Service details

Every text Significans Architect shows you or sends you, from the sources the service itself uses.

The agreements

• Terms of Service
• Privacy Policy
• EULA
• Cookie Policy
• Data processing agreement

What we keep and why

Your account. Your e-mail address and, if you changed it, the addresses the account had before with when each was left (kept until the account is erased), a hash of your password (Argon2id — we never keep the password itself), when the account was created, verified, last signed in and last used, your plan, your settings (the «Help us improve Architect» switch, whether an operator granted you the AE-Agent in full beyond your plan, the context size you chose, and Debug mode — which only an operator can switch on for an account), your display name and the standing instructions you give the assistant. The instructions are content you type: they go to the model with each request, like a chat's text.

Sign-ins and mail links. A session is a token we keep only as a hash; it lives 30 days and is extended while you use the service. A verification link lives 48 hours, a password-reset link 1 hour; we keep their hashes only. A link that confirms a new address for your account lives 48 hours; we keep its hash and the new address it asks for until it is used, replaced by a newer one or expires.

Security counters. Short-lived counters that limit sign-in attempts, password checks, exports, organisation changes and bug reports (10 an hour), keyed by hashes and by your account id. They exist to refuse an attacker and name no content.

Your organisation. If you belong to an organisation: its name, its members (who, with what role, since when), its plan and settings, and the invitations its administrators send — an invited address, valid for 7 days and kept 30 days after it expires.

Your chats. A stored chat's title, times, the model and reasoning level you picked, the knowledge line and recipe packs it uses, and its messages: your text, the names of your uploads, the assistant's replies with the tool calls they made and what those returned, and the summaries the service writes when a long conversation is compacted. The live stream of a running reply is kept 24 hours so a reconnect can resume it. Chat content — titles, messages, tool calls and their results, the live stream — and the names of files are encrypted at rest in our database; the key is held by the operator on the host, outside the database. This protects stored copies such as database dumps and backups; the running service decrypts a chat to answer in it or to show it to you. Not yet encrypted at rest: the contents of files and their checksums, the working drafts the workflow builder keeps for a chat, the copies a bug report keeps (see «Bug reports»), and your display name and standing instructions.

Your files. Files you upload and files the assistant builds for you: name, size, type, a checksum and the bytes. Up to 1 GiB of live files per account and 100 MiB per file. A file lives 60 days, or until its chat is deleted; an upload that was never sent is removed after 24 hours.

Help us improve Architect. See the section of that name below.

Usage and payment records. For each model call: ids, the model, token counts and the amount in money — never the content. Your usage windows (5 hours and 7 days) and the service's daily totals. If you or your organisation hold a prepaid balance: its sums, the holds of calls in flight, each top-up (with Stripe's payment id) and each charge, refund or dispute; for an organisation's balance also each expiry of its unused money (its amount and day), the days and times of the expiry emails we sent its administrators for the balance's current term and the date each stated, and, while we have disabled the organisation, when the balance's term was paused and for how long.

AE-Agent. If you connect the AE-Agent: a hash of its token (never the token), when it was created, revoked and last seen, the install key the token is pinned to and the computer name reported at a code sign-in, and — while the agent is connected — the live link: the kit's and Automation Engine's versions, since when, and the calls in flight. Until a sign-in code expires: that code with the installation's public key, computer name and kit version. Each update of an AE-Agent is recorded: who started it (you, an administrator of its organisation, or its organisation's automatic updates), when, the version it left and the one it went to, and how it ended.

MCP clients (organisation plans). The clients you connect and their grants; codes and refresh tokens are kept as hashes only, and a grant is removed after 30 days without use.

Bug reports. See «Bug reports» below: what a report carries is what you tick in the report dialog, and it is kept for 180 days.

Logs. An operational log with ids and counts (customer, request and chat ids, timings, warnings — never an address, password, token, title or text), and an access log with the request path and your network address. Both are the host's and follow its log rotation.

Help us improve Architect

A personal account starts with this setting on: Architect asks once, at the account's first sign-in, or its first visit after this change or after it leaves an organisation, with the switch showing the setting, and the person can switch it off then or on the Account page at any time; an account that belongs to an organisation always has it off and is never asked. While it is on, Architect collects telemetry to find mistakes and improve Architect: for each reply the person starts, when it ran, from which client, on which plan, the command used (its name alone) and how it ended (completed, stopped or failed, with the error's code); for each call to the model, the model and reasoning level, the tokens in and out, how long it took and whether it completed; for each call to the tools on Architect's server, the tool's name, how long it took and whether it succeeded — each with the account's id and the chat's and the reply's ids. It never collects a message, a reply, a tool's input or result, an instruction to the assistant, a file or a file's name, an e-mail address or an IP address.

Telemetry is kept for 30 days and is deleted sooner with its chat or the account; switching the setting off, or the account joining an organisation, deletes everything collected so far at once. It is not used to train third-party AI models, and it is not sold or shared. To improve Architect, we see a chat's content only in a bug report the person chooses to send (see «Bug reports»). Whatever the setting, a chat's messages and the person's instructions to the assistant are sent to the company that runs the model so that it can answer them.

Who processes it for us

• Hosting — Amazon Web Services (Lightsail), region [fill in: the region — the operator]: the service, its disk and its backups.
• Model providers — your requests and the assistant's replies go to the provider of the model you picked, under our key: Anthropic, or Amazon Bedrock (Amazon Web Services) in the region [fill in: Bedrock's region — the operator]. An organisation that connects its own model key sends its members' requests that run on that key to its own provider under its own contract, and none of ours is involved; its members' other requests go under our key, as above.
• The product server — Significans Automation's workflow server, which keeps the record of your product key and the working drafts of your chats' sessions. It keeps each chat's working copies — the workflow draft and the files handed to it — for 7 days after the last use, unencrypted, in its own database, which is backed up nightly with the rest of the service; our own database keeps your chats' text encrypted at rest, but not the contents of files (see «Your chats»).
• Payments — Stripe: your e-mail address, your account id and, as you enter them at checkout, a business name, billing address and tax ID; your subscriptions, charges, invoices and receipts. We never see your full card number.
• Bug reports — Amazon S3 (a private, server-side-encrypted bucket in the host's region) for a report's bundle, and GitHub (one private repository that only our engineers can open) for its issue; see «Bug reports» above.
• Mail — [fill in: the mail relay — the operator]: the account mails (your address and the mail's text).
• Our gateway — our own TLS front door, with its access log.

We tell organisations under a data processing agreement before we add or replace a processor.

Who can see it

You — through the service and through your export. Your organisation's administrators — the organisation's members, settings, balance and usage. Our operators — through the admin console: your account, plan, spend and balance, to run the service and help you; every change an operator makes and each opening of your account's, organisation's or balance's record, an organisation administrator's console sign-ins, sign-outs and changes to the organisation's agents and to its members' recipe rights, and a recipe studio account's sign-ins, sign-outs and changes to recipe packs and submissions, are recorded in an audit kept 365 days. Beyond what the console shows, our operators can read the «Help us improve Architect» telemetry in the service's database — ids, names, numbers and moments, never a chat's content — and the contents of a bug report on the host. The host's operator — whoever runs the server reads its disk and logs. The processors above — each its own part, under its own terms. Nobody else, unless the law requires it; this, like the age limit under «Children», is our policy.

How long

• a session — 30 days, extended by use; a verification link 48 hours; a reset link 1 hour;
• a running reply's stream — 24 hours; an unsent upload — 24 hours;
• a file — 60 days, or with its stored chat;
• the workflow server's working copies of a chat (its draft and the files handed to it) — 7 days after the last use, unencrypted;
• «Help us improve Architect» telemetry — 30 days, and at once when you switch the setting off;
• a bug report — 180 days, or less when you erase your account first; after an erase, the report's issue at GitHub still keeps its own history of our engineers' edits until we remove it by hand;
• an invitation — 7 days, kept 30 days after it expires; an unused MCP grant — 30 days;
• a prepaid balance — a personal account's has no expiry date and ends with the account; an organisation's expires at the end of the term the «Refunds» section of our Terms of Service sets;
• usage and payment records — kept as the service's accounting (ids and amounts, no content);
• the record of an AE-Agent update — 365 days from its start;
• the operators' audit — 365 days, including the reason an operator typed (up to 200 characters) for erasing or exporting your account or for removing you from an organisation; logs — the host's rotation;
• an account with no plan that nobody signs in to or uses — until the inactivity term that the «Term and termination» section of our Terms of Service sets ends, after emails to its address before that day; then it is erased as under «Erase» (never while it holds a prepaid balance, belongs to an organisation with a plan, or is suspended by us);
• everything else — as long as your account exists, and as the next section says afterwards.

What you can do

Export. From your account page you get one document with everything the service keeps about you: your account with its former addresses, your organisation membership, the pending invitations to your current address, your chats with their messages, your files, your usage and balance, your «Help us improve Architect» telemetry, each event as kept, your bug reports' facts, the record of each AE-Agent update you started, your product key's dates, your AE-Agent records (each one's name and dates, whether it is still linked and the computer name its sign-in reported), the MCP clients you connected (each client's name and its grant's state and dates) and the AE-Agent direct clients you allowed (each client's name and its grant's state and dates). It leaves out what proves nothing about you (hashed secrets, security counters, a running turn's stream), a new address you asked for and have not confirmed yet, the service's own accounting (your usage is included instead), the operators' audit and the logs.

Erase. From your account page, with your password, you erase your account: your sessions end at once, and your account with its former addresses, chats, messages, files, collected records, the invitations to your current address, your own AE-Agent records with their tokens and update records, MCP grants, your Stripe customer and your product key go. A step that fails is finished by the service within minutes, and you are mailed once when the account is gone. An account with no plan that nobody signs in to or uses is erased the same way, without its password, when its inactivity term ends (see «How long»). What stays: the usage and payment records as ids and amounts; the balance record, with any remainder ended without a refund; the record of each update you started on an organisation's AE-Agents, which stays the organisation's for its term (see «How long») with «erased» in place of who started it; the operators' audit, which keeps your account's id — also where, as an organisation's administrator, you changed its AE-Agents or signed in to or out of its console — and any reason an operator typed for erasing or exporting your account or for removing you from an organisation, as typed (an address written in a reason stays), with your addresses blanked; the product server's record of your revoked key, its id and dates, with your details removed; a delivered bug report in the form the «Bug reports» section describes; an invitation sent to one of your former addresses, until its own term ends (see «Your organisation»); Stripe's records of your payments under Stripe's terms; the logs under their rotation; and our backups — the host's nightly sets, seven daily and four weekly — until their retention removes them.

Switch «Help us improve Architect» off — on your account page, at any time; everything collected so far is deleted at once. Revoke the AE-Agent — on your account page. Leave an organisation — ask its administrator.

If you are in the European Union or the United Kingdom, you also have the rights the GDPR gives you — to access, correct, erase, restrict or object to the processing of your data, to take it with you, and to complain to your supervisory authority. The export and the erase above are how you exercise most of them yourself; for the rest, write to us.

The legal bases

We process your account, chats, files and payments to provide the service you asked for (the contract). We keep the security counters, the logs and the usage records in our legitimate interest in running a safe, metered service. We keep the «Help us improve Architect» telemetry in our legitimate interest in finding mistakes and improving the service, and you can object at any time by switching the setting off. We process a bug report on the consent you give in the report dialog. Our processors work on the same bases: the model providers answer your requests and Stripe takes your payments to provide the service you asked for (the contract), and each other processor named under «Who processes it for us» handles what it carries for that purpose. We keep the operators' audit in our legitimate interest in tracing every change an operator makes and each opening of your account's, organisation's or balance's record, an organisation administrator's console sign-ins, sign-outs and changes to the organisation's agents and to its members' recipe rights, and a recipe studio account's sign-ins, sign-outs and changes to recipe packs and submissions. [fill in: the legal basis review — the lawyer.]

3. The service

The service helps you design, inspect, refactor and document automation workflows for Esko Automation Engine, with the help of AI models and a curated knowledge base of tasks and recipes. Esko® and Automation Engine are trademarks of their owner; their mention here describes what the service works with and implies no endorsement by, or affiliation with, their owner unless we say so elsewhere.

What the service produces — a workflow, a suggestion, an analysis, a text — is generated with the help of AI models. It can be wrong, incomplete or unsuitable for your installation. You review and test everything the service produces before you rely on it, and you alone decide what runs in your production environment. The service is a tool for your work, not a substitute for your judgement.

We may change the service — add, change or remove features — and we may do so without notice where the change does not materially reduce what your plan gives you. A material reduction of a paid plan is announced in the service at least 30 days before it takes effect.

4. Plans, prices and payment

The service is offered under plans. The personal plans, what each one includes and its price are published on the pricing page of the service at the time you choose it; the pricing page is part of these Terms. An organisation's plan and its price are agreed in its contract with us. Some features are available only on particular plans; the service shows you which ones are not in your plan.

Prices are stated in US dollars and exclude taxes unless the pricing page says otherwise. Where tax applies to your purchase, it is added at checkout or shown on your invoice.

Payment for a personal plan and for a top-up of a prepaid balance is taken through our payment provider, Stripe, under the payment details you give there; we never see your full card number. Your plan's usage allowance is set by the plan you hold. An organisation's usage on our model key is paid from the organisation's prepaid balance, which an administrator tops up or we credit against our invoice under the organisation's contract, and which an administrator may cap per month; usage is drawn from the balance at the rates of our model catalogue for the model each request uses. Usage under an organisation's own model key is not drawn from the balance (section 10). Prepaid extra usage, where your plan offers it, works the same way for a personal account.

We may change prices. A price change applies to you from your next renewal or top-up after we announce it, and we announce it at least 30 days in advance in the service or by email.

If a payment fails, we tell you and give you a reasonable time to put it right. While a plan is unpaid or a balance is exhausted, the service may limit or suspend the features that payment covers.

5. Refunds

Usage that has been consumed is not refunded. A prepaid balance, including prepaid extra usage, is not refundable: its unused part is not paid back, and a balance ends when its account is erased or its organisation is removed. A personal account's prepaid balance has no expiry date. An organisation's prepaid balance — its top-ups and the credits we make against its invoice — expires 12 months after money was last added to it; each time money is added, the whole balance runs for 12 months from that day. We email the organisation's administrators 30 days and 7 days before its balance expires, and a balance never expires sooner than 7 days after the last of these emails was sent. What is left on the expiry date is removed and is not paid back. While we have disabled an organisation, its balance does not expire and we send no emails about it; the time it stays disabled is added to the balance's term. Where we grant a refund in a particular case, it goes back through the payment method it was paid with and is for the amount we received, less any amounts the payment provider does not return to us. [fill in: the refund window and any exceptions — the operator.]

Nothing in this section limits rights you have under the consumer law that applies to you where you are a consumer.

7. Your content

What you upload to the service, what you type into it and the workflows you author with it are yours (or your organisation's). You keep every right you have in them.

You give us the permission we need to operate the service for you: to store your content, to process it, to send it to the AI model providers we use so they can answer your requests, and to show it back to you and to the members of your organisation that your organisation's settings allow. This permission ends when the content is deleted from the service, except for the copies and records the Privacy Policy says we keep for a stated time (such as backups and the records of a bug report).

You are responsible for your content: for having the right to use it, and for what it contains.

8. Feedback and bug reports

If you send us suggestions, ideas, requests, bug reports or other feedback about the service («feedback»), you grant us a perpetual, irrevocable, worldwide, royalty-free, sublicensable right to use, change, publish and build on that feedback for any purpose, without any obligation to you — no payment, no credit, no confidentiality. This lets us improve the service for everyone without having to trace every improvement back to a conversation. You keep the right to use your own feedback as you wish.

The content of a bug report — your workflow, the chat it concerns, the files it carries — is your content under section 7, not feedback. We process it only as the report dialog's consent and the Privacy Policy say, and we keep it for the time stated there.

10. Third-party services

The service relies on providers we do not control: AI model providers that answer your requests, a payment provider (Stripe) for payments, a cloud provider (Amazon Web Services) for hosting and storage, a mail relay that delivers the service's emails, and a code-hosting provider (GitHub) where our engineers track bug reports. Each provider handles its part under its own terms, and the Privacy Policy names each provider and what reaches it. We choose providers with care, but we are not responsible for a provider's own failures beyond what section 13 says.

If you connect your own key to an AI model provider where the service allows it, that provider's terms govern that provider's use, and the costs it charges you are yours.

11. Data and privacy

Our Privacy Policy explains what data the service keeps, where it is kept, for how long, who processes it and what you can do about it. In short: you can export your data and erase your account from your account page; the service keeps a few records after an erase for the time and the reasons the Privacy Policy states; the «Help us improve Architect» collection is on by default for personal accounts and you can turn it off at any time, and it is always off for organisation accounts. Organisations that need it get our data processing agreement on request.

14. Term and termination

These Terms apply from the moment you create an account until the account is closed.

You can close your account at any time from your account page (the erase); an organisation's only active administrator first hands that role to another member or removes the other members. Closing it ends your plan; the unused part of a prepaid balance is handled under section 5; what happens to your data is stated in the Privacy Policy.

An account with no plan that nobody has signed in to or used for 12 months (the inactivity term) is closed by us with the same erase; we email its address 30 days and 7 days before. Signing in or taking a plan before then keeps the account and starts the inactivity term again (for a member of an organisation: a plan from its administrator; for an account whose address was never confirmed: signing up again and confirming it). We never close an account this way while it holds a prepaid balance, belongs to an organisation with a plan, is its organisation's only active administrator while other members remain or the organisation's balance holds money, or is suspended by us — the inactivity term then starts again on the day we lift the suspension.

We may suspend or close your account if you break these Terms, if a payment stays outstanding after our notice, or if we must do so by law. We tell you why, except where the law or security prevents it. We may also discontinue the service as a whole with at least 90 days' notice; in that case we refund the unused part of a prepaid balance.

Sections that by their nature survive the end of these Terms — 7 to 9, 13, 15 and 16 — keep applying after it.

The bug report's consent

Sending this report transmits what you tick in the report dialog — your description and contact details, the chat’s transcript (including tool calls), the chat’s files listed and any files you add — together with your account’s identifiers, plan and organisation, the chat’s workflow line, the versions of this service and of the workflow service, and the AE-Agents you may use — their names and versions and whether each was linked, to Significans Automation. A staff member will read and analyze them to investigate the problem and will reply to the address you give. The report is kept by us in our storage at Amazon Web Services, and our engineers track it as an issue in a private repository at GitHub that only they can open (GitHub processes that issue on our behalf). After 180 days, or at once when you erase your account, its files are deleted and your words, contact details and file names are removed from its record; earlier versions of the record and copies our engineers have already received are not recalled, and the emptied issue stays until we remove it by hand. Your password and model keys are never included. You receive a report number; quote it to have the report deleted. Nothing is sent until you press Send. Ideas and suggestions in a report may be used by us as our Service details say.

Shown in the report dialog (“Report a bug…” in a chat's menu) under “What goes with the report”, where it reads “what is ticked above” in place of “what you tick in the report dialog”.

The emails we send

Your organisation's prepaid balance of {amount} expires on {date}.

A top-up by an administrator, or a credit we make against an invoice, before that day keeps it: each time money is added, the whole balance runs for {months} from that day. What is left on {date} is removed and is not paid back (see Refunds in our Service details).

The organisation console: {console}

Your Significans Architect account has no plan, and nobody has signed in to it or used it for the inactivity term our Service details set ({origin}/legal#term-and-termination).

Unless you {cure} before {day}, the account and what the service keeps for it are deleted on that day, as when you delete it yourself. What stays: {origin}/legal#what-you-can-do

You get one more email when the account is gone.

sign in ({origin}/app/login) or take a plan ({origin}/app/billing)

sign in ({origin}/app/login), or ask your organisation's administrator for a plan,

sign up again with this address ({origin}/app/signup) and confirm it

Your Significans Architect account and what the service kept for it
were deleted: the account and its sessions, your membership of an
organisation, the invitations to this address, your stored chats with
their messages and files, the collected records, your AE-Agent link
and its tokens, your MCP client connections, the files of the bug
reports you sent, your customer record at Stripe with its
subscription, your address on an organisation's customer record at
Stripe, and your product key (revoked, then your name removed from
its record).

What stays: the usage records (amounts, no content); your prepaid
balance's record, kept: its sums, its credits (a grant with the
operator's id and the invoice number) and its debits (a refund or a
dispute, with Stripe's id for it and the payment's), the rest of the
balance extinguished without a refund; the operators' audit entries
with your address removed, which keep your account's id and any
reason an operator typed for erasing or exporting your account or for
removing you from an organisation, as typed (an address written in a
reason stays); the records of the updates you started on an
organisation's AE-Agents, which stay the organisation's with the word
erased in place of who started them; the product key's record,
revoked, with your name removed; a bug report already passed to our
engineers, as a record without your words, contact details and file
names (earlier versions of it and copies our engineers have already
received are not recalled); and the payment records Stripe keeps
under its own terms.
An organisation's prepaid balance keeps the top-ups you bought for it
under your account's id, without your address.

Back to the front page