Terms of service

1. Who provides the service and who these terms apply to

1.1 Verho is provided by Tekoälytehdas Oy (business ID 3600364-1), Liisankatu 7, 00170 Helsinki, Finland, email aarne@tekoalytehdas.fi. In these terms, "we".

1.2 "You" are the person who signs in to Verho. When you use Verho on a seat belonging to a company or other organisation, these terms also bind that organisation ("your firm"). If you accept these terms on behalf of an organisation, you confirm that you are authorised to do so.

1.3 These terms apply to businesses and to individuals. If you are a consumer, you also have the rights given to you by the Finnish Consumer Protection Act and by the mandatory consumer protection law of your country of residence. Nothing in these terms limits them.

1.4 The agreement consists of:

1. these terms of service
2. the data processing agreement between us and your firm, once your firm has set up a team in Verho. We send it on request. For personal data it takes precedence over these terms. Until your firm has it, we process personal data on your firm's behalf only as these terms and the privacy notice describe
3. any order or quote agreed separately in writing; it takes precedence over these terms where it says otherwise.

The privacy notice explains what data we process about you and why. It is information, not a contract.

1.5 You accept these terms when you first sign in. You must be at least 18 years old to use the service.

2. Words we use

3. What Verho does

3.1 When you type or paste text into the AI service's input field, the extension sends the text over an encrypted connection to our server in Helsinki. The server looks for personal and other sensitive data, returns where it is, and forgets the text. The extension highlights what was found in the input field.

3.2 You can remove a highlight or add something Verho missed. When you ask, the extension replaces the highlighted values with placeholders. You send the message yourself, with the AI service's own button.

3.3 When the answer arrives, the extension puts the original values back into it in your browser. Which placeholder stands for which value is stored only in your browser, encrypted under a key that never leaves your device. Our server takes no part in restoring.

3.4 The extension is designed always to show whether protection is on, switched off, or unavailable. If detection is not working, the extension says so and never suggests that protection is running.

4. What Verho does not do

4.1 Verho does not block you. You can send text without protecting it, switch Verho off, or remove it. The extension offers; you decide.

4.2 Verho does not find everything. Detection relies on a machine-learning model and on rules, and it can miss data or highlight something needlessly. We measure accuracy separately for each type of data. You are responsible for what you send.

4.3 Verho does not fulfil your obligations under data protection law and does not transfer your firm's obligations to us. Text in which values have been replaced with placeholders is pseudonymised, not anonymous: it can be linked to a person, and the rest of the text may still reveal who it is about. Your firm, as controller, decides whether the data may be processed in an AI service at all.

4.4 Verho gives no legal, medical or financial advice and says nothing about whether the AI service's answers are correct. We may provide templates, such as a description of Verho for your firm's AI register, but we do not assess your firm's compliance.

4.5 Verho does not protect what the AI service's page does before you send. The AI service's page sees the contents of your input field in your browser before Verho replaces any values, and some services save unsent drafts, which may reach their servers before you have protected anything. Verho protects the message you send with placeholders. It does not protect attachments, images, or text you type anywhere other than the input field.

4.6 Verho is not an AI service and not a product of Anthropic or OpenAI, and they have not endorsed it.

5. Account and seats

5.1 You sign in with a Microsoft or Google account, or with a code sent to your email. Your first sign-in creates a free account and a firm of one. We never ask for or keep a password.

5.2 Your account is personal. Do not let anyone else use it or your device's sign-in token. Tell us without delay if you suspect someone else is using your account. You can sign out of one device or of all of them.

5.3 When you set up a team, you become its admin. An admin can invite users, remove their seats and handle payment. An admin sees who holds a seat (name, email and role). Nobody sees what an individual user did: not the admin and not us. No such data is stored.

5.4 When you accept an invitation to a team, your previous firm of one and its counters are deleted. When your seat is removed, your account remains and your next sign-in gives you a new firm of one.

5.5 Your firm is responsible for its users following these terms and for having instructed them on what data may be processed in AI services.

5.6 Your firm's liability towards us. Your firm compensates us for third-party claims, and the reasonable costs arising from them, that result from text your firm's users send to detection or to an AI service, from use contrary to these terms or to the law, from your firm's failure to meet its own data protection obligations as controller, or from the use of AI services. This section does not apply to consumers.

6. The AI services' own terms

6.1 You use Claude and ChatGPT with your own account, under their own terms of use and privacy policies. Verho is not a party to that agreement. What the AI service does with the text you send is between you and the AI service.

6.2 The extension never handles your AI service credentials, session or cookies. It sends no messages on your behalf and adds no requests.

6.3 The AI services' terms and Verho. The AI services' terms contain clauses restricting use of the service by automated means and programmatic extraction of output. According to the legal assessment we have obtained, using Verho does not breach these terms: a person starts every message, Verho changes the text in the input field only when you ask, reads the answer only in your browser to restore your values, handles no credentials and keeps no answers. The AI service nevertheless decides for itself how it reads its terms, and we are not responsible for its decisions, such as restricting your account.

6.4 For firms, we recommend the AI services' business plans (for example Claude Team or ChatGPT Business), which fall under commercial terms.

6.5 AI services change their pages. A change can stop Verho working until we update the extension. The extension then shows that protection is unavailable.

7. Permitted and prohibited use

7.1 You may use Verho lawfully and in line with these terms for what it is made for: finding and protecting data before you send it to an AI service.

7.2 You may not:

• use the detection server other than through the extension, for example as your own API, in automated bulk, or as part of another product
• use detection results to train a competing detection model
• try to break into the server or get around its limits, disrupt the service, or overload it on purpose
• share your account or sign-in token with anyone
• use Verho to monitor employees or to assess their performance, emotions or productivity. Verho is built so that it does not even collect the data that would make this possible
• use the service for any unlawful purpose.

7.3 The extension's source code is readable in your browser and is not obfuscated. You may read and inspect it, for example to check what it sends. You may not copy, modify or redistribute it without our permission, except as far as the law allows.

8. Your text and your feedback

8.1 Your text is yours. We acquire no rights in it. We process the text in the input field and your word lists only for detection, in the server's memory, and forget them as soon as the answer has been returned. We do not store them in a database, in logs or in error reports.

8.2 We never train or improve models with our customers' text. Our detection model is trained on invented and openly licensed material.

8.3 Feedback. You can send feedback from the extension. If you wish, you can attach the conversation's protected prompt and answer as they were sent and came back, with placeholders and without the restored original values. You see the attachment in full and can edit it before sending. The attachment is deleted after 90 days; the rest of the feedback is kept for 24 months.

• You are responsible for what you attach. Do not attach your clients' or other people's data. Verho checks feedback before it is sent and tells you if it finds personal data.
• We read the attachment only to find out what went wrong. We never use it, as it is or rewritten, for training or testing.
• If we notice personal data in an attachment that was left unprotected, we delete it.
• We may use the ideas in your feedback to develop the service without compensation.

8.4 The service's own statistics. We may use the service's own usage totals and technical metrics, such as daily totals of active devices, response times and error rates, to operate and develop the service. They contain no text and identify no one. We do not use your firm's counters for our own purposes.

9. Prices and payment

9.1 Launch period. Verho is free during the launch period. At least 30 days before the free period ends we will tell you, by email and on the account page, what the service will then cost and what happens if you do not order. Free use never becomes paid without you ordering it yourself.

9.2 Paid plans. Current prices and what each plan includes are on our website. Prices are shown without VAT for businesses and including VAT for consumers.

9.3 Payment. Orders are paid on our website in advance for a month or a year at a time. Payment is handled by Revolut, and your card details are not stored by us. A subscription renews automatically for a new period until the admin cancels it. A firm can ask for an invoice to pay by bank transfer.

9.4 Seats. A team's price depends on the number of seats paid for. Before a change, the account page shows what adding or removing seats in the middle of a period will cost.

9.5 Cancelling. The admin can cancel the subscription at any time on the account page. Cancellation takes effect at the end of the current billing period, and the service works until then. Payments for unused time are not refunded, except in the situations in sections 9.6, 10.3, 10.5, 11.3, 14.2 and 15.1 or where the law requires it.

9.6 Consumer right of withdrawal. If you are a consumer and order a paid plan, you may withdraw within 14 days of the order by telling us, for example by email to aarne@tekoalytehdas.fi. If you asked for the service to start straight away, you pay a proportionate amount for the time used before withdrawal.

9.7 Price changes. We announce a price change at least 30 days in advance. The change applies from the next billing period. If you do not accept it, you can cancel before it takes effect.

9.8 Late payment. Late payments bear interest under the Finnish Interest Act. If a payment is more than 7 days late after a reminder, we may suspend the paid plan's features until it is paid.

10. Availability and changes to the service

10.1 We aim to keep Verho running at all times, but during the launch period we do not promise a particular level of availability. We carry out maintenance, and there may be interruptions.

10.2 The extension is designed always to show honestly whether protection is on. If detection is unavailable, the extension offers no protection and does not suggest that it is running.

10.3 We develop Verho continuously and may add, change or remove features. If a change materially reduces what a paid plan includes, we will announce it at least 30 days in advance, and you may cancel with effect before the change. Consumers receive a refund for the prepaid unused period.

10.4 We may offer features marked as experimental. They may change or be removed without notice.

10.5 If we discontinue Verho altogether, we will announce it at least 60 days in advance and refund the prepaid unused part.

11. Rights in Verho

11.1 Verho's software, our changes to the detection model, the website, the name and the marks belong to us or our licensors. While the agreement is in force you receive a non-exclusive, non-transferable right to use Verho in line with these terms.

11.2 Verho contains open-source components under their own licences. We send the list, with the licences, on request.

11.3 If someone claims that Verho infringes their intellectual property rights, we may change the service so that it no longer infringes, obtain the right to keep using it, or end the agreement and refund the prepaid unused part. These are our only obligations in respect of such a claim, unless mandatory law provides otherwise.

12. Liability

12.1 What we promise. We provide Verho with care and professional skill and fix faults within a reasonable time. Otherwise Verho is provided as it is. We do not promise that it finds every value, works without interruption, or suits your particular purpose.

12.2 If a paid service has a fault, we fix it within a reasonable time. If we do not, a business customer may cancel the subscription with immediate effect. Correction and cancellation are a business customer's only remedies for a fault. Consumers also have their rights under the Finnish Consumer Protection Act.

12.3 What we are not responsible for. We are not responsible for:

• data Verho did not detect, when you were able to check the highlights before sending
• what you send to an AI service, and what the AI service does with the text
• the content of the AI service's answers
• the AI service's decisions, such as restricting your account (section 6.3)
• interruptions caused by changes to the AI services (section 6.5)
• loss or corruption of data
• penalties or other sanctions imposed on you or your firm by an authority
• indirect losses, such as loss of profit, business interruption or third-party claims.

12.4 Maximum amount. Our total liability to your firm for all claims together, under these terms and the data processing agreement, is limited to the fees your firm paid us for the three (3) months before the event that caused the damage. For free use we are not liable, as far as the law allows.

12.5 The limits do not apply to damage caused intentionally or by gross negligence, to personal injury, to liability that mandatory law does not allow to be limited (such as product liability), or to a consumer's mandatory rights. Liability for processing personal data is agreed with your firm in the data processing agreement.

12.6 A business customer's claim for damages must be made to us in writing within six (6) months of the event that caused the damage, or the right to compensation is lost. Statutory time limits apply to consumers.

13. Force majeure

Neither party is liable for delay or damage caused by an obstacle beyond its control that it could not reasonably have taken into account or overcome. Examples are a widespread telecommunications or power failure, a serious failure at a data centre, a widespread cyberattack, an order by an authority, or a natural disaster.

14. End of the agreement

14.1 You may stop at any time: remove the extension and delete your account on your account page. A team's admin can delete the team only once the subscription has been cancelled.

14.2 We may end free use with 30 days' notice, and a paid subscription at the end of a billing period with at least 30 days' notice. If we end a paid subscription for a reason other than those in section 14.3, we refund the prepaid unused part.

14.3 We may suspend use immediately or end the agreement if you materially breach these terms and do not put it right within a reasonable time of our notice, if your use endangers the service or other users' security, or if the law or an authority requires it. We tell you the reason unless the law prevents it.

14.4 When the agreement ends, we delete your account data as described in the privacy notice. A firm's counters are deleted with the firm. The extension has stored settings and placeholder mappings in your browser; the privacy notice explains how to remove them. Payment records that form part of our accounts are kept for the period the Finnish Accounting Act requires.

14.5 Sections that by their nature are meant to survive, such as 8, 12 and 16, survive the end of the agreement.

15. Changes to these terms

15.1 We may change these terms. We announce material changes by email and on the account page at least 30 days before they take effect. If you keep using the service after a change takes effect, you accept the changed terms. If you do not accept them, you may stop using the service and cancel with effect before the change. Consumers receive a refund for the prepaid unused part.

15.2 We may make a change that does not weaken your position, or that the law or an authority requires, with immediate effect. We store which version of the terms your firm accepted, and when.

15.3 We will never change these terms so as to start using data you have already given us for a new purpose retroactively.

16. Other terms

16.1 Assignment. We may transfer the agreement to a company to which the Verho business is transferred, by telling you. You may not transfer the agreement without our consent, except to a new owner in a corporate restructuring.

16.2 Governing law. The agreement is governed by Finnish law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

16.3 Disputes. We will first try to settle any disagreement by negotiation. Disputes with business customers are decided by the Helsinki District Court. As a consumer you may take the matter to the Finnish Consumer Disputes Board (kuluttajariita.fi) or bring an action in the district court of your place of residence, and the mandatory consumer protection law of your country of residence applies to you.

16.4 Notices. We send notices to your account's email address or show them on the account page. You can send notices to aarne@tekoalytehdas.fi, or by post to the address in section 17.

16.5 Language. These terms are in Finnish and English. If the versions differ, the Finnish version prevails.

16.6 If any term is found invalid, the other terms remain in force.

17. Contact

Tekoälytehdas Oy · Business ID 3600364-1 · Liisankatu 7, 00170 Helsinki, Finland · aarne@tekoalytehdas.fi