Terms of Service

§ 1 Scope of Application

These Terms of Service (hereinafter "Terms") govern all contracts between Scanara UG (haftungsbeschränkt), represented by its managing director Thilo Barth, Silnerstraße 37, 85221 Dachau, Germany, registered in the commercial register of the Munich Local Court (Amtsgericht München) under HRB 312777 (hereinafter "Provider" or "Scanara") and the customer (hereinafter "Customer") regarding the use of the Scanara platform.

The Scanara platform is available to both businesses and organisations (entrepreneurs within the meaning of § 14 BGB) and consumers (§ 13 BGB). Business customers (entrepreneurs within the meaning of § 14 BGB) confirm upon registration that they act in a commercial or professional capacity; no statutory right of withdrawal pursuant to §§ 312g, 355 BGB applies to them. EU consumers (§ 13 BGB, habitually resident in the EU) have a 14-day statutory right of withdrawal. If the consumer expressly requests at checkout that performance begin before the withdrawal period expires and acknowledges that the right of withdrawal expires upon complete performance of the service (§ 356 para. 4 BGB), the consumer owes pro-rata compensation for services rendered up to the withdrawal (§ 357a para. 2 BGB) in the event of withdrawal — this separate express request is collected at checkout. Customers habitually resident outside the EU have no EU withdrawal right under § 312g BGB; the consumer protection rules of their country of residence may apply. For details see the Right of Withdrawal.

Conflicting terms and conditions of the Customer shall not be recognized unless the Provider expressly agrees to their validity in writing.

§ 2 Service Description

Scanara provides a web-based platform for automated technical analysis and pattern recognition to support conformity assessment under Regulation (EU) 2024/1689 (EU AI Act). The scope of services includes:

• Automated code analysis across 10+ programming languages
• Automated document validation using policy engines
• Risk classification and conformity assessment
• Software-assisted generation of document templates (compliance dossiers and reports) as working aids for meeting regulatory documentation requirements

Important notice — not a substitute for legal advice: Scan results do not constitute legally binding assessments or legal advice within the meaning of § 2 of the German Legal Services Act (RDG). Scanara provides technical compliance tooling; the platform does not provide legal advice within the meaning of the RDG. Scan results are for technical and informational purposes only and do not replace individual legal review by qualified legal professionals. Scanara does not guarantee the completeness or accuracy of automated analysis results. Documents, dossiers, and reports generated by the platform constitute automatically generated drafts and do not replace independent review of their content. The Customer bears sole responsibility for the accuracy, completeness, and use of all documents created on the basis of platform results and for all compliance decisions derived therefrom. Scanara accepts no liability for damages arising from reliance on automated analysis results or generated document content.

Rule set currency: The rule set underlying the automated analysis reflects the regulatory state as of the revision date indicated in the platform. The Provider updates the rule set within a reasonable time following changes to the AI Act, associated delegated acts, harmonised standards, or regulatory guidance; immediate or gap-free reflection of the current regulatory state at all times is not warranted.

§ 2a Customer Regulatory Responsibility

All regulatory obligations under Regulation (EU) 2024/1689 (EU AI Act) — in particular obligations relating to risk assessment, conformity assessment, technical documentation, registration, market surveillance, and post-market monitoring — remain solely with the Customer as provider or deployer of an AI system.

Scanara provides technical analysis tools only. Use of the platform and its scan results does not transfer regulatory obligations to the Provider and does not constitute a conformity assessment within the meaning of the AI Act. The Customer bears sole responsibility for all regulatory decisions, submissions, and measures taken on the basis of platform results.

The Provider accepts no liability for sanctions, fines, or other measures imposed by supervisory authorities on the Customer as a result of the Customer's breach of regulatory obligations.

§ 3 Contract Formation and Registration

The contract is concluded upon the Customer's registration on the platform and acceptance of these Terms. The Customer is obligated to provide truthful and complete information during registration.

The Customer is responsible for maintaining the confidentiality of their access credentials and is liable for all activities that occur under their account.

Contract conclusion in electronic commerce (§ 312i BGB, Art. 246c EGBGB): The contract may be concluded in German or English. The technical steps leading to the conclusion of the contract are: registration, selection of a plan, entry of payment details, and confirmation via the order button indicating a payment obligation. Input errors can be identified and corrected at any time before submission using standard browser and form functions. The contract text is not permanently stored by the Provider in retrievable form; the Terms in force are available at /legal/terms, and the Customer receives the essential contract details by confirmation email.

§ 4 Subscription and Payment

Use of the platform is based on subscription models. Current prices and included features are listed on the pricing page of the website.

Payment processing is handled by Stripe Payments Europe, Ltd. (Ireland). By subscribing to a paid plan, the Customer agrees to Stripe's payment terms.

All prices displayed on the website are gross prices inclusive of applicable statutory VAT in accordance with German price indication regulations (PAngV). Invoices to business customers (B2B) will show VAT separately pursuant to § 14 UStG. Customers outside Germany are subject to the VAT treatment applicable in their country (reverse charge or OSS procedure) in accordance with applicable tax law.

Trial period: For certain paid plans, the Provider offers a free trial period of 14 days. If the Customer does not cancel before the trial period expires, the subscription automatically converts into a paid subscription of the selected plan. The Customer is informed before the start of the trial period of the plan, the price, and the date on which paid billing begins.

§ 5 Contract Term and Cancellation

Paid subscriptions have a minimum term corresponding to the selected billing period (monthly or annual). The subscription renews automatically for the same period unless cancelled before the end of the current term.

Cancellation is possible at any time, effective at the end of the current billing period. For monthly billing, the notice period is 14 days before the end of the month; for annual billing, the notice period is 1 month before the end of the contract term.

The free tier may be terminated by either party at any time without notice.

The right to extraordinary termination for good cause remains unaffected.

Consumer rule (§ 309 No. 9 BGB): For consumers within the meaning of § 13 BGB: after the agreed minimum term expires, the subscription does not renew into a new fixed term of equal length, but continues indefinitely and may be terminated by the consumer at any time with one month's notice. The consumer's right to extraordinary termination for good cause remains unaffected.

Cancellation button (§ 312k BGB): Consumers may also cancel their subscription via a dedicated button in the platform account settings (app.scanara.io → Settings → Billing).

Withdrawal button (§ 356a BGB, effective 19 June 2026): From 19 June 2026, § 356a BGB requires a permanently accessible withdrawal function ("Vertrag widerrufen" button) for consumer distance contracts concluded via an online interface. Non-compliance automatically extends the withdrawal period to 12 months and 14 days. The withdrawal function is available in the platform account settings (app.scanara.io → Settings → Billing).

§ 5a Data Retention After Termination

Upon termination of the contract, the Customer's scan results and compliance findings are retained for a period of 30 days after subscription termination to allow the Customer to export their data. After expiry of this 30-day period, the data is irrevocably deleted.

Audit trail records are retained for a minimum of 10 years to support the statutory documentation obligations of organisations subject to the AI Act. This retention is performed on a contractual basis on the Customer's behalf (GDPR Art. 28(3)(a)). Upon termination, these records are anonymized so that they can no longer be attributed to the Customer.

Payment records and invoices are retained for 8 years in accordance with statutory retention periods pursuant to § 147(1) No. 4 AO and § 14b(1) UStG as amended by the Fourth Bureaucracy Relief Act (BEG IV, BGBl. 2024 Nr. 323; effective 1 January 2025).

§ 5b Switching Support pursuant to Art. 25 Data Act

In accordance with Art. 25 of Regulation (EU) 2023/2854 (Data Act), the Provider grants the Customer support in switching to another provider.

Transition period: The 30-day period following contract termination referred to in § 5a simultaneously constitutes the maximum transition period within the meaning of Art. 25(1) Data Act. During this period, the Customer may export their data in machine-readable format and transfer it to another service or an on-premise solution. After the end of the transition period, the Provider guarantees a retrieval period of at least 30 calendar days during which the Customer may continue to retrieve their exported data (Art. 25(2) Data Act); the data is permanently deleted only after expiry of this retrieval period.

Notice period for switching: The maximum notice period for initiating a switch to another provider is two months (Art. 25(2)(d) Data Act); the notice periods set out in § 5 are within this maximum.

Export scope: The Provider will, upon request, make available a full organisation export comprising: all AI system definitions and versions, all assessments (AIRA, FRIA, DPIA, GPAI, Deployer, Conformity Assessment), all scan results including findings, all compliance dossiers (metadata and source artefacts), organisation settings and members, and an audit trail extract for the relevant organisation scope. Derived data, platform rules, and anonymised infrastructure logs are not included in the export.

Format: Exported data is provided in a structured, commonly used, and machine-readable format within the meaning of Art. 30(5) Data Act (JSON per RFC 8259, UTF-8 encoded, embedded in a ZIP archive with manifest file). Details on the export format are documented in the Service Description (Section 8).

Fees: Data export during the transition period is free of charge for the Customer. From 12 January 2027 (Art. 29(1) Data Act), no switching fees will be charged.

Responsibility: The Provider supplies the data and export format. Migration of data to the target provider or on-premise solution is the Customer's responsibility.

§ 6 Customer Obligations

• The Customer may only use the platform in accordance with applicable law and these Terms.
• The Customer warrants that they are authorized to submit the content (source code, documents) provided for analysis to Scanara for processing, and that such content does not contain third-party trade secrets without appropriate authorization.
• The Customer ensures that submitted content does not knowingly include credentials, API keys, or unredacted personal data of third parties.
• The Customer shall not use the platform for unlawful purposes, reverse engineering, or to compromise the integrity of the platform.
• The Customer is responsible for compliance with data protection requirements regarding the data they submit.

§ 6a Defect Notification

The Customer is obligated to notify the Provider of any defects in the platform promptly, and in any event within 5 business days of discovery or of the point at which the Customer should have discovered the defect in the exercise of ordinary care. Defect notifications must include a sufficiently detailed description to allow the Provider to reproduce the issue (in particular: description of the defect, affected functionality, time of occurrence, browser/client version used).

If the Customer fails to give timely notice of a defect, the Customer forfeits warranty claims with respect to that defect to the extent permitted by law. This does not apply to defects fraudulently concealed by the Provider.

Consumer rule: This § 6a does not apply to consumers within the meaning of § 13 BGB. Their statutory warranty rights (in particular under §§ 327 et seq. BGB) continue without any notification period and without forfeiture of claims (§ 476 BGB).

§ 7 Availability

Platform availability targets, maintenance windows, and incident response times are governed by the Service Description. The Provider reserves the right to temporarily restrict the platform if necessary for security reasons, maintenance, or platform improvements. Planned maintenance windows will be announced to the Customer at least 24 hours in advance where possible.

§ 8 Intellectual Property

All rights to the platform, including software, algorithms, designs, and documentation, remain with the Provider. The Customer receives a simple, non-transferable, non-sublicensable right to use the platform for the duration of the contract.

Content submitted by the Customer (source code, documents) remains the property of the Customer. The Provider uses Customer content solely for the provision of the contractually agreed services. Customer content is not used for AI model training or any other purposes.

§ 9 Liability

The Provider is liable without limitation for damages arising from injury to life, body, or health based on an intentional or negligent breach of duty by the Provider, as well as for damages caused by intent or gross negligence.

In case of a breach of material contractual obligations (cardinal obligations) due to slight negligence, the Provider's liability is limited in amount to the typically foreseeable, contract-typical damage. Material contractual obligations are those whose fulfilment is essential for the proper execution of the contract and on whose compliance the Customer may regularly rely.

Liability for breach of material contractual obligations due to slight negligence is limited to the fees paid by the Customer to the Provider in the 12 months preceding the damage-causing event.

The Provider's total aggregate liability for all claims by the Customer arising from or in connection with this contract is — without prejudice to liability for intent, gross negligence, and damages arising from injury to life, body, or health — limited to EUR 100,000 per calendar year.

Beyond this, liability for slight negligence is excluded. This applies in particular to indirect damages, consequential damages, lost profits, and damages resulting from data loss.

In the event of data loss, the Provider is liable only up to the recovery effort that would have been incurred had the Customer performed proper and regular data backups or made regular use of the export functions offered (§ 5b).

The Provider assumes no liability for the accuracy, completeness, or timeliness of results generated by automated analysis or of documents, dossiers, and reports generated by the platform. These constitute automatically generated drafts and do not replace independent content review or professional legal advice. Use of analysis results and generated documents is at the Customer's own risk. A scan result of "compliant", "no findings", or any other positive result does not constitute a legally binding conformity determination under the AI Act or any other legislation, does not create any entitlement to rely on such results as a legal or regulatory opinion, and does not replace individual legal review by qualified legal professionals (§ 2 RDG). Regulatory compliance responsibility and all conformity decisions remain solely with the Customer (§ 2a of these Terms).

For free use of the platform (Free Tier), the Provider's liability — without prejudice to liability for intent and gross negligence as well as damages arising from injury to life, body, or health — is excluded. For free use, the remuneration relevant for calculating the liability cap is EUR 0; claims arising from breach of material contractual obligations are limited in this case to EUR 500.

The Provider is not liable for disruptions, outages, delays, or errors caused by third-party service providers engaged by the Provider for service delivery (in particular Amazon Web Services as cloud infrastructure provider, Stripe as payment service provider, and GitHub as repository platform), to the extent such disruptions are not attributable to the Provider. The Provider will promptly notify the Customer of material disruptions at third-party service providers of which it becomes aware. In the event of a permanent cessation of operations or insolvency of a material third-party service provider, the Provider shall notify the Customer promptly, no later than five (5) business days after becoming aware, and shall take reasonable measures to provide an alternative solution.

Liability under the German Product Liability Act (ProdHaftG) remains unaffected. From 9 December 2026, the Product Liability Directive (EU) 2024/2853, as implemented into national law, shall also apply. Liability limitations in these Terms of Service shall not apply to consumers (within the meaning of § 13 BGB) for claims under Art. 6(1) of Directive (EU) 2024/2853 (death, personal injury, property damage, data loss) to the extent that Art. 14 of Directive (EU) 2024/2853 prohibits derogation by agreement.

Consumer rule: The above liability limitations (including the fixed aggregate caps) apply to consumers within the meaning of § 13 BGB only to the extent permitted by applicable law. Consumer warranty rights and liability claims that cannot be excluded or limited by law remain unaffected.

Excluded from the Provider's liability are regulatory fines and other sanctions imposed by supervisory authorities (including data protection authorities under GDPR Art. 83 or market surveillance authorities under the EU AI Act) on the Customer. The Provider is not liable for regulatory measures resulting from the Customer's own regulatory non-compliance.

§ 10 Data Protection

The Provider processes the Customer's personal data in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Details are set out in the Privacy Policy.

Where the Provider processes personal data on behalf of the Customer, the provisions of the Data Processing Agreement (DPA) shall apply.

§ 11 Confidentiality

Both parties undertake to treat all confidential information obtained from the other party in the course of the contractual relationship as confidential and not to disclose it to third parties. This obligation shall continue to apply after termination of the contract. Information that is publicly known, was already known to the receiving party, or must be disclosed due to legal obligations is excluded.

§ 12 Changes to These Terms

The Provider reserves the right to amend these Terms with effect for the future, provided such changes are objectively justified and do not unreasonably disadvantage the Customer. Changes will be communicated to the Customer by email at least 30 days before they take effect. If the Customer does not object within 30 days of receiving the notification of changes, the amended Terms shall be deemed approved. If the Customer objects in a timely manner, the Customer is entitled to terminate the contract with extraordinary effect as of the date the changes take effect. The Provider will inform the Customer separately and prominently in the notification of the significance of the 30-day period, the legal consequence of silence (deemed approval), and the right of termination in case of objection.

Consumer rule: In relation to consumers within the meaning of § 13 BGB, the deemed-approval mechanism (silence as consent) applies only to non-material changes. Material changes — in particular price increases and reductions in the scope of services — are not approved by the consumer's silence; the consumer must expressly consent to such changes. If the consumer does not consent, the consumer is entitled to terminate the contract early.

§ 13 Governing Law and Jurisdiction

The laws of the Federal Republic of Germany shall apply, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

If the Customer is a merchant within the meaning of the German Commercial Code (HGB), a legal entity under public law, a special fund under public law, or has its registered seat in another EU or EEA member state and acts in the exercise of its commercial or independent professional activity, the exclusive place of jurisdiction for all disputes arising from or in connection with this contract shall be Munich, Germany. The foregoing exclusive jurisdiction clause does not apply to consumers within the meaning of § 13 BGB; the mandatory provisions of the consumer protection law of the member state in which the consumer is habitually resident remain unaffected.

§ 13a Consumer Dispute Resolution

The Provider is neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

§ 14 Indemnification

The Customer shall indemnify and hold harmless the Provider from and against all third-party claims arising from content submitted by the Customer (source code, documents), any infringement of third-party rights by the Customer, or misuse of the platform by the Customer, including reasonable costs of legal defence.

This applies in particular to claims for infringement of copyright, other intellectual property rights, or data protection regulations caused by content submitted by the Customer.

The Provider will promptly notify the Customer of any claims asserted and is entitled to conduct the legal defence at its own discretion. The Customer undertakes to reasonably support the Provider in defending against such claims.

Consumer rule: In relation to consumers within the meaning of § 13 BGB, the indemnification obligation applies only to claims based on a culpable breach of duty by the consumer.

§ 15 Warranty

The Provider warrants that the platform substantially conforms to the functionalities documented in the Service Description. The Provider makes no warranty that the platform is suitable for any particular purpose of the Customer or that automated analysis results are complete, error-free, or suitable for regulatory submissions.

In the event of defects in the platform, the Provider shall first be entitled to cure the defect (Nachbesserung). If the cure fails after two attempts, the Customer may reduce the fees accordingly. A right to terminate the contract for defects exists only in the case of material defects that substantially impair the usability of the platform.

Automated scan results are technical approximations and do not constitute binding conformity determinations. The Provider excludes any implied warranty of fitness for a particular purpose, merchantability, or legal compliance of results, to the extent permitted under applicable German law.

Features designated as "beta", "preview", or "experimental" are provided as available; the Provider gives no warranty for such features, and they are excluded from the availability commitments under the Service Description.

Warranty claims by the Customer for initial defects that were not fraudulently concealed by the Provider are excluded to the extent permitted by law.

Consumer rule: The above warranty exclusions and limitations do not apply to consumers within the meaning of § 13 BGB. Consumers retain their statutory warranty rights under §§ 327 et seq. BGB (digital products and services) and §§ 434 et seq. BGB in full (§ 476 BGB).

§ 16 Force Majeure

The Provider shall not be liable for non-performance or delayed performance of contractual obligations where such failure is caused by events beyond the Provider's reasonable control (force majeure).

Force majeure events include in particular: natural disasters, war, terrorist attacks, pandemics, cyber attacks against cloud provider (AWS) infrastructure, widespread failures of critical internet infrastructure, governmental orders, regulatory changes, and power or telecommunications outages not within the Provider's area of responsibility.

The Provider will notify the Customer promptly of any such event and will use all reasonable efforts to minimise the impact. Both parties are released from their affected obligations for the duration of the event.

If a force majeure event continues for more than 90 days, either party is entitled to terminate the contract by written notice to the other party with immediate effect.

§ 17 Severability

Should individual provisions of these Terms be or become invalid or unenforceable, the validity of the remaining provisions shall not be affected. The invalid or unenforceable provision shall be replaced by a valid and enforceable provision that most closely reflects the economic purpose of the invalid or unenforceable provision.

§ 18 Limitation Period

The limitation period for claims by the Customer arising from or in connection with this contract is one year from the statutory commencement of the limitation period, unless mandatory statutory provisions require a longer period. This does not apply to claims arising from injury to life, body, or health or from intentional or grossly negligent conduct.

Consumer rule: The above reduction of the limitation period does not apply to consumers within the meaning of § 13 BGB. Consumers retain the statutory limitation periods (in particular §§ 195, 327j, 438 BGB).

§ 19 Set-Off and Right of Retention

The Customer may only set off claims against the Provider's claims if such counter-claims are undisputed or have been established by final and binding court judgment. The Customer may only exercise a right of retention based on counter-claims arising from the same contractual relationship.

§ 20 Assignment Restriction

The Customer may not assign or transfer rights and obligations under this contract to third parties without the prior written consent of the Provider. § 354a HGB (German Commercial Code) remains unaffected.

§ 21 Price Adjustment

The Provider is entitled to adjust the prices for paid subscriptions with a notice period of at least 30 days, effective at the end of the current billing period. Notice will be given by email. If the Customer objects to the price adjustment within 14 days of receipt of the notice, the Customer is entitled to terminate the contract with extraordinary effect as of the date the price adjustment takes effect.

Vis-à-vis consumers within the meaning of § 13 BGB, price increases require the consumer's express consent; the consumer rule in § 12 remains unaffected.

§ 22 Written Form

Amendments and supplements to this contract require text form (email suffices) to be effective. This also applies to the waiver of this text form requirement. No oral side agreements exist.

§ 23 Entire Agreement

This contract, including all documents incorporated by reference (Service Description, Privacy Policy, DPA, Right of Withdrawal), constitutes the entire agreement between the parties regarding the subject matter hereof and supersedes all prior oral or written agreements, representations, and understandings relating to the same subject matter.

§ 24 Language Versions

These Terms and the documents incorporated by reference are provided in German and English. In the event of discrepancies between the language versions, the German version prevails; the English version is provided for information purposes only.

Contact

Scanara UG (haftungsbeschränkt) Managing Director: Thilo Barth Silnerstraße 37, 85221 Dachau, Germany Commercial Register: Munich Local Court (Amtsgericht München), HRB 312777 Email: support@scanara.io