Terms of Service

1. Introduction & acceptance

These Terms of Service (the “Terms”) govern your access to and use of the AdaptivMapr platform, including the public website at adaptivmapr.com, the REST API under /v1, the embeddable Workbench, the MCP server, and any vertical template packs (collectively, the “Services”). The Services are provided by AdaptivMapr (“AdaptivMapr”, “we”, “us”).

AdaptivMapr provides a data adaptation engine that maps arbitrary tabular inputs (CSV, Excel, SQL exports, JSON, XML) to a target schema you define, returning structured rows ready for ingestion into your downstream system. The mapping cascade itself is stateless by design — it holds no state between requests — but account metadata, audit logs, and clamped upload samples are persisted (Supabase, EU region) as described in our Security page and DPA. We sell this capability to businesses (“Customers”) through a usage-metered subscription.

By creating an account, generating an API key, or otherwise using the Services, you confirm that (a) you have authority to bind the entity you represent to these Terms, (b) you are at least 18 years old, and (c) you accept these Terms in full. If you do not agree, you must not use the Services.

2. The Services

The Services consist of:

• REST API — endpoints under https://api.adaptivmapr.com/v1 that accept schema inputs (headers plus optional sample rows) and return column-by-column mapping recommendations, transformations, and validation results.
• MCP server — a Model Context Protocol surface allowing AI agents to invoke the same cascade tools (mapr.suggest, mapr.commit, mapr.validate) on behalf of an authenticated workspace.
• Workbench — an embeddable web UI that wraps the API for human-in-the-loop mapping confirmation; can be self-hosted or embedded via iframe.
• Vertical packs — curated bundles of templates, validators, and hints for specific industries (healthcare, finance, logistics). Pack availability depends on your subscription tier.

The Services operate in one of two modes:

• Schema-only mode — only column headers and up to three sample row values per column (truncated to 80 characters each) leave your environment. This mode is the default and minimizes data exposure to header and sample metadata. A DPA/BAA may still be required depending on whether those samples contain personal/health data; we provide one on request.
• Full-data mode — invoked only when an active AdaptivMapr subscription is attached to the API key. The cascade runs in-process; the layer-5 LLM call routes through phi-cloud, which carries the downstream in-region LLM processing under its own BAA. AdaptivMapr offers its own BAA covering its role as a business associate.

3. Account & API keys

You may sign up for an account at /signup. Upon signup we issue you a workspace and one or more HMAC-signed API keys. Keys are self-contained, scoped credentials; they encode workspace identity, the mode they may use, and any rate limit overrides.

• You are responsible for keeping your API keys confidential. Anyone holding a valid key can make billable calls on your behalf.
• You must rotate keys promptly if you suspect compromise. Rotation is available from the dashboard or via API.
• We may suspend keys that exhibit abuse patterns (e.g. credential stuffing, sustained 5xx amplification, scraping) without notice if required to protect the platform; we will notify you as soon as practicable.
• Each workspace may have multiple users with role-based access (Owner, Admin, Developer, Viewer). You are responsible for ensuring access is granted on a need-to-use basis.

4. Acceptable use

You agree not to:

• Use the Services to process content that is unlawful, defamatory, infringing, or that you do not have the right to process;
• Attempt to reverse-engineer, decompile, or extract training data from the Services beyond what is permitted by applicable law;
• Circumvent rate limits, quotas, or access controls (including by rotating identities, distributing a single workspace across unrelated end customers, or by using residential proxies to evade per-account metering);
• Resell, white-label, or rebrand the Services without a written reseller agreement;
• Use the Services for any safety-critical application without independent human review of every output (the cascade includes an AI layer that may produce incorrect mappings);
• Use the Services in a way that violates export controls, sanctions laws, or applicable data protection laws.

You acknowledge that the production rate limits enforced by lib/rateLimit.ts are part of the product contract — sustained attempts to defeat them are a material breach of these Terms.

5. Customer data & confidentiality

We take a deliberately minimal approach to handling your data.

5.1 Schema-only mode

• Only column header text and up to three sample row values per column (each truncated to 80 characters) leave your network.
• We do not retain row content beyond the transient processing window your workspace selects. Clamped upload samples are held under that window — destroyed at commit, or 24 hours (the default), 7 days or 30 days — written into a hard Cloudflare KV expirationTtl at create time, mirrored to Supabase EU, and swept on expiry or on commit, as described in our Security page and DPA. The window is shown on each upload as expires_at.
• We may retain anonymized header text + chosen target field pairs in our mapping_statistics learning table to improve the deterministic and heuristic layers of the cascade. You may opt out from your workspace settings; opt-out applies prospectively.

5.2 Full-data mode

• Full-data mode requires a AdaptivMapr subscription. The cascade runs in-process; the layer-5 LLM call routes through phi-cloud, which carries the downstream in-region LLM processing under its own BAA;
• AdaptivMapr does not train on full-row content; row payloads are processed transiently and not retained beyond the 24-hour upload window described in section 5.1;
• Downstream LLM retention windows and incident-response timelines for the layer-5 call are governed by the phi-cloud BAA / DPA.

5.3 No training on customer data

We do not use your data to train third-party foundation models. The learning table referenced above stores only header-to-target mappings — not row values — and is used to improve the deterministic statistics layer of the cascade, never to fine-tune external LLMs.

5.4 Confidentiality

Each party will protect the other's Confidential Information with at least the same degree of care it uses to protect its own confidential information of like importance, and in no event less than a reasonable standard of care.

6. Subscription & billing

6.1 Plans

• Pay-as-you-go — a prepaid token wallet (minimum top-up published on the pricing page), shared across the phi-cloud suite. Every map draws a small flat fee, including deterministic maps; schema-only mode (a data-minimization mode) is available throughout. DPA/BAA available on request, no SLA.
• Full-data — usage-metered (per accepted mapping decision, plus the phi-cloud tokens AI cleanup, convert and reshape consume), schema-only and phi-cloud-delegated full-data mode, signed DPA on request, business-hours SLA.
• Enterprise — committed-volume pricing, IP allow-list, single-tenant deployment option, custom data residency, 24×7 SLA.

6.2 Metering and overages

Billing is processed by Stripe; we never see your card number. Usage is metered per accepted mapping decision and reported to Stripe via the meter event API. Overages above your committed volume are billed at the published per-unit price, prorated to the closing of the billing period.

6.3 BYO-LLM-key discount

If you provide your own foundation-model API key (OpenAI, Anthropic, Mistral) we deduct the LLM cost component from your per-call price. Your key is encrypted at rest with envelope encryption (KMS-managed keys) and is used only to fulfil your own requests.

6.4 Payment and late payment

Invoices are issued monthly and are payable within 14 days of issue. Overdue invoices accrue interest at 5% per annum (or the maximum rate permitted by Swiss law if lower). We may suspend the Services if an invoice remains unpaid 30 days after its due date and we have given written notice.

6.5 Refunds

• Usage-based charges are non-refundable once incurred.
• Prepaid committed volume is refundable on a pro-rated basis if we materially breach these Terms and fail to cure within 30 days of notice.
• We do not offer satisfaction-based refunds for production usage that has already been served.

7. Intellectual property

AdaptivMapr (or its licensors) retain all right, title, and interest in and to the Services, including the cascade algorithms, the template catalogue, validator implementations, the Workbench UI, and the documentation. Nothing in these Terms transfers ownership of any of the foregoing to you.

You retain all right, title, and interest in your inputs (file content, custom schema definitions, custom hints). You grant us a worldwide, non-exclusive, royalty-free licence to process your inputs solely to provide and improve the Services, subject to the data-handling commitments in section 5.

Built-in templates are licensed to you for use within the Services only. You may not extract, redistribute, or build a competing mapping catalogue from them.

8. Warranties & disclaimers

We warrant that we will provide the Services with reasonable skill and care, and that we have the right to grant the licences set out in these Terms.

Except as expressly set out above, the Services are provided “as is” and “as available”. To the maximum extent permitted by applicable law, we disclaim all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, completeness, and uninterrupted availability.

The cascade includes an AI layer that is probabilistic. While the auto-accept thresholds ({minN: 100, minRatio: 0.95} and {minN: 20, minRatio: 1.00}) are tuned for production, you remain responsible for verifying transformations before relying on them for any decision that has financial, clinical, or legal consequence. We recommend gating risky template categories (medium and high risk) through a human review queue.

9. Limitation of liability

To the maximum extent permitted by applicable law, neither party will be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, lost data, or lost goodwill, arising out of or in connection with these Terms, whether based on contract, tort, statute, or otherwise, and whether or not the party was advised of the possibility of such damages.

Each party's aggregate liability under these Terms is capped at the total fees you paid to AdaptivMapr for the Services in the twelve (12) months immediately preceding the event giving rise to the claim. The cap does not apply to a party's indemnification obligations or to liability that cannot be excluded under applicable law (e.g. gross negligence or wilful misconduct under Swiss law).

10. Indemnification

We will defend and indemnify you against any third-party claim alleging that the Services, as used in accordance with these Terms, infringe a third party's patent, copyright, or trade secret, and will pay damages finally awarded by a court of competent jurisdiction or agreed in a settlement we approve.

You will defend and indemnify us against any third-party claim arising from (a) your inputs or your use of the Services in breach of section 4, (b) your end users' data, or (c) your failure to obtain appropriate consents under applicable data protection law.

Indemnification is subject to the indemnified party (i) promptly notifying the indemnifying party of the claim, (ii) giving the indemnifying party sole control of the defence, and (iii) providing reasonable cooperation at the indemnifying party's expense.

11. Termination

Either party may terminate these Terms for convenience by giving the other party 30 days' written notice. Either party may terminate immediately for material breach if the other party fails to cure the breach within 30 days of written notice (or immediately if the breach is incapable of cure).

On termination:

• Your right to use the Services ends. Outstanding fees become immediately due.
• We will make your audit log records and any active mapping fingerprints available for export for at least 30 days following termination, after which we may delete them.
• Sections 5 (Customer data), 7 (IP), 8–10 (Warranties, Liability, Indemnification), 13 (Governing law) and any other provisions that by their nature should survive, will survive termination.

12. Modifications

We may update these Terms from time to time. Material changes will be notified to the email address on file for the workspace at least 30 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Terms. The version history of this document is recorded by the “Last updated” date at the top of the page.

13. Governing law & dispute resolution

These Terms are governed by the substantive laws of Switzerland, excluding its conflict-of-law rules and excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

The competent courts of Zurich, Switzerland have exclusive jurisdiction over any dispute arising out of or in connection with these Terms, subject to any mandatory consumer-protection rules that may apply. The forum aligns with the primary data residency for the Services (Cloudflare eu-central-2, Zurich).

14. Contact

Questions about these Terms can be sent to hello@adaptivmapr.com. For privacy-specific requests please email dpo@adaptivmapr.com; for security disclosures please use security@adaptivmapr.com.