records, business identifiers, account references, staff schedules, attendance, leave categories and pay-related records. Do not upload payment-card security codes, credentials or unnecessary special-category or criminal-offence data. Necessary sensitive employment data requires an expressly agreed processing scope and appropriate safeguards; ordinary app availability does not establish those safeguards.

### B Our processing obligations

We will follow documented instructions, including for transfers, unless law requires otherwise. Where lawful, we will inform you before legally required processing. If we believe an instruction breaches applicable data-protection law, we will inform you immediately and pause that instruction while it is resolved.

People authorised to process this data must be bound by confidentiality. We will implement and maintain security appropriate to the risks, including the measures described in Annex A. We will help you address individual-rights requests, security incidents, impact assessments and regulator consultation, taking account of our role and available information. We will not answer requests for your workspace data independently unless authorised or legally required.

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, provide available information to support your assessment and response, and cooperate with mitigation. An initial notice need not wait for a completed investigation.

We will provide information reasonably necessary to demonstrate compliance and permit proportionate audits and inspections by you or an independent auditor bound by confidentiality. Timing and access arrangements must protect other customers but must not frustrate statutory rights or urgent investigations.

### C Suppliers and international transfers

You generally authorise the subprocessors identified in Annex A. We will give at least **30 days' prior notice** of proposed additions or replacements engaged by us so you can raise reasonable data-protection objections. For changes within a supplier's own subprocessor chain, we will pass on notice promptly when received and support reasonable objections under the applicable supplier terms. We will work to resolve an objection; if no reasonable solution is available, you may end the affected service before that processing begins and receive unused prepaid fees for it.

We will impose equivalent relevant data-protection duties on subprocessors and remain responsible for their performance of those duties. Restricted international transfers require a lawful mechanism and any required assessment and safeguards. Annex A identifies the configured processing locations and the suppliers' contractual transfer safeguards; a regional endpoint is not a promise that all support or operational processing stays in that region.

### D Return and deletion

When processing ends, we will return or delete personal data at your choice and delete remaining copies, unless law requires retention. Confirmed deletion instructions can be acted on without retaining an export copy. Any legally retained data remains protected and restricted to that purpose.

Export arrangements and backup handling are described in Annex A. Copies awaiting scheduled destruction must be isolated from ordinary use; if restored for recovery, deletion instructions must be reapplied. Cancellation alone is not a deletion instruction while you continue using a retained workspace.

### Annex A Suppliers and data handling

#### A1 Service suppliers

The following suppliers process information to deliver the relevant features. Not every feature sends every record to every supplier. Supplier personnel and their own subprocessors may provide support or operational services from other countries listed in the linked supplier information. We do not offer UK-only or EU-only processing across the complete service.

- **Supabase Pte. Ltd. (Singapore):** authentication, database and private uploaded-file storage; account, workspace, invoice and workforce records. Our production project is hosted in Ireland. Its [data-processing terms](https://supabase.com/legal/customer-resources/data-processing-addendum) include Standard Contractual Clauses (SCCs) and the UK Addendum for relevant restricted transfers. Its [subprocessor information](https://supabase.com/legal/subprocessors) identifies onward providers and locations.
- **Vercel Inc. (United States):** website and application hosting, request processing and operational delivery; account requests and workspace information needed to render or operate the service. The application runtime is configured in Dublin, with global delivery and provider operations. Its [data-processing terms](https://vercel.com/legal/dpa) include SCCs and UK transfer provisions. See its [subprocessor list](https://vercel.com/legal/sub-processors).
- **Google Cloud EMEA Limited (Ireland):** Google Document AI invoice parsing; uploaded documents and extracted fields. Our processor uses Google's EU location. Synchronous document processing is in memory; operational metadata is separate. Its [Cloud data-processing terms](https://cloud.google.com/terms/data-processing-addendum) provide contractual safeguards for relevant restricted transfers. See Google's [subprocessor information](https://cloud.google.com/terms/subprocessors) and [Document AI security information](https://docs.cloud.google.com/document-ai/docs/security).
- **OpenAI OpCo, LLC (United States):** invoice repair/fallback, assistant answers and generated insights; relevant invoice contents, prompts and workspace facts. Our project uses global processing and Standard Retention, not a regional or zero-retention service. Its [data-processing terms](https://openai.com/policies/data-processing-addendum/) include SCCs and the UK Addendum where applicable. See its [subprocessor list](https://platform.openai.com/subprocessors). API content is not opted into training. Abuse-monitoring content may be retained for up to 30 days, or longer where legally required; some Responses application state can also be retained. Invoice and assistant requests disable response storage, but this does not eliminate abuse-monitoring retention or apply to every feature.
- **Railway Corporation (United States):** hosting for our malware-scanning service; invoice bytes streamed for scanning and operational request information. That service is configured in EU West. Its [data-processing terms](https://railway.com/legal/dpa) include SCCs and the UK Addendum for relevant restricted transfers, with its onward supplier details. The scanner does not write uploaded invoice files to its application disk; provider operational logs are separate.
- **Plus Five Five, Inc., trading as Resend (United States):** application email delivery; recipient addresses and the contents of the relevant notification or transactional message. Resend identifies the US as its primary processing location. Its [data-processing terms](https://resend.com/legal/dpa) include SCCs and the UK Addendum for relevant restricted transfers. See its [subprocessor list](https://resend.com/legal/subprocessors).

Stripe provides subscription checkout and billing. It also acts as an independent controller for activities such as payment processing, fraud prevention and regulatory compliance under its [Privacy Policy](https://stripe.com/gb/privacy); that activity is not treated as workspace processing solely on our instructions. We do not send uploaded invoice documents or staff schedules to Stripe for subscription payment.

For transfers from the UK to the EEA, applicable UK adequacy regulations may provide the safeguard. The contractual mechanisms above address other relevant restricted transfers; the applicable supplier terms, onward arrangements and any necessary supplementary measures remain part of our obligations. Contact us for information about the safeguards relevant to your data.

#### A2 Security and access

The application uses authenticated accounts, live workspace-membership checks, role-based permissions and database row-level security to separate tenants. Uploaded invoices use private storage and access-controlled retrieval. Upload scanning rejects unsafe files; privileged service credentials are kept server-side. Application-to-provider requests use encrypted HTTPS connections. Infrastructure encryption and physical security are provided by the relevant hosting suppliers under their published security terms.

We restrict administrative access to people who need it for delivery, support or security. Such access must be authorised and subject to confidentiality. We maintain operational records, review access and test application controls, including cross-workspace access checks. Security incidents are handled through the contact below, with customer notification under Schedule 1. These measures are not a claim that Involiqo has independent security certification or cannot experience an incident.

Our database currently has daily physical backups with a seven-day accessible backup window. Those database backups do not include private Storage objects. We do not promise a dedicated customer backup service, an uploaded-file backup, or a guaranteed restoration time. Keep your own required copies. Recovery must preserve tenant controls and reapply outstanding deletion instructions before restored data returns to ordinary use.

#### A3 Retention, export and deletion

Workspace records are retained while the workspace relationship continues, including restricted access after a trial and read-only access after a cancelled paid period. Cancellation or trial expiry is not an instruction to delete. Cancelled workspaces are not automatically purged for inactivity. Owners can request deletion; individual erasure rights and lawful closure under section 11 still apply.

Use the available financial JSON/CSV and Rota exports to retain records. These exports have feature-specific scope and limits and do not constitute a single complete export of all files and personal data. An authorised workspace owner can contact us for an assisted export of remaining records or original files. We verify authority, arrange a secure return format and agree an appropriate completion period, taking account of the volume and any statutory deadline. Request an export before confirming permanent deletion if you need a copy.

Confirmed workspace deletion is asynchronous: it cancels applicable billing, removes private uploaded objects and then deletes live workspace records. Failed steps are retried; we do not guarantee immediate or ten-minute completion. We will investigate reported delay and confirm completion on request. Deleting a user account also removes its linked acceptance rows; archived published document versions are retained separately.

Quarantined uploads and diagnostic extraction traces become eligible for scheduled cleanup after their configured retention period, ordinarily 30 days. Retries or backlogs may delay completion. They are not retained as a substitute for your business records.

Database copies may remain in the rolling backup window after live deletion. Access to residual copies is restricted to recovery, legal or security needs, not ordinary workspace use; they are overwritten or removed under supplier backup/deletion schedules. The seven-day accessible backup window is not a guarantee of destruction of every supplier-held log or residual copy. Provider operational and AI retention is governed by the relevant supplier terms described above. Where law requires longer retention, we retain only what is needed for that purpose, restrict access and delete it when the requirement ends. Our own necessary tax, billing and legal-claims records are handled under the Privacy Policy, not reused as active workspace records.

#### A4 Contacts

For privacy, security, assistance with records and contractual notices, contact [keypillarailtd@gmail.com](mailto:keypillarailtd@gmail.com) or [involiqo.com/contact](https://involiqo.com/contact). We send customer incident notices to its designated account contact. Please keep that contact current and avoid sending sensitive invoice or staff information in an initial email; we can arrange an appropriate secure channel.