OXTA TERMS OF SERVICE (PUBLIC OFFER)

Version 1.0 · Effective 18 September 2026

Convenience translation. The Ukrainian version prevails (Section 1.4).

1. Who we are and what this is

1.1. These Terms are a public offer by ТОВ «Окста» (Oxta, we), to enter into an agreement for access to the Oxta automation platform on the terms below (Articles 633, 634, 641, 642 of the Civil Code of Ukraine; Article 11 of the Law of Ukraine "On Electronic Commerce").

1.2. The Agreement is concluded with the person who registers an account (Customer, you). Registering an account and ticking the mandatory box accepting these Terms and the Privacy Policy constitutes acceptance. We record which version you accepted and when; you can see these records in settings ("Documents & consents").

1.3. The Privacy Policy, the Data Processing Agreement (DPA) and the AI Features Terms form an integral part of the Agreement. In case of conflict regarding data flowing through your flows, the DPA prevails.

1.4. The Agreement is concluded in Ukrainian. The English version is a convenience translation; the Ukrainian text prevails.

2. Who may use the platform

2.1. The platform is for businesses — online stores, service companies, entrepreneurs — and developers automating processes. By registering you confirm you are at least 18 years old and, if acting for an organisation, authorised to bind it.

2.2. We do not provide access to persons or entities subject to sanctions of Ukraine, the EU, the US or the UN, or to persons located in the russian federation, the Republic of Belarus or temporarily occupied territories of Ukraine. We may close accounts created in breach of this Section.

2.3. If you are a consumer under EU law (an individual acting outside trade or profession), mandatory rules of your country of residence also apply. In particular, you have a 14-day right of withdrawal from a paid subscription from the date of payment. By subscribing you request immediate performance and acknowledge that once the paid period is fully used the right of withdrawal lapses; on withdrawal within the period you are refunded pro rata for the unused part.

3. What the platform is

3.1. Oxta lets you build flows from steps and run them on a schedule, on an external event or on demand. The platform includes: a flow editor; flow execution with run history; file uploads; datasets with vector search; AI nodes and agents; publishing static sites on *.sites.oxta.io; a flow marketplace; connections to external services and your databases.

3.2. We grant you a non-exclusive, non-transferable, revocable right to use the platform during the Agreement under your chosen plan. This excludes copying, modifying or decompiling the platform software.

3.3. We may change, develop and discontinue features. We give at least 30 days' notice before discontinuing a feature your flows depend on.

4. Your account

4.1. An account has a single owner; there is no team access. You are responsible for your password and all activity in the account. We store only an irreversible hash of your password.

4.2. Notify us at support@oxta.io of any suspected unauthorised access. You can sign out all active sessions at once in settings.

4.3. Provide accurate registration details and keep them current. The account time zone determines the local time at which schedules fire.

5. Your data and data flowing through flows

5.1. Two roles. For your account data (e-mail, name, plan, payments) we are the controller — see the Privacy Policy. For everything passing through your flows, files, datasets, sites and connections (Customer Data), you are the controller and we are the processor; we process it solely per your configuration under the DPA.

5.2. You are responsible for lawfulness. You warrant that you have a legal basis to collect Customer Data and send it to the platform and to every external service you connect (Telegram, Slack, Google, SMTP, HTTP endpoints, your database, your AI provider), and that data subjects are duly informed. We do not and cannot verify this.

5.3. Special categories prohibited. The platform is not designed or certified for health, biometric or genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or orientation, criminal convictions and offences, or data of minors collected without guardian consent. Do not pass such data through the platform. If it happens we may suspend the flows or the account and delete the data.

5.4. Run history. The platform stores the full content of every run: inputs, each step's result, variable values, outputs. This enables debugging and replay. Credentials, keys and passwords are redacted automatically, but any other data entering a flow is stored in history within the periods in Section 12. Design flows accordingly.

5.5. You retain all rights in Customer Data. We do not use it for our own purposes, sell it, disclose it to third parties other than DPA sub-processors, or train models on it.

5.6. External credentials (API keys, SMTP passwords, database connection strings) you store on the platform are encrypted. You are responsible for granting them least privilege and revoking them when you stop using the platform.

6. AI features

6.1. AI nodes and agents, the editor assistant and dataset vector search send data to language models. Before you first add an AI node we show the AI Features Terms and ask you to confirm them. They form part of the Agreement.

6.2. By default requests run on Cloudflare Workers AI under our key. You may connect your own key to an OpenAI-API-compatible provider; requests then go directly to it under your contract with it, and we are not responsible for its processing or retention.

6.3. Model outputs may be wrong, are not professional advice and are not guaranteed to be reproducible. Verify results before use.

7. Plans, payment, limits

7.1. Plans and limits are published on the pricing page. Prices are in US dollars; charges are made in the currency of your payment instrument at the payment provider's rate on the transaction date. Prices do not include VAT.

7.2. Unit of account. One run = one complete execution of a flow from first to last step, regardless of step count. AI operations are counted separately; operations on your own key do not consume plan quota.

7.3. Subscription and automatic charging. Paid plans are billed monthly in advance and renew automatically until you cancel. By paying you consent to recurring charges via the payment provider (Universal Bank JSC, Monobank). Card data is processed by the provider; we receive only the result and a masked card number. Cancel any time in settings — access continues to the end of the paid period.

7.4. Purchased packs of runs or AI operations do not expire and are consumed after plan limits are exhausted. Unused packs are forfeited without compensation on account deletion.

7.5. The free plan is available indefinitely within its limits. We may change free-plan limits with 30 days' notice and close free accounts inactive for more than 12 months with 30 days' e-mail notice.

7.6. If a charge fails we retry for 7 days, then downgrade the account to the free plan; flows exceeding its limits stop; data is kept.

7.7. Price changes are notified at least 30 days ahead and apply from the next billing period. Disagreement entitles you to cancel without penalty.

8. Refunds

8.1. Fees for the current subscription month are non-refundable on cancellation, except: (a) a first request within 14 days of first payment — full refund on request; (b) platform unavailability attributable to us exceeding 48 consecutive hours — pro-rata refund; (c) where mandatory law requires (including Section 2.3 for EU consumers).

8.2. Purchased packs are non-refundable once use has begun.

8.3. Refunds go to the original payment instrument within 14 days. Requests: support@oxta.io.

9. Prohibited use

You must not use the platform to:

• send unsolicited messages (spam) via any channel or circumvent messenger or e-mail provider rules;
• overload third-party systems, evade their rate limits, scan or scrape in breach of the source's terms;
• circumvent platform limits, including by creating multiple accounts;
• process personal data without a legal basis or in breach of Section 5.3;
• resell or share access without our written consent;
• host on *.sites.oxta.io or publish in the marketplace unlawful content, malicious code, phishing pages or content infringing others' rights;
• act in violation of the law of Ukraine, the EU or the country where you operate.

We may suspend the account or specific flows on breach, notifying you by e-mail, and unpublish sites or flows subject to a substantiated complaint.

10. Marketplace and sites

10.1. Marketplace. Flows are published by other customers. We do not review them for functionality, safety or legality. The author is responsible for the flow's content and warrants it holds the rights to it. When installing another customer's flow, review it yourself — in particular where it sends data.

10.2. By publishing a flow you grant us and other customers a free, non-exclusive licence to use, copy and adapt it within the platform. You may unpublish; already-installed copies remain with other customers.

10.3. Sites. You are responsible for the content of sites you publish on *.sites.oxta.io and for placing your own legal documents there if you collect visitor data. The subdomain is provided for the term of the Agreement and is not your property.

11. Intellectual property

11.1. Rights in the platform, its code, design, documentation and marks belong to us or our licensors. Rights in your flows, prompts, files, datasets and sites belong to you.

11.2. You may submit improvement suggestions; we may use them without restriction or compensation.

12. Retention and account deletion

12.1. Run history is retained up to the 10,000 most recent runs per flow; older runs are deleted automatically. Daily statistics — 730 days. Snapshots of external-service response structure — 30 days. Details are in the Privacy Policy and DPA.

12.2. Account deletion is available in settings. It deletes flows, agents, datasets, files, sites, connections and counters, closes the subscription and then deletes the account. Final destruction in infrastructure backups occurs within 30 days. Payment records are kept for 3 years for tax and accounting obligations; records of documents you accepted for 3 years after deletion as evidence.

12.3. Export what you need before deleting. Deletion is irreversible.

13. Availability and support

13.1. The platform is provided "as is". We make commercially reasonable efforts to keep it running but do not warrant uninterrupted or error-free operation or that a flow will fire at an exact second. No service-level agreement (SLA) is established by this Agreement.

13.2. Flow operation depends on the external services you connect; we are not responsible for their availability, API changes or limits.

13.3. Support is by e-mail at support@oxta.io on business days.

14. Limitation of liability

14.1. Our aggregate liability under the Agreement is limited to the amount you paid in the 12 months preceding the event giving rise to the claim; for the free plan — USD 20. We are not liable for lost profits, loss of data you did not export, indirect losses, or the consequences of actions performed by flows you configured (including messages sent, requests to third-party systems, changes in your databases).

14.2. These limitations do not apply to liability for intent, death or personal injury, or where mandatory consumer law prohibits limitation.

14.3. You indemnify us for documented losses (including fines and reasonable legal costs) caused by your breach of Sections 5.2, 5.3, 9 and 10.

15. Confidentiality

Each party keeps the other's non-public information received under the Agreement confidential and uses it only to perform the Agreement, for 3 years after termination and, for Customer Data, indefinitely. Public information and information required to be disclosed by law are excepted.

16. Term and termination

16.1. The Agreement runs from registration until account deletion.

16.2. You may terminate at any time by deleting the account.

16.3. We may terminate with 30 days' notice, or immediately on a material breach of Sections 5, 9 or 10 not cured within 7 days of notice, or where required by law. On termination by us without your breach, prepayment for the unused period is refunded.

16.4. If the platform is discontinued entirely we give 90 days' notice and keep export available.

17. Changes to terms

17.1. We may amend these Terms and related documents. Each substantive change is a new document version. Changes that worsen your position or alter data processing are notified by e-mail at least 30 days ahead; on your next sign-in the platform will ask you to accept the new version. Editorial clarifications take effect on publication.

17.2. All versions are archived at oxta.io/legal/archive. If you disagree, you may delete your account before the effective date with a refund of prepayment for the unused period.

18. Notices

Notices to you go to the account e-mail and are deemed received the next business day. Notices to us: support@oxta.io.

19. Governing law and disputes

19.1. Ukrainian law governs the Agreement, without depriving EU consumers of the protection of mandatory rules of their country of residence.

19.2. Disputes are first negotiated; a claim is answered within 20 days. Unresolved disputes go to the competent court at our location unless mandatory law provides another forum. EU consumers may also use the European Commission's ODR platform.

20. Miscellaneous

20.1. Invalidity of a provision does not affect the rest. We may engage subcontractors and remain liable for them; data sub-processors are listed in the DPA.

20.2. The parties recognise electronic documents and actions in the account (tick, click, payment) as expressions of will under the Law of Ukraine "On Electronic Commerce" and Regulation (EU) No 910/2014.

20.3. We are not liable for non-performance due to force majeure, including hostilities, power and connectivity outages and infrastructure-provider failures, provided we notify you within 5 days.

Details: ТОВ «Окста» · support@oxta.io · Data matters: privacy@oxta.io