OnFlow Customer Agreement (Cloud Service Agreement) — Cover Page / Key Terms

Based on: Common Paper CSA Standard Terms Version 2.1 (CC BY 4.0)

Last updated: 13 October 2026.

By creating an account, starting a trial, or paying for a subscription, Customer accepts these Key Terms and the Common Paper CSA Standard Terms Version 2.1 (the “Standard Terms”), which are incorporated by reference. Capitalized terms have the meanings in the Standard Terms or below. This Agreement does not by itself make Customer compliant with any law.

---

Parties

Field	Value
Provider	Aaptera Ltd (company number 16869753), a company registered in England and Wales, trading as OnFlow. Registered office: Aaptera Ltd, 7 Jossey Lane, Doncaster, England, DN5 9DB.
Provider notice address	Email: [email protected] (monitored notice address); website: https://onflowapp.com.
Customer	The company or individual that creates a tenant / account on the Product
Effective Date	Date Customer first accepts these terms (account creation, trial start, or paid checkout), as recorded by Provider

Product

Field	Value
Cloud Service	OnFlow: multi-tenant SaaS for custom record types, modules, workflows, automations/agents, plugins, reports/views, MCP (Model Context Protocol) access, and in-app AI tooling, as described in Documentation at https://app.onflowapp.com and the marketing sites.
Documentation	In-app help, Help Center / knowledge base, and any API/MCP docs Provider publishes
Use Limitations	Fair use and rate limits as published in Documentation; no High Risk Activities; Customer must not circumvent tenant isolation or access other tenants’ data
Customer Content	Includes all data, records, files, prompts, agent/MCP tool inputs and outputs, and configurations Customer or Users submit to or store in the Product. MCP write-back and agent actions that create, update, or delete records are Customer Content and Customer-directed Processing.
Machine Learning	Section 1.6 of the Standard Terms is replaced as follows. Provider does not use Customer Content (including prompts, tool inputs and outputs) to train or fine-tune any AI or machine-learning model, and does not permit its Subprocessors, including Google Vertex AI, to do so. Provider may use Usage Data that is aggregated and does not identify Customer, Users, or any individual to maintain and improve the Product. In-app generative AI (including Google Vertex AI / Gemini, processed in the Vertex global location) may be inaccurate and may be processed outside the United Kingdom and the European Union. Customer remains responsible for human oversight of agent and MCP actions. UK or EU processing of AI and embeddings is available on Enterprise plans by agreement.

Commercial terms (Order Form defaults for self-serve)

Field	Value
Subscription Period	Monthly or annual as selected at checkout
Pilot / trial period	30 day free trial from account creation (or as otherwise stated at signup), then converting to a paid Subscription Period if Customer adds a payment method and continues after the trial
Fees	As shown at checkout for the selected plan (Business Starter or successor plans). Currency: USD
Payment Process	Automatic payment via card / payment provider on file (e.g. Stripe)
Non-Renewal Notice Date	End of then-current Subscription Period (cancel in-app before renewal)
Technical Support	In-app / email support ([email protected]) as described in Documentation for the plan

Legal variables

Field	Value
Governing Law	Laws of England and Wales
Chosen Courts	Courts of England and Wales
General Cap Amount	Fees paid by Customer to Provider under the applicable Order Form in the 12 months before the claim
Increased Cap Amount	2× General Cap Amount
Increased Claims	Breach of confidentiality; Provider’s indemnification obligations for Provider Covered Claims
Unlimited Claims	Fraud; death or personal injury caused by negligence; other liability that cannot be limited under Applicable Laws
Provider Covered Claims	Third-party claims that the Cloud Service infringes IP rights (subject to Standard Terms exclusions)
Customer Covered Claims	Third-party claims arising from Customer Content, Customer’s use of MCP/agents, or Customer’s breach of the Agreement
Additional Warranties	None beyond the Standard Terms. Provider does not currently hold third-party certifications (for example SOC 2 or ISO 27001). This Agreement does not by itself make Customer compliant with the UK GDPR, the EU GDPR, or any other law.
DPA	The OnFlow Data Processing Agreement (separate cover page) applies whenever Customer Personal Data is Processed. Entering this Agreement includes acceptance of the DPA when Personal Data is submitted.
Logo Rights	Provider may identify Customer as a customer unless Customer opts out in writing to [email protected]
Prohibited Data	As defined in Standard Terms unless Order Form expressly authorizes

Hosts in scope

This Agreement covers use of the Product accessed via app.onflowapp.com, onflowapp.com, and any successor domains Provider designates for the same Product.

Attribution

Portions of this Agreement incorporate Common Paper CSA Standard Terms v2.1 under CC BY 4.0. Modifications are limited to this Cover Page / Key Terms and OnFlow-specific Product descriptions.