Skip to Content

Legal

Vizum Apps — Terms of Service

Version 1.3 · Effective date: 4 November 2026 (clause 15.4(b) made explicit on 4 October 2026 — see clause 22.6) Language: English. A Spanish version of this document is published at /es/terms. See clause 24.3 on which version prevails.

1. Who we are, and what this document is

1.1. These Terms of Service (the "Terms") are a binding contract between you and Enrique Echeverría, a natural person trading as Vizum Apps, with establishments in Colombia and the United States of America ("Vizum", "we", "us").

1.2. We state this plainly because it matters to you: Vizum Apps is not, at the date of this version, an incorporated company. The contracting party is a natural person. If and when the business is incorporated, we will notify you under clause 22 and the incorporated entity will assume this contract by assignment; your rights under it will not be reduced by that change.

1.3. Contact for every purpose under these Terms, including notices, complaints, rights requests and copyright claims: support@vizumapps.com.

1.4. These Terms govern your access to and use of the website vizumapps.com, the Vizum App Store, the Vizum software modules, and the Managed AI service (together, the "Services"). Additional documents form part of your contract with us where they apply to you:

(a) the Data Processing Agreement at /dpa, which applies whenever we process personal data on your behalf (clause 13 and the DPA itself); (b) the Developer Agreement, which you accept in the developer portal before publishing an application, and which governs your relationship with us as a publisher (clause 9); (c) the plan description and price shown to you at the moment of purchase, which define what you bought (clause 10).

1.5. Where those documents conflict with these Terms, the order of precedence is: the Data Processing Agreement first (for matters of personal data processing), then the Developer Agreement (for publishing matters), then these Terms.

2. Definitions

2.1. "Platform Software" means the Vizum Odoo modules you install and run in your own Odoo database, on infrastructure you control — including Vizum Window Manager, Vizum Apps Platform and the store client modules.

2.2. "Store" means the catalogue, developer portal, account system, checkout and licensing service operated by us at vizumapps.com.

2.3. "vApp" means an application package distributed through the Store and executed inside the Platform Software. A vApp is either first-party (authored by us) or third-party (authored by a Developer).

2.4. "Developer" means any person or entity, other than us, who submits or publishes a vApp to the Store.

2.5. "Managed AI" means the hosted inference, embedding, retrieval, optical character recognition, transcription and image-generation service we operate and bill by consumption, together with the hosted vector and document storage described in clause 12.

2.6. "Customer Content" means the prompts, documents, files, extracted text, embeddings and other material you or your users transmit to, or store in, the Managed AI service.

2.7. "Consumer" means a natural person acting for purposes outside their trade, business, craft or profession. In Colombia this corresponds to the consumidor under Ley 1480 de 2011; in the European Union, to the consumer under EU consumer law. Everyone else is a "Business Customer".

2.8. "Instance" means a single Odoo database in which the Platform Software is installed and which is registered against a licence.

3. Formation of the contract, and how you accept

3.1. You enter into these Terms by any of the following acts, each of which constitutes acceptance:

(a) ticking the acceptance box presented to you at account creation, checkout or developer registration; (b) completing a purchase or subscription for any of the Services; (c) installing, activating or using the Platform Software against a licence issued by us; (d) transmitting Customer Content to the Managed AI service.

3.2. Acceptance by electronic means is valid and produces full legal effect. In Colombia this follows Ley 527 de 1999 on data messages and electronic commerce; in the United States, the E-SIGN Act (15 U.S.C. §7001) and applicable state law; in the European Union, Directive 2000/31/EC as implemented locally.

3.3. We keep a record of your acceptance — the version accepted, the date and time, and the account that accepted it — and we will provide that record to you on request.

3.4. If you accept these Terms on behalf of an organisation, you represent that you have authority to bind it, and "you" means that organisation.

3.5. A statement of current fact, made so you are not misled: at the date of this version, account creation through /web/signup and through the Store account API does not present an acceptance box. Until that box is deployed, we rely on clause 3.1(b), (c) and (d) — purchase, activation and use — to form the contract. We are deploying the acceptance box; the absence of it does not extend any right to you beyond what these Terms already give.

4. Eligibility and capacity

4.1. You must have legal capacity to contract. If you are a natural person, you must be at least 18 years old.

4.2. The Services are not directed at children. We do not knowingly create accounts for, or process the personal data of, persons under 18. If you believe a minor has an account, write to support@vizumapps.com and we will delete it.

4.3. You must not use the Services if you are subject to sanctions that prohibit it, or located in a jurisdiction subject to comprehensive trade sanctions under United States or European Union law.

5. Your account and your credentials

5.1. You are responsible for the accuracy of the registration data you provide, and for keeping it current.

5.2. You are responsible for your credentials and for every action taken through your account, except where the action results from our own failure. Passwords are stored only as salted hashes (PBKDF2-SHA512); we cannot recover a password and will never ask you for it. We enforce a minimum of eight characters. That is a floor, not a recommendation — use a long, unique password, and a password manager.

5.3. Notify us at support@vizumapps.com as soon as you become aware of unauthorised access. Until you notify us, we may treat instructions received through your account as yours.

5.4. We apply automated rate limiting to authentication (five failed attempts per five minutes, per IP address and per email address, with a fifteen-minute block) and to checkout. These limits protect your account and may occasionally delay a legitimate attempt.

5.5. Instance registration and claim codes. A licence is bound to an Instance, identified by your Odoo database UUID and by nothing else — not by database name, hostname or URL. On purchase we issue a claim code in the form VZ-XXXX-XXXX to your account email. It is valid for 30 days, and it can be redeemed once. Redemption binds the licence to the database that redeems it. Failed redemption attempts are rate-limited to eight per IP address per fifteen minutes.

5.6. One subscription covers one database. If you need a second or third Odoo database covered, you need a second or third subscription. A database already linked to another account cannot be claimed.

6. The three Services are different, and are treated differently

6.1. We sell three things. Our obligations are not the same for each, and this document does not treat them as if they were. In summary:

Where it runs Who holds your data Our role for personal data
Platform Software (clause 7) Your server, your Odoo database You None. We have no access.
Store (clauses 8–9) Our infrastructure Us We are the controller of your account, billing and store data.
Managed AI (clause 12) Our infrastructure and our AI providers Us, for what you send We are a processor acting on your instructions. See /dpa.

6.2. Read the clause that matches what you bought. A limitation stated for one Service does not silently extend to another.

7. Platform Software — licence and scope

7.1 Licence grant

7.1.1. The Platform Software is proprietary. Each module is distributed under the Odoo Proprietary License v1.0 ("OPL-1"), as declared in each module's manifest. Subject to your payment of the applicable fees and to these Terms, we grant you a non-exclusive, non-transferable, non-sublicensable licence, for the term of your subscription, to install and use the Platform Software on the number of Instances your licence covers.

7.2 What you may do

7.2.1. Install and run the Platform Software on the licensed Instance or Instances. 7.2.2. Allow any number of your own users to use it on a licensed Instance. Our plans are priced per database, not per seat. 7.2.3. Modify the source for your own internal use, including to adapt it to your Odoo deployment. We do not support modified copies, and modification is at your risk. 7.2.4. Make backup copies for your own continuity.

7.3 What you may not do

7.3.1. Distribute, publish, sublicense, sell, rent, lease, lend or otherwise make the Platform Software — or any derivative of it, modified or not — available to any third party. 7.3.2. Use one licence across more Instances than it covers, or share a licence across legally separate organisations. 7.3.3. Remove, obscure or alter copyright, licence or attribution notices. 7.3.4. Circumvent, disable or tamper with the licensing, entitlement or metering mechanisms. 7.3.5. Use the Platform Software to build or operate a service that competes with the Store or with Managed AI.

7.3.6. Where the OPL-1 text and this clause 7 differ, the OPL-1 text governs the licence grant, and clause 7 governs everything else in our relationship.

7.4 Your data stays with you

7.4.1. The Platform Software runs inside your Odoo database. We do not receive, store or have access to the business data it processes. You remain the sole controller of it, and this contract gives us no right to it.

7.4.2. The single exception is the desktop and Instance telemetry described in clause 15.4, and any Customer Content you choose to send to Managed AI under clause 12.

7.5 Versions, updates and supported Odoo releases

7.5.1. The Platform Software is currently offered for Odoo 17, 18, 19 and 20, Community and Enterprise editions. Support for a further Odoo release exists in our codebase but is not part of the published offer unless your plan says so.

7.5.2. Updates and new releases are provided during your subscription. You install them. We do not deploy to your server and are not responsible for the outcome of an update you apply, or for the consequences of one you do not.

7.5.3. Downloads of releases are gated by a signed link bound to your account and valid for ten (10) minutes. A link cannot be forwarded to someone else, and entitlement is checked at the moment of download, not at the moment the link was created. When a subscription ends, the ability to download new releases ends with it. Copies you have already downloaded and installed are addressed in clause 21.4. We publish a SHA-256 checksum for every release so that you can verify what you received.

7.6 Offline operation

7.6.1. Your desktop verifies its entitlement against the Store. If it cannot reach us, it keeps working for a limited period — it warns first, and stops only after that period elapses. This exists so that a network fault on our side does not stop your business on the same day.

7.6.2. Where the Store answers that an Instance is not entitled, the desktop warns and then stops within a shorter period.

7.7 Migration between databases

7.7.1. If you are moving to a new Odoo database, you can open a migration window from the portal. During the window, one subscription temporarily covers two databases, so you can stand the new one up before retiring the old one.

7.7.2. A migration window lasts 7 days. You may extend it once, by yourself, by 3 further days. Any further extension requires our approval, and requesting one does not move the deadline while it is pending.

7.7.3. A second migration window opened within 30 days of a previous one requires our approval. We will email you.

7.7.4. What the window grants is deliberately narrow: it lets the second database run the desktop. It does not carry over your Managed AI credit, and it does not carry over per-application paid licences. Those stay with the original database until you complete the cutover.

7.7.5. If the window closes without a cutover, entitlement simply returns to the original database. Nothing is deleted, nothing is billed, and the source database is untouched.

7.7.6. On cutover, your subscription and your per-application licences are rebound to the new database, and the old one stops being entitled.

8. The Store, and third-party vApps

This clause allocates the risk of software you obtain from someone other than us. Read it.

8.1 What the Store is

8.1.1. The Store is an intermediation service. For a third-party vApp, the contract for the application itself is between you and the Developer. We operate the catalogue, take payment, and deliver the package.

8.1.2. For first-party vApps authored by us, we are the supplier and clause 8.6 does not apply — our own obligations under clauses 17 and 18 do.

8.2 What we check before a vApp is published

8.2.1. Every submission runs automated validation: manifest correctness, the permissions the package declares, static checks over any server-side code the package declares, and a scan of its assets for embedded secrets.

8.2.2. A first submission that requests privileged permissions is additionally reviewed by a person. A submission that requests no privileged permission is published by the automated checks alone.

8.2.3. Two limits of that process we state rather than let you assume: (a) once an application has been published, later versions that pass validation are published without returning to human review, including versions that request wider permissions than the version you installed. Your protection against that case is clause 8.4.2, which operates on your own Instance and requires your administrator to approve the wider permissions before the new version will run; (b) the automated scan of an application's browser-side JavaScript is pattern-based, not an analysis of what the code does.

8.2.4. What this process is not. It is not a security audit, not a penetration test, not a malware scan, not a code correctness review, and not an assessment of whether the vApp is fit for your business. We do not warrant that a third-party vApp is secure, functional, lawful, or free of defects or malicious code. Passing validation means the package met our submission criteria on the day it was submitted. It means nothing more.

8.3 The technical containment we do apply

8.3.1. A vApp executes inside a sandboxed browser frame with an opaque origin, without access to your Odoo session or cookies, and with its own content restrictions applied to the frame. Every call it makes to your data crosses a bridge that checks the permission the vApp declared before allowing the call, and your Odoo access rights and record rules apply underneath, unchanged.

8.3.2. This is containment, not a guarantee. It reduces the harm a defective or hostile vApp can do. It does not eliminate it, and we do not represent that it is impossible to defeat.

8.4 Permissions, and changes to them

8.4.1. A vApp receives only the permissions it declares and you grant. Permissions determine which models, fields and operations it may reach, and which device capabilities it may use.

8.4.2. If a Developer widens the permissions an application requests, the new version requires a fresh approval. Until that approval is given, the widened version does not become available on your Instance. This can leave an application inaccessible after an update until someone with authority approves it. That behaviour is deliberate — it exists so that no application silently acquires access it did not previously have.

8.5 Your responsibility before you install

8.5.1. You decide what to install on your own database. Before installing a third-party vApp, review the permissions it requests, and satisfy yourself that they match what you are willing to expose. We give you the information; the decision is yours.

8.5.2. Install and test on a non-production database first. We recommend this and do not enforce it.

8.6 Who answers for a third-party vApp

8.6.1. The Developer is responsible for the vApp's behaviour, its correctness, its handling of your data, its compliance with the licences of anything it incorporates, and its support.

8.6.2. As between you and us, and to the fullest extent the applicable law permits, we are not liable for loss or damage caused by a third-party vApp. Your claim in respect of a third-party vApp lies against its Developer.

8.6.3. This limit does not apply where the law does not allow it, and we say where that is:

(a) Colombian Consumers. Ley 1480 de 2011 makes the productor and the expendedor jointly and severally liable to the consumer for the legal warranty (garantía legal) and for defective products. Where you are a Colombian Consumer and we sold you the vApp, clause 8.6.2 does not shield us from that joint liability, and we do not ask you to treat it as if it did. Your remedy under Articles 7, 8, 11 and 20 of Ley 1480 stands. (b) European Union Consumers. Mandatory consumer protection in your country of habitual residence applies, and clause 8.6.2 does not displace it. (c) Our own conduct. Clause 8.6.2 never covers our fraud, our wilful misconduct, our gross negligence, or death or personal injury caused by our negligence.

8.6.4. Where we are held liable under clause 8.6.3, we may recover from the Developer, and the Developer's indemnity to us under the Developer Agreement is expressly preserved.

8.7 Removal and takedown

8.7.1. We may remove or unpublish any vApp — including one you have installed — where it is malicious, defective, deceptive, unlawful, infringing, or in breach of the Developer Agreement, or where a competent authority requires it.

8.7.2. Removal from the catalogue stops new installations. It does not, by itself, stop a copy already installed on your Instance. An installed application keeps running under the licence you obtained until you remove it.

8.7.3. The one exception is a paid application. Where the licence behind a paid application is revoked — for example after a refund or a lost chargeback — the application stops running on your Instance once your Instance next revalidates the licence. Revalidation is periodic rather than immediate, so there is a window of continued use of up to fourteen (14) days.

8.7.4. A limit on our notice we must state: for a free vApp, the Store knows that an Instance has it installed only through the telemetry described in clause 15.4, and only for an Instance that has not switched that telemetry off. We may use it to notify you individually, but we do not undertake to: for an Instance that has switched it off, or that has not reported recently, we may be unable to identify that you installed the application. For that class of application, removal will be announced in the catalogue, and you should treat the catalogue, not your inbox, as the record of what has been withdrawn.

8.7.5. If we remove an application for a safety reason and cannot reach you, removing it from your own Instance is your decision and your action. We can withdraw distribution; we cannot uninstall software from your server, and we do not have that access.

8.7.6. Personalised packages. A paid or private application you download is watermarked with your database identifier before delivery. A copy passed to another database will not run there, and the watermark identifies the source of a leaked copy. Do not redistribute packages you obtain from the Store.

8.7.7. To report an application, write to support@vizumapps.com with the application's key, what is wrong, and how to reproduce it. For copyright claims, use clause 16.

9. Publishing to the Store (Developers)

9.1. To publish, you must accept the Developer Agreement in the developer portal. That agreement, in the version you accepted, governs publication, and its terms are summarised here for orientation only.

9.2. You keep ownership of your application. You grant us a non-exclusive right to list it, sandbox it, distribute it to customers through the Store, and reproduce its name, icon, screenshots and description for that purpose and to promote the Store.

9.3. Revenue share. For paid applications we retain the percentage stated in the Developer Agreement at the time you accept it, and the remainder is credited to you. Free applications are free to publish. The percentage is shown to you before you submit and is recorded against your acceptance.

9.4. Payouts. Earnings accrue to your developer account and are shown in the portal as pending and paid. The timing, threshold and method of payout are as stated in the Developer Agreement or as agreed with us in writing. We do not commit to a payout date in these Terms.

9.5. You warrant that you own or have licence to everything in your package; that it contains no malware and no undisclosed data collection; that it requests only the permissions it uses; that it complies with applicable law including data protection law; and that it does not infringe any third party's rights.

9.6. You indemnify us against any claim, loss, liability, fine or reasonable legal cost arising from your application, from your breach of clause 9.5, or from your handling of any customer's data. This indemnity survives termination.

9.7. We may reject, delay, unpublish or remove any submission at our discretion where it fails validation, requests permissions it does not use, is deceptive or broken, or breaches the Developer Agreement. We will give you the reason.

9.8. We do not act as your data processor in respect of data your application collects from customers. If your application processes a customer's personal data, that relationship is between you and the customer, and you are responsible for having the agreement the law requires.

10. Fees, payment, and what is refundable

10.1 Prices

10.1.1. Prices, billing period, trial (if any) and what each plan includes are those displayed at the moment you subscribe or purchase, and those are the terms of your purchase. Plans are priced per database, with your users included, and are billed in United States dollars unless the checkout states otherwise.

10.1.2. Prices exclude taxes. You are responsible for any VAT, IVA, sales tax, withholding or other levy applicable in your jurisdiction, except taxes on our own income. Where we are required to collect a tax, it is added at checkout.

10.2 Subscriptions

10.2.1. Subscriptions are taken and charged through Stripe. We never receive or store your card number. Card data passes from your browser to Stripe; we hold only Stripe's identifiers. Stripe's own terms and privacy notice govern its handling of that data.

10.2.2. Subscriptions renew automatically at the end of each billing period, at the then-current price for your plan, until cancelled. You may cancel at any time from the customer portal (/my/vizum-licence) or the billing portal, with effect at the end of the period you have paid for.

10.2.3. Where a plan is offered with a free trial, a payment method is required up front and the first charge is taken when the trial ends. Cancel before the trial ends and you are not charged.

10.2.4. Price changes apply from your next renewal and are notified at least 30 days in advance under clause 22. If you do not accept a price change, cancel before it takes effect.

10.2.5. Failed payment, stated precisely because the effect is immediate. If a renewal payment fails, the licence moves to a past-due state and entitlement stops at that moment — it does not run to the end of the period the failed payment would have bought. Payment succeeding restores it. Your Odoo database and its data are untouched throughout (clause 21.4.2).

10.2.6. Cancellation is different, and better for you. Cancelling does not end anything immediately: you keep full access until the end of the period you have already paid for, and the subscription then stops renewing. You may resume before that date. Cancelling does not produce a refund of the current period.

10.3 Managed AI: prepaid balance and consumption billing

10.3.1. Managed AI is prepaid. You add credit to a balance held against your Instance; consumption draws it down. You cannot spend credit you have not funded — when the balance is exhausted, requests are refused rather than charged.

10.3.2. Credit reaches the balance in these ways, and the way it arrived determines whether it can be refunded (clause 10.4): (a) a top-up you pay for; (b) an automatic top-up you have enabled, charged off-session to your saved payment method when the balance falls below the threshold you set; (c) the credit allowance granted by an AI subscription plan each period; (d) a grant we make, including any introductory trial credit made available on a new Instance; (e) a refund credited back to the balance.

10.3.3. Automatic top-up is opt-in and you control both numbers: the balance at which it fires, and the amount it charges. The amount must be greater than the threshold. You may disable it at any time from the portal. A saved payment method is required, and the charge is taken off-session — that is, without you being present. Instances running only on trial credit are never auto-charged.

10.3.4. Your balance can go below zero, in two situations, and we tell you both: (a) by at most one request. A charge is estimated before a request and reconciled to the real amount afterwards. Where the real amount exceeds the balance, the request that was already delivered is charged in full. Once the balance is at or below zero, further requests are refused. (b) on a refund or a lost chargeback. Where we return money for a top-up, the credit that top-up created is removed from your balance. If you had already spent it, the balance goes negative by that amount. You buy nothing further until you fund it back above zero. Asking for a refund of credit you have already consumed leaves you owing that amount.

10.3.5. Hosted storage is billed separately and monthly, at the published rate per thousand vectors per month and, where applicable, per gigabyte of stored documents, and only if you choose hosted residency (clause 12.2). If your vectors stay on your own infrastructure, we do not charge you storage.

10.3.6. When the balance is exhausted, hosted storage becomes read-only rather than deleted. New indexing and new uploads are refused; what you have already stored is not deleted for non-payment. Deletion happens only under clause 12.4.3.

10.3.7. Unused credit does not expire on its own, and it survives cancellation of a subscription. It is not transferable between accounts or Instances, and it has no cash value.

10.4 Refunds — exactly what is refundable

10.4.1. Refundable: a payment you made for a top-up, including an automatic top-up. That is the payment; the credit it created may still be in your balance or already spent.

10.4.2. Not refundable: (a) consumption — AI usage already delivered is a service performed, not a payment; (b) credit granted by a subscription plan, which is an allowance rather than a purchase; (c) unused credit as such — a balance you have not spent does not convert into money on request; (d) storage already accrued.

10.4.3. How to ask. Open a request at /my/vizum-ai/refunds, selecting the payment and the reason (charged twice, not authorised, service did not work, or other). You may request the whole payment or part of it; leaving the amount blank requests what is still refundable on that payment — the whole payment if nothing of it has been refunded before. The total refunded for one payment, across all your requests, never exceeds what you paid. A person reviews every request, you receive a reference by email, and the decision and its reason are shown in the portal and sent to you. Only one open request may exist per payment.

10.4.4. We do not commit to a fixed decision period in these Terms, and we will not pretend to one we have not measured. We commit to acknowledging your request when you open it and to giving you a reasoned decision.

10.4.5. An approved refund returns the money to the card that paid, through Stripe. It is not credited to your balance. Separately, and as clause 10.3.4(b) explains, the credit that the refunded payment created is removed from your balance, which may take the balance negative if you had already spent it. Your bank typically shows a refund within five to ten working days; that timing is the bank's, not ours.

10.5 Purchases of applications from the Store

10.5.1. A paid vApp is bought once, for a licence bound to your database. There is no self-service refund route for an application purchase.

10.5.2. To request one, write to support@vizumapps.com with the application, the database and what went wrong. We will consider it, and we will answer you with a reason.

10.5.3. A refunded application stops working. The licence behind it is revoked, and your Instance stops running it at its next revalidation (clause 8.7.3).

10.5.4. Consumers keep their statutory rights over an application purchase in full — clause 10.6 applies to it exactly as it applies to anything else you buy from us, and clause 10.5.1 does not displace a statutory right of withdrawal or a legal warranty.

10.6 Consumers keep their statutory withdrawal and warranty rights

10.6.1. Colombian Consumers. Article 47 of Ley 1480 de 2011 gives you a right of withdrawal (retracto) within five (5) business days of contracting, for distance and electronic sales, with reimbursement of what you paid. Articles 7, 8 and 11 give you the legal warranty (garantía legal) and the remedies attached to it. Nothing in clauses 10.4 or 10.5 removes either. Where those clauses and Ley 1480 conflict, Ley 1480 wins.

10.6.2. European Union Consumers. You have a 14-day right of withdrawal under Directive 2011/83/EU. For digital content and services supplied immediately, that right is lost only where you gave express prior consent to immediate performance and acknowledged the loss of the right; where we did not obtain that consent properly, the right stands.

10.6.3. United States Consumers. State consumer-protection statutes apply where they apply, and clauses 10.4 and 10.5 do not purport to waive them.

10.7 Chargebacks

10.7.1. Please use clause 10.4 or 10.5 before disputing a charge with your bank. Where we receive a chargeback, we may suspend the Services associated with the disputed payment until it is resolved, and the credit created by the disputed payment is removed from your balance (clause 10.3.4(b)). This does not limit your right to dispute a charge.

11. Availability, support and the absence of an SLA

11.1. We do not commit to a service level, an uptime percentage, or a maximum outage duration, and this document contains none. No figure appears here because no figure has been measured. Do not rely on availability that is not promised.

11.2. The Services are provided on a commercially reasonable-efforts basis. We may perform maintenance, and we will give advance notice of planned maintenance where we reasonably can.

11.3. Support response targets. Where the plan description shown to you at purchase states a support response target — for example an email response within a stated number of hours — that target is a response target for a first human reply, not a resolution time, and not an availability commitment. It applies during our business days.

11.4. Dependencies outside our control. Managed AI depends on third-party AI providers, and the Store depends on our hosting and payment providers. Where one of them is degraded or unavailable, the corresponding part of the Services may be degraded or unavailable. We do not accept liability for the acts, omissions or outages of those providers, subject always to clause 18.5.

11.5. The Platform Software runs on your infrastructure. Its availability is a function of your server, your Odoo installation and your operations, and is outside our control.

12. Managed AI, Customer Content, and where it goes

12.1 Your content stays yours

12.1.1. You retain all rights in Customer Content. We claim no ownership of it.

12.1.2. You grant us a limited licence to host, transmit, process, index, embed and display Customer Content solely to provide the Managed AI service to you, and to comply with law. That licence exists to run the service and for nothing else. It ends when the content is deleted.

12.1.3. We do not train any model on Customer Content. We do not sell it, and we do not use it for advertising.

12.1.4. What we cannot promise on your behalf, and will not pretend to. Your content is executed by third-party AI providers (clause 12.3). Our service does not transmit a technical "do not train" or "zero retention" instruction to those providers. Whether a provider retains your content, and whether it trains on it, is governed by that provider's terms for the account through which the request runs — our account for the shared pool, or your own account where you use your own key. If a no-training guarantee is a requirement for you, use your own provider key under a contract you have negotiated, and tell us before you send content.

12.2 Where your vectors and documents live: you choose

12.2.1. Retrieval storage operates in one of three residencies, and you set it: (a) local — vectors and original documents stay in your own Odoo database and filestore; (b) pgvector — the same, with the search running in your own PostgreSQL; (c) managed — vectors and original documents are stored on our infrastructure, and hosted storage is billed under clause 10.3.5.

12.2.2. This choice determines our data-protection role for stored content. In local and pgvector, we do not hold your indexed corpus. In managed, we do, as your processor under /dpa.

12.2.3. Inference always passes through us. Whichever residency you choose, prompts, the text sent for embedding, images sent for OCR and media sent for transcription are transmitted through our service to the AI provider selected for the request. We are your processor for that transmission in every residency mode.

12.2.4. A behaviour you must know before switching residency: if you change residency, originals written before the switch stay where they were written. Switching from managed to local does not move or delete what is already in our store. Use the export and deletion mechanisms in clause 12.4 if you want it moved or removed.

12.3 Which AI provider receives your content depends on your configuration

12.3.1. Managed AI routes requests to third-party providers. The providers we use are named, one by one, with their function and location, in Annex III of the Data Processing Agreement. Not all of them are established in the United States: Annex III says where each one is, and two are not. Content routed to a provider you select may therefore be processed outside the United States.

12.3.2. You select the model per application. Which provider receives a given piece of Customer Content is therefore a consequence of your own configuration, and we do not promise that your content goes to one provider rather than another. Where you supply your own provider key ("bring your own key"), your content goes to the provider you have keyed, under your own contract with them.

12.3.3. Provider terms apply to the provider's own processing. We pass your content to them to execute your request. We state plainly that we have not, at the date of this version, negotiated bespoke data processing agreements with those providers beyond their standard published terms. If that matters to your compliance position, tell us before you send content, and select your models accordingly.

12.4 Getting your content out, and deleting it

12.4.1. Export. You can export the vectors and documents held in managed residency at any time, through the export endpoint exposed to your Instance.

12.4.2. Deletion on demand. You can delete indexed documents from your Instance at any time; deletion applies to the store your Instance is configured for.

12.4.3. Deletion after cancellation. When a Managed AI subscription is cancelled, managed vectors and documents are retained for a grace period of 30 days (configurable, and 30 days by default) and are then purged. Export before the grace period ends. Your prepaid balance is not storage and survives cancellation (clause 10.3.7).

12.5 Limits and fair use

12.5.1. The economic limit on Managed AI is your prepaid balance. We do not currently impose a per-customer requests-per-minute or tokens-per-minute limit on chat, embedding, reranking, OCR or image generation.

12.5.2. The limits that do apply are quotas and per-request ceilings, and they exist to protect the service and to bound a single request: (a) a cap on document-indexing calls within a rolling window; (b) a cap on the number of concurrent transcription jobs per Instance; (c) per-request ceilings on message count, input size, output length, number of images, image size, document size and response size; (d) optional ceilings on total stored vectors and stored bytes.

12.5.3. The values in force are shown in the product and may change. Where a change reduces a limit materially, clause 22 applies.

12.5.4. We may refuse or throttle requests that threaten the stability of the service, and we may suspend an account generating abusive load. Where we do, we will tell you.

12.6 What you must not send

12.6.1. Do not send Customer Content that you have no right to send, that is unlawful, or that you are contractually or legally prohibited from disclosing to a third-party processor.

12.6.2. Do not send special categories of personal data (health, biometrics, genetic data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation), data relating to children, payment card numbers, or government-issued identifiers, unless you have first agreed it with us in writing and the Data Processing Agreement has been extended to cover it. The service has not been assessed for those categories.

12.7 AI output

12.7.1. AI output can be wrong. Models produce plausible text that may be inaccurate, incomplete or fabricated. Do not rely on AI output for legal, medical, financial, safety or other consequential decisions without human verification.

12.7.2. We make no warranty as to the accuracy, completeness, originality or fitness of AI output, and we do not warrant that output is free of third-party rights. As between you and us, you are responsible for how you use it.

13. Data protection

13.1. We are the controller of the personal data we process for our own purposes: your account, your instance registration, your billing relationship, the desktop and Instance telemetry described in clause 15.4, and the security logs described in clause 5.4. Our privacy notice describes that processing.

13.2. We are a processor of the personal data contained in Customer Content that you send to Managed AI, and of managed-residency stored content. You are the controller. That processing is governed by the Data Processing Agreement at /dpa, which forms part of these Terms and which you accept by using Managed AI.

13.3. We are neither in respect of the business data processed by the Platform Software inside your own database. We do not receive it.

13.4. Processing is carried out in the United States. For data subjects in the European Union or the United Kingdom that is an international transfer; for data subjects in Colombia it is a transfer to a country the Superintendencia de Industria y Comercio has not declared to have an adequate level of protection. The transfer mechanisms we rely on are set out in the Data Processing Agreement.

13.5. Cookies. The site sets three cookies and only three: session_id (your session), frontend_lang (your language) and VZLB (load-balancer affinity, without which the service does not function). There is no analytics, no tracking pixel and no third-party cookie. All three are strictly necessary and therefore exempt from prior consent under the ePrivacy Directive as implemented in the EU. That is why there is no cookie banner. If we introduce any tool that sets a non-essential cookie, we will introduce a consent mechanism at the same time.

14. Acceptable use

14.1. You must not, and must not permit anyone to:

(a) use the Services to break the law, or to infringe anyone's rights; (b) upload or transmit malware, or attempt to gain unauthorised access to any system, account or data; (c) probe, scan or test the vulnerability of our infrastructure without our prior written permission; (d) circumvent licensing, entitlement, quota, rate-limit or metering controls; (e) resell, rebroadcast or provide the Managed AI service to third parties as a service of your own; (f) use the Services to generate content that sexually exploits children, incites violence, harasses, defames, or facilitates fraud; (g) reverse engineer the Platform Software except to the extent that applicable law grants you a right that cannot be excluded by contract; (h) impose load intended to degrade the Services for others.

14.2. Responsible disclosure. Report a security vulnerability to support@vizumapps.com. We will not pursue you for good-faith research that respects clause 14.1(b) and (c), stops at proof of concept, and does not access, alter or exfiltrate anyone else's data.

15. Intellectual property

15.1. Ours stays ours. The Platform Software, the Store, the Managed AI service, the Vizum name and logo, the documentation, and everything we author remain our property or that of our licensors. These Terms grant you the licence in clause 7 and nothing else. No right is granted by implication.

15.2. Yours stays yours. Customer Content, your configurations, and any application you author remain yours (clauses 9.2 and 12.1).

15.3. Feedback. If you send us suggestions, we may use them without obligation, without confidentiality and without payment. You are not required to send us any.

15.4. Desktop and Instance telemetry, described exactly. The Platform Software reports two kinds of figures to us, once a day and already aggregated on your server:

(a) usage counters — a daily total per event name: an event label, a date and a count;

(b) a technical profile of the Instance — the version of the Platform Software; the Odoo series and edition (Community or Enterprise); the number of active internal users as a range (for example "11–25"), never the exact number; and the inventory of installed vApps: the identifier (key) and the version of every vApp installed in the Instance — whether it comes from the public Store, is a private app, or is an app you or your own developers built. The inventory is sent from 4 November 2026; before that date the Platform Software sends no part of the technical profile. It is one entry per vApp per day, in the form com.example.app@1.2.0, for the Instance as a whole. It says nothing about who uses an app or how, and carries no data from inside the app. An identifier is whatever its developer chose, so for an app you built yourself it may name your company or your project; an identifier longer than 52 characters is sent shortened.

It carries no user identity, no user names or email addresses, no IP address, no document, no record content and no per-user breakdown. We also record when an Instance last checked in.

15.4.1. We use it to operate and improve the product, to know which versions and applications are in use, and to verify entitlement. For the inventory of installed vApps the purposes are to check compatibility between the Platform Software and the vApps installed, to follow the health of each release, and to give support. It is retained for 730 days and then deleted automatically.

15.4.2. You can switch it off. An administrator of the Instance can stop the upload from the desktop's settings; the Platform Software then sends none of the data described in clause 15.4, including the inventory of installed vApps. Switching it off does not affect your entitlement.

15.5. Third-party components. The Services incorporate third-party software under its own licences. Those licences govern those components, and where one of them grants you rights that these Terms would restrict, that licence prevails for that component.

16.1. We respect copyright, and we remove infringing material from the Store.

16.2. To report infringement, send a notice to support@vizumapps.com containing: (a) a physical or electronic signature of the owner or a person authorised to act for the owner; (b) identification of the copyrighted work claimed to be infringed; (c) identification of the material claimed to be infringing, with enough detail for us to locate it — the vApp key and version; (d) your address, telephone number and email; (e) a statement that you believe in good faith that the use is not authorised by the owner, its agent or the law; (f) a statement that the information in the notice is accurate and, under penalty of perjury, that you are authorised to act for the owner.

16.3. On a compliant notice we will remove or disable access to the material and notify the Developer.

16.4. Counter-notice. A Developer who believes the removal was mistaken may send a counter-notice containing their signature, identification of the removed material and its previous location, a statement under penalty of perjury that the removal was the result of mistake or misidentification, their contact details, and consent to the jurisdiction of the federal court for their district (or, if outside the United States, any district in which we may be found). We may restore the material 10 to 14 business days after forwarding a compliant counter-notice, unless the complainant tells us they have filed an action.

16.5. Repeat infringers. We terminate the accounts of Developers who repeatedly infringe.

16.6. A statement of current fact. The safe harbour of 17 U.S.C. §512 requires a designated agent registered with the United States Copyright Office. We have not yet registered a designated agent. We operate the procedure in this clause 16 regardless, and we are completing that registration. This clause will name the agent when it is registered.

16.7. Misuse of this procedure. A person who knowingly and materially misrepresents that material is infringing is liable for damages under 17 U.S.C. §512(f).

17. Warranties, and what we do not warrant

17.1 Our warranty

17.1.1. We warrant that we will provide the Services with reasonable care and skill, and that we have the right to grant the licence in clause 7.

17.2 The disclaimer, for Business Customers

17.2.1. To the fullest extent permitted by law, and except for clause 17.1, the Services are provided "as is" and "as available", and we disclaim all other warranties, express, implied or statutory, including the implied warranties of merchantability, fitness for a particular purpose, title and non-infringement.

17.2.2. We do not warrant that the Services will be uninterrupted, timely, secure or error-free; that defects will be corrected; that the Services will meet your requirements; that AI output will be accurate; or that any third-party vApp is fit for anything.

17.3 The disclaimer does not apply to Consumers in the way it applies to businesses

17.3.1. Colombian Consumers. The legal warranty of Articles 7, 8 and 11 of Ley 1480 de 2011 is mandatory and cannot be waived, limited or excluded by contract. Article 43 of that statute makes an abusive clause ineficaz de pleno derecho — void of right, without needing a judge to say so — and expressly catches clauses that limit the supplier's liability for its own conduct or reverse the burden of proof. Clause 17.2 therefore does not apply to you, and where any part of these Terms would produce a result Ley 1480 forbids, that part does not apply to you either.

17.3.2. European Union Consumers. Directive 93/13/EEC on unfair terms and Directive 2019/770 on digital content give you rights that a contract cannot remove. Clause 17.2 does not remove them.

17.3.3. United States Consumers. Some states do not allow the exclusion of implied warranties. Where yours does not, clause 17.2 does not apply to you, and you may have other rights that vary by state.

18. Limitation of liability

Clause 18.1 to 18.4 apply to Business Customers. Clause 18.6 governs Consumers, and it is different.

18.1 No indirect loss

18.1.1. To the fullest extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, nor for loss of profit, revenue, goodwill, anticipated savings, business opportunity, or loss or corruption of data, however caused and whether or not the party was advised such loss was possible.

18.2 The cap

18.2.1. Our total aggregate liability arising out of or in connection with these Terms and the Services, in any twelve-month period, is limited to the greater of: (a) the total amount you actually paid us for the Service that gave rise to the claim in the twelve (12) months immediately preceding the event; and (b) one hundred United States dollars (USD 100).

18.2.2. The cap is aggregate across all claims, not per claim.

18.3 Managed AI, allocated separately

18.3.1. For a claim arising from Managed AI, the amount under clause 18.2.1(a) is the AI charges you actually consumed in the preceding twelve months. Unspent prepaid balance is not part of that figure, and is instead returned to you where clause 21 requires.

18.4 Third-party vApps

18.4.1. Clause 8.6 allocates that risk, and clause 18.2 applies to whatever residual liability we bear under it.

18.5 What is never limited

18.5.1. Nothing in these Terms excludes or limits liability for: (a) fraud or fraudulent misrepresentation; (b) wilful misconduct or gross negligence; (c) death or personal injury caused by negligence; (d) any liability that applicable law does not allow to be excluded or limited; (e) your obligation to pay fees due.

18.6 Consumers

18.6.1. If you are a Consumer, clauses 18.1 to 18.3 do not apply to you. Instead:

(a) We are liable to you for foreseeable loss caused by our breach of this contract or our negligence. Loss is foreseeable if it is obvious that it will happen, or if we both knew it might happen when the contract was made. (b) Colombian Consumers: Ley 1480 de 2011 governs. Article 43 renders abusive limitation clauses ineffective by operation of law, and we do not assert clauses 18.1 to 18.3 against you. Your remedies under the garantía legal — repair, replacement, or return of the money paid — and your right to bring an acción de protección al consumidor stand in full. (c) EU Consumers: mandatory liability rules of your country of habitual residence apply and are not displaced.

18.6.2. We say this because a clause that a court would strike is worth nothing, and pretending otherwise misleads you. The cap in clause 18.2 is drafted for commercial counterparties. Against a Consumer protected by Ley 1480 it would be ineffective, and we do not rely on it.

18.7 Basis of the bargain

18.7.1. The prices we charge reflect this allocation of risk. If you need a higher cap, an availability commitment or a bespoke indemnity, contact us before you buy — those are available by negotiated agreement, and are priced accordingly.

18.8 Time limit

18.8.1. Except where the law provides otherwise, and except for Consumers, any claim must be brought within one (1) year of the date the claim arose.

19. Your indemnity to us

19.1. If you are a Business Customer, you will indemnify us against any third-party claim, and any resulting loss, liability, fine and reasonable legal cost, arising from: (a) Customer Content you sent, including a claim that it infringes rights or was sent unlawfully; (b) your breach of clause 14 (acceptable use), clause 12.6 (what you must not send), or clause 7.3 (licence restrictions); (c) your use of the Services in breach of applicable law, including data protection law; (d) for Developers, clause 9.6.

19.2. This clause does not apply to Consumers.

19.3. We will notify you of any claim, allow you to control the defence of it with counsel we reasonably approve, and cooperate at your expense. You may not settle a claim in a way that admits our fault or imposes an obligation on us without our written consent.

20. Confidentiality

20.1. Each party will protect the other's non-public information disclosed in connection with the Services with at least reasonable care, use it only to perform this contract, and not disclose it except to personnel and advisers who need it and are bound to equivalent obligations.

20.2. This does not apply to information that is public without breach, was already known, is independently developed, or is lawfully received from a third party. Disclosure compelled by law is permitted, with notice to the other party where the law allows it.

21. Suspension and termination

21.1 By you

21.1.1. You may cancel a subscription at any time from the portal, with effect at the end of the paid period. You may close your account at any time by writing to support@vizumapps.com.

21.2 By us — suspension

21.2.1. We may suspend all or part of the Services where: (a) payment is overdue after we have told you; (b) your use threatens the security, integrity or availability of the Services or another customer; (c) we are required to by law or by a competent authority; (d) we reasonably believe the account is compromised or is being used for fraud.

21.2.2. We will tell you why, and restore the Services as soon as the cause is resolved. Where the reason is a security threat we may suspend first and notify immediately afterwards.

21.3 By us — termination

21.3.1. We may terminate for material breach that you do not cure within thirty (30) days of written notice, or immediately for a breach incapable of cure, for repeated infringement (clause 16.5), or for use that is unlawful.

21.3.2. We may discontinue a Service. If we discontinue a Service you are paying for, we will give you at least 90 days' notice and refund the unused portion of any prepaid subscription fee for that Service, plus the unspent prepaid AI balance where Managed AI is discontinued.

21.4 What happens to your software when it ends

21.4.1. Your licence to the Platform Software ends when your subscription ends. You must stop using it and remove it from your Instances. You lose access to new releases and to entitlement-gated functions.

21.4.2. Your Odoo database, and the business data in it, remain entirely yours. We hold none of it and take none of it.

21.5 What happens to your data when it ends

21.5.1. Managed AI vectors and documents held in managed residency are retained for 30 days after cancellation, and then purged. Export them within that window (clause 12.4.1). We will not recover them after the purge.

21.5.2. Your prepaid AI balance is not deleted by cancellation. Where we terminate without cause, or discontinue the Service, we return the unspent balance.

21.5.3. Account, billing and transaction records are retained for as long as tax, accounting and limitation law requires, and are then deleted.

21.5.4. Desktop and Instance telemetry is deleted automatically after 730 days (clause 15.4). Failed licence-claim attempts, which record the requesting IP address, are deleted after 7 days.

21.5.5. Three gaps we declare rather than conceal. At the date of this version: (a) there is no automatic retention limit on dormant Store account records. We delete an account on request under clause 21.1.1, and we are defining a retention period, which will be published in the privacy notice when set; (b) there is no automatic retention limit on transcripts produced by the transcription service. They persist until the Instance is deleted or you ask us to remove them. Ask us, at support@vizumapps.com, and we will delete them; (c) there is no automatic retention limit on usage and billing ledger records. They contain metering data — model, token counts, amounts and a pseudonymous user reference — and no prompt or response content.

21.6 Survival

21.6.1. Clauses 2, 8.6, 9.6, 15, 17, 18, 19, 20, 21.4, 21.5, 23 and 24 survive termination.

22. Changes to these Terms

22.1. We may change these Terms. Every version carries a version number and an effective date.

22.2. Material changes — those that reduce your rights, increase your obligations, or change price or scope — take effect no less than 30 days after we notify you, by email to your account address and by a notice on the site.

22.3. Non-material changes (clarifications, typographical corrections, contact details) take effect on publication.

22.4. If you do not accept a material change, cancel before it takes effect. Continuing to use the Services after the effective date is acceptance. For Consumers, where mandatory law requires express acceptance rather than continued use, we will obtain express acceptance.

22.5. We keep previous versions available on request.

22.6. Version history.

(a) 1.3 — effective 4 November 2026. Clause 15.4(b) now states explicitly that the technical profile includes the key and version of every installed vApp, public, private or your own, and why; clauses 15.4.1 and 15.4.2 follow. It applies from the same date as version 1.2 and is notified under clause 22.2.

(b) 1.2.1 — 4 October 2026. Clause 7.5.1 now lists Odoo 20 among the supported Odoo releases. It adds no obligation and reduces no right, so it is treated as a non-material change under clause 22.3: it took effect on publication, with no notice under clause 22.2 and no new acceptance.

(c) 1.2 — effective 4 November 2026. Telemetry (clause 15.4), notified under clause 22.2.

23. Governing law and forum

We explain the choice rather than merely stating it, because the practical effect differs depending on who you are.

23.1 The situation this clause has to serve

23.1.1. We contract from Colombia and the United States; our infrastructure is in the United States; and our customers may be in Colombia, the United States or the European Union. One law cannot govern all of it, because consumer protection in each of those places is mandatory and cannot be contracted away.

23.2 Governing law

23.2.1. These Terms are governed by the laws of the Republic of Colombia, excluding its conflict-of-laws rules and excluding the United Nations Convention on Contracts for the International Sale of Goods.

23.2.2. This choice does not, and cannot, deprive a Consumer of the protection of the mandatory law of their country of habitual residence. Under Article 6 of Regulation (EC) No 593/2008 (Rome I), an EU Consumer keeps that protection whatever this clause says. A Colombian Consumer keeps Ley 1480 de 2011. A United States Consumer keeps the mandatory statutes of their state.

23.3 Forum

23.3.1. Business Customers: the courts of Bogotá D.C., Colombia have exclusive jurisdiction.

23.3.2. Consumers may sue where the law entitles them to sue, and we will not object: (a) a Colombian Consumer may bring an acción de protección al consumidor before the Superintendencia de Industria y Comercio in exercise of its jurisdictional powers, or before the civil judge, under Article 56 of Ley 1480 de 2011; (b) an EU Consumer may sue in the courts of their own domicile under Articles 17 to 19 of Regulation (EU) No 1215/2012, and we may sue an EU Consumer only there; (c) a United States Consumer may sue where the law of their state entitles them to.

23.3.3. Injunctive relief. Either party may seek urgent injunctive relief in any court with jurisdiction, to protect intellectual property or confidential information.

23.4. Practical effect, stated plainly: if you are a business, a dispute goes to Bogotá under Colombian law. If you are a consumer, you keep your home law and your home forum, and this clause does not move you.

24. General

24.1. Assignment. You may not assign these Terms without our written consent. We may assign them to an entity we incorporate to carry on this business, or to a successor of the business, on notice to you, and the assignee assumes them in full. Your rights are not reduced by the assignment.

24.2. Entire agreement. These Terms, the Data Processing Agreement, the Developer Agreement where it applies, and the plan description shown at purchase, are the entire agreement between us and replace any prior understanding. This does not exclude liability for fraudulent misrepresentation.

24.3. Languages. These Terms are published in English and Spanish. For a Consumer domiciled in Colombia or in any Spanish-speaking country, the Spanish version prevails. For everyone else, the English version prevails. Where a translation creates an ambiguity, the version that better protects the Consumer prevails.

24.4. Severability. If a provision is held invalid or ineffective — including by operation of Article 43 of Ley 1480 de 2011 — it is severed to the minimum extent needed and the rest continues in force.

24.5. No waiver. Not enforcing a right is not a waiver of it.

24.6. Force majeure. Neither party is liable for failure caused by an event beyond its reasonable control, excluding the obligation to pay. This does not extend a party's own outage into a defence for an event within its control.

24.7. No partnership. Nothing here creates an agency, partnership, joint venture or employment relationship.

24.8. Notices. Notices to us go to support@vizumapps.com. Notices to you go to your account email address, and are treated as received on the next business day after sending.

24.9. Export and sanctions. You will comply with applicable export control and sanctions law, and you represent that you are not a prohibited party.

24.10. Third-party rights. No one other than you and us has a right to enforce these Terms, except a Developer to the extent clause 8.6.4 preserves our recovery.

25. Contact

Enrique Echeverría, trading as Vizum Apps Email: support@vizumapps.com Postal address and tax identifier: not published yet. The controller is a natural person and the operation has no incorporated entity; a postal address and a NIT will be published here when the company is formed, and this document will be reissued at that point. Colombian consumer law (Ley 1480 de 2011) and EU consumer law both require that disclosure, so this is a gap stated rather than a decision defended. Until then, support@vizumapps.com is the channel of record for every notice, claim and rights request under these Terms, and it is monitored.