Terms of Service

1. Definitions

• "Kiff Agents OÜ", "we", "us", "our": the Estonian private limited company providing the Service. Registry code 17372313.
• "Customer", "you", "your": the natural or legal person agreeing to these terms.
• "User": any individual the Customer authorizes to access the Service through the Customer's account.
• "Service": the KIFF Cloud product, including api.kiff.dev, app.kiff.dev, kiff.dev, tafs, and the documentation, dashboards, and APIs we publish there.
• "tafs": the tafs app for iPhone and iPad and the service behind it, including Setup and planque (§3A), in which a Customer hands a job to an AI agent that works inside KIFF Cards. A "taf" is one such agent.
• "Tenant": a logically-isolated workspace inside the Service belonging to a single Customer.
• "Audit Data": the events, decisions, actions, approvals, and receipts the Service persists on the Customer's behalf via the runtime.
• "tafs Data": what tafs keeps on the Customer's behalf: each taf's runs and chats (including what the Customer's connected tools return to it), its reports, its memory notes, and the phones registered for its alerts.
• "Receipt": a signed, versioned decision record emitted by the Service for each governed action.
• "Documentation": the technical Service documentation and security measures in the dated revision linked from these Terms (kiff.dev/docs/archive/2026-10-10). It excludes the strategic whitepaper, marketing materials and documentation for the separately licensed open-source framework.
• "DPA": the Data Processing Agreement at /legal/dpa, governing our processor-side relationship.

2. The agreement

These terms govern your use of the Service. By creating an account, generating an API key, or otherwise using the Service, you agree to these terms. If you accept on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" and "your" refer to that entity.

We may publish supplemental terms for specific features (beta features, third-party integrations). Where they conflict with these terms, the supplemental terms control for the specific feature.

3. The Service

KIFF Cloud is a hosted service for governing delegated actions. It evaluates requests against the Customer's configured permissions and Cards, may require human approval, and records governance decisions. Depending on the configured integration, KIFF forwards an authorized request or provides authorization that the protected system verifies. The connected system performs the underlying action.

The applicable technical behavior, evidence, integration requirements and execution limits are specified in the dated Documentation linked from these Terms. The strategic whitepaper explains KIFF's principles and model; it is not incorporated as technical Documentation under these Terms.

KIFF Cloud's governance service is not an agent framework, a workflow engine, a model gateway, or a managed agent platform. It composes with whatever you already use. See "What KIFF is not" on the homepage for the explicit list. tafs is the one part of the Service that runs agents for you, inside the Cards you issue; §3A describes it.

The open-source kiff/kiff framework is governed by its own MIT license and falls outside these terms. When you run the framework on your own infrastructure, no contract with Kiff Agents OÜ is created.

3A. tafs

In tafs you hand a job (for example refunds, bill pay or card disputes) to a taf: an AI agent that works on a schedule with the tools you connect, inside the KIFF Cards you issue for it. Each taf runs on our agent runtime, and Anthropic provides the AI model it uses. You answer its held calls in the tafs app.

Connecting your tools. Setup, an AI agent in tafs that runs like a taf, helps you connect a tool and set up a taf for a job. It doesn't connect anything by itself. You sign in at the tool's own provider (for example Stripe), and you approve on your device each connection, the tools a taf may use, and its Cards. The token from that sign-in is kept by planque, our connection service. It is encrypted, used only to make a call KIFF has decided, and never given to a taf. Disconnecting a tool revokes the token at the provider and deletes it.

Your Cards are your instructions. A taf reaches your tools only through KIFF, which checks every call against the taf's Cards before it is sent. A call within a Card you issued is made on your instruction. A call outside a Card is held or refused, as the Card says. A held call is made only after someone your account allows to answer held calls approves it. In the tafs app, the answer carries a signature from their device that KIFF verifies, and the receipt keeps that proof. Your account can also answer in KIFF itself (the dashboard, its command-line tool, or an approver you authorise there); the receipt then records who answered and how.

What stays with you. You choose each taf's job and Cards, answer its held calls, and make sure you may use the tools and accounts you connect. A taf's reports, messages and memory notes are written by an AI model and can be wrong; check what matters before you rely on it.

Stopping a taf. You can pause a taf, revoke any of its Cards, or remove it. Revoking a Card stops its authority at once. Removing a taf stops its schedule and deletes its runs, chats, memory and the key it used. Even before that, what your tools return to a taf is kept only until its run ends, and its runs and chats for 30 days. KIFF keeps the receipts of what it did.

The EU AI Act. For tafs, Kiff Agents OÜ is the provider of the AI system and you are its deployer. We make sure anything a taf writes to someone outside your company says that an AI agent wrote it. You use tafs only for the jobs it offers, and not for any use the AI Act prohibits or classes as high-risk, such as decisions about a person's employment, credit or access to essential services. You keep the human approvals your Cards require, and make sure the people who use tafs for you understand what it does and its limits.

Costs. During the beta, tafs is free of charge, including the model and runtime it uses (§8).

4. Accounts and access

To use the Service you must create an account. You agree to provide accurate registration information, to keep your credentials confidential, and to be responsible for all activity under your account.

You must be at least 16 years old, or the age of digital consent in your jurisdiction, whichever is higher. The Service is not directed at children.

You are responsible for the actions of every User you authorize on your account. We may suspend an account or revoke access on reasonable notice if we detect a credible breach of these terms. For Acceptable Use violations (see §5) suspension may be immediate.

5. Acceptable use

You agree not to use the Service to:

• violate any law or third party right;
• generate, distribute, or store malware, exploit code, or material that infringes intellectual property;
• generate, distribute, or store child sexual abuse material;
• scrape, mass-export, or otherwise extract bulk data from the Service beyond your own Tenant;
• attempt to circumvent, derive other tenants' data from, or forge Receipts emitted by the Service;
• reverse-engineer the hosted Service for the purpose of building a competing product (this prohibition does not apply to the open-source framework, which is governed by its MIT license);
• send spam or unsolicited messages through any Service surface;
• use the Service to develop products or services that compete with the Service.

We may suspend immediately on a credible AUP violation. We are not obligated to monitor Customer content but may act on credible reports.

6. Customer data and content

You own your Audit Data. You grant Kiff Agents OÜ a limited, non-exclusive, royalty-free, worldwide licence to host, copy, transmit, display, and otherwise process your Audit Data solely as necessary to operate, maintain, and improve the Service for you.

We act as processor for your Audit Data and your tafs Data under Article 28 GDPR; the DPA governs that relationship in detail. We act as controller for your account metadata; the privacy policy governs that relationship.

You represent that you have all rights necessary to submit the data you submit, and that submission complies with applicable laws (including data-protection laws and, where applicable, the EU AI Act).

7. Confidentiality

Each party may receive non-public information from the other ("Confidential Information"). The receiving party will use Confidential Information only as necessary to perform its obligations and exercise its rights under these terms, and will protect it with at least the same degree of care it uses for its own confidential information.

Confidential Information does not include information that (a) is or becomes publicly available without breach, (b) was known to the receiving party before disclosure, (c) is independently developed without use of the Confidential Information, or (d) must be disclosed by law (with notice to the other party where allowed).

8. Fees and payment

At v0.1 the Service is offered free of charge during a named private beta. When paid plans launch, fees and payment terms will be set out in an order form, in the pricing page, or in supplemental terms incorporated here. We will not start charging an active account without thirty days' written notice and an opportunity to opt out.

Where applicable, fees are exclusive of VAT. EU business-to-business transactions involving Customers outside Estonia with valid VAT identification numbers will be invoiced under the EU reverse-charge mechanism.

9. Term and termination

These terms take effect when you first use the Service and continue until terminated.

You may terminate at any time by deleting your account. We may terminate (a) for material breach not cured within thirty days of written notice, or (b) immediately for Acceptable Use violations or insolvency events.

On termination we delete your Audit Data, your tafs Data and account metadata in line with the retention rules in the privacy policy. You may export your data before termination; on request and at our discretion we may grant a thirty-day post-termination window for export.

Sections that by their nature should survive termination survive, including confidentiality, intellectual property, indemnification, limitation of liability, disclaimers, governing law, and any accrued fees.

10. Warranties

Each party represents that it has the right and authority to enter into and perform these terms.

We warrant that we will provide the Service in a professional manner and in substantial conformity with the Documentation. Your sole remedy for breach of this warranty is, at our option, re-performance or pro-rata refund of fees attributable to the affected Service for the period of breach.

You warrant that your use of the Service complies with applicable law and these terms.

11. Disclaimer

Except for the express warranties in §10, the Service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all other warranties, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing or usage of trade.

We do not warrant that the Service will be uninterrupted, error-free, or free from harmful components, or that any data will not be lost or corrupted. You are responsible for backing up your data.

12. Limitation of liability

To the maximum extent permitted by law, neither party will be liable to the other for any indirect, incidental, consequential, special, exemplary, or punitive damages, including lost profits, lost revenue, lost data, or business interruption, arising out of or related to these terms or the Service, even if advised of the possibility of such damages.

Each party's aggregate liability arising out of or related to these terms will not exceed the greater of (a) the fees paid or payable by the Customer to Kiff Agents OÜ in the twelve months preceding the event giving rise to liability, or (b) one hundred thousand euros (€100,000). At v0.1 the Service is free of charge, so the €100,000 floor applies in practice.

Nothing in these terms limits or excludes liability that cannot be limited or excluded under applicable law, including liability for death, personal injury caused by negligence, fraud, or wilful misconduct.

13. Indemnification

We will defend you against third-party claims that the Service, as provided by us and used by you in accordance with these terms, infringes that third party's intellectual property rights, and we will pay damages finally awarded against you (or the agreed settlement amount) for such claims.

You will defend us against third-party claims arising from (a) your Customer data or content; (b) your use of the Service in breach of these terms (including the AUP); or (c) your gross negligence or wilful misconduct, and you will pay damages finally awarded against us (or the agreed settlement amount) for such claims.

Indemnification is conditional on prompt notice of the claim, sole control of defence and settlement by the indemnifier, and reasonable cooperation by the indemnitee. The indemnifier may not settle a claim that imposes obligations on the indemnitee without consent.

14. Service-level commitment

At v0.1 we operate the Service on a best-effort basis during a named private beta. No service-level agreement applies. Operational practices, incident response, and breach notification commitments are documented in the dated revision linked from these Terms (kiff.dev/docs/archive/2026-10-10); /security shows the current practices.

A formal SLA covering availability, latency, and credit remedies will be published before the Service exits private beta or before paid plans launch, whichever is sooner.

15. Modifications to the Service

We may add, change, or remove features at any time. Material reductions of functionality or the deprecation of an API surface that breaks documented behaviour are notified to active customers at least thirty days in advance, with a published deprecation schedule. Security-driven changes may be made without notice where notice would itself create risk.

16. Modifications to these terms

We may amend these terms from time to time. Material changes are notified by email and a prominent banner on this page at least thirty days in advance. Non-material changes (clarifications, references) are posted with a new "last updated" date. Your continued use of the Service after the effective date of an update constitutes acceptance.

17. Force majeure

Neither party is liable for any failure or delay in performance to the extent caused by circumstances beyond its reasonable control, including acts of God, war, terrorism, civil disturbance, labour disputes, fire, natural disaster, pandemic-related government action, internet or power outages, or actions of telecom providers or third-party hosting infrastructure.

18. Governing law and venue

These terms are governed by the laws of the Republic of Estonia, without regard to its conflicts of law rules. The exclusive forum for disputes is Harju County Court in Tallinn.

Where you are a consumer resident in another EU member state, mandatory consumer-protection rules of your home jurisdiction continue to apply to the extent they grant you rights you cannot waive by contract; this clause does not deprive you of the protection of those rules.

19. General

Entire agreement. These terms, together with the privacy policy, the DPA, any order forms, and any supplemental terms expressly incorporated, are the entire agreement between us on their subject and supersede any prior or contemporaneous understanding.

Severability. If a provision is held unenforceable, the rest remain in effect.

Assignment. You may not assign these terms without our written consent. We may assign without consent in connection with a merger, acquisition, or sale of all or substantially all of our assets, on notice to you.

No waiver. A failure to enforce any provision does not waive the right to enforce it later.

Notices. Notices to Kiff Agents OÜ go to legal@kiff.dev or, by post, to Tööstuse tn 75-71, Põhja-Tallinna linnaosa, Tallinn 10416, Estonia. Notices to you go to the email associated with your account or, where you have provided one, your designated legal-notices address.

Independent contractors. Nothing in these terms creates a partnership, agency, joint venture, or employment relationship.

Third-party beneficiaries. There are none, except to the extent indemnified affiliates are expressly identified.

20. Contact us

Commercial and contractual questions: legal@kiff.dev.

General product questions: hello@kiff.dev. Privacy questions: privacy@kiff.dev. Security disclosures: security@kiff.dev.

Document version: v0.1.
Last updated: 20 October 2026.