Terms of service

These terms apply to the use of Deltawall: the console at app.deltawall.ai, the browser extension and the AI gateway (together, ‘the service’). The service is provided by Deltawall B.V., Dutch Chamber of Commerce no. 42169421, De Boelelaan 1095 A, 1081 HV Amsterdam, the Netherlands (‘we’, ‘us’). The service is intended for organisations only, not for consumers.

1. Scope

These terms apply to every agreement between us and an organisation that uses the service (‘the customer’). Anyone who signs up an organisation or uses the service on its behalf confirms they are authorised to bind that organisation.

Price, term, numbers of users and any service levels are agreed per customer in a quote or order form (‘the order’). In case of conflict, the order prevails over these terms, and these terms prevail over the data processing agreement except where personal data is concerned.

The customer's own general terms and conditions do not apply unless we accept them in writing.

2. The service

The service lets the customer set policy for its employees' use of AI tools. The extension detects sensitive data on the employee's device and masks, blocks or warns according to that policy. The console shows the customer what happens and provides evidence for audits.

Detection is never complete. Automatic detection can miss sensitive data or flag data that is not sensitive, and only works in supported browsers, on supported AI sites, and while the extension is active and connected. AI sites change their pages; it can take some time before the extension is updated. The service is a tool that reduces risk, not a guarantee that no data reaches an AI tool. The customer remains responsible for protecting its data.

We may improve and change the service. If we remove a material feature the customer pays for, we give at least 30 days' notice.

3. Accounts

The customer appoints administrators and is responsible for what they do in the console. Administrators keep their sign-in details secret and report misuse to us immediately.

Employees connect the extension with their work email address. The customer ensures only its own employees and contractors are added.

4. The customer's responsibilities

The service processes data about employees' behaviour. The customer is the controller for this and ensures, among other things, that:

• it has a valid legal basis for the processing and informs its employees clearly, in advance, about the extension and what it does;
• it carries out a data protection impact assessment (DPIA) where required;
• it involves the works council where the law requires it; in the Netherlands a system like this may require the works council's consent under article 27 of the Works Councils Act;
• the policy it sets suits its organisation and complies with the law;
• it only installs the extension on devices and browsers it manages or is permitted to.

We provide tools for this (such as a DPIA template and information for the works council), but they are not legal advice.

5. Acceptable use

The customer and its users will not:

• use the service in breach of the law or of others' rights;
• use the service to monitor people outside their own organisation;
• attempt to circumvent, decrypt, decompile or reproduce the service, except where mandatory law allows it;
• load the service more than is reasonable, or use it to attack or test our systems or anyone else's without our written permission;
• resell the service or make it available to third parties without our permission.

Found a security issue? Report it to security@deltawall.ai.

6. Other parties' AI services

ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek and other AI services belong to other parties. What a user sends to such a service is governed by that party's terms. We are not responsible for those services, for what they do with data or for their availability. With the AI gateway, the customer chooses the provider and remains responsible for its use.

7. Fees and payment

Fees are set out in the order and exclude VAT. We invoice as stated in the order; invoices are payable within 30 days.

Late payment bears the Dutch statutory commercial interest. If payment is still outstanding 14 days after a written reminder, we may suspend the service until payment is made.

We may adjust fees once a year with at least 60 days' notice. If the customer does not agree, it may terminate the agreement as of the date the new fees take effect.

8. Personal data

For personal data we process on the customer's behalf, we conclude a data processing agreement with the customer that meets article 28 GDPR. How we handle personal data is further described in our privacy policy: https://deltawall.ai/privacy

The text employees type into AI tools and the contents of their files do not leave their device towards us; see the privacy policy for what is sent.

9. Confidentiality

We and the customer keep each other's confidential information secret and use it only for the agreement. This does not apply to information that is already public, that a party already lawfully had, or that it must disclose by law. This obligation survives the end of the agreement.

10. Intellectual property

All rights in the service, the software, the extension, the detection model and the documentation remain with us or our licensors. For the term of the agreement the customer receives a non-exclusive, non-transferable right to use the service for its own organisation.

The customer's data remains the customer's. We may freely use feedback about the service to improve it.

11. Availability and support

We do our best to keep the service available and to schedule maintenance so it causes little disruption. A guaranteed service level only applies if agreed in the order.

If the console or server cannot be reached, the extension applies the last policy it received.

12. Liability

Our total liability per year is limited to the amount the customer paid us for the service in the 12 months before the event that caused the damage.

We are not liable for indirect damage, including consequential damage, lost profit, lost savings, loss of data, reputational damage and fines from regulators, nor for damage because the service did not detect sensitive data (see article 2).

These limitations do not apply in case of intent or deliberate recklessness on the part of us or our management.

A claim lapses if the customer has not reported the damage to us in writing within 12 months of discovering it.

13. Term, suspension and termination

The term is set out in the order. If nothing is stated, the agreement runs for an indefinite period and either party may terminate it with one month's notice to the end of a calendar month.

We may suspend access immediately where needed to stop a serious security risk or abuse, and will inform the customer straight away.

Either party may terminate the agreement if the other fails to perform a material obligation and does not remedy it within 30 days of a written notice of default, or if the other is declared bankrupt or granted a suspension of payments.

After the end, the customer can export its data or ask us for it for 30 days. We delete it within 90 days of the end, unless the law requires us to keep it longer. The customer removes the extension from the devices it manages.

14. Changes to these terms

We may change these terms. We notify the customer's administrators at least 30 days in advance. If the customer does not agree with a material change to its disadvantage, it may terminate as of the date the change takes effect.

15. Governing law and disputes

These terms and the agreement are governed by Dutch law; the United Nations Convention on Contracts for the International Sale of Goods does not apply. Disputes are submitted to the competent court in the district where we have our registered office.

16. Other

If a provision is invalid, the others remain in force and we replace the invalid provision with a valid one that comes as close to it as possible.

These terms exist in Dutch and English. In case of any difference, the Dutch text prevails.

Contact: privacy@deltawall.ai.