TERMS OF SERVICE
OBVELO — Personal Data Masking Gateway
Version: 1.0 · Published: 2026-09-27 · In force from: 2026-09-27
1. Provider and scope
1.1 These Terms of Service (the "Terms") set out the rules for using OBVELO, provided electronically by Luminote P.S.A. (prosta spółka akcyjna), with its registered office at ul. Olszańska 7, 31-513 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for Kraków-Śródmieście in Kraków under number 0001223956, NIP 6751824986, REGON 543999032 (the "Provider").
1.2 Contact: e-mail support@obvelo.com (support and complaints), security@obvelo.com (data protection and security reports); postal address as in Section 1.1.
1.3 These Terms constitute the terms of service (regulamin) referred to in Article 8 of the Polish Act of 18 July 2002 on the Provision of Electronic Services. They are available free of charge at https://app.obvelo.com/legal/terms before the conclusion of the Agreement, in a form that allows them to be downloaded, stored and reproduced.
1.4 The Data Processing Agreement published at https://app.obvelo.com/legal/dpa (the "DPA") forms an integral part of the Agreement.
2. Definitions
"Agreement" means the agreement for the provision of the Service concluded between the Provider and the Customer, consisting of these Terms, the DPA, the selected Plan and the Price List.
"Customer" means the business entity that registers an Account and accepts these Terms.
"User" means a natural person authorised by the Customer to use the Service on its behalf (including the person registering the Account).
"Service" or "OBVELO" means the service for the detection, masking and restoration of personal data in content, provided by the Provider in the shapes and surfaces described in the Documentation, including the gateway (Proxy Mode), the masking API and SDK (API Mode), the MCP tool gateway, the /app web page, the browser extension and the customer panel.
"Account" means the Customer's account in the Service.
"Plan" means the service plan selected by the Customer (Free, Starter, Standard or Pro, available on a self-service basis, or Enterprise, available under an individual agreement), with the limits and features described in the Price List.
"Price List" means the list of Plans, add-ons, fees and limits published at https://obvelo.com/#pricing.
"Documentation" means the technical documentation of the Service published at https://obvelo.com/docs/, including the description of known limitations.
"Customer Content" means any content sent by or on behalf of the Customer to the Service, including Requests and files, and the Tenant Configuration.
"Third-Party Model Provider" means any language model provider or other downstream endpoint to which the Customer directs the Service, using the Customer's own credentials.
"Business Day" means a day from Monday to Friday, other than a public holiday in Poland.
Other capitalised terms have the meanings given in the DPA.
3. Eligibility
3.1 The Service is intended exclusively for entrepreneurs and other entities acting in the course of business. It is not offered to consumers.
3.2 The person registering the Account represents that they are authorised to conclude the Agreement on behalf of the Customer. If the Customer data given is untrue or the person lacked authority, that person is liable towards the Provider as provided by law.
3.3 A natural person conducting business activity concludes the Agreement as an entrepreneur, on the same terms as any other Customer. By registering, such a person confirms that the Agreement is directly connected with their business activity.
4. Registration and Account
4.1 To use the Service, the Customer must register an Account by: (a) giving the User's e-mail address and choosing a Plan; (b) accepting these Terms and the DPA by ticking the relevant checkbox; and (c) confirming the e-mail address by clicking the link sent to it. Before the first payment, the Customer gives its company name, registered address, country and VAT identification number (or other registration number where the Customer has no VAT number) in the customer panel.
4.2 The Agreement is concluded when the e-mail address is confirmed. Immediately afterwards, the Provider sends the accepted versions of these Terms and the DPA to the Account e-mail address as PDF attachments.
4.3 The Provider may verify the VAT identification number in the VIES system and may refuse a paid Plan, or may close an Account, if the Customer data cannot be verified or is clearly untrue.
4.4 The Customer shall keep its Account data up to date. Notices under the Agreement are sent to the Account e-mail address and are effective when sent to the last address provided.
4.5 The Customer is responsible for the actions of its Users and for keeping API keys and model provider credentials confidential. The Customer shall revoke a compromised API key without delay and notify the Provider of any unauthorised use of the Account.
5. The Service and technical requirements
5.1 Within the Service, the Provider enables the Customer, depending on the Plan: (a) to send content through a gateway that detects and masks personal data, forwards the masked content to a Third-Party Model Provider chosen by the Customer and restores original values in the response; (b) to mask, restore and inspect content through the API without any language model; (c) to mask personal data in text, in supported Office files, csv and text files, in PDF files with a text layer (returned as masked text) and, on Plans with the OCR add-on, in scanned documents and images (returned as masked text); (d) to configure the Service (Tenant Configuration); and (e) to manage API keys, usage and billing in the customer panel. The detailed scope of each feature, including on which surface each file type is masked, is set out in the Documentation and the Price List.
5.2 To use the Service, the Customer needs: (a) a device with Internet access; (b) for the customer panel and /app page — a current version of a common web browser with JavaScript enabled and cookies required for the session allowed; (c) for Proxy Mode and API Mode — an HTTP client supporting TLS 1.2 or higher and, where applicable, an active account and credentials with a Third-Party Model Provider; (d) for the browser extension — a supported browser as listed in the Documentation; and (e) an active e-mail address.
5.3 The Provider informs that using services provided electronically involves typical risks associated with the Internet, such as malware or unauthorised access to data transmitted over public networks. The Customer should use up-to-date software and protect its credentials.
6. Nature of the Service and its limitations
6.1 Risk reduction, not a guarantee. The Service is a technical measure intended to reduce the amount of personal data disclosed to Third-Party Model Providers and other recipients. Detection is based on deterministic rules and a statistical model and is not exhaustive. The Provider does not warrant that every item of personal data will be detected and masked.
6.2 Obligation of means. With respect to detection, the Provider undertakes to provide the Service with due diligence and in accordance with the Documentation. This is an obligation of means, not of result.
6.3 Known limitations. The Provider describes the known limitations of the Service in the Documentation (and in Section 6.2 of the DPA) and keeps that description up to date. The Customer shall read the Documentation before using the Service in production. Use of the Service contrary to the Documentation (including sending content types the Documentation states are not masked on the surface used) is at the Customer's own risk.
6.4 No legal advice; no compliance guarantee. The Service does not constitute legal advice. The Provider does not represent that use of the Service alone ensures the Customer's compliance with data protection laws or any other laws. The Customer remains solely responsible for its compliance, including the assessment of whether the Service, as configured, is suitable for its processing and for any data protection impact assessment.
6.5 Customer configuration. The Customer is responsible for configuring the Service appropriately for its data, including the choice of attachment policy, enabled identifier rules and the coverage profile. Keeping or selecting settings that reduce masking (for example the default flag attachment policy, under which attachments are forwarded unmasked and reported) is the Customer's informed decision.
6.6 After restoration. Content returned to the Customer after restoration is under the Customer's control. The Provider is not responsible for its further use or transmission.
7. Third-Party Model Providers
7.1 The Customer chooses the Third-Party Model Provider, contracts with it directly and uses its own credentials. The Provider does not resell or provide access to any language model and does not call any language model under its own contract.
7.2 By sending content to the gateway's path for a Third-Party Model Provider, or by configuring its own model endpoint, the Customer instructs the Provider to forward masked content to that endpoint. The Customer bears sole responsibility for its relationship with each Third-Party Model Provider, including the lawful basis for disclosure, the data processing agreement and any transfer mechanism required by law.
7.3 The Provider is not responsible for the availability, performance, output, pricing, terms, data retention, model training practices or security of any Third-Party Model Provider, nor for any fees the Customer owes to it.
7.4 Model output may be inaccurate. The Provider does not verify and is not responsible for the content generated by Third-Party Model Providers.
7.5 For security reasons, the gateway connects only to model hosts on an allow-list maintained by the Provider. The Provider may add or remove hosts from the allow-list; the current list is available in the Documentation.
8. Acceptable use
8.1 The Customer shall use the Service in accordance with the law, these Terms and the Documentation, and shall not provide content of an unlawful nature.
8.2 In particular, the Customer shall not: (a) use the Service to process personal data without a lawful basis or in breach of data protection laws; (b) attempt to reverse engineer, decompile, extract or reproduce the Name Recognition Model, detection rules or other components of the Service, except to the extent permitted by mandatory law; (c) circumvent limits, allow-lists, key controls or other security measures; (d) use the Service as an open relay or proxy for purposes other than masking content; (e) carry out load or security tests of the Service without the Provider's prior written consent; (f) resell, sublicense or make the Service available to third parties as a service of their own, without a separate agreement with the Provider; (g) introduce malware or content intended to disrupt the Service; (h) use the Service to build a competing product or dataset.
8.3 Security researchers may report vulnerabilities to security@obvelo.com. The Provider will not pursue claims against persons who report vulnerabilities in good faith, without accessing data of other customers and without disrupting the Service.
9. Plans, fees and payment
9.1 Plans. The Plans, add-ons, their fees, usage limits (measured in characters of content processed and, for the OCR add-on, in pages) and features are set out in the Price List. The Free Plan is provided free of charge within the limits of the Price List.
9.2 Billing periods. Paid self-service Plans are billed for monthly periods or, where the Price List offers it, for annual periods. An annual period is charged at the monthly fee × 12 less the annual discount stated in the Price List (10% for Starter, Standard and Pro). Add-ons and deployments that the Price List offers on annual terms only (such as Pro in the Customer's own infrastructure) carry no annual discount. Prices in the Price List are net prices; VAT is added where applicable. For Customers with a valid EU VAT number outside Poland, the reverse-charge mechanism applies.
9.3 Payment. The fee for a billing period is paid in advance through a payment link issued in the customer panel and processed by Mollie B.V. (Amsterdam, the Netherlands) as the payment service provider. The Provider does not store payment card data and does not charge any payment method automatically.
9.4 Invoices. The Customer consents to receiving invoices electronically. Invoices are issued in accordance with Polish law, including through the National e-Invoicing System (KSeF) where required, and are available in the customer panel.
9.5 Usage limits and overage. Hard usage limits are enabled by default: when a limit is reached, processing is blocked until the next billing period or until the Customer changes its Plan. On paid Plans the Customer may switch the hard limit off in the customer panel; usage above the Plan's limits is then charged at the overage rates in the Price List for the billing period in which it occurs. On the Free Plan the hard limit cannot be switched off.
9.6 Changing Plans. A change of Plan takes effect immediately and is settled pro rata to the days remaining in the current billing period: on an upgrade, the Customer pays the difference between the two Plans for those days; on a downgrade, the difference is credited against the next fee. Credits are not paid out in cash.
9.7 Renewal. A paid Plan continues for further billing periods of the same length until the Customer changes it to the Free Plan or terminates the Agreement. The fee for each further period is due at its start and is paid under Section 9.3.
9.8 Late payment. The fee for a billing period is due on its first day. If it is not paid within 3 days of the due date (grace period), the Provider suspends access to the Data Plane until payment is made; the Customer is notified when the fee falls due and when access is suspended. The Provider may charge statutory interest for late payment in commercial transactions.
9.9 Price changes. The Provider may change the Price List. Changes for existing Customers take effect from the next billing period starting at least 30 days after notice; a paid annual period keeps its price until it ends. A Customer who does not accept the change may cancel before it takes effect.
9.10 Refunds. Fees paid are not refundable, except as expressly provided in these Terms (Sections 16.4 and 18.3) or required by mandatory law.
10. Availability, support and changes to the Service
10.1 The Provider shall use reasonable efforts to ensure the continuous availability of the Service. For Free, Starter, Standard and Pro Plans, no service level (SLA) is guaranteed. Service levels for the Enterprise Plan are agreed separately.
10.2 The Provider may carry out planned maintenance, notifying Customers in advance in the customer panel or by e-mail, where possible outside the business hours of Central European Time.
10.3 Support is provided by e-mail at support@obvelo.com on Business Days. Response times depend on the Plan as described in the Price List.
10.4 The Provider develops the Service and may change its features, provided that the change does not materially reduce the core functionality of the paid Plan used by the Customer during the paid billing period. The Provider notifies Customers of material changes in advance. A change to the API that is not backward compatible will be announced at least 30 days in advance, except where immediate change is necessary for security reasons.
11. Data protection
11.1 The Provider processes personal data contained in Customer Content as a processor on behalf of the Customer, in accordance with the DPA. The DPA prevails over these Terms in matters of processing of such data.
11.2 The Provider processes personal data of Users and Customer contact persons for the purposes of the Agreement, billing and security as an independent controller, in accordance with the Privacy Policy available at https://app.obvelo.com/legal/privacy.
11.3 The Provider does not use Customer Content to train or improve any model, to build dictionaries or datasets, or for any purpose other than providing the Service.
12. Intellectual property
12.1 The Service, including its software, detection rules, the Name Recognition Model, Documentation and trademarks, is the property of the Provider or its licensors and is protected by law.
12.2 For the term of the Agreement, the Provider grants the Customer a non-exclusive, non-transferable, non-sublicensable licence to use the Service, the SDK and the browser extension, within the limits of the Plan, for the Customer's internal business purposes. Open-source components are subject to their own licences as listed in the Documentation. Installation of the Service in the Customer's own infrastructure, including the model weights, requires a separate licence agreement.
12.3 The Customer retains all rights to Customer Content. The Customer grants the Provider a licence to process Customer Content solely to the extent necessary to provide the Service.
12.4 The Provider may use feedback and suggestions from the Customer to develop the Service without any obligation to the Customer, provided the feedback does not identify the Customer or contain Customer Content.
12.5 The Provider may publish aggregated and anonymised statistics on the use of the Service (for example the number of characters processed or detection categories) which do not identify the Customer or contain Customer Content.
13. Confidentiality
13.1 Each Party shall keep confidential any non-public information of the other Party obtained in connection with the Agreement, including information obtained in an audit, and shall use it only for the purposes of the Agreement. This obligation does not apply to information that is publicly available without breach of the Agreement, was lawfully obtained from a third party, or must be disclosed under the law or a decision of a competent authority.
13.2 The confidentiality obligation continues for 3 years after termination of the Agreement, and indefinitely for trade secrets.
14. Liability
14.1 Principles. Each Party is liable for non-performance or improper performance of the Agreement in accordance with Polish law, subject to the limitations below.
14.2 Excluded damage. Neither Party is liable for lost profits (lucrum cessans), loss of revenue, loss of business opportunities, loss of goodwill or indirect or consequential damage.
14.3 Cap. The total liability of the Provider under the Agreement, including the DPA, for all events in any 12-month period is limited to the fees actually paid by the Customer for the Service in the 12 months preceding the event giving rise to liability, and for Customers on the Free Plan to PLN 500. The liability under the DPA and these Terms is aggregated and subject to this one limit.
14.4 Specific exclusions. The Provider is not liable for: (a) the non-detection of personal data where the Service operated in accordance with the Documentation, including within its described limitations; (b) the acts, omissions, processing or output of Third-Party Model Providers; (c) consequences of the Customer's configuration choices, including settings that reduce masking; (d) use of the Service contrary to these Terms or the Documentation; (e) unauthorised use of the Customer's API keys or credentials, unless caused by the Provider; (f) interruptions caused by force majeure, failures of the public Internet or of the Customer's systems.
14.5 Mandatory law. The limitations in this Section do not apply to damage caused intentionally (Article 473 § 2 of the Polish Civil Code), to liability that cannot be limited under mandatory law, or to the Customer's obligation to pay fees. Nothing in this Section limits either Party's liability towards data subjects under Article 82 GDPR; in relations between the Parties, the allocation of such liability follows Article 82(5) GDPR and this Section.
14.6 Customer's indemnity. The Customer shall indemnify the Provider against claims of third parties (including data subjects and Third-Party Model Providers) and against fines, to the extent they arise from Customer Content, from the Customer's lack of a lawful basis for processing or disclosure, or from the Customer's breach of Sections 7 or 8, and shall reimburse reasonable costs of defence, provided that the Provider promptly notifies the Customer of the claim and allows it to participate in the defence.
14.7 Claims period. Claims of the Customer against the Provider must be notified within 12 months of the Customer becoming aware of the event giving rise to them, to the extent permitted by law.
15. Suspension
15.1 The Provider may suspend access to the Service, in whole or in part, where: (a) the Customer fails to pay under Section 9.8; (b) the Customer's use of the Service seriously breaches Section 8 or poses a threat to the security of the Service or other customers; (c) required by law or a decision of a competent authority.
15.2 The Provider notifies the Customer of the suspension and its reason in advance, and where this is not possible due to the urgency of the threat, without delay after suspension. The suspension lasts only as long as necessary to remove its cause.
16. Term and termination
16.1 The Agreement is concluded for an indefinite period. Where a Plan or add-on is taken on annual terms, the Customer may terminate with effect at the end of the paid annual period.
16.2 Termination by the Customer. The Customer may terminate the Agreement at any time by closing the Account in the customer panel. For paid Plans, termination takes effect at the end of the current billing period, and the Service remains available until then; no further period is charged. Until termination takes effect, the Customer may keep the Account in the customer panel. The Provider confirms the closing by e-mail to the Account e-mail address.
16.3 Termination for breach. Either Party may terminate the Agreement with immediate effect if the other Party materially breaches the Agreement and does not remedy the breach within 14 days of receiving a notice specifying it, or if the breach cannot be remedied.
16.4 Termination by the Provider. The Provider may terminate the Agreement with 30 days' notice for important reasons, such as the discontinuation of the Service or of a Plan, a change in the law, or a decision of a competent authority preventing the provision of the Service. In that case, the Provider refunds the pro-rata part of prepaid fees for the period after termination.
16.5 Free Plan. The Provider may close an Account on the Free Plan that has not been used for 12 months, after 30 days' notice to the Account e-mail address.
16.6 Effects of termination. Upon termination, access to the Service ends, API keys are revoked and Customer Content is deleted in accordance with Section 14 of the DPA. Before closing the Account, the Customer may copy its Tenant Configuration from the customer panel.
17. Complaints
17.1 Complaints concerning the Service may be submitted by e-mail to support@obvelo.com. A complaint should include the Customer's name, Account e-mail address, a description of the problem and, where possible, the date, API key identifier and request identifier (without Customer Content).
17.2 The Provider responds to a complaint within 14 days of receipt, by e-mail to the address from which it was sent.
18. Changes to the Terms
18.1 The Provider may amend these Terms for important reasons, such as changes in the law, decisions of competent authorities, changes to the Service, the Price List or the Provider's business, or the need to improve security.
18.2 The Provider notifies the Customer of the amended Terms by e-mail to the Account e-mail address and in the customer panel at least 30 days before they take effect, stating the changes.
18.3 If the Customer does not accept the amended Terms, it may terminate the Agreement with effect before the amendment takes effect, and the Provider refunds the pro-rata part of prepaid fees for the period after termination. Continued use of the Service after the amendment takes effect constitutes acceptance.
18.4 Amendments required by law or a decision of an authority may take effect earlier where the law so requires. Amendments that are exclusively favourable to the Customer (e.g. new features, higher limits) may take effect immediately.
18.5 All previous versions of these Terms remain available on the Provider's website, each under its own address (for example https://app.obvelo.com/legal/terms-1.0.html), with their dates of validity.
19. Mandatory provisions
19.1 Nothing in these Terms excludes or limits rights that mandatory provisions of Polish law grant to a natural person conducting business activity. Where such a provision applies, it prevails over any provision of these Terms incompatible with it.
20. Governing law and jurisdiction
20.1 The Agreement is governed by the laws of the Republic of Poland. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
20.2 Any disputes arising out of or in connection with the Agreement shall be resolved exclusively by the common court having jurisdiction over the registered office of the Provider, i.e. the competent common court in Kraków, Poland.
21. Final provisions
21.1 Order of precedence. In the event of a conflict: (a) the DPA prevails in matters of processing of personal data in Customer Content; (b) an individually signed agreement (e.g. for the Enterprise Plan or for installation in the Customer's own infrastructure) prevails over these Terms; (c) these Terms prevail over the Documentation and the Price List, unless they expressly provide otherwise.
21.2 Force majeure. Neither Party is liable for failure to perform caused by events beyond its reasonable control, which it could not have prevented with due diligence, such as natural disasters, war, pandemics, acts of public authorities, large-scale failures of energy or telecommunications networks, or failures of data centres not attributable to the Party.
21.3 Assignment. The Customer may not assign rights or obligations under the Agreement without the Provider's consent. The Provider may assign the Agreement to a successor of its business or of the Service, notifying the Customer.
21.4 Reference. The Provider may list the Customer's name as a customer only with the Customer's prior consent.
21.5 Point of contact. The single point of contact for authorities of the Member States, the European Commission and the European Board for Digital Services, as well as for recipients of the Service, is support@obvelo.com; communication is possible in Polish and English.
21.6 Severability. If any provision of these Terms is found invalid, the remaining provisions remain in force, and the invalid provision shall be replaced by a valid one that most closely achieves its purpose.
21.7 Language. These Terms are drawn up in English. If a translation is made available, the English version prevails.