BackendXLanguage
Version

BackendX Terms of Use

Effective Date: October 15th, 2026 Last Updated: October 15th, 2026 Contact: team@email.backendx.ai

These Terms of Use ("Terms") govern the use of the BackendX service (the "Service") provided by BackendX Inc. (주식회사 백엔드엑스) (the "Company").

BackendX is a software-as-a-service (SaaS) platform that enables users to generate, deploy, and manage backend services online. The Service includes software features that process user-submitted requirements and configurations to generate outputs such as source code, infrastructure definitions, deployment-related artifacts, and related software-generated results.

By creating an account or using the Service, you ("User") agree to be bound by these Terms and related policies.

These Terms apply to Users worldwide. Mandatory consumer protection rules of the User's country of residence may apply to the extent required by law.

1. Definitions

  1. "User" means any individual or legal entity using the Service.
  2. "Account" means a login identity created to access the Service.
  3. "Requirements" means any user-submitted descriptions, specifications, text, or configuration inputs.
  4. "Task" means a software-generated or software-processed unit of work requested through the Service, such as backend generation, modification, deployment-related execution, or related in-product workflows.
  5. "Subscription" means a recurring paid plan attached to an individual project (the project is the billing unit) that determines that project's feature access, deployment tier, included Seats, and Monthly Free AI Tokens. Subscriptions are offered in tiered plans and billed on a monthly or yearly basis.
  6. "Seat" means an entitlement for one user to participate as a member of a subscribed project. Each plan includes a stated number of Seats, and additional Seats may be purchased on eligible plans.
  7. "AI Token" (or "Token") means the unit of use defined by the Company to measure the amount of computing resources consumed by AI-powered generation and modification work, including Requirements interviews and runs of the generation pipeline. Tokens belong to a project and consist of Initial Generation Tokens granted once when a project is created, Monthly Free Tokens included in paid plans on a monthly basis, and Paid Tokens purchased by the User as Token Packs. Tokens are unrelated to the Access Tokens defined in item 9.
  8. "Output" means any generated source code, configuration files, documents, scripts, or infrastructure definitions (IaC), together with artifacts built from them (including container images and deployment bundles).
  9. "Access Token" means cloud API credentials provided by the User (e.g., AWS Access Key ID/Secret Access Key, Google Cloud service-account keys, or equivalent credentials) that the User registers with the Service for Customer-Cloud deployment and operation.
  10. "Billing Policy" means the separate policy titled "Subscription & Billing Policy" governing Subscriptions, Seats, Tokens, payments, cancellations, and refunds.
  11. "Deployment Option" means the manner in which a generated service is hosted and operated, as described in Section 2: Managed Hosting, Customer-Cloud (Company-Operated), or Self-Operated (Export).
  12. "Self-Operated (Export)" means a Deployment Option in which the Company generates and delivers the Outputs to the User and the User hosts and operates the generated service entirely on its own, without the Company hosting, operating, accessing, or processing the generated service or any end-user data (except as provided in Sections 8.8 and 12.8).

2. Deployment Options

  1. The Company may continue to evolve the Service through successive releases as the Service matures, and may introduce, expand, or phase out features accordingly.
  2. The Service offers the following Deployment Options, distinguished by who operates the generated service:
    • Managed Hosting (default). The Company hosts and operates the generated service on shared, multi-tenant infrastructure managed by the Company (currently located in the AWS Asia Pacific (Seoul) region). Projects are isolated at the application, network, and database level (including a dedicated database and database role per project on shared database infrastructure). The User is the controller of end-user personal data processed through the generated service; the Company processes such data as a processor (consignee) on the User's behalf and in accordance with the User's documented instructions, as further described in the Privacy Policy and the Data Processing Agreement referenced in Section 12. Managed Hosting is currently offered on a shared-infrastructure tier; higher plan tiers may provide additional isolation (such as a dedicated network environment) and additional features (such as custom domains), and a fully dedicated-infrastructure tier may be offered in a later phase, in each case as described in the plan descriptions in the Service.
    • Customer-Cloud (Company-Operated). The generated service runs in the User's own cloud account, and — at the User's request and only within the scope of an Access Token the User registers with the Service — the Company provisions and operates it on the User's behalf (including deployment, monitoring, scaling, and operational assistance) as described in Section 11. Even where the generated service and its associated data reside in the User's own cloud account, to the extent the Company processes end-user personal data on the User's documented instructions while performing the above work, the User is the controller of end-user personal data and the Company acts as a processor under the Data Processing Agreement in Section 12 (and, where one has been entered into, a separate operational delegation arrangement). Availability of this option, supported cloud providers, and supported regions are described in the Service.
    • Self-Operated (Export). The Company generates and delivers the Outputs to the User (Section 7), and the User hosts and operates the generated service entirely on its own — locally, on-premises, or in a cloud account the User controls — without the Company hosting, operating, accessing, or processing the generated service or any end-user data. In Self-Operated (Export) deployment the Company's role ends at delivery of the Outputs; the User is solely the controller and operator, and the Company is neither a controller nor a processor of end-user personal data. However, where the User connects "Sign in with BackendX" to the generated service, Section 12.8 applies to the login accounts, and where the generated service uses the Company file storage, Section 8.8 and the DPA apply to those files. The Company provides no operational support for a Self-Operated deployment except as separately agreed in writing.
  3. The following scope limitations currently apply to generated services under Managed Hosting:
    • End-user file uploads are supported only through storage the User provides and controls (Section 8.5) or the Company file storage (Section 8.8).
    • Services in the categories listed in Section 8.2 or Section 8.3 are not eligible for Managed Hosting: Section 8.2 categories are refused at interview, and Section 8.3 categories are refused at deployment.
  4. The Company may add, modify, restrict, suspend, or discontinue any feature of the Service.
  5. Free-tier limits and deletion of inactive projects. The operating limits in Section 2.8 of the Billing Policy apply to free-tier projects. Where a free-tier project has not been used for ninety (90) days (or one hundred eighty (180) days where Subscription fees have actually been paid for that project), the Company may delete that project. Use of a free trial does not count as payment of Subscription fees. For the purposes of this paragraph, a project is used when the User creates or changes its requirements specification (SRS) or runs a deployment (conducting the Requirements interview, signing in, and automatic restarts caused by traffic do not count as use); the period runs from the date of the last such use or, where the project reverted from a paid plan to the free tier after that date, from the date it reverted. A project with unused Paid Tokens remaining is not deleted even after the period has passed. The Company gives notice of the intended deletion, at least thirty (30) days before the scheduled deletion date, to the email address registered for the project owner's Account, and the project is not deleted if the User uses it before the scheduled deletion date. Where the Company deletes a project, its deployment through the Company is removed as well (Section 11.6 applies to resources in the User's own cloud account), unused Initial Generation Tokens are forfeited, and the project's data and Outputs are deleted as described in the Privacy Policy.

3. Accounts and User Responsibilities

  1. Eligibility. The Service is available only to persons who have reached the age of majority under the law of their nationality, and in any case are at least eighteen (18) years of age (for example, at least nineteen (19) for nationals of the Republic of Korea). The User confirms at registration that they meet this requirement and warrants that the confirmation is accurate. The Company may refuse registration, or suspend or terminate an Account, where this requirement is not met.
  2. Users must provide accurate information and must not impersonate others.
  3. Users are responsible for safeguarding their Accounts and notifying the Company of any suspected unauthorized access.
  4. Users must not submit sensitive personal data or regulated information within Requirements except as expressly permitted by the Acceptable Use Policy in Section 8 and under a lawful basis applicable to the User. The Company applies the security measures described in the Privacy Policy but cannot guarantee against harm arising from submissions that violate these Terms or the Acceptable Use Policy.
  5. Re-registration restriction. If the Company terminates the User's Account under Section 14 on the ground that the User violated these Terms or the Acceptable Use Policy, the User may not register again, including with a different email address or sign-in method, for one (1) year from the date of termination, and the Company may refuse any registration made during that period. The same applies where the User deletes their Account after the Company has notified the User, under Section 14, of the ground for terminating the Account for a violation of these Terms or the Acceptable Use Policy and before that process concludes; in that case the one-year period runs from the date of deletion. For this purpose, the Company keeps the records of use restrictions described in the Privacy Policy.

4. Subscriptions, Seats, AI Tokens, and Payments

  1. The Service is offered through per-project Subscriptions: each project has its own Subscription plan (including a free tier), and charges for a project (plan fees, Seat fees, purchased Token Packs, and any usage-based fees) are billed to that project's designated payment method. A free tier and a limited number of free projects per Account may be offered as disclosed in the Service.
  2. Tokens. Each project is granted Initial Generation Tokens once at creation, and paid plans include Monthly Free Tokens. Unless otherwise expressly stated, Monthly Free Tokens are granted and reset each calendar month measured from the billing date and do not roll over, while remaining Initial Generation Tokens roll over. Users may purchase Token Packs for projects with an active paid Subscription; unless otherwise expressly stated, Paid Tokens are valid for five (5) years from the date of purchase. Tokens are consumed in the order Monthly Free Tokens, Initial Generation Tokens, then Paid Tokens.
  3. Token deduction and budget stops. Tokens are deducted when each Requirements-interview turn ends and when a generation pipeline run completes successfully; no Tokens are deducted for failed runs. The number of Tokens consumed by a piece of work depends on the size and complexity of the Requirements and similar factors and is measured according to the Company's metering, and it is not guaranteed that any particular piece of work will complete within a given number of Tokens. Where a run's usage would exceed the project's remaining Tokens, the Company stops the run and preserves the Outputs produced so far, and the User may resume from the stopped step after obtaining Tokens. Detailed rules are set out in the Billing Policy.
  4. Seats. Each plan includes a stated number of Seats. On eligible plans, additional Seats may be purchased at the per-Seat price disclosed in the Service. Unless otherwise expressly stated: (a) additional Seats are billed monthly in advance, separately from the plan Subscription; (b) Seat increases take effect immediately, and the charge for the remaining period is prorated and billed immediately; (c) Seat decreases take effect at the start of the next Seat billing cycle and do not entitle the User to a refund or credit for the current cycle; (d) Seats not in use at renewal (neither occupied by a member nor reserved by a pending invitation) are automatically reduced at the start of the new cycle — though never below the plan's included Seats — and are not billed for that cycle; (e) if the number of project members exceeds the available Seats at renewal, the Company may restrict excess members' access until Seats are added or members are removed; and (f) on a move to a plan that does not offer Seats, or to the free tier, members other than the owner are removed from the project. The detailed rules are set out in Section 5 of the Billing Policy.
  5. Usage-based fees. Certain plans include usage allowances (such as API-call volume or storage). Where the Service so discloses, usage beyond an included allowance is billed as overage in accordance with Section 6 of the Billing Policy, or — where the hard-stop option for API calls or file downloads is enabled — the Service may instead restrict further calls or new file downloads for the remainder of the period. The default setting of each hard-stop option, and whether it can be changed, are disclosed in the Service.
  6. Tokens and other usage entitlements are used solely within the BackendX Service, are not cash, electronic money, prepaid payment instruments, gift cards, deposits, payment instruments, or virtual assets, have no monetary exchange value outside the Service, and are non-transferable and non-resellable except where required by applicable law or expressly permitted by the Company.
  7. Plan entitlements, Seat rules, Token validity, cancellation effects, and refunds (if any) are governed by the Billing Policy.
  8. Specific Subscription tiers, purchase options, or payment methods may be unavailable, limited, or offered on a preview basis. Payments are currently collected by the Company's wholly-owned U.S. subsidiary (BackendX US, Inc.), which acts solely as the Company's payment-processing agent, through a third-party payment processor (Stripe), as further described in the Billing Policy; the Company will disclose current availability and payment methods through the Service.
  9. The Company may change Subscription tiers, included allowances, pricing, and feature access from time to time. Any such changes will be disclosed through the Service or by other reasonable means before they take effect for future billing periods, unless immediate changes are required by law, security, or abuse-prevention reasons.
  10. Unless otherwise expressly stated, the purchase of a Subscription, Seats, or Token Packs does not include offline consulting, manual development services, or any physical goods.
  11. Automatic Renewal. Unless expressly stated otherwise at the time of purchase, Subscriptions automatically renew at the end of each billing period (monthly or annual, as applicable) for a successive period of the same length, and the Company (or its payment processor) will charge the User's designated payment method at the then-current price for the renewing period until the User cancels. By purchasing a Subscription, the User authorizes such recurring charges.
  12. Price-Change Notice. The Company will provide reasonable advance notice of any price increase that will apply at the next renewal, by email or through the Service, at least thirty (30) days before the increase takes effect (or, where applicable law, including California Business & Professions Code §17602 and equivalent U.S. state automatic-renewal statutes, sets a different notice window, within that window). If the User does not wish to accept the new price, the User may cancel the Subscription before the renewal date; continued use after the effective date constitutes acceptance of the new price. However, where the User is a consumer under the Korean Act on the Consumer Protection in Electronic Commerce, the Company obtains the User's consent to the date of the increase, the prices before and after it, and the payment method within the thirty (30) days before a price increase (including an increase resulting from the end of an introductory discount) applies, and informs the User of the conditions, method and effect of cancellation; in that case acceptance is not deemed from continued use. If the User does not consent, the Subscription does not renew, and the project moves to the free tier at the end of the current billing period.
  13. Cancellation. The User may cancel a project's Subscription at any time through the project's billing settings within the Service or by contacting team@email.backendx.ai. Cancellation will take effect at the end of the then-current billing period, and the User will retain access to paid features until that date, after which the project reverts to the free tier. The same applies to cancellation during a free trial: the User may continue to use the free trial until it ends, and no Subscription fee is charged after the trial ends. Overage incurred during the trial period is charged in accordance with Section 8.1 of the Billing Policy, and whether it is paid does not affect the cancellation. A scheduled cancellation may be withdrawn until it takes effect.
  14. Renewal Reminder. Where required by applicable law (including, without limitation, Korea's Act on Consumer Protection in Electronic Commerce and U.S. state automatic-renewal statutes), the Company will send a renewal reminder before each automatic renewal, identifying the amount to be charged, the billing date, and cancellation instructions.
  15. Free Trials and Introductory Offers. Where a free trial or introductory-rate Subscription is offered, the Company will disclose in a clear and conspicuous manner before the User's acceptance: (a) the length of the trial or introductory period, (b) the price that will apply after the trial/introductory period ends, (c) the renewal cadence, and (d) how to cancel before being charged. For EU and EEA consumers, the Company will comply with the "button solution" in Article 8(2) of Directive 2011/83/EU by labeling the purchase button with an explicit obligation-to-pay indication (e.g., "Order with obligation to pay" / "Subscribe and pay").
  16. Plan changes, taxes, and failed payments. Changes of plan and billing cycle and when they take effect, taxes charged in addition to the price, and the restrictions on use and the stopping of deployments upon a failed payment are governed by Sections 2, 11, and 12 of the Billing Policy.

5. EU and EEA Consumer Rights

  1. If you are a consumer residing in the European Union or European Economic Area, you benefit from any mandatory consumer protection rights granted to you by the laws of your country of residence. Nothing in these Terms limits or excludes those mandatory rights.
  2. Where the Service is supplied to an EU or EEA consumer as a digital service or digital content, the Company will provide the service in conformity with the contract and with mandatory applicable law, including any mandatory rights relating to remedies for failure to supply or lack of conformity.
  3. If you are an EU or EEA consumer purchasing a Subscription or other digital service at a distance, you may have a statutory 14-day right of withdrawal from the date of conclusion of the contract, except to the extent an exception or reduction applies under mandatory law.
  4. If you ask us to begin supplying a paid digital service during the withdrawal period, you expressly request immediate performance. Where mandatory law so requires, we will obtain the additional confirmations needed for immediate performance and will inform you of the consequences for your withdrawal right.
  5. If you validly withdraw from a contract after requesting immediate performance of a digital service during the withdrawal period, you may be required to pay a proportionate amount for the service supplied up to the time of withdrawal, to the extent permitted by applicable law.
  6. If mandatory law grants you a right to terminate due to a negative modification of the Service, lack of conformity, or failure to supply, you may exercise that right notwithstanding any other provision of these Terms.

6. Account Deletion

  1. Users may request account deletion at any time, subject to Section 6.2.
  2. Owned projects first. An Account cannot be deleted while the User owns one or more projects. The User must first delete each project they own or transfer its ownership to another member of that project; each project deletion ends that project's Subscription in accordance with the Billing Policy and triggers the deletion of the project's data and Outputs as described in the Privacy Policy. When the User requests account deletion, the Service identifies any projects still owned by the User so they can be deleted or transferred. Where the User cannot delete or transfer projects in the Service because they have not agreed to amended terms, the User may ask the Company at team@email.backendx.ai to delete those projects or transfer their ownership on the User's behalf. Where the User participates in projects owned by others, account deletion removes the User's membership from those projects without affecting the projects themselves.
  3. Upon account deletion, the Account may be permanently removed, and remaining Tokens and other unused entitlements may be forfeited or expire in accordance with the Billing Policy.
  4. Account deletion does not automatically trigger a refund. Refund eligibility for Subscriptions and unused purchased Tokens is governed by the Billing Policy and applicable laws.
  5. This Section governs deletion requested by the User. Suspension, restriction, or termination by the Company is governed by Section 14 and is not subject to Section 6.2.

7. Delivery of Outputs and GitHub Collaboration

  1. The Company generates each project's source code in a private, Company-controlled repository on Company-managed infrastructure. The Company may deliver Outputs to the User by one or more of the following methods, subject to the User's plan:
    • a downloadable source-code archive (ZIP);
    • a downloadable deployment bundle (e.g., container-composition configuration, environment files, and related credential files) for local or self-managed execution; and
    • where provided under the User's plan, a private GitHub repository under an account or organization owned or managed by the Company, which mirrors the project's main branch and to which access is provided with read-only collaborator permission. The GitHub Repository Delivery Policy Addendum applies to this delivery method.
  2. The Company may change the delivery method or repository structure at its discretion. Mirrored repositories reflect the current state of the project's main branch and may be rewritten or force-updated when the project is regenerated.
  3. Upon project deletion, the Company deletes associated delivery repositories and mirrors; the Company-controlled source repository is deleted after a reasonable retention grace period as described in the Privacy Policy.
  4. The Company is not obligated to provide technical support for Outputs (e.g., debugging, operations, performance tuning, or security reviews), unless otherwise agreed in writing.
  5. Delivery of the Outputs under this Section constitutes the mechanism for the Self-Operated (Export) Deployment Option defined in Section 2; the User's operation of a service built from delivered Outputs is governed by Sections 8.6 and 15.
  6. Container images and source code. Container images and deployment bundles are provided to run the generated service. Source code is delivered only through the methods in Section 7.1 that the User's plan includes. The User will not decompile, disassemble, or otherwise attempt to extract source code from container images or deployment bundles, except that (a) third-party components remain governed by their own license terms (Section 15.3), and nothing in this paragraph restricts the modification or replacement those licenses permit or reverse engineering for debugging such modifications, and (b) this restriction does not apply to the extent applicable law permits such activity notwithstanding it.

8. Acceptable Use Policy

8.1 General prohibitions

Users must not use the Service to:

  • create, distribute, deploy, or operate services, systems, or content that violate applicable laws or regulations;
  • generate, distribute, or deploy malware, spyware, stalkerware, surveillance tools, or software intended to defeat security controls;
  • engage in hacking, credential stuffing, unauthorized access, or infringement activities;
  • infringe third-party rights (including intellectual property, trade secrets, privacy rights, or publicity rights);
  • facilitate or promote criminal or unlawful activities;
  • process the personal data of any person without a lawful basis under applicable data-protection law.

8.2 Intrinsically prohibited service categories

The Service may not be used for the generation, hosting, or operation of services in the following categories, regardless of Deployment Option, and the Company will refuse generation and deployment for any service falling within them:

  • adult, sexually explicit, or pornographic services;
  • gambling, betting, lotteries, or games of chance offered for monetary stakes;
  • firearms, ammunition, explosives, weapons, or weapons-accessory sales or configurators;
  • sale or distribution of controlled substances, prescription medications, or narcotics (including cannabis where not expressly permitted);
  • political-campaign targeting, voter-profiling, or electioneering platforms.

8.3 Generation-only service categories (no deployment through the Company)

For services in the following categories, the Company does not offer Managed Hosting or Customer-Cloud (Company-Operated) deployment, and will refuse or reverse any such deployment. The Company may, in its discretion, generate and deliver Outputs for such services for Self-Operated (Export) use only. Licensure, registration, and lawful operation of any such service are solely the User's responsibility; by requesting generation of such a service, the User represents that its intended operation will comply with applicable law, including any required licenses, registrations, or lawful bases. The Company does not verify this representation and may refuse generation at its discretion. Sections 8.6 and 15 govern the User's operation of any such service:

  • services that target, are primarily designed for, or knowingly accept end-users under the age of thirteen (13) (or fourteen (14) in the Republic of Korea, or sixteen (16) in the European Union / EEA, as applicable);
  • licensed financial services (including banking, lending, money transmission, securities brokerage, cryptocurrency exchange or custody, stablecoin issuance, and insurance underwriting);
  • healthcare services that create, transmit, or store protected health information subject to HIPAA, EU medical-device regulation, or equivalent regimes (the Company's infrastructure is not certified for such data; the User must deploy on its own compliant infrastructure);
  • biometric identification or verification systems;
  • trust-and-safety or content-moderation platforms whose operation requires processing categories of content (such as CSAM) that the Company does not host;
  • any other service whose hosting or operation by the Company would require the Company to hold licenses, registrations, or certifications it does not hold.

8.4 Service categories conditionally permitted for deployment

Services in the following categories are permitted, including generation and all Deployment Options. When such a service is deployed under Managed Hosting, the User must additionally complete the deployment questionnaire accurately, accept the Data Processing Agreement referenced in Section 12, give the warranties in Section 12.2, and publish the end-user privacy policy described in Section 12.3. Disclosed personal-data categories are checked against the generated database schema before deployment; other answers are recorded declarations on which the Company relies, and a material inconsistency between them and the deployed service's actual behavior may trigger reactive inspection (Section 10) and suspension (Section 14). No additional conditions apply to Self-Operated (Export) use of these categories beyond Sections 8.6, 12.8 (where applicable), and 15. The categories are:

  • services that collect any personal data from end-users;
  • services offered to end-users located in the European Union, European Economic Area, United Kingdom, or California;
  • services with user-generated text content;
  • services where minors (13 and above in the US, 14 and above in Korea, 16 and above in the EU) may be among end-users;
  • business-to-business services processing employee or human-resources data.

8.5 End-user file uploads (customer-provided storage)

Generated services may include end-user file upload features only where the uploaded files are stored in storage that the User provides and controls (e.g., the User's own Amazon S3 bucket or equivalent object storage, connected using credentials the User supplies) or in the Company file storage under Section 8.8. This paragraph applies to storage the User provides; the Company file storage is governed by Section 8.8. File uploads and downloads are performed directly between the end-user's client and the User's storage using pre-signed URLs: the generated service issues time-limited pre-signed URLs, and the file contents themselves do not pass through, and are not stored on, Company-managed infrastructure. Except as provided in Section 8.8, Users must not enable or configure a generated service to store end-user files on, or serve them from, Company-managed infrastructure. The User is responsible for its storage account, including its credentials, access configuration, retention, costs, and the lawfulness of stored content; storage credentials the User supplies are used solely to operate the file features of the User's own generated service and are handled as described in the Privacy Policy.

8.6 User responsibility

Users are solely responsible for the legality, deployment, operation, and consequences of any service built using the Outputs, including the conduct of their end-users. The Company's acceptance or deployment of a generated service does not constitute legal advice, does not certify compliance with any law, and does not transfer to the Company any duty owed by the User to its end-users.

8.7 Conduct toward Company personnel

In customer support, inquiries, or any other communication with the Company, Users must not engage in any of the following toward the Company's officers or employees (including persons handling customer communications on the Company's behalf):

  • abusive language, profanity, insults, or sexual harassment;
  • threats to harm a person's life, body, or property;
  • obstructing the Company's normal operations by repeating demands that go beyond what is reasonably acceptable or by excessively repeating communications with the same content.

Expressing complaints or opinions about the Service, exercising rights under applicable law or these Terms, and filing complaints or reports with the competent authorities do not constitute such conduct.

8.8 Company file storage

  1. Use. Where the Company offers file storage in the Service, a generated service may, regardless of its Deployment Option (including Self-Operated), store end-users' files in storage managed by the Company and serve them through pre-signed URLs. The Company keeps those files on the User's behalf as a processor (Section 12 and the DPA), and the User is responsible, as controller, for the lawfulness of their contents and for their processing. For a project for which the User has not already accepted the DPA at deployment through the Company, the User must accept the DPA when first enabling the file storage for that project. Storage capacity, free capacity and fees are governed by the Billing Policy.
  2. Permitted files. Only files of the types and sizes the Company specifies in the Service may be stored; other files may be deleted immediately after they are stored. Video files may not be stored.
  3. Automated inspection. For security, abuse prevention and legal compliance, the Company inspects stored files by automated means (including third-party AI providers or content-classification services and matching against known illegal content) to determine whether they are permitted files and whether they violate Section 8 of these Terms. Section 10.2 does not apply to this inspection. Company personnel examine a file only where a violation is suspected, when handling an appeal, or where required by law, and such examination is logged.
  4. Quarantine and measures. A file determined to be in violation is quarantined and can no longer be accessed through the generated service. The Company notifies the User of that fact and the reason by email and by a notification to the generated service, without including the file itself. Because automated determinations may be wrong, the Company in principle limits its action to quarantining that file; where violations recur or clearly illegal content such as child sexual abuse material is identified, the Company may suspend the generated service's use of Company features such as file storage and "Sign in with BackendX" and take measures under Section 14. The Company may report to the competent authorities in accordance with applicable law.
  5. Retention of quarantined files. Notwithstanding a deletion request from the generated service or the User, or the deletion of the project, a quarantined file is kept encrypted and separated for 90 days from quarantine and is then destroyed. A file that human review finds needs no report or preservation of evidence may be destroyed or released earlier, and a file is kept until the end of any pending appeal or request from the competent authorities, or any retention required by law.
  6. Appeal. The User may request a review of a determination at abuse-reports@backendx.ai. The Company has the determination reviewed again by a person, and if the determination was wrong, the Company lifts the quarantine and any measures.
  7. Infringement notices. A person who claims that a stored file infringes their copyright or other rights may request, at abuse-reports@backendx.ai and with material substantiating that right, that its reproduction and transmission be stopped. On receiving such a request, the Company promptly stops access to the file and notifies the User. Where the User requests resumption by showing that its use is based on a legitimate right, the Company handles the request in accordance with applicable law (such as Article 103 of the Copyright Act of Korea). The Company may restrict the file storage of, or terminate the Account of, a User who repeatedly infringes others' rights. This paragraph also applies to logos and other images the User uploads to the Service for use in a generated service; in that case the Company may stop their use by replacing the image with a default icon. Where the Company reviews such images in advance, that review checks only for violations of Section 8 and does not confirm that the image does not infringe third-party rights.

9. Automated Analysis and Illegal Use Detection

  1. To prevent unlawful use, abuse, violations of these Terms, and to reduce legal risk, the Company may analyze Requirements and related configuration inputs using automated methods.
  2. For this purpose, the Company may use third-party AI tools solely as auxiliary means to detect potential illegality or violations.
  3. Only the minimum information necessary is used, and such information is not provided for external model training, subject to provider constraints.
  4. Automated analysis results are supporting indicators only and do not constitute final legal determinations.

10. Monitoring Scope and Reactive Inspection

  1. The Company may review system metadata, configuration information, and traffic patterns to the minimum extent necessary for security, stability, and abuse prevention.
  2. The Company does not routinely access, scan, or inspect application-level end-user data (such as databases or application logs) stored within generated services. The Company does not perform proactive database-level scanning for illegal content. Automated inspection of files stored in the Company file storage is governed by Section 8.8.
  3. Error-event capture (deployments through the Company). To provide error diagnostics and the operations dashboard for the User's own project, to analyze the cause of errors and generate proposed fixes, and to support the resolution of the User's incidents, generated services deployed through the Company — under Managed Hosting or Customer-Cloud (Company-Operated) — may capture error events (HTTP responses with status 400 and above). Each captured event includes limited clear-text metadata (status code, HTTP method, route template, error fingerprint, trace identifier, timestamp) and, where necessary for error diagnostics, may include the associated request, response body, and stack trace. The request body, response body, or stack trace may in turn contain personal data of end-users, such as email addresses, contact details, account identifiers, input values, or other personal information. The Company collects such information only to the minimum extent necessary for error diagnostics; it is credential-redacted at capture time and then encrypted with a per-project key before leaving the service. The encrypted contents are decrypted only (i) to present incident details to authorized members of the User's own project, (ii) to analyze the cause of errors and generate proposed fixes, (iii) where the Company provides customer support to resolve the User's incidents, or (iv) in the reactive-inspection cases described in this Section, and are retained as described in the Privacy Policy. Third-party AI providers are used for the analysis in (ii) and for preparing draft replies as part of the customer support described in (iii) (only where the person requesting support is authorized to view that project's error events; replies are reviewed and sent by Company staff); in that case the AI provider processes the credential-redacted contents of the error event as a Sub-processor listed in the Data Processing Agreement (DPA). Access by Company personnel and transmission to AI providers under (iii) are recorded together with the project concerned and the scope of the query (and, for access by personnel, the person accessing). Container-level resource metrics (CPU, memory, network) and service-liveness signals are also collected; these do not contain application payloads. Retention and deletion of error events are governed by the Privacy Policy and the Data Processing Agreement (DPA).
  4. The Company may conduct a reactive inspection of a generated service only in the following circumstances, limited to the minimum scope necessary to verify the report or request:
    • a credible abuse report received through the Company's abuse-reporting channel (abuse-reports@backendx.ai) or any other reasonable means;
    • a law-enforcement request, court order, or lawful request from a competent authority;
    • a payment-processor, cloud-provider, or trust-and-safety flag affecting the service;
    • a material inconsistency between interview or deployment-stage answers and the actual behavior or data of the deployed service;
    • a third-party complaint alleging infringement of intellectual property, privacy, or other legal rights.
  5. Where a reactive inspection touches end-user personal data, the Company acts under the Data Processing Agreement referenced in Section 12 and under applicable legal bases; the scope, timing, and actors involved are recorded in an internal audit log. Solely for the security, abuse-prevention, and legal-compliance processing described in this Section, the Company acts as an independent controller to the narrow extent required.
  6. Evidence preservation and law-enforcement cooperation. The Company may preserve evidence and disclose information to competent authorities as required or permitted by law. Disclosure will be limited to the minimum necessary to comply with the specific legal demand.
  7. User notification of law-enforcement requests. Where legally permitted, the Company will notify the User of a law-enforcement request, court order, or comparable legal demand concerning the User's Account or generated service before complying, to give the User an opportunity to seek a protective order or challenge the demand. Where notification is prohibited (such as under a lawful gag order or sealed subpoena), the Company will notify the User as soon as the legal restriction is lifted. The Company will publish its law-enforcement response policy at a stable URL on the Service and may publish periodic transparency reports regarding the volume and type of legal demands received.

11. Infrastructure Management Support and Access Tokens (Customer-Cloud, Company-Operated)

  1. Where the generated service is deployed under the Customer-Cloud (Company-Operated) option (in the User's own cloud account), and at the User's request, the Company may provide technical management or operational support within the User's cloud account (e.g., provisioning, deployment, monitoring, scaling configuration, operational assistance). Such support may require a separate operational delegation arrangement.
  2. The User may register an Access Token with the Service for such support, and the Company may perform actions using that Access Token. Registered Access Tokens are stored in an encrypted secrets store and used only for the purposes described in this Section.
  3. The Company will act only within the scope of permissions granted by the User and will not exceed such permissions. The User must limit the permission scope of the Access Token to the minimum necessary for the relevant tasks.
  4. The User is responsible for issuing, scoping, rotating, revoking, and securing the Access Token, and may revoke or deactivate the Access Token at any time, including by deleting it from the Service.
  5. Final operational responsibility and decision-making authority remain with the User. The Company's support does not imply joint operation or joint liability, except as expressly set out in a separately signed Data Processing Agreement or operational delegation arrangement.
  6. Removal of Customer-Cloud deployments. Resources provisioned in the User's own cloud account remain the User's resources. Before deleting a project (or where the User no longer wishes to incur cloud charges), the User must request removal of the Customer-Cloud deployment through the Service; the Company does not automatically tear down resources in the User's cloud account upon project deletion, and the User remains responsible for charges its cloud provider levies for resources left running.

12. Personal-Data Processing, DPA, and End-User Privacy Policy for Deployments through the Company

  1. Deployment questionnaire and DPA at deployment. Before a generated service may be deployed or begin operation under Managed Hosting or Customer-Cloud (Company-Operated), the User must complete the Company's deployment questionnaire (which may cover legal matters — such as end-user jurisdictions, personal-data categories, minors, payment posture, and privacy contacts — and operational matters) and must review and accept the Company's Data Processing Agreement (which includes processor terms under Article 28 of the GDPR and a consignment arrangement under Article 26 of PIPA). The Company will present the Data Processing Agreement for active acceptance at deployment time and will record the document version, timestamp, accepting user, and the IP address from which acceptance was given. Questionnaire answers are recorded in the same manner; certain answers (such as confirmed personal-data categories and payment posture) must be re-confirmed when the generated service is regenerated. Certain answers (such as an intention to store raw payment-card data, an indication that the service processes sensitive personal data (such as data concerning health, biometric data, political opinions, religious beliefs, or sex life), or an indication that end-users are under the age of digital consent — see Section 8.3) block deployment. Where Managed Hosting is offered for a fee, the User must additionally accept the applicable pricing terms, and such acceptance is recorded with the policy version and timestamp.

  2. Customer warranties. By deploying a generated service under Managed Hosting or Customer-Cloud (Company-Operated), the User represents and warrants that:

    • the intended service is lawful in every jurisdiction in which its end-users are located;
    • the service does not fall within any of the prohibited categories in Section 8.2 or the generation-only categories in Section 8.3;
    • the categories of end-user personal data the service will collect have been accurately disclosed to the Company at interview and deployment;
    • the User has, or will have before the service becomes available to end-users, a lawful basis under applicable data-protection law for processing each category of end-user personal data;
    • the User has implemented, or will implement, age-verification measures where required by applicable law, including measures to prevent use of the service by end-users under the age of digital consent (see Section 8.3);
    • the User will comply with the Acceptable Use Policy and will not introduce regulated-data categories (such as protected health information or payment-card data) into the service without the Company's prior written agreement.

  3. End-user privacy policy. Before making a generated service deployed through the Company available to end-users, the User must publish a privacy policy applicable to that generated service. Depending on the actual processing, the User's privacy policy must include at least the following:

    • that the User, as operator of the generated service, is the controller of end-user personal data;
    • that the Company acts as a processor performing hosting, deployment, operational assistance, error diagnostics (including error analysis and draft customer-support replies using third-party AI providers), security, and other tasks on the User's documented instructions;
    • where "Sign in with BackendX" is connected to the generated service, that the login account is operated by the Company as controller and that the generated service receives a service-specific identifier from the Company;
    • the categories or items of personal data that may be collected, used, stored, or transmitted from end-users;
    • the purpose of each processing activity;
    • the retention period of the personal data, or the criteria used to determine it;
    • where sub-processors, cross-border transfers, or third-party services used by the User exist, the matters required by applicable law; and
    • how end-users may exercise their rights and the contact point for privacy inquiries.

    The Company may provide notice language or a draft covering the personal-data items, processing purposes, retention periods, and the scope of the Company's processing as processor, based on the deployment questionnaire, the generated database schema, and the service configuration. The User must review such material and publish it as adapted to the actual operation of its service, and is responsible for adding any notices required for external payments, marketing, analytics, file storage, external login, or other processing activities specific to the User. The User must not remove notice language provided by the Company or narrow or misrepresent the actual scope of the Company's processing. The User may fulfil the publication obligation in this paragraph through a privacy-policy page that the Company generates from that draft and from the operator details confirmed by the User (the name of the controller, the service name, and the contact for exercising rights) and publishes under the address of the generated service. In that case the User must link that address where end-users can easily find it, such as the sign-up screen of the generated service; where "Sign in with BackendX" is connected to the generated service, the Company links that address on the sign-in consent screen. The User remains responsible under this paragraph for the content of the privacy-policy page published by the Company.

  4. Data-subject rights routing. The User will designate a privacy-contact email for rights requests from end-users. The Company will route end-user rights requests it receives to that email in the first instance, and the User will respond within the timeframes required by applicable law. The Company will, as processor, assist the User in handling such requests as set out in the Data Processing Agreement.

  5. Breach notification flow. In the event of a personal-data breach, the Company will notify the User without undue delay (and in any case within seventy-two (72) hours of awareness) with the information required for the User to meet its own notification obligations to end-users and competent authorities. The User will notify affected end-users and competent authorities within the statutory timeframes (including, where applicable, the 72-hour supervisory-authority notification under GDPR Article 33, notification of data subjects without undue delay under GDPR Article 34, and equivalent PIPA requirements). The Company may notify end-users directly only where necessary to comply with a direct legal duty or where the User is unresponsive.

  6. Customer indemnity. To the maximum extent permitted by applicable law, the User will indemnify, hold harmless, and — where permitted under the applicable jurisdiction — defend the Company and its officers, directors, employees, and agents from and against any third-party claim, demand, proceeding, or governmental action arising out of or relating to: (a) the User's breach of the warranties in Section 12.2; (b) the legality or operation of the service deployed by or on behalf of the User; (c) the content or conduct of the User's end-users; (d) the User's failure to publish a compliant end-user privacy policy or to respond to end-user rights requests; or (e) the User's introduction of undisclosed regulated-data categories into the service. The User's obligation includes payment of damages, settlements, fines, and reasonable attorney fees and costs. The Company will (i) promptly notify the User of any such claim, (ii) cooperate reasonably with the User's handling of the claim at the User's expense, and (iii) have the right, but not the obligation, to control the defense of any claim subject to this indemnity with counsel of its choosing, at the User's expense, in which case the User may not settle the claim without the Company's consent. Nothing in this Section limits mandatory consumer rights where applicable.

  7. Reservation of rights. The Company may refuse, delay, or reverse deployment where, in its reasonable judgment, the User's answers at interview or deployment are inconsistent with the actual generated service, with the Acceptable Use Policy, or with applicable law. Refusal at deployment does not entitle the User to a refund of fees paid or Tokens consumed for generation, subject to the Billing Policy and applicable law.

  8. Sign in with BackendX. Where the Company offers "Sign in with BackendX" (shown in the Service and in the requirements specification as, for example, "Google, Apple and email sign-in (provided by BackendX)") and the User connects it to a generated service, the following applies:

    • the sign-in account used to sign in (distinct from the Account defined in Section 1.2) is provided by the Company directly to the end-user, with the Company as controller, and is governed by the BackendX Terms of Use for Sign-in Users and the BackendX Privacy Policy for Sign-in Users. The Company provides the generated service only with an identifier generated specifically for that service, and does not provide the end-user's email address or any other account information;
    • the User must not combine the identifier it receives with the identifiers of other services or with other information in order to identify end-users or to track them across services;
    • the User must state in its own privacy policy that it receives that identifier (Section 12.3, for deployments through the Company);
    • where an end-user disconnects the generated service or deletes the sign-in account, the Company notifies the generated service of that fact, and the User must, on receiving the notification, take the measures required by applicable law (such as deleting the information of that end-user);
    • a sign-in account may be created only by a person who has confirmed that they have reached the age of majority. Where a generated service uses "Sign in with BackendX" as its only sign-in method, the Company treats that service as having in place, among the age-verification measures referred to in Section 12.2, an age-confirmation procedure based on the end-user's own declaration. This is not verification of age or identity by means of an identity document or an identity-verification agency, and the Company does not warrant that account holders are in fact adults. Where applicable law requires stricter verification for a service, such as adult verification based on identity verification, the User must carry out that verification itself;
    • where the User uses or also offers another sign-in method, such as its own OAuth client, the User must itself implement age-verification measures for end-users who register through that method;
    • where end-users of a generated service may include minors (Section 8.4), the User must also offer another sign-in method;
    • where the User uses the function by which the Company, with the end-user's consent, sends advertising emails for the generated service on the User's behalf ("advertising email relay"), the User, as the sender of the advertising information, is responsible for the content of the advertising and for compliance with applicable law (including Article 50 of the Korean Act on Promotion of Information and Communications Network Utilization and Information Protection), and the Company acts only as the sending agent and does not provide end-users' email addresses to the User. The User must pass a consent to the Company only where the end-user has selected it personally, must not pre-select consent or register it on an end-user's behalf, must use advertising email relay only in the form set by the Company (the Company's template and the wording registered at deployment) and within the sending limits set by the Company, and must not send advertising for businesses or content designated by the Company, such as sexually explicit content, gambling, pharmaceuticals, short-term or high-interest loans, or affiliate marketing. The Company may suspend advertising email relay for a service whose unsubscribe, spam-complaint, or bounce rates are high or that violates this item; and
    • the Company may suspend the login connection for a service where the User violates this paragraph or the Acceptable Use Policy.

13. Automated Deployment and Scaling

  1. Automated deployment (e.g., deploy on source code updates) and automated scaling (e.g., scale when load thresholds are reached) may be offered as optional features.
  2. Responsibility for enabling, configuring (thresholds, scope, targets), and outcomes of such features remains with the User.
  3. Where the Company executes automation under the Customer-Cloud (Company-Operated) option using an Access Token, it will do so only within the User-configured settings and permission scope granted by the User. Where the Company executes automation under Managed Hosting, it will do so in accordance with the Data Processing Agreement referenced in Section 12.

14. Suspension, Restriction, and Termination

  1. If the Company reasonably suspects a violation of these Terms, the Acceptable Use Policy, or applicable laws, or if a reactive inspection under Section 10 identifies a material concern, the Company may suspend, restrict, or terminate access to the Service or the Account without prior notice. Where circumstances permit, the Company will notify the User of the reason and provide an opportunity to respond.
  2. The Company may temporarily suspend the Service for security, maintenance, outages, or legal or regulatory reasons.
  3. The Company may retain logs and records as necessary for security, audit, dispute resolution, and compliance with applicable laws, in accordance with the retention periods in the Privacy Policy.
  4. Upon termination, the Company may cease hosting the User's generated service under Managed Hosting. The Company will, where reasonably feasible and subject to applicable law, provide the User a reasonable opportunity to export the Outputs and data stored within the generated service.
  5. If you are an EU or EEA consumer and mandatory law grants you a remedy because the Service is not supplied, is not in conformity, or is modified in a way that negatively affects your access to or use of the Service beyond what mandatory law allows, those remedies remain available to you.
  6. Operational measures on deployments through the Company. The Company may stop, restart, or remove a deployment through the Company, or pause or resume generation work, where necessary to ensure security or stability, to respond to a failed payment (Section 12 of the Billing Policy) or a violation of these Terms, or to provide support at the User's request. Such measures are recorded together with the person who performed them and the reason.
  7. Conduct toward Company personnel. If the User violates Section 8.7, the Company may, taking into account the seriousness of the violation and whether it has been repeated, take such of the following measures as are necessary: a warning, a restriction on how the User may contact the Company (such as limiting contact to writing), a restriction on use of the Service, or termination of the Account. Except in a serious case such as a threat, the Company will give a warning before restricting use or terminating the Account. Notwithstanding Section 14.1, this paragraph governs violations of Section 8.7.

15. Intellectual Property

  1. User content. As between the Company and the User, the User retains all rights, title, and interest in and to Requirements, configurations, and other content submitted by the User.
  2. Assignment of Outputs. Subject to Section 7.6 (container images and source code), Section 15.3 (third-party licenses), the User's compliance with these Terms, and payment of applicable fees, the Company hereby assigns to the User all of the Company's rights, title, and interest in the Outputs delivered to the User, to the maximum extent such rights are assignable under applicable law. Where such rights are not assignable, the Company grants the User a worldwide, perpetual, irrevocable, royalty-free, sublicensable license to use, reproduce, modify, distribute, and create derivative works of the Outputs.
  3. Third-party components. Outputs may include third-party components, including open-source software. Such components remain subject to their respective license terms, and nothing in Section 15.2 purports to assign rights the Company does not hold.
  4. Back-license to the Company. The User grants the Company a worldwide, non-exclusive, royalty-free license to use Requirements, configurations, Outputs, and content uploaded by the User such as logos solely as necessary to provide, secure, operate, and improve the Service, to comply with legal obligations, and to exercise the Company's rights under these Terms. This license does not authorize use of Requirements or content uploaded by the User for training the Company's own AI models except where separate consent has been obtained.
  5. Company marks and platform. The BackendX name, logo, and platform software are and remain the Company's intellectual property. No right, title, or interest in Company marks or the underlying platform is transferred to the User.
  6. Feedback. Where the User voluntarily provides feedback or suggestions regarding the Service, the User grants the Company a perpetual, irrevocable, royalty-free license to use such feedback without restriction.
  7. AI-generated Outputs; no warranty. Outputs are generated by AI systems and may contain errors, inaccuracies, or security vulnerabilities. This applies equally to artifacts built from Outputs — including container images and deployment bundles — and to services deployed and operated from them. The Company makes no warranties regarding the accuracy, completeness, security, legality, or fitness of Outputs for any purpose, except as expressly provided in these Terms or required by mandatory applicable law.

16. Third-Party Services

The Service may integrate with third-party services such as GitHub, cloud infrastructure providers (e.g., AWS), payment processors (e.g., Stripe), and external AI providers (e.g., OpenAI, Google, Anthropic). The Company is not responsible for third-party outages, policy changes, suspensions, or limitations, except to the extent caused by the Company's willful misconduct or gross negligence.

17. Disclaimer and Limitation of Liability

  1. Except as expressly required by mandatory applicable law (including, without limitation, mandatory conformity and remedy rights granted to consumers in the European Union, European Economic Area, and United Kingdom, and mandatory consumer-protection rights under the laws of the User's country or state of residence), the Service and Outputs are provided on an "AS IS" and "AS AVAILABLE" basis, and to the maximum extent permitted by law, the Company disclaims all warranties, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation. Nothing in this Section limits any non-excludable statutory warranty or consumer right.
  2. Users are solely responsible for the legality and operation of services built using the Outputs.
  3. Subject to Section 17.5, and to the maximum extent permitted by applicable law, the Company's total aggregate liability arising out of or relating to these Terms or the Service is limited to the greater of (a) the fees actually paid by the User to the Company during the six (6) months immediately preceding the event giving rise to the claim, or (b) one hundred U.S. dollars (USD 100). Where the Service is provided free of charge (e.g., free tiers, trials, or other no-charge offerings), the Company shall have no liability except to the extent liability cannot be excluded under applicable mandatory law (including the carve-outs in Section 17.5).
  4. Subject to Section 17.5, and to the maximum extent permitted by applicable law, the Company shall not be liable for any indirect, special, incidental, consequential, exemplary, or punitive damages, including loss of profits, revenue, data, goodwill, or reputation, even if advised of the possibility of such damages.
  5. Carve-outs. Nothing in Sections 17.1, 17.3, or 17.4 shall exclude or limit the Company's liability for: (a) death or personal injury caused by the Company's negligence; (b) the Company's own fraud or fraudulent misrepresentation; (c) the Company's own willful misconduct or gross negligence; (d) any other liability of the Company that cannot be excluded or limited under applicable mandatory law (including mandatory EU, EEA, UK, U.S. state, or Republic of Korea consumer-protection rules). For clarity, this Section addresses only the extent to which the Company's own liability may be limited; the User's responsibility for its services and end-users (Sections 8.6 and 12.6) is unaffected.
  6. Some jurisdictions do not allow the exclusion or limitation of certain warranties or damages; in such jurisdictions, the exclusions and limitations in this Section apply only to the maximum extent permitted by law, and the User may have additional rights.

18. Amendments

  1. The Company may amend these Terms and the related policies listed in Section 23 due to changes in laws or Service operations. Each document is managed by version number, and earlier versions remain available on the Service.
  2. Material changes. A change that materially affects the User's rights or obligations is announced through the Service or by email, together with a summary of the change and its effective date, at least seven (7) days before the effective date (or, where applicable law requires a longer period, at least that period before). Continued use of the Service after the effective date requires the User's consent to the amended document; a User who does not consent may stop using the Service and delete the Account in accordance with Section 6.
  3. Other changes. A change that does not materially affect the User's rights or obligations (such as clarification of wording, correction of errors, or a change of contact details) takes effect upon announcement through the Service.
  4. To the extent mandatory law requires a different consequence or gives the User a right to terminate, mandatory law prevails.

19. Governing Law and Jurisdiction

  1. These Terms, and any non-contractual obligations arising out of or in connection with them, are governed by and construed in accordance with the laws of the Republic of Korea, excluding the conflict-of-laws rules of the Republic of Korea's Act on Private International Law.
  2. Non-consumer disputes. If you are not a consumer (that is, if you use the Service for purposes relating to your trade, business, or profession), all disputes arising out of or in connection with the Service, these Terms, or the relationship between the parties shall be subject to the exclusive jurisdiction of the Seoul Central District Court of the Republic of Korea as the court of first instance.
  3. Consumer disputes — choice of law. If you are a consumer, the choice of Korean law in Section 19.1 does not deprive you of any mandatory protection afforded to you by the laws of your country or state of residence that cannot be derogated from by agreement, including (where applicable) mandatory consumer-protection rules under the laws of the European Union and its Member States, the European Economic Area, the United Kingdom, the Republic of Korea, and the individual states of the United States.
  4. Consumer disputes — forum. If you are a consumer residing in the European Union or the European Economic Area, you may bring proceedings against the Company in the courts of the Member State in which you are domiciled, and the Company may bring proceedings against you only in those courts, in accordance with Articles 17 to 19 of Regulation (EU) No 1215/2012 (Brussels Ia). Other consumers, including consumers residing in the United Kingdom or the United States, retain any jurisdictional or consumer-protection rights under the law of their habitual residence that cannot be derogated from by agreement. The jurisdiction clause in Section 19.2 does not apply to, and is not intended to limit, any such consumer.
  5. Nothing in this Section prevents either party from seeking urgent injunctive or equitable relief from a court of competent jurisdiction where necessary to protect intellectual-property rights, prevent unauthorized access to the Service, or otherwise protect rights pending resolution of a dispute.

20. Force Majeure

Neither party will be liable for any failure or delay in performance caused by events beyond its reasonable control, including acts of God, natural disasters, epidemic or pandemic, war, civil unrest, terrorism, governmental action or regulation, labor disputes, power or telecommunications failures, denial-of-service or other cyberattacks, or the failure or interruption of third-party services (including upstream cloud or AI providers) on which the Service depends. The affected party will notify the other of the event and use reasonable efforts to mitigate its effects. This Section does not excuse payment obligations already accrued.

21. Assignment

  1. The User may not assign, transfer, or delegate these Terms or any rights or obligations under them without the Company's prior written consent. Any purported assignment in violation of this Section is void.
  2. The Company may assign, transfer, or delegate these Terms in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, or to an affiliate. Where required by applicable law, the Company will provide affected Users with prior notice and, where applicable, an opportunity to terminate.

22. Severability

If any provision of these Terms is held invalid, illegal, or unenforceable by a court or regulator of competent jurisdiction, that provision will be modified to the minimum extent necessary to be enforceable (and if not modifiable, will be severed), and the remaining provisions will continue in full force and effect.

23. Entire Agreement and Order of Precedence

  1. These Terms, together with the Privacy Policy, the Billing Policy, the GitHub Repository Delivery Policy Addendum (where the User uses the GitHub repository delivery option), the Acceptable Use Policy in Section 8, and any Data Processing Agreement or other written agreement executed by the parties, constitute the entire agreement between the User and the Company with respect to the Service and supersede all prior or contemporaneous understandings, communications, and agreements, whether written or oral.
  2. In the event of a conflict among these documents, the following order of precedence applies:
    • first, any written agreement separately signed by the parties (such as an enterprise agreement) and, for the processing of end-user personal data, the Data Processing Agreement (DPA) accepted under Section 12;
    • second, these Terms of Use;
    • third, the GitHub Repository Delivery Policy Addendum (for matters relating to the GitHub repository delivery option);
    • fourth, the Billing Policy (for matters relating to Subscriptions, Seats, Tokens, and payments);
    • fifth, the Privacy Policy (for matters relating to the processing of personal data; provided that, for conflicts on data-protection terms, the Privacy Policy prevails over these Terms, except that the Data Processing Agreement prevails for end-user personal data).
  3. These Terms and the documents listed in this Section are provided in Korean and English; if the two language versions differ, the Korean version prevails. This paragraph does not limit consumer rights under mandatory law of the User's country of residence.

24. Notices

  1. The User may deliver legal notices to the Company by email to law@backendx.ai and team@email.backendx.ai, and, where required by applicable law, by mail to the Company's registered office address in the Republic of Korea.
  2. The Company may deliver notices to the User by email to the address associated with the User's Account, through an in-product notification, or by posting a notice on the Service. Notice is deemed received when sent by email or when posted prominently in the Service.
  3. It is the User's responsibility to keep the Account email address current. The Company is not responsible for notices that fail to reach the User due to an outdated or inaccurate Account email address.
  4. Abuse reports (Section 10.4) are received at abuse-reports@backendx.ai.

25. Points of Contact and Legal Representative under the EU Digital Services Act (DSA)

This Section applies to the extent Regulation (EU) 2022/2065 (the Digital Services Act) applies to the Company.

  1. Point of contact for authorities (Article 11). Member States' authorities, the European Commission, and the European Board for Digital Services may contact the Company directly at law@backendx.ai. Communications may be made in English or Korean.
  2. Point of contact for recipients of the Service (Article 12). Recipients of the Service may contact the Company directly at team@email.backendx.ai.
  3. Legal representative (Article 13). The Company has designated the following as its legal representative in the European Union:
    • Name: Data Protection Representative Limited (trading as DataRep)
    • Address: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
    • Email: digitalrequest@datarep.com
    • Telephone: +353 (1) 919 8899
  4. Reporting illegal content (Article 16). Any person who considers that a generated service deployed through the Company contains illegal content may report it to abuse-reports@backendx.ai. A report must include the reasons why the content is considered illegal, the exact location of the content (such as its URL), the name and email address of the person reporting, and a statement confirming the good-faith belief that the report is accurate. However, the name and email address of the person reporting are not required for reports of information relating to the offences referred to in Articles 3 to 7 of Directive 2011/93/EU (child sexual abuse and exploitation). The Company handles reports in accordance with Section 10 and informs the person reporting of the outcome.
  5. Inquiries about personal data and the representative under the GDPR are governed by Sections 11 and 14 of the Privacy Policy.