Terms of service

1. Who we are and what these terms govern

These general terms govern the contract between [PENDING: owner's name] (tax ID [PENDING: NIF], with its address at [PENDING: address], trading as NextAura; hereinafter, the Provider) and the individual or legal entity that subscribes to the service (hereinafter, the Customer) to use NextAnalyzer: the web dashboard, the desktop agent, the API and the associated services (hereinafter, the Service).

The Privacy policy, the Data processing agreement (incorporated as an annex when the Customer processes third-party data with the Service) and the Acceptable use policy form part of the contract. In case of conflict, what has been agreed in writing with the Customer prevails, then the Data processing agreement on data protection matters, and then these terms.

2. Service for professionals

The Service is intended exclusively for businesses, professionals and organisations. Whoever subscribes declares that they act for purposes related to their trade, business, craft or profession, and not as a consumer. If, nonetheless, the law were to treat them as a consumer, the rights that consumer law grants them on a non-waivable basis will be respected. Self-employed persons who subscribe for their business do so as professionals. The Provider may request a tax ID and refuse or terminate contracts that do not have a professional purpose.

3. Definitions

• Account: a person's individual access to the dashboard.
• Organisation: the Customer's space in the Service, with its members, devices and settings.
• Device: each device linked to the Service through the agent.
• Agent: the program installed on devices that connects them to the Service, together with the Wazuh detection agent it installs alongside.
• Customer Data: the information that the Customer and its staff enter or that the agent collects from its devices and network.
• AI-generated content: the analyses, summaries and remediations that the Service writes with artificial intelligence models.

4. Contracting and account

The contract is concluded when the Customer creates the account and accepts these terms by ticking the corresponding box, which is not pre-ticked, after having been able to read, save and print them. Before submitting the sign-up form, the Customer can review and correct the data entered. The Provider archives the electronic contract document (the accepted version of the documents) and the proof of acceptance (document, version, date, IP and browser), and will provide them to the Customer on request. The contract is concluded in Spanish; translations are provided as a courtesy.

As neither party acts as a consumer, they agree that the Provider will not send the confirmation of acceptance provided for in article 28 of Law 34/2002 (LSSI-CE), in accordance with its section 3.a. The Customer in any case receives the account verification email and may request at any time the version of the documents it accepted.

Whoever creates the account declares that they have the capacity and authority to bind the Customer, are of legal age and provide truthful data, which they will keep up to date. They must confirm their email address to enrol devices.

The Customer is responsible for safeguarding its staff's credentials and API keys and for requiring the second factor from its members, which it can configure in the organisation settings and which the Provider recommends enabling at least for owners and administrators. Any activity carried out from an account or an API key is presumed to have been carried out by the Customer. The Customer must report any unauthorised use without delay.

If the Customer gives access to its organisation to a third party that provides services to it (for example, a managed service provider), that third party acts on behalf of the Customer, who is responsible for its actions in the Service.

5. Free trial

New organisations enjoy a fourteen-day free trial of the Business plan, with up to five devices and no card required. If no plan is purchased when it ends, the organisation switches to read-only mode and, after thirty days in that state, is suspended. The Provider may limit or cancel trials in case of abuse. During the trial, the Service is provided without any availability commitment.

6. Plans, limits and prices

The plans, their limits (users, included devices and extra devices, AI analyses per month) and their features are published on the pricing page. Prices are stated exclusive of taxes and are invoiced with the taxes that apply under the law and the Customer's tax details.

Features marked as «coming soon» are not part of the contract until they are available. The Provider may change prices with thirty days' notice, applicable from the next renewal; if the Customer does not agree, it may cancel before the change applies.

7. Billing and payment

The Service is contracted for monthly periods with automatic renewal and is charged in advance through the payment gateway (Stripe). Extra devices are counted by the daily maximum of the period and charged pro rata by day.

The Provider issues an invoice for each charge, in electronic format and with an invoicing system compliant with Royal Decree 1007/2023 (VeriFactu), to the tax details the Customer has provided in Billing. The Customer is responsible for their accuracy and for validating its VAT number if it is a business in another Member State; if it cannot be validated, Spanish VAT will apply. Invoices are not modified: errors are corrected with corrective invoices.

If a payment fails, the Customer has a seven-day grace period with notice. After that, the organisation switches to read-only mode (devices remain protected with their last policy, but devices cannot be enrolled nor policies changed) and, after thirty days, is suspended. Overdue amounts will accrue late-payment interest and the compensation for recovery costs under Spanish Law 3/2004 on combating late payment in commercial transactions.

8. Plan changes, renewal and cancellation

Upgrading applies immediately with the corresponding proration; downgrading applies at the end of the period, and if the organisation exceeds the new limits, the Customer must choose which users and devices are kept. Features that are lost are disabled and data that only existed because of them (for example, activity history) is deleted according to its retention.

The Customer may cancel the subscription at any time; cancellation takes effect at the end of the period already paid, during which the Customer may continue to use the Service. Unless there is an error attributable to the Provider or a legal provision to the contrary, periods already started are not refunded.

9. Licence to use

The Provider grants the Customer a limited, non-exclusive, non-transferable and revocable licence to use the Service and the agent during the term of the contract and within the limits of its plan. The software is licensed, not sold.

Unless expressly permitted by law, the Customer may not: copy, modify, decompile or reverse engineer the software; sublicense it or make it available to third parties outside the Customer; circumvent technical or plan limits; or use it to build a competing service. Open-source components are governed by their own licences, which prevail over this clause insofar as they apply.

10. Customer responsibility for devices and people

The Customer declares that it owns the devices and networks on which it uses the Service or has the right to do so, and is solely responsible for having a legal basis for processing the data of the people who use those devices, for informing them in advance in an express, clear and concise manner and for respecting their rights, in particular those of employees (arts. 87 to 91 of the LOPDGDD and arts. 20.3, 20 bis and 64.5 of the Spanish Workers' Statute) and those of minors.

Activity history is turned off by default. Only the owner can turn it on, after declaring that they have informed the users of the devices and have a legal basis to do so; the Customer must have carried out, where mandatory, its data protection impact assessment, for which the Provider supplies a template. While it is on, the device shows a permanent notice that the Customer cannot hide. Using the Service for covert surveillance, for discriminatory or unlawful purposes, or to process the content of communications is prohibited.

The Customer decides which notices and alerts its members receive and through which channels, and when configuring them it will respect their right to digital disconnection (article 88 of the LOPDGDD) and its internal policy. Nor will it use the Service, or its artificial intelligence features, to monitor or evaluate the performance or behaviour of employees or to take decisions about their employment relationship.

The Provider may suspend the affected feature or the Service if there are reasonable indications that it is being used contrary to these terms, with prior notice except in urgent cases.

11. Acceptable use

The Customer and its staff will use the Service in accordance with the law and the Acceptable use policy, without compromising the security, availability or integrity of the Service or of other customers.

12. Changes to devices, remote access and scripts

The agent may modify the configuration of the Customer's devices (for example, the firewall, the DNS server, browser policies, content blocking or a local certificate authority used only to display the notice page for blocked websites) and execute commands the Customer requests (restart, shut down, update drivers or programs, apply remediations or run scripts). These changes are saved so that they can be reverted where technically possible and are recorded in the audit log, but they have effects on the Customer's systems, which the Customer authorises and assumes.

Remote access is configured by the Customer. Attended sessions require the person using the device to accept them; if the Customer configures unattended access or allows sessions to be recorded (recording happens in the technician's browser and is not stored on the platform), it is responsible for having informed those people in advance and for having a basis to do so. Sessions by the Provider's support are always attended, with a stated reason, not recorded and audited; they are allowed by default and the Customer can turn them off in its remote access policy.

Scripts in the organisation's library are written and approved by the Customer; the platform signs each approved version and the agent checks the signature before running it. Their content and effects are the Customer's sole responsibility. They may run with administrator privileges: testing them first on a test device is recommended.

It is recommended to test new agent versions on a group with delayed updates and to have backups. Commands that close or restart devices may cause loss of unsaved work.

13. Security, vulnerabilities and artificial intelligence

The Service helps identify risks, but does not guarantee detection of all threats, vulnerabilities or incidents, nor that devices are free of them, nor does it replace a security audit. Vulnerability information comes from public sources that may be incomplete or inaccurate. The mapping to NIS2, the Spanish National Security Framework (ENS) or ISO/IEC 27001 shown by the Service is for guidance only and does not certify compliance.

AI-generated content is produced with models from an external provider (Anthropic) from minimised data, is always identified as such and may contain errors. Proposed remediations may be reviewed by the Provider, generic or written by AI (the latter only for vulnerabilities without a remediation in the catalogue, from the CVE identifier, the operating system and the language). The Customer must review them before applying them and applies them under its own responsibility; the AI never applies changes on its own.

The weekly email summary (Business and Enterprise plans) is optional: each user turns it on and off in their account. The Customer will not use AI-generated content as the sole basis for decisions affecting people. The AI features are not intended for the purposes listed in Annex III of Regulation (EU) 2024/1689 (in particular, the management of workers); using them for such purposes is an unintended use for which the Customer is responsible.

14. Data protection

With regard to the data of the people who use the devices and other Customer Data, the Customer is the controller and the Provider its processor, under the Data processing agreement, which the Customer accepts by accepting these terms. With regard to account, billing and support data, the Provider is the controller, under its Privacy policy.

Customer Data belongs to the Customer. The Provider will only process it to provide the Service and in accordance with the Customer's instructions.

15. Availability and support

The Provider endeavours to keep the Service continuously available, but does not guarantee uninterrupted availability; it may carry out maintenance, with prior notice where possible. Unless a service level agreement is agreed in writing (for example, on the Enterprise plan), no availability or response time commitments are made.

Support is provided through the dashboard chat, during the published support hours, and by email. To operate the platform, the Provider's authorised staff see basic technical data about devices; to see an organisation's details they need temporary, read-only access, with a stated reason and notice to the owner, and they never access the activity history. Maintenance commands that such staff send to a device to resolve an incident carry a stated reason and are recorded in the organisation's audit log.

16. Warranties and limitation of liability

To the maximum extent permitted by law, the Service is provided «as is» and the Provider gives no warranties other than those expressly set out here.

The Provider will not be liable for indirect damage, loss of profit, loss of opportunity, revenue or reputation, or damage arising from the actions of the Customer or third parties, from use contrary to these terms, from changes the Customer orders on its devices or from causes beyond its reasonable control. Nor for loss of data that the Customer could have avoided with reasonable backups.

The Provider's total aggregate liability to the Customer for any cause will not exceed the amounts paid by the Customer for the Service in the twelve months preceding the event giving rise to it (one hundred euros if only the free trial has been used).

These limitations do not apply to liability that cannot be limited by law, in particular for wilful misconduct or gross negligence or for personal injury, nor do they limit the rights that article 82 GDPR grants to data subjects.

17. Indemnity

The Customer will hold the Provider harmless against third-party claims, including those of device users and authorities, arising from use of the Service contrary to the law or these terms, or from the Customer's breach of its obligations regarding information and legal basis concerning the people whose data it processes with the Service.

The Provider will hold the Customer harmless against third-party claims alleging that the Service, used in accordance with these terms, infringes their intellectual or industrial property rights, provided that the Customer notifies the Provider without delay and allows it to conduct the defence.

18. Intellectual property

The Provider retains all rights in the Service, the agent, the documentation and the NextAura and NextAnalyzer trademarks. The Customer may freely use, for its organisation, the reports and AI-generated content it obtains from the Service. Suggestions the Customer sends may be used without compensation. The Service includes third-party software, including open-source software, subject to its own licences.

19. Confidentiality

Each party will keep confidential the non-public information of the other party to which it has access under the contract and will use it only to perform the contract, during its term and for five years afterwards, unless it must disclose it by law or by order of an authority.

20. Suspension and termination

The Provider may suspend or terminate the contract, with prior notice except in urgent cases for security or unlawfulness, for non-payment, serious breach of these terms, unlawful use or risk to the Service or third parties. The Customer may terminate it by cancelling its subscription or requesting deletion of the organisation.

21. Exit, portability and deletion of data

The Customer can export its data at any time: the owner downloads a complete export of Customer Data in JSON from Settings, also during the deletion period; there are also the dashboard exports (findings in CSV, reports in PDF and invoices) and, on the plans that include it, the API. If it needs another structured and commonly used format (such as CSV), the Provider will deliver it on request within thirty days at most. When requesting deletion of the organisation, the Customer has thirty days to export it or cancel the deletion; after that, Customer Data is deleted, including backups in their ordinary rotation cycle, except data the Provider must keep blocked by legal obligation (such as invoices and the security audit log, the latter for up to three years).

In accordance with Chapter VI of Regulation (EU) 2023/2854 (Data Act): (a) the Customer may request, with a maximum notice period of two months, switching to another data processing service provider or to its own infrastructure, or only the erasure of its data; (b) after the notice period there is a thirty-day transition period, which the Customer may extend once if needed, during which the Provider continues to provide the Service with full continuity, helps it extract its exportable data and provides reasonable assistance; if that period were not technically feasible, the Provider will inform it with reasons within fourteen days and set an alternative period of up to seven months; (c) the contract ends when switching is completed or, if the Customer only wants its data erased, at the end of the notice period; (d) afterwards it has at least thirty more days to retrieve its data, after which the data is fully erased; (e) the Provider does not charge switching or data extraction fees. Agents are uninstalled with the retire command or with the uninstaller, which reverts the reversible changes applied to the devices (DNS, browser policies, firewall and local certificate authority) and deletes the agent's local data.

Exportable data: all data that the Customer and its staff have entered or the agent has collected from its devices and network, and the organisation's configuration (groups, policies, alert rules, scripts and their versions, channels and integrations without their secrets), in the format of the complete export, whose description (tables, columns and types) the Provider supplies on request. The following are not exported, for security reasons or because they are the Provider's assets: passwords, keys and secrets (only their fingerprints or encrypted forms are stored), the platform's certificates, the code of the Service and the agent, the Provider's remediation catalogue, the detection engine's raw events and internal support notes.

The Service's infrastructure is located in the European Economic Area (jurisdiction stated in Annex III of the Data Processing Agreement). Faced with requests from third-country authorities to access or transfer non-personal Customer Data that conflict with Union or Spanish law (article 32 of the Data Act), the Provider only complies with those that have a valid legal basis, reviews them, provides the minimum strictly necessary and informs the Customer beforehand unless prohibited by law; in addition, it encrypts communications and minimises what it sends to providers outside the EEA.

22. Changes to the terms

The Provider may change these terms for legal, technical or business reasons, notifying the Customer by email and in the dashboard at least thirty days in advance, unless the change is imposed by law or benefits the Customer. If the Customer does not agree, it may cancel before the effective date without penalty; if it continues to use the Service afterwards, it will be deemed to accept the new version, which it will be asked to confirm in the dashboard when the change is material.

23. General provisions

• Assignment: the Provider may assign the contract to a successor in the business, notifying the Customer; the Customer requires the Provider's consent.
• Force majeure: neither party is liable for non-performance caused by events beyond its reasonable control.
• Notices: they will be sent by email to the owner's account address and, where appropriate, in the dashboard. Notices from the Customer to the Provider, to [PENDING: email].
• Severability: if a clause is void, the rest will remain in force and the void clause will be replaced by the valid one closest to its purpose.
• Entire agreement: these terms and the documents they incorporate constitute the entire agreement between the parties regarding the Service, except as agreed in writing.

24. Governing law and jurisdiction

The contract is governed by Spanish law. The parties submit, waiving any other jurisdiction that may correspond to them, to the courts of the city of the Provider's place of business, unless a mandatory rule provides otherwise.

Contact for any question about these terms: [PENDING: email].