Terms of sale and subscription

Hubflow service, published by SAS MEDUZA STUDIO. Version dated 8 November 2026, applicable to any order or renewal placed after that date.

Recitals

MEDUZA STUDIO, a French simplified joint-stock company (société par actions simplifiée) with a share capital of 500 euros, registered with the Reims Trade and Companies Register under number 911 536 217, whose registered office is located at 126 boulevard Saint-Marceaux, 51100 Reims, France, intra-Community VAT number FR86911536217 (hereinafter the “Provider”), publishes and operates, under the trade name “Hubflow”, an online software service for collecting, sharing and sending documents, intended for professionals.

These terms of sale and subscription (the “Terms of Sale”) set out the conditions under which the Provider supplies the Service to its business customers. They are supplemented by the terms of use (the “Terms of Use”), which are binding on any person using the Service, and by the data processing agreement (the “DPA”), which governs the processing of personal data on behalf of the Customer.

Article 1 — Definitions

Capitalised terms have, in the singular and in the plural, the following meaning:

• Subscription: the right to access and use the Service taken out by the Customer for a given Plan, term and number of Team Members.
• Administrator: the Team Member designated by the Customer to manage the Workspace, accounts, API keys, billing and relations with the Provider.
• API: the public programming interface of the Service, described in the Documentation, allowing the Customer to operate the Service from its own applications.
• Order Form: the quotation, purchase order or subscription form, online or signed, by which the Customer takes out a Subscription and which refers to these Terms of Sale.
• Customer: the legal entity or self-employed natural person, acting for purposes falling within the scope of their professional activity, who takes out the Subscription.
• Team Member (or “user” in the pricing grid): any natural person holding a named account in the Customer’s Workspace, created by the Administrator. Only Team Members are counted in the Plan; Participants never are.
• Special Terms: the provisions specific to a Customer, set out in the Order Form or in a signed contract, in particular for the Custom Plan.
• Content: all documents, files, data, messages and metadata uploaded, shared, sent or generated in the Customer’s Workspace by the Customer, its Team Members or its Participants.
• Contributor: the natural or legal person invited by the Customer to submit documents to a Request (Collect product), via a personal link, without an account.
• Request: a request for documents created by the Customer in the Collect product, made up of expected items (slots) and Participants.
• Recipient: the person who receives a Delivery (Send product) or accesses a Resource (Share product), via a personal link or an access request, without an account.
• Documentation: the functional and technical documentation of the Service, published at hubflow.cloud/docs, as updated by the Provider.
• Customer Data: the Content together with any information communicated by the Customer to the Provider under the Agreement, including personal data processed on its behalf.
• Delivery: the transmission of documents to one or more Recipients by means of the Send product, together with usage rules, an undertaking and a delivery certificate.
• Workspace: the Customer’s environment within the Service, logically segregated from that of other customers, containing its Requests, Resources, Deliveries, templates, contacts, Team Members and settings.
• Plan: the pricing offer taken out (Solo, Business or Custom), with its quotas, described in articles 6 and 7.
• Request Opening: the creation and sending of a Request to its Participants, including each occurrence of a recurring request.
• Active Resource: a Resource that is published and accessible, i.e. neither expired nor archived.
• Credentials: the elements enabling access to the Service or the API: username and password, single sign-on token, personal link, one-time code, API key, webhook secret.
• Third-Party Integration: any service published by a third party that the Customer chooses to connect to the Service (online storage, automation, identity provider, business software).
• Business Days: Monday to Friday, excluding public holidays in metropolitan France.
• Participants: all of the Customer’s Contributors and Recipients.
• Subscription Period: the period, monthly or annual, for which the Subscription is taken out and then renewed.
• Resource: a set of files organised in a folder tree, made available to Recipients by means of the Share product.
• Service: the Hubflow software platform accessible in SaaS mode, comprising the Collect, Share and Send products, the API, the webhooks, the hosting of Content, the Documentation and support, as described in article 3.
• Agreement: the contractual set formed by the Order Form, the Special Terms, these Terms of Sale, the DPA, the Terms of Use and the Documentation.

Article 2 — Purpose, scope and order of precedence

2.1. The purpose of the Terms of Sale is to define the conditions for subscribing to, supplying, using, invoicing and terminating the Subscription to the Service. They apply to any order placed with the Provider, whatever the channel.

2.2. The Service is intended exclusively for professionals. The Customer declares that it is acting for purposes falling within the scope of its professional activity and acknowledges that the protective provisions of the French Consumer Code do not apply to it.

2.3. In the event of conflict between the contractual documents, they shall prevail in the following order: (i) the Special Terms; (ii) the Order Form; (iii) the DPA, for all matters relating to personal data; (iv) these Terms of Sale; (v) the Terms of Use; (vi) the Documentation. The Customer’s general terms of purchase or any other document issued by the Customer are not enforceable against the Provider, even if it has been made aware of them, unless expressly accepted in writing.

2.4. The fact that the Provider does not, at a given time, rely on any of the provisions of the Terms of Sale shall not be construed as a waiver of its right to rely on them at a later date.

Article 3 — Description of the Service

3.1. The three products

The Service allows the Customer, from a single Workspace accessible through a browser, to:

• Collect — create Requests from templates, define the expected items and their verification criteria (format, size, name, number of files, rejection reasons), invite Contributors by e-mail or from a contact list, track progress, schedule reminders by e-mail or SMS, create recurring requests, and retrieve the files received (.zip export, API, webhooks).
• Share — publish Resources with a stable link, define their access mode (public, by link, allowlist, on request), roles (view, download, contribute), domain restrictions, expiry date, personalised watermark, versions and access log.
• Send — transmit documents to Recipients with usage rules, a generated and signed undertaking (simple signature by default, advanced signature as an option), a SHA-256 fingerprint of each file, a delivery certificate, a retention period, reminders and deletion confirmation, all recorded in an evidence vault.

All Plans give access to the three products. The Customer uses only those it needs.

3.2. Services included

• the hosting of Content and its backup under the conditions of article 13;
• an unlimited number of Participants, never billed, and the Request Openings, Active Resources, Deliveries and storage volume provided for by the Plan (article 6), within the scope of normal and fair use of the Service within the meaning of article 11.4;
• the sending of the transactional e-mails required by the Service (invitations, reminders, access codes, acknowledgements, notifications);
• access to the public API and to webhooks, within the limits of the Documentation;
• the library of Request, item and undertaking templates;
• the Workspace audit log, which can be exported;
• corrective and evolutionary updates of the Service;
• e-mail support as described in article 10;
• the opening and initial set-up of the Workspace together with the Customer (article 4.3).

3.3. Optional services

Certain features are subject to specific conditions or fees set out in the Order Form: the sending of SMS messages (reminders, codes, alerts) beyond any included volume; advanced signature of Send undertakings with identity verification; storage beyond the included volume; SAML or OIDC single sign-on (SSO), dedicated hosting, a negotiated DPA and enhanced service level commitments, reserved for the Custom Plan; dedicated onboarding, custom configuration and data migration; any consulting or bespoke development service.

3.4. Evolution of the Service

The Service is provided in SaaS mode and evolves continuously. The Provider may at any time add, modify or improve features, and modify the interface, without this constituting an amendment of the Agreement, provided that it does not substantially degrade the essential features described in article 3.1 during the current Subscription Period. The withdrawal of an essential feature or of a version of the API is subject to the notice period set out in article 18.4. Features announced as “in progress”, “planned” or “on the roadmap” do not constitute contractual commitments.

3.5. Technical requirements

Access to the Service requires an internet connection and the current or previous stable version of a mainstream browser (Chrome, Firefox, Safari, Edge). The Customer is responsible for the equipment, software, connections and settings (firewall, e-mail and SMS filtering) required by its Team Members and, where applicable, for the proper receipt of messages from the Service by its Participants.

Article 4 — Ordering, entry into force and go-live

4.1. Demonstration and quotation. The Service does not offer self-service sign-up. Following a demonstration, the Provider sends the Customer an Order Form specifying the Plan, the billing frequency, the number of Team Members, the options and the price. The Order Form is valid for thirty (30) days from its issue date, unless otherwise stated.

4.2. Formation of the Agreement. The Agreement is formed on the date the Customer accepts the Order Form, by handwritten or electronic signature, or by online validation including express acceptance of the Terms of Sale, the DPA and the Terms of Use. The Customer warrants that the signatory has the necessary authority to bind it. Any order is firm and final.

4.3. Opening and set-up of the Workspace. Within five (5) Business Days of the formation of the Agreement, the Provider opens the Workspace, creates the Administrator’s account and organises a set-up session with the Customer: selection and adaptation of templates, import of contacts, reminder rules, creation of the first Team Members. The Subscription and billing take effect on the date the Workspace is made available (the “Go-Live Date”), notified by e-mail to the Administrator.

4.4. Acceptance. The making available of the Workspace and the Customer’s effective access constitute delivery of the Service. The Customer has ten (10) Business Days from the Go-Live Date to report in writing any non-conformity of the Service with the Documentation; failing this, the Service is deemed compliant.

4.5. Administrator. The Customer designates at least one Administrator, who is the Provider’s point of contact for the performance of the Agreement. Any notice sent to the Administrator is deemed to have been sent to the Customer. The Customer shall inform the Provider without delay of any change of Administrator.

Article 5 — Term and renewal

5.1. Monthly Subscription. The monthly Subscription is entered into without any fixed-term commitment. It runs from the Go-Live Date until the end of the current calendar month and is then tacitly renewed for successive periods of one (1) month. The first month is billed pro rata to the remaining days.

5.2. Annual Subscription. The annual Subscription is entered into for an initial term of twelve (12) months from the Go-Live Date. It is then tacitly renewed for successive periods of twelve (12) months, unless either party gives written notice of non-renewal at least thirty (30) days before the end of the current Subscription Period.

5.3. Custom Plan. The Custom Plan is entered into for a minimum initial term of twelve (12) months, renewable under the conditions of article 5.2, unless otherwise provided in the Special Terms.

5.4. Prior notice of renewal. The Provider informs the Customer, by e-mail to the Administrator, of the expiry of the annual Subscription Period at least forty-five (45) days beforehand, reminding it of its option not to renew.

Article 6 — Plans

6.1. Team Members. The number of Team Members is the number of active accounts in the Workspace on the billing date. Under the Business Plan, any Team Member created during a Subscription Period is billed pro rata to the remaining days; a Team Member who is removed frees up their seat as from the following Period, with no refund for the current Period. The Solo Plan is limited to one (1) Team Member: creating a second account requires upgrading to the Business Plan.

6.2. Monthly quotas and Active Resources. The Request Opening and Delivery quotas of the Solo Plan are assessed per calendar month and do not carry over from one month to the next. When a quota is reached, the corresponding feature is suspended until the first day of the following month or until an upgrade to the Business Plan; Requests, Resources and Deliveries already opened remain fully accessible to Participants. The number of Active Resources is assessed at any given time: beyond the quota, the Customer must archive a Resource or let it expire before publishing a new one.

6.3. Storage. The storage volume is assessed across all Content in the Workspace, including previous versions, excluding the Provider’s backups. When the volume used reaches 90% of the included volume, the Administrator is informed. Beyond the included volume, the Customer has thirty (30) days to free up space, purchase additional storage at the prevailing rate or change Plan; after this period, the uploading of new files may be suspended, while existing Content remains viewable and exportable. No Content is deleted by the Provider on the grounds of an overrun.

6.4. Change of Plan. The Customer may change Plan at any time. An upgrade to a higher Plan takes effect immediately and is billed pro rata to the remaining Subscription Period. A downgrade to a lower Plan takes effect at the start of the following Subscription Period, provided that the number of Team Members, the number of Active Resources and the stored volume are compatible with the new Plan.

Article 7 — Prices

7.1. Prices are expressed in euros and exclusive of taxes; VAT and any applicable tax are added at the rate in force on the invoice date. The applicable prices are those published on the Pricing page on the date of the Order Form, or those of the Order Form if they differ.

7.2. Optional services. SMS messages beyond the included volume, advanced signature and onboarding or development services are billed under the conditions of the Order Form or, failing that, at the prevailing rate communicated to the Customer before any consumption. SMS messages are billed per unit, monthly, in arrears, on the basis of the Service’s sending log.

7.3. Price revision. The Provider may revise its prices. Any revision is notified to the Customer at least sixty (60) days before it takes effect and applies only as from the next renewal of the Subscription Period. A Customer who refuses the revision may terminate the Subscription free of charge, by written notice before the effective date; failing this, it is deemed to have accepted it. The prices of the Custom Plan set out in the Special Terms are fixed for the initial term.

Article 8 — Invoicing and payment

8.1. Invoicing. The Subscription is invoiced in advance, at the start of each Subscription Period. Invoices are issued in an electronic format compliant with the applicable regulations and sent to the Administrator or to the billing contact designated by the Customer; they are also available in the Workspace. The Customer expressly agrees to receive electronic invoices.

8.2. Payment. Invoices are payable on receipt, by bank card or by SEPA direct debit, under the direct debit mandate signed by the Customer; card and direct debit payments are processed by an authorised payment service provider, and the Provider does not retain any complete banking data. For the Custom Plan, invoices may be paid by bank transfer within thirty (30) days of the invoice date. No discount is granted for early payment.

8.3. Late payment. In accordance with articles L441-10 and D441-5 of the French Commercial Code, any sum not paid when due shall automatically bear, without prior formal notice, late-payment penalties calculated at the interest rate applied by the European Central Bank to its most recent refinancing operation plus ten (10) percentage points, together with a fixed indemnity for recovery costs of forty (40) euros per invoice, without prejudice to additional compensation, upon supporting evidence, where the costs incurred are higher.

8.4. Suspension for non-payment. In the event of a rejected direct debit or an invoice remaining unpaid fifteen (15) days after an e-mail reminder has been sent without effect, the Provider may, after notice, suspend the Team Members’ access to the Workspace until full payment of the sums due. Links already transmitted to Participants remain accessible in read-only mode during the suspension so as not to penalise third parties. The suspension does not release the Customer from payment of the Subscription and does not give rise to any compensation.

8.5. Disputes. Any dispute of an invoice must be notified in writing, with reasons, within fifteen (15) days of its receipt. After this period, the invoice is deemed accepted. Disputing part of an invoice does not release the Customer from paying the undisputed part. The Customer may not effect any set-off without the Provider’s written consent.

Article 9 — Provision, Credentials and access

9.1. The Service is accessible at app.hubflow.cloud and, for the API, at the address indicated in the Documentation, twenty-four hours a day, seven days a week, subject to maintenance operations and the exclusions set out in article 10.

9.2. Credentials are strictly personal and confidential. The Customer is responsible for their safekeeping and for their use by its Team Members, as well as for the API keys and webhook secrets generated in its Workspace. Any connection or action carried out using a Team Member’s Credentials or one of the Customer’s API keys is deemed to have been carried out by the Customer. The Customer shall notify the Provider without delay, at security@hubflow.cloud, of any loss, compromise or unauthorised use of Credentials; the Provider shall then revoke them.

9.3. The Provider retains only a hash of API keys; a lost key cannot be recovered and must be regenerated. A revoked key is rejected immediately.

9.4. Where the Customer enables single sign-on (SSO), it is solely responsible for the configuration, security and availability of its identity provider, as well as for managing its Team Members’ permissions within that provider.

Article 10 — Service level, maintenance and support

10.1. Availability

The Provider undertakes to use the means necessary to ensure a monthly availability of the Service of at least 99.5%, measured on the accessibility of the application from the Provider’s infrastructure, excluding scheduled maintenance periods and the exclusions referred to in article 10.4. Any service credits applicable to the Custom Plan are defined in the Special Terms; they constitute the sole remedy due for a failure to meet availability.

10.2. Maintenance

Scheduled maintenance operations likely to interrupt the Service are announced to the Administrator at least forty-eight (48) hours in advance and carried out, as far as possible, between 10 p.m. and 6 a.m. (Paris time) or at weekends, within a limit of eight (8) hours per month. Urgent corrective maintenance, made necessary by a security incident or a risk to the integrity of Content, may be carried out without notice; the Customer is informed as soon as possible.

10.3. Support and incident handling

Support is available to Team Members by e-mail at support@hubflow.cloud, on Business Days from 9 a.m. to 6 p.m. (Paris time). It covers use of the Service and the handling of defects; it does not include training of Participants, legal or business advice, or the development of bespoke integrations. Defects are classified and handled according to the following levels:

Time limits run from receipt of a sufficiently documented defect report (Workspace concerned, steps to reproduce, timestamp, screenshots). Resolution targets are best-efforts obligations.

10.4. Exclusions

The following are not attributable to the Provider and are excluded from the availability calculation: scheduled maintenance; failures of the internet network, of the Customer’s equipment, software or identity provider; failures of e-mail and SMS operators and of Third-Party Integrations; cyberattacks of exceptional scale despite the security measures in place; non-compliant use of the Service; suspension imposed pursuant to the Agreement; force majeure events.

Article 11 — Customer’s obligations

11.1. Compliance. The Customer uses the Service in accordance with the Agreement, the Documentation, applicable laws and regulations, and the ethical rules of its profession. It is solely responsible for determining the suitability of the Service for its needs and professional obligations, in particular as regards professional secrecy, statutory retention periods and professional ethics.

11.2. Participants and personal data. The Customer warrants that it has the necessary right and legal basis to collect, hold, share and send the documents it processes by means of the Service, and that it has provided Participants with the information required by data protection regulations. It alone defines the recipients, retention periods, access rules and reminder scenarios, and ensures that the frequency of reminders and alerts remains proportionate and compliant with the regulations applicable to electronic communications.

11.3. Sensitive and regulated data. The Customer is informed that the Service is not certified as a “health data host” (hébergeur de données de santé, HDS) and is not designed for the hosting of data for which the law requires a certification, approval or location that the Service does not hold. It undertakes not to upload such data to the Service without a specific written agreement with the Provider. It also undertakes not to process unlawful or infringing content, or content that violates the rights of third parties.

11.4. Fair use. The unlimited nature of Participants and, depending on the Plan, of Request Openings, Resources and Deliveries is understood as normal use of the Service by a professional in the course of their activity. Abnormal use includes, in particular, using the Service as a mass distribution tool, creating Requests or Deliveries with no genuine Participant, sharing a Team Member account between several people to circumvent per-Team-Member billing, or making API calls that are disproportionate to the Customer’s activity. In the event of abnormal use, the Provider informs the Customer and agrees with it on appropriate measures or pricing conditions; failing agreement within thirty (30) days, either party may terminate the Subscription at the end of the current Period.

11.5. Team Members. The Customer undertakes to procure compliance with the Agreement and the Terms of Use by its Team Members, and is liable for their acts. It updates permissions without delay and removes the accounts of persons who have left its organisation.

11.6. Cooperation. The Customer provides the Provider with the information required for the performance of the Agreement, keeps its billing and Administrator contact details up to date, and cooperates in good faith in the handling of defects and security incidents.

11.7. Backup and export. Without prejudice to the backups carried out by the Provider, the Customer remains responsible for regularly exporting the Content it needs to maintain its files, using the export features and the API, and for archiving it in accordance with its own obligations.

Article 12 — Provider’s obligations

12.1. The Provider undertakes to supply the Service with diligence, in accordance with best practice and the Documentation, under a best-efforts obligation, unless expressly provided otherwise.

12.2. The Provider undertakes to implement and maintain the technical and organisational security measures described in article 14 and in the DPA, to inform the Customer of any data breach concerning it under the conditions of the DPA, and to access Content only in the cases provided for in article 13.3.

12.3. The Provider declares that it holds a professional liability insurance policy covering the risks associated with its activity, taken out with a reputably solvent insurance company; a certificate is provided to the Customer on request.

12.4. The Provider keeps the Customer informed of significant changes to the Service, to sub-processors and to these Terms of Sale, under the conditions set out in the Agreement.

Article 13 — Customer Data, hosting and backups

13.1. Ownership. Customer Data is and remains the exclusive property of the Customer or of the third parties who uploaded it. The Provider acquires no rights over Customer Data other than the right of use strictly necessary for the performance of the Agreement: hosting, backup, display, transmission to the persons designated by the Customer, fingerprint computation, watermarking, automated reading where enabled, and production of aggregated and anonymous usage statistics.

13.2. Location. Customer Data is hosted exclusively in France, in the Paris region of Scaleway SAS (8 rue de la Ville-l’Évêque, 75008 Paris, RCS Paris 433 115 904), including its backups. No Customer Data is transferred outside the European Union. Any change of hosting provider or location is notified to the Customer at least thirty (30) days in advance under the conditions of the DPA.

13.3. Access by the Provider. The Provider accesses Content only (i) on the Customer’s written instruction, in particular for support purposes; (ii) where technically indispensable to the provision of the Service or the handling of a security incident, with the justification recorded in the log; (iii) to comply with a legal obligation or an order from a competent authority, the Customer being informed unless prohibited by law. Internal access is nominative, limited to authorised persons and logged.

13.4. No exploitation. The Provider undertakes not to exploit Content for its own purposes, not to disclose it to third parties outside the cases provided for in the Agreement, not to use it to train machine learning models, and not to analyse it for advertising or commercial purposes.

13.5. Backups. Customer Data is subject to encrypted backups at least daily, kept for a rolling thirty (30) days and stored in the same region as the production data. The purpose of backups is to restore the Service in the event of a disaster; they do not constitute an evidentiary archiving service for the Customer and do not allow the individual restoration of a file deleted by the Customer, unless a specific service has been agreed.

13.6. Retention periods. The Customer sets the retention period of each Request, Resource or Delivery, inherited from the template or defined manually. On expiry, the Service notifies the Administrator thirty (30) days before deletion; export remains possible until the last day. Each deletion is logged with the fingerprint of the deleted file. The audit log is kept for three (3) years from each event.

Article 14 — Security

14.1. The Provider implements the following measures, described in more detail on the Security page and in the Trust center: encryption of communications using TLS 1.2 or higher; encryption of Customer Data at rest using AES-256, with keys managed by a key management service with annual rotation; logical segregation of Workspaces; role-based access control; SAML or OIDC single sign-on for the Custom Plan; SHA-256 fingerprint of each file on upload; timestamped and exportable audit log; encrypted backups; annual penetration tests by an independent third party; responsible vulnerability disclosure policy (security@hubflow.cloud, acknowledgement within 72 hours).

14.2. The Provider notifies the Customer of any security breach affecting its Customer Data under the conditions and within the time limits set out in the DPA, and no later than forty-eight (48) hours after becoming aware of it, providing the available information to enable the Customer to fulfil its own obligations.

14.3. The Customer may, once a year and subject to thirty (30) days’ notice, send the Provider a security questionnaire, to which the Provider responds within ten (10) Business Days. On request and under a confidentiality agreement, the Provider discloses its security policy and the summary of its latest penetration test. On-site audits are governed by the DPA.

14.4. The Customer is responsible for the security of its own environment, the strength of its Team Members’ passwords, the confidentiality of its API keys and webhook secrets, and the security of the systems to which it exports Content, including Third-Party Integrations.

Article 15 — Personal data

15.1. Roles. For personal data contained in the Content and relating to Participants and Team Members, the Customer acts as controller and the Provider as processor within the meaning of Regulation (EU) 2016/679 (GDPR). Their relationship is governed by the DPA, which forms an integral part of the Agreement. The Provider processes such data solely on the Customer’s documented instructions, the Agreement and the Service settings constituting those instructions.

15.2. Provider’s own processing. The Provider acts as controller for the data required to manage the contractual relationship: identity and contact details of Administrators and billing contacts, billing data, technical security logs, exchanges with support. This processing is described in the privacy policy.

15.3. Sub-processors. The Customer gives its general authorisation for the use of the sub-processors appearing on the published list, all established in the European Union: hosting (Scaleway), transactional e-mail sending, SMS sending, and payment service provider. Any addition or replacement is notified to the Customer at least thirty (30) days before it takes effect; the Customer may object in writing on legitimate grounds, in which case the parties seek a solution and, failing that, the Customer may terminate the Subscription free of charge for the future.

15.4. Assistance and data subject rights. The Provider assists the Customer, through the features of the Service (export, rectification, deletion, log) and, beyond that, through reasonable assistance, in responding to requests from data subjects exercising their rights and in carrying out impact assessments. Any request received directly by the Provider from a Participant is forwarded to the Customer without delay.

15.5. End of the Agreement. On expiry of the Agreement, the personal data processed on behalf of the Customer is returned and then deleted under the conditions of article 22, subject to the Provider’s statutory retention obligations.

Article 16 — Automated reading of documents

16.1. The Service allows the Customer to enable, item by item, an automated verification of uploaded documents: extraction of information (type of document, dates, amounts, identity of the holder), consistency check against the expected item and evaluation of rejection reasons defined by the Customer. Where a reason is marked as evaluated on upload, a non-compliant file is rejected immediately and the Contributor is informed with the message written by the Customer; where it is marked for manual review, the reason is suggested to the Team Member, who decides.

16.2. This processing is carried out on the Provider’s infrastructure, within the European Union. Documents are neither retained beyond processing by the analysis component nor used to train models. The results are indications based on probabilistic processing; they may contain errors or omissions.

16.3. The Customer remains solely responsible for the verification criteria and rejection reasons it configures, for their compliance with regulations and with the principle of non-discrimination, for the final decision to accept or reject an item, and for informing Participants of the existence of this processing. The Customer undertakes not to use automated reading as the sole basis for a decision producing legal effects or significantly affecting a person, without human intervention. The Provider does not warrant the completeness or accuracy of the results, which cannot replace the professional’s own review.

Article 17 — Deliveries, undertakings, fingerprints and evidentiary value

17.1. Undertaking. In the Send product, the Customer selects usage rules (do not disclose, do not modify, do not copy, use limited to a given purpose, deletion on expiry) and the Service generates an undertaking that the Recipient accepts before accessing the documents. The undertaking is an instrument entered into between the Customer and the Recipient; the Provider is not a party to it and does not warrant its validity, suitability or performance. Clauses added by the Customer to its undertaking library are its sole responsibility.

17.2. Signature. By default, acceptance of the undertaking is collected by simple electronic signature: identification of the Recipient by their e-mail address and, where applicable, a one-time code, timestamping and logging. As an option, an advanced signature with identity verification may be offered. In accordance with article 25 of Regulation (EU) No 910/2014 (eIDAS), an electronic signature shall not be denied legal effect solely on the grounds that it is not qualified; however, the Service does not provide a qualified electronic signature, a qualified electronic registered delivery service or a qualified timestamp, unless a feature expressly states otherwise.

17.3. Fingerprints and certificate. Each file sent receives a SHA-256 fingerprint; the delivery certificate, in PDF format, brings together the Delivery identifier, the sender, the Recipient, the fingerprints, the timestamps, the accepted undertaking and a verification code. Views, downloads, reminders and deletion confirmations are recorded in the Delivery’s evidence vault. These elements constitute prima facie technical evidence of the integrity of the files and of the chronology of events, the assessment of which lies with the competent courts. The Customer remains responsible for retaining the certificates and exports it may need.

17.4. Deletion on expiry. The deletion reminder and confirmation feature records the Recipient’s declaration, or the absence thereof. The Provider does not check and does not warrant the actual deletion, by the Recipient, of any copies it may have made.

Article 18 — API, webhooks and Third-Party Integrations

18.1. API. The Customer may create API keys from its Workspace. A key gives access to a single Workspace, with the rights of the Team Member who created it; the Customer is responsible for the use made of it, including by its service providers. The Customer is informed that, as the Documentation currently stands, “test” environment keys read and write the same data as “live” keys, there being no isolated sandbox.

18.2. Limits. The Provider may apply reasonable rate and volume limits to API calls in order to preserve the quality of the Service for all customers; these limits are documented or communicated to the Customer. Calls exceeding these limits may be temporarily rejected without this constituting unavailability.

18.3. Webhooks. Webhooks are sent on a best-effort basis: the action carried out in the Service completes independently of the delivery of the notification, which is automatically retried in the event of failure and then disabled in the event of repeated failures. The Customer verifies the HMAC signature of notifications and designs its processing to be idempotent, in accordance with the Documentation. The Provider is not responsible for the availability or security of the Customer’s servers receiving webhooks.

18.4. Versioning. The API version number appears in the URL. The addition of fields or routes does not constitute a version change; the Customer’s integrations must ignore unknown fields. The withdrawal of a route, field or version is subject to at least six (6) months’ notice, during which the previous version remains available, save for security imperatives.

18.5. Third-Party Integrations. Connections to third-party services (Google Drive, Microsoft SharePoint and OneDrive, Dropbox, Zapier, Make, identity providers, business software) are enabled at the Customer’s initiative; the Customer accepts their terms with their respective publishers and authorises the corresponding data exchanges. The Provider is not responsible for the operation, availability, security or modification of these third-party services, nor for Content once exported to them. The Provider may suspend a Third-Party Integration that presents a risk to the security of the Service.

Article 19 — Intellectual property

19.1. The Service, including its software, source and object code, databases, architecture, interfaces, graphic elements, Documentation, template libraries, texts, trade marks, domain names and distinctive signs, is and remains the exclusive property of the Provider or its licensors, protected by the French Intellectual Property Code and international conventions. The Agreement does not entail any assignment of intellectual property rights to the Customer.

19.2. Licence to use. The Provider grants the Customer, for the term of the Agreement, worldwide and for its own professional needs, a personal, non-exclusive, non-assignable and non-transferable right to access the Service and to use it in accordance with its intended purpose and the Documentation, through its Team Members and for the benefit of its Participants.

19.3. Restrictions. Except with the Provider’s written authorisation or where mandatory law so provides, the Customer shall not: reproduce, copy, adapt, translate or create derivative works of the Service; decompile, disassemble or reverse engineer it, other than in the cases provided for in article L122-6-1 of the French Intellectual Property Code; rent, lend, resell, sub-license or make the Service available to third parties other than its Participants, in particular as a service bureau; circumvent technical protection measures or the limits of the Plan; extract or re-use a substantial part of the Service’s databases; use the Service to develop a competing product.

19.4. Templates and libraries. The Request, item, reminder scenario and undertaking templates supplied by the Provider are generic examples made available as an aid to set-up. The Customer adapts them, under its own responsibility, to its situation and obligations; they do not constitute legal advice and the Provider does not warrant their suitability for any particular case. Adaptations made by the Customer in its Workspace belong to the Customer, subject to the Provider’s rights over the original elements.

19.5. Suggestions. The Customer authorises the Provider to make free use, without consideration, of the improvement suggestions sent to it by the Customer’s Team Members, without this conferring any right over the Content.

19.6. Indemnity against infringement claims. The Provider indemnifies the Customer against any third-party action based on infringement by the Service of an intellectual property right in France, provided that the Customer informs the Provider of the claim without delay, allows it to conduct the defence and any settlement, and cooperates reasonably. The Provider may, at its option, obtain the right to continue using the Service, modify it or replace it with an equivalent service, or, failing that, terminate the Agreement and refund the sums paid in advance for the unexpired period. The indemnity does not apply to claims arising from the Content, from a Third-Party Integration, from non-compliant use or from a modification not made by the Provider.

Article 20 — Warranties and exclusions

20.1. The Provider warrants that the Service operates in substantial conformity with the Documentation and that it is supplied with the care and skill expected of a professional in its sector.

20.2. The Provider does not warrant that the Service will be free of all defects or will operate without interruption, that it will meet the Customer’s specific needs beyond the Documentation, or that it will, on its own, satisfy the legal, regulatory or ethical obligations specific to the Customer. The Service is a tool made available to a professional who retains control over it: the completeness of a file, the relevance of the items requested, the lawfulness of a share or a delivery, the acceptance of a document and relations with Participants are the Customer’s responsibility.

20.3. The Provider does not provide any legal, accounting, tax or regulatory advice. The contents of the website, the Documentation and the template library are provided for general information purposes.

20.4. Any other warranty, express or implied, is excluded to the extent permitted by law.

Article 21 — Liability

21.1. Each party is liable for the direct damage caused to the other by its breach of the Agreement, under the ordinary rules of law and subject to the following provisions.

21.2. Cap. The Provider’s total aggregate liability under the Agreement, for all causes and all types of loss combined, is limited to the amount, exclusive of taxes, actually paid by the Customer for the Subscription during the twelve (12) months preceding the event giving rise to the damage or, if the Agreement has been in force for less than twelve months, to the annualised amount of the Subscription.

21.3. Excluded losses. The Provider is not liable for indirect or consequential losses, including in particular: loss of turnover, profit, margin, customers or opportunity; commercial or reputational harm; the cost of a substitute service; loss, alteration or disclosure of Content attributable to the Customer, its Participants, its Credentials or a Third-Party Integration; the consequences of a decision taken on the basis of the results of automated reading or of an item check; penalties or reassessments resulting from the Customer’s breach of its own obligations.

21.4. Exclusions. The above limitations do not apply to damage caused by gross negligence or wilful misconduct, to personal injury, or to cases where the law prohibits limiting liability. Nor do they apply to the infringement indemnity in article 19.6 or to the Customer’s indemnification obligation under article 21.5.

21.5. Customer’s indemnity. The Customer indemnifies the Provider against any claim, action or judgment brought by a third party, including a Participant or an authority, based on the Content, on the use made of the Service by the Customer or its Team Members, on the verification criteria, usage rules and undertakings it configures, or on the Customer’s breach of its legal obligations, and holds it harmless from all resulting costs, including legal fees, and damages.

21.6. Limitation period. Any action by the Customer against the Provider under the Agreement must be brought, on pain of being time-barred, within twelve (12) months of the occurrence of the triggering event of which it became aware.

Article 22 — Confidentiality

22.1. Each party undertakes to keep strictly confidential all information of any kind, whether technical, commercial, financial or organisational, that it receives from the other under the Agreement and that is designated as confidential or whose confidential nature is evident, including the Content in the case of the Provider and the specific pricing terms in the case of the Customer. It uses such information only for the purposes of the Agreement and discloses it only to its employees, subcontractors and advisers who need to know it and who are bound by an equivalent confidentiality obligation.

22.2. Information is not confidential if it is or becomes public through no fault of the receiving party, was lawfully held by the receiving party before its disclosure, was received from an authorised third party, or was developed independently. Disclosure required by law or by an authority is permitted, the party concerned informing the other beforehand where possible.

22.3. The confidentiality obligation remains in force for the term of the Agreement and for five (5) years after its expiry; it is of unlimited duration for Content covered by professional secrecy. At the end of the Agreement, each party returns or destroys the other’s confidential information, subject to statutory retention obligations and technical backups, which are themselves subject to the confidentiality obligation.

Article 23 — Suspension

23.1. In addition to the case of non-payment provided for in article 8.4, the Provider may suspend all or part of the access to the Service, to an account, to an API key or to a Third-Party Integration: (i) in the event of a breach by the Customer or a Team Member of articles 11.3, 11.4 or 19.3, or of the Terms of Use; (ii) in the event of a proven risk to the security, integrity or availability of the Service or of other customers’ data; (iii) upon an order from a competent judicial or administrative authority.

23.2. Except in cases of urgency or an order from an authority, suspension is preceded by written notice stating the grounds and, where the breach can be remedied, a cure period of five (5) Business Days. Access is restored as soon as the cause has ceased. Where justified, suspension does not give rise to any compensation or price reduction.

Article 24 — Termination

24.1. For convenience. The Customer may end a monthly Subscription at any time, and decline to renew an annual Subscription under the conditions of article 5, from its Workspace or by written notice to support@hubflow.cloud. Termination takes effect at the end of the current Subscription Period; the sums paid for that Period remain vested in the Provider and no pro rata refund is due, except in the cases expressly provided for in the Agreement (articles 7.3, 15.3, 19.6, 28 and 30).

24.2. For breach. In the event of a serious breach by either party of its obligations, not remedied within thirty (30) days of a written formal notice specifying the breach and referring to this clause, the other party may terminate the Agreement by operation of law, by written notice, without prejudice to any damages. The following in particular constitute a serious breach by the Customer: persistent non-payment after the suspension provided for in article 8.4, breach of articles 11.3, 11.4 or 19.3, or compromising the security of the Service. The following in particular constitute a serious breach by the Provider: unavailability of the Service for more than five (5) consecutive days for a cause attributable to it, or breach of articles 13.3, 13.4 or 22.

24.3. Other cases. Either party may terminate the Agreement by operation of law in the event of the compulsory liquidation of the other party, subject to the public-policy provisions of the French Commercial Code applicable to insolvency proceedings, or in the cases provided for in articles 7.3, 11.4, 15.3 and 28.

24.4. Effects. On the effective date of termination, the Team Members’ access to the Workspace is closed, API keys and webhooks are disabled, and the reversibility provisions of article 25 apply. The provisions which, by their nature, are intended to survive the Agreement, in particular articles 13.1, 13.4, 15, 17.3, 19, 21, 22, 25 and 31, remain in force.

Article 25 — Reversibility, return and deletion of data

25.1. During the Agreement. The Customer may at any time export all of its Content and data from its Workspace and through the API, in open and documented formats: files in their original format, .zip archives per Request or Resource, audit log and metadata in CSV or JSON format, delivery certificates in PDF format.

25.2. On expiry of the Agreement. For thirty (30) days from the effective date of termination or expiry, the Administrator retains read and export access to the Workspace, all other features being disabled. Links transmitted to Participants are disabled on the effective date, unless the Customer requests otherwise for the duration of the reversibility period. On request, the Provider provides reversibility assistance, billed on a time-spent basis at the prevailing rate, following an accepted quotation.

25.3. Deletion. On expiry of the thirty (30) day period, the Provider deletes all Customer Data from its production environment within fifteen (15) days; backups containing such data are destroyed at the end of their thirty (30) day retention cycle. On request, the Provider issues the Customer with a certificate of deletion. The Provider may retain, for the statutory period, only the data necessary to comply with its accounting, tax and evidentiary obligations (invoices, contractual data, security logs), under the conditions of article 22.

25.4. The Customer is solely responsible for having exported the Content it needs before deletion. Once the reversibility period has elapsed, no restoration is possible.

Article 26 — Subcontracting

The Provider may use subcontractors for the performance of all or part of the Agreement, under its own responsibility; it remains the Customer’s sole point of contact and is liable for its subcontractors as for itself. The subcontractors processing Customer Data are those referred to in article 15.3; they are bound by confidentiality and security obligations at least equivalent to those of the Agreement.

Article 27 — Force majeure

Neither party may be held liable for a breach of its contractual obligations, with the exception of payment obligations, resulting from a force majeure event within the meaning of article 1218 of the French Civil Code and the case law of the French courts, including in particular: widespread failure of telecommunications or energy networks, major unavailability of the hosting provider not attributable to the Provider, cyberattack of exceptional scale, natural disaster, epidemic, armed conflict, decision of the public authorities. The affected party notifies the other without delay and endeavours to limit the effects of the event. Obligations are suspended for the duration of the event. If the event continues for more than sixty (60) days, either party may terminate the Agreement by written notice, without compensation; the sums paid in advance for the unexpired period are then refunded to the Customer.

Article 28 — Commercial references

Unless the Customer objects in writing, which it may do at any time, the Provider is authorised to cite the Customer’s company name and logo as a commercial reference, on its website and in its presentation materials, without disclosing any information about the Customer’s use of the Service or any Content. Any testimonial or case study attributed by name is subject to the Customer’s prior written agreement.

Article 29 — Amendment of the Terms of Sale

The Provider may amend these Terms of Sale. The new version is published on this page with its date and notified to the Administrator by e-mail at least thirty (30) days before it takes effect. It applies as from the renewal of the Subscription Period following its entry into force. Where the amendment substantially restricts the Customer’s rights or increases its obligations, the Customer may, before the effective date, terminate the Agreement free of charge by written notice, with effect on that date; the sums paid in advance for the unexpired period are then refunded to it. Failing this, the new version is deemed accepted. Amendments required by a change in legislation or regulations apply immediately.

Article 30 — General provisions

30.1. Entire agreement. The Agreement constitutes the entire agreement between the parties with respect to its subject matter and supersedes any prior agreement, proposal or exchange, written or oral, relating thereto.

30.2. Severability. If any provision of the Agreement is held to be null and void or unenforceable, the other provisions shall remain in full force and effect and the parties shall replace the provision concerned with a valid provision of equivalent economic effect.

30.3. Assignment. The Customer may not assign or transfer the Agreement, in whole or in part, without the Provider’s prior written consent. The Provider may assign the Agreement to any company affiliated with it or succeeding it in the operation of the Service, in particular in the event of a transfer of business, merger or partial contribution of assets, by informing the Customer; the assignee is bound by all the obligations of the Agreement.

30.4. Independence. The parties are independent contractors. The Agreement does not create any relationship of subordination, agency, partnership or joint venture.

30.5. Notices. Notices provided for in the Agreement are validly given by e-mail to the Administrator in the case of the Customer and to support@hubflow.cloud in the case of the Provider, except for formal notices and terminations for breach, which are sent by registered letter with acknowledgement of receipt or by qualified electronic registered mail within the meaning of article L100 of the French Postal and Electronic Communications Code, together with an e-mail.

30.6. Evidence. The parties agree that the records of the Service (audit logs, technical logs, timestamps, online acceptance acknowledgements, electronic invoices) are admissible as evidence and are binding between them unless proven otherwise, in accordance with articles 1366 et seq. of the French Civil Code.

30.7. Language. These Terms of Sale are drawn up in French. Any translation is provided for convenience only; in the event of discrepancy, the French version prevails.

30.8. Anti-corruption and sanctions. Each party declares that it complies with applicable anti-corruption regulations and that it does not appear on any European Union or French sanctions list.

Article 31 — Governing law and dispute resolution

31.1. The Agreement is governed by French law, to the exclusion of its conflict-of-laws rules.

31.2. In the event of a dispute relating to the formation, interpretation, performance or termination of the Agreement, the parties shall endeavour to find an amicable solution. To this end, the more diligent party notifies the dispute to the other, and their authorised representatives meet within fifteen (15) days. Failing agreement within thirty (30) days of the notification, the parties may by mutual agreement resort to contractual mediation; this amicable phase does not preclude interim relief proceedings or protective measures.

31.3. Failing an amicable solution, any dispute shall be submitted to the exclusive jurisdiction of the Reims commercial court (tribunal des activités économiques), notwithstanding multiple defendants or third-party proceedings, including for urgent or protective proceedings.

Contact

SAS MEDUZA STUDIO — Hubflow — 126 boulevard Saint-Marceaux, 51100 Reims, France — RCS Reims 911 536 217 — VAT FR86911536217. Support and billing: support@hubflow.cloud. Security: security@hubflow.cloud.