Terms of Service

These Terms, the Data Processing Annex, Privacy Policy, processing details supplied before activation, and any accepted order or plan confirmation form the agreement between you and Xentavi sp. z o.o.

STAiMP is a brand of Xentavi sp. z o.o.("Xentavi," "we," "us" or "our"), not a separate legal entity. Xentavi is registered at ul. Domaniewska 47/406, 02-672 Warszawa, Poland; KRS 0001258350; NIP 5214175567; REGON 545420830; share capital PLN 5,000, fully paid; registered by the Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego. Contact: legal@xentavi.com.

Mandatory law prevails, followed by binding transfer clauses, the Annex for Customer Personal Data, an accepted order for plan-specific terms, and these Terms. You must actively accept the current Terms before any free or paid analysis. The Privacy Policy is information, not consent to optional marketing or tracking.

1. Provider and agreement

1.1 STAiMP is a brand of Xentavi sp. z o.o., as identified above.

1.2 STAiMP is designed primarily for businesses, public bodies, professionals and their authorized users, but an individual may also contract as a consumer where consumer access is offered. "Customer" or "you" means the person or organization accepting these Terms. If you act wholly or mainly outside your trade, business, craft or profession, you are a "Consumer". "Protected Customer" means a Consumer and any sole trader or small-business customer entitled to mandatory consumer-equivalent or unfair-term protection. Declaring business use does not remove mandatory Consumer or Protected Customer rights.

1.3 These Terms, the Data Processing Annex, Privacy Policy, processing details supplied before activation, and any accepted order or plan confirmation form the agreement.

1.4 You must actively accept the current Terms before any free or paid analysis. We record the version, time, account and declared customer status and provide the accepted documents in a retainable form.

2. Customers, territory and roles

2.1 STAiMP may support business and consumer accounts in territories and plans expressly made available at registration. Access remains subject to sanctions, export controls and local law.

2.2 Non-EU customers and EU-facing use. Customers established outside the European Union may use STAiMP where supported at onboarding. If Customer Content, an AI-system output, product, service, advertisement or publication is offered, displayed, distributed, used or otherwise directed into the EU, you are responsible for determining and complying with applicable EU law, including the EU AI Act. Establishment outside the EU does not necessarily exclude EU law.

2.3 Regulatory roles. You determine whether you act as a provider, deployer, importer, distributor, product manufacturer, controller, processor or other regulated person. Using STAiMP does not transfer your role or obligations to Xentavi. Xentavi is not your authorized representative under the EU AI Act, GDPR or other law unless a separate written mandate expressly says so.

2.4 Agencies may submit client material only with necessary rights and instructions. If you are a processor, you must have the controller's authority to appoint Xentavi as sub-processor.

2.5 Consumer use. A Consumer contracts personally and may use only plans expressly available to Consumers. Mandatory pre-contract information, withdrawal, conformity, refund, unfair-term, choice-of-law, jurisdiction and privacy protections prevail.

2.6 Children. An account holder must be at least 18 or the age of legal majority where they live. STAiMP is not directed to children.

3. Service and results

3.1 STAiMP analyses supported Customer Content. Depending on the enabled feature, technical signals may include language or stylometric indicators, provenance and content credentials, metadata, perceptual comparisons, artefact checks, synthetic-media detection and third-party model output. Rules may map findings to potential EU AI Act Article 50 considerations and suggested next steps. Only content types, formats, limits and features expressly shown as available for your plan are supplied; audio and other roadmap features are not available until enabled.

3.2 Provenance information does not establish truth, authorship, ownership, consent or permission to publish.

3.4 You must not use a result as the sole basis for a decision producing legal or similarly significant effects on a person, or as the sole basis for accusing someone of deception, infringement or unlawful conduct.

3.5 We provide paid services with reasonable care. Unless an order says otherwise, we do not promise uninterrupted availability, response times, a detection rate, compatibility with every file or preservation of a feature.

4. Accounts and acceptable use

4.1 Provide accurate information, protect credentials, maintain reasonable security and report suspected compromise promptly. Workspace administrators control users and permissions and must remove access when no longer required.

4.2 You must not probe vulnerabilities without permission; bypass access controls or quotas; introduce malware; disrupt the service; scrape it at scale; share access outside authorized users; reverse engineer except where non-waivable law permits; or use STAiMP to build a competing detection or compliance service.

4.3 We may apply reasonable technical limits to protect security, integrity and agreed quotas. You are responsible for authorized-user activity unless caused by our breach.

5. Customer Content

5.1 You retain your rights and grant Xentavi and authorized providers a worldwide, non-exclusive, limited right to host, transmit, reproduce, transcode, extract, segment and technically process Customer Content only to provide, secure, support and lawfully operate the service.

5.2 You represent that you have all rights, authority, lawful bases and notices needed to submit Customer Content and instruct processing.

5.3 Do not submit credentials, identity documents, payment-card data, special-category or criminal-offence data, intimate material, unlawful material or knowingly submit children's personal data unless a suitable written arrangement expressly permits it. Minimize personal data.

5.4 Do not upload unlawful or infringing material; misrepresent results as official findings; remove material limitations from a shared report; or use the service to harass, discriminate or make unsupported allegations.

5.5 We do not sell Customer Content, receipts or reports; use them for behavioral advertising; or authorize a provider to train or fine-tune its general models on them. We do not use Sightengine's Feedback API for Customer Content.

6. Content handling and providers

6.1 For content types expressly designated "transient" in the current processing details, Xentavi processes the submitted source content in working memory or ephemeral processing and deletes it after analysis. This applies to image uploads and to video uploads (MP4, MOV or WebM, up to 50 MB and 20 seconds). For a video, Xentavi extracts still frames (three per second) in working memory and analyses each frame as an image; the video and its frames are deleted when the analysis ends, and the sound track is not analysed. Text, document, audio, URL and future workflows remain disabled until their content-specific processing details are disclosed before use.

6.2 We retain for 30 days a limited analysis receipt containing source name or identifier, content type, score or classification, triggered rule or finding, analysis time and account/workspace association. For a video, the receipt also records its duration, the number of frames analysed and flagged, and the time position, score and classification of up to five frames, never the frames themselves. Active receipts are automatically deleted after 30 days and excluded from routine backups.

6.3 We do not persist standalone extracted text, transcripts, frames, clips, thumbnails, metadata, embeddings, fingerprints, perceptual hashes, prompts or other derivatives unless the processing details disclose the derivative, purpose and retention before use.

6.4 Images, and up to three still frames extracted from each video, are transmitted over an encrypted connection to Sightengine, operated by Kozelo SAS, 16 bis rue d'Odessa, 75014 Paris, France. The video file itself and its sound track are not sent to Sightengine. Default processing is in the EU (France, Ireland, Germany, Finland), Canada or the United States, with no region lock under Terms version 1.1. Sightengine deletes submissions by default after processing; Xentavi does not use its Feedback API or any storing feature. Xentavi's 30-day receipt deletion covers STAiMP receipts only and does not automatically delete Sightengine-side processing, which follows Sightengine's own published terms. The applicable transfer safeguard is the one named in the provider record supplied before activation.

6.5 Before a provider first receives Customer Content or Customer Personal Data, we will identify it in the current provider record, describe its function, data, processing locations, retention and transfer safeguard, put required contractual safeguards in place and obtain any legally required authorization.

6.6 Under Terms version 1.1, OpenAI and any LLM or AI platform not listed in the current provider record are disabled for Customer Content. A materially different optional AI feature remains off unless the Customer enables it after receiving that information.

7. Confidentiality and intellectual property

7.1–7.2 Each party protects the other's non-public information. Customer Content is Customer confidential information. Service code, rules, models, non-public security information, pricing and plans are Xentavi confidential information.

7.3 Xentavi and licensors retain all rights in STAiMP. You may retain and lawfully share delivered results with staff, clients, advisers, insurers, auditors or regulators if material limitations remain intact.

7.4 Voluntary feedback may be used without payment, but this grants no rights to Customer Content or confidential information.

8. Plans, fees and renewal

8.1 Before payment or a converting trial, checkout states price, currency, taxes, period, quotas, reset or rollover rules, renewal, conversion date and cancellation method. We do not charge undisclosed upgrades or overages.

8.2–8.4 A subscription renews only if disclosed and accepted. Stop renewal through the account control or by emailing legal@xentavi.com before the next charge. Cancellation does not itself create a refund for a properly supplied period. We may suspend paid features for undisputed overdue amounts after notice and at least seven days to pay.

8.5–8.6 Business Customers. Price changes apply prospectively for new purchases and future renewals. For non-Protected Customers we give at least 30 days' individual notice before a price change applies to a renewal.

8.7 Consumers and Protected Customers. Where applicable law requires active acceptance of a revised price, we will obtain express and informed agreement before charging it. Notice, silence, failure to cancel or continued use will not constitute acceptance where prohibited.

8.8–8.9 The scheduled expiry of a disclosed promotion, trial or discount is not a price change. Prices may exclude taxes where clearly stated.

9. Suspension, termination and changes

9.1 We may proportionately restrict access where reasonably necessary for security threats, unlawful activity, sanctions risk, infringement, material misuse, risk to another customer or material breach.

9.2 Either party may terminate a material breach not remedied within 14 days after notice, or immediately if irremediable, insolvency permits termination, or continued performance would be unlawful.

9.3 We give at least 30 days' notice of a materially adverse mid-term change where lawful and practicable. If it materially reduces an agreed paid service and is not required for law or security, you may terminate affected access before it takes effect and receive a pro-rata refund of unused prepaid fees.

10. Export, switching and deletion

10.1 On request, we provide Customer data still held, including active receipts and findings, account/workspace data, permissions, settings, and customer-specific usage and transaction records. Deleted source content and expired receipts cannot be recovered.

10.2–10.5 Where EU Data Act Chapter VI applies, our notice period is 30 calendar days. We provide exportable data in a structured, commonly used, machine-readable format. We impose no switching, egress or additional early-termination charge. Switching export data remains retrievable for at least 30 days after transition.

11. Warranties and disclaimers

11.1 Each party warrants authority to enter the agreement. We warrant that paid services will be performed with reasonable care and substantially as described in the order, subject to stated limitations.

11.2 Except for express warranties, the service and free features are provided "as available". We disclaim implied warranties of merchantability, fitness for a purpose, non-infringement, uninterrupted operation and error-free results.

11.3 For a reproducible service-warranty breach, our contractual remedy is, at our option, re-performance, correction, reasonable service credit, or termination of the affected paid service with refund of unused prepaid fees.

12. Indemnities

12.1 If Customer is not a Consumer, Customer will defend Xentavi against a third-party claim to the extent arising from Customer Content, unlawful instructions or use, breach of clauses 5.2–5.4, or alleged infringement of intellectual-property, privacy, publicity or confidentiality rights.

12.2 For paid service, Xentavi will defend a claim that unmodified STAiMP directly infringes an EU or UK patent, copyright or trademark. This does not cover claims within clause 12.1 or claims arising from modifications, combinations or use not provided by Xentavi.

13. Liability

13.2 Nothing excludes liability for fraud, intentional damage, or death/personal injury caused by negligence to the extent it cannot lawfully be limited.

13.3 For Consumers and Protected Customers, clauses 12.1 and 13.1 apply only to the extent lawful, transparent and fair.

14. Complaints, law and general terms

14.1 Send complaints to legal@xentavi.com or our registered address. We respond within 14 calendar days or sooner where required.

14.2 Polish law governs without prejudice to mandatory local law. Courts competent for Xentavi's registered office have exclusive jurisdiction where validly agreed with a non-Protected Customer. The CISG does not apply.

14.3–14.6 Contract notices may be sent to the account email or legal@xentavi.com. Neither party is liable for delay caused by events beyond reasonable control. The English version governs where lawful.

15. Consumer and protected-customer rights

15.1 A Consumer and any qualifying sole trader or small business retains all mandatory protections. Account labels are evidence of intended use but do not waive rights determined by actual circumstances.

15.2 Where a statutory distance-contract withdrawal right applies, a Consumer may withdraw within 14 days after conclusion by an unequivocal statement to legal@xentavi.com. Starting an analysis does not waive withdrawal rights unless all legal conditions are satisfied.

15.3 Mandatory supply, conformity, correction, price-reduction, termination, refund, content-return, fair-term and local-court rights remain.

16. Data Processing Annex — Application and roles

16.1 This Annex applies when Xentavi processes personal data in Customer Content, derivatives or receipts on Customer's behalf ("Customer Personal Data"), for free and paid processing and every enabled content type.

16.2 Customer is controller and Xentavi processor, or Customer is an authorized processor and Xentavi sub-processor. For account administration, billing, service security and legal obligations, Xentavi is an independent controller as described in the Privacy Policy.

17. Processing details

Subject and purpose: provision, security, support and termination of STAiMP; receipt, transmission and analysis of enabled content; generation and return of findings; limited receipts; export and deletion. Duration: agreement and content-specific deletion periods — at raw images and videos, and frames extracted from videos, are transient and receipts last 30 days. Data may include text, likenesses, voices, transcripts, prompts, C2PA/EXIF/device/location/author metadata, filenames, URLs, identifiers, scores, rules and findings.

18. Instructions and compliance

18.1–18.2 Xentavi processes Customer Personal Data only on documented instructions, including transfers, unless EU, Member State or applicable UK law requires otherwise. Xentavi will not independently reuse Customer Personal Data or authorize training, advertising or product-development evaluation.

19. Non-EEA customers and return transfers

19.1–19.3 Before processing, a Customer established outside the EEA must disclose legal establishment, access locations, GDPR Article 3(2) applicability and intended EU-facing use. Where GDPR Chapter V applies, the parties use an adequacy decision or valid safeguard, including SCC Module Four where appropriate. If none is available, Xentavi may block affected processing without liability.

20. Confidentiality and security

20.1–20.3 Xentavi maintains encrypted transmission; encryption at rest for retained Customer Personal Data; least privilege; tenant separation; minimization of source content in logs and backups; secure development; tested deletion; incident response and recovery controls. Content designated transient is excluded from routine logs and backups.

21. Sub-processors and transfers

21.1–21.2 Customer gives general written authorization for the sub-processors identified in the current provider record supplied before activation. We give at least 30 days' notice before adding or replacing a sub-processor. Customer may object on reasonable data-protection grounds.

21.4 Under Terms version 1.1, image analysis, including still frames extracted from videos, uses Kozelo SAS (Sightengine), France. Default infrastructure may process in the EU (France, Ireland, Germany, Finland), Canada or the United States, with no region lock. Xentavi does not use Sightengine's Feedback API or any storing feature for Customer Content. OpenAI and other unlisted LLM/AI providers are not authorized to receive Customer Personal Data.

22. Assistance, incidents and audit

22.1–22.3 Xentavi assists with data-subject requests, breaches, impact assessments and prior consultation, and notifies Customer of a confirmed personal-data breach without undue delay. Audit no more than annually unless a breach, regulator or substantiated concern justifies more.

23. Return and deletion

23.1–23.3 At processing end, Customer may choose return or deletion. Raw images and videos, and frames extracted from videos, are not retained by Xentavi after processing. Active receipts are deleted after 30 days and excluded from routine backups. We confirm deletion on request.

Contact

If you have questions about these Terms of Service, please contact our legal and compliance desk directly at:

Email: legal@xentavi.com

OPERATOR & LEGAL ENTITY

Xentavi Spółka z ograniczoną odpowiedzialnością

Registered Seat

ul. Domaniewska 47/406
02-672 Warszawa, Poland

Commercial Register

KRS: 0001258350
NIP: 5214175567 · REGON: 545420830

Official Contacts

legal@xentavi.com

Brand Ecosystem

staimp.com · xentavi.com