Subscription Agreement

Last updated: July 23, 2026. This Agreement supplements the Terms of Use, Privacy Policy, applicable plan page, checkout and any commercial proposal. Specific conditions formally accepted by the parties prevail over incompatible general conditions.

1. Parties

Provider: TIAGO BONFIM FERNANDES, CNPJ 20.979.792/0001-03, responsible for the Ecofyx platform and established in Pindamonhangaba, São Paulo, Brazil.

Customer: the individual or legal entity identified in the registration, checkout, proposal or subscription document.

2. Purpose

This Agreement grants a temporary, non-exclusive, limited and non-transferable license to use Ecofyx as a SaaS service to create and execute operations, templates, forms, records, evidence, indicators, alerts, workflows, history, results and exports within the limits of the contracted plan.

3. Formation, term and renewal

The subscription is formed through electronic acceptance, payment, plan activation or execution of a proposal. Its term follows the selected billing period. When automatic renewal is disclosed, renewal continues until cancellation, subject to payment-method rules and applicable law.

4. Price, billing, adjustments and taxes

Price, billing frequency, allowances, limits and payment method are those presented in the plan, checkout or proposal. Price adjustments will be communicated before they take effect and will comply with the subscription conditions and applicable law. Non-payment may result in collection attempts, notice, limitation, suspension or cancellation.

5. Provider obligations

• Provide the service and resources included in the contracted plan, subject to maintenance and external dependencies.
• Adopt technical and administrative measures appropriate to the nature of the data and service.
• Separate access between accounts and apply authentication and authorization controls.
• Provide digital support according to the plan and reasonable information about relevant incidents.
• Provide export and deletion resources available on the Platform, subject to technical and legal limitations.

6. Customer obligations

• Keep registration data and contacts current, protect credentials and administer team access.
• Configure and validate operations, templates, forms, indicators, rules, alerts and permissions.
• Have an appropriate legal basis, authorizations, notices and policies for collected data, photos, locations and files.
• Avoid excessive collection and apply additional controls when processing sensitive data or data relating to vulnerable people.
• Export and retain information essential to the Customer's continuity, audit or regulatory obligations.
• Not use the service for unlawful, invasive purposes or purposes incompatible with the Terms.

7. Data protection — roles and instructions

For account, security, billing and commercial-relationship data, the Provider may act as Controller. For Customer Content entered into operations, the Customer will generally act as Controller and the Provider as Processor, processing data according to the contracted features, these documents and lawful instructions recorded on the Platform.

The Customer must not issue instructions that violate applicable law. If the Provider identifies a manifestly unlawful or unsafe instruction, it may suspend that instruction and request corrective action.

8. Confidentiality and authorized persons

The parties will protect non-public data and information. Employees and service providers with access will be limited to what is necessary for their functions and will be subject to confidentiality duties. Exceptions include information that is public, legitimately received from a third party, independently developed or required to be disclosed by law.

9. Security, incidents and cooperation

The Provider will maintain controls appropriate to the service, including authentication, authorization, session protection, logical segregation, technical logs, backups and monitoring. In a relevant incident involving processing performed as Processor, the Provider will notify the Customer without undue delay after confirmation and provide available information for assessment and response. The Customer remains responsible for communications that fall under its role as Controller.

10. Subprocessors and transfers

The Provider may use subprocessors necessary for hosting, storage, backup, email, security, payment, maps, authorized analytics and support. Those providers should receive only the data necessary for the relevant service and be subject to compatible obligations. International transfers will follow mechanisms permitted by applicable law.

11. Data-subject rights and requests

When acting as Processor, the Provider will provide reasonable assistance to the Customer to locate, export, correct or delete data using available resources. Requests received directly may be referred to the Customer when the Customer is the Controller. Extraordinary requests requiring development or significant effort may be subject to a specific schedule and quotation, without prejudice to mandatory legal duties.

12. Data, export, backup and termination

The Customer retains rights in its content. Before termination, it should use the available export features. After deletion or termination, data may be deleted or anonymized except for records required for legal obligations, security, billing, fraud prevention and exercise of rights. Backup copies may remain until replaced through the normal technical cycle and will not be reused for other purposes.

13. Availability, maintenance and support

No SLA is guaranteed unless specifically agreed. Maintenance, updates, incidents and third-party dependencies may cause temporary unavailability. Whenever practical, planned maintenance with material impact will be communicated. Support and response expectations vary by plan or contracted conditions.

14. Artificial intelligence

AI-assisted resources provide suggestions that require human review. The Customer decides what to send to the selected AI provider, should avoid unnecessary data and is responsible for reviewing the output before publishing or using it. The Provider does not guarantee the legal, regulatory or technical suitability of AI-generated content.

15. Intellectual property

The Platform, brand, interfaces, code and materials remain the property of the Provider or its licensors. This Agreement does not transfer source code, trademarks or technology. The Customer retains its data and content.

16. Cancellation, withdrawal and refunds

Cancellation may be requested through the account or the stated contact channel. Access and billing after cancellation follow the applicable cycle and disclosed conditions. Consumer rights, including any applicable right of withdrawal for a distance purchase, will be respected when required. See the Cancellation and Refund Policy.

17. Liability

Each party is responsible for its acts and omissions according to applicable law. The Provider is not responsible for improper configuration, Customer Content, technical decisions made by the Customer, access granted by the Customer, device or connection failures, use outside the service's purpose or external services beyond the Provider's control. No limitation applies to willful misconduct, non-waivable legal duties or situations in which applicable law prohibits exclusion or limitation.

18. Changes, assignment and communications

Conditions may be updated to reflect legal or service developments. Material changes will be communicated. The Customer may not assign the subscription without authorization except as part of a corporate reorganization that does not prejudice performance. Communications may be delivered by email, dashboard or the stated channels.

19. Applicable law and jurisdiction

Brazilian law applies. Jurisdiction will be determined under applicable law, preserving the consumer's place of residence where required. Contact: contato@ecofyx.com.