Terms of Service

These Terms of Service (“Terms”) govern the Customer's access to and use of the Axiara platform. For purposes of these Terms, “Axiara” means Axiara.ai and its affiliates that provide the Services under the applicable Order Form. “Services” means Axiara's dashboard, browser extension, detection pipeline, compliance reports, APIs, hosted services, support services, and related functionality made available by Axiara to the Customer during the Subscription Term.

“Customer” means the enterprise organization entering into the applicable Order Form or otherwise authorizing use of the Services. “End Users” means Customer's employees, contractors, or other authorized personnel whose browsing activity is monitored through the Services. “Customer Data” means data processed by Axiara on Customer's behalf through the Services, including event telemetry and related identifiers. “Documentation” means Axiara's technical, operational, or product documentation made available to Customer. “Order Form” means the commercial ordering document, proposal, subscription schedule, statement of work, or other written ordering instrument executed by the parties. “On-Premise Software” means any self-hosted Axiara software deployment installed in Customer's own infrastructure. “Subscription Term” means the paid subscription period identified in the applicable Order Form, including any renewal term.

Subject to these Terms and the applicable Order Form, Axiara grants Customer a limited, non-exclusive, non-transferable, and non-sublicensable subscription license to access and use the hosted Services during the Subscription Term solely for Customer's internal business purposes related to Shadow AI governance, risk management, and regulatory compliance.

If Customer purchases an On-Premise deployment, Axiara grants Customer a limited, non-exclusive, non-transferable, and non-sublicensable license to install, operate, and use the On-Premise Software solely within Customer's own controlled infrastructure during the Subscription Term and only in accordance with the Documentation and Order Form. Customer may deploy the Axiara browser extension to End Users solely for Shadow AI detection and related governance workflows. Except for the express rights granted in these Terms, Axiara reserves all rights, title, and interest in and to the Services, and no additional rights are granted by implication, estoppel, or otherwise.

Customer shall provide accurate, current, and complete registration, billing, and account information and shall promptly update such information as needed. Customer is responsible for maintaining the confidentiality and security of account credentials, API keys, administrator logins, and related access methods used to access the Services.

Customer is responsible for managing End User access to the Services and for ensuring that all End Users comply with these Terms, the Documentation, and Customer's internal policies. Before deploying the browser extension or any other monitoring component, Customer shall provide all notices and obtain all consents or other lawful bases required under applicable law, including employee monitoring notice requirements under Indonesian labor law and Article 20 of UU PDP where applicable. Customer shall comply with all laws and regulations applicable to its use of the Services, including UU PDP and sector-specific governance obligations, and shall not attempt to access any other customer's data or any Axiara system or environment beyond the scope of access expressly granted to Customer.

Customer shall not, and shall not permit any End User or third party to, misuse the Services.

• Reverse engineer, decompile, disassemble, or otherwise attempt to derive source code, trade secrets, or non-public logic from the Services
• Use the Services for unauthorized surveillance or any purpose beyond Shadow AI governance, IT governance, and regulatory compliance
• Resell, sublicense, lease, timeshare, distribute, or otherwise make the Services available to any third party except as expressly permitted in the Order Form
• Remove, alter, or obscure proprietary notices, legends, trademarks, or copyright notices contained in the Services or Documentation
• Use the Services to store, transmit, introduce, or facilitate malicious code, destructive routines, or unauthorized access mechanisms
• Use the Services in violation of any applicable law, regulation, regulatory order, or third-party right
• Attempt to probe, scan, circumvent, disable, or defeat security controls, tenant isolation, rate limits, authentication requirements, or logging safeguards
• Use the Services to monitor personnel for purposes unrelated to enterprise IT governance, cyber risk management, or regulatory compliance

Axiara is designed around strict data minimization. The Services collect only domain names visited, organization ID, employee ID, timestamps, and browser metadata necessary to identify and govern Shadow AI usage patterns. Axiara NEVER collects prompts, AI responses, page content, credentials, or any user-generated content. For data protection purposes, Customer acts as the data controller under UU PDP, and Axiara acts as Customer's data processor.

For On-Premise deployments, Customer Data remains exclusively within Customer's infrastructure, and Axiara has no access to Customer Data unless separately agreed in writing for support purposes. For cloud or SaaS deployments, Customer Data is stored in Google Cloud Platform's asia-southeast2 region in Jakarta and is encrypted at rest using AES-256 and in transit using TLS 1.3. Unless otherwise specified in the Order Form, the default retention period is 90 days and may be configured differently by agreement. The Services are intended to support Customer's compliance obligations under POJK 30/2025, UU PDP, GDPR, and the EU AI Act, but Customer remains responsible for its own legal and regulatory obligations. Full details regarding data handling are available in the Axiara Privacy Policy at axiara.ai/privacy. Axiara will process Customer Data only on Customer's documented instructions and as necessary to provide, secure, maintain, and support the Services.

As between the parties, Axiara and its licensors retain all right, title, and interest in and to the Services, including all software, source and object code, algorithms, detection signatures, models, workflows, user interfaces, analytics methods, reports, trademarks, service marks, and Documentation, together with all related intellectual property rights. Customer receives only the limited rights expressly granted under these Terms.

Customer retains all right, title, and interest in and to Customer Data. If Customer or its End Users provide suggestions, enhancement requests, recommendations, corrections, or other feedback regarding the Services, Customer grants Axiara a perpetual, irrevocable, worldwide, royalty-free license to use, reproduce, modify, and incorporate that feedback into Axiara's products and services without restriction or obligation to Customer. No implied licenses are granted under these Terms.

Each party may receive Confidential Information from the other party in connection with these Terms. Each receiving party shall protect the disclosing party's Confidential Information using at least the same degree of care it uses to protect its own confidential information of a similar nature, and in no event less than reasonable care, and shall not use or disclose such Confidential Information except as necessary to perform or exercise its rights under these Terms.

Confidential Information does not include information that is or becomes public through no fault of the receiving party, was known to the receiving party without restriction before disclosure, is independently developed without use of the disclosing party's Confidential Information, or is rightfully received from a third party without breach of any confidentiality obligation. If disclosure is required by law, regulation, or court order, the receiving party shall, where legally permitted, provide prompt notice so that the disclosing party may seek protective treatment. For On-Premise customers, Customer Data constitutes Customer's Confidential Information, and Axiara's software source code, detection algorithms, and non-public technical methods constitute Axiara's Confidential Information. Confidentiality obligations under this Section survive termination of these Terms for three years.

Customer shall pay the fees specified in the applicable Order Form in accordance with the payment schedule stated therein. Unless the Order Form states otherwise, invoices are due net 30 days from the invoice date. Late amounts may accrue interest at the lesser of 1.5% per month or the maximum rate permitted by applicable law until paid in full.

Except as expressly required by Indonesian consumer protection law or as otherwise stated in the Order Form, all fees are non-refundable. Axiara may update pricing effective at renewal by providing at least 30 days' prior written notice. Fees are exclusive of all taxes, levies, duties, and similar governmental assessments, and Customer is responsible for all such amounts associated with its purchases under these Terms other than taxes based on Axiara's net income.

Axiara warrants that the Services will materially conform to the applicable Documentation for 30 days from the commencement of the Subscription Term. In the event of a breach of this limited warranty, Customer's exclusive remedy and Axiara's sole obligation shall be, at Axiara's election, to re-perform the non-conforming Services or provide a pro-rated refund of prepaid fees attributable to the affected portion of the Services. Customer warrants that it has the full legal authority to enter into these Terms and that it will use the Services in compliance with all applicable laws and regulations.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT AS EXPRESSLY SET FORTH HEREIN, THE SERVICES ARE PROVIDED “AS IS.” AXIARA DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. AXIARA DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR MEET CUSTOMER'S SPECIFIC COMPLIANCE REQUIREMENTS.

NEITHER PARTY SHALL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

AXIARA'S AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATED TO THESE TERMS SHALL NOT EXCEED THE TOTAL FEES PAID BY CUSTOMER TO AXIARA IN THE 12 MONTHS PRECEDING THE CLAIM.

These limitations apply to the fullest extent permitted by applicable Indonesian law. Some jurisdictions do not allow limitations on certain damages, and in those jurisdictions the foregoing limitations shall apply only to the extent permitted by law. The limitations in this Section do not apply to death or personal injury caused by Axiara's gross negligence, fraud, or any liability that cannot be limited or excluded under applicable law.

These Terms commence on Customer's first access to or use of the Services and continue for the Subscription Term set forth in the applicable Order Form. Unless otherwise stated in the Order Form, subscriptions automatically renew for successive terms of equal length unless either party provides at least 30 days' written notice of non-renewal before the end of the then-current term.

Either party may terminate these Terms or the affected Order Form for material breach if the breaching party fails to cure the breach within 30 days after written notice. Either party may also terminate immediately upon written notice if the other party becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to bankruptcy, receivership, liquidation, or similar proceedings. Upon termination or expiration, Customer shall immediately cease using the Services. For SaaS deployments, Axiara will delete Customer Data within 90 days in accordance with the Privacy Policy unless retention is required by law or agreed otherwise in writing. For On-Premise deployments, Customer shall uninstall or disable the On-Premise Software. Sections concerning Definitions, Intellectual Property, Confidentiality, Limitation of Liability, Governing Law and Dispute Resolution, and accrued payment obligations survive termination.

These Terms are governed by the laws of the Republic of Indonesia, without regard to conflict-of-law principles. The parties shall first attempt in good faith to resolve any dispute arising out of or relating to these Terms through amicable negotiation for a period of 30 days after written notice of the dispute.

If the dispute is not resolved through negotiation, it shall be finally submitted to arbitration administered by the Badan Arbitrase Nasional Indonesia (“BANI”) in accordance with its then-current rules. The seat of arbitration shall be Jakarta, and the proceedings shall be conducted in English, or in Indonesian if required by applicable law. Nothing in these Terms prevents either party from seeking interim or injunctive relief from the competent courts of Indonesia. Customer's compliance obligations under POJK 30/2025 and any applicable regulatory reporting obligations under Indonesian law remain unaffected by this dispute resolution clause. These Terms are written in English, and if translated, the English version shall control.