Terms and Conditions

SOWA Privacy sp. z o.o.
ul. Stanisława Leszczyńskiego 4/25, 50-078 Wrocław, Poland
KRS 0001255530 · VAT ID (NIP) PL8971976110 · info@sowaprivacy.ai
hereinafter the “Provider”

Last updated: 25 October 2026

§ 1 Scope and contracting parties

1. These terms apply to all contracts between the Provider and the customer for the use of the following services:
   • the browser extension SOWA Privacy for Chrome and Chromium-based browsers,
   • the desktop application SOWA Privacy Chat for macOS and Windows,
   • the user account and the organisation management on sowaprivacy.ai.
2. A consumer is any natural person who concludes the contract for purposes that are predominantly outside their trade, business or self-employed profession.
3. A business customer is anyone who, when concluding the contract, acts in the exercise of their trade, business or self-employed profession. Clauses that apply to only one of the two groups are marked accordingly.
4. Deviating terms of the customer do not become part of the contract unless the Provider expressly agrees to their validity in writing.

§ 2 Subject matter and description of services

1. The Provider makes available software that detects personal and other sensitive data in inputs to AI services and replaces it with placeholders before it is sent. Detection takes place locally on the customer’s device.
2. Detection works in three layers: pattern recognition, local models for named-entity recognition and, optionally, a locally run language model.
3. What is owed is detection using the methods described in paragraph 2, in their current version at any given time. These methods work with patterns and statistical models. They can miss a sensitive item and, conversely, mask an item that is not sensitive; complete detection cannot be achieved with the state of the art and is therefore not part of the service. The known limitations published by the Provider describe the service in more detail.
4. Paragraph 3 defines which service is owed. It limits neither the customer’s rights in the event of defects nor the Provider’s liability; §§ 12 and 13 apply to these.
5. The software does not replace an organisation-wide data loss prevention solution or any other security measure. It complements such systems.
6. The Provider develops the software continuously. Changes to functionality are reserved insofar as the purpose of the contract is not impaired and the change is reasonable for the customer.
7. Technical requirements. The extension requires a current version of Google Chrome or another Chromium-based browser that supports Manifest V3 extensions. The desktop application requires a version of macOS or Windows that is still supported by its manufacturer. The user account, the website and the plan check require an internet connection, a current web browser with JavaScript enabled and an email address. The optional local language model additionally requires WebGPU support and 2 to 4 GB of free memory (RAM).

§ 3 Conclusion of the contract

1. Free use of the extension. Installing the extension from the Chrome Web Store concludes a free-of-charge contract of use covering the features of the Starter plan. No user account is required for this.
2. User account. Confirming the registration concludes a free-of-charge contract for the use of the account.
3. Paid plans. The presentation of the plans on the website is not a binding offer. The customer submits their offer by pressing the order button in the payment form. Before doing so, the customer confirms there that they have taken note of these terms and agree to their validity. The contract is concluded upon the Provider’s confirmation in text form (for example by email).
4. Enterprise. Contracts for the Enterprise plan are concluded by individual agreement.

§ 4 Plans and prices

1. All prices include statutory VAT. The applicable tax rate depends on the customer’s billing country.
2. The desktop application SOWA Privacy Chat is included in the Business and Enterprise plans at no extra charge. It is provided through the sales contact; there is no public download.
3. Price changes for ongoing contracts are notified to the customer in text form at least six weeks before they take effect. The customer may terminate the contract, up until the change takes effect, with effect from the date of the change.
4. For consumers, a price change takes effect only if the consumer expressly agrees to it, for example in text form; silence does not count as agreement. If the consumer has not agreed by the intended effective date, the contract continues at the previous price; the Provider may then terminate it with one month’s notice to the end of a billing period.

§ 5 Trial period

1. The Pro and Business plans begin with a free trial period of 14 days. No payment details are collected for this.
2. The subscription is concluded when the order under § 3 (3) is completed. The trial period is free of charge.
3. If the customer has not added a payment method by the end of the trial period, the subscription is paused; no charges are incurred.
4. The paid term begins only once the customer adds a payment method, and no earlier than at the end of the trial period.
5. The customer may cancel the subscription at any time during the trial period. It then ends at the end of the trial period without any charges being incurred.
6. For the Enterprise plan, an individual pilot operation is agreed.

§ 6 Payment and billing

1. Billing takes place in advance for the respective billing period via the payment service provider Stripe. Payment card data is processed exclusively there and does not reach the Provider.
2. For the Business and Enterprise plans, annual invoicing, ordering by purchase order and payment by bank transfer are also available.
3. Adding licences. Licences can be added pro rata at any time; they are billed at the next renewal.
4. Reducing licences. Reductions take effect from the next billing period. There is no billing within a current period. For annual contracts, reductions take effect at renewal.
5. Business customers only: In the event of late payment, the Provider is entitled to block access after prior notice in text form.

§ 7 Term and termination

1. Contracts billed monthly end at the end of the current billing period without any reason having to be given.
2. Contracts billed annually run until the renewal date. There is no automatic renewal without the customer’s confirmation.
3. The right of both parties to terminate for good cause remains unaffected.
4. Termination must be made in text form. Contracts for the Pro plan can also be terminated without signing in via the cancellation button, which can be reached through the link “Cancel contracts here” in the footer of every page of the website, and, after signing in, via the customer portal. Contracts for the Business and Enterprise plans are terminated with the sales contact or at info@sowaprivacy.ai.
5. The Provider confirms receipt of a termination without delay in text form, stating its content, the date and time of receipt and the point in time at which the contract ends.
6. After the end of the contract, the Provider makes the data export available to the customer for 30 days. The export includes in particular the dictionary, templates and the audit log history.

§ 8 Right of withdrawal for consumers

1. Consumers have a statutory right of withdrawal. The details are set out in the withdrawal instructions, which also contain the model withdrawal form. The withdrawal can also be declared via the withdrawal function “Withdraw from contract” in the footer of every page of the website.

§ 9 Duties and obligations of the customer

1. The customer keeps their access credentials secret and does not pass them on to third parties. A user account is assigned to one natural person.
2. The customer refrains from circumventing protection mechanisms of the software, reverse engineering it or reproducing it beyond the scope granted.
3. The customer remains responsible for the lawfulness of the content they transmit to AI services. The customer checks the masking before sending on their own responsibility, insofar as this can reasonably be expected of them.
4. The customer’s relationship with the providers of the AI services used is governed exclusively by their terms. The Provider is not a party to those contracts.
5. Business customers only: The customer informs the users assigned to them of the limitations under § 2 (3).
6. The customer must not supply content of an unlawful nature in connection with the services, in particular not via the user account, the organisation management or the Provider’s contact and support channels.

§ 10 Rights of use

1. For the term of the contract, the customer receives a simple, non-exclusive, non-transferable right to use the software as intended within the scope of the plan booked.
2. Sublicensing, renting or making the software available to third parties is excluded. For the Business and Enterprise plans, this does not apply to use by the users named by the customer within the licences booked.
3. The source code of the detection core can be inspected (“source-available”) but is not open source. Inspection requires a separate confidentiality agreement. It does not establish any right to use, reproduce, modify or pass on the source code, nor any rights of use beyond this contract.

§ 11 Availability, support and complaints

1. Detection runs locally on the device and does not require any service of the Provider to be available.
2. For the website and the account management, the Provider does not owe any particular availability unless separately agreed. Maintenance windows are announced where possible.
3. The scope of support depends on the plan booked. For the Enterprise plan, a response time of four hours applies.
4. Complaints. The customer sends complaints about the services by email to info@sowaprivacy.ai or in writing to the Provider’s address stated above. The complaint should contain the customer’s name, their email address (for a user account, the account’s address) and a description of the problem; a complaint with missing details remains valid.
5. The Provider answers complaints in text form within 14 days of receipt. If the Provider does not answer a consumer’s complaint in time, the complaint is deemed accepted (Art. 7a of the Polish Consumer Rights Act of 30 May 2014).
6. The customer’s statutory rights in the event of defects (§ 12) remain unaffected.

§ 12 Warranty

1. The Provider makes the software available in the condition owed under § 2 and maintains it in this condition during the term of the contract. This includes the updates required for this purpose.
2. For consumers, the statutory provisions on the supply of digital content and digital services apply without restriction, in particular Chapter 5b (Art. 43h et seq.) of the Polish Consumer Rights Act of 30 May 2014 and the provisions of the state of the consumer’s habitual residence that apply mandatorily under § 16 (1). The same applies to natural persons for whom the contract is not of a professional nature under Art. 7aa of that Act.
3. For business customers, except the persons referred to in paragraph 2 sentence 2, the statutory provisions apply with the proviso that defects must be notified in text form without delay after their discovery.

§ 13 Liability

1. The Provider is liable without limitation for intent and gross negligence, for culpable injury to life, body or health, for fraudulent concealment of a defect, to the extent of a guarantee given and under the mandatory provisions on product liability (currently Art. 449¹ et seq. of the Polish Civil Code).
2. In the case of slight negligence, the Provider is liable only for the breach of essential contractual obligations, that is, obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the customer may regularly rely. This includes in particular the provision of detection under § 2 (2) and (3). In this case, liability is limited to the damage typical for the contract and foreseeable at the time the contract was concluded.
3. Otherwise, liability for slight negligence is excluded.
4. The above limitations of liability also apply in favour of the Provider’s corporate bodies, employees and vicarious agents.

§ 14 Data protection

1. Details of the processing are set out in the Provider’s privacy policy.
2. Insofar as the Provider processes personal data on behalf of the customer, the parties conclude a data processing agreement under Art. 28 GDPR. Within its scope, that agreement takes precedence over these terms.
3. The subprocessors used, their purpose and their location are set out in the privacy policy.
4. Audit events are logged only after prior activation by the customer. What is logged are events, not the content of inputs.

§ 15 Changes to these terms

1. The Provider may change these terms with effect for the future if there is a valid reason for doing so and the change is reasonable for the customer. Valid reasons are a change in the law, a decision of an authority or a court, the remedying of a security risk, the change or extension of functions under § 2 (6) and the clarification of unclear provisions. The change is notified to the customer in text form at least six weeks before it is intended to take effect.
2. Business customers only: If the customer does not object before the change takes effect, the change is deemed accepted. The notification specifically points out this consequence.
3. For consumers, a change takes effect only if the consumer expressly agrees to it, for example in text form; silence does not count as agreement. The consumer may terminate the contract, up until the change takes effect, with effect from the date of the change. If the consumer has not agreed by the intended effective date, the contract continues on the previous terms; the Provider may then terminate it with one month’s notice to the end of a billing period.

§ 16 Final provisions

1. Polish law applies, excluding the UN Convention on Contracts for the International Sale of Goods. For consumers, mandatory consumer protection provisions of the state in which the consumer has their habitual residence remain unaffected; for consumers with habitual residence in Germany, German consumer law applies to that extent.
2. Business customers only: The exclusive place of jurisdiction for all disputes arising from this contract is the Provider’s registered office.
3. The Provider is neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.
4. Should any provision be invalid, the validity of the remaining provisions remains unaffected.
5. These terms are provided in German, English and Polish. The language version that was presented to the customer when the contract was concluded and that the customer accepted is binding. For consumers who are Polish citizens and have their place of residence in Poland, the Polish version is the basis of interpretation (Art. 8 (1a) of the Polish Act on the Polish Language of 7 October 1999). Discrepancies between the language versions shall not be interpreted to the detriment of a consumer. In relation to business customers, the Polish version prevails in the event of discrepancies.