Terms of Service

VisualAutomate is operated by VisualAutomate, registered under KvK 42126716. Reach us at legal@visualautomate.com.

Most accounts are opened online and these terms are the whole of it. Some are opened under a signed agreement — an Order Form, a master services agreement, a data processing agreement, or a security schedule. Where one of those exists and says something different from this page, the signed document wins for the customer who signed it, and only for them.

Nothing on a purchase order, in a supplier portal or in your own standard terms binds us, however it is transmitted and whether or not we acknowledge receipt of it, unless we have signed it.

VisualAutomate lets you build workflows on a canvas and run them. A workflow is made of steps; each step is a Module, and when a workflow runs, each step executes either on our managed infrastructure or in a sandbox we create for that Run and take down afterwards.

What a step does, what it connects to and what it sends is decided entirely by you. We provide the canvas, the runner and the plumbing. We do not review your workflows before they run, and running one is not our endorsement of what it does.

You need an account, and the details you give us have to be accurate. Keep your sign-in and any API keys to yourself: anything done with your account is treated as done by you, and if you think someone else has got in, tell us at once.

You may let Authorised Users and your Affiliates use the Service under your account. You stay responsible for what they do with it, and their acts and omissions count as yours under this agreement.

You must be at least 16, and neither you nor any Authorised User may be a person or entity barred under the sanctions or export control rules that apply to either of us.

Customer Data stays yours. We claim no ownership of any of it, and we acquire no rights in it beyond the licence in this section.

To run the Service we need permission to do the obvious things with it — store it, copy it between our systems, and execute your code on our infrastructure when you ask for a Run. You grant us a worldwide, non-exclusive, royalty-free licence to do exactly that, for as long as you keep the material on the platform and for no purpose beyond providing and supporting the Service to you.

We do not train models on Customer Data, we do not sell it, and we do not use it to improve the Service for anyone else. Where a Module of yours calls an AI provider, what that provider does with what you send it is governed by their terms, not ours — see section 10.

You are responsible for having the right to use what you upload and connect: code you did not write, data you did not collect, and credentials to accounts that are not yours are all your problem before they are ours.

If you send us feedback or suggestions, we may use them without obligation to you. That covers the idea, not your Customer Data.

If you publish a Module for other users to install, you are saying you may — that the code is yours to share and infringes nobody — and you grant those users the right to run it in their own workflows. You keep ownership; publishing is a licence, not a transfer.

We may remove a published Module, without notice where the situation calls for it, if it breaks these terms, infringes someone’s rights, or puts other users at risk. A Module someone forks is theirs from that point on, subject to the same rules.

The sandboxes run whatever you put in them, which is the point, and also the reason this list exists. Do not use VisualAutomate to:

• break the law, or help anyone else to;
• attack, scan, overload or otherwise interfere with any system you are not authorised to test;
• send unsolicited bulk messages, or anything you would not want called spam;
• build or distribute malware, credential stealers, or scrapers of other people’s private data;
• mine cryptocurrency, run proxies or VPN exits, or otherwise use our compute for work that has nothing to do with a workflow;
• resell the sandbox capacity itself, or pass it on as a general-purpose execution service;
• work around plan limits, rate limits or credit accounting, whether by many accounts or by any other means;
• reverse engineer the platform, except where the law says you may.

Where a workflow of yours processes other people’s personal data, you are the one responsible for having a legal basis and for telling them — see section 12 and the Privacy Policy.

Running a workflow costs credits, and what a Run costs depends on how it ran. A workflow whose steps all execute on our managed infrastructure, without a sandbox, is charged a flat amount per step that actually ran — a step told to repeat over a list is charged for each turn it takes. A workflow that needs a sandbox is charged from what that machine used: the time it was alive, the processor time it spent, and the data it sent out, plus a one-off amount for starting it.

A step that failed before it did anything, or that was skipped, is not charged. Every Run shows what it cost, per step and in total, in the execution panel. The rates for each plan are on the pricing page and in your account.

Each plan carries limits: how long a step may run before it is stopped, how long a whole Run may take, how many steps run at once, how often a workflow may start, how many times one step may repeat over a list, and how much you may store. They exist so that one account cannot take the service down for everyone, and we may adjust them where usage threatens that. If we have to change a limit in a way that affects you materially, we will tell you first.

A workflow is usually only useful because it talks to something else — a mail service, an API, a database, a model provider. Those services have their own terms, and using them through us does not change that. We are not responsible for them: not for their availability, not for what they charge you, and not for what they do with what your workflow sends them.

Deciding what your workflow sends to a third party, and whether it is allowed to, is your decision and not one we can make for you.

We keep technical and organisational measures appropriate to the risk, and these are the ones worth naming:

• traffic is encrypted in transit, and Customer Data is encrypted at rest;
• stored credentials and secrets are encrypted with a separate key and are never displayed back once saved;
• each Run executes in isolation from other customers’ Runs, and a sandbox is destroyed after the Run that created it;
• access to production systems and data is restricted to the people who need it to operate the Service, and is logged;
• changes to the platform go through review and automated testing before release.

If we become aware of a security incident affecting your Customer Data, we will notify you without undue delay and in any case within 72 hours of becoming aware of it, and will tell you what we know, what we are doing, and what you may need to do. We will not make a public statement identifying you without your consent unless the law requires it.

We will answer a reasonable security questionnaire once a year and share the security documentation we hold. We do not currently hold a third-party audit certification and do not claim one; where an Order Form requires a specific standard, it says so there.

For your account data we are the controller. For the personal data your workflows carry we act as your processor: you decide what your workflows do and what they touch, and we act on your instructions, which are these terms and your use of the Service.

Where you need a data processing agreement, ours is available at privacy@visualautomate.com and, once signed, takes precedence over this section. Where personal data leaves the European Economic Area it goes under the European Commission’s standard contractual clauses or an adequacy decision.

We use sub-processors to provide the Service. The current list is in the Privacy Policy, kept in one place so it cannot drift. We will give you at least 30 days’ notice before a new sub-processor starts handling Customer Data, and you may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected part of the Service and we will refund the unused part of what you have paid for it.

We will help you, at your cost where the work is substantial, with data subject requests, impact assessments and consultations with a supervisory authority, to the extent only we can.

Each of us may learn things about the other that are not public: your Customer Data and your plans, our pricing, our architecture, anything marked confidential or that a reasonable person would take to be. Each of us will use the other’s confidential information only to perform this agreement, protect it with at least the care we use for our own, and disclose it only to people who need it and are under obligations at least as strict.

This does not cover information that is public without a breach, that the receiving party already had, or that it develops independently. Where the law or a court compels disclosure, the party compelled will tell the other first if it is allowed to.

These obligations run for the term and for five years after it, and for Customer Data for as long as it is held.

We work to keep the Service up and we will keep planned maintenance out of the way where we can, giving notice in the app or by email for maintenance we expect to be disruptive. Emergency maintenance we may have to do without notice.

We do not commit to an uptime percentage on these terms. An availability commitment, and any service credits that go with it, is agreed in an Order Form. If you need one, ask before you buy rather than after.

Parts of the Service may change and features may be withdrawn. Where a change would break workflows you already run, we will give you reasonable notice and, where we can, a way to keep running while you adapt.

Some features are marked beta, preview or experimental. They are there to be tried, not relied on: they may change, break or disappear, they are excluded from any availability commitment, and they are provided without warranty of any kind. Do not put them on the critical path of something that matters.

This agreement runs until you or we end it. You may stop at any time by deleting your account or, on a subscription, by cancelling before the next renewal. Where an Order Form sets a term, that term governs.

We may suspend or close an account that breaks these terms, has not paid, or is putting the platform or other users at risk — immediately where the risk is immediate, and otherwise after asking you to put it right and giving you a reasonable chance to do so. We will narrow a suspension to what the problem requires where that is possible.

For 30 days after an account closes you may ask us to export your Customer Data, and we will provide it in a structured, commonly used format. After that it is deleted, along with your workflows, Modules, stored credentials and Run history, apart from what we must keep for tax and legal reasons and what sits in routine backups until those age out.

We warrant that we will provide the Service with reasonable skill and care, and that we have the right to provide it to you.

Beyond that, and beyond what the law requires of us, the Service is provided as it is. We do not warrant that it will be uninterrupted, error-free, or fit for a particular purpose of yours, and we do not warrant the Modules other users publish.

What your workflows do is not something we can vouch for. A workflow that sends the wrong email, writes the wrong record or calls an API too many times is doing what it was built to do. Test them before you point them at anything that matters.

We will defend you against a third-party claim that the Service, used as we intended, infringes that party’s intellectual property, and pay the damages finally awarded or agreed in settlement. If the Service becomes the subject of such a claim, we may modify it, obtain a licence, or end the affected part and refund the unused portion of what you paid for it. This does not apply to claims arising from your Customer Data, your Modules, a Module you obtained from another user, or use of the Service in breach of these terms.

You will defend us against a third-party claim arising from your Customer Data, from what your workflows did, or from a Module you published, and pay the damages finally awarded or agreed in settlement.

Either of us claiming under this section will tell the other promptly, let them control the defence, and cooperate with it. Neither will settle in a way that admits liability for the other without consent.

We are liable for damage caused by our intent or gross negligence, for injury or death, and for anything else the law does not allow us to limit.

Beyond that, the total liability of each of us under this agreement is capped at what you paid us in the twelve months before the event giving rise to the claim, and neither of us is liable for indirect or consequential loss — lost profit, lost business, lost data — however it arises.

The cap does not apply to what you owe us in fees, to either side’s indemnity under section 19, or to a breach of confidentiality under section 14.

If you are a consumer, nothing here takes away rights you have under mandatory consumer law.

Neither of us will use the other’s name or logo publicly without written consent, which for a customer list or a case study we will ask for separately and which you may withdraw.

Each of us will comply with the export control and sanctions rules that apply to it. You will not make the Service available to anyone in a sanctioned territory or on a restricted party list, and you will not use it for any purpose those rules prohibit.

Neither of us is in breach for a delay or failure caused by something genuinely outside its control — an act of war, a natural disaster, a general failure of the internet or of a utility, an attack on infrastructure neither of us operates. This does not excuse paying what is owed.

We may change these terms. If a change matters to you, we will tell you by email or in the app at least 30 days before it takes effect, and continuing to use the Service after that means you accept it. If you would rather not, you can close your account and we will refund the unused part of any period you have already paid for.

Where you are under an Order Form, a change that materially reduces the Service or your rights does not apply to you until that term ends.

Formal notice to us goes to legal@visualautomate.com. Notice to you goes to the email address on your account, or appears in the app. Either counts as given on the day it is sent, and it is your job to keep the address current.

The law of the Netherlands applies, without regard to its conflict of law rules, and disputes go to the competent courts there — unless you are a consumer, in which case you keep the protection of your own country’s mandatory law and courts.

Before it comes to that, write to legal@visualautomate.com. Most things are settled faster that way.

If any part of these terms turns out to be unenforceable, the rest stands. Not enforcing something once does not mean giving it up. You may not transfer this agreement without our consent; we may transfer it as part of a merger or sale of the business, and will tell you if we do. Nothing here makes either of us the other’s agent or partner, and nobody outside this agreement may enforce it.

Sections 6, 12, 14, 18, 19, 20 and 26 survive the end of this agreement, along with anything else that by its nature should.

These terms, the Privacy Policy and any Order Form are the whole agreement between us about the Service, and replace anything said before it.