Terms of Service

CernaFlow is operated by Kalora AI Ltd, a company incorporated in the Republic of Mauritius under company number C25221194, registered office in Curepipe, Republic of Mauritius (“we”, “us”). These Terms of Service (the “Terms”) are the agreement between us and the organisation using CernaFlow (the “Service”) — “you”.

You accept these Terms by clicking to accept them, by signing an order form that references them, or by using the Service. If you accept on behalf of an organisation, you confirm you are at least 18 and have authority to bind it, and “you” means that organisation.

CernaFlow is a business product. It is not offered to consumers and is not for personal or household use.

You upload documents or send them in through a connector such as email or WhatsApp. We use artificial intelligence to read them, split multi-document files into their parts, match each part to one of your extraction templates, and produce text and structured data you can export. You can then ask questions about that data in plain language, and an automated system answers by searching your extractions and, where it helps, running generated code in a sandbox to analyse them.

We may change, add to or remove features, but not in a way that materially reduces the core functionality of your paid plan during a period you have already paid for.

Keep your registration details accurate. You are responsible for keeping login credentials confidential and for everything done under your organisation’s account, authorised or not. Email [email protected] if you suspect unauthorised access; changing a password ends that user’s existing sessions.

If you sign up yourself you must verify your email address before signing in. Users invited by an admin count as verified. Invitations expire after three days. You may invite as many people as you like, and you are responsible for their compliance with these Terms.

A Kalora employee may enter your organisation to provide support, investigate a fault or comply with law. Their identity is preserved throughout, the visit is recorded in your audit log, and we use that access for nothing else.

Pages are the only thing we bill for. A page is charged once, when its document finishes and we mark it Completed.

Nothing is charged for a document we mark Failed, for an exact Duplicate of one you already sent, or for a result we withhold because it came back incomplete. On a bundle we split, only the documents inside it are charged.

Where we charge a document and still mark it Needs review, that document carries one free re-run. Other re-runs are charged.

Deleting a document does not return its pages to your allowance.

Named users are unlimited. No plan caps how many people you invite.

Each tier is one price with one monthly page allowance. There is nothing to choose inside a tier. The per-page rate in the table below is the rate prepaid pages buy at under clause 5; it is never added to your bill on its own.

Enterprise is quoted only, never self-service, and our pricing page is the authoritative current list. We may also agree a plan with you that is not on that page. Prices exclude tax and are in United States dollars.

When your pages run out the Service stops processing new documents and returns an out-of-quota error, and documents arriving through a connector are rejected the same way. You can move up a tier, or buy prepaid pages under clause 5. We never send you a bill for pages you did not pay for in advance.

Chat is not metered by message. Two limits apply instead: a per-user limit of 60 chat messages a day, and the message figure published against each plan, which is a fair-use threshold rather than a wall. If your usage substantially and persistently exceeds it we will contact you.

Two other plan limits are enforced: active extraction templates, capped at 10 on Starter and 25 on Pro and unlimited on Business; and retention, in clause 8. We may also apply rate, concurrency, file-size and file-format limits to protect the Service. Some features are available only on certain plans, as shown on our pricing page, and moving to a lower plan applies that plan's features and limits.

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. We sell the Service to Paddle.com Market Limited, which resells it to you. Paddle handles your payment, invoice and receipt, appears as the seller, and determines and remits any sales tax, VAT or GST due in your country. Paddle’s buyer terms govern the payment; these Terms govern the Service. We remain responsible to you for providing the Service, and you can raise any billing question with us at [email protected]. Enterprise plans may be invoiced by us directly under a signed order form, in which case we are the seller and we charge the tax our own registration requires.

Paid plans are billed in advance, and by providing a payment method you authorise Paddle to charge it until you cancel. Your subscription renews automatically, either monthly or annually at a 20% discount on the same plan’s monthly price. An annual term cannot be cancelled mid-term, and its discount cannot be combined with a referral or promotional discount.

Moving up applies immediately and is charged immediately. The charge is the full difference between the two plans’ list prices, for every month of allowance it buys, and never a part-month figure: your new allowance arrives whole on the day you move, so you pay for it whole. On a monthly term that is one month’s difference; on an annual term it is the difference for each month left in the year, counting the one you are in. The Service shows you the amount before you confirm. Moving down applies at the end of the current period, and you keep your current allowance until then.

Switching how often you pay is not a change of plan, and it never changes your allowance. Switching from monthly to annual charges the annual price less the invoice you have already paid toward it, and your renewal date does not move. Switching from annual to monthly charges nothing: you keep every month you have already paid for, and the first monthly charge falls on the day the year would have renewed.

Cancelling stops the next renewal and revokes nothing on the day. You keep full access and your full allowance to the end of the period you have paid for, and then move to a trial-expired state, where people can still sign in but no documents are processed. You may undo a scheduled cancellation before it takes effect.

A cancellation made within an hour of a renewal takes effect after it. A renewal is processed automatically and cannot be stopped once it has begun, so a cancellation made in the hour before one stops the renewal after that. You keep the period that renewal has paid for, and the Service shows you the cutoff time on the day.

Extra pages are prepaid, and they are off unless you switch them on. Prepaid pages are a one-time purchase in fixed dollar amounts. They buy pages at your plan’s published per-page rate, so the same purchase buys more pages on a larger plan. They are not sold on the Trial, and Enterprise plans are priced by agreement instead.

Two things must both be true before we process a page past your allowance: you hold prepaid pages, and an admin has switched extra pages on. Only an admin can switch them on, by expressly approving them, and we record who approved it and when. The approval takes effect immediately. It is an instruction to keep working past your allowance, not acceptance of a bill. Each page past your allowance is paid for from your prepaid pages as we finish it. Occasionally a document turns out to hold more pages than we could count before starting it; those pages are processed and paid for the same way. When your prepaid pages run out, the Service stops processing new documents again. You can switch extra pages off at any time, which stops further processing past your allowance; it does not undo pages we have already processed and paid for. We warn you as you approach your allowance, and again as your prepaid pages run low.

Prepaid pages expire twelve months after your most recent purchase. Every purchase moves that date, so the twelve months always run from the last time you bought, and we email you before they expire. Prepaid pages can only be used to pay for CernaFlow usage, have no cash value, and cannot be transferred.

Prepaid pages are spent only while your subscription is active. They are attached to your subscription rather than held separately, so while it is cancelled, expired or on hold nothing can be spent from them. If you subscribe again before they expire, they are there.

Prepaid pages we give you at no charge, for example under a referral offer or to put something right, work exactly like prepaid pages you bought. They appear in your prepaid pages history, expire on the same twelve-month clock, and carry no cash value.

If a payment fails, Paddle may retry it and contact you. While an amount is unpaid your organisation may be moved to a past-due state, where people can sign in but no documents are processed. After 30 days unpaid we may suspend the organisation entirely and may terminate. You cannot buy prepaid pages while an amount is unpaid, because no documents are processed until the payment clears.

We may change our prices, including per-page rates, on at least 30 days’ notice by email, effective at your next renewal. A changed per-page rate never applies to a period already open. Because prepaid pages are held as a dollar amount and spent at your plan’s rate, a rate change changes how many pages your prepaid amount buys, and we give you that figure in the notice. If you do not accept a new price, cancel before it takes effect.

14-day money-back guarantee. If CernaFlow is not right for you, ask within 14 days of your first payment and we will refund it in full. Your access ends when the refund is issued.

Paddle.com is the seller of record for your order, so refunds are issued by Paddle under Paddle’s refund policy. Your statutory rights are unaffected.

Refund requests go to [email protected] or to Paddle, whichever you prefer.

You own your data. You keep all right, title and interest in everything you submit and everything the Service derives from it: documents, extracted text and structured data, templates and chat messages. You grant us a licence to host, copy, process, display and derive material from it, solely to run and support the Service for you, keep it secure and comply with law. That licence ends when the data is deleted, except for backups still inside their retention window.

We do not train on your data. We do not use your data to train or fine-tune generative models, and our model provider’s paid-tier terms prohibit it from doing so.

Our Privacy Policy at cernaflow.com/privacy describes how we handle personal data and lists our current sub-processors. It forms part of these Terms. For your data you are the controller and we are the processor: we act on your instructions, as needed to provide the Service, and as required by law. Business customers who need a Data Processing Agreement can request one at [email protected].

The Service is hosted in Europe. Your data may be processed in other countries by the sub-processors listed in our Privacy Policy, and by using the Service you instruct those transfers.

Security. We encrypt data in transit and at rest, store connector credentials encrypted, control access by role, isolate every tenant, and end sessions when a password changes, an account is deactivated or you sign out of all devices. No service is perfectly secure, and your side is yours: credential hygiene, prompt removal of departing users, and control of paired devices and inbound addresses. Email [email protected] with any security question or to report a problem. We will tell you without undue delay about a security incident affecting your data.

What you must not send us. Do not submit payment card data, health records, government identity numbers, biometric data or export-controlled material unless we agree in writing first. You warrant you have the rights and lawful bases we need to process what you do send. Keep your own copies of anything you cannot afford to lose: the Service is not a system of record and is not a backup service.

Files still being uploaded are deleted after 7 days, and only successfully processed documents reach permanent storage. We keep each document’s original, because re-processing works from it.

You can delete extractions and documents yourself at any time. Deletion is permanent, covers the whole document and its split parts, and erases the stored file. It also removes the document from any destination connector you configured, acting on your instruction and only within the folders we created there; we cannot do so once you have disconnected that connector. Deleted pages do not return to your allowance, and the record that the document was processed stays in your usage figures and audit log.

Beyond that, one period per plan governs how long we keep your documents, extracted data, ingestion records, chat sessions and audit log. Past it, we delete the record and its file automatically:

This is a deletion schedule, not a backup promise. Export anything you need to keep for longer. Moving to a plan with a shorter period brings the deletion date forward. The schedule governs our systems: anything already delivered to a destination you configured is not deleted from it.

After your subscription ends you may lose access to the Service and so to any export tool, so export what you need before then. On request, or in any event within 90 days after termination, we delete your data, except where law requires us to keep it or where it sits in backups until those expire. Data we have already delivered to a destination you configured sits in your storage rather than ours, and we do not delete it. We keep invoices and audit logs as our own records of the relationship.

You must not, and must not let anyone else:

1. use the Service unlawfully, or process material that is unlawful, infringing or obtained without permission;
2. resell or provide the Service to a third party as a service of your own, unless an order form allows it;
3. copy, decompile or reverse engineer the Service, derive its source code, models or prompts, or build a competing product with it;
4. probe its security, bypass authentication, tenant isolation or quota enforcement, or escape the code-execution sandbox, except under a written testing agreement with us;
5. upload malware, or content designed to disrupt the Service or another user;
6. send documents from a source you are not authorised to send from, or connect an account you do not control;
7. make automated decisions about individuals that have legal or similarly significant effects on them, without appropriate human review.

If you breach this clause we may suspend the affected part of the Service immediately. Where it is reasonable and lawful, we will tell you first and give you a chance to fix it.

The Service uses large language models to read, classify and split documents, extract fields, write code and answer questions. All of it is probabilistic and can be inaccurate, incomplete, out of date or wholly wrong, even when presented confidently and even when a confidence score is shown. Confidence scores are internal heuristics, not guarantees. Chat may generate and run code in a sandbox with no access to your systems; no human reviews that code before it runs.

You must review output before relying on it. You alone are responsible for checking and approving it before you act on it, publish it, file it or feed it into another system. Do not use the Service as the sole basis for a decision with financial, legal, regulatory, employment, medical or safety consequences. Output is not professional advice of any kind.

Generative models can produce similar output for different customers, so we make no claim that output is original and grant you no exclusivity in it. Otherwise you may use it freely for your own business purposes.

Connectors are your choice. Each connected service is run by a third party under its own terms, and we are not responsible for it, for its availability, or for what it does with data once we have delivered it at your instruction. WhatsApp ingestion runs over a shared platform number: anyone holding a paired handset can send documents into your organisation, so tell us promptly when someone leaves or a handset is lost.

We and our licensors own the Service: its software, models, prompts, the templates we supply, designs, documentation and trade marks. You get a limited, non-exclusive, non-transferable right to use it during your subscription for your own internal business purposes, and every right not expressly granted is reserved. Extraction templates you create are yours. If you send us feedback, we may use it without restriction or payment. We will not use your name or logo publicly without your consent.

We will provide the Service with reasonable skill and care. Beyond that, and to the fullest extent permitted by law, the Service and all its output are provided “as is” and “as available”, and we disclaim every other warranty, express or implied, including merchantability, fitness for a particular purpose and non-infringement. In particular we do not warrant that the Service will be uninterrupted or error-free, that output will be accurate or fit for your purpose, that the Service will meet a regulatory or record-keeping requirement that applies to you, or that documents will always be correctly classified, split or identified as duplicates. There is no uptime guarantee on self-service plans, and anything labelled beta or preview may change or be withdrawn at any time.

To the fullest extent permitted by law, neither of us is liable for indirect, incidental, special or consequential loss, or for lost profit, revenue, business, goodwill or anticipated savings, or for loss or corruption of data or its cost of recovery. Each party’s total liability under these Terms is capped at the fees paid for the Service in the 12 months before the event giving rise to the claim, or USD 100 where no fees have been paid. Nothing here limits liability for death or personal injury caused by negligence, for fraud, for fees you owe, or for anything that cannot lawfully be limited.

You indemnify us against any third-party claim, and resulting costs, arising from the data you submit, from your breach of clause 9, from your use of the Service’s output, or from a connector you configured. We indemnify you against any third-party claim that your permitted use of the Service infringes their intellectual property, except where the claim arises from your data, from output, from a beta feature, or from use in breach of these Terms.

We may suspend or limit the Service where your allowance is exhausted and we cannot process further pages — because extra pages are off, because you hold no prepaid pages, or because your prepaid pages have expired — where a user exceeds the daily chat limit, where payment is overdue, where we reasonably believe there is a breach of clause 9 or a security threat, or where law requires it. Allowance and rate limits are automatic and self-clearing; otherwise we give notice as soon as we reasonably can. Suspension does not relieve you of paying.

You may cancel at any time in the Service, as set out in clause 5. Either of us may terminate if the other materially breaches these Terms and does not fix it within 30 days of written notice, or immediately if the other becomes insolvent or ceases to trade. We may terminate a free trial at any time, and a paid subscription for convenience on 30 days’ notice, in which case we refund the unused part of any period you have already paid for, pro rata; on an annual term that means the unused whole months. On termination your right to use the Service ends, outstanding fees fall due, and clause 8 applies to your data.

We may change these Terms. A material change takes at least 30 days’ notice, by email to your admins or a notice in the Service, and applies from your next billing period. Smaller changes, such as fixing a typo, apply when published. If you do not accept a material change, cancel before it takes effect. The current version is always at cernaflow.com/terms.

These Terms, and any dispute arising from them, are governed by the laws of the Republic of Mauritius, and the parties submit to the exclusive jurisdiction of its courts. We will both try in good faith to resolve any dispute by discussion for 30 days before starting proceedings.

A signed order form or master services agreement takes precedence over these Terms where they conflict. No purchase order or vendor portal term has any effect, even if we acknowledge it. You may not transfer these Terms without our consent; we may transfer them to a successor of our business. If any provision is unenforceable, the rest stands. These Terms are in English, and any translation is for convenience only. They are the entire agreement between us on this subject.

Kalora AI Ltd, Curepipe, Republic of Mauritius. General, legal, support and security requests: [email protected]. Billing and refunds: [email protected]. Data protection and Data Processing Agreement requests: [email protected]. Or call +230 5816 7370.