Terms and Conditions

Welcome to VibeTasking. These Terms and Conditions ("Terms", "T&Cs") govern your access to and use of the VibeTasking service (the "Service"), provided by Xplosion AI, SL, with N.I.F. (Tax ID) B26864538 and registered office at Calle Pobladores 6, Esc 4, Planta 2, Pta 4B, 41900, Camas, Spain ("VibeTasking", "We", "Us", "Our").

The Service is offered for business, professional or institutional activities. The “Client” is the person or entity contracting the subscription; authorised users act on its behalf. If you contract on behalf of an entity, you represent that you have sufficient authority. By accepting these Terms through the contracting process provided, you also accept the DPA in Section 7. If you do not accept them, do not contract or use the Service. The Privacy Policy explains data processing; it does not replace the DPA or itself constitute consent to all processing.

1. Description of the service

VibeTasking is a technological service consisting of a chat-based artificial intelligence agent designed to automate computer tasks that users would typically perform on their computers. The Service allows you to instruct the agent, through a chat interface, to perform specific tasks in your digital environment, using your software, credentials, and following your instructions. The Service is primarily aimed at automating repetitive or semi-repetitive administrative, accounting, or operational tasks common in professional settings.

VibeTasking provides training and guidance resources, including its Academia and community. Each party will take the AI literacy measures required of it for its staff and other persons operating or using AI systems on its behalf, taking account of their knowledge, experience, context of use and affected persons.

2. User account

To use the Service, you must register and create an account. You are responsible for providing accurate and complete information during registration and for keeping it updated. You are responsible for safeguarding your account password and for any activity that occurs under your account. You must notify us immediately of any unauthorized use of your account or any other breach of security.

Demonstrations of the Service accessed without an account are also governed by these Terms from their first use.

3. Subscriptions, term, and renewal

We offer monthly subscriptions to the plans published on the Pricing page. Each subscription has an initial duration of ONE (1) MONTH from its purchase and automatically renews for successive one-month periods unless you cancel it before the renewal date. The Enterprise plan is also governed by the conditions agreed with the Client.

Without a paid subscription, the account has a free tier with a monthly credit allowance and the limitations the platform shows, including that it cannot contract the resources described in Section 4. We may modify or withdraw the free tier.

You can cancel your subscription at any time through the mechanisms provided on the VibeTasking platform or by notifying us. The cancellation will take effect at the end of the already paid period. From then on the account moves to the free tier and keeps its workspaces and their data. No refunds will be provided for partially used subscription periods, except where a refund is provided for in these Terms or required by law.

When you delete a workspace, it stays archived for thirty days, during which you can export or restore it and its subscription and resources keep being billed. After that period it is erased under Section 7.7 and its subscription is canceled at that moment, unless another workspace shares it, with no refund for the current period.

4. Pricing, credits, and payments

Fees: The monthly fees published on the Pricing page or the Subscription section of VibeTasking.com. Taxes not included.

Plan Credits: Each monthly subscription period grants its plan's credits, which are consumed when using the Service. The amount of credits consumed per task varies depending on its complexity. Plan credits unused at the end of each billing period expire and do not roll over to the next. Free tier credits renew on the first day of each calendar month on the same terms.

Extra Credits: With an active subscription you can purchase Extra Credit packages through any of the available modalities, including automatic recharge. Unused Extra Credits roll over to later periods until they are depleted, including after the subscription is canceled.

Promotional Credits: We may grant promotional credits, for example when you sign up. They expire on the date stated when granted.

Order of Consumption: The system consumes plan or free tier credits first, then valid promotional credits, and finally purchased Extra Credits.

Resources contracted through the platform: Some resources the Service contracts on your behalf, such as phone numbers, LinkedIn accounts, databases, mailboxes, websites or proxies, require a paid subscription and are charged in credits each monthly period. If a renewal cannot be charged, the resource keeps working and is released on the next renewal date if the debt has not been settled. When the subscription ends, the resources are released after seven days' notice and deleted seven days later. We do not guarantee keeping a phone number after its release.

Payment: Payments are made in advance at the beginning of each subscription period. We will use the payment information you provide. You authorize us to charge the applicable subscription fees using your registered payment method. If a charge does not succeed after its retries, the subscription is canceled and the account moves to the free tier.

Price Changes: We reserve the right to modify the fees. Any price change will be notified to you in advance (e.g., via email) and will apply to the next billing cycle following the notification.

5. License to use and intellectual property

Our Intellectual Property: VibeTasking and its software, platform, technology (including AI), methodology, trademarks, logos, designs, and all related documentation are the exclusive property of XPLOSION AI, SL. We grant you a limited, non-exclusive, non-transferable, and revocable license to access and use the Service while you keep your account, with or without a paid subscription, and in accordance with these Terms, solely for your internal professional purposes.

Your Intellectual Property: You retain full intellectual property ownership over all data, information, credentials, files, and any content you provide to us or to the VibeTasking agent to perform the tasks ("Your Content"). Furthermore, you will be the intellectual owner of the specific final output generated by the agent as a direct consequence of executing the requested tasks using Your Content (e.g., reports, compiled spreadsheets).

6. Your obligations and conditions of use

You may configure users, instructions, automations and available integrations within your contracted plan without negotiating a separate agreement for each task. You must pay the fees, use the Service lawfully and administer your accounts and permissions diligently.

You determine the purposes for which you use the Service and are responsible for the lawfulness, origin and relevance of the data and instructions you supply, the rights and authorisations needed to access third-party systems, and decisions you make using the results. You must have a valid legal basis for processing; consent is required only where it is the applicable basis. You will fulfil the obligations concerning information, retention, impact assessments, prior consultation and involvement of a data protection officer that apply to you, with our assistance under the DPA.

AI outputs and actions may contain errors. You will establish human oversight and review proportionate to their consequences, especially before communicating information to others, entering it in official records or making decisions affecting individuals. Technical availability does not authorise every use. VibeTasking does not pre-validate the lawfulness of each task or replace your professional judgement; it retains its own legal obligations.

Actions on your behalf. The agent acts as your tool and on your instructions. They include what authorised users ask for and what they configure on the platform: automations, triggers, approvals given for one action or kept for later ones, and the permissions and limits set there. Purchases, bookings, payments, subscriptions and messages the agent makes or sends through your accounts, credentials or payment methods are made in your name, and you are responsible for them as if your users had made them. Except for its own Service, VibeTasking is not the seller or provider of what the agent contracts from third parties: that third party's conditions govern price, delivery, cancellation and refunds, and you claim them from it. We are responsible for an action the Service carries out contrary to your instructions or to the controls configured on the platform.

Third-party services. The agent reaches third-party services through your accounts, integrations and channels, through the resources contracted on the platform and, when you enable it, through your own browser and the sessions open in it, using the VibeTasking extension. Those services attribute the agent's actions to you and may limit, suspend or close accounts they consider automated. You are responsible for complying with their conditions. A restriction a third party imposes is not a breach by VibeTasking unless our own breach caused it. The agent reaches your browser only while the extension is installed and enabled.

Actions the Service stops. The Service may refuse, pause or stop an action, even an authorised one, when it would break the law or these Terms, put people, security or data at risk, or exceed a limit or a policy set on the platform. Stopping it is not a breach by VibeTasking. Suspending the Service itself is governed by Section 13.

Data requiring additional protection. You may supply children's data, special categories of data and other regulated data only where processing has a lawful basis, falls within the processing mandate and the safeguards actually provided by the Service are appropriate. You must not use a feature for data or processing excluded by its conditions or whose requirements the Service does not meet. Your acceptance or assumption of responsibility does not remedy missing safeguards.

National Security Framework. The Service is provided under the BÁSICO profile of its System Categorisation under the Spanish National Security Framework (Esquema Nacional de Seguridad). You will not process in the Service information you rate at the MEDIO level in any dimension without first agreeing the MEDIO profile with us, which requires the Enterprise plan and the configuration that profile demands.

Uses prohibited by law. You must not use the Service for practices prohibited by Article 5 of the AI Act or for other unlawful activities. The scope of each prohibition and its exceptions is determined by applicable law.

Client-created systems and high-risk uses. VibeTasking provides a general platform for creating, configuring and running agents and automations. You may use it to develop or modify systems intended for high-risk uses, provided you fulfil the legal requirements applicable to the system and its use and have the necessary capabilities, information and safeguards before putting it into service. Legally prohibited uses remain excluded.

You are responsible for identifying the intended purpose, context of use and classification of systems you create or modify. Where your activities make you a provider, including changing a system not classified as high-risk into a high-risk system under Article 25 of the AI Act, you will fulfil the obligations associated with that role: risk management, validation, documentation, conformity assessment, registration and monitoring, as applicable. You will also fulfil your obligations as a deployer. Internal use may constitute putting into service; marketing the system to third parties is not necessary. Merely using or ordinarily configuring the platform does not automatically make you a provider.

Access to the Service, its general controls and our assistance do not constitute a declaration of conformity or validation of a Client-created system. If capabilities or documentation necessary for a use are missing, you must not start or continue that use until the deficiency is remedied. Accepting these Terms does not remedy it. Specific systems developed or supplied by VibeTasking as provider for a high-risk purpose will be governed by the scope and obligations of the relevant project; they are not covered by a general disclaimer.

Compliance cooperation. Where required under Article 25 of the AI Act, we will provide information about the platform's capabilities and limitations, known failure modes and necessary technical documentation, together with the technical access and assistance reasonably required for assessment, testing and validation of the resulting system. Where relevant, cooperation will include information about versions and material changes, logs, and available oversight and security controls. These Terms and the technical documentation incorporated into the agreement will specify that cooperation; additional needs will be documented in writing before the affected use. A separate contract is not required for each task or integration. Access arrangements will protect third-party data, confidentiality and intellectual property without preventing legal compliance. Extraordinary assistance may be reasonably quoted, without making legally required obligations conditional on, or delaying them because of, financial disagreements.

Transparency and the parties' roles. VibeTasking will fulfil its obligations as provider, including those concerning design to inform people of direct AI interaction and the marking and detectability of synthetic content, within the scope, exceptions and deadlines of Article 50 of the AI Act. You will fulfil the transparency obligations applicable to your uses and communications and preserve legally required notices and mechanisms without disabling or circumventing them. A declaration that an audience is outside the European Union does not itself exempt compliance.

Being a processor under the GDPR does not exclude being a provider under the AI Act. Roles and obligations depend on the actual activities and intended purpose. The contractual allocation reflects the actual roles and does not transfer VibeTasking's own obligations to the Client.

7. Data Processing Agreement (DPA)

This section constitutes the data processing agreement under Article 28 GDPR and Article 33 LOPDGDD. For data processed on the Client's behalf, VibeTasking acts as processor and the Client as controller. If the Client acts as processor for another controller, it will identify that controller and demonstrate authorisation for subprocessing before processing starts. Contractual labels do not replace actual roles.

7.1. Subject matter, operations and instructions. The mandate covers operations necessary to provide contracted functions: access, collection, organisation, storage, consultation, extraction, transformation, document generation, communication on the Client's instructions and erasure. It includes data in inputs, outputs, files, histories and logs necessary to provide the service. Access is limited to environments, uploaded files and tools authorised by the Client; this DPA does not itself authorise access to local devices or servers.

The processing description associated with the contract or workspace will identify the controller, subject matter, purposes, duration, categories of data subjects and types of data. It may be completed and updated electronically without listing or approving each task or integration. A material change of purpose or categories must be documented before the relevant processing begins.

Documented instructions comprise these Terms, the processing description, recorded configurations and requests of authorised users, and the Client's written communications. They cover only operations within the mandate. If we consider that an instruction infringes data protection law, we will inform the Client immediately and suspend its execution until it is clarified or corrected. We will process without instructions only where required by Union or Member State law applicable to us, informing the Client beforehand unless legally prohibited.

7.2. Categories of data subjects. These may include users, representatives, employees, collaborators, applicants, customers, suppliers, pupils, patients, beneficiaries and their representatives, according to the categories actually identified for the mandate. This list does not authorise purposes or uses excluded by Section 6.

7.3. Types of data. These may include identification and contact details, communications, professional, academic, administrative, financial and transaction data, expressly authorised credentials, document content and necessary technical data. Special categories, data relating to criminal convictions and offences and other regulated data must be specifically identified in the processing description and meet Section 6's conditions. Inclusion in this list does not constitute a legal basis for processing.

7.4. VibeTasking's obligations. We will limit processing to lawful instructions, access to authorised personnel bound by confidentiality and retention to the mandate. We will apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and segregation of environments. Before processing, we will provide a concrete description of applicable measures, incorporated into the mandate in a durable medium; it may be updated without reducing the protection committed to. We will maintain required records and cooperate with authorities.

We will assist the Client with data subject rights and its security, impact assessment and prior consultation obligations, taking into account the nature of processing and available information. We will promptly forward requests received concerning the Client's data and will not resolve them on its behalf without instructions or a legal obligation.

We will notify personal data breaches affecting the mandate without undue delay and in any case within 48 hours after becoming aware, to the designated contact and to the users who manage the Client's workspaces on the platform. We will provide the nature of the incident, affected data and persons where known, likely consequences, measures and a follow-up contact. Information may be supplied progressively without delaying the initial notice.

Ordinary assistance and assistance necessary to remedy our breaches are included in the Service. Extraordinary assistance unrelated to those breaches may be quoted at a reasonable, substantiated cost. Financial disagreement will not justify omitting or delaying legal obligations.

We will not use Your Content or data processed on your behalf to train, retrain or fine-tune our own or third-party artificial intelligence models, for advertising or to commercialise profiles. We will require compatible commitments from subprocessors.

To improve the Service for all clients we may derive anonymous, aggregated information from use of the platform, such as the usual format of a tool's responses or general guidance for completing a type of task. That information does not identify the Client, its users or any person, does not reproduce Your Content and is not used to train artificial intelligence models. On the Enterprise plan, an owner can exclude their workspace in its settings.

Account, contact and billing data that we process as controller to manage our relationship are governed by the Privacy Policy. This does not turn content or processing logs into data reusable for other purposes.

7.5. Subprocessors and the Client's tools. The Client grants general written authorisation to use subprocessors necessary for the Service, identified in the subprocessor register. We will provide the version applicable at contracting and maintain information about their identity, function, locations, retention and transfer safeguards. We will verify sufficient guarantees and bind them to equivalent data protection obligations. We remain liable to the Client for their obligations as provided in Article 28(4) GDPR.

We will announce additions or replacements at least thirty days in advance in the register and through a notice in the inbox of each of the Client's workspaces. The users who manage workspaces on an Enterprise plan will also receive it by email unless they turn it off in their notification settings, and the other users who manage workspaces may turn it on there. We will also send it to the designated contact where one has been agreed. The Client may object during that period on substantiated data protection grounds. Without objection, general authorisation will cover the change when the period expires. If there is an objection, the new provider will not process affected data while it is resolved. We may offer a reasonable alternative or either party may terminate the affected service, with a refund of its unused prepaid amount. Silence does not authorise unlawful processing or transfers.

The Client is responsible for third-party applications it contracts and authorises us to operate on its behalf. Connecting them does not require a separate VibeTasking contract for each task. Intermediaries, gateways or providers contracted by VibeTasking that process data on our behalf remain subject to the subprocessor regime, including when they enable access to the Client's applications. The Client's choice of a tool does not remove VibeTasking's obligations according to each third party's actual role.

7.6. International transfers. The Client authorises necessary, documented transfers for the mandate only where they comply with Chapter V GDPR. VibeTasking will establish the mechanisms and carry out the assessments and supplementary measures incumbent on it, and provide sufficient information about them. Client authorisation or activation of an integration does not replace these safeguards. If they cease to exist, we will suspend the affected transfer until remedied or terminate the affected processing.

Hosting infrastructure in Europe does not mean every function is processed exclusively there. Locations are documented by provider and service. An exclusively European residency commitment exists only where expressly agreed and the service is configured to fulfil it. The Client will comply with its applicable sectoral restrictions, without excluding VibeTasking's own obligations.

7.7. Duration, retention, return and erasure. The mandate remains effective while we provide the Service and hold data on the Client's behalf.

While a workspace exists, its activity records are kept for twelve months, or for the period between six and thirty-six months an owner sets on the Enterprise plan, and are then erased. Each conversation, with its messages, files and history, is erased once it has rested for that period without activity. The configuration change log, closed notices, mailbox emails and access records are erased when they reach it. When a conversation is deleted, its record of actions is kept until it reaches that same period. Sign-in records are kept for twelve months, billing records for six years and the erasure register for five years, as proof of each erasure.

The Service terminates for a workspace when that workspace or the account of its sole owner is deleted. Canceling a subscription does not terminate it: the account moves to the free tier and keeps its data, which the Client may delete at any time. Upon termination, the workspace stays archived for thirty days, during which the Client can export or restore it and nothing runs in it, and is then erased. The Client may instruct earlier return or erasure by writing to [email protected].

We will complete erasure from active systems, including copies held by subprocessors, no later than the day after that archive ends or thirty days after an earlier instruction triggering erasure, and from backups no later than ninety days after termination or that instruction, without prejudice to shorter legal deadlines. Backups awaiting rotation will be isolated from ordinary use and, after restoration, erasure instructions will be reapplied. Erasure includes content, histories, derived data, logs containing affected data and copies held by subprocessors. The anonymous, aggregated information described in Section 7.4 contains no data of the mandate and is not part of erasure. We will confirm completion in writing on request.

After erasure we will not retain those data for reactivation, training or commercial exploitation. We will retain specific data only under an applicable legal retention obligation, for its required period, with restricted purpose and access and informing the Client unless legally prohibited.

7.8. Information and audits. We will provide sufficient information and allow audits and inspections to demonstrate compliance. The ordinary procedure will first review relevant, current documentation, including available independent reports. These do not replace additional checks where insufficient.

Ordinary audits will be coordinated with thirty days' notice and, in principle, once a year, protecting confidentiality and other clients' data. These limits do not apply to incidents, reasonable indications of non-compliance, material changes justifying review or authority requests. Practical conditions and costs will not prevent effective verification. The Client will bear its ordinary costs; VibeTasking will bear reasonable verification and remediation costs arising from its substantiated material breaches.

7.9. Liability and precedence. Each party is liable according to its obligations and Section 11, without limiting data subjects' rights, authorities' powers or liability that cannot legally be limited. This DPA prevails in data protection matters over conflicting Terms or policies. Applicable standard contractual clauses for international transfers prevail within their scope.

8. Confidentiality

Each party will protect non-public information received from the other and use it solely to perform the contract or fulfil a legal obligation. Information is excluded where the receiving party can demonstrate that it was public without breach, already lawfully known, legitimately received from a third party or independently developed. Legally required disclosure will be limited to what is necessary, with prior notice where permitted.

The obligation survives for three years after the relationship ends. For personal data it continues while the data remain protected, and for trade secrets while they retain that status, even after three years.

9. Communications

We will communicate with you primarily through the email address associated with your account. You are responsible for keeping your email address updated. Communications directed to Us go to the address that matches their subject:

• [email protected]: contractual and commercial communications, including the notices provided for in these Terms.
• [email protected]: technical support and use of the platform.
• [email protected]: security incidents and vulnerabilities.
• [email protected]: data protection, exercise of rights and instructions on data processed on the Client's behalf, for the attention of the Data Protection Officer.

10. Commercial reference and logo use

Unless you notify us otherwise in writing, you authorize us to include your company name and/or logo in our customer lists and marketing materials to identify your company as a VibeTasking user. You can revoke this authorization at any time by notifying us in writing.

11. Nature of AI, warranties and liability

AI may produce variable, incorrect or incomplete actions or outputs. We do not guarantee specific results, complete absence of errors or uninterrupted availability. We will provide the Service with the required diligence and in accordance with contracted features and legal obligations. These limitations do not exclude security or data protection commitments.

Each party is responsible for breaches and damage attributable to it. VibeTasking is not responsible for damage arising exclusively from the Client's unlawful instructions, data supplied without a legal basis, permissions under its exclusive control or decisions contrary to these Terms. This exclusion does not cover damage caused or aggravated by VibeTasking's own breaches or those of subprocessors for which it must answer.

Between the parties and insofar as legally permissible, VibeTasking's aggregate contractual liability is limited to amounts paid by the Client for the Service during the twelve months preceding the event giving rise to liability. Lost profits and indirect damage are excluded to the extent that exclusion is valid under applicable law.

These limitations do not apply to intentional misconduct, gross negligence, liability that cannot legally be limited, data subjects' rights, authorities' powers, compensation or recourse obligations that cannot be limited, or liability whose limitation would conflict with applicable standard contractual clauses. They do not reduce DPA compliance obligations.

To the extent permitted by law, the Client will indemnify VibeTasking for amounts paid to third parties and reasonable, substantiated defence costs arising from unlawful data or instructions or other breaches of these Terms attributable to the Client, in proportion to its responsibility. This excludes penalties imposed on VibeTasking and amounts attributable to its own breaches or those of subprocessors for which it must answer. VibeTasking will promptly notify the claim, allow reasonable participation in the defence and not enter settlements binding the Client without its consent, which must not be unreasonably withheld. Late notice will reduce this obligation only to the extent of actual prejudice caused.

12. Changes to the Service and Terms

We may improve or change the Service for technical, security, legal or product-development reasons. If a change materially reduces contracted features, we will give at least thirty days' notice and you may terminate the affected service before it applies, with a refund of the corresponding unused prepaid amount. Urgent measures necessary to comply with law or protect security may apply sooner, with their reason explained as soon as possible.

We will communicate material changes to these Terms by email at least thirty days in advance, specifying the changes, effective date and how to terminate the affected service before that date if you do not accept them, with the proportional refund described above. We will obtain express acceptance where necessary. Continued use does not cure legal consent requirements or amend individual agreements that require express acceptance.

We will not unilaterally amend individual agreements or reduce committed data protection safeguards. Subprocessor changes follow Section 7.5. We will retain applicable versions and provide a copy in a durable medium.

13. Suspension and termination

You may cancel under Section 3, without prejudice to other termination rights in these Terms. We may restrict or suspend the affected service for material breach, prohibited use, unlawful instructions or serious risk to security or data. Action will be proportionate, with notice and an opportunity to remedy where possible; we may act immediately if waiting would maintain unlawful processing or a serious risk.

We may terminate for material breach not remedied within a reasonable period or incapable of remedy. Ordinary termination for VibeTasking's commercial reasons requires thirty days' notice and a refund of the unused prepaid amount. Confidentiality, legally required assistance, return and erasure obligations survive according to their nature; their fulfilment will not depend on payment of disputed amounts. Termination does not exclude liability for our own breaches.

14. Force majeure

We shall not be liable for any failure or delay in the performance of our obligations under these Terms due to events beyond our reasonable control (Force Majeure Event), such as natural disasters, acts of war, pandemics, widespread network failures, etc.

15. Governing law and jurisdiction

These Terms are governed by Spanish law, without prejudice to applicable mandatory rules. Disputes will be submitted to the courts having jurisdiction under applicable law. Mandatory administrative and judicial jurisdiction will be respected, including for public procurement and data protection.

16. Miscellaneous

• Contract documents and precedence: The contract comprises the accepted offer or subscription, these Terms, the DPA and incorporated processing documentation. Individual agreements prevail over these Terms in case of conflict; the precedence rules in Section 7.9 also apply to data protection. The Privacy Policy is informative and does not amend contractual obligations or authorise use of content outside the processing mandate.
• Severability: If any provision of these Terms is held to be invalid or unenforceable by a court, the remaining provisions of these Terms will remain in effect.
• No Waiver: The failure to exercise or enforce any right or provision of these Terms shall not constitute a waiver of such right or provision.
• Assignment: You may not assign or transfer these Terms, by operation of law or otherwise, without our prior written consent. We may assign or transfer these Terms freely without restriction.

17. Contact

If you have any questions about these Terms, please contact us at: [email protected]