Beta terms for Early Access. These apply to free use of the Ordainer Early Access beta. Paid plans and live keys aren't offered during the beta. Version: Beta preview 2026-10-13. Last updated: October 13, 2026. If we publish a new version, we'll email you at least 30 days before it applies to you (unless you accept it sooner, for example in the console), except where a change is required by law or needed to protect the security of the Service, in which case we'll tell you as soon as we reasonably can. See section 1A.12.
Ordainer Terms of Service
Version: Beta preview 2026-10-13. Last updated: October 13, 2026.
These Terms of Service (the "Terms") are a contract between Ordainer ("we", "us"), a business based in Ottawa, Ontario, Canada, and the business that signs up for the Service ("you", the "Customer"). Please read them. Section 6 (what we are not responsible for), section 16 (limitation of liability) and section 20 (governing law) matter most.
1. Who we are, who can use the Service, and how you accept
1.1 Us. Ordainer ("we", "us") is a business based in Ottawa, Ontario, Canada. Until our company is incorporated, Ordainer is run as an unincorporated business. When the company is incorporated, these Terms will transfer to it (sections 21.1 and 21.2). You can reach us at support@ordainer.ai. You can ask us at any time for the full legal name and address of the person operating Ordainer: email support@ordainer.ai.
1.2 Businesses only. The Service is for businesses. It is not for personal, family or household use. By accepting these Terms you confirm that you are using the Service for a business, and that the person accepting has authority to bind that business. If you are accepting on behalf of a company, "you" means that company.
1.2A Businesses established outside Quebec. The Service, and these Terms, which are in English only (section 22.5), are offered to and intended for businesses established outside the province of Quebec. If we learn that you are established in Quebec, we may end these Terms by notice to you, and we will refund any prepaid fees for the unused period (section 9.8(f)).
1.3 Accepting. To sign up you must tick a box confirming that you agree to these Terms and the DPA and have read the Privacy Policy. You cannot sign up without ticking it. We keep a record of each acceptance: the versions of the three documents, the date and time, the email address used, and a one-way hash of the IP address. When we publish a new version, we email you before it applies to you, and we ask you to accept it the next time you sign in (section 18.2). If you do not agree, do not sign up or use the Service.
1.4 Other documents that form part of these Terms.
- (a) The Data Processing Addendum at https://ordainer.ai/legal/dpa (the "DPA") is part of these Terms. It applies to the personal information we process on your behalf.
- (b) Any order form or written plan agreement signed by both of us. If it conflicts with these Terms, the order form wins for that specific point.
- (c) Our Privacy Policy at https://ordainer.ai/legal/privacy explains how we handle personal information where we decide how it is used (for example, your account email). It is for information and is not part of this contract.
1.5 Order of priority. If documents conflict: an order form first (for the point it covers), then the DPA (for anything about personal information), then these Terms.
1A. Beta
1A.1 Who the beta is for. These Terms are a beta version for free use of the Ordainer Early Access Beta (the "beta") by anyone who signs up during the beta (our "beta testers"). Sign-up is open to businesses that meet section 1.2.
1A.2 The beta is free: no card, no live keys, no paid plans. The beta is free. We don't ask for a card or other payment method, and live keys and paid Subscriptions are not offered during the beta. No payments are taken during the beta. Any checkout shown in the console is a test checkout: it takes no real payment and creates no paid Subscription. The sections of these Terms about Subscriptions, payment, billing, missed payments and live keys (including sections 4.3, 5.6, 9, 10, 11.7 and 11.8, where they refer to a Subscription) describe how paid plans will work, and apply only once you subscribe under our final Terms. If a test checkout unlocks live keys in the console, those keys are part of the free beta: no fees apply to them, and they are not a paid Subscription.
1A.3 Where the beta runs. The beta runs on our beta environment, hosted by Render and Neon in the United States (Ohio region).
1A.4 Decision Records. Decision Records are kept for 90 days (section 11.4).
1A.5 Backups. Our database has 7-day point-in-time recovery, so data can be restored for up to 7 days. There is no off-site backup copy yet. We plan to add one with Backblaze, but it isn't in use yet (section 11.12).
1A.6 Test-key limit. During the beta, each beta tester's account gets the test-key limit in section 4.2 (currently 1,000 Decisions per calendar month, UTC). For accounts we invite or run as a pilot, we may agree a higher limit of up to 10,000 test-key Decisions per calendar month (UTC). The console shows your test-key usage.
1A.7 Shadow mode. On a shadow-mode Plan, a call is never blocked because of a Plan limit or the test-key limit. Calls past a limit are counted and recorded as "would deny" but still run, up to 10 times your monthly test-key limit. Beyond that, to protect the Service, we return a safety_limit_reached error (HTTP 429) instead of a Decision until your monthly test-key usage resets at the start of the next calendar month (UTC). Calls past that ceiling are not counted, and no Decision Record is written for them. Our SDK lets the call run when it gets this error, whatever its fail-open or fail-closed setting. If you call our API directly, your own code decides what happens, and we recommend treating safety_limit_reached as "run the call". The other rate limits in section 5.9 still apply. On an enforce-mode Plan, test keys over the test-key limit get a deny with the reason test_limit_reached (section 4.2(b)).
1A.8 Keep personal information out. Please use pseudonymous End Customer IDs (not names or email addresses) where you can (section 7.1(d)).
1A.9 Support. Support is by email to support@ordainer.ai, Monday to Friday. We aim to send a first reply within 1 business day (our business hours are 9 AM to 6 PM Eastern Time). These are targets, not commitments, and there is no service level agreement (section 5.8). Calls with our team are available on request only, through sales@ordainer.ai. We don't record calls unless we ask and you agree first.
1A.10 Provided as is; features may change; no service level agreement. The beta is provided "as is" and "as available" (section 14.2). Features may change or be removed during the beta. There is no service level agreement and no uptime commitment (section 5.8).
1A.11 Feedback. We welcome feedback on the beta. Section 12.3 applies to it: we may use it freely, we have no obligation to use it, it isn't treated as confidential, and we don't pay for it.
1A.12 How long the beta runs, and notice. The beta runs until paid plans launch; we don't promise an end date. We'll email you at least 30 days before the beta ends or before new terms apply to you, except where a change is required by law or needed to protect the security of the Service, in which case we'll tell you as soon as we reasonably can. During the beta, this notice applies in place of any shorter notice in sections 17.4 and 18.2.
1A.13 When the beta ends. When the beta ends, you can choose a free plan with its normal limits or a paid plan. If you don't choose, your account moves to the free plan. You keep your account, your keys and the data we still hold, with no need to sign up again. Decision Records are kept for 90 days (section 11.4), so older records won't exist. Paid plans will be offered under our final Terms. Beta discount: if your organisation is in the beta when it ends and subscribes to a paid plan within 30 days after the beta ends, you get 50% off your first 3 monthly payments for that plan. Taxes are calculated on the discounted amount. After those 3 payments, the normal price applies. The discount is for your organisation only, applies once, can't be transferred or exchanged for cash, and can't be combined with other offers. We'll remind you of it in the notice we send at least 30 days before the beta ends (section 1A.12). We don't promise any other discount, price or special offer for beta testers.
2. Definitions
In these Terms:
- "Service" means our hosted allow/deny check (the
POST /v1/decideAPI), the web console, the software development kit ("SDK"), the public demo, and related documentation. - "Agent" means an AI agent, bot, script or integration run by or for one of your End Customers that calls your product.
- "End Customer" means a customer of yours whose Agents use your product.
- "Agent Key" means a secret key we issue so that your product can ask the Service for a decision about an Agent. Each Agent Key belongs to one End Customer and one Plan.
- "Plan" means a limit you set up in the console: the tools it covers (either one tool or every tool), how many allowed decisions per calendar month, and the mode (shadow or enforce).
- "Decision" means one answer from the Service: allow or deny.
- "Decision Record" means the audit record we write for each Decision (each allow or deny). Requests rejected without a Decision are not recorded (section 5.1).
- "Customer Data" means data you or your product send to the Service or create in it, including End Customer names and external IDs, Plans, Agent Key details and Decision Records. It does not include Account Data.
- "Account Data" means information about you as our customer, such as the account owner's email address and billing details. The Privacy Policy covers it.
- "Subscription" means your paid subscription to a paid plan, billed monthly (a "Monthly Subscription").
- "Missed Renewal Date" means the renewal date on which a Subscription payment failed and was not paid in time (section 10.1).
- "Subscription End Date" means the date your Subscription ends: at the end of the paid period after you cancel (or straight away if you cancel with a payment still unpaid, section 10.1(f)), or, after a failed renewal payment that is never paid, at the end of the comeback period, when we cancel the Subscription (30 days after the Missed Renewal Date; section 10.1(e)). After a failed payment your live keys stop earlier, at the cutoff (section 10.1(d)).
3. Your account
3.1 Signing in. You sign in with a one-time link sent from login@ordainer.ai to your email address. Anyone who can read that inbox can get into your account. You are responsible for keeping the inbox secure, and for everything done through your account.
3.2 One owner. In this version of the Service each account has one owner (one email address). To change the owner email, contact support@ordainer.ai.
3.3 Accurate details. Keep your account email working and up to date. We send important notices there, including billing and suspension warnings.
3.4 Tell us about misuse. If you think someone has got into your account or an Agent Key has leaked, revoke the affected keys in the console and tell us at support@ordainer.ai.
4. Agent Keys, test keys and live keys
4.1 Your keys, your responsibility. You create, hand out, store and revoke Agent Keys. We show each key's secret once, when it is created. We store only a one-way hash of it, so we cannot recover a lost key. A revoked key stops working straight away.
4.2 Test keys (free sandbox). Test keys are free. They are for building and testing, not for running your product for End Customers.
(a) Each account can make up to the monthly test-key Decision limit shown on our pricing page (currently 1,000 per calendar month, UTC), across all its test keys, unless we agree a higher limit with you. Allows, denies and shadow-mode "would deny" answers all count. Retries with the same idempotency key do not.
(b) Over the limit. Until the first day of the next month (UTC):
- On an enforce-mode Plan, test keys get a deny with the reason
test_limit_reached, and the SDK blocks the call even if it is set to let calls through when the Service is unavailable. - On a shadow-mode Plan, the call is never blocked because of a Plan limit or the test-key limit. Over the limit, the call is still counted and recorded as a "would deny" Decision Record (reason
test_limit_reached), but it gets an allow and runs. This continues up to 10 times your monthly test-key limit. Beyond that, to protect the Service, we return asafety_limit_reachederror (HTTP 429) instead of a Decision, until your monthly test-key usage resets at the start of the next calendar month (UTC). Calls past that ceiling are not counted, and no Decision Record is written for them. Our SDK lets the call run when it gets this error, whatever its fail-open or fail-closed setting (section 5.4). If you call our API directly, your own code decides what happens, and we recommend treatingsafety_limit_reachedas "run the call". The other rate limits in section 5.9 still apply.
Live keys are never affected.
- On an enforce-mode Plan, test keys get a deny with the reason
(c) Usage. The console shows your test-key usage for the month. If you need more for testing, email support@ordainer.ai.
(d) The "reset sandbox" button deletes your test-key counters and test-key Decision Records. It does not reset the monthly test-key limit.
(e) We may change the test-key limit with notice under section 18.
4.3 Live keys. You can create live keys only while you have a paid Subscription. Live keys are suspended as described in section 10 if a renewal payment fails and is not paid in time, or if your Subscription ends.
5. What the Service does, and what it does not do
5.1 What it does. When your product asks, the Service returns allow or deny for an Agent Key based only on the Plans, caps and keys you have set up, and the count of allowed Decisions so far in the period. Each Decision comes with a request ID (also returned in the X-Request-Id response header), and we write one Decision Record for each allow or deny. The following are rejected without a Decision, so no Decision Record is written and they are not counted:
- (a) calls with live keys after your Subscription has ended, through cutoff or cancellation (error
subscription_inactive, HTTP 403; section 10.3); - (b) calls with live keys on an account that has never paid (error
subscription_required; section 9.2(b)); - (c) requests that fail with an error before a Decision is made (for example an unknown or revoked key, an invalid request, a rate limit under section 5.9, the
safety_limit_reachederror under section 4.2(b), or a server error).
5.2 What it does not do. The Service does not run your tool, see the content of your tool's requests, or decide what your product does. A Decision is information. You decide what your product does with it.
5.3 Shadow and enforce modes. Each Plan has a mode, which you choose in the console (or which your code can set for a call):
- (a) Shadow mode: a deny is recorded as "would deny", and the SDK lets the call run. New Plans you create in the console start in shadow mode.
- (b) Enforce mode: the SDK blocks the call on a deny. Switching modes is your choice and your responsibility.
5.4 If our SDK can't get an answer in time: fail open or fail closed.
- (a) An SDK setting. Fail open and fail closed are settings of our SDK. You choose one for each route (each tool) in your SDK configuration (and, once available, your console settings). Fail open is the default, and you can change your choice at any time. If you call the API without our SDK, what happens is whatever your own code does.
- (b) When it applies. If our service doesn't answer in time, the SDK follows your fail-open or fail-closed setting for that route. That covers: no answer within the SDK's waiting time (about 250 to 300 milliseconds by default); a dropped connection; and a server error or an answer the SDK can't read. A
subscription_inactiveanswer (your Subscription is inactive) does not follow this setting: the SDK follows your separate billing-lapse setting instead (section 10.3(b)). - (c) Fail open: the call runs. Calls let through this way aren't checked or capped. In rare cases, a decision we recorded may not match what ran: if our server made and recorded a Decision, and counted it toward your cap, but the SDK had already stopped waiting (or the answer was lost on the way back), the SDK runs the call anyway, even if that Decision was a deny.
- (d) Fail closed: those calls are refused.
- (e) Refused under either setting. Some answers are refused even in fail open, because the Service did answer: a missing, invalid or revoked key, a bad request, the test-key limit on an enforce-mode Plan (
test_limit_reached, section 4.2), and most rate limits (section 5.9). The exception is thesafety_limit_reachederror for shadow-mode test-key calls (section 4.2(b)): our SDK lets those calls run under either setting. - (f) What we keep. We keep operational logs, never the content of calls (section 11.3). If and when our SDK's health reports become available, we will also keep counts of such calls unless you switch them off (section 11.3).
- (g) Your choice, your responsibility. You are responsible for the settings you choose (or your own code's behaviour) and for everything that results from them. To the extent the law allows, we have no liability for any outcome under either setting, including overage or usage beyond your caps, lost revenue, blocked End Customers or users, a recorded Decision that does not match what ran, and any loss suffered by you or your End Customers (section 6.1(f); section 6.2 still applies).
5.5 You are responsible for how your product acts. You are responsible for: your Plans and caps being correct; your choice of shadow or enforce mode, of fail open or fail closed for each route in your SDK configuration (section 5.4), and of your billing-lapse setting (section 10.3(b)), or your own code's behaviour if you don't use our SDK; how your product responds to an allow, a deny, an error or a timeout; and what you tell your End Customers.
5.6 Monthly decision ceiling (alert only). The Starter plan includes up to 1,000,000 allowed live-key Decisions per calendar month (UTC). Denies never count toward it. Going over it never changes a Decision. We send you an email and show a console banner, and we may contact you about a different plan.
5.7 Public demo. The public demo is a toy that shows how a deny works. It is provided as is, may be limited or removed at any time, and must not be used as part of any product.
5.8 No service level agreement. This is an early version of the Service. We do not promise any level of uptime, speed or support response time. Any status page we publish is for information only and does not create a commitment. We will make reasonable efforts to keep the Service available and to respond to support emails sent to support@ordainer.ai. Please include the request ID.
5.9 Rate limits. To protect the Service, we limit how many requests can be sent in a short time, including per Agent Key. Requests over a limit get an error (rate_limited, HTTP 429) asking the caller to retry later. We also limit repeated requests with an invalid or missing key from the same network address (too_many_failed_auth, HTTP 429). Requests with a valid key are never blocked because of other keys' failed attempts while our key check is working. If our key check is briefly unavailable during such a flood, a key we can't confirm at that moment (for example, one created moments ago, or one used just after we restart a server) may get a retryable error from this limit. rate_limited and too_many_failed_auth errors are answers, not outages under section 5.4: our SDK refuses those calls under either fail setting, and the caller can retry. We log a too_many_failed_auth refusal of a key we couldn't confirm internally as a possible wrong refusal so we can look into it. That log entry is not an admission that the refusal was wrong, and it gives no warranty, credit or other remedy (sections 6.1(b) and 14.2). We also limit how many requests one Agent Key can have in progress at the same time: extra requests may wait briefly in line, and if they still can't run they get a retryable error (concurrency_limited, HTTP 429, retry after about 1 second). Like the other rate-limit errors, our SDK refuses those calls under either fail setting (section 5.4). The safety limit for shadow-mode test-key calls works differently; see section 4.2(b). Limits are approximate: they are counted on each of our servers separately, so the real limit can vary. We may change them. We do not promise any particular rate limit.
6. What we are not responsible for
6.1 Please read this carefully. A wrong deny, a wrong allow, an outage or a suspension could affect your product and your End Customers. You control the settings that decide that effect (sections 5.3 to 5.5 and 10.3(b)). So, to the extent the law allows, and subject to section 16, we are not liable for any loss or claim arising from:
- (a) any allow, including an allow that lets an Agent go past a limit you meant to set;
- (b) any deny, including a deny that blocks an End Customer you meant to let through;
- (c) the Service being unavailable, slow or wrong, or returning errors, for any reason;
- (d) a suspension of live keys or of the Service under section 10, and any call made while your Subscription is inactive (section 10.5);
- (e) the test-key limit and the safety limit in section 4.2;
- (f) the fail open or fail closed setting you choose for each route (section 5.4), or the billing-lapse setting (open, or blocking turned on) that applies while your Subscription is inactive (section 10.3(b)), or how your own code behaves if you don't use our SDK, under any of these settings: calls that run unchecked and uncapped, a recorded Decision (including a deny) that does not match what ran, calls that are refused, usage over your caps, overage or extra costs, lost revenue, blocked End Customers or users, and losses to you or your End Customers; or
- (g) how your product, your code or your End Customers act on (or ignore) a Decision, error or timeout.
6.2 Overall cap still applies. If, despite section 6.1, we are found liable for any of these things, our liability is limited by section 16.
7. Your responsibilities
7.1 You will:
- (a) use the Service only in line with the law and these Terms;
- (b) keep your Plans, caps and keys accurate;
- (c) give your End Customers any notices, and get any consents, the law requires for the data you send us;
- (d) keep personal information in Customer Data to the minimum you need. In particular, use pseudonymous IDs rather than people's names or email addresses in End Customer names, external IDs, key labels, tool names and idempotency keys where you can;
- (e) not send us sensitive personal information (for example health, financial account or government ID numbers) in any field; and
- (f) comply with export control and sanctions laws that apply to you.
7.2 You are responsible for your End Customers' use of your product, and for any claims your End Customers make about it.
8. Acceptable use
You will not, and will not let anyone else:
- (a) resell, sublicense or offer the Service (or its allow/deny check) to others as a standalone service, other than as part of your own product;
- (b) load test, stress test, scan or probe the Service without our written permission;
- (c) try to get into another customer's account or data, or get around any limit or security measure;
- (d) use the Service to break the law, infringe others' rights, or send malware;
- (e) reverse engineer the Service, except where the law allows this despite this restriction;
- (f) use the Service to build a competing product; or
- (g) share Agent Keys or account access with anyone who is not working for you or your End Customers.
9. Fees, renewal, taxes and cancellation
9.1 Price. The Starter plan costs US$99 per month, unless an order form says otherwise. Prices shown at checkout apply.
9.2 Free sandbox, then pay first for live keys.
- (a) Free sandbox. You can use test keys free of charge, up to the monthly test-key Decision limit shown on our pricing page (currently 1,000 per calendar month, UTC) per account, as described in section 4.2 (during the beta, see section 1A.6). No payment method is needed.
- (b) Live keys after the first payment. Live keys are available only after the first Subscription charge (the first month) has been paid in full. It is charged when you subscribe through checkout (Billing, then "Subscribe"). Live keys unlock once that payment has gone through; with slower payment methods, that is when the money arrives. Until then, you cannot create live keys.
9.3 Automatic renewal. Your Subscription renews automatically until you cancel, and we charge your payment method at the start of each period:
- (a) a Monthly Subscription renews each month.
9.4 Payment processing. Payments are processed by Stripe. You authorise us, through Stripe, to charge your payment method for all fees when due. You must keep a valid payment method on file.
9.5 Taxes. Fees do not include taxes. You pay any sales, use, goods and services, harmonised sales, value-added or similar taxes that apply, other than taxes on our income. No payments are taken during the beta (section 1A.2).
9.6 Price changes. We may change prices with at least 30 days' notice by email. A change applies from your next renewal after the notice period. If you do not agree, you can cancel before it takes effect.
9.7 Cancelling. You can cancel at any time in the console (Billing, then "Manage billing (Stripe portal)"). Cancellation takes effect at the end of the period you have paid for (the current month). Your live keys keep working until then. If a payment has failed and is still unpaid, cancellation takes effect straight away instead (section 10.1(f)). To change your mind, resume the Subscription in the Stripe portal before the period ends.
9.8 Refunds. Fees are not refundable, and there are no partial refunds: we do not refund or credit partial months. The exceptions are:
- (a) if we end these Terms or stop offering the Service for convenience (section 17.4), we refund the prepaid fees for the period after the end date;
- (b) if you end these Terms because of our uncured material breach (section 17.3), we refund the prepaid fees for the period after the end date;
- (c) if you cancel because you object to a new or replacement Sub-processor (DPA section 7.4), we refund the prepaid fees for the period after cancellation;
- (d) if we end your Subscription because of an intellectual property claim (section 15.1), we refund the prepaid fees for the unused period;
- (e) if you pay an invoice after your Subscription has ended (section 10.1(g)), we restore your Subscription or refund that payment in full;
- (f) if we end these Terms because you are established in Quebec (section 1.2A), we refund the prepaid fees for the unused period; and
- (g) any refund the law requires.
9.9 Included decisions (alert only). The Starter plan includes 1,000,000 allowed live-key Decisions per calendar month (UTC). Denies and test-key Decisions never count. There are no overage charges on the Starter plan. If you go over, we email you and show a banner in the console. Going over never causes a deny and never blocks a call: your End Customers get the same answers as before. See sections 5.6 and 9.9A.
9.9A Fair use (denies are always free). Denies are always free. We never charge for denies, never add a fee for unusual usage, and never move you to a different plan or price without your agreement. If your account sends an unusually high number of requests that are denied (for example, an agent stuck retrying a denied call in a loop), we'll email the account owner, show a console banner, and contact you to help find and fix the cause. Rate limits (section 5.9) still apply. If the volume puts the Service or other customers at risk, we may limit or suspend only the affected Agent Keys under section 10.4; we'll tell you and lift it once the cause is fixed.
9.10 Your data after your Subscription ends. Nothing is deleted during the comeback period after a failed payment (section 10.1(e)). After the Subscription End Date we hold your account and data, with live keys off, and delete everything, Decision Records included, 90 days after the Subscription End Date (section 11.7). You can export your Decision Records until then (section 11.6).
9.11 Coming back.
- (a) During the comeback period after a failed payment (section 10.1(e)), pay the open invoice and the same live keys turn back on in the same account, except any keys you revoked.
- (b) After your Subscription has ended, for any reason (a voluntary cancellation or an unpaid failure), we never make you open a new account. To restart, subscribe again in the same account before the deletion date in section 11.7(b). Your End Customers, Plans, settings and remaining Decision Record history are still there. Once the payment has gone through, you create new live keys. Your old live keys never work again: they keep being refused (with the
subscription_inactiveerror, section 10.3) and can never be turned back on, whether or not you create new keys. If you use Issue new live keys in the console, the old keys are also shown as revoked.
10. Suspension
10.1 Failed payment. In short, for a Monthly Subscription: Stripe retries the payment for 1 week, then you get a 7-day warning, and your live keys keep working until the cutoff on day 14 after the Missed Renewal Date. Until 30 days after the Missed Renewal Date you can still pay the open invoice and get the same keys back. After that, the open invoice is voided, payment links stop working, and you must subscribe again and create new keys. The time from the failed charge to the cutoff is the payment window. If we only learn of a failed payment later than it happened (for example because a payment notice from Stripe didn't reach us), we count these periods from when the payment first failed where Stripe records it, and otherwise from when we learn of it, so they are never shorter than stated here.
- (a) While Stripe retries. If a renewal payment fails, we email the account owner to say so, and Stripe retries the payment automatically for 1 week. Your live keys keep working normally while the retries run.
- (b) 7-day warning. If the retries run out without a successful payment, Stripe marks your Subscription "unpaid" and the invoice stays open. We send a written warning to the account owner's email and show a banner in the console, 7 days before the cutoff. The warning includes a link to pay the open invoice and the date your live keys will stop (the cutoff), which is a fixed day: day 14 after the Missed Renewal Date for a Monthly Subscription. It does not move if Stripe's retries end earlier or later. Your live keys keep working until then.
- (c) Paying in time. If you pay the invoice before the cutoff (for example using the link in the warning), your Subscription goes back to normal and nothing is cut off.
- (d) Cutoff. If the invoice is still unpaid at the cutoff (day 14), your live keys stop, as described in section 10.3. We email you again and show a console banner. Your Subscription is not cancelled yet: the invoice stays open during the comeback period in (e).
- (e) Comeback period. Until 30 days after the Missed Renewal Date, you can pay the open invoice yourself, from the Billing page or the link in our emails. Once the payment has gone through, the same live keys turn back on in the same account (keys you revoked stay revoked), and your Subscription continues. Your renewal date stays the same, so the next month's charge may follow soon after. If your next renewal date has already passed when you pay, we charge the month that has already started at the same time (or send you an invoice for it if your card isn't saved for future charges); if that charge fails or the invoice isn't paid, this section 10.1 applies to it from that renewal date. If the invoice is still unpaid at the end of the 30 days, we cancel your Subscription and void the open invoice. A voided invoice can't be paid, so payment links in our earlier emails stop working, and no money can be taken through them. We will not try to collect a voided invoice, and you don't owe it. That is the Subscription End Date. Your account and data are then held with live keys off (section 11.7), your old live keys never work again, and to restart you subscribe again and create new keys (section 9.11(b)). Nothing is deleted during the comeback period.
- (f) Cancelling after a failed payment. If you cancel while Stripe is retrying, during the 7-day warning or during the comeback period, your Subscription ends and your live keys stop straight away (if they have not stopped already), as in section 10.3. The warning period is there so you can fix your payment. The last period you paid for has already ended, so no paid time is left to run out. We will not try to collect the unpaid invoice for the period you did not pay for. If you cancel during the comeback period, the invoice is voided and its payment links stop working, as under (e). If you cancel earlier, we stop collecting it; if you pay it anyway, (g) applies.
- (g) Paying an invoice after your Subscription has ended. After the comeback period the invoice is voided and can't be paid, so this applies only in rare cases: for example if you cancelled before the cutoff under (f) and then pay that invoice, or a payment lands in the moments before the void completes. Your live keys do not turn back on by themselves. Within one business day of your payment, we will either restore your Subscription for the period you paid for (with new live keys, section 9.11(b)) or refund the payment in full. To start again normally, subscribe again (section 9.11(b)).
10.2 Cancellation.
- (a) If you cancel, your live keys keep working until the end of the period you have paid for. If you cancel with a failed payment still unpaid, they stop straight away (section 10.1(f)).
- (b) About 7 days before that date (or straight away, if fewer than 7 days are left), we will send a warning email and show a console banner.
- (c) When the period ends, your live keys stop working, and we email you again and show a console banner.
10.3 What happens when live keys stop. The same applies whether your live keys stopped at the cutoff after a failed payment (section 10.1(d)) or your Subscription ended after cancellation (section 10.2):
- (a) Calls with your live keys get an error (
subscription_inactive, HTTP 403). This is not a deny. No Decision Record is written, and the call is not counted (section 5.1(a)). - (b) What the SDK does with that error: the billing-lapse setting. Our SDK has a billing-lapse setting for what happens when your Subscription is inactive. It is separate from each route's fail open or fail closed setting (section 5.4): when the SDK gets a
subscription_inactiveanswer, it follows the billing-lapse setting, not the fail setting for that route. The billing-lapse setting defaults to open: the call runs, whatever your fail setting is. Blocking is opt-in: to block calls instead, you must turn blocking on. If you do, the SDK returns an error without a retry-in-5-seconds hint, and your End Customers see a neutral message. Either way, the SDK logs a billing warning (not an outage warning; rate-limited by default, so it isn't repeated on every call) and calls the optionalonBillingInactivehook on each call. We also email the account owner when your live keys stop, and again 7 days later if they are still stopped, and show a console banner. If you call the API without our SDK, what happens is whatever your own code does. - (c) Test keys, the console and data export keep working.
- (d) If you pay the open invoice during the comeback period (section 10.1(e)), the same live keys turn back on once the payment has gone through. If you subscribe again after your Subscription has ended, you create new live keys; the old ones never work again (section 9.11(b)). Keys you revoked stay revoked.
10.4 Immediate suspension. We may suspend your account, or any Agent Key, straight away and without the warnings above if we reasonably believe that: (a) your use is a security risk to the Service or to others; (b) you are breaking section 8 (acceptable use); or (c) the law or a court or government order requires it. We will tell you as soon as we reasonably can and will limit the suspension to what is needed. We will lift it once the reason is fixed.
10.5 Your responsibility while your Subscription is inactive. Once your live keys have stopped, for any reason (at a cutoff, during the comeback period, or after your Subscription has ended), the Service no longer checks caps or records Decisions for them. Because the billing-lapse setting (section 10.3(b)) defaults to open, your caps stop being enforced while your live keys are stopped, unless you have turned blocking on. Calls then run unchecked, with no Decision Record. We email the account owner when your live keys stop, and again 7 days later if they are still stopped, and show a console banner, so you can act.
Whether you leave the billing-lapse setting open or turn blocking on (or, if you don't use our SDK, whatever your own code does), you are responsible for that choice and for any usage, cost or loss that results, including calls that run unchecked and calls that are refused. To the extent the law allows, we are not liable for anything that happens through calls made while your Subscription is inactive, under either choice (see sections 6.1(d) and (f), and 16).
10.6 No liability. We are not liable for a suspension made under this section (see sections 6 and 16).
11. Your data
11.1 You own Customer Data. As between us, you own Customer Data. You give us a non-exclusive licence to host, copy, process and display it only to provide, secure and support the Service for you, as these Terms and the DPA describe.
11.2 The DPA. For personal information in Customer Data, you are the controller and we are your processor (or service provider). The DPA sets out how we handle it.
11.3 Service data. We may use data about how the Service is used (for example counts of Decisions, errors, and when an account made its first Decision) to run, secure, support and improve the Service. This includes our operational logs: daily counts of failed or rejected requests per account, error code and client, and one log line for each decision request that reaches us, with its request ID, account ID, status, decision, error code, timings and queue and limit flags. They never contain request content, keys or IP addresses. We may also use statistics that are aggregated and de-identified, and that do not identify you, your End Customers or any person. If and when it is built, this would also include health reports from our SDK, which are planned but not yet in use: for each day, counts of the calls the SDK could not check with us (for example because of a timeout, a network error or a server error) and the slowest call time. The SDK would send them with your next decision request. They would contain no tool arguments, End Customer identifiers or other request content. You would be able to switch them off in the SDK settings (the clientStats option).
11.4 Audit history. We keep Decision Records for the history length of your plan:
- (a) Sandbox (test keys) and Starter: 90 days.
- (b) Growth (when offered): 365 days.
- (c) Public demo: 30 days.
When a Decision Record passes its history length, it is hidden from the console and exports. It is then permanently deleted when the whole calendar month that contains it has expired, which can take up to about one more month. If you move to a plan with a shorter history, older records are hidden straight away.
11.5 Append-only, with deletions logged. Decision Records are append-only: the database rejects changes and deletes, except for deletions made by the Service itself (history expiry, the deletions after a Subscription ends, account deletion, and sandbox resets). Each of those deletions is logged with the number of records removed and a hash of their request IDs, so you can check an earlier export against what was removed. This is a record-keeping feature, not a guarantee that records cannot be changed by someone with database administrator access.
11.6 Export. You can download your Decision Records as CSV or JSON from the console at any time while you have access to it, including after your Subscription ends and until your account is deleted, within the history length of your plan. Large exports are split into pages of up to 100,000 records.
11.7 After your Subscription ends. We never make you open a new account. If you do not subscribe again:
- (a) Held, with the Service off. From the Subscription End Date until deletion under (b), we only hold your account and Customer Data (End Customers, Plans, settings and Decision Records). Your live keys stay off. They keep being refused with the
subscription_inactiveerror and never work again, whether or not you later create new keys on a restart (section 9.11(b)). During this time the paid Service is off: we have no obligation to provide it, no service commitments apply, and we have no liability for its unavailability or for anything that happens through your product while it is off (sections 10.5 and 16). You can still sign in, use test keys under the free sandbox terms (section 4.2), and export your Decision Records (section 11.6). Your plan's history length (section 11.4) keeps running, so older Decision Records are hidden and deleted as usual. - (b) Deletion, 90 days after the Subscription End Date (after an unpaid failure, that is day 120 after the Missed Renewal Date): we delete everything in one step: Decision Records and related usage counters, End Customer records, Plans, Agent Keys, the change log, acceptance records (apart from the minimal record in section 11.10(b)), sign-in and session records, and your account and owner details. There is no earlier purge of Decision Records after the Subscription ends. We email the account owner about 14 days before.
- (c) Nothing is deleted during the comeback period after a failed payment (section 10.1(e)). If you subscribe again before the deletion date, nothing is deleted, and you create new live keys (section 9.11(b)).
11.8 Deleting your account yourself. You can delete your account from the console at any time when you have no active Subscription and no Subscription with an unpaid balance that is still inside the payment window in section 10.1 (whether Stripe shows it as past due or unpaid). So cancel first and wait for the paid period to end. If a payment has failed, either pay and then cancel, or wait for the cutoff in section 10.1(d). Once your live keys have stopped at that cutoff, or your Subscription has ended by cancellation, you can delete your account. Deleting during the comeback period first cancels your Subscription and voids the open invoice, as a cancellation would (section 10.1(f)); this can take a few minutes. Deletion happens straight away and cannot be undone, so export anything you need first. We email the account owner to confirm.
11.9 Inactive free accounts. If an account has never had a paid Subscription and has had no sign-in and no Decisions for 12 months, we delete it. We email the account owner 14 days before, and any sign-in or Decision in that time stops the deletion.
11.10 What we keep after deletion. After your account is deleted, we keep only:
- (a) a deletion record: an internal account ID, the reason, the time, how many records were removed, and your Stripe customer ID, so that billing records can still be matched for tax purposes. It holds no other information about you, and we delete it 7 years after the account is deleted.
- (b) a minimal record of what you accepted: the versions of the Terms, DPA and Privacy Policy and the date you accepted them, with no email address or IP address. We delete it 3 years after the account is deleted. We keep it as evidence of our contract while a claim could still be made.
- (c) Invoices and payment records are not in our database. Stripe keeps them, and we keep our official copy (Stripe invoices, payout reports, bank statements and an export of our books) in Canada, for six years from the end of the tax year they relate to, as Canadian tax law requires.
11.11 Holds. If we must keep information for longer, for example while a request to access personal information is open or for a legal claim, we put your account on hold. While the hold lasts, the automatic deletions in sections 11.7, 11.9 and 11.10, and the routine clean-up of old records, are paused for your account. If a record can't be held where it is (for example Decision Records reaching the end of your plan's history), we keep a copy for the hold. We keep held information only for that purpose. If you delete your account yourself under section 11.8, the deletion still goes ahead.
11.12 Backups. Our database host (Neon) keeps 7-day point-in-time recovery history so we can recover the Service after a failure or mistake. Because of this, deleted data can still be restorable from that history for up to 7 days after it is deleted; after that it is gone from that history. There is no off-site backup copy yet. We plan to add a daily encrypted off-site backup with Backblaze in Canada; it isn't in use yet, and we'll update these Terms and our sub-processor list before it starts. (The copy of billing records we keep in Canada for tax purposes, section 11.10(c), is a separate accounting record, not a database backup.)
12. Intellectual property and feedback
12.1 Ours. We (and our licensors) own the Service, including the software, SDK, documentation, and all improvements. Apart from the rights these Terms give you, we keep all rights.
12.2 Your right to use the Service. While these Terms are in force, we give you a non-exclusive, non-transferable right to use the Service, and to use and copy the SDK and documentation, only to connect your product to the Service.
12.3 Feedback. If you send us ideas, suggestions or other feedback (including feedback on the beta), we may use them freely, for any purpose, without paying you or owing you anything. We have no obligation to use your feedback, and feedback is not confidential: it is not your Confidential Information under section 13. This does not give us any rights to Customer Data or your other Confidential Information.
12.4 Your name. We will not name you as a customer, or use your logo, without your permission.
13. Confidentiality
13.1 "Confidential Information" means non-public information one of us shares with the other that is marked confidential or that a reasonable person would understand to be confidential. Customer Data is your Confidential Information. Non-public details of the Service are ours.
13.2 The receiving party will use the other's Confidential Information only for these Terms, protect it with at least reasonable care, and share it only with its employees, contractors, service providers and advisers who need it and who are bound by similar duties.
13.3 This section does not cover information that is or becomes public through no fault of the receiving party, was already known to it, is received lawfully from someone else, or is developed independently.
13.4 The receiving party may disclose Confidential Information if the law or a court requires, after giving the other party notice where legally allowed.
14. Warranties and disclaimer
14.1 Mutual. Each of us confirms that it has the authority to enter into these Terms.
14.2 Disclaimer. To the extent the law allows, the Service is provided "as is" and "as available". We give no other warranties or conditions, whether express, implied or statutory, including any about merchantability, fitness for a particular purpose, title, non-infringement, accuracy, or that the Service will be uninterrupted or error-free. The free sandbox, the public demo, and any feature labelled beta or early access are provided as is with no commitments of any kind. This doesn't limit our Privacy Policy, our Data Processing Addendum, or our security and confidentiality commitments in these Terms.
15. Indemnities
15.1 From us. We will defend you against any claim by a third party that your use of the Service, as permitted by these Terms, infringes that party's intellectual property rights, and pay the damages and costs finally awarded or agreed in settlement. This does not apply to claims caused by Customer Data, your product, your changes, combining the Service with things we did not provide, or use in breach of these Terms. If such a claim happens or seems likely, we may get you the right to keep using the Service, change it so it no longer infringes, or end your Subscription and refund prepaid fees for the unused period.
15.2 From you. You will defend us against any claim by a third party (including any End Customer) arising from: (a) Customer Data; (b) your product, including how it acts on Decisions; or (c) your breach of section 7 or section 8; and you will pay the damages and costs finally awarded or agreed in settlement.
15.3 How it works. The party asking for defence must tell the other party promptly about the claim, let it control the defence and settlement (a settlement that admits fault or imposes duties on the protected party needs that party's consent), and give reasonable help at the defending party's cost.
16. Limitation of liability
16.1 No indirect losses. To the extent the law allows, neither of us is liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any lost profits, lost revenue, lost business, lost goodwill, or loss of data, even if told they were possible.
16.2 Overall cap. To the extent the law allows, each party's total liability arising out of or relating to these Terms and the Service, for all claims together, is limited to the fees you paid us for the Service in the 12 months before the event that gave rise to the claim.
16.3 Exceptions. Sections 16.1 and 16.2 do not limit: (a) your obligation to pay fees; (b) your liability for breach of section 8 (acceptable use); or (c) liability that cannot be limited by law.
16.4 These limits apply whatever the legal theory (contract, tort including negligence, or otherwise), and even if a remedy fails of its essential purpose.
17. Term and termination
17.1 Term. These Terms start when you accept them and continue until your account is closed.
17.2 By you. You can stop using the Service at any time. To end a Subscription, cancel it as described in section 9.7. To close your account entirely, delete it from the console as described in section 11.8.
17.3 For breach. Either of us may end these Terms by notice if the other materially breaches them and does not fix the breach within 30 days after notice. If you end them because of our breach, we refund the prepaid fees for the period after the end date (section 9.8(b)).
17.4 By us, for convenience. We may end these Terms or stop offering the Service with at least 30 days' notice. If we do, we will refund prepaid fees for any period after the end date.
17.5 What happens at the end. Your access to live keys stops, your data is handled as described in section 11.7, and any fees owed become due. Sections 6, 9 (for fees owed), 11.7 to 11.12, 12, 13, 14.2, 15, 16, 17.5, 19, 20, 21 and 22 survive.
18. Changes
18.1 To the Service. We may change the Service. If a change materially reduces a core feature you pay for, we will give you at least 30 days' notice by email or in the console, unless the change is needed for security or legal reasons.
18.2 To these Terms. We may update these Terms. If we publish a new version, we will email you before it applies to you. For a material change, we will give you at least 30 days' notice by email before it takes effect. Changes needed for legal reasons may take effect sooner. If you keep using the Service after a change takes effect, you accept it. If you do not agree, you may stop using the Service, or cancel before the change takes effect, and the earlier version applies until your Subscription ends.
19. Notices
We will send notices to your account email or show them in the console. You must send legal notices to us by email at support@ordainer.ai. Notices by email are received when sent, unless the sender gets an error message.
20. Governing law and courts
These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict-of-law rules. The courts located in Ottawa, Ontario have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each of us submits to them. Either of us may still seek an urgent injunction in any court. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
21. Assignment
21.1 By us. We may transfer (assign) these Terms, in whole or in part, without your consent, to an affiliate or to a successor of all or part of our business, including on our incorporation, amalgamation, continuance, reorganisation, merger, or sale of assets. A change of our legal name or brand does not affect these Terms. We will tell you about a transfer.
21.2 Before incorporation. Until our company is incorporated, Ordainer is run as an unincorporated business. When the company is incorporated, these Terms, the DPA and our obligations under them transfer to it (section 21.1), and we will tell you by email. You can ask us at any time for the full legal name and address of the person operating Ordainer: email support@ordainer.ai.
21.3 By you. You may not transfer these Terms without our written consent, except to a successor to all or substantially all of your business, with notice to us. Any other transfer is void.
22. General
22.1 Whole agreement. These Terms (with the DPA and any order form) are the whole agreement between us about the Service and replace earlier discussions. Any terms on your purchase orders or forms do not apply.
22.2 Force majeure. Neither of us is liable for delays or failures caused by events beyond its reasonable control (for example failures of hosting or internet providers, power, natural disasters, or acts of government), other than payment obligations.
22.3 Relationship. We are independent contractors. Nothing in these Terms creates a partnership, agency or employment relationship.
22.4 Severability and waiver. If any part of these Terms is unenforceable, the rest stays in force. Not enforcing a right is not a waiver of it.
22.5 Language. These Terms, the DPA and the Privacy Policy are written in English only. That is why the Service is offered to and intended for businesses established outside Quebec (section 1.2A).
22.6 No third-party rights. No one other than you and us has rights under these Terms.
23. Contact
Ordainer, a business based in Ottawa, Ontario, Canada (unincorporated until our company is incorporated; see section 21.2). You can ask us for the full legal name and address of the person operating Ordainer at support@ordainer.ai. Support and legal notices: support@ordainer.ai · Calls with our team: sales@ordainer.ai · Privacy: support@ordainer.ai with "Privacy" in the subject · Sign-in links are sent from login@ordainer.ai.
Questions about these terms? Email support@ordainer.ai