Terms and Conditions

Introduction

Effective Date: June 2026 | Last Updated: September 2026

These Terms of Service ("Terms") govern your access to and use of the Y Intelligence platform ("Y") and the website y-institute.com, provided by Y-Institute, trading as Y-Institute ("Y-Institute", "we", "us", "our"), a private limited company (besloten vennootschap) incorporated in the Netherlands. By creating an account, accepting an invitation to a Workspace, placing an order or using Y, you agree to these Terms. If you do not agree, do not use Y.

The Privacy Policy, Cookies Policy, Refund Policy, Cancellation Policy, Delivery Policy and Pricing page form part of these Terms. Dutch law and the law of the European Union apply. If you are a Consumer, nothing in these Terms takes away a right that mandatory Dutch or EU consumer law gives you (see section 24).

1 Who we are

The following information is provided under Article 5 of Directive 2000/31/EC (the E-Commerce Directive), Article 3:15d of the Dutch Civil Code (Burgerlijk Wetboek, "BW") and the Dutch Commercial Register Act (Handelsregisterwet 2007):

2 How these Terms apply

2.1 Self-service customers. If you sign up on y-institute.com or in the Y app and pay by card or another online method, these Terms and the policies they reference are the complete agreement between you and us.

2.2 Business customers under a Subscription Agreement. Organisations may subscribe under a signed Y SaaS Subscription Agreement with its order form and schedules (a "Subscription Agreement"). Where a Subscription Agreement conflicts with these Terms, the Subscription Agreement prevails for that customer. Everything else in these Terms continues to apply.

2.3 Resellers. Y is also sold and supported by independent authorised resellers. A reseller contracts with you in its own name for its price, invoicing and any implementation or support services it provides. These Terms govern your and your Named Users' use of Y regardless of who invoices you, and a reseller cannot vary them. Resellers are not our agents, do not hold exclusive territories and cannot bind us.

2.4 Named Users. Every person who signs in to a Workspace accepts these Terms for their own use of Y. The Workspace owner is responsible for its Named Users' compliance and for having the right to give them access.

2.5 Consumers and business customers. Some provisions apply only to Consumers (see the definition in section 3) and are marked as such. Where a provision would be unenforceable against a Consumer under mandatory law, it applies only to business customers.

2.6 Order of precedence. (1) a signed Subscription Agreement and its order form; (2) these Terms; (3) the Pricing page and the policies listed above; (4) the Documentation.

2.7 Concluding the contract electronically. As required by Article 10 of the E-Commerce Directive and Article 6:227b BW: you conclude a contract with us by completing the sign-up or checkout steps and clicking the confirmation button; before confirming you can review and correct your entries on the summary screen; we send a confirmation email and store the contract, which you can view in Billing; the contract is concluded in English; a copy of these Terms can be saved or printed from this page. We do not subscribe to a code of conduct.

3 Definitions

• AI Output: text, images, audio, video, assessments, scores or other material generated by Y's AI features in response to a prompt or instruction.
• Bonus Credits: Credits granted free with a larger top-up, expiring 12 months after the top-up.
• Business Day: Monday to Friday, excluding public holidays in the Netherlands. Business Hours: 08:00 to 17:00 Central European Time (CET, or CEST when summer time applies) on Business Days.
• Client Data: all documents, knowledge, prompts, conversations, lessons, courses, assessments, results, images, audio, messages and other content that you or your Named Users upload to, connect to or generate in your Workspace, including personal data in it.
• Consumer: a natural person who uses Y for purposes outside their trade, business, craft or profession, within the meaning of Article 6:230g(1)(a) BW and Article 2(1) of Directive 2011/83/EU.
• Credits: the usage units in which Y meters AI actions and other consumption. Included Credits come with a Plan each month; Purchased Credits are bought as top-ups; Bonus Credits are defined above.
• Documentation: the help content, admin guides and API reference we publish for Y.
• GDPR: Regulation (EU) 2016/679 (General Data Protection Regulation), together with the Dutch GDPR Implementation Act (Uitvoeringswet AVG, "UAVG"). Terms such as controller, processor, personal data, data subject and supervisory authority have the meanings given in the GDPR.
• Named User: an individual who has been given access to a Workspace by its owner or administrator.
• Plan: a subscription tier described on the Pricing page (Personal, Pro, Team, Business, Scale or Enterprise).
• Term: the period of a fixed-term subscription, comprising the Initial Term and any Renewal Term.
• Service Credits: the credits against fees payable for availability shortfalls under section 14.
• Workspace: a tenant in Y that holds an organisation's or individual's Client Data, Named Users, Plan and Credits. The Workspace owner is the person or organisation that created the Workspace or holds the owner role.

4 Eligibility and accounts

4.1 You must be at least 18 years old and have legal capacity to create an account or place an order. If you accept these Terms for an organisation, you confirm that you are authorised to bind it.

4.2 Younger Named Users. A Workspace owner such as a school, club or family may enrol Named Users under 18. Where a Named User is under 16, the Workspace owner must hold the consent of the holder of parental responsibility or another lawful basis under Article 8 GDPR and Article 5 UAVG, and must tell us so that we can apply the settings appropriate for that Workspace. We do not knowingly allow anyone under 16 to create their own account.

4.3 You are responsible for keeping credentials, API keys and one-time codes confidential, for enabling multi-factor authentication where offered, and for all activity under your account until you tell us at [email protected] that it has been compromised.

4.4 You must give accurate account, contact and billing details and keep them current. If we find your details are inaccurate or your use exceeds your Plan, we will give you 10 Business Days to put it right before we act under section 16.

4.5 You may sign in with a Microsoft or Google account or your organisation's identity provider. Those providers' terms govern your relationship with them.

5 Plans, Credits and usage

5.1 Each Plan has the limits shown on the Pricing page (Named Users, connected tools, storage, channels and Included Credits). We may enforce limits technically.

5.2 Credits. One Credit has a value of €0.005 (200 Credits per euro). Every AI action has a Credit cost that is shown in the app before expensive actions and in the Credit history afterwards. Credits are consumed in this order: Included, then Bonus, then Purchased.

5.3 Included Credits are added at the start of each monthly period. 20% of unused Included Credits roll over and remain available for 12 months; the rest lapse at the end of the period.

5.4 Purchased Credits never expire while your Workspace exists. Bonus Credits expire 12 months after the top-up that granted them.

5.5 When your Credit balance reaches zero, Y pauses AI actions until you top up, unless a Workspace administrator has enabled overage billing or auto top-up, in which case use continues at the overage rate on the Pricing page.

5.6 Excess use. If you exceed a Plan limit other than Credits (for example seats or storage), we will notify you and you have 10 Business Days to upgrade or reduce use. After that we may charge the applicable overage rate or restrict the excess.

5.7 We may apply reasonable rate limits and fair-use safeguards to protect the platform for all customers; these never reduce the Credits you have paid for.

5.8 Credits have no cash value except as the Refund Policy provides and cannot be transferred between Workspaces.

6 Fees, payment and VAT

6.1 Fees are as stated on the Pricing page or in your Subscription Agreement, in euro, payable in advance for each billing period. Fees for self-service Plans are charged on the day you subscribe and on each renewal date.

6.2 Payment. Self-service payments are made by card, iDEAL, SEPA Direct Debit or another method offered at checkout, through our payment processor, [PAYMENT PROCESSOR], which is authorised as a payment institution in the European Union and is certified under PCI DSS. We store only a payment token, never your full card number. By enabling auto top-up or a recurring Plan you authorise recurring charges to the saved method until you cancel. Subscription Agreement customers pay by bank transfer against invoice within 30 days of the invoice date, or as the agreement states.

6.3 VAT. Fees are subject to value added tax under Council Directive 2006/112/EC and the Dutch Turnover Tax Act 1968 (Wet op de omzetbelasting 1968). (a) Consumers and other non-business customers in the Netherlands pay Dutch VAT at the standard rate (currently 21%). (b) Consumers in other EU Member States pay VAT at the rate of their Member State, which we account for through the EU One Stop Shop. (c) Business customers established in another EU Member State that provide a valid VAT identification number are invoiced without Dutch VAT and must account for VAT under the reverse-charge mechanism (Article 196 of Directive 2006/112/EC). (d) Customers outside the EU are invoiced without EU VAT and are responsible for any tax due in their own jurisdiction. Prices shown to Consumers before payment include VAT, as Directive 98/6/EC and Article 6(1)(e) of Directive 2011/83/EU require.

6.4 Invoices. We issue an electronic invoice meeting the requirements of Article 35a of the Dutch Turnover Tax Act for every payment. It is emailed to the billing contact and available in Billing.

6.5 Late payment. If a business customer does not pay by the due date, we may charge statutory commercial interest under Article 6:119a BW (implementing Directive 2011/7/EU) from the due date and recover reasonable collection costs under Article 6:96 BW. If a Consumer does not pay, we will first send a reminder giving 14 days to pay, and only then charge statutory interest under Article 6:119 BW and the collection costs permitted by the Dutch Extrajudicial Collection Costs Decree (Besluit vergoeding voor buitengerechtelijke incassokosten).

6.6 Disputed invoices. Tell us in writing within 10 Business Days of the invoice date what you dispute and why; pay the undisputed part on time. We will not suspend for a fee that is disputed in good faith while we resolve it.

6.7 If undisputed fees remain unpaid 10 Business Days after we (or your reseller) have sent you written notice, we may suspend access under section 16.

6.8 Change of invoicing party. If we or a reseller transfer invoicing to another party (for example if a reseller arrangement ends), we will give you at least 20 Business Days' written notice. Your Plan, price for the current Term and Client Data are unaffected.

6.9 A reseller sets its own prices and payment terms for the customers it invoices. The Pricing page shows our list prices for direct purchases.

7 Term, renewal, cancellation and the right of withdrawal

7.1 Monthly Plans run month to month from the date you subscribe and renew automatically each month until cancelled. You may cancel at any time with effect from the end of the month you have paid for. The Cancellation Policy explains how.

7.2 Fixed-term subscriptions (business customers). Annual prepaid Plans and Subscription Agreements run for an Initial Term of 12 months unless the order says otherwise, and renew automatically for further 12-month Renewal Terms unless either party gives written notice of non-renewal at least 60 days before the current Term ends. A business customer cannot terminate a fixed-term subscription for convenience during a Term, but may terminate early in the circumstances in sections 13, 14, 15, 17 and 25.

7.3 Fixed-term subscriptions (Consumers). If you are a Consumer on an annual Plan, Article 6:236 under j BW applies: at the end of the Initial Term your subscription is not renewed for a further fixed term but continues for an indefinite period at the then-current monthly price, and you may cancel at any time on one month's notice. We will remind you by email before the Initial Term ends and tell you what will apply afterwards.

7.4 Right of withdrawal (Consumers). Under Article 6:230o BW (implementing Article 9 of Directive 2011/83/EU) you may withdraw from a contract concluded at a distance within 14 days of the day it was concluded, without giving a reason. To withdraw, send an unequivocal statement to [email protected] (you may use the model withdrawal form in the Refund Policy) or use the withdrawal function in Billing where it is offered. We refund all payments received from you within 14 days of your withdrawal, using the same payment method (Article 6:230r BW). Because Y is a digital service that starts immediately, you expressly request that we begin performance during the withdrawal period when you subscribe. If you withdraw after performance has begun, you pay a proportionate amount for the service supplied up to the moment of withdrawal (Article 6:230s(4) BW), which we calculate as the greater of the pro rata Plan fee for the days used and the value of Credits consumed. Purchased Credits that have been consumed are treated as digital content for which performance began at your express request, and the right of withdrawal no longer applies to them (Article 6:230p BW). The Refund Policy sets out our additional goodwill rules, which go further than the law requires.

7.5 Trials and pilots. Either party may end a trial or pilot on 5 Business Days' notice. Trials carry no fees unless agreed, no service levels and no automatic conversion. Trial data is deleted 30 days after a trial ends without a subscription.

8 Acceptable use

8.1 You and your Named Users must not use Y to:

• store, generate or distribute content that is unlawful under Dutch or EU law or the law of the place where you use Y, including child sexual abuse material, terrorist content within the meaning of Regulation (EU) 2021/784, incitement to violence or hatred, or content that defames or harasses;
• infringe any copyright, database right, trade mark, trade secret or other right, or upload material you do not have the right to use;
• process personal data of others without a lawful basis under Article 6 GDPR, or special categories of personal data (Article 9 GDPR) without a valid exemption and without telling us;
• send unsolicited electronic communications in breach of Article 11.7 of the Dutch Telecommunications Act (Telecommunicatiewet) or Article 13 of Directive 2002/58/EC;
• engage in a practice prohibited by Article 5 of Regulation (EU) 2024/1689 (the AI Act), including deploying manipulative or deceptive techniques that distort behaviour and cause significant harm, exploiting vulnerabilities of age or disability, social scoring, inferring the emotions of people in workplaces or education institutions, biometric categorisation to deduce protected characteristics, or untargeted scraping of facial images;
• use Y for medical, legal, financial or other professional advice to third parties without qualified human review, or in any context where an error could cause death, personal injury or severe damage;
• introduce malware, probe or test the security of Y without our written permission, circumvent Credit metering, rate limits or tenant isolation, or access another Workspace;
• scrape, copy, resell, sublicense or offer Y or AI Output as a competing service, or use AI Output to train a competing model;
• misrepresent AI Output as human-authored where the law requires disclosure (section 9.2), or impersonate any person or organisation.

8.2 Reporting unlawful content. As a hosting service under Regulation (EU) 2022/2065 (the Digital Services Act) we operate a notice mechanism: anyone may report content they believe is unlawful to [email protected], stating where it is, why it is unlawful and their contact details. We act on well-founded notices without undue delay, tell the affected Workspace owner what we did and why, and allow them to contest the decision by replying within 10 Business Days. Our single point of contact for authorities and users under Articles 11 and 12 of that Regulation is [email protected].

8.3 We may remove or disable access to content, and suspend or terminate access, as sections 16 and 17 describe. Workspace owners are responsible for content moderation within their own Workspace.

9 AI features

9.1 How Y works. Y answers questions, tutors, generates lessons, courses, images, audio and video, marks assessments and runs agents by sending your prompt, the relevant passages retrieved from your Workspace and any attached file to general-purpose AI models operated by third-party providers. We do not train a model on your data. The current providers are Anthropic PBC, OpenAI LLC and OpenRouter Inc (United States) for language models, embeddings, speech-to-text and image generation, and Microsoft Corporation (Azure AI Speech, EU region where available) for speech. The Privacy Policy lists them with their locations; a change is treated as a sub-processor change under section 12.3.

9.2 Transparency (AI Act Article 50). Y tells Named Users that they are interacting with an AI system, and every surface that shows AI Output carries the notice "Y uses AI and can make mistakes. Check important information." Where technically feasible, AI-generated images, audio and video produced by Y carry machine-readable markings as Article 50(2) of Regulation (EU) 2024/1689 requires. If you publish AI Output that depicts real people or events, or AI-generated text on matters of public interest, you are responsible for the disclosures Article 50(4) requires of deployers.

9.3 Accuracy. AI Output is generated statistically and may be inaccurate, incomplete, out of date, biased or inappropriate, even when it appears confident. You must review AI Output before relying on it or giving it to others. AI Output is not professional advice.

9.4 Human oversight and automated decisions. Y's assessment marking, knowledge-gap detection, recommendations and classifications are decision-support features. They must not be used to take decisions that produce legal or similarly significant effects on a person based solely on automated processing, contrary to Article 22 GDPR, unless the Workspace owner has ensured a lawful exception, human review and the right for the person to contest the decision. A Workspace owner that uses Y to determine access or admission to education, to evaluate learning outcomes that steer a person's learning path, to assess the appropriate level of education for a person or to monitor prohibited behaviour during tests may be a deployer of a high-risk AI system under Annex III, point 3 of the AI Act and is responsible for the deployer obligations in Article 26 of that Regulation. We will give Workspace owners the information about Y they reasonably need for that purpose.

9.5 Interaction log. We keep a log of prompts, retrieved context references, tool calls and AI Output for at least 12 months for security, billing, quality and dispute resolution. Workspace administrators can review conversation and agent history in the admin console; Named Users can see their own history.

9.6 No training; limited retention. Our contracts with AI providers prohibit them from using your content to train their models, limit their retention to what is needed to return the output plus abuse monitoring of not more than 30 days, and require zero retention where the provider offers it. Providers receive only the content of each request, never your whole Workspace.

9.7 Your inputs. Do not include in prompts more personal data or confidential information than the task needs. Workspace administrators can restrict which knowledge is available to which roles.

10 Your content and AI Output

10.1 Ownership. You (or the Workspace owner) retain all rights in Client Data. You grant us a non-exclusive, worldwide, royalty-free licence to host, copy, index, transmit, display and process Client Data only as needed to provide, secure and support Y and to comply with law. The licence ends when the Client Data is deleted under section 18.

10.2 Your responsibility. You warrant that you have the rights, consents and lawful bases needed to upload Client Data and to have Y process it, including for material protected by copyright or by a text-and-data-mining reservation under Article 4 of Directive (EU) 2019/790.

10.3 AI Output. Under EU copyright law, works must be the author's own intellectual creation to be protected, and AI Output generated without sufficient human creative input may not be protected at all. To the extent any intellectual property right does subsist in AI Output generated in your Workspace, we assign it to you (or the Workspace owner) on creation, and you may use it for any lawful purpose. Because models generate output statistically, similar or identical output may be produced for other customers and we do not warrant that AI Output is original, accurate or free of third-party rights.

10.4 Trade secrets. Client Data that qualifies as a trade secret under Directive (EU) 2016/943 and the Dutch Trade Secrets Act (Wet bescherming bedrijfsgeheimen) remains yours, and we protect it under section 20.

10.5 Feedback. If you give us suggestions about Y, we may use them without obligation to you. We will not identify you as the source without your consent.

10.6 Usage data. We may use aggregated, de-identified data about how Y is used to operate, secure and improve Y. It never identifies you, your Named Users or your Client Data.

11 Our intellectual property

11.1 Y, its software, models we configure, prompts, Documentation, designs, trade marks and all improvements are owned by us or our licensors and are protected by Dutch and EU law, including the Dutch Copyright Act (Auteurswet), Directive 2009/24/EC on the legal protection of computer programs and Directive 96/9/EC on databases.

11.2 We grant you a non-exclusive, non-transferable right to access and use Y during your subscription, for your internal purposes and in accordance with these Terms. You must not copy, modify, decompile or create derivative works of Y except where Articles 5 and 6 of Directive 2009/24/EC give you a right that cannot be excluded, remove notices, or use our trade marks without permission.

11.3 Y includes open-source components licensed under their own terms, which apply to those components.

12 Data protection (GDPR processor terms)

12.1 Roles. We are the controller of personal data about account holders, billing contacts and website visitors, as the Privacy Policy describes. For personal data in Client Data, the Workspace owner is the controller and we are the processor. This section 12 is the contract required by Article 28(3) GDPR between the Workspace owner and us, and its subject matter, duration, nature and purpose, the types of personal data and the categories of data subjects are set out in the Privacy Policy and this section.

12.2 Our obligations as processor. We will: (a) process personal data in Client Data only on the Workspace owner's documented instructions, which are these Terms, the Subscription Agreement, the configuration of the Workspace and the use of Y by its Named Users, including as regards transfers to a third country, unless EU or Dutch law requires otherwise, in which case we tell the Workspace owner before processing unless the law prohibits it; (b) ensure that everyone we authorise to process the data is bound by confidentiality; (c) implement the technical and organisational measures in section 12.5, as Article 32 GDPR requires; (d) engage sub-processors only as section 12.3 allows; (e) help the Workspace owner respond to data-subject requests under Articles 15 to 22 GDPR, by forwarding any request we receive within 2 Business Days and by providing the export, correction and deletion tools in Y; (f) help the Workspace owner meet its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us; (g) at the end of the subscription, delete or return all personal data as section 18 describes, unless EU or Dutch law requires storage; (h) make available the information needed to demonstrate compliance with Article 28 GDPR and allow and contribute to audits as section 12.7 describes; and (i) inform the Workspace owner immediately if, in our opinion, an instruction infringes the GDPR or other EU or Dutch data protection law.

12.3 Sub-processors. The Workspace owner gives general written authorisation under Article 28(2) GDPR for the sub-processors listed in the Privacy Policy. We will give at least 30 Business Days' notice by email to Workspace administrators before adding or replacing a sub-processor that will process Client Data. If the Workspace owner objects on reasonable data protection grounds within that period and we cannot resolve the objection, the Workspace owner may terminate the affected subscription and we refund prepaid fees for the unexpired period. We impose the same data protection obligations on each sub-processor as this section imposes on us and remain fully liable to the Workspace owner for their performance (Article 28(4) GDPR).

12.4 Personal data breaches. If we become aware of a personal data breach affecting Client Data, we will notify the Workspace owner without undue delay and in any event within 24 hours, with the information Article 33(3) GDPR requires as it becomes available, so that the Workspace owner can meet its 72-hour notification duty to the Autoriteit Persoonsgegevens under Article 33 and its duty to data subjects under Article 34. Where we are the controller we notify the Autoriteit Persoonsgegevens within 72 hours where required.

12.5 Security measures. Encryption in transit (TLS 1.2 or higher) and at rest (AES-256); multi-factor authentication for our staff and available to all Named Users; role-based, least-privilege access reviewed quarterly; tenant isolation enforced at the retrieval and storage layers; personal identity data held in a separate identity service so that content systems refer to people by identifier only; secrets in a managed key vault; security and access logs retained 12 months; vulnerability remediation targets of 7 days (critical), 30 days (high) and 90 days (medium); annual independent penetration testing; no Client Data in development or test environments; encrypted backups every 24 hours retained 30 days within the EU with restore tests at least every 6 months; and a documented incident response process.

12.6 Data protection impact assessments. On request we provide the description of Y's processing that a Workspace owner needs to carry out an assessment under Article 35 GDPR.

12.7 Audits. We provide, on request, our current security summary, penetration test summary and sub-processor list. A Workspace owner under a Subscription Agreement may, no more than once in any 12 months and on 20 Business Days' notice, audit our compliance with this section itself or through an independent auditor bound by confidentiality, during Business Hours, at its own cost and without disrupting other customers, or more often where a supervisory authority requires it.

12.8 Workspace owner obligations. The Workspace owner is responsible for the lawfulness of the personal data it and its Named Users put into Y, for providing the information Articles 13 and 14 GDPR require to its data subjects, for the conditions in Articles 8 and 9 GDPR where it processes data of children or special categories of data, and for configuring roles and knowledge access appropriately.

12.9 Duration. This section applies for as long as we process personal data in Client Data, including the transition and deletion periods in section 18.

13 Data location, international transfers and switching

13.1 Hosting in the EU. The Y platform, your account data, Client Data, search indexes, interaction logs and encrypted backups are hosted in Microsoft Azure data centres in the European Union (West Europe region, Netherlands). Our infrastructure is subject to the jurisdiction of the Netherlands and the European Union.

13.2 Transfers outside the EU. The following processing involves recipients outside the European Economic Area, each under a transfer mechanism in Chapter V GDPR: (a) AI model inference by the providers in section 9.1 in the United States, for the duration of each request and any permitted abuse-monitoring retention, under the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914 (Article 46(2)(c) GDPR) and, where the provider is certified, the EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795), supported by transfer impact assessments and supplementary measures including encryption in transit, data minimisation and short retention; (b) WhatsApp messages, which pass through the infrastructure of Meta Platforms Ireland Limited and its affiliates under Meta's Business Messaging terms and transfer mechanisms; (c) Microsoft Teams messages, which are processed in the Microsoft 365 region of your own tenant; (d) published video assets served from a global content delivery network so that they load quickly for viewers. The Privacy Policy gives the detail.

13.3 New locations. We will not store Client Data at rest outside the EU, or add a processing location outside the EU for Client Data, without giving Workspace owners at least 60 Business Days' notice. A Workspace owner that does not accept the change may terminate the affected subscription before it takes effect and we refund prepaid fees for the unexpired period.

13.4 Government access. If a public authority outside the EU requests access to Client Data, we will challenge the request where there are reasonable grounds, provide only the minimum required, and tell the Workspace owner unless the law prohibits it, in line with Article 32 of Regulation (EU) 2023/2854 (the Data Act) and Article 48 GDPR.

13.5 Switching and export (Data Act, Articles 23 to 31). You may switch away from Y at any time. Your cancellation or non-renewal notice is also your switching notice; the maximum notice period is 2 months. You can export all Client Data at any time through the export functions in a commonly used, machine-readable format, and on request we deliver a complete export within 10 Business Days. The exportable data, its formats and the export process are described in the Documentation. After your subscription ends you have a transition period of 30 days (extendable once on request, and up to 90 days under a Subscription Agreement) during which your Client Data remains available for retrieval. We do not charge switching fees; until 12 January 2027 we may pass on only the direct costs of an unusually large export, and from that date no switching or egress charges apply. Because Y is a software service, functional equivalence in a destination service is not within our control.

13.6 Individuals may also exercise their right to data portability under Article 20 GDPR as the Privacy Policy describes.

14 Service levels and support

14.1 Availability. We target at least 99.5% availability in each calendar month. Y is unavailable when Named Users cannot sign in or a core function fails for at least 5 consecutive minutes, excluding scheduled maintenance, force majeure, and causes on your side or at your third-party providers (including Meta, Microsoft and your identity provider).

14.2 Service Credits (Subscription Agreement customers). If monthly availability falls below 99.5% we credit the next invoice: 5% of that month's fees below 99.5%; 10% below 99.0%; 20% below 98.0%; 30% below 95.0%; plus an additional 10% for any single outage longer than 8 Business Hours. Service Credits are capped at 100% of one month's fees and at three months' fees in any rolling 12 months. Claim within 20 Business Days after month end; we respond within 10 Business Days. If availability is below 99.5% in 3 consecutive months or in 4 months in any 12, you may terminate on 20 Business Days' notice and we refund all prepaid unexpired fees.

14.3 Self-service customers. If Y is unavailable to you for more than 8 consecutive Business Hours in a month, tell us and we credit 10% of that month's Plan fee as Credits or, if you prefer, as a refund.

14.4 Support. Support is available by email at [email protected], in the app, and by telephone or WhatsApp on [TELEPHONE NUMBER] during Business Hours. Response targets are: Severity 1 (Y unavailable or a core function failing for all users of a Workspace) response within 1 Business Hour, workaround within 4 Business Hours, resolution target 8 Business Hours; Severity 2 (major function impaired for many users, no reasonable workaround) 4 Business Hours, 1 Business Day, 3 Business Days; Severity 3 (minor function impaired or workaround exists) 1 Business Day, 5 Business Days, next release; Severity 4 (question, cosmetic issue, feature request) response within 2 Business Days. We monitor for Severity 1 incidents around the clock. These are commitments under a Subscription Agreement and service goals for self-service Plans. Where a reseller provides first-line support, we support the reseller within the same targets.

14.5 Maintenance. Scheduled maintenance takes place on Saturdays between 20:00 and 24:00 CET/CEST, is limited to 4 hours per month, and is announced to administrators at least 5 Business Days in advance. Emergency maintenance to address a security or stability risk may happen at any time; we notify administrators within 24 hours.

14.6 Incidents. During a Severity 1 incident we update administrators at least every 2 Business Hours until resolved and provide a written summary within 5 Business Days. Subscription Agreement customers receive a monthly availability report within 10 Business Days of month end.

14.7 Backups and recovery. Client Data is backed up at least every 24 hours to encrypted storage in the EU and retained for 30 days, with a recovery point objective of 24 hours and a recovery time objective of 8 Business Hours, tested at least every 6 months.

15 Changes to Y, to these Terms and to prices

15.1 Changes to Y. We improve Y continuously and may change features, provided Y continues to conform to what you subscribed to. For Consumers, Article 19 of Directive (EU) 2019/770 (implemented in Book 7, Title 1AA BW) applies: we may modify Y beyond what is needed to keep it in conformity only for a valid reason stated in these Terms (security, legal compliance, technical adaptation, improvement of features), without additional cost, and with clear notice. If a modification negatively affects your access to or use of Y in more than a minor way, we notify you at least 30 days in advance and you may terminate free of charge within 30 days of the notice or of the modification, whichever is later, with a pro rata refund.

15.2 Material adverse change (business customers). If a change materially reduces the functionality, security or performance of Y for you, tell us within 30 days. If we do not remedy it within a further 30 days, you may terminate the affected Plan or module on 20 Business Days' notice with a pro rata refund of prepaid fees.

15.3 Feature withdrawal and discontinuation. We give at least 6 months' notice before withdrawing a material feature, and at least 6 months' notice if we discontinue Y or your Plan altogether, in which case we refund prepaid unexpired fees. You may terminate on receipt of such a notice with a pro rata refund.

15.4 API changes. We give at least 60 days' notice of a breaking change to the API or the connector protocol and run the old version in parallel during that period where reasonably possible.

15.5 Changes to these Terms. We may amend these Terms by publishing the new version here and emailing account holders at least 30 days before it takes effect (immediately where required by law or to address a security risk, in which case we tell you why). If you do not accept the change, you may terminate before it takes effect: monthly Plans end at the end of the paid month; fixed-term customers may reject the change in writing within 20 Business Days of notice and either continue on the old Terms until the Term ends or terminate with a pro rata refund. Continued use after the effective date is acceptance.

15.6 Price changes. We may change monthly Plan prices and Credit costs with at least 30 days' notice; the new price applies from your next renewal, and you may cancel before then. For fixed-term subscriptions we give at least 90 days' notice before a Renewal Term, and increases are capped at the change in the Dutch consumer price index published by Statistics Netherlands (CBS) plus 3 percentage points, unless you agree otherwise; if we propose more, you may reject the increase within 20 Business Days and your subscription ends at the end of the current Term without penalty. A Consumer may in every case cancel a subscription in response to a price increase before it takes effect.

16 Suspension

16.1 We may suspend some or all access to a Workspace if: (a) undisputed fees remain unpaid 10 Business Days after written notice; (b) there is a material breach of section 8 or 9; (c) continued access poses a genuine security risk to Y, other customers or third parties; (d) the law, a court or a competent authority requires it; or (e) the account holder is declared bankrupt (faillissement), granted a suspension of payments (surseance van betaling) or enters an equivalent procedure.

16.2 Except in cases (b) to (d) we give notice and a reasonable chance to remedy first. Suspension is limited to what is necessary. Client Data stays intact and available for export during a suspension. Fees continue to accrue if the suspension is caused by your breach. We restore access within 2 Business Days after the cause is remedied, without a reactivation fee.

17 Termination

17.1 By you. You may end a monthly Plan at any time (section 7.1), withdraw as a Consumer (section 7.4), decline to renew a fixed term (section 7.2), and terminate early in the circumstances in sections 12.3, 13.3, 14.2, 15, 21, 23 and 25, or if we commit a material breach that we do not remedy within 20 Business Days of your written notice.

17.2 By us. We may terminate your subscription if you commit a material breach of these Terms and do not remedy it within 20 Business Days of written notice (10 Business Days for a repeat of a breach we have already notified); immediately for a serious or irremediable breach of section 8 or 9, for insolvency as described in section 16.1(e), or where continuing would be unlawful. We do not terminate a paid fixed-term subscription for convenience during its Term.

17.3 Effect. Termination for your breach does not entitle you to a refund for the current period, and a business customer on a fixed term remains liable for the fees for the rest of the Term. Termination for our breach, or under a right in section 17.1, entitles you to a pro rata refund of prepaid unexpired fees.

18 What happens after termination

18.1 Export. Export your Client Data before the end of the transition period using the export functions, or ask us for a complete export, which we deliver within 10 Business Days free of charge on the first request after termination.

18.2 Transition. After a paid subscription ends you have 30 days (up to 90 days under a Subscription Agreement) of read-only access to export. Full access during the transition is available at pro rata fees, unless the subscription ended for our breach, in which case it is free.

18.3 Deletion. After the later of the end of the transition period and 30 days after termination, we delete Client Data from live systems and from backups within a further 90 days, and confirm deletion in writing on request. We retain only: the interaction log for its 12-month security retention; invoices, payment and tax records for 7 years after the end of the financial year as Article 52 of the Dutch General Tax Act (Algemene wet inzake rijksbelastingen) and Article 2:10 BW require; and information needed for a pending dispute, restricted to that purpose.

18.4 No lien. We never withhold Client Data because of unpaid fees.

18.5 Survival. Sections 6 (for amounts due), 10, 11, 12, 18, 20, 22, 23, 26 and 28 survive termination

19 Channels, connectors and the API

19.1 WhatsApp. If your Workspace enables WhatsApp, you connect your own WhatsApp Business number through Meta's embedded sign-up and accept Meta's Business Messaging terms. Meta's per-conversation charges are passed through at cost plus the platform fee shown in Billing. You are responsible for the consents your recipients must give before you message them (section 8.1).

19.2 Microsoft Teams. Your Microsoft 365 administrator must approve the Y app. Microsoft's terms govern your tenant.

19.3 Connectors. Connectors let Y read from, and where you allow it write to, your own systems through an agent you install. You control which systems, permissions and tools are exposed. We access those systems only to fulfil a request from a Named User with the permissions you granted.

19.4 API and MCP clients. API keys are confidential and tied to your Workspace. You are responsible for the applications and AI clients you connect and for their compliance with these Terms.

19.5 Third parties. We are not responsible for the availability, changes or charges of Meta, Microsoft, Google or the systems you connect, but we will help you resolve issues with them where we can.

20 Confidentiality

20.1 Each party will keep the other's confidential information (including Client Data, pricing, security information and non-public information about Y) confidential, use it only for the purposes of the agreement, and protect it with at least reasonable care, for the duration of the agreement and 5 years afterwards, and for trade secrets for as long as they remain trade secrets under Directive (EU) 2016/943.

20.2 Exceptions: information that is public without breach, already known, independently developed, or that must be disclosed by law or court order, in which case the disclosing party gives notice where lawful and discloses only what is required.

21 Warranties and conformity

21.1 Business customers. We warrant that Y will perform materially as described in the Documentation and that we will provide it with reasonable skill and care. If it does not, tell us and we will repair or re-perform within 30 Business Days; if we fail, you may terminate the affected Plan or module with a pro rata refund. Except as stated in these Terms and any Subscription Agreement, Y is provided without other warranties, and we do not warrant that Y will be uninterrupted or error-free or that AI Output will be accurate, complete or fit for a particular purpose.

21.2 Consumers. If you are a Consumer, Y must conform to the contract as Articles 7 and 8 of Directive (EU) 2019/770 and Book 7, Title 1AA BW require, including the features, security and updates you can reasonably expect. If Y does not conform, you have the remedies in Article 14 of that Directive: you may require us to bring Y into conformity within a reasonable time free of charge; if we fail or it is impossible, you may reduce the price proportionately or, unless the lack of conformity is minor, terminate the contract and receive a refund of the price for the period of non-conformity. For a continuous supply such as Y, we bear the burden of proving conformity during the whole subscription period. Nothing in section 21.1 limits these rights.

21.3 We are not responsible for a lack of conformity caused by your own systems, network, browser or third-party providers, by Client Data, or by use contrary to these Terms.

22 Liability

22.1 Nothing limits liability for death or personal injury caused by negligence, for intent or deliberate recklessness (opzet of bewuste roekeloosheid) of a party or its management, for fraud, or for anything that cannot be limited under mandatory Dutch or EU law.

22.2 Business customers. Subject to 22.1, each party's total liability arising out of or in connection with the agreement in any 12-month period, whether in contract, tort (onrechtmatige daad) or otherwise, is limited to the fees paid or payable by the customer in the 12 months before the event giving rise to the claim, or €500 if greater; and neither party is liable for indirect or consequential loss, loss of profit, revenue, goodwill or anticipated savings, or for loss of data where a current backup or export was available to the customer. A Subscription Agreement may set a different cap for data protection and confidentiality breaches.

22.3 Consumers. If you are a Consumer, we are liable under the law for damage caused by our failure to perform the contract, and we do not exclude that liability. To the extent Article 6:237 under f BW permits, we are not liable for loss that was not reasonably foreseeable when the contract was concluded, and our liability for other loss is limited to the higher of €500 and the amount you paid us in the 12 months before the event. These limits do not apply in the cases in 22.1 or where Dutch law does not allow them.

22.4 AI Output. We are not liable for loss resulting from reliance on AI Output that you have not reviewed as section 9.3 requires, or from your use of AI Output in a context excluded by section 8.

22.5 Your liability. You are liable for loss we suffer because of your breach of section 8 or 10.2, subject to 22.1 and, for business customers, 22.2.

23 Indemnities

23.1 By us. We defend you against any third-party claim that Y (excluding Client Data, AI Output derived from Client Data, and third-party systems) infringes an intellectual property right valid in the European Economic Area, and pay damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, we may modify or replace Y so that it no longer infringes, or, if we cannot, terminate the affected Plan and refund prepaid unexpired fees. This is your sole remedy for such claims. It does not apply to the extent the claim arises from Client Data, use contrary to these Terms, or combination with items we did not supply.

23.2 By business customers. A business customer defends us against third-party claims arising from its Client Data, its use of AI Output, or its or its Named Users' breach of sections 8 or 12.8, and pays damages and costs finally awarded or agreed in settlement.

23.3 Procedure. The indemnified party must notify promptly, give reasonable cooperation, and allow the indemnifying party to control the defence, and may not settle without the indemnifying party's consent, which will not be unreasonably withheld.

24 Your rights as a Consumer

24.1 If you are a Consumer, these Terms do not limit your rights under the mandatory provisions of Dutch and EU law, in particular: Book 6, Title 5, Section 2b BW (distance contracts, Articles 6:230g to 6:230z, implementing Directive 2011/83/EU as amended by Directives (EU) 2019/2161 and (EU) 2023/2673); Book 6, Title 5, Section 3 BW (general terms and conditions, Articles 6:231 to 6:247, implementing Directive 93/13/EEC); Book 7, Title 1AA BW (digital content and digital services, implementing Directive (EU) 2019/770); and Articles 6:193a to 6:193j BW (unfair commercial practices, implementing Directive 2005/29/EC).

24.2 Consumers outside the Netherlands. Under Article 6 of Regulation (EC) No 593/2008 (Rome I) you also keep the protection of the mandatory consumer law of the country where you habitually reside, and under Articles 17 to 19 of Regulation (EU) No 1215/2012 (Brussels I bis) you may bring proceedings in the courts of that country. These Terms are in English and directed at customers in the EU.

24.3 Complaints. Send complaints to [email protected]. We acknowledge within 2 Business Days and give a substantive reply within 10 Business Days, or tell you when to expect one if we need longer.

24.4 Alternative dispute resolution. Directive 2013/11/EU and the Dutch Consumer ADR Implementation Act (Implementatiewet buitengerechtelijke geschillenbeslechting consumenten) allow consumer disputes to be submitted to a certified dispute resolution body. We are not currently registered with such a body, but we will consider a request to use one for an individual dispute. You may also seek advice from ACM ConsuWijzer (www.consuwijzer.nl) or, for cross-border disputes, your local European Consumer Centre.

25 Force majeure

25.1 Neither party is liable for a failure to perform caused by circumstances that cannot be attributed to it within the meaning of Article 6:75 BW, including natural disaster, war, terrorism, epidemic, government action, widespread failure of the internet or of a cloud or telecommunications provider outside its reasonable control, or a cyber attack that reasonable security measures could not prevent. Inability to pay is never force majeure.

25.2 The affected party must notify the other promptly, take reasonable steps to mitigate, and resume performance as soon as possible. If the event prevents performance for more than 30 consecutive days, either party may terminate the affected subscription and we refund prepaid fees for the unexpired period.

26 Governing law and disputes

26.1 These Terms and any dispute arising out of or in connection with them are governed by the law of the Netherlands. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

26.2 Business customers. The courts of Amsterdam (Rechtbank Amsterdam) have exclusive jurisdiction, without prejudice to either party's right to seek interim relief in any competent court. The parties will first attempt in good faith to resolve any dispute through discussion between senior representatives for at least 20 Business Days after written notice, and may agree to mediation under the rules of the Mediatorsfederatie Nederland (MfN).

26.3 Consumers. If you are a Consumer, the court that is competent under the law has jurisdiction. If we bring a claim against you before the Rechtbank Amsterdam, you have one month after we invoke this clause in writing to choose instead the court competent under the law (Article 6:236 under n BW). Section 24.2 applies to Consumers resident outside the Netherlands.

27 Notices

27.1 Notices to us must be sent by email to [email protected] (legal notices, disputes, data protection) or [email protected] (cancellations, billing, refunds), or by post to our registered address in section 1.

27.2 Notices to you are sent to the email address of the account holder or the Workspace administrators, or shown in the app. You must keep these current.

27.3 An email notice is deemed received on the Business Day it is sent if sent before 17:00 CET/CEST, and otherwise at 09:00 on  the next Business Day. Postal notices are deemed received 3 Business Days after posting within the Netherlands.

28 General

28.1 Entire agreement. These Terms, the documents they incorporate and any Subscription Agreement are the entire agreement between us and replace all earlier discussions. Each party acknowledges that it has not relied on any statement not set out in them, without prejudice to liability for fraud or to mandatory consumer law.

28.2 Assignment. You may not assign or transfer the agreement without our written consent, not to be unreasonably withheld. We may assign it to an affiliate or to a successor to our business on written notice to you, provided your rights are not reduced. We may use subcontractors, and remain responsible for them.

28.3 Severability. If a provision is invalid or unenforceable, it is replaced by a valid provision that comes as close as possible to its intent, and the rest remains in force.

28.4 Waiver. A failure to enforce a right is not a waiver of it.

28.5 Third parties. Except for Named Users' right to use Y as these Terms allow, no third party has rights under these Terms.

28.6 Language. These Terms are concluded in English. If we publish a Dutch translation, the English version prevails in case of conflict, except where mandatory law requires otherwise for Consumers.

28.7 Electronic signatures and records. Contracts, notices and consents given electronically, including electronic signatures within the meaning of Regulation (EU) No 910/2014 (eIDAS), are valid and binding.

28.8 Sanctions and export control. You confirm that you and your Named Users are not subject to EU or Dutch sanctions and will not use Y in breach of Regulation (EU) 2021/821 on dual-use items or applicable sanctions regulations.

28.9 Independent parties. Nothing in these Terms creates a partnership, joint venture or agency between us, or between us and any reseller.

28.10 Interpretation. Headings are for convenience. "Including" means "including without limitation". References to legislation include amendments and replacements.

29 Contact

Y-Institute trading as Y-Institute

Registered office: 

Chamber of Commerce (KvK):  | VAT: 

Legal notices and data protection: [email protected]

Support, billing, cancellations and refunds: [email protected]

Security incidents and unlawful-content notices: [email protected]

Telephone: