CREATO AI AI and Integration Special Terms

Document version: 2.0 — Date of preparation: September 30, 2026. This schedule is an addendum to the SaaS Agreement for Customers activating artificial intelligence and integration capabilities.

1 Available capabilities and instructions

Depending on the purchased tier, AI response generation, conversational summarization, multi-language translation, knowledge base retrieval, customer contextualization, store and campaign analytics, Copilot suggestions, and automated workflows may be enabled. Available scopes are defined in the Order Summary and account dashboard. Artificial intelligence is an algorithmic software tool and does not act as an employee, legal counsel, or certified fiduciary adviser to the business.

Customer determines knowledge base resources, accessible datasets, response boundaries, authorized operational tasks, and mandatory human review gates. Activating an agent or automation serves as a documented processing instruction strictly limited to the enabled scope. Where a configuration mandates human approval for critical actions, general platform usage does not substitute for that explicit approval.

2 Store integrations and analytics authorization

When Customer connects an e-commerce store after reviewing the data categories and analytical scopes displayed on the connection screen, Customer grants a documented service instruction authorizing CREATO AI to synchronize product, order, customer, cart, fulfillment, and sales metrics, correlate them with relevant contact profiles, and run analytical assessments within enabled features. Authorization is limited to operations, customer support, business intelligence, audience segmentation, and relevant AI analysis.

This instruction represents Customer's warranty that it possesses lawful administrative authority over the connected store. It does not imply that blanket consent has been granted on behalf of store End Users, nor that data may be repurposed arbitrarily, nor that Customer is relieved of statutory privacy notice obligations. Lawful processing grounds and necessary consents must be established by the Customer; CREATO AI maintains its statutory processing duties.

Connecting a store does not authorize sending unprompted marketing broadcasts, canceling orders, altering catalog pricing, charging payment methods, or modifying advertising budgets. Where write or transactional capabilities are provided, permissions, action types, and consequences are displayed and confirmed separately. Customer may disconnect stores at any time; disconnection halts further synchronization. Historical synchronized data is managed under deletion requests and contract termination rules.

3 AI model providers and data minimization

AI features may be powered by external large language model providers operating infrastructure abroad. CREATO AI applies data minimization to incoming prompts, stripping or masking unnecessary direct personal identifiers. The model provider, functional purpose, data categories, hosting country, and data retention windows are documented in the Subprocessors and Service Providers notice and integration prompts.

True anonymization requires that an individual cannot be re-identified through reasonable means, including correlation with external datasets. Merely removing a name, hashing a phone number, substituting a pseudonym, or redacting isolated phrases does not constitute statutory anonymization. Where contextual parameters, order numbers, or free-form text allow identification, data remains personal data. Processing source personal data to create anonymized records requires a lawful legal basis.

In current anonymous LLM workflows, only genuinely anonymized statistical aggregations or operational inputs are routed to foreign AI providers for specified service goals. Unanonymized personal data is not routed through this workflow; if anonymization cannot be completed, the operation is halted. If dedicated AI features operating on personal data are introduced, data scopes, purposes, providers, countries, and retention rules must be separately disclosed and enabled, with valid international transfer mechanisms under applicable laws (e.g., Article 9 of KVKK / GDPR Chapter V) established in advance. Accepting this agreement or connecting a store does not grant automatic consent for new scopes. Baseline AWS hosting and other personal data transfer requirements remain in effect.

4 Model training and purpose limitation

Customer conversations, subscriber lists, order records, and Google API user data are never used to train general-purpose foundation AI models or build multi-tenant training corpora for other customers. Appropriate commercial contractual terms and enterprise API configurations are applied to prevent providers from ingesting customer content into model weights. Transient runtime processing for inference differs fundamentally from permanent weight retraining.

Knowledge base materials uploaded by Customer are indexed strictly to provide retrieval-augmented context within Customer's own account. Indexing does not constitute permission for foundation model training or transfer of IP. If bespoke model fine-tuning or persistent personalization is introduced, objectives, data subsets, retention periods, and legal terms will be negotiated separately; practices prohibited by upstream channel policies cannot be legalized through customer agreement.

De-identified aggregate usage telemetry may be evaluated to optimize system uptime, error rates, and security baselines. Re-identification or cross-customer data pooling is strictly prohibited. Anonymized derivatives of Google user data remain subject to applicable Google Limited Use restrictions.

5 Output evaluation human oversight and errors

Model outputs and recommendations may contain errors, omissions, unintended biases, or outdated facts. Customer is responsible for reviewing published copy, outbound promotional campaigns, price quotes, legal disclaimers, and high-stakes operational choices. AI outputs must not serve as the sole determinant for employment decisions, credit assessments, medical advice, or critical legal outcomes.

Conversational agents interacting with End Users must provide a transparent path to human support. End Users must be clearly informed that they are interacting with an automated or AI-powered assistant; systems must not deceptively impersonate real humans. Customer configures handoff routes and notices; CREATO AI implements designated UI cues and escalation routing. Customer must maintain accurate and updated knowledge sources; CREATO AI is responsible for technically enforcing configured permission gates and human-in-the-loop workflows. Provider cannot disclaim technical liability for software bugs solely by invoking the probabilistic nature of AI.

IP rights in generated outputs are subject to source content inputs, provider API terms, and applicable copyright law. Uniqueness, copyrightability, and non-infringement of outputs are not guaranteed. Customer remains responsible for ensuring that prompted assets and published outputs respect third-party rights.

6 Meta integrations

Meta integrations enable ingestion of messages, template statuses, campaign metrics, and authorized lead ad submissions within the approved account scope. Receiving a new lead form does not automatically grant blanket marketing permissions across unrelated channels. Workflows adjusting ad budgets or altering campaigns require distinct administrative authorizations.

AI usage via WhatsApp is restricted to permitted business customer service and conversational support. General-purpose open-ended AI dissemination or prohibited use cases restricted by Meta are not authorized under this agreement. Current Meta platform terms and regional policies apply.

7 Google user data

CREATO AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including applicable Limited Use requirements. Where Google Workspace connections are utilized, the Workspace API User Data and Developer Policy also applies.

Only OAuth scopes strictly necessary for active, user-facing capabilities are requested. Prior to authorization, accessible data categories, usage, retention, sharing, and potential actions performed on the user's behalf are presented. Expanding data uses or requesting broader scopes requires updated notices and explicit opt-in.

Google user data is never used for generalized advertising targeting, retargeting, selling to data brokers, or training, improving, or fine-tuning generalized AI/ML foundation models. Sharing and human inspection of data under Limited Use is restricted to purposes authorized by Google policies; human access occurs only upon explicit user consent for troubleshooting, security incident mitigation, or legal compliance.

Customer may revoke Google OAuth access at any time via Google Account security settings and request data deletion from CREATO AI. Revoking access stops synchronization; historical data is managed under standard retention and deletion policies. An OAuth grant does not permit accessing other customers' environments or unannounced AI routing.

8 Allocation of responsibilities and notices

Customer is responsible for source content legality, instructions, account authorizations, and the lawful basis of Customer Data. CREATO AI is responsible for technical execution in accordance with instructions, platform security, purpose limitation, and adherence to declared transfer safeguards. Fault, indemnification, and liability caps established in the main agreement apply.

Contact and notices: EMRE ALAY — CREATO AI, hello@creato.digital.