CREATO AI Terms of Service and SaaS Agreement

Document version: 2.0 — Date of preparation: September 30, 2026. This version enters into force for the relevant customer on the date it is presented and accepted electronically.

1 Parties and scope

This agreement is entered into between EMRE ALAY, providing services under the brand name CREATO AI (“CREATO AI” or “Provider”), and the natural person or legal entity acquiring the service on their own behalf or on behalf of the business they are authorized to represent (“Customer”). CREATO AI is not an independent legal entity, but the commercial trade brand of the Provider.

Provider contact details: Şemikler Mah. 6250 Sk. No:5 D:3 Karşıyaka/İzmir, Türkiye; tax identification number 0480374439; email hello@creato.digital. Customer trade name, address, and authorized representative are specified in the order or account registration.

The Service is a cloud-based software provided for customer communication and marketing operations of businesses. In transactions concluded for commercial or professional purposes, the business-to-business (B2B) provisions of this agreement apply. Mandatory statutory rights of customers acting in the capacity of a consumer according to the genuine nature of the transaction are reserved; selecting a business account does not by itself eliminate consumer status.

2 Definitions and contractual documents

“Service” refers to the AI chat agents, customer messaging center, WhatsApp marketing, automation, CRM, store analytics, and connected capabilities activated under the purchased plan. “Authorized User” refers to an employee or representative granted access by the Customer. “Customer Data” refers to content, conversations, contacts, products, orders, campaigns, and similar data ingested or connected from Customer sources. “End User” refers to any individual communicating with the Customer. “Order Summary” is the record detailing the selected tier, billing cycle, price, applicable taxes, quotas, overage terms, renewals, and trial conditions, displayed prior to transaction completion and transmitted in reproducible format thereafter.

WhatsApp Marketing Special Terms, AI and Integration Special Terms, Data Processing Agreement, Acceptable Use Policy, and Subscription Cancellation and Refund Policy constitute contractual schedules for their respective service modules. Privacy Policy, KVKK Information Notice, and Cookie Policy are informational notices; their presentation does not constitute explicit consent.

Mandatory statutory law prevails. Regarding personal data processing matters, the Data Processing Agreement applies; regarding specialized modules, their respective special terms apply; regarding commercial scope, the expressly accepted Order Summary or individually executed written agreements govern. Specific order terms cannot diminish data subject rights or mandatory data security obligations. Revisions to general terms do not unilaterally alter the expressly agreed scope of an existing order.

3 Contract formation and representation

This agreement is formed when the Customer electronically accepts these documents after they have been made accessible and downloadable, and completes the account creation or checkout process. Merely visiting the website does not create a paid subscription, marketing permission, or explicit consent for personal data processing.

The individual acting on behalf of a business represents and warrants that they possess the legal power to bind the business and connect the relevant e-commerce store, advertising, Google, or messaging accounts. The Provider may request verification documents where appropriate. The accepted version, timestamp, account details, transaction records, and necessary technical logs are preserved for evidentiary purposes. The probative value of electronic records remains subject to procedural law; Provider logs do not constitute exclusive or absolute evidence.

4 Scope of service and license grant

During the subscription term, Customer is granted a non-exclusive, non-transferable right to access and use the Service limited to the selected plan and user seats. Customer acquires no ownership rights or source code access. Customer may serve its own clientele using platform capabilities; independent white-labeling, resale, or sublicensing to third-party businesses requires explicit written authorization.

Tiers may contain quantifiable limits across messages, AI compute, team seats, contacts, channels, connected stores, workflows, or storage. The method of calculation and whether exceeding quotas causes suspensions or overage fees is disclosed before purchase. Unannounced overage charges or silent unlimited tiers are never applied. Pilot or beta features are subject to change; essential availability of paid core services cannot be negated via broad beta disclaimers.

Roadmap features, marketing previews, or forward-looking statements do not constitute service delivery commitments unless explicitly incorporated into an Order Summary. Access permissions are never requested for unreleased integrations.

5 Seven-day free trial

The trial period lasts seven calendar days from the activation timestamp stated in the account dashboard. Commencement and expiry times are clearly displayed. Capabilities, quotas, seats, and integrations enabled during the trial may differ by selected tier; trials do not include unlimited access or every advanced enterprise tier feature.

The trial is free of charge regarding platform subscription access. If live WhatsApp messaging or third-party usage entails additional carrier costs, such fees, calculation methods, and payment obligations must be clearly disclosed and accepted by the Customer prior to sending. No paid dispatches are initiated without explicit acceptance.

Trial expiration does not automatically trigger a paid subscription or recurring billing authorization. Continued paid access and recurring charges require distinct positive opt-in confirming tier, total fee, first billing date, renewal cadence, and cancellation terms. If not converted, trial accounts may be suspended; data export and deletion follow Section 14. Abusive duplicate trials may be prevented; validly running trials are not arbitrarily truncated.

6 Fees payment and renewals

Tier pricing, billing cycle, currency, VAT, and applicable taxes are detailed in the Order Summary. Promotional pricing aimed at businesses may exclude VAT; the final payable amount is clearly stated prior to checkout. Consumer transactions always display all-inclusive prices in accordance with applicable consumer legislation. For annual plans displaying monthly equivalent rates, the total annual commitment is clearly itemized.

Payments are securely processed via iyzico. Payment card storage and recurring card debits are subject to the authorized scope established with the payment gateway and the Customer's consent. Using a card for an initial transaction does not grant permission to bill arbitrary future charges. Invoices and transaction receipts are sent to the Customer.

B2B subscriptions renew at the end of the term only if disclosed and agreed in the Order Summary. Subscriptions cancelled before a new term do not incur renewal fees. Mandatory statutory regulations govern extensions and terminations of fixed-term consumer contracts.

Price changes do not apply retroactively to an active paid term. Revisions for subsequent cycles are notified at least thirty days in advance via registered communication channels. Customer may cancel recurring renewal prior to the new cycle. Where re-consent is legally required, new amounts are not charged without consent. Quota expansions and upgrades require separate confirmation; effective dates for downgrades are shown in the control interface. Third-party provider rates are governed by Section 8 and WhatsApp special terms.

7 Account security and customer obligations

Customer agrees to provide accurate billing and identity details, restrict credentials to authorized personnel, maintain role-based access, safeguard authentication tokens, and promptly revoke access upon employee departure. Customer remains responsible for activities under its authorized credentials. Unauthorized actions directly arising from Provider security vulnerabilities are not attributed to Customer under this clause.

Customer must hold all required authorizations, legal bases, and intellectual property rights for data and content uploaded or connected to the platform. Customer is solely responsible for presenting statutory privacy notices, obtaining commercial electronic message consents, and honoring opt-outs for its End Users. Connecting a store or obtaining template approvals does not fulfill these statutory duties on Customer's behalf.

Customer must review campaign messaging, targeted audiences, dispatch timing, automated rules, AI knowledge bases, and approval thresholds. Customer ensures the accuracy of representations made regarding products, pricing, stock, fulfillment, and refunds. Decisions carrying legal, sensitive, or high-risk implications require human oversight. Platform misuse for unlawful purposes is strictly prohibited.

8 Integrations and third-party services

Depending on enabled features, AWS hosting, iyzico payment processing, Meta/WhatsApp, Google, e-commerce engines, and AI model providers may be utilized. Active providers and data flows are documented in the Subprocessors and Service Providers notice and integration screens. Not all integrations are activated for every account.

Customer warrants that it owns or is an authorized admin of connected accounts, uses provider permissions lawfully, and reviews access scopes. Provider requests only permissions strictly necessary for service delivery. Granting Meta or Google permissions does not authorize Provider to act outside necessary functional scopes.

Channel verifications, template reviews, API tokens, provider quotas, policy changes, and carrier maintenance may affect availability. Provider is not liable for disruptions beyond its reasonable control provided it is free of fault; however, responsibilities regarding diligent supplier selection, proprietary integration codebase maintenance, risk notifications, and reasonable troubleshooting remain in effect. Third-party provider incidents do not constitute blanket force majeure or automatic waivers of liability.

CREATO AI is not a contractual party to Customer e-commerce sales, ad spend investments, or End User transactions. Provider is responsible solely for providing its software platform according to agreed specifications.

9 Artificial intelligence and output usage

AI responses are generated probabilistically; they may occasionally contain inaccuracies, incomplete details, or outdated information. Provider does not warrant specific sales volume, conversion rates, ad return, or universally infallible output. Customer defines assistant knowledge parameters and decides which operational tasks necessitate human sign-off.

Disclosing inherent AI operational risks does not shield Provider from liability arising from faulty software configuration, unauthorized data usage, gross technical negligence, or failure to apply mutually agreed security baselines. AI data governance, anonymization, model training prohibitions, and human oversight are governed by the AI and Integration Special Terms.

10 Provider obligations and service quality

Provider agrees to maintain the Service in accordance with agreed specifications, assess reported issues within a reasonable timeframe, implement technical and organizational security measures commensurate with risks, process Customer Data strictly per instructions and applicable laws, apply unauthorized access safeguards, and remediate errors within its direct technical domain.

Support requests may be submitted to hello@creato.digital. Unless formally agreed in a custom enterprise SLA, guaranteed uptime percentages, round-the-clock live chat, or fixed recovery windows are not warranted. Scheduled maintenance is announced in advance where feasible; urgent security patching may occur immediately. The general duty to perform services with reasonable care and skill remains binding.

11 Data privacy and intellectual property

All proprietary rights in and to Customer Data remain with Customer or its licensors. Customer grants Provider only the hosting, processing, routing, and backup permissions necessary to deliver the Service. This license does not permit selling data, transferring subscriber lists between accounts, or general AI model training. Asserting proprietary claims over data does not diminish statutory rights of data subjects.

Software, brand assets, interface designs, and documentation belong exclusively to the Provider or its licensors. Except where permitted by mandatory law, decompiling, reverse engineering, unauthorized extraction, or exceeding licensed seats is prohibited. Unsolicited feedback or suggestions may be used for feature improvements without disclosing Customer confidential trade secrets. Customer logos or testimonials will not be published without prior consent.

Each party shall hold confidential information received from the other in strict confidence, using it solely for contractual execution, and disclosing it only to authorized personnel bound by confidentiality covenants. Information already public, legitimately known prior to disclosure, or independently developed is excluded. If disclosure is compelled by legal process, reasonable advance notice is given where legally permissible. Confidentiality commitments persist for three years following contract termination, and indefinitely for trade secrets and personal data.

12 Suspension and remediation

Provider may suspend specific features in the event of overdue invoices, grave abuse, revoked credentials, data security incidents, legal injunctions, or carrier restrictions. Absent imminent severe harm, Customer is notified of reasons and afforded at least seven calendar days to cure the defect. Immediate security suspensions are explained without undue delay.

Suspensions must be proportionate; access is reassessed once risks are remediated. Erroneous suspensions caused by Provider fault will not incur unjustified reconnection fees or forfeit refund rights. Restrictions target only offending datasets or workflows unless broader suspension is legally mandated. Statutory data access requests are not hindered by billing disputes.

13 Termination and refunds

Customer may disable subscription renewal directly from the dashboard or by sending written notice to hello@creato.digital. Notices received prior to a renewal cycle take effect without imposing supplementary grace cutoff windows. For B2B accounts, ordinary cancellation terminates access at the end of the paid billing period; pro-rata refunds are not issued for unused days. Faulty service delivery, material breach by Provider, impossibility of performance, or statutory consumer cancellation rights remain excepted.

If a material curable breach is not remedied within seven days of written notice, the non-breaching party may terminate the agreement. Where violations or severe risks cannot be cured, immediate termination is permitted. Unjustified early termination by Provider triggers a pro-rata refund for the remaining paid period. Other statutory remedies for non-performance remain unaffected.

Consumer cancellation, withdrawal, and refund entitlements are administered in accordance with the Subscription Cancellation and Refund Policy and statutory consumer legislation.

14 Post-termination data handover and deletion

Upon termination, automated AI tasks, outbound campaigns, and store syncs cease. Within thirty calendar days of termination, Customer may request an export of stored records in a standard, machine-readable format without supplementary export fees. Bespoke data transformation consulting requires a separate written agreement.

Customer Data not subject to statutory retention mandates is purged from active databases upon conclusion of the thirty-day export window. Earlier deletion requests will be honored unless legal retention grounds apply. Restricted access backups are overwritten within their ordinary retention cycle, not exceeding ninety days from termination, during which they cannot be accessed for operational use. Upon restoration from backup, the deletion instruction is re-applied.

Billing, tax, contract, and litigation records are archived under restricted access per statutory retention schedules. Routine customer chat logs cannot be retained indefinitely under the guise of financial record-keeping. The Data Processing Agreement sets forth detailed data deletion terms.

15 Limitation of liability and indemnification

Each party is liable for its own breaches and proportionate fault. Customer is solely responsible for failing to secure subscriber consent, uploading illicit contact lists, sending misleading marketing materials, or deploying unreviewed automated actions. Provider is responsible for maintaining platform security, compliant processing, proprietary code integrity, and performance per specifications.

In B2B transactions, total contractual liability for ordinary negligence that may be lawfully capped is limited to the greater of the SaaS subscription fees paid by Customer in the preceding twelve months or the list price of one month of the relevant tier. For free trials, one month's list price serves as the cap. For ordinary negligent breaches of personal data security or confidentiality, a cap of twice that amount applies. Incurred third-party carrier charges are excluded.

These caps do not apply to intent, gross negligence, mandatory statutory liability, personal injury, consumer statutory rights, or non-waivable violations of law. Validated refunds and statutory data obligations cannot be extinguished via liability limits. Caps do not bind supervisory authorities or third-party data subjects.

To the extent permitted by law in B2B contexts, neither party is liable for indirect or consequential damages, or lost business profits. Direct remediation of defective service, data handover, and mandatory legal remedies are not excluded.

In third-party claims brought against Provider due to Customer's culpable breach, Customer shall indemnify Provider for proven damages and reasonable legal defense expenses directly caused by such breach. Provider shall give prompt notice of claims, allow participation in defense, and refrain from unilateral settlements without Customer approval. Costs resulting from Provider's own fault are excluded. Administrative penalties cannot be shifted by contract where statutory rules forbid it.

16 Force majeure and amendments

Where unforeseeable and unavoidable events beyond reasonable control prevent performance, the affected party shall notify the other, mitigate damages, and suspend performance only for the duration of the obstacle. Routine software defects or unmanaged server capacity issues do not constitute force majeure. If essential service is disrupted for thirty consecutive days, Customer may terminate the affected service and receive a refund for the unperformed period.

Contractual modifications adversely affecting existing customers are announced at least thirty days in advance and do not retroactively curtail paid rights. Where immediate legal or security compliance necessitates shorter notice, reasons are provided. Processing personal data for new purposes requires updated notices and valid consent prior to commencement. Publishing notices on a website does not substitute for legally required active opt-in.

17 Governing law and dispute resolution

Turkish law governs this agreement. If both parties are merchants or public legal entities and a valid choice of forum clause can be agreed under applicable law, courts and execution offices of Izmir, Türkiye have exclusive jurisdiction. Otherwise, statutory jurisdictional rules apply. Consumer rights to apply to Consumer Arbitration Committees and Consumer Courts remain fully reserved; monetary thresholds are determined by legislation in effect on the application date.

Account notices are delivered via registered email or dashboard notifications. Statutory formal notice requirements remain binding where applicable. If any provision is deemed unenforceable, remaining terms remain in effect to the fullest extent permitted by law. Continued contract validity does not imply ongoing marketing consent or personal data processing permission.

CREATO AI WhatsApp Marketing Special Terms

Document version: 2.0 — Date of preparation: September 30, 2026. This schedule is an addendum to the Terms of Service and SaaS Agreement for Customers activating WhatsApp capabilities.

1 Service and account authority

CREATO AI provides messaging, template management, automated broadcasts, conversational workflows, and campaign analytics connected to the Customer's account via the WhatsApp Business Platform. Customer warrants that it is the legal owner or authorized representative of the business identity, phone number, and WhatsApp Business Account utilized. Misleading business profiles, unauthorized use of third-party trademarks, or unverified phone numbers are strictly prohibited.

Meta/WhatsApp exercises independent discretion over account verification, channel access, template approvals, and quality rating enforcement. CREATO AI does not warrant, as an agent of Meta, that all verification requests will be granted or account restrictions lifted. Liability arising from Provider's own integration or configuration defects remains reserved.

2 Recipient consent and legal basis

Prior to campaign launch, Customer must establish, verify, and retain auditable records of recipient opt-ins, commercial electronic message approvals, WhatsApp messaging permissions, and statutory data processing grounds. Purchased, scraped, or unverified contact databases may not be used under any circumstances. Holding an individual's phone number, receiving an order, having a form submitted, or handling a single customer inquiry does not constitute blanket consent for future marketing broadcasts.

Personal data protection notices (e.g., KVKK/GDPR), explicit consents, commercial electronic messaging approvals (e.g., IYS under Turkish Law No. 6563), and WhatsApp channel opt-ins represent distinct legal requirements. Satisfying one does not automatically fulfill the others. Where applicable, Customer must ensure registration with message management registries, timely synchronization of opt-ins and opt-outs, and lawful retention of consent records. CREATO AI providing messaging tools does not constitute authorized registry integration or an assurance of automatic statutory compliance.

If relying on statutory consent exceptions (e.g., existing commercial relationships or B2B communications), Customer must verify that the content meets strict criteria. Embedding promotional pitches into transactional updates transforms the message into a marketing communication. Exceptions applicable to merchants do not eliminate recipient opt-out rights or WhatsApp's proprietary messaging policies.

3 Campaign content and dispatch instructions

Customer is responsible for verifying audience segments, message copy, variable dynamic fields, links, pricing, product availability, schedule parameters, and retry rules. Triggering a campaign or activating a workflow constitutes a documented dispatch instruction. CREATO AI will not append unauthorized audiences or utilize message content for unrelated purposes.

Meta's approval of a message template is solely a technical channel determination. It does not certify legal compliance, verify recipient permissions, or substantiate marketing claims. Customer remains liable for commercial offers, inventory, fulfillment, and sales to End Users. CREATO AI is responsible for executing dispatches in accordance with documented instructions.

4 Templates and channel compliance

All messaging must comply with the current WhatsApp Business Messaging Policy and technical guidelines. Business-initiated messages and responses outside the customer service window must utilize approved templates under the correct Meta category. Service windows, broadcast tiers, and billing models are separate concepts; access to a channel tier does not imply free or unlimited usage.

Meta may re-categorize, delay, reject, or deprecate templates, and enforce quality ratings, country limits, or recipient throttling. Prevailing rates and technical parameters govern. Fixed delivery ratios, permanent quotas, verification checkmarks, or unlimited bandwidth are not guaranteed.

Automated conversational agents must provide a clear, accessible path for End Users to connect with human support. Customer configures human handoff rules; CREATO AI delivers the routing features as specified. The use of automated or AI assistants must be disclosed transparently to End Users in compliance with the AI and Integration Special Terms.

5 Opt-out mechanisms and blocking re-sends

Every marketing communication must provide a simple, free-of-charge, and accessible opt-out mechanism directly within the messaging channel. Clear opt-out requests received via WhatsApp or other channels must be honored promptly. Subject to statutory limits, new marketing messages must cease without delay; under Turkish commercial electronic messaging rules, dispatches must terminate within three business days of receiving the refusal.

Opt-out records must not be bypassed by uploading new lists, re-segmenting audiences, switching templates, clearing queues, or resuming automated journeys. CREATO AI enforces automatic suppression for contacts recorded as opted-out in its systems; Customer must immediately sync opt-outs received through external channels. A request to opt out of all channels cannot be narrowed to a single channel without consent.

Following an opt-out, only strictly necessary transactional messages permitted by law and platform rules may be delivered; promotional content cannot be embedded into transactional alerts. CREATO AI remains independently responsible for consent and opt-out processing regarding its own direct brand communications.

6 Queuing quotas and analytics

Subject to plan limits and channel restrictions, campaigns may be queued, throttled, or executed in stages. Consent status is re-evaluated during queue processing. Pausing a campaign halts unsent messages; messages already accepted by the carrier network cannot be recalled.

Send, accept, delivery, read, and click statuses represent distinct lifecycle events. Analytics reflect statuses reported by upstream providers and may be affected by delivery delays, device settings, or recipient privacy choices. Delivery logs cannot substitute for legal proof of opt-in.

7 Third-party carrier fees

Platform subscription fees and Meta/WhatsApp conversation fees are distinct; bundled inclusions are explicitly detailed in the Order Summary. Regional rates, template categories, message volumes, and currency fluctuations affect carrier pricing. No paid messaging campaigns are executed without prior acceptance of pricing terms, calculation methods, and estimated costs.

Unsuccessful message deliveries are not uniformly billed or waived; upstream carrier billing rules and verified gateway records govern. Third-party fees not levied by upstream providers will not be collected from Customer. Provider remains obligated to correct erroneous or duplicated charges resulting from software bugs. Free trial accounts are subject to the same carrier cost terms agreed prior to dispatch.

8 Prohibited activities and protective measures

Spam, impersonation, fraudulent campaigns, phishing, harassment, illegal products, counterfeit goods, IP infringement, and circumventing platform rate limits are strictly prohibited. Regulated goods or services may only be marketed where explicitly authorized by governing laws and Meta policies. Requesting full payment card numbers, sensitive authentication credentials, or unnecessary special category personal data via messaging is prohibited.

CREATO AI may pause campaigns presenting imminent legal or operational risks, demand proof of recipient consent, and suspend offending features. Interventions are strictly proportionate to the risk; justifications are communicated where legally permissible. Bypassing account restrictions via alias identities or secondary phone numbers is prohibited.

9 Allocation of liability

Customer is responsible for recipient consents, uploaded lists, commercial offers, claims accuracy, and campaign dispatch instructions. CREATO AI is responsible for technical dispatch execution, local opt-out suppression enforcement, data security, and compliant service provision within its domain. Channel restrictions imposed by Meta due to Customer violations are the Customer's responsibility; disruptions caused by Provider fault are not excluded through blanket third-party disclaimers.

Third-party claims, indemnity obligations, and statutory liability limitations are governed by the main agreement. No provision shifts statutory provider, intermediary, or data security obligations onto the Customer.

10 Reference policies and contact

Messaging operations are subject to the WhatsApp Business Messaging Policy and WhatsApp Business Platform Terms. Impact on service arising from updates to carrier terms will be communicated to Customer. Carrier terms do not authorize Provider to arbitrarily alter its own core contractual commitments.

Contact and notices: EMRE ALAY — CREATO AI, hello@creato.digital.

CREATO AI AI and Integration Special Terms

Document version: 2.0 — Date of preparation: September 30, 2026. This schedule is an addendum to the SaaS Agreement for Customers activating artificial intelligence and integration capabilities.

1 Available capabilities and instructions

Depending on the purchased tier, AI response generation, conversational summarization, multi-language translation, knowledge base retrieval, customer contextualization, store and campaign analytics, Copilot suggestions, and automated workflows may be enabled. Available scopes are defined in the Order Summary and account dashboard. Artificial intelligence is an algorithmic software tool and does not act as an employee, legal counsel, or certified fiduciary adviser to the business.

Customer determines knowledge base resources, accessible datasets, response boundaries, authorized operational tasks, and mandatory human review gates. Activating an agent or automation serves as a documented processing instruction strictly limited to the enabled scope. Where a configuration mandates human approval for critical actions, general platform usage does not substitute for that explicit approval.

2 Store integrations and analytics authorization

When Customer connects an e-commerce store after reviewing the data categories and analytical scopes displayed on the connection screen, Customer grants a documented service instruction authorizing CREATO AI to synchronize product, order, customer, cart, fulfillment, and sales metrics, correlate them with relevant contact profiles, and run analytical assessments within enabled features. Authorization is limited to operations, customer support, business intelligence, audience segmentation, and relevant AI analysis.

This instruction represents Customer's warranty that it possesses lawful administrative authority over the connected store. It does not imply that blanket consent has been granted on behalf of store End Users, nor that data may be repurposed arbitrarily, nor that Customer is relieved of statutory privacy notice obligations. Lawful processing grounds and necessary consents must be established by the Customer; CREATO AI maintains its statutory processing duties.

Connecting a store does not authorize sending unprompted marketing broadcasts, canceling orders, altering catalog pricing, charging payment methods, or modifying advertising budgets. Where write or transactional capabilities are provided, permissions, action types, and consequences are displayed and confirmed separately. Customer may disconnect stores at any time; disconnection halts further synchronization. Historical synchronized data is managed under deletion requests and contract termination rules.

3 AI model providers and data minimization

AI features may be powered by external large language model providers operating infrastructure abroad. CREATO AI applies data minimization to incoming prompts, stripping or masking unnecessary direct personal identifiers. The model provider, functional purpose, data categories, hosting country, and data retention windows are documented in the Subprocessors and Service Providers notice and integration prompts.

True anonymization requires that an individual cannot be re-identified through reasonable means, including correlation with external datasets. Merely removing a name, hashing a phone number, substituting a pseudonym, or redacting isolated phrases does not constitute statutory anonymization. Where contextual parameters, order numbers, or free-form text allow identification, data remains personal data. Processing source personal data to create anonymized records requires a lawful legal basis.

In current anonymous LLM workflows, only genuinely anonymized statistical aggregations or operational inputs are routed to foreign AI providers for specified service goals. Unanonymized personal data is not routed through this workflow; if anonymization cannot be completed, the operation is halted. If dedicated AI features operating on personal data are introduced, data scopes, purposes, providers, countries, and retention rules must be separately disclosed and enabled, with valid international transfer mechanisms under applicable laws (e.g., Article 9 of KVKK / GDPR Chapter V) established in advance. Accepting this agreement or connecting a store does not grant automatic consent for new scopes. Baseline AWS hosting and other personal data transfer requirements remain in effect.

4 Model training and purpose limitation

Customer conversations, subscriber lists, order records, and Google API user data are never used to train general-purpose foundation AI models or build multi-tenant training corpora for other customers. Appropriate commercial contractual terms and enterprise API configurations are applied to prevent providers from ingesting customer content into model weights. Transient runtime processing for inference differs fundamentally from permanent weight retraining.

Knowledge base materials uploaded by Customer are indexed strictly to provide retrieval-augmented context within Customer's own account. Indexing does not constitute permission for foundation model training or transfer of IP. If bespoke model fine-tuning or persistent personalization is introduced, objectives, data subsets, retention periods, and legal terms will be negotiated separately; practices prohibited by upstream channel policies cannot be legalized through customer agreement.

De-identified aggregate usage telemetry may be evaluated to optimize system uptime, error rates, and security baselines. Re-identification or cross-customer data pooling is strictly prohibited. Anonymized derivatives of Google user data remain subject to applicable Google Limited Use restrictions.

5 Output evaluation human oversight and errors

Model outputs and recommendations may contain errors, omissions, unintended biases, or outdated facts. Customer is responsible for reviewing published copy, outbound promotional campaigns, price quotes, legal disclaimers, and high-stakes operational choices. AI outputs must not serve as the sole determinant for employment decisions, credit assessments, medical advice, or critical legal outcomes.

Conversational agents interacting with End Users must provide a transparent path to human support. End Users must be clearly informed that they are interacting with an automated or AI-powered assistant; systems must not deceptively impersonate real humans. Customer configures handoff routes and notices; CREATO AI implements designated UI cues and escalation routing. Customer must maintain accurate and updated knowledge sources; CREATO AI is responsible for technically enforcing configured permission gates and human-in-the-loop workflows. Provider cannot disclaim technical liability for software bugs solely by invoking the probabilistic nature of AI.

IP rights in generated outputs are subject to source content inputs, provider API terms, and applicable copyright law. Uniqueness, copyrightability, and non-infringement of outputs are not guaranteed. Customer remains responsible for ensuring that prompted assets and published outputs respect third-party rights.

6 Meta integrations

Meta integrations enable ingestion of messages, template statuses, campaign metrics, and authorized lead ad submissions within the approved account scope. Receiving a new lead form does not automatically grant blanket marketing permissions across unrelated channels. Workflows adjusting ad budgets or altering campaigns require distinct administrative authorizations.

AI usage via WhatsApp is restricted to permitted business customer service and conversational support. General-purpose open-ended AI dissemination or prohibited use cases restricted by Meta are not authorized under this agreement. Current Meta platform terms and regional policies apply.

7 Google user data

CREATO AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including applicable Limited Use requirements. Where Google Workspace connections are utilized, the Workspace API User Data and Developer Policy also applies.

Only OAuth scopes strictly necessary for active, user-facing capabilities are requested. Prior to authorization, accessible data categories, usage, retention, sharing, and potential actions performed on the user's behalf are presented. Expanding data uses or requesting broader scopes requires updated notices and explicit opt-in.

Google user data is never used for generalized advertising targeting, retargeting, selling to data brokers, or training, improving, or fine-tuning generalized AI/ML foundation models. Sharing and human inspection of data under Limited Use is restricted to purposes authorized by Google policies; human access occurs only upon explicit user consent for troubleshooting, security incident mitigation, or legal compliance.

Customer may revoke Google OAuth access at any time via Google Account security settings and request data deletion from CREATO AI. Revoking access stops synchronization; historical data is managed under standard retention and deletion policies. An OAuth grant does not permit accessing other customers' environments or unannounced AI routing.

8 Allocation of responsibilities and notices

Customer is responsible for source content legality, instructions, account authorizations, and the lawful basis of Customer Data. CREATO AI is responsible for technical execution in accordance with instructions, platform security, purpose limitation, and adherence to declared transfer safeguards. Fault, indemnification, and liability caps established in the main agreement apply.

Contact and notices: EMRE ALAY — CREATO AI, hello@creato.digital.

CREATO AI Acceptable Use Policy

Document version: 2.0 — Date of preparation: September 30, 2026. This policy is an addendum to the SaaS Agreement.

1 Permitted use

The platform is designed to be used within the Customer's legitimate business operations and purchased subscription scope for customer support, permitted conversational marketing, e-commerce store analytics, and associated operational automations. Customer is responsible for supervising its authorized users. Relevant third-party carrier guidelines and messaging channel rules must be observed.

2 Prohibited activities

The following activities are strictly prohibited:

• Unsolicited commercial messaging or communications without required recipient consent; utilizing purchased, scraped, or unverified contact databases; sending communications in violation of recorded opt-out requests.
• Impersonation, falsified business identities, fraudulent schemes, phishing, deceptive advertising, or unlawful commercial enterprises.
• Publishing content that infringes personal data protection, privacy rights, trade secrets, or intellectual property of others; leaking or exposing third-party customer conversations across accounts.
• Harassment, threats, hate speech, incitement to violence, child sexual abuse material, human trafficking, or related harmful and exploitative content.
• Unauthorized access, token hijacking, compromising security boundaries, deploying malware, causing denial of service, or conducting uncoordinated penetration testing.
• Circumventing plan limits, user quotas, or channel restrictions via account duplication or automated scraping; unauthorized sublicensing, reselling, or white-label distribution.
• Marketing products, services, or regulated industries prohibited by messaging channels; non-compliance with age, jurisdictional, licensing, or sector-specific restrictions.
• Collecting unauthorized datasets for generalized AI model training; transferring Google user data for advertising targeting or training, developing, improving, or fine-tuning generalized AI/ML foundation models in violation of Google policies.

Statutory exceptions for scientific research, software interoperability, or mandatory legal disclosures are not negated by this policy. Formal security research requires prior written authorization with defined scopes.

3 Data and AI governance

Customer must not upload unnecessary special category personal data, full government identity documents, payment card security codes, plaintext passwords, or private encryption keys. Sensitive processing that has not been legally and technically agreed upon in advance is prohibited. AI outputs must not serve as the sole automated decision-maker for critical matters involving legal status, employment opportunities, creditworthiness, or health outcomes.

Customer must maintain updated knowledge base sources and define automation boundaries. CREATO AI enforces technical access limits and approval controls; customer errors do not eliminate Provider's statutory technical data security duties.

4 Reporting violations enforcement and appeals

Suspected violations or security incidents may be reported to hello@creato.digital. Upon identifying concrete risks or violations, CREATO AI may restrict offending content or campaigns, demand proof of recipient consent, and suspend affected features or accounts. Interventions remain strictly proportionate to risk urgency and scope.

Absent imminent security emergencies or legal mandates, Customer will receive notice of reasons and an opportunity to remedy curable breaches within timeframes established in the main agreement. Where emergency interventions occur, explanations are provided promptly as legally permissible. Customer may appeal enforcement actions; appeals are evaluated through audit logs and identity verification. Carrier-level restrictions remain under the independent authority of upstream network providers.

5 Liability and consumer protections

Customer is liable for its own culpable and unlawful platform misuse; Provider is liable for its own actions and contractual breaches. Enforcement discretion does not grant arbitrary termination rights or the right to retain unearned fees. Data handover rights, statutory consumer remedies, and non-waivable legal protections remain fully preserved under the main agreement.