Platform Terms of Service

1. Acceptance of these terms

1.1 These Platform Terms of Service (the “Terms“) form a binding agreement between BlueImpact RiskIntelligence Ltd., doing business as nank.ai (“nank.ai“, “we“, “us” or “our“), and the organization that accesses or uses the Platform (“Customer” or “you“).

1.2 You accept these Terms when you click to accept them, sign an order that refers to them, or access or use the Platform. If you accept on behalf of an organization, you confirm that you have authority to bind it. If you do not have that authority, or do not agree, do not use the Platform.

1.3 The Platform is for business use only. It is not intended for consumers or for anyone under the age of majority where they live.

2. Definitions

2.1 In these Terms:

• “Platform” means nank.ai’s hosted, AI-powered compliance management software, including its AI features, integrations, documentation and any updates.
• “AI Features” means functions of the Platform that use machine learning or generative artificial intelligence, such as agents that draft policies, map documents to framework requirements or review evidence.
• “AI Output” means content generated by the AI Features.
• “Authorized User” means an employee or contractor whom you permit to use the Platform under your account.
• “Customer Data” means data, documents, evidence and other content that you or your Authorized Users submit to the Platform, or that the Platform collects from systems you connect to it.
• “Order” means an order form, quote, online checkout or signed agreement that sets out your subscription, fees and term.
• “Services” means the Platform and any related support.

3. Relationship to other agreements

3.1 If you have signed a separate agreement with nank.ai that covers the Platform, such as a Compliance-as-a-Service Subscription and Services Agreement, that agreement governs your use of the Platform. These Terms apply only to matters it does not address.

3.2 Otherwise, these Terms and your Order together form the entire agreement for the Platform. If they conflict, the Order governs for that subscription only. Terms in your purchase order or other documents do not apply.

3.3 Compliance manager, advisory and audit support services are provided only under a signed agreement or Order that describes them. These Terms do not include those services.

4. Accounts and Authorized Users

4.1 You must provide accurate account information and keep it up to date.

4.2 You are responsible for your Authorized Users and for all activity under your account. You will keep credentials confidential, require multi-factor authentication where the Platform offers it, and remove access promptly when an Authorized User leaves or no longer needs it.

4.3 You will tell us promptly at [email protected] if you learn of any unauthorized access to your account.

5. Your right to use the Platform

5.1 Subject to these Terms and payment of the applicable fees, we grant you a non-exclusive, non-transferable, non-sublicensable right during your subscription term for your Authorized Users to use the Platform for your internal business purpose of managing your compliance programs.

5.2 Your Order sets the scope of your subscription, such as the frameworks, features, users or entities included.

5.3 Trials and preview features. We may offer free trials or features labelled beta, preview or early access. They are provided “as is”, may change or end at any time, and are excluded from any service commitments. Unless you buy a subscription, we may delete trial data 30 days after the trial ends.

6. Acceptable use

6.1 You will not, and will not allow anyone to:

• copy, modify, or create derivative works of the Platform;
• reverse engineer, decompile or try to extract the source code or underlying models of the Platform, except where law expressly allows it despite this restriction;
• resell, sublicense or provide the Platform to third parties, or use it as a service bureau, except as your Order allows;
• use the Platform to build or benchmark a competing product;
• probe, scan or test the security of the Platform without our written permission;
• interfere with or disrupt the Platform, or exceed reasonable usage limits we communicate;
• upload malicious code, or content that infringes anyone’s rights or breaks the law;
• use the AI Features to generate unlawful, deceptive or harmful content, or to try to bypass their safeguards; or
• use the Platform in breach of export control or sanctions laws.

6.2 We may suspend access that we reasonably believe breaches this Section or threatens the security of the Platform or other customers. We will give notice when practical and restore access once the issue is resolved.

7. Customer Data and privacy

7.1 Ownership. As between you and us, you own all Customer Data. You grant us a limited licence to host, copy, process and display Customer Data only as needed to provide and secure the Services, and to comply with law.

7.2 Your responsibilities. You are responsible for the accuracy and lawfulness of Customer Data, and for having the notices, consents and rights needed to provide it to us. Limit personal information in evidence to what you need. Do not upload personal health information, payment card data or government identification numbers unless your Order expressly allows it and any additional terms required by law are in place. If you upload information in breach of this Section, you are solely responsible for it and for any notice, consent or legal obligation that applies to it. To the extent permitted by law, we have no liability for its presence on the Platform or for any loss, claim, fine or breach notification cost relating to it, except to the extent caused by our gross negligence or wilful misconduct. We may delete or restrict access to it when we find it, and we will tell you when we do.

7.3 Processing on your behalf. We process personal information in Customer Data on your behalf, as a service provider, and only to provide the Services, on your instructions, or as law requires. Our Privacy Policy explains how we handle personal information about account holders and website visitors.

7.4 Security. We maintain administrative, technical and physical safeguards appropriate to the sensitivity of Customer Data. These include encryption in transit and at rest, least-privilege access with multi-factor authentication for administrative access, logging and monitoring, vulnerability management, and backup and recovery.

7.5 Service providers and location. We use third-party service providers, such as cloud hosting and AI model providers, to deliver the Services. We bind them by written terms that protect Customer Data at least as well as these Terms, and we remain responsible for them. We will provide a current list on request. Customer Data may be stored and processed in Canada, the United States or another jurisdiction where we or our service providers operate, as set out in that list. Data processed outside your country may be accessible to courts, law enforcement and national security authorities of that jurisdiction.

7.6 Security incidents. We will notify you without undue delay, and in any case within 72 hours, after we become aware of a breach of security safeguards involving your Customer Data, and we will cooperate with your response.

7.7 Aggregated data. We may use de-identified, aggregated data about how the Platform is used, which does not identify you or any individual, to operate, secure and improve our services.

7.8 Export, return and deletion. You may export Customer Data at any time during your subscription. When your subscription ends, we will return your Customer Data and evidence, in the form you submitted it, within 30 days, whether or not any fees are outstanding. Returning it does not waive fees you owe. We will deliver the policies, registers, reports, task and audit histories, AI Output and other records generated in the Platform for you once you have paid all fees due, other than amounts you dispute in good faith. If those fees remain unpaid 90 days after your subscription ends, we may delete those generated records after giving you at least 15 days’ notice. We will delete Customer Data from our active systems within 60 days after returning it, and from backups in the normal backup cycle, unless law requires us to keep it.

8. AI Features

8.1 AI Output is generated automatically and may be incomplete, inaccurate or unsuited to your organization. It is a starting point for review, not professional, legal or audit advice. You are responsible for reviewing AI Output and for deciding whether to adopt any policy, procedure, control or conclusion it suggests.

8.2 We will not use Customer Data, or AI Output that contains Customer Data, to train or fine-tune AI models that are made available to other customers or the public. We use only third-party AI providers whose terms prohibit them from training their models on Customer Data.

8.3 Automated review of evidence supports, and does not replace, your own review and the work of your independent auditor.

9. Integrations and third-party services

9.1 The Platform can connect to systems you choose, such as cloud providers, identity providers, code repositories and ticketing tools. When you connect one, you authorize us to access it with the permissions you grant, to collect configuration data and evidence for your compliance programs. We recommend granting read-only, least-privilege access.

9.2 Third-party services are governed by their own terms. We are not responsible for their availability, security or changes, or for any data they receive when you choose to share it with them.

10. Compliance outcomes

10.1 The Platform helps you plan, manage and evidence your compliance programs. Your management remains responsible for your controls, the accuracy of your evidence, and any assertion you make to an auditor, customer or regulator.

10.2 nank.ai is not an audit firm or certification body. We do not issue attestation reports or certificates. The outcome of any audit depends on your controls and on the independent judgment of your auditor. We do not guarantee that you will obtain a report, a certificate or any particular result, or that you will do so within a particular time.

10.3 Content in the Platform, including templates and framework mappings, is general information and not legal advice. Consult qualified counsel about your legal obligations.

11. Fees and payment

11.1 You will pay the fees in your Order. Unless your Order says otherwise, fees are billed annually in advance. Invoices are due on receipt, and amounts are in the currency stated in your Order.

11.2 Fees exclude applicable taxes, such as GST, HST, PST, QST and sales or use taxes, which you will pay in addition.

11.3 Overdue amounts bear interest at 1.5% per month (19.56% per year), or the maximum lawful rate if lower. If an undisputed amount is more than 15 days overdue, we may suspend the Services after giving at least 10 days’ written notice.

11.4 Except as stated in Sections 15.1, 17.1 and 18.2 or in your Order, fees are non-cancellable and non-refundable, including if your subscription ends early. We do not give refunds, credits or pro-rated reductions for any unused part of a subscription year.

11.5 If your Order allows you to pay a year’s fees in instalments, such as quarterly, the instalments are a payment convenience only. You commit to the full fees for that year from its start, and paying in instalments does not reduce that commitment. If your subscription ends during that year for any reason other than one that carries a refund under Section 15.1, 17.1 or 18.2, all unpaid instalments for that year become due immediately. If an instalment is more than 30 days overdue, we may require the remaining instalments for that year to be paid immediately by giving you notice.

12. Availability, support and changes

12.1 We use commercially reasonable efforts to keep the Platform available at all times, except for planned maintenance, which we try to schedule outside business hours with advance notice, and events beyond our reasonable control.

12.2 We provide support by email at [email protected] and through the Platform, from 9:00 a.m. to 5:00 p.m. Eastern Time, Monday to Friday, excluding Ontario statutory holidays.

12.3 We improve the Platform over time. We will not make a change that materially reduces the core functions of your paid subscription during its current term.

13. Confidentiality

13.1 Each party will protect the other’s non-public information that it receives in connection with the Services, using at least reasonable care, and will use it only to perform or receive the Services. This does not apply to information that is public through no fault of the recipient, already known to it, lawfully received from a third party, or independently developed. A party may disclose information when law requires it, after giving notice where legally permitted.

13.2 You may share Platform reports and evidence with your auditors and advisors for the purpose of your compliance programs.

14. Intellectual property

14.1 We and our licensors own the Platform, the AI Features, and our templates, control libraries, methods and documentation, including improvements to them. No rights are granted except as these Terms expressly state.

14.2 Once you have paid the applicable fees, policies and other documents you create in the Platform for your organization, including those built from our templates, are yours to use, copy and modify for your internal business purposes, including after your subscription ends. We keep ownership of the underlying templates.

14.3 We may use any feedback or suggestions you give us about the Services without restriction or obligation.

15. Warranties and disclaimers

15.1 We warrant that the paid Platform will perform materially as described in its documentation. If it does not and you tell us within 30 days, we will correct it. If we cannot do so within a reasonable time, either party may end the affected subscription and we will refund prepaid fees for the remaining term. This is your exclusive remedy for breach of this warranty.

15.2 Except as these Terms expressly state, the Services and AI Output are provided “as is” and “as available”. To the extent permitted by law, we disclaim all other warranties and conditions, express, implied or statutory, including merchantability, quality, fitness for a particular purpose and non-infringement. We do not warrant that the Platform will be uninterrupted or error-free, or that it will make you compliant with any law or framework.

16. Limitation of liability

16.1 Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, business opportunity or goodwill, however caused, even if advised of their possibility.

16.2 Each party’s total liability arising out of or relating to these Terms will not exceed the fees you paid and owe for the Platform in the 12 months before the event giving rise to the claim. For free trials and preview features, our total liability is limited to CAD $100.

16.3 These limits do not apply to your payment obligations, to your indemnity obligations under Section 17.2, to our indemnity obligations under Section 17.1, which are capped at two times the amount in Section 16.2, to liability for fraud, gross negligence or wilful misconduct, or to any liability that cannot be limited by law.

17. Indemnification

17.1 We will defend you against any third-party claim that the Platform, as we provide it and as you use it under these Terms, infringes that party’s Canadian or United States intellectual property rights, and will pay damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, we may obtain the right for you to keep using the Platform, change it so it does not infringe, or end the affected subscription and refund the fees you have paid for the remaining period. This does not apply to claims arising from Customer Data, combinations with items we did not provide, or use in breach of these Terms.

17.2 You will defend us against any third-party claim arising from Customer Data, including a claim that you lacked the rights or consents needed to provide it or uploaded information in breach of Section 7.2, or from your use of the Services in breach of Section 6 or the law, and will pay damages and costs finally awarded or agreed in settlement.

17.3 The party seeking defence will give prompt notice, reasonable cooperation, and control of the defence and settlement to the other party. No settlement may impose an admission or obligation on the defended party without its consent.

18. Term, suspension and termination

18.1 These Terms apply while you use the Platform. Your subscription term and any renewal are set out in your Order. Unless your Order says otherwise, subscriptions renew automatically for successive one-year terms unless either party gives notice of non-renewal at least three months before the next subscription year starts. You may not end the current subscription year for convenience. You may end all later years, including later years of a multi-year term, by giving us notice at least three months before the next subscription year starts. If your notice is late, the next year begins and its fees are payable in full.

18.2 Either party may terminate a subscription by written notice if the other party materially breaches these Terms and does not cure the breach within 30 days after notice, or becomes insolvent or subject to bankruptcy proceedings. If you terminate because of our uncured breach, we will refund the fees you have paid for the period after termination and will not invoice any remaining instalments.

18.3 When your subscription ends, your right to use the Platform ends, and Section 7.8 applies to your Customer Data. Sections that by their nature should survive, including Sections 7, 10, 11, 13, 14 and 15 to 21, survive.

19. Changes to these Terms

19.1 We may update these Terms from time to time. We will post the updated Terms on this page and change the “Last updated” date. For material changes, we will give you at least 30 days’ notice by email or in the Platform before they take effect.

19.2 Changes apply from your next renewal, unless they are needed to comply with law or to address a security risk, in which case they apply when stated. If you do not agree to a material change, you may give notice of non-renewal. Continued use after a change takes effect means you accept it.

20. Governing law and disputes

20.1 These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

20.2 The parties will first try to resolve any dispute through good-faith discussion between senior representatives for 30 days. Failing that, each party submits to the exclusive jurisdiction of the courts of Ontario sitting in Toronto. Either party may seek urgent injunctive relief in any court.

21. General

21.1 Independent parties. The parties are independent contractors. Nothing in these Terms creates a partnership, agency or employment relationship.

21.2 Assignment. Neither party may assign these Terms without the other’s consent, which will not be unreasonably withheld, except to an affiliate or a successor in a merger, reorganization or sale of the relevant business, on notice.

21.3 Force majeure. Neither party is liable for delays or failures, other than payment obligations, caused by events beyond its reasonable control.

21.4 Publicity. We will not use your name or logo in our marketing without your consent. If you agree in your Order or in writing to a case study, we will send you the final draft, and you will approve it or ask for reasonable changes within 15 business days. Once you approve it, we may publish the approved case study and reuse it unchanged, including in excerpts, during and after your subscription, without asking again. Any material change needs new approval. A case study will not disclose your Customer Data or details of your security weaknesses.

21.5 Notices. We may send notices to the email address on your account or through the Platform. You may send notices to [email protected]. Notices of breach or termination must also be sent by courier to our registered office, whose address we will provide on request.

21.6 Severability and waiver. If any provision is unenforceable, it will be limited to the minimum extent necessary and the rest will remain in effect. A failure to enforce a provision is not a waiver.

21.7 Language. The parties have expressly required that these Terms and all related documents be drawn up in English. Les parties ont expressément exigé que les présentes conditions et tous les documents connexes soient rédigés en anglais.

22. Contact us

BlueImpact RiskIntelligence Ltd., doing business as nank.ai
Toronto, Ontario, Canada
Email: [email protected]