Orizon AI — Terms of Service

These terms govern use of the Orizon AI application ("the Service"). They are entered into between Orizon S.r.l., Via Cefalonia 70, 25124 Brescia (BS), Italy, VAT IT04484750981 ("Orizon"), and the organisation that has subscribed to the Service, or the individual using it where no organisation has ("you").

They do not govern browsing the orizon.one website, which is covered by the separate website terms. Where you have signed an order form, master agreement or data processing agreement with Orizon, that document prevails over these terms to the extent of any conflict.

Orizon AI brings documents, meetings, mail and calendar into workspaces and answers questions about them, citing the source of each answer. It is delivered either self-hosted, on infrastructure you control, or as a managed instance operated by Orizon in the European Union. Which applies is set out in your order form.

Orizon may add, change or withdraw features. Where a change materially reduces the functionality you subscribed to, Orizon will give notice as described in the section on changes below.

An account is required. It may be created directly or by signing in with Orizon SSO, Google or Microsoft. You are responsible for the accuracy of the registration details, for keeping credentials confidential, and for everything done through your account. Tell Orizon promptly of any unauthorised use.

The Service is a business product. It is not intended for anyone under 16, and it is not sold to consumers as a consumer product; where an individual nonetheless uses it as a consumer, the section on governing law preserves their mandatory rights.

For the term of your subscription, Orizon grants you a non-exclusive, non-transferable, non-sublicensable right to use the Service for your own internal business purposes, within the limits of your order form.

You may not copy, resell, rent, sublicense or make the Service available to a third party as a service, reverse engineer it except to the extent that restriction is unenforceable under applicable law, remove proprietary notices, or use it to build a competing product.

You will not use the Service to:

• break the law, or infringe the rights of any person
• upload or connect content you have no right to use
• attempt to gain access to another tenant, workspace or account, or to circumvent access controls, usage limits or rate limits
• introduce malware, or interfere with the integrity or performance of the Service
• generate or distribute material that is unlawful, defamatory, or that harasses or endangers a person
• process special categories of personal data, or data of children, unless expressly agreed in writing with Orizon

You retain all rights in the documents, messages, files and other material you upload to, or connect to, the Service ("Customer Content"). Orizon acquires no ownership of it.

You grant Orizon only the limited licence needed to host, index, process and display Customer Content in order to provide the Service to you, and to do so on the instructions of you or your organisation. Nothing in these terms permits Orizon to use Customer Content to train or improve any machine learning or artificial intelligence model, and Orizon does not do so.

As between you and Orizon, you own the output the Service generates for you from your Customer Content. Orizon retains all rights in the Service itself, including its software, models, interfaces and documentation.

The Service connects to third-party accounts through two separate integrations, each consented to on its own. Sign-in identifies the account and, where you choose, lets a Google Drive or OneDrive folder be attached to a workspace. The Mail & Calendar connector is authorised separately for each mailbox and can be revoked per mailbox at any time. Neither is required to use the Service.

The Mail & Calendar connector requests read permissions to display, search and summarise mail, calendar and contacts, and the write permissions needed for you to reply or schedule from the composer. The assistant cannot use those write permissions: sending a message and creating, updating or deleting an event are refused whenever the model requests them and happen only when you press send.

Your use of Google and Microsoft services remains governed by your agreements with those providers. Data obtained through the connectors is handled as described in the Orizon AI privacy notice, which forms part of these terms by reference.

The Service uses language models. Their output can be inaccurate, incomplete, outdated or plainly wrong, and it may appear confident while being none of those things. Answers cite the message, event or file they were drawn from precisely so that you can check them.

You are responsible for reviewing and verifying output before relying on it, and for any decision you take on the basis of it. Output is not legal, financial, medical or other professional advice.

The Service does not take automated decisions producing legal or similarly significant effects. It drafts; a person decides. In particular, no message is sent and no calendar is changed unless you review the draft and press send.

Regulation (EU) 2024/1689 (the AI Act) applies to this Service. Orizon is the provider of the AI system; the customer organisation using it is the deployer. Each role carries its own duties, and this section allocates them.

Transparency (Article 50). The Service identifies itself as an AI system in its interface, so that a person is informed they are interacting with AI at the point of first interaction. Content the Service generates — a drafted reply, a summary, a briefing — is presented as AI-generated within the product, and Orizon is implementing machine-readable marking of generated text in line with Article 50(2) and the transitional deadline of 2 December 2026.

Not a high-risk system, unless you make it one. As supplied, the Service is a general knowledge and productivity assistant and does not fall within any Annex III high-risk category. If you deploy it to make or materially influence decisions about recruitment, promotion, termination, task allocation or monitoring of workers, access to education, creditworthiness, or any other Annex III purpose, that deployment may be high-risk and you assume the deployer obligations that follow, including human oversight, logging and, where applicable, a fundamental rights impact assessment. Such use is outside the intended purpose Orizon states for the Service and requires prior written agreement.

AI literacy (Article 4). Each party will take reasonable measures to ensure that its staff dealing with the Service have a sufficient level of AI literacy. Orizon supports this with product documentation describing what the Service can and cannot do, and with the citations attached to every answer.

Logging. The Service records questions, answers and the sources each answer was drawn from, so that a deployer who needs traceability has it. Retention of those records is as set out in the privacy notice or in your order form.

Orizon aims for continuous availability but does not warrant that the Service will be uninterrupted or error-free. Any availability commitment, and any support response time, is the one stated in your order form; absent one, support is provided during Italian business hours on a commercially reasonable-efforts basis.

Orizon may perform maintenance, and will schedule planned maintenance outside business hours where practicable. For a self-hosted deployment, availability is a function of your own infrastructure and is your responsibility.

Fees, billing period and payment terms are those set out in your order form. Unless it says otherwise, fees are exclusive of VAT and other applicable taxes, and are payable within 30 days of invoice. Orizon may suspend the Service for non-payment after giving written notice and a reasonable opportunity to remedy.

Each party will comply with applicable data protection law. Where Orizon processes personal data on your behalf, it does so as processor on your documented instructions, under a data processing agreement which is available on request and which prevails over these terms on matters of data protection.

How the Service handles personal data, including data from a connected Google or Microsoft account, is described in the Orizon AI privacy notice.

Orizon maintains technical and organisational measures appropriate to a security product: encryption of credentials at rest with AES-256-GCM, encryption in transit, workspace isolation with per-workspace access control, least-privilege access for staff, logging, and ISO/IEC 27001-certified operations.

Orizon will notify you without undue delay after becoming aware of a security incident affecting your data in the managed instance, with the information available at the time and updates as the investigation proceeds. For a self-hosted deployment, detection and notification are yours; Orizon will support your investigation on request.

Where you are subject to Directive (EU) 2022/2555 (NIS2), or to DORA or a comparable regime, Orizon will provide, on reasonable request and subject to confidentiality, the information you need for your own supply-chain due diligence and reporting duties — including our certifications, a description of the measures above, and the incident information described in this section. Any right of audit is the one set out in your order form or data processing agreement.

Each party will keep the other’s confidential information confidential, use it only to perform these terms, and protect it with at least reasonable care. This does not apply to information that is public through no breach, was already lawfully known, is independently developed, or must be disclosed by law — in which case the disclosing party will be told first where lawful.

Orizon warrants that it will provide the Service with reasonable skill and care, and that it has the right to grant the rights it grants here.

Beyond that, and to the fullest extent permitted by law, the Service is provided as is and Orizon disclaims all other warranties, express or implied, including fitness for a particular purpose and non-infringement, and any warranty that the output of the Service will be accurate or complete. Nothing in these terms excludes a warranty that cannot lawfully be excluded.

Neither party excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be excluded or limited under Italian law.

Subject to that, and to the fullest extent permitted by law: neither party is liable for indirect or consequential loss, loss of profit, revenue, goodwill or anticipated savings; and each party’s total aggregate liability arising out of these terms in any twelve-month period is limited to the fees paid or payable by you for the Service in that period.

Orizon is not liable for loss arising from your reliance on Service output that you did not verify, nor, in a self-hosted deployment, for the availability, security or configuration of infrastructure you control.

Orizon will defend you against a third-party claim that the Service, used in accordance with these terms, infringes that party’s intellectual property rights, and will pay the damages finally awarded, provided you notify Orizon promptly, give it control of the defence and reasonable assistance.

You will defend Orizon against a third-party claim arising from Customer Content, from your use of the Service in breach of these terms, or from output you acted on without verification, on the same conditions.

These terms run for the term stated in your order form, or until the account is closed where there is none.

Either party may terminate for material breach that is not remedied within 30 days of written notice. Orizon may suspend access immediately where necessary to protect the security or integrity of the Service, or where required by law, and will tell you as soon as it lawfully can.

On termination your right to use the Service ends. You may export Customer Content for 30 days afterwards, after which Orizon deletes it in accordance with the retention terms in the privacy notice. Disconnecting a mailbox deletes the data indexed from it immediately, as described there.

Orizon may amend these terms. Material changes will be notified through the Service, or by email to the address associated with the account, at least 30 days before they take effect, unless an earlier change is required by law or to address a security risk. Continued use after the effective date constitutes acceptance. If you do not accept a material change, you may terminate before it takes effect and receive a pro-rata refund of fees paid for the unused period.

Neither party is liable for failure to perform caused by events beyond its reasonable control. You may not assign these terms without Orizon’s consent; Orizon may assign them to an affiliate or in connection with a merger or sale of assets. If a provision is held unenforceable, the rest stands. A failure to enforce a right is not a waiver of it. These terms, with your order form and the documents they reference, are the entire agreement between the parties on their subject matter.

These terms are governed by Italian law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The Court of Brescia, Italy has exclusive jurisdiction over any dispute arising out of or in connection with them.

Where you use the Service as a consumer, this clause does not deprive you of the protection of the mandatory provisions of the law of your country of habitual residence, nor of your right to bring proceedings before the courts of that country.