AHA Commercial Beta Terms of Service and Privacy Notice

Version: Commercial Beta 1.0
Version date: 21 September 2026
Terms effective for each user: The date the user accepts these Terms
Privacy Notice effective: The date this document is first published in AHA
Contact: support@aha-agent.com

This document is a single agreement containing both the Terms of Service and the Privacy Notice for AHA's worldwide commercial beta. Please read it carefully.

1. Operator and scope

AHA (Autonomous AI-Enabled Handover Agent) is operated by the AHA Project Team ("AHA," "we," "us," or "our"). AHA is an independent service. No university, academic institution, professional body, standards organization, or other third party operates, sponsors, endorses, or assumes responsibility for AHA unless that organization expressly agrees in writing.

These Terms govern AHA's websites, applications, application programming interfaces, validation tools, reports, support, and related services (collectively, the "Service"). "Customer" means the person or organization accepting these Terms. "Authorized User" means an individual whom a Customer permits to use the Service. "Customer Content" means files, data, text, project information, comments, instructions, and other material submitted to or generated through the Service on a Customer's behalf.

These Terms apply prospectively to each Customer and Authorized User from the date they accept them. They do not apply retroactively to activity completed before acceptance. The Privacy Notice describes how AHA handles personal information retained when this document is first published in the Service, subject to applicable law.

2. Acceptance and authority

By creating an account, clicking an acceptance control, signing an order form, or using the Service, the Customer agrees to these Terms and acknowledges the Privacy Notice.

If an individual accepts for an organization, that individual confirms that they have authority to bind the organization. If they do not have that authority, they must not accept these Terms or use the Service for that organization.

The Service is intended for business, professional, research, testing, and evaluation use by people who are at least 18 years old and have legal capacity to enter into a contract. If mandatory law gives a user rights that cannot be waived, those rights are not limited by these Terms.

3. Commercial beta status

AHA is a commercial beta service. It may include incomplete, experimental, or rapidly changing features. During the beta, AHA may add, modify, limit, suspend, or remove features; change models, rules, workflows, or interfaces; impose usage limits; and perform maintenance with or without prior notice when reasonably necessary.

Unless an order form states otherwise, the Service has no guaranteed availability, support response time, processing time, data-recovery commitment, or service-level agreement. Customers must not use the Service as the sole repository for project information or as the sole basis for safety-critical, regulatory, payment, acceptance, or other high-impact decisions.

4. What the Service does

AHA assists with reviewing Building Execution Plans ("BEPs"), Industry Foundation Classes ("IFC") models, operations and maintenance information, asset-information materials, and related building-information data. The Service may extract candidate requirements, perform deterministic or rules-based checks, generate validation results, identify items for human review, and produce AI-assisted explanations, summaries, or remediation suggestions.

AHA is a decision-support tool. It does not provide architectural, engineering, legal, regulatory, financial, safety, certification, or other professional advice. It does not certify that any model, asset-information model, building, design, document, or project complies with a contract, standard, law, code, owner requirement, or professional duty.

5. Human review and Customer responsibility

Automated and AI-generated outputs may be incomplete, inaccurate, inconsistent, outdated, or based on an incorrect interpretation of Customer Content. A qualified person must review material outputs before they are used.

The Customer is responsible for:

• verifying material findings, calculations, classifications, and recommendations;
• determining which requirements, rules, standards, and contract documents apply;
• confirming that source files are complete, current, authorized, and correctly identified;
• maintaining authoritative project records and independent backups;
• deciding whether and how to use any output; and
• obtaining all professional review, approvals, and certifications required for the project.

6. Accounts and Authorized Users

The Customer must provide accurate account information, keep it current, protect credentials, use reasonable account-security measures, and promptly notify AHA of suspected unauthorized access. Accounts are personal to the assigned Authorized User and may not be shared or transferred.

The Customer is responsible for its Authorized Users, their compliance with these Terms, and activity occurring through their accounts, except to the extent caused by AHA's breach of these Terms. AHA may require identity or authority verification before changing account ownership, project ownership, or administrative access.

7. Plans, fees, billing, and taxes

Some commercial-beta features may be free, usage-limited, paid, or offered under an order form. The applicable plan, price, currency, billing interval, included usage, overage rules, and subscription term will be shown at purchase or in the order form.

Unless the purchase screen or order form states otherwise:

• fees are billed in advance and are non-refundable except where required by law;
• subscriptions renew for successive periods equal to the initial subscription period until cancelled;
• cancellation takes effect at the end of the current paid period;
• the Customer authorizes AHA and its payment provider to charge applicable fees and taxes;
• the Customer is responsible for taxes, duties, and similar governmental charges other than taxes based on AHA's net income; and
• overdue undisputed amounts may result in restricted or suspended access after reasonable notice.

AHA may change prices prospectively by giving reasonable notice. A price change will not alter a prepaid fixed term unless the Customer agrees. If the Customer does not accept a renewal price, it may cancel before renewal.

8. Customer Content and upload authority

The Customer retains ownership of Customer Content. The Customer grants AHA and its subprocessors a worldwide, non-exclusive, limited licence to host, copy, transmit, parse, transform, analyze, display, and otherwise process Customer Content only as reasonably necessary to provide, secure, support, and maintain the Service; comply with law; and enforce these Terms.

The Customer represents that it has all rights, permissions, notices, and lawful grounds needed to submit Customer Content and permit its processing under these Terms. The Customer must not submit information if doing so would violate confidentiality, intellectual-property, privacy, data-protection, export-control, employment, professional, or contractual obligations.

Unless AHA expressly approves otherwise in a signed agreement, the Customer must not upload passwords, private keys, authentication secrets, payment-card data, bank-account credentials, government identifiers, biometric templates, health records, children's information, classified information, export-controlled technical data, or other highly sensitive or specially regulated information.

9. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or should reasonably be understood as confidential, including Customer Content, security information, product roadmaps, pricing in an order form, and non-public technical or business information.

The receiving party will use Confidential Information only to perform or exercise rights under these Terms, protect it with at least reasonable care, and disclose it only to personnel, advisers, and service providers who need it and are bound by confidentiality obligations. These duties do not apply to information that the receiving party can show was lawfully known without restriction, independently developed, lawfully obtained from another source, or made public without breach.

If disclosure is legally required, the receiving party may disclose the minimum required and, when lawful, will give prompt notice so the disclosing party may seek protection. This section does not create a professional secrecy obligation or replace a project-specific non-disclosure agreement where one is required.

10. AI processing and outputs

AHA uses third-party AI services, including OpenAI API models, for functions that may include BEP extraction, requirement verification, readiness analysis, human-review assistance, and remediation summaries. Depending on the function, prompts may include document excerpts, model metadata, rules, validation findings, and reviewer context.

AHA does not authorize its AI providers to use Customer Content to train general-purpose models unless the Customer separately opts in. AHA does not itself use identifiable Customer Content to train a general-purpose AI model without the Customer's separate written or in-product permission.

As between AHA and the Customer, and to the extent permitted by law, the Customer may use outputs generated for it. Outputs may not be unique; other users may receive similar outputs. AHA does not guarantee that outputs are accurate, complete, non-infringing, or eligible for intellectual-property protection.

11. Service data, de-identified data, and feedback

AHA may collect operational measurements such as processing time, file size, page or element counts, rule counts, pass/fail totals, error rates, feature usage, resource consumption, and reliability metrics.

AHA may use aggregated or de-identified information that does not reasonably identify the Customer, an Authorized User, or a project to operate, secure, analyze, and improve the Service; develop benchmarks; and report overall service performance. AHA will not intentionally publish identifiable Customer Content, project names, file names, document excerpts, or confidential project details without permission.

If the Customer provides suggestions or feedback, AHA may use it without restriction or payment, provided AHA does not publicly identify the contributor without permission.

12. Acceptable use

The Customer and Authorized Users must not:

• violate law, regulation, sanctions, export controls, third-party rights, professional duties, or contractual obligations;
• upload unlawful, infringing, malicious, deceptive, or unauthorized content;
• access another user's account, project, files, or results without authorization;
• probe, scan, attack, disrupt, overload, or circumvent security, rate limits, or access controls;
• introduce malware or harmful code;
• reverse engineer the Service except to the limited extent the restriction is prohibited by law;
• use automated means to scrape or extract the Service beyond documented interfaces and agreed limits;
• misrepresent an AHA result as professional certification, guaranteed compliance, or an authoritative project record;
• use the Service to make a decision producing legal or similarly significant effects about a person without required notice, lawful authority, safeguards, and human review; or
• use the Service or its non-public outputs to develop or train a competing product or model without AHA's written permission.

Security testing requires prior written authorization. AHA may investigate suspected misuse and preserve relevant evidence as permitted by law.

13. AHA intellectual property

Except for Customer Content and third-party material, AHA and its licensors own the Service, software, interface, prompts, validation methods, documentation, branding, and related intellectual property.

Subject to these Terms and payment of applicable fees, AHA grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right during the subscription or beta-access period to allow its Authorized Users to use the Service for the Customer's internal business, professional, research, testing, and evaluation purposes.

No source-code, trademark, patent, dataset, model, or other ownership right is transferred. Third-party material remains subject to its applicable licence or terms.

14. Third-party services and integrations

The Service depends on third-party infrastructure, AI, analytics, hosting, authentication, storage, font, classification, and other services. AHA is not responsible for a third-party service outside AHA's reasonable control. Third-party services may change, interrupt, or discontinue their functionality.

When a Customer chooses or directs an integration, the Customer authorizes AHA to exchange the information reasonably required for that integration. AHA may suspend an integration that creates a security, legal, or operational risk.

15. Security and backups

AHA uses reasonable technical and organizational measures designed for the commercial beta, including authenticated access, project and tenant authorization checks, database row-level security, private storage for BEP and IFC artifacts, controlled or signed file access, transport encryption, infrastructure encryption at rest, logging, and access limitation.

No service is completely secure. The Customer must remove unnecessary sensitive information, maintain independent backups, manage Authorized Users, and promptly report suspected incidents to support@aha-agent.com. AHA is not an archival service and must not be the Customer's only repository.

16. Suspension and termination

The Customer may stop using the Service at any time and may cancel a subscription as described in Section 7. Either party may terminate an order form for a material breach that is not cured within 30 days after written notice, or immediately if the breach cannot reasonably be cured.

AHA may suspend access immediately when reasonably necessary to address a security risk, unlawful activity, material misuse, non-payment, harm to the Service or another customer, or a legal requirement. Where practical and lawful, AHA will provide notice and an opportunity to cure.

AHA may end the commercial beta or discontinue the Service by providing reasonable notice. On termination, access ends and the retention and deletion rules in Section 29 apply. The Customer should export needed content before termination. Provisions that by their nature should survive will survive, including payment obligations, confidentiality, intellectual property, disclaimers, liability limits, indemnities, dispute provisions, and privacy obligations.

17. Disclaimers

To the fullest extent permitted by law, the Service and all outputs are provided "as is" and "as available." AHA disclaims express, implied, and statutory warranties, including merchantability, fitness for a particular purpose, title, non-infringement, accuracy, uninterrupted availability, error-free operation, data preservation, and suitability for professional, contractual, safety, or regulatory reliance.

AHA does not warrant that the Service will identify every defect, requirement, incompatibility, or non-compliance, or that an output will be accepted by any owner, regulator, authority, certifier, client, or project participant.

Nothing in these Terms excludes a warranty, remedy, or right that cannot lawfully be excluded.

18. Limitation of liability

To the fullest extent permitted by law, neither party will be liable for indirect, incidental, consequential, special, exemplary, or punitive damages, or for lost profits, lost revenue, lost opportunity, loss or corruption of data, project delay, rework, business interruption, or loss of goodwill, arising from or related to the Service, even if advised that the loss was possible.

To the fullest extent permitted by law, AHA's total aggregate liability arising from or related to the Service during any 12-month period will not exceed the fees paid or payable by the Customer for the Service during the 12 months before the event giving rise to the claim. If the Customer used only free access, the cap is the equivalent of US$100.

These exclusions and caps do not apply to liability that cannot legally be limited, or to a party's fraud or wilful misconduct. The Customer's payment obligations are not limited by this section. Different limits stated in a signed order form control for that order form.

19. Indemnity

To the extent permitted by law, the Customer will defend and indemnify AHA and its contributors against third-party claims, damages, and reasonable costs arising from Customer Content, the Customer's unlawful or unauthorized use of the Service, or the Customer's material breach of Sections 8 or 12. This obligation does not apply to the extent a claim was caused by AHA's breach, negligence, unlawful conduct, or wilful misconduct.

AHA will give prompt notice of a covered claim, allow the Customer to control the defence and settlement, and provide reasonable cooperation at the Customer's expense. The Customer may not settle a claim in a manner that admits fault by, imposes obligations on, or fails to fully release AHA without AHA's written consent.

20. Governing principles and disputes

The parties will first try in good faith to resolve a dispute by written notice and discussion for at least 30 days. Notices may be sent to support@aha-agent.com and to the Customer's account email.

Unless a signed order form identifies a specific governing law and forum, these Terms are governed by the laws applicable at AHA's principal place of business, without regard to conflict-of-law principles, and disputes will be brought in the competent courts serving that location. Mandatory consumer, privacy, employment, and other non-waivable rights in a person's place of residence remain unaffected.

The United Nations Convention on Contracts for the International Sale of Goods does not apply. Nothing prevents either party from seeking urgent injunctive relief to protect security, confidentiality, or intellectual-property rights.

21. General terms

These Terms, the Privacy Notice below, any accepted order form, and any signed data-processing or service agreement form the entire agreement for the Service and replace prior discussions about the same subject. An order form controls over these Terms only where it expressly states the conflicting provision.

The Customer may not assign these Terms without AHA's written consent, except with a merger, reorganization, or sale of substantially all relevant assets where the successor accepts these Terms. AHA may assign these Terms as part of a reorganization, financing, merger, acquisition, or transfer of the Service, subject to continued protection of personal information.

Neither party is liable for delay caused by events beyond its reasonable control, except payment obligations. If a provision is unenforceable, it will be limited to the minimum extent necessary and the remaining provisions continue. Failure to enforce a provision is not a waiver. Headings are for convenience. Electronic communications and acceptance satisfy writing requirements where permitted by law.

22. Changes to these Terms

AHA may update these Terms to reflect changes in the Service, providers, business model, security needs, or law. Material changes will be announced through the Service or by email before they take effect when reasonably practicable. The updated document will show a new effective date and version.

If a material change requires consent under applicable law, AHA will request it. If the Customer does not agree, its remedy is to stop using the Service and cancel before the change takes effect, subject to any refund right required by law or stated in an order form.

Privacy Notice

23. Scope and responsibility

This Privacy Notice explains how AHA collects, uses, discloses, stores, transfers, and deletes personal information in connection with the Service. It applies to website visitors, Customers, Authorized Users, support contacts, and people whose personal information is included in Customer Content.

For account administration, billing, security, support, service analytics, and AHA's own business operations, the AHA Project Team acts as the organization responsible for deciding why and how personal information is processed.

When AHA processes personal information contained in Customer Content on behalf of an organizational Customer, that Customer generally decides the purpose and means of processing and AHA acts as its service provider or processor. The Customer is responsible for notices, lawful grounds, instructions, and rights requests concerning that content. A data-processing agreement may be made available where required.

Privacy questions and requests may be sent to:

Privacy Lead, AHA Project Team
Email: support@aha-agent.com

24. Information AHA collects

Account, organization, and contact information

• name, email address, organization, role, and account identifiers;
• authentication, verification, sign-in, and session records;
• subscription, plan, billing status, transaction references, and tax-related information; and
• support, sales, security, and privacy communications.

Authentication credentials are handled through AHA's authentication provider. AHA does not intend to store plaintext passwords in its application database. Payment-card details, if payments are enabled, should be collected by the designated payment provider rather than stored by AHA.

Project and uploaded information

• project names, codes, descriptions, originators, ownership, and membership;
• BEP, IFC, operations and maintenance, asset-information, and related files;
• file names, sizes, hashes, schemas, storage references, and upload status;
• text, properties, classifications, identifiers, and metadata extracted from files; and
• personal information or confidential information included by the Customer in those materials.

Validation, review, and AI information

• extracted rules and requirement candidates;
• validation profiles, results, findings, scores, and reports;
• reviewer decisions, comments, history, and recorded reviewer identity;
• AI requests, job status, prompts, outputs, and remediation information; and
• timestamps, errors, processing metrics, and audit records.

Technical, security, and analytics information

• IP address and approximate location derived from it;
• browser, device, operating system, language, page, referrer, and session information;
• application events, feature use, performance, diagnostics, and error information;
• cookie, local-storage, and similar identifiers; and
• interaction or session-replay data only if that feature is separately enabled as described in Section 28.

AHA does not intentionally collect highly sensitive personal information and asks Customers not to include it unless a signed agreement expressly authorizes that processing.

25. How information is collected

AHA collects information:

• directly when a person registers, purchases, configures a project, uploads files, runs a validation, reviews results, exports a report, changes settings, or contacts AHA;
• automatically through the application, authentication, security, hosting, logging, and permitted analytics technologies;
• from an organization that creates or manages an Authorized User's account;
• from another authorized project participant who submits Customer Content; and
• from integrations or external classification services at the Customer's direction.

26. Purposes and legal grounds

AHA processes information to:

• create, authenticate, administer, and secure accounts;
• provide BEP extraction, IFC validation, reporting, review, export, and related functions;
• process payments, manage subscriptions, and maintain transaction records;
• store project configuration, Customer Content, results, and audit history;
• provide AI-assisted functions requested by the Customer;
• respond to support, privacy, sales, and security requests;
• monitor reliability, prevent misuse, investigate incidents, and protect the Service;
• analyze and improve performance, accuracy, cost, usability, and product design;
• create aggregated or de-identified service information;
• enforce agreements, establish or defend legal claims, and comply with law; and
• send service communications and, with any required permission, product communications.

Where a legal ground is required, AHA relies as applicable on performance of a contract, steps requested before entering a contract, legitimate interests that are not overridden by individual rights, consent, and compliance with legal obligations. AHA may also process information to protect vital interests or for another ground recognized by applicable law.

Consent may be withdrawn at any time for future optional processing. Core processing required to provide a requested account or function cannot be disabled while that function is used.

27. How AHA discloses information

AHA may disclose information:

• to service providers and subprocessors that support the Service;
• to the Customer and its Authorized Users according to project roles and permissions;
• when a Customer directs an integration or export;
• to professional advisers under confidentiality obligations;
• to comply with law, legal process, or a valid governmental request;
• to protect rights, safety, security, the Service, or other users;
• in connection with a financing, merger, acquisition, reorganization, or transfer of the Service, subject to appropriate safeguards; and
• with consent or as otherwise disclosed when information is collected.

AHA does not sell personal information for money and does not use personal information for third-party targeted advertising.

28. Cookies, local storage, analytics, and session replay

AHA uses browser storage, cookies, or similar technologies that are necessary to authenticate users, maintain sessions, preserve security, remember essential settings, and provide requested functions. Blocking essential technologies may prevent the Service from working.

AHA may use PostHog for optional product analytics. Optional analytics will be controlled through an appropriate preference or consent mechanism where required. Refusing optional analytics will not block core Service functions.

Session replay is disabled by default for the commercial beta. AHA will not enable session replay for an account unless the feature is separately disclosed, configured to mask inputs and suppress sensitive text, and activated under a valid consent or other lawful basis where required. If enabled, session replay may reconstruct page views, clicks, navigation, device information, and interactions within the application; it does not intentionally record a user's webcam, microphone, or general computer screen outside the AHA application.

Users may change available analytics preferences through the Service or contact support@aha-agent.com.

29. Storage and retention rules

AHA stores core account, database, and project information using Supabase services in a United States West region. Private object storage is used for BEP and IFC artifacts. Information may also be processed in other locations by AHA's providers and authorized team members as described in Section 31.

AHA applies the following commercial-beta retention rules. Periods are measured from the relevant event and may be extended when necessary to comply with law, preserve evidence, resolve a dispute, prevent fraud or abuse, protect security, or follow a Customer's documented legal-hold instruction. Deletion from active systems may not immediately remove isolated backup or security-log copies, which expire under their applicable rotation cycle.

When exact deletion is technically infeasible, AHA may irreversibly de-identify the information instead. AHA may retain aggregated or de-identified information that no longer reasonably identifies a person, Customer, or project.

30. AI data handling

Relevant portions of Customer Content may be sent to OpenAI for requested AI functions. AHA configures and uses business/API services rather than consumer chat accounts for this processing. AHA does not authorize the provider to train general-purpose models on AHA API inputs or outputs unless the Customer separately opts in.

Provider retention depends on the selected API feature and AHA's account controls. AHA will not represent that Modified Abuse Monitoring or Zero Data Retention is enabled unless that status has been verified. Customers must not submit restricted or highly sensitive information unless the applicable plan, security review, and signed agreement expressly permit it.

AHA does not use automated output by itself to make decisions that produce legal or similarly significant effects about individuals.

31. Service providers and international processing

AHA currently uses or may use the following provider categories:

Authorized AHA personnel may access information from multiple countries when reasonably necessary for service development, support, security, and operations. Access is limited according to role and need.

Information may therefore be processed outside a person's country and be subject to the laws of other jurisdictions. Where required, AHA will use recognized transfer safeguards, contractual commitments, consent, or another lawful transfer mechanism.

AHA may update its providers. Material changes that create a new privacy risk will be communicated through the Service, a published subprocessor list, or email when required.

32. Security incidents

If AHA becomes aware of unauthorized access, use, disclosure, loss, or alteration of personal information, it will investigate, take reasonable containment and remediation steps, and notify affected Customers, individuals, or authorities when required by applicable law or contract.

Customers must promptly notify AHA of suspected compromise and reasonably cooperate with investigation and remediation.

33. Privacy choices and rights

Depending on applicable law and the context of processing, a person may request:

• confirmation of whether AHA processes their personal information;
• access to or a copy of that information;
• correction of inaccurate or incomplete information;
• deletion of information no longer required;
• restriction of or objection to certain processing;
• withdrawal of consent for optional future processing;
• portability of information they provided, where applicable;
• review of a qualifying automated decision, if any; or
• information about providers, processing locations, and safeguards.

Requests should be sent to support@aha-agent.com from the account email where possible. AHA may verify identity, authority, account ownership, and project access before acting. AHA may deny or limit a request where permitted by law, including to protect another person's rights, preserve security, comply with law, or avoid disclosing confidential information.

If AHA processes Customer Content solely on behalf of an organizational Customer, AHA may direct the requester to that Customer and assist the Customer as required. A person may also complain to a competent privacy or data-protection authority where that right applies.

34. Account and project deletion

Users may use any deletion controls made available in the Service or submit a verified request to support@aha-agent.com. Before deletion, AHA may require the requester to export needed results, confirm authority, resolve shared-project ownership, or identify records that another Authorized User remains entitled to retain.

Deleting an authentication account must be coordinated with related projects, stored objects, validation records, reports, and organization membership. AHA will process verified requests under the retention rules in Section 29 and applicable law.

35. Communications

AHA may send service communications needed for account verification, security, billing, changes to the Service, support, and legal notices. These messages are not optional while an account remains active.

AHA will send promotional communications only as permitted by law. Recipients may unsubscribe using the message control or by contacting support@aha-agent.com. Unsubscribing from promotional messages does not stop necessary service communications.

36. Children

The Service is not directed to children and is not offered to anyone under 18. AHA does not knowingly collect personal information from children. If such information is identified, contact support@aha-agent.com so it can be reviewed and deleted.

37. Changes to this Privacy Notice

AHA may update this Privacy Notice as the Service, providers, retention practices, or legal requirements change. Material changes will be communicated through the Service or by email when reasonably practicable and required. The current version and effective date will be displayed with the notice. New consent will be obtained where required.

38. Contact

Questions, complaints, legal notices, privacy requests, and security reports may be sent to:

AHA Project Team
Privacy Lead / Support
Email: support@aha-agent.com

AHA will acknowledge and respond within the period required by applicable law and will work in good faith to resolve concerns.