Terms of Service

1. Parties

These Terms govern DeskNexo (“Service”) provided by YecoAI di Marco Nasi to professional hosting providers (“Customer”). The Service is B2B only, not a consumer contract.

2. Definitions

• End Users: your hosting clients whose tickets DeskNexo processes.
• AI system / provider / deployer: as in Regulation (EU) 2024/1689 (AI Act). YecoAI is the provider of DeskNexo as placed on the market; you are the deployer under your operational control.

YecoAI’s legal role is only: (i) seller of a B2B SaaS tool; (ii) processor / UK processor / Swiss processor / US service provider of End User ticket data on your instructions; (iii) controller of website, account, billing and (if you join Beta) already-redacted improvement text; (iv) AI Act provider for DeskNexo as placed on the EU/EEA market. YecoAI is not your DPO, lawyer, hosting ISP, payment institution, joint controller of End Users, or the controller of your helpdesk. Duties toward End Users (notices, AI labels, human review, contracts, local tax) stay with you.

3. Eligibility

You must be 18+ and authorised to bind a professional organisation. Consumer use is not permitted. The Service is offered to professionals in the EEA, the United Kingdom, Switzerland and the United States. You remain controller (or ‘business’) of End User data under the law that applies to you. We may refuse accounts that are not B2B.

4. Plans, billing, cancellation

Plans: Essential, Business, Enterprise. Prices in EUR exclude tax. Italian IVA applies where required; reverse charge for valid EU VAT IDs outside Italy. UK VAT, Swiss VAT and US sales/use tax are your responsibility unless the law makes us the collector. Billed monthly in advance via Stripe. Overage per published rates. Unpaid invoices may lead to suspension after 15 days.

Essential and Business are intended to remain as published long term. Enterprise may change with at least 30 days’ notice (email or panel). You may cancel anytime via the Stripe Customer Portal; access lasts until the end of the paid period. Refunds: Refund Policy.

5. Acceptable use

• No unlawful use; no reverse-engineering of models beyond applicable law; no resale without consent; no interference with other tenants.

6. AI operations, Art. 22 GDPR, liability

You choose Copilot or Autopilot. Destructive VM actions require your approval. You remain controller of End User data and of any automated decision that produces legal or similarly significant effects on End Users (GDPR Art. 22). You must keep human review available (Copilot / Approvals) where Art. 22 applies. You must not use Autopilot to terminate hosting contracts, score credit or insurance, decide employment, or otherwise produce Art. 22-type effects without a human in the loop. Those uses are outside the intended purpose of DeskNexo as placed on the market.

To the maximum extent permitted by Art. 1229 Codice Civile, we are not liable for indirect or consequential loss from AI actions. Aggregate liability is capped at fees paid in the 3 months before the claim. This does not limit liability for wilful misconduct or gross negligence, or any liability that cannot be limited by Italian law.

7. Data protection

Controller vs processor: Privacy Policy. Processor tickets: DPA, incorporated by accepting these Terms.

8. Intellectual property and Yeco-PII

The Service (software, models including Yeco-PII, docs, marks) is YecoAI’s. You keep your data, KB and tickets. You grant us a licence to process them to provide the Service. Yeco-PII processes ticket text to redact personal data before downstream models and summaries; Yeco-PII and encrypted storage still constitute processing. Staff do not read conversations. Beta opt-in additionally allows us, as controller, to use already-redacted DeskNexo ticket text to improve the Service (Privacy Policy Art. 6(1)(f)). That is not a licence to view raw PII.

You are responsible for reviewing AI output before it reaches End Users where your mode requires it (Copilot) and for any Autopilot configuration you enable.

9. EU AI Act (Regulation 2024/1689)

9.1 Roles

DeskNexo classifies tickets, generates replies, and may propose or execute VM actions. It is an AI system. YecoAI places it on the market as provider. You use it under your operational control as deployer.

9.2 Not placed as Annex III high-risk

DeskNexo is offered as B2B hosting-support automation (helpdesk + optional hypervisor actions you authorise). It is not placed on the market as a high-risk system under Annex III (it is not biometric identification, a safety component of critical infrastructure as defined there, employment/education scoring, credit or insurance eligibility, law enforcement, migration, or administration of justice). If you deploy it in a way that would make the use high-risk, you must not do so unless the applicable deployer obligations are met, and you must notify us. Human oversight remains available (Copilot, Approvals; destructive actions gated).

9.3 Prohibited practices (Art. 5)

You may not use DeskNexo for Art. 5 prohibited practices (e.g. social scoring by public authorities, untargeted facial-image scraping, emotion recognition in workplace/education as banned, exploitative subliminal techniques).

9.4 Transparency Art. 50 — your duty

Unless it is obvious from the circumstances, you must inform natural persons who interact with DeskNexo (including End Users receiving ticket replies) that they are interacting with an AI system. You shall configure WHMCS/helpdesk wording accordingly (e.g. a signature that the reply may be prepared by DeskNexo). We provide Docs guidance; you remain the deployer responsible for Art. 50 in your customer relationship.

9.5 Logging and incidents

The audit log records ingest, decisions, actions and replies to support oversight and post-market monitoring. You must not disable logging required for safe operation.

9.6 AI literacy (Art. 4)

As deployer you must ensure that staff who operate DeskNexo have a sufficient understanding of its capabilities and limits (Copilot / Autopilot, Approvals, Yeco-PII). Docs are provided for that purpose. YecoAI staff who operate the Service receive equivalent internal briefing.

9.7 Marking AI output

Ticket replies generated or substantially prepared by DeskNexo are AI-generated content. You must make that clear to End Users (Art. 50). If you use BYOK or a self-hosted model, you remain responsible for how that model is used with DeskNexo.

10. SLA

Enterprise includes a 99.9% uptime target with service credits as described in the order. Other plans are best effort. Maintenance with 48 hours’ notice where practicable.

11. Termination

We may suspend or terminate for material breach (30 days’ cure except immediate for security or §5). After end of access, export remains available 30 days, then deletion per DPA/Privacy, subject to Italian legal retention.

12. Customer warranties

You warrant that: (a) you contract as a professional and not as a consumer; (b) you have a valid legal basis and you give End Users the notices required of you as controller/business; (c) ticket content you send us is lawfully obtained; (d) you will not instruct Autopilot or VM actions that would unlawfully affect End Users or fall outside §6; (e) you will keep AI-interaction notices and, where needed, human review in your customer channel; (f) your tax details are accurate. A breach of (a)–(e) is a material breach.

13. Disclaimer of results; Yeco-PII limits

The Service is provided as a professional tool, not as a guaranteed outcome (no obligation of result for ticket resolution, AI accuracy, or 100% PII detection). Yeco-PII reduces personal data in downstream text; it does not make processing “anonymous” and may miss data. AI output can be incomplete or wrong. You must not treat DeskNexo as legal, tax, or security advice. Except for the Enterprise uptime target in §10, all warranties implied by law are excluded to the extent Art. 1229 c.c. allows.

14. Indemnity (private claims and your share of loss)

You shall defend and indemnify YecoAI, its owner and staff against third-party claims, damages, reasonable legal fees and contractual penalties arising from: (i) your unlawful use or instructions; (ii) your End User contract, marketing or support practices; (iii) your failure as deployer or as controller (including GDPR Arts. 5, 6, 12–22, 32–34 and AI Act Arts. 4, 5, 26, 50 as applicable to you); (iv) content you upload (KB, tickets, credentials); (v) tax or invoicing errors caused by data you supplied. This indemnity is a civil allocation between us. It does not bind a public authority and does not waive any fine the law places on YecoAI for YecoAI’s own conduct.

15. Regulatory proceedings (honest allocation)

Public-law fines (Garante, AGCM, AI Act market surveillance, tax authorities, or equivalent abroad) cannot be contracted away. If an authority investigates or sanctions processing that occurred because of your instructions, your configuration (including Autopilot), your failure to inform End Users, or your End User relationship, you shall: (a) promptly notify us; (b) cooperate in good faith (Art. 1375 c.c.) with facts and logs you control; (c) bear or reimburse, as between the parties, the portion of any fine, order cost, or defence cost that is attributable to your breach of these Terms or of deployer/controller duties. If an order is attributable to YecoAI’s own processor or provider failure, we bear that portion. Either party may suspend the Service if continuing would reasonably be expected to violate a final order. We may refuse or pause instructions that appear unlawful (GDPR Art. 28(3)(a)).

Nothing in these Terms is a representation to any authority that DeskNexo is “100% compliant”, certified, or approved. Marketing pages that describe GDPR-oriented design are not a conformity certificate under the AI Act or ISO/IEC 42001.

16. Change of law, orders, force majeure

If a new statute, guidance, or binding order makes a feature unlawful or materially more costly to operate, we may modify, geofence, or withdraw that feature with notice as practicable. Neither party is in default for delay caused by events beyond reasonable control (including infrastructure outages of named sub-processors, cyber-attack despite Art. 32-level measures, or public emergency). Fees already accrued remain due. Service credits under §10 are the sole remedy for covered downtime on Enterprise.

17. Third-party terms, sanctions, claims period

WHMCS, hypervisor, Clerk, Stripe, Cloudflare and any LLM endpoint you or we configure remain subject to their own terms; we are not liable for those providers’ independent failures except as Art. 1229 requires. You must not use the Service if you are subject to EU, UN, UK, Swiss or US (OFAC) restrictive measures that would make the contract unlawful. B2B claims arising from these Terms (other than indemnity for third-party claims still pending) must be notified in writing within 12 months of when you knew or should have known the facts; after that they are time-barred as between the parties, without affecting longer mandatory periods.

18. Governing law, venue, severability

The contract is governed by Italian law. Exclusive civil venue: Tribunale di Cuneo, without prejudice to mandatory rules. Public-law matters (Garante, ICO, FDPIC, US state AGs, tax) follow the competent authority. EU consumer ODR does not apply. UK, Swiss and US privacy duties are in the Privacy Policy and DPA addenda and apply by operation of those statutes, not by choosing English or US law for the commercial contract. If a clause is void, the rest stays in force. These Terms do not create a partnership, employment, or joint-controllership unless a specific processing is jointly determined in writing.

19. Changes to Terms

We may change these Terms with 30 days’ notice by email or panel. If you disagree, cancel before the effective date. Continued paid use after that date is acceptance of the new Terms (contract, not GDPR consent).

20. Contact