Product Terms and Operator Agreement

Section 1The parties and how these terms fit together

1. HiveCliq. HiveCliq (Pty) Ltd, a company registered in the Republic of South Africa ("HiveCliq", "we", "us"), provides the HiveMind OS service.
2. The Client. The business named in the signed proposal ("the Client", "you"). The person who signs confirms that they are authorised to bind the Client.
3. Documents and order of precedence. Your agreement with HiveCliq consists of, in this order where they conflict: the signed proposal (plan, users, fees, start date, options), these Product Terms including their Schedules, and the HiveCliq Terms and Conditions version 3.0 of 22 April 2026 at hivecliq.com/terms (the "Master Terms"). Where these Product Terms deal with a matter the Master Terms also deal with, these Product Terms prevail for HiveMind OS.
4. Acceptance. You accept these Product Terms by signing the proposal that refers to them, by signing the signature block at the end of this document, or by using the service after receiving them. No tenant is activated before acceptance.

Section 2Definitions

1. Service: HiveMind OS, the hosted software through which HiveCliq ingests communications and records you connect, builds a private memory of your customers, drafts replies and briefs for human review, flags matters needing attention, and makes that memory available to your authorised users and tools.
2. Tenant: your isolated instance of the Service, including its database, encryption keys, memory, drafts, audit log and configuration.
3. Client Data: all data you or your connected systems submit to the Service, including email and message content, attachments, calendar entries, CRM records, form submissions, documents, and the memory, embeddings, drafts, briefs and outputs the Service derives from them.
4. Personal Information, Responsible Party, Operator, Data Subject, Special Personal Information and Information Regulator have the meanings given in the Protection of Personal Information Act 4 of 2013 ("POPIA").
5. Connector: an authorised link between the Service and a third party platform you control, such as Microsoft 365, a practice management system, a WhatsApp Business number or a web form.
6. AI Provider: a third party whose language or embedding models the Service calls to process Client Data, named in Schedule 2.
7. Region: the geographic hosting location of a Tenant as set out in Schedule 2. South African Tenants are hosted in the Sovereign region in South Africa.
8. Key Tier: either Standard (HiveCliq holds the key that wraps your Tenant's data encryption key) or Sovereign (you hold that key in your own Microsoft Azure Key Vault), as chosen in the proposal.
9. Users: the named people in your organisation you authorise to use the Service, up to the number in your plan.
10. Working Day: Monday to Friday, excluding South African public holidays.

Section 3The service

1. What it does. The Service reads what you connect, recognises which customer a message belongs to, keeps a memory of each customer, drafts replies and daily briefs for your review, raises flags such as deadlines and unanswered messages, and answers questions from your Users about your own data. The plan in your proposal states the Connectors, Users and volumes included.
2. Human approval is built in. The Service never sends a message, writes to your CRM or takes any other outward action without an explicit approval by one of your Users, recorded in the audit log. Where you enable a write-back (for example a note to your CRM), the Service writes only what a User approved.
3. Drafts are drafts. Outputs are suggestions for a qualified person to check. They are not legal, tax, accounting, audit or other professional advice, and HiveCliq does not review their content. You remain responsible for everything you send and for the professional duties that apply to you.
4. Your mailbox sends. Approved replies are sent from your own mailbox through your own provider under your own identity. HiveCliq does not operate a mail server on your behalf.
5. Tenant isolation. Your Tenant is isolated from every other tenant at the database, key and application level as described in Schedule 3. Client Data is never used to train, tune or improve any model, by HiveCliq or by any AI Provider.
6. Onboarding. Onboarding (discovery, Connectors, voice training from replies you nominate, rules, and a team session) is delivered as set out in the proposal. You keep the right to approve the configuration before the Service acts on live data.

Section 4Term, fees and billing

1. Minimum term. A subscription runs for a minimum of twelve months from the signing date unless the proposal states otherwise. After the minimum term it continues month to month until either party gives thirty days written notice.
2. Fees. Fees are in South African Rand and exclude VAT; VAT is added at the prevailing rate. The first month is invoiced in full on signing and each month thereafter is invoiced in advance. Invoices are payable within seven days. Where a debit order is agreed, it runs on the first Working Day of the month.
3. What is included. The plan fee includes the Users, Connectors, hosting in your Region, encryption at the chosen Key Tier, the AI processing volumes stated in the proposal, support in Section 12 and the compliance pack in Section 21. Usage beyond the plan volumes is billed at the overage rates in the proposal, in arrears, and we warn you at eighty percent of a volume.
4. Pass-through costs. Costs charged by third parties for your use, such as messaging conversation fees from WhatsApp, are passed through at cost and shown separately on the invoice.
5. Late payment. If an invoice is unpaid seven days after its due date we may, after written warning, suspend the Service until payment clears. Interest accrues on overdue amounts at the prime rate plus two percent. Suspension does not pause the minimum term.
6. Early termination of the minimum term. If you terminate before the end of the minimum term other than for our material breach, the fees for the remaining months of the minimum term become payable as a single final invoice. Sections 11 and 19 then apply to your data.
7. Price changes. Fees are fixed for the minimum term. Thereafter we may change fees once a year with thirty days written notice; an increase above ten percent entitles you to terminate on thirty days notice without penalty.
8. Founding rates. Where the proposal grants a founding or promotional rate, it applies for the period stated and reverts to the list price thereafter, with notice as in 4.7.

Section 5Hosting and data residency

1. Where your data lives. Client Data for a South African Tenant is stored and processed in the Sovereign region: Microsoft Azure data centres in South Africa North (Johannesburg), with encrypted backups in South Africa West (Cape Town). This covers your database, memory, embeddings, attachments, drafts, audit log and backups. The hosting locations are listed in Schedule 2.
2. What leaves South Africa. The only Client Data that leaves the Region is the content sent to an AI Provider for processing under Section 6, and metadata needed to deliver notifications and DNS. Nothing else is replicated, cached or backed up outside the Region.
3. Infrastructure ownership. Unless the proposal says otherwise, HiveCliq holds the cloud subscription and administers the infrastructure. Where the proposal provides for your own Azure subscription or your own Key Vault (the Sovereign Key Tier), you keep that subscription in your name and grant HiveCliq the minimum access required to operate the Service, which you may revoke under Section 7.6.
4. Changes of hosting. We may change hosting providers, data centres or services within the Region with thirty days written notice, provided the replacement offers equivalent or better residency, security and certification. We will not move a Sovereign Tenant outside South Africa without your prior written consent.
5. Network edge. Domain name resolution is provided by Cloudflare in DNS-only mode; connections are encrypted end to end and terminate inside the Region. No content transits or is cached at the network edge.
6. Not an office server. The Service is delivered from certified cloud data centres with physical security, redundancy and monitored backups. We do not install the Service on premises.

Section 6Artificial intelligence processing

1. Provider and terms. HiveCliq uses Anthropic PBC ("Anthropic") under Anthropic's commercial terms of service and data processing addendum. Under those terms Anthropic does not use inputs or outputs to train its models, and retains API data only for the limited period its terms allow for abuse monitoring, or not at all where zero data retention has been granted to HiveCliq's organisation. HiveCliq applies for zero data retention for HiveMind OS and will confirm the status to you in writing before your Tenant processes live data.
2. Dedicated key. Your Tenant uses its own Anthropic API key or workspace, not shared with any other tenant or HiveCliq product, so your usage and spend are separately metered and can be separately revoked.
3. Minimisation before processing. Before any content is sent to an AI Provider the Service replaces South African identity numbers, company registration numbers, tax and VAT numbers, bank account numbers and card numbers with per-Tenant tokens and restores them only inside your Tenant. Names and figures needed for a correct draft are not removed. No prompt or response is written to any log with its content.
4. Models and changes. The Service routes each job to a model in the chain stated in the proposal. We may change models within that chain to maintain quality or availability and will notify your administrator of a change of default model, with the ability to revert for seven days.
5. No other providers without consent. Client Data is not sent to any AI Provider other than those named in Schedule 2. We add a provider only with thirty days written notice and your right to object under Section 8.7. We will never send Client Data to a provider that trains on it or that cannot give the protections in 6.1.
6. Embeddings. Where the Service creates vector embeddings to search your memory, it does so either inside the Region or with an AI Provider named in Schedule 2 on the same terms as 6.1. Embeddings are stored only in your Tenant.
7. Acceptable use flows down. You will not use the Service to produce content that breaches Anthropic's usage policies or the law, and you accept that the AI Provider may refuse individual requests. A refusal is not a breach by HiveCliq.
8. Accuracy. Language models can be wrong, incomplete or out of date. The Service shows drafts for review for this reason. HiveCliq does not warrant the accuracy of any output and you must not rely on an output without checking it.

Section 7Security

1. Baseline. HiveCliq maintains the technical and organisational measures in Schedule 3, including encryption in transit and at rest, per-Tenant application-level encryption, hardware-backed key management, two-factor authentication for every User, tenant isolation in the database, an append-only audit log, and a security review of every release before it is deployed.
2. Key custody. Each Tenant has its own data encryption key. Under the Standard Key Tier the key that wraps it is held in HiveCliq's hardware-backed key vault in the Region. Under the Sovereign Key Tier it is held in your own Microsoft Azure Key Vault and the Service holds only wrap and unwrap rights that you grant.
3. Access by HiveCliq staff. HiveCliq staff access Client Data only to operate, support or secure the Service, under role-based access with two-factor authentication, and every access is logged. Staff are bound by written confidentiality obligations. We do not read your messages for any other purpose.
4. Testing. Every release passes an independent automated security review before deployment. The platform is penetration tested at least annually and after any material architectural change, and a summary of findings and remediation is available to you under Section 21.
5. Incidents. If we become aware of a security compromise affecting Client Data we will notify your designated contact without undue delay and in any event within seventy two hours of becoming aware, with what we know, what we are doing and what you should do. We will assist you with any notification you must make to the Information Regulator and to Data Subjects under section 22 of POPIA, and we will not notify the Regulator on your behalf without your instruction unless the law requires us to.
6. Your revocation rights. You may at any time revoke a Connector, remove a User, rotate your API keys, or, under the Sovereign Key Tier, revoke the key encryption key. Revoking the key makes your Tenant's data unreadable to everyone, including HiveCliq, and the Service stops until access is restored. HiveCliq is not liable for the consequences of a revocation you make.

Section 8POPIA roles and the operator agreement

This Section is the written contract required by section 21 of POPIA between you as Responsible Party and HiveCliq as Operator, and it applies to all Personal Information in Client Data.

1. Roles. You are the Responsible Party for the Personal Information in Client Data. You decide why and how it is processed. HiveCliq is your Operator and processes it only for the purposes in Schedule 1 and only on your documented instructions, which include this agreement, the proposal, and the configuration your administrators set in the Service.
2. Instructions. If we believe an instruction breaches POPIA or other law we will tell you before acting on it. If we must process Personal Information to comply with a law, we will tell you of that requirement first unless the law prohibits it.
3. Confidentiality. We treat all Personal Information as confidential, we do not disclose it except as needed to provide the Service or as required by law, and we ensure every person acting under our authority is bound to do the same.
4. Security safeguards. We secure the integrity and confidentiality of Personal Information with the appropriate, reasonable technical and organisational measures in Schedule 3, as required by section 19 of POPIA, and we keep them under review against reasonably foreseeable risks and generally accepted practice.
5. Special Personal Information and information of children. You may submit financial, tax and other Special Personal Information and information about children only where you have a lawful basis to process it. The Service treats all Client Data with the same protections regardless of category.
6. Sub-operators. You authorise the sub-operators named in Schedule 2. Each is bound by written terms providing data protection obligations no less protective than this Section. HiveCliq remains responsible to you for their performance.
7. Changes to sub-operators. We will give you thirty days written notice before adding or replacing a sub-operator that processes Personal Information. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate the affected part of the Service on written notice without penalty for the remainder of the minimum term.
8. Transfers outside South Africa. Personal Information leaves South Africa only as described in Section 6 and Schedule 2, to recipients bound by agreements that provide protection substantially similar to POPIA, as section 72(1)(a) permits, and with your consent given by signing.
9. Data Subject requests. We will promptly inform you of any request we receive from a Data Subject about their Personal Information and will not respond except on your instruction. The Service provides tools to find, export, correct and delete a customer's information so you can answer requests within the statutory periods, and we will assist where the tools do not suffice.
10. Breach notification. Section 7.5 applies.
11. Records and cooperation. We keep records of the processing we carry out for you and will make the information reasonably necessary to demonstrate compliance with this Section available under Section 21, including cooperating with the Information Regulator at your request.
12. Information Officer. HiveCliq maintains a registered Information Officer and a PAIA manual. Contact details are in Section 23.
13. End of processing. At the end of the agreement Section 11 applies: we return your data in a usable form and then delete it, and certify the deletion on request.

Section 9Your obligations

1. Lawful basis and notice. You confirm that you have a lawful basis under POPIA to process the Personal Information you connect to the Service, including your own clients' information, and that your privacy notice discloses the use of a service provider and the transfer to an AI Provider outside South Africa described in Section 6. We provide wording you may use.
2. Professional duties. Where you are bound by the rules of a professional body (for example in accounting, auditing, tax or law) you remain responsible for complying with those rules, including client confidentiality and your own quality controls. The Service is a tool under your supervision.
3. Access and consent. You will grant the Connector permissions the Service needs (for example administrator consent in Microsoft 365), keep your own accounts secure, enable the two-factor authentication the Service requires, and remove Users who leave your organisation.
4. Review before sending. You will ensure a qualified User reviews every draft before approving it, and you accept responsibility for every approved action.
5. Acceptable use. You will not use the Service for unlawful purposes, to send unsolicited marketing in breach of section 69 of POPIA or other law, to process information you have no right to process, to attempt to access another tenant, or to reverse engineer, scrape or resell the Service.
6. Cooperation. You will give us timely access to the people, decisions and systems needed for onboarding and support, and respond to requests within five Working Days.

Section 10Connectors and third party platforms

1. Your platforms, your terms. Connectors link to platforms you license directly (such as Microsoft 365, your practice management system or WhatsApp Business). Those platforms' terms apply to your use of them. HiveCliq is not a party to them and is not liable for their availability, their changes to interfaces or pricing, or their suspension of your account.
2. Scope of access. Each Connector requests the minimum permissions required for the features you enable, and the permissions are listed in the Service before you grant them. Tokens are encrypted at rest in your Tenant and can be revoked by you at any time.
3. Messaging platforms. Where WhatsApp is connected, HiveCliq uses an approved WhatsApp Business Solution Provider and Meta's official interfaces only. Meta's business and messaging policies apply to your messaging, and conversation fees are passed through under Section 4.4.
4. Interruptions. If a platform withdraws or changes an interface, we will use reasonable efforts to restore the Connector or offer an alternative. Where neither is possible the affected feature is removed and the fee for it is adjusted from the next invoice.

Section 11Your data: ownership, export, return and deletion

1. Ownership. Client Data, including drafts, briefs, memory and other outputs the Service creates from your data, belongs to you. HiveCliq claims no rights in it beyond the licence to process it needed to provide the Service.
2. Export at any time. Your administrators may export your customer memory, drafts, audit log and configuration in open formats (CSV, JSON, EML and PDF) from the Service at any time.
3. Return on exit. On termination or expiry we keep your Tenant available in read and export mode for thirty days. On request we deliver a complete export in the formats above within ten Working Days.
4. Deletion. After the thirty day export window we delete your Tenant, including its keys, and all Client Data in it. Backups containing your data are purged within a further thirty five days. We certify deletion in writing on request. Data held by sub-operators is deleted under their retention terms in Schedule 2.
5. Retention settings. Your administrators set how long the Service keeps message content and memory. Content older than the setting is purged automatically; the audit log of approvals is kept for the life of the Tenant.
6. Legal holds. We will suspend deletion where the law or a court requires us to and tell you so unless prohibited.

Section 12Availability and support

1. Availability target. We target 99.5 percent monthly availability of the Service, excluding planned maintenance notified at least forty eight hours in advance and performed outside South African business hours, and excluding downtime caused by your platforms, your network, or events in Section 20.
2. Service credits. If availability in a month falls below the target, you may claim a credit of five percent of that month's plan fee for each full percentage point below the target, up to twenty five percent, by written request within thirty days. Credits are applied to the next invoice and are your sole remedy for availability shortfalls.
3. Support. Support is provided by email and the in-app request channel on Working Days between 08:00 and 17:00 South African time. We acknowledge requests within four business hours and resolve or give a plan within one Working Day for issues that stop you working, and within three Working Days for other issues. Security incidents are handled under Section 7.5 at any hour.
4. Continuity. Your database is backed up continuously with point in time recovery for at least seven days and nightly encrypted backups retained for thirty five days in the paired South African location. Recovery is tested at least quarterly.

Section 13Changes to the service

1. The Service is improved continuously. We may add, change or remove features provided we do not materially reduce the core functionality, security or data residency you subscribed to. We give thirty days notice of material changes.
2. If a change materially reduces the protections in Sections 5 to 8 you may terminate on written notice within thirty days of the notice without penalty for the remainder of the minimum term.

Section 14Intellectual property

1. The platform is ours. HiveCliq and its licensors own the Service, its software, models of operation, prompts, system instructions, designs, documentation and all improvements. You receive a non-exclusive, non-transferable licence to use the Service for your business for the duration of the subscription.
2. Your data and outputs are yours. Section 11.1 applies. The voice profile and rules the Service derives from your content are your confidential information, are used only for your Tenant, and are deleted with it.
3. Feedback. You grant HiveCliq a perpetual licence to use suggestions you make about the Service, without any obligation to you and without using your Client Data.
4. Branding. Tenant pages carry your logo and a small "Built by HiveCliq" credit. We will not name you as a client publicly without your written consent.

Section 15Confidentiality

1. Each party keeps the other's confidential information confidential, uses it only for this agreement, and discloses it only to people who need it and are bound to the same duty. Client Data is always your confidential information.
2. The duty lasts for five years after the agreement ends and indefinitely for trade secrets and for Personal Information.
3. Disclosure required by law or a court is permitted after notice to the other party where lawful, limited to what is required.

Section 16Warranties and disclaimers

1. HiveCliq warrants that it will provide the Service with reasonable skill and care, in accordance with these terms and applicable law, and that it has the right to grant the licence in Section 14.1.
2. You warrant that you have authority to enter this agreement, that your Client Data and your use of the Service comply with law, and that you have the consents and notices described in Section 9.1.
3. Except as stated in these terms, the Service is provided without other warranties. HiveCliq does not warrant that the Service will be uninterrupted or error free, that outputs will be accurate, or that the Service will achieve any particular business result.

Section 17Liability

1. General cap. Each party's total aggregate liability arising out of or in connection with this agreement in any twelve month period, whether in contract, delict or otherwise, is limited to the fees paid by you for the Service in the three months immediately before the event giving rise to the claim.
2. Data protection cap. For HiveCliq's breach of Sections 7 or 8 (security and the operator agreement) the cap in 17.1 is replaced by the fees paid by you for the Service in the twelve months immediately before the event.
3. Exclusions. Neither party is liable for indirect or consequential loss, loss of profit, loss of business, or loss of goodwill, however arising.
4. Nothing excluded by law. Nothing in this agreement limits liability for fraud, wilful misconduct, gross negligence, death or personal injury, or any liability that cannot be limited by law.
5. Your reliance on outputs. HiveCliq is not liable for loss arising from a message, filing, payment or decision you approved or made in reliance on an output, where review under Section 9.4 would have revealed the error.

Section 18Indemnities

1. You indemnify HiveCliq against third party claims arising from your Client Data, your breach of Section 9, your lack of a lawful basis or notice for processing, or your misuse of the Service, including reasonable legal costs.
2. HiveCliq indemnifies you against third party claims that the Service, as provided by HiveCliq and used in accordance with these terms, infringes a third party's intellectual property rights in South Africa, including reasonable legal costs, provided you notify us promptly, let us control the defence, and cooperate. We may modify or replace the Service to avoid infringement or, if that is not reasonable, terminate it and refund fees paid in advance for the unexpired period.

Section 19Suspension and termination

1. For breach. Either party may terminate on written notice if the other commits a material breach and fails to remedy it within ten Working Days of a written demand.
2. Immediate suspension. HiveCliq may suspend the Service immediately where continuing would, in our reasonable view, cause a security incident, breach the law, or breach an AI Provider's or platform's policies, and will tell you at once and restore the Service as soon as the cause is resolved.
3. For non-payment. Section 4.5 applies.
4. On notice after the minimum term. Section 4.1 applies.
5. Effect. On termination your licence ends, the fees in Section 4.6 become payable where applicable, and Section 11 governs your data. Sections 8, 11, 14, 15, 17, 18 and 22 survive.

Section 20Force majeure

1. Neither party is liable for failure caused by events beyond its reasonable control, including sustained electricity supply interruption affecting a data centre, failure of a cloud provider's region, failure of an AI Provider, internet backbone failure, cyber attack on a third party, government action, strike, or natural disaster, provided it uses reasonable efforts to mitigate and resume.
2. If such an event prevents the Service for more than sixty consecutive days, either party may terminate the affected Service on written notice and HiveCliq will refund fees paid in advance for the unexpired period.

Section 21Compliance pack and audit

1. Compliance pack. On onboarding and on request thereafter, HiveCliq provides: this agreement and Schedules; a data flow map naming each location and sub-operator; the current security measures summary; the breach notification runbook; the retention and purge procedure; privacy notice wording for your own use; and the most recent penetration test summary.
2. Reports. Quarterly, we provide an access review of HiveCliq staff access to your Tenant and a summary of security events, if any.
3. Audit. Once a year, on thirty days written notice, you or an independent auditor bound by confidentiality may review our compliance with Sections 7 and 8 by reviewing documentation and interviewing responsible staff, at your cost, during Working Days, without disrupting other tenants. We may satisfy the review with a recent independent assessment covering the same scope.
4. Regulator. We cooperate with the Information Regulator and with your professional body's reviewers in respect of the Service at your request.

Section 22Governing law and disputes

1. This agreement is governed by the law of the Republic of South Africa.
2. The parties will first try to resolve any dispute by negotiation between senior representatives within fifteen Working Days of written notice, then by mediation under the rules of the Arbitration Foundation of Southern Africa (AFSA), and failing settlement within thirty days of the mediation request, by binding arbitration under AFSA's rules in Cape Town before a single arbitrator. Either party may seek urgent interim relief from the Western Cape Division of the High Court.

Section 23Notices, amendments and general

1. Notices are given by email to the addresses in the proposal, with a copy to legal@hivecliq.com for HiveCliq, and are deemed received on the next Working Day. Our Information Officer can be reached at the same address.
2. Amendments. We may amend these Product Terms with at least thirty days written notice. An amendment that materially reduces your rights under Sections 5 to 8, 11 or 17 does not apply to you during your current minimum term without your written agreement, and otherwise entitles you to terminate without penalty under Section 13.2. Other amendments apply from the notice date to continued use.
3. Entire agreement. The documents in Section 1.3 are the entire agreement for HiveMind OS and replace earlier proposals, demonstrations and discussions.
4. Assignment. Neither party may assign this agreement without the other's written consent, not unreasonably withheld, except that HiveCliq may assign to a successor to its business on notice, bound by these terms.
5. Severability and waiver. An unenforceable provision is modified to the minimum extent needed and the rest stands. A delay in enforcing a right is not a waiver.
6. Electronic signature. Signature by electronic means, including through the proposal platform, is binding.
7. Language. English is the controlling language of this agreement.

Schedule 1Processing details

Schedule 2Hosting locations and sub-operators

Regions

Sub-operators that may process Client Data

Platforms you connect and license yourself (for example Microsoft 365, your practice management system and web form providers) are not sub-operators of HiveCliq; they remain your own service providers under your own agreements with them. HiveCliq staff access is governed by Section 7.3. Any addition to this Schedule follows Section 8.7.

Schedule 3Security measures

SignatureAcceptance of the Product Terms and Operator Agreement

Signing the proposal that refers to this document is acceptance of it. Where a separate signature is preferred, sign below. The signatory for the Client confirms authority to bind the Client and that the Client has read Sections 5 to 8 on hosting, artificial intelligence processing, security and POPIA.