Legal documents

Every policy, agreement and annex we publish, what each one covers, and who it is written for. If you are reviewing one of our apps for a platform's app store, go straight to the per-app policies.

Effective {{TODO: the date you publish these}} Last updated 23 August 2026 Version 0.1-draft

Draft, not yet reviewed by a lawyer. These documents were prepared as a structured starting point. Every highlighted value still needs to be supplied, and the whole set needs review by qualified counsel in India before it is relied on.

Who each document is for

Five kinds of reader arrive here, and they need different pages. Find yourself below, then use the index in the next section.

Prospect: You are deciding whether to talk to us. Read the terms and the disclaimer. The disclaimer says plainly what an Agent can and cannot be relied on to do.
Client: You have engaged us, or you are running a vendor review before you do. Read the data processing addendum, sub-processors, AI and your data and security.
Merchant: You have installed one of our apps on your store or site. Read that app's own policy under app policies, and the annex for your Platform under platform annexes.
App-store reviewer: You are checking an app submission against a platform's requirements. Use the per-app policies. They name the app, its scopes and the records it reads and writes. This site-wide policy set does not.
End customer: You are a shopper or a lead of a business that uses one of our apps. That business controls your data and you should contact them first. The routing clause on each per-app policy explains what we do if you contact us instead.

Document index

Everything we publish, in one table. The two entries at the foot are indexes in their own right: each lists a page per app or per platform.

Document	What it covers	Who it is for
Privacy policy	What personal data this site and our engagements involve, why we hold it, how long we keep it, and the rights you can exercise.	Anyone who contacts us through this site. Clients deciding what data an Agent may reach.
Terms	The terms for using this website, and the terms that apply when you engage us to build and run Agents.	Prospects reading before they enquire. Clients under an engagement.
Disclaimer	What Agents can and cannot be relied on to do: probabilistic output, what evals prove, approval gates, and dependencies we do not control.	Anyone weighing what we claim. Clients deciding where a human gate stays.
Cookies	What this site stores in your browser and what the server logs. As of 23 August 2026 the site sets no cookies, runs no analytics and loads no third-party scripts.	Any visitor. Reviewers checking what this site tracks.
Data processing addendum	The controller and processor terms that apply when an Agent reads or writes personal data on your systems.	Clients and their counsel. Procurement and privacy reviewers.
Sub-processors	Every third party that may process Client Data or End Customer Data on our behalf, what it does, and where it sits.	Clients mapping their processing chain and checking onward transfers.
AI and your data	What is sent to a model provider during an Agent run, what a run trace contains, and what we do about training on your data.	Clients and merchants asking what happens to their data at inference time.
Security	The controls that are in place: transport encryption, least-privilege scopes, credential handling and incident response. We hold no certification and claim none.	Clients running a vendor security review. Platform reviewers.
App policies	An index of per-app policies. Each app has its own page naming that app's scopes, the records it reads and writes, and how data is deleted on uninstall.	App-store reviewers. Merchants installing or auditing one of our apps.
Platform annexes	An index of per-platform annexes. Each annex covers the data-handling and deletion rules a specific Platform places on apps built for it.	Merchants on a given Platform. Reviewers checking platform-specific obligations.

Core documents

Four documents apply to everyone who uses this website or engages us, whatever platform you are on and whichever app you install.

Privacy policy. Personal data, purposes, retention and rights.
Terms. Using the site, and engaging us to build and run Agents.
Disclaimer. The limits of what an Agent can be relied on to do.
Cookies. What this site stores in your browser, and what the server logs.

The cookie page is short on purpose. This site sets no cookies of its own, installs no analytics, and self-hosts its fonts, so there is nothing to consent to. What remains is the web server's access log, which records IP address, timestamp, URL, status and user agent.

Data processing

Four more documents cover what happens to data once an Agent is running. These are the set a client's counsel or a security reviewer normally asks for.

Data processing addendum. Roles, instructions, and the obligations each side takes on.
Sub-processors. Who else may touch the data, and for what.
AI and your data. What reaches a model provider, and what a run trace keeps.
Security. The controls in place today, stated without certification claims.

Read AI and your data alongside sub-processors. An Agent run sends prompts to a model provider, and those prompts can carry End Customer Data. The sub-processor list is where that provider is named.

Per-app policies

If you are reviewing an app for a platform's app store, use the per-app pages under /legal/apps/, not this site's general policies. A site-wide privacy policy cannot satisfy an app review, because it does not name the specific app, the scopes that app requests, the records it reads and writes, or what happens to that data when a merchant uninstalls. Each per-app page states those four things for one app.

Each per-app policy also carries the routing clause for End Customers: the merchant is the controller of a shopper's data, we act on the merchant's instructions, and a request that reaches us is passed to the merchant with our support in answering it.

Start at the app policy index. Every published app is listed there with a direct link to its own page.

Per-platform annexes

A Platform is Shopify, Wix, WordPress, Ecwid, HighLevel, BigCommerce, or another system an Agent connects to. Each one sets its own rules for how an app handles merchant and shopper data, how deletion requests are honoured, and what an app may do without asking.

An annex under /legal/platforms/ records those rules for one Platform and how we meet them. An annex adds to the core documents for the platform you are on. It does not replace them.

Platform requirements change on the platform's own schedule. Each annex marks any statement about a Platform's current requirement so it can be checked against that Platform's live documentation before anyone relies on it.

Words we use

These terms carry the same meaning on every page in this set.

Agent: Software we build that is given a goal and a set of tools, and that decides which tools to call and in what order to reach it.
Agent run: One execution of an Agent, from trigger to result, including its plan, tool calls, inputs and outputs.
Tool: A single typed capability an Agent may call, scoped to one operation against one system.
MCP server: A connector that exposes a system's operations to an Agent through one contract.
Human approval gate: A configured point at which an Agent's intended write action is held until a person approves it.
Eval: A test case, written from real examples, that an Agent is scored against before and after changes.
Run trace: The record of an Agent run: plan, tool calls, inputs, outputs, timings and cost. A run trace can contain personal data.
Client: The business that engages us.
Client Data: Data belonging to or controlled by the Client that an Agent reads or writes.
End Customer: An individual who deals with the Client, for example a shopper or a lead. Not our customer.
End Customer Data: Personal data about an End Customer that an Agent reads or writes on the Client's systems.
Service Data: Data we hold to run our own business: account details, billing records, our website's server logs.
Platform: Shopify, Wix, WordPress, Ecwid, HighLevel, BigCommerce, or another system an Agent connects to.
Sub-processor: A third party we use that may process Client Data or End Customer Data on our behalf.

Different laws use different words for the same two roles. Under the EU and UK GDPR they are controller and processor. Under India's Digital Personal Data Protection Act 2023 they are Data Fiduciary and Data Processor, and an individual is a Data Principal. Under the CCPA and CPRA they are business and service provider, and an individual is a consumer. Where these documents say controller and processor, the equivalent role under the law that applies to you is meant.

Who we are

AI Speedforce is the trading name of {{TODO: registered legal entity name, e.g. AI Speedforce Technologies Private Limited}}, a {{TODO: private limited company / LLP / sole proprietorship}} established in India.

Registration number: {{TODO: CIN or LLPIN}}
GSTIN: {{TODO: GSTIN, if registered}}
Registered address: {{TODO: full registered address, Delhi, India}}
Governing law: {{TODO: confirm, expected: laws of India}}
Courts: {{TODO: confirm exclusive jurisdiction, expected: courts at Delhi, India}}

Each document states the law and the forum that apply to it. Until the values above are confirmed, no document in this set asserts a governing law, a forum, a liability position or any other commercial term.

Contact

hello@aispeedforce.com reaches us and works today. The addresses below are the intended routes for specific requests, and each is still to be confirmed. Until then, write to the general address and say what your request is about.

Privacy and data requests: {{TODO: privacy@aispeedforce.com, confirm the mailbox exists}}
Legal notices: {{TODO: legal@aispeedforce.com, confirm the mailbox exists}}
Security and vulnerability reports: {{TODO: security@aispeedforce.com, for vulnerability reports}}
Support: {{TODO: support@aispeedforce.com, confirm the mailbox exists}}
Grievance Officer: {{TODO: name and email of the Grievance Officer. India's DPDP Act 2023 requires a Data Fiduciary to publish a contact who answers Data Principal questions}}
Data Protection Officer: {{TODO: EU/UK GDPR Art 37 DPO, only if one is appointed. If not appointed, say so plainly rather than naming a placeholder}}

Changes to these documents

We may update any document in this set. When we do, we change the "Last updated" date on that page and add a row to the version history at the foot of it. Section anchors are stable and we do not rename them, so a link to a section keeps working.

This index carries its own version history below, covering changes to the structure of the set: a document added, retired or moved.

Version history

Version	Date	Change
0.1-draft	{{TODO: the date you publish these}}	First published draft. Not yet reviewed by counsel.