Changelog and Product Placement
Version 1.0
1. What this package contains
Nine documents replace the eight "FINAL" drafts of 26 July 2026. All findings of the internal legal review of 30 July 2026 (P0 blocking issues, P1 regulatory gaps, per-document findings, cross-document inconsistencies) have been worked in. One document is new: the AI Transparency Notice, which covers Airhive's own obligations under Articles 4 and 50 of the EU AI Act (in force since 2 August 2026).
| # | File | Canonical URL (to be served) |
|---|---|---|
| 1 | Airhive_Terms_of_Service_v1.0.docx | https://airhive.ai/legal/terms |
| 2 | Airhive_Privacy_Policy_v1.0.docx | https://airhive.ai/legal/privacy |
| 3 | Airhive_Data_Processing_Agreement_v1.0.docx | https://airhive.ai/legal/dpa |
| 4 | Airhive_Refund_and_Cancellation_Policy_v1.0.docx | https://airhive.ai/legal/refunds |
| 5 | Airhive_Cookie_Policy_v1.0.docx | https://airhive.ai/legal/cookies |
| 6 | Airhive_Legal_Notice_Impressum_v1.0.docx | https://airhive.ai/legal/imprint |
| 7 | Airhive_Subprocessors_v1.0.docx | https://airhive.ai/legal/subprocessors |
| 8 | Airhive_Acceptable_Use_Policy_v1.0.docx | https://airhive.ai/legal/aup |
| 9 | Airhive_AI_Transparency_Notice_v1.0.docx (new) | https://airhive.ai/legal/ai-transparency |
2. Global changes (all documents)
- Brand: "AirHive" replaced by "Airhive" throughout (260 occurrences). Email addresses unchanged.
- Entity data filled: Airhive GmbH, Eckernwoort 16, 22607 Hamburg, Amtsgericht Hamburg HRB 199886, managing director Daniel Dede, VAT ID DE464499000.
- Header block on every document: Document · Version · Effective from · Last updated · Supersedes · Canonical URL. The effective date is the only remaining placeholder and is set when the documents go live (see Section 4).
Version 1.0 everywhere; the Subprocessors list additionally carries a change-history table.
"should" → "will"/"does" in every operative provision (Privacy § 6, § 9, § 10; DPA Annex 2/3; AUP; ToS § 7, § 17).
One no-training sentence reused verbatim in ToS § 8, Privacy § 6, DPA § 9 and Subprocessors § 5: covers Airhive's own and third-party models, opt-in exception only.
- Deletion period aligned: 30 days production deletion, backup rotation at most 35 days (ToS § 17, Privacy § 13, DPA § 16, Annex 2).
- Age threshold aligned: 18 for paid Plans, 16–17 free Plan with parental consent, under 16 not permitted (ToS § 3, Privacy § 16).
- Order of precedence aligned: DPA prevails on data-protection matters, including over an order form (ToS § 1, DPA § 1).
Forum changed from Munich to Hamburg (ToS § 28). Supervisory authority HmbBfDI named (Privacy § 15, Impressum § 7).
Contact addresses: six mailboxes are promised — support@, billing@, privacy@, security@, legal@, abuse@. Every one must exist and be monitored before go-live.
3. Per-document changes and where they live in the product
3.1 Terms of Service
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| B2B-only clauses labelled as such; new consumer section | §§ 21–24 | Signup must capture whether the Customer is a Consumer or Business Customer (checkbox "I am purchasing for a business" + optional VAT ID). Store the flag on the Account; it drives pricing display (incl./excl. VAT), renewal logic and cancellation button. |
| Age gate | § 3 | Signup: date-of-birth or age confirmation; paid checkout blocked under 18; free signup 16–17 requires parental-consent confirmation. |
| Fair-use on "unlimited" restricted to Business Customers | § 5 | Any throttling logic must check the Consumer flag; do not throttle "unlimited" features for Consumers except for automated abuse. |
| Licence narrowed (no "improve"); unqualified no-training commitment | § 8 | No pipeline may feed Customer Content into model training, fine-tuning or evaluation sets. Opt-in flag for future data-sharing programmes must default to off. |
| Airhive's own AI Act obligations | § 9 | See AI Transparency Notice (3.9) for the concrete UI/API requirements. |
| Data Act switching terms and export categories | § 17 | Export function must cover: original files, extracted text/OCR, metadata/titles/tags/entities/Hive membership, instruction-set versions, audit log (per Plan), stored Generated Output. Formats: originals + JSON/CSV. No egress charges. Switching request channel: support@airhive.ai. |
| Consumer renewal: annual plans continue as indefinite term, cancellable monthly | § 18 | Billing: after the initial annual term of a Consumer subscription, switch to monthly charging at the monthly-equivalent price (or annual prepayment only if the Consumer actively selects it). Renewal reminder email 14 days before end of annual term. Price-change notice ≥ 30 days by email. |
| DSA notice handling: acknowledgement, decision, redress | § 19 | abuse@ workflow must send an automatic receipt, track the decision and send a decision email with review option. |
| Export period after termination ≥ 30 days | § 20 | Account deletion flow: 30-day grace export window before hard delete (except illegal-content/security terminations). |
| IP indemnity by Airhive, liability cap floor EUR 10,000, super-cap for confidentiality/DPA breaches (2× fees, min. EUR 100,000) | §§ 23–24 | No product impact. Decision point for Daniel: confirm cap magnitudes with insurer/counsel. |
| § 327r BGB change mechanics for Consumers | § 25 | Change notifications: email + in-app ≥ 30 days before a change that significantly impairs use; in-app record of the version each Customer accepted. |
| Contract language and stored contract text | § 27.5 | Account area must show the version of the Terms the Customer accepted (with date) and allow download. German version required before B2C launch in DE/AT. |
| Hamburg forum; § 36 VSBG statement | § 28 | None. |
| billing@ added | § 29 | Mailbox must exist. |
3.2 Privacy Policy
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| Roles allocated definitively (controller / processor) | § 2 | None. |
| Art. 13(2)(e): which data is required and consequence of not providing | § 4 | Signup form: mark required fields; nothing else required. |
| § 7(3) UWG existing-customer exception | § 5 | At the point where the email address is collected (signup and checkout), display the notice "We may send you information about similar Airhive products; you can object at any time free of charge" with an opt-out checkbox. Every marketing email carries an unsubscribe link. |
| Hosting location for all data categories; "no third-country transfer" statement | § 10 | Must be true: no non-EU provider, no non-EU staff access (see Section 4). |
| Concrete retention periods (security logs 90 days, audit logs per Plan, support 3 years, billing 8/10 years) | § 13 | Log retention jobs must enforce these periods. Workspace settings must display the audit-log retention period of the Plan. |
| HmbBfDI named | § 15 | None. |
| Children section aligned to age gate | § 16 | See ToS § 3. |
| Version/effective date at top; previous versions on request | § 18 | Keep an archive of every published version (see Section 5). |
3.3 Data Processing Agreement
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| Conclusion mechanics (accepted with the Terms; countersigned copy on request) | § 1 | Signup: the Terms-acceptance checkbox text must mention the DPA. Provide a downloadable DPA PDF from the account area. |
| Airhive DPA contact named | § 1 | privacy@ mailbox. |
| Personnel access: EU-only, logged, quarterly review | § 7 | Production access restricted to EU-located named staff; access log; quarterly review calendar. Confirm this is true for the whole team (see Section 4). |
| Subprocessor notice by email to Administrators + in-app | § 11 | Notification mechanism for Administrators (email template + in-app banner). |
| "No third-country transfer" + SCCs in reserve | § 12 | Same precondition as Privacy § 10. |
| Breach notification within 48 hours; designated security contact | § 15 | Workspace settings: optional "security contact" email field. Incident runbook must include the 48-hour Customer notification step. |
| Firm TOMs in Annex 2: TLS 1.2+, AES-256 at rest, MFA (TOTP) for every user on every Plan and enforceable per Workspace, mandatory MFA for staff, 90-day security logs, daily backups to a separate EU location, 35-day backup retention, RTO/RPO 24h, restore tests 2×/year, annual pen test, patch SLAs (critical 7 days, high 30 days), malware scanning of uploads | Annex 2 | Every line is a commitment. Engineering must confirm each one is implemented or implement it before go-live; anything not achievable must be removed from Annex 2 before publication, not left in. Specific features required: MFA for all users; Workspace-level "require MFA" setting; upload malware scanning. |
| Deletion confirmation on request | § 16 | Support process; ideally an automated deletion certificate email. |
3.4 Refund and Cancellation Policy
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| Consumer/Business definitions by reference | § 1 | None. |
| Consumer annual plans: no automatic fixed-term renewal; indefinite term, monthly cancellable | § 3 | See ToS § 18. |
| § 312k BGB cancellation button | § 4 | Required on airhive.ai and dash.airhive.ai: a permanently visible button labelled "Cancel subscription" (DE: "Verträge hier kündigen"), leading to a confirmation page (fields: type of cancellation, optional reason, identification – email/account, intended termination date) with a "Cancel now" ("Jetzt kündigen") button. Immediate email confirmation stating date/time received and the date the contract ends; downloadable. Must be reachable without login (identification by email is sufficient); must not be hidden behind menus. |
| Statutory withdrawal instruction inserted; checkout requirements | § 5 | Checkout for Consumers: (a) checkbox "I expressly request that the service begins before the end of the withdrawal period and acknowledge that I owe a proportionate amount if I withdraw" — unchecked by default; (b) order button labelled exactly "Order with obligation to pay" (DE: "Zahlungspflichtig bestellen"); (c) immediately above the button: Plan characteristics, total price incl. VAT, term, cancellation conditions; (d) after order: confirmation email containing the withdrawal instruction and the model form (durable medium). Withdrawal function in the account area sends acknowledgement email. |
| Trial conversion reminder 3 days before | § 6 | Email job. |
| Downgrade content deletion notice ≥ 30 days | § 7 | Downgrade flow. |
| Failed payment: ≥ 7 days notice before suspension | § 8 | Dunning schedule. |
| Refund response within 10 business days | § 13 | Support SLA. |
3.5 Cookie Policy
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| Concrete cookie table (names, provider, purpose, duration) | § 3.1 | The names and durations in the table (ah_session, ah_csrf, ah_consent, ah_locale, ah_ws, rate-limit identifiers, Mollie checkout cookies) are Daniel's proposal and must be matched to the actual implementation — either rename the cookies to match or correct the table. Nothing else may be set. |
| Preferences moved to strictly necessary only where user-requested; no consent-free "preferences" category | § 3 | Language and Workspace-state storage is allowed without consent only because the user actively selects it. Do not store anything else without consent. |
| Analytics: explicitly none | § 3.2 | Landing page and app must ship without any analytics/tracking script (no GA, Plausible, Hotjar, pixels). If marketing wants analytics, the policy must be updated first and a consent banner (reject as easy as accept) implemented. |
| Cookie settings link in footer and app settings | § 5 | Footer link "Cookie settings" on airhive.ai; settings entry in dash.airhive.ai. With zero consent-based cookies the page can simply show the table and state that no consent is required. |
| Global Privacy Control honoured | § 7 | Only relevant once consent-based cookies exist. |
3.6 Legal Notice / Impressum
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| Entity data, HRB, VAT ID, editorial responsible (Daniel Dede) | §§ 1–4 | Impressum page reachable from every page in two clicks (footer link). |
| Contact form as second fast contact channel (§ 5 DDG; ECJ C-298/07) | § 2 | Contact form at https://airhive.ai/contact with committed one-business-day response. Telephone number optional placeholder; add when available. |
| DSA Art. 11/12 contact points with languages (DE/EN) | § 5 | None beyond the mailboxes. |
| HmbBfDI | § 7 | None. |
3.7 Subprocessors
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| Mistral AI SAS (correct legal name); Mollie B.V. in the table with seat; column "Sees Customer Content" added | § 2 | Must be verified against the production stack (see Section 4). |
| Statement: EU-only personnel access | § 3 | See Section 4. |
| Change-history table | § 7 | Update on every change. |
| Additional notification address | § 8 | Optional field in Workspace settings. |
3.8 Acceptable Use Policy
| Change | Section | Product placement / engineering requirement |
|---|---|---|
| § 3 reframed from prohibition to allocation of responsibility (employment records, contracts, IDs are permitted) | § 3 | Marketing/onboarding copy may now say these use cases are supported. PCI: block or warn on card-number patterns if feasible (optional). |
| AI-generated marking must not be removed | § 5 | See AI Transparency Notice. |
| DSA Art. 16(4) receipt/decision | § 9 | See ToS § 19. |
| Security research safe harbour; 3-business-day acknowledgement; 90-day disclosure window | § 10 | security@ mailbox with acknowledgement process. Consider a security.txt at https://airhive.ai/.well-known/security.txt. |
| Statement of reasons and review (DSA Art. 17, 20) | § 12 | Enforcement actions must generate a statement-of-reasons email (facts, automated means yes/no, ground, redress) and a review function (email or in-app), with human decision. |
3.9 AI Transparency Notice (new)
| Requirement | Product placement / engineering requirement |
|---|---|
| Art. 50(1) disclosure in document chat | Chat UI: label the assistant "Airhive AI"; first message of every session states that answers are AI-generated and may be inaccurate. |
| Art. 50(2) visible marking | Every piece of Generated Output (suggested title, extracted values, summary, chat answer, proposal) carries an "AI-generated" badge until a user accepts/edits it; audit log keeps the AI-origin record after acceptance. |
| Art. 50(2) machine-readable marking | Exports: metadata field "generator: Airhive AI" in exported documents (and a content-credentials manifest where the format supports it). API: field "ai_generated": true plus model identifier on any response containing Generated Output. |
| Human oversight | Auto-apply only above a threshold set by an Administrator; every auto-applied change reversible from the audit log. |
| AI literacy | Documentation page at https://airhive.ai/docs/ai; in-product confidence indicator, files read and instruction version shown on each proposal; release notes on model changes. |
| Model/provider table | Must match the production stack (OCR pipeline location, Mistral models). Update the table when models change. |
4. Preconditions before the effective date is set (engineering confirmation required)
The documents make factual statements that are only lawful if they are true. Each item below needs an explicit yes/no from engineering. A "no" means the corresponding passage must be changed before publication.
| # | Statement in the documents | Where | Confirm |
|---|---|---|---|
| 1 | The Subprocessors list is complete: no other provider sees Customer Content or personal data. Specifically check: transactional email (e.g. Postmark, SES, Resend), inbound email processing for the email-in feature, error monitoring (e.g. Sentry), CDN/WAF (e.g. Cloudflare), authentication provider, product analytics, support-desk tool, LLM providers other than Mistral. | Subprocessors § 2 | yes / no + list |
| 2 | Every provider processes in the EU/EEA only; no non-EU support access to personal data (AWS support access only on request). | Subprocessors § 2, Privacy § 10, DPA § 12 | yes / no |
| 3 | No team member or contractor located outside the EU/EEA has access to production systems or Customer Content, including ad-hoc debugging access. | DPA § 7, Subprocessors § 3 | yes / no |
| 4 | Mistral processing region is France/EU, per-request, no retention, DPA with no-training clause signed. | Subprocessors § 2, AI Notice § 3 | yes / no |
| 5 | Backups: AWS eu-central-1, encrypted with keys held by Airhive, daily, 35-day retention. | Subprocessors § 2, DPA Annex 2 | yes / no |
| 6 | Every line of DPA Annex 2 (TLS 1.2+, AES-256, MFA for all users, Workspace MFA enforcement, staff MFA, 90-day logs, RTO/RPO 24h, restore tests, annual pen test, patch SLAs, malware scanning). | DPA Annex 2 | line by line |
| 7 | Cookie names, providers and durations match the implementation; no analytics or tracking anywhere. | Cookie § 3 | yes / no |
| 8 | Export covers all six data categories in the stated formats. | ToS § 17 | yes / no |
| 9 | Application URL is dash.airhive.ai (not app.airhive.ai). | All documents | yes / no |
| 10 | All six mailboxes exist and are monitored; contact form exists. | All documents, Impressum § 2 | yes / no |
5. Publishing mechanics
Serve every document at its canonical URL under https://airhive.ai/legal/ as HTML with the header block visible at the top; provide a PDF download of each.
Keep every published version permanently retrievable (e.g. https://airhive.ai/legal/terms/v1.0). The Privacy Policy promises previous versions on request, and the Terms promise that each Customer can see the version they accepted.
Record, per Account, the document version and timestamp of acceptance at signup and at every re-acceptance.
Set the effective date in all nine header blocks and in the Subprocessors change history on the day of publication; use the same date everywhere.
Footer links on every page: Terms · Privacy · Cookies · Cookie settings · Imprint · AUP · DPA · Subprocessors · AI Transparency · Cancel subscription.
German versions of the consumer-facing documents (Terms, Privacy, Refund/Withdrawal, Cookie, Impressum, AI Notice) are required before B2C launch in Germany/Austria; the English set is sufficient for a B2B launch. Translation and legal review are handled separately.
6. Decisions taken in this version (for transparency)
One set of Terms with B2B-only clauses labelled, rather than separate B2C/B2B documents.
Liability cap: greater of 12 months' fees (all Workspaces) or EUR 10,000; super-cap for confidentiality/DPA breaches: greater of 2× 12 months' fees or EUR 100,000. To be confirmed against insurance cover.
Breach notification to Customers: 48 hours.
"No third-country transfer" stated as fact, SCCs kept in reserve, conditional on Section 4 items 1–3.
Telephone number treated as optional (contact form with one-business-day response as the second fast channel).
DSA classification memo (hosting service, not an online platform; Art. 19 micro-enterprise exemption) is an internal document and is not part of this package.