Legal

1. About these terms

1.1 These customer terms (the "Customer Terms") apply to the customer's (the "Customer") use of the Reliable service (the "Service"), provided by Reliable AI AS, reg. no. 934 343 786 (the "Supplier").

1.2 The agreement between the parties consists of the signed customer agreement (the "Customer Agreement") and these Customer Terms, including the Supplier's data processing agreement or, where the parties have signed a separate data processing agreement, that agreement (the "DPA"), together the "Agreement". In case of conflict, the Customer Agreement prevails over the Customer Terms. In matters concerning the processing of personal data, the DPA prevails over the Customer Agreement and the rest of the Customer Terms.

1.3 The current version of the Customer Terms is published on the Supplier's website with a version number and date, together with previous versions. The Customer Terms are published in Norwegian and English. In case of discrepancy, the Norwegian version prevails.

2. Definitions

• Users: Persons to whom the Customer gives access to the Service.
• Customer Data: Content that the Customer and Users enter or save in the Service, such as searches, projects, notes and comments, and information about the Users.
• Usage Data: Information about how the Service is used, which does not include the content of Customer Data.

3. The Service

3.1 The Service is a web-based search service for public legal sources. Its scope, including which areas of law and jurisdictions the Customer has access to, is set out in the Customer Agreement.

3.2 The Supplier makes the Service available no later than two weeks after the Customer Agreement is signed, or from the delivery date requested by the Customer, if later.

3.3 The Supplier continuously develops and changes the Service, and the Customer always has access to the current version.

4. Licences

4.1 The Customer receives a non-exclusive and non-transferable right to use the Service in its own business during the term of the Agreement, for the number of Users set out in the Customer Agreement.

4.2 Each licence is personal and may not be shared. The Customer may transfer a licence to a new User when the original User leaves or no longer needs access.

4.3 The Customer may order additional licences in writing. E-mail is sufficient. New licences are governed by the Agreement and the current price per licence, and are invoiced from activation.

4.4 The Supplier may verify that the Customer's use of the Service corresponds to the number of licences in the Customer Agreement. The Supplier shall give reasonable notice of such verification and carry it out with the least possible inconvenience to the Customer.

5. The Supplier's obligations

5.1 The Supplier shall deliver the Service professionally and in accordance with good industry practice.

5.2 The Supplier shall aim to keep the Service available around the clock. Planned maintenance affecting the Service during working hours shall as a rule be notified at least fourteen (14) days in advance.

5.3 The Supplier provides user support by e-mail and telephone on working days between 09:00 and 17:00. Enquiries are normally answered within two (2) working days.

5.4 The Supplier shall protect the Service and Customer Data with appropriate technical and organisational security measures, as described in the DPA. The Supplier does not warrant that the Service is free from vulnerabilities or attacks.

5.5 Except as stated in the Agreement, the Supplier gives no warranties for the Service, including that it is error-free, always available, or that searches give correct or complete results.

6. The Customer's obligations

6.1 The Customer is responsible for Users' use of the Service and for keeping sign-in credentials confidential. The Customer shall notify the Supplier immediately of any suspected unauthorised access.

6.2 The Customer shall not:

1. share, sell, license or otherwise make the Service available to others,
2. decompile, reverse engineer or attempt to obtain the source code of the Service,
3. use automated methods to extract content from the Service at scale,
4. use the Service to develop a competing product, or
5. use the Service in breach of the law or in a way that impedes delivery to other customers.

6.3 The Service does not provide legal advice. The Customer is responsible for checking results and sources before use, and for decisions based on them.

6.4 The Customer is responsible for the security of its own systems, networks, devices and user accounts, including access management, configuration and any integrations with the Service, and for assessing whether use of the Service is compatible with the Customer's own security requirements. The Customer acknowledges that any web-based service may have unknown vulnerabilities and may be attacked or misused even where appropriate security measures are in place, and uses the Service subject to that risk. The Supplier is not liable for loss caused by attacks, malware or unauthorised access in the Customer's own systems or at third parties other than the Supplier's subcontractors, including where the Service or links to external sources have been used as a route of attack, unless the Supplier has acted with gross negligence or wilful misconduct.

7. Data and rights

7.1 The Supplier owns the Service and all rights in it. The Customer receives only the rights expressly set out in the Agreement.

7.2 The Customer owns Customer Data. The Supplier uses Customer Data only to deliver and secure the Service, as set out in clause 7.3, and as described in the DPA and the Supplier's privacy policy. Customer Data is never shared with other customers and is not used to train generative AI models.

7.3 The Supplier may use Usage Data to operate, invoice and improve the Service. The Supplier may also anonymise Customer Data, individually or in aggregate, so that it cannot be linked to the Customer, to individuals or to other identifiable parties. Such data is owned by the Supplier and may be used to improve the Service.

7.4 When the Agreement ends, Customer Data is deleted or returned in accordance with the DPA. Stored search text is not linked to the Customer and is therefore deleted or anonymised in accordance with the retention periods in the privacy policy. Data anonymised under clause 7.3 is not covered.

8. Price and payment

8.1 The price and invoicing period are set out in the Customer Agreement. All prices are exclusive of VAT.

8.2 Invoices are due fourteen (14) days after the invoice date, unless otherwise agreed. Late payment accrues interest under the Norwegian Act relating to Interest on Overdue Payments (forsinkelsesrenteloven).

8.3 The Supplier may change its prices with effect from the first day of the following month, with reasonable notice. Prices are not changed during an agreed binding period, unless the change is due to material changes to the Service.

8.4 Fees paid are non-refundable, unless otherwise stated in the Customer Agreement.

9. Confidentiality

9.1 The parties shall treat information received from each other in connection with the Agreement as confidential, and use it only to perform the Agreement. Customer Data is always confidential.

9.2 The duty of confidentiality does not apply to information that is publicly known, that the recipient lawfully held beforehand, or that the recipient has lawfully received from a third party not bound by confidentiality.

9.3 The parties may share confidential information with their own employees, advisers and subcontractors who need it to perform the Agreement and are bound by equivalent confidentiality. Information may also be disclosed when required by law or a decision of a public authority. The recipient shall then notify the other party, as far as lawful.

9.4 The duty of confidentiality continues after the Agreement has ended.

10. Liability

10.1 Neither party is liable for indirect loss, such as lost profits or lost savings.

10.2 Each party's total liability under the Agreement is limited to an amount equal to six (6) months' fees under the Customer Agreement, based on the fees applicable when the event giving rise to the claim occurred.

10.3 The limitations in clauses 10.1 and 10.2 do not apply in cases of gross negligence or wilful misconduct, to the Customer's payment obligations, or to the Customer's breach of clause 6.2.

10.4 The Customer shall indemnify the Supplier against third-party claims arising from the Customer's use of the Service, including breach of law, third-party rights or the Agreement.

11. Force majeure

11.1 Neither party is liable for failure to perform caused by circumstances beyond its control, such as natural disasters, war, terrorism, pandemics, government orders, strikes, or widespread failures of power, networks or subcontractors.

11.2 The affected party shall notify the other party without undue delay and limit the effects. If the circumstances last more than one month, either party may terminate the Agreement in writing.

12. Term, suspension and termination

12.1 The Agreement applies from the signing of the Customer Agreement. Unless otherwise stated in the Customer Agreement, either party may terminate the Agreement or individual licences with three (3) months' written notice.

12.2 Either party may terminate the Agreement with immediate effect if the other party materially breaches the Agreement.

12.3 If the Customer has not paid within forty-five (45) days of the invoice date, nor within thirty (30) days of written notice of the overdue payment, this constitutes a material breach.

12.4 The Supplier may temporarily suspend access to the Service, in whole or for individual Users, if (a) overdue fees have not been paid within thirty (30) days of written notice, or (b) use breaches clause 6.2 or poses a security risk. The suspension shall not be broader or last longer than necessary, and the Customer shall be notified, in case (b) as soon as possible.

13. Changes to the Customer Terms

13.1 The Supplier may change the Customer Terms. Changes are published on the website, and the Customer is notified by e-mail within a reasonable time before they take effect. If the Customer does not accept a change, the Customer may, before the change takes effect, terminate the Agreement with effect from that date.

13.2 Changes to the Customer Terms or the privacy policy may not weaken the Supplier's obligations regarding confidentiality, security or Customer Data during the term of the Agreement without the Customer's written consent.

14. Other provisions

14.1 Notices. Notices under the Agreement shall be given in writing to the contact persons and e-mail addresses stated in the Customer Agreement. E-mail counts as writing.

14.2 Assignment. The Customer may not assign the Agreement without the Supplier's written consent. Either party may nevertheless assign the Agreement in its entirety in connection with a merger, acquisition, reorganisation or sale of all or substantially all of its business, with written notice to the other party.

14.3 Subcontractors. The Supplier may use subcontractors and is responsible for their work as for its own. Subcontractors that process personal data are governed by the DPA.

14.4 Reference. The Supplier may state that the Customer uses the Service, and use the Customer's name and logo in marketing, unless otherwise agreed in the Customer Agreement.

14.5 Entire agreement. The Agreement constitutes the entire agreement between the parties regarding the Service, and supersedes previous agreements and understandings on the same subject.

14.6 Severability. If a provision of the Agreement is invalid, the rest of the Agreement continues to apply.

15. Governing law and disputes

15.1 The Agreement is governed by Norwegian law.

15.2 The parties shall first seek to resolve disputes through negotiation. If this fails, the dispute shall be settled by the ordinary courts, with Oslo District Court as the agreed venue.

This policy explains how Reliable AI AS processes personal data when you use the Reliable service, visit our website or contact us.

1. Who is responsible

Reliable AI AS (reg. no. 934 343 786, Akersbakken 30, 0172 Oslo, Norway) is the controller for the processing described in this policy.

If you use Reliable through your employer, your employer is the controller for data we process on its behalf to deliver the service, such as the content of your projects. In that case we are the processor, and the processing is governed by a data processing agreement with your employer. You can direct questions about that processing to your employer or to us.

2. What we process, and why

This is the processing we carry out for our own purposes, as controller.

Your user account

We process your name, e-mail address and employer to administer your account and the customer relationship with your employer. We use your e-mail address only to send you information about the service.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in administering the service and the customer relationship.

Sign-in and security

Sign-in is handled by Microsoft Entra ID, which logs the time, sign-in method and technical details of each sign-in. We use the logs to control access and to detect and investigate misuse, errors and security incidents. The logs are not used to monitor your work.

Legal basis: Legitimate interest in securing the service.

Use of the service

We record how the service is used, for example which features are used and how often. We use this for invoicing and improving the service.

Legal basis: Legitimate interest in invoicing and improving the service.

Search text

The text you search for may be stored so that we can improve the search. It is stored without your name, e-mail address or user ID, is deleted or anonymised automatically after at most 90 days, and is not used to train generative AI models.

You decide whether your searches are stored, unless your employer has switched storage off for all users. Storage can be switched off in the service, and from then on none of your searches are stored.

Legal basis: Legitimate interest in improving the search. You can object at any time by switching storage off.

The customer relationship

We process the names and contact details of contact persons at customers and prospective customers to enter into and follow up agreements and to invoice.

Legal basis: Legitimate interest in managing the customer relationship, and legal obligation (bookkeeping rules).

Our website and enquiries

• Visitor statistics. We use Vercel Analytics, which does not use cookies, to see how the website is used (pages visited, approximate location and device type). Legal basis: Legitimate interest in improving the website.
• Demo bookings. If you book a demo, Calendly processes the name, e-mail address and meeting details you provide. Legal basis: Legitimate interest in arranging and holding the demo.
• Enquiries. If you write to us, we process your message and contact details to reply. Legal basis: Legitimate interest.

3. How long we keep the data

• User account: For as long as the account is in use. It is deleted when your employer ends your access, when the customer relationship ends, or after 24 months of inactivity.
• Search text and usage data: Up to 90 days, after which they are deleted or anonymised automatically.
• Sign-in and security logs: Up to 24 months, for security reasons.
• Application logs: Up to 30 days.
• Customer relationship and enquiries: For as long as necessary for the purpose.
• Accounting records: For as long as bookkeeping rules require.

4. Who we share data with

We never sell personal data. We use providers that process data on our behalf, for example for running the service, sign-in, our website, e-mail, customer follow-up and demo bookings. The service runs on Microsoft (Azure and Entra ID) within the EU/EEA. Some other providers may process data outside the EU/EEA, in which case the transfer relies on a valid transfer basis, such as the EU standard contractual clauses.

We disclose data to authorities only when required by law. The full list of providers that process customer data in the service is on the Sub-processors page.

5. Cookies

The service uses only the cookies needed for sign-in. The website does not use cookies for statistics or marketing.

6. Your rights

You have the right to access the data we hold about you and to have incorrect data corrected. You can also request erasure, request restriction of processing, object to processing based on legitimate interest, and receive your data in a machine-readable format.

Contact us at hei@reliableai.no. We reply without undue delay and within one month at the latest. If we are unsure of your identity, we will ask you to confirm it before handling your request.

If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the supervisory authority where you live. We would appreciate it if you contacted us first.

7. Contact

Reliable AI AS, Akersbakken 30, 0172 Oslo, Norway. E-mail: hei@reliableai.no

8. Changes

We update this policy when needed. The current version is always on our website, where previous versions are also available.

This data processing agreement (the "DPA") forms part of the Customer Terms and applies between the customer (the "Customer") and Reliable AI AS, reg. no. 934 343 786 (the "Supplier"). It governs the Supplier's processing of personal data on behalf of the Customer when delivering the Service, and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

This DPA is published in Norwegian and English. In case of discrepancy, the Norwegian version prevails.

1. Roles

1.1 The Customer is the controller and the Supplier is the processor of personal data that the Supplier processes on the Customer's behalf when delivering the Service, as described in Appendix 1.

1.2 For processing the Supplier carries out for its own purposes, which are limited to managing the customer relationship, invoicing, securing the Service and improving the Service, the Supplier is itself the controller. That processing is described in the Supplier's privacy policy.

1.3 The Customer is responsible for having a lawful basis for the personal data processed on its behalf, and for ensuring that its instructions to the Supplier comply with data protection law.

1.4 The Customer may switch off storage of search text for all its Users. Stored search text is not linked to the Customer or the Users, is processed by the Supplier as controller under clause 1.2, and is deleted or anonymised within 90 days. Clause 7.2 does not apply to stored search text.

2. The Supplier's obligations

2.1 The Supplier shall process personal data only on documented instructions from the Customer. The Customer Agreement, the Customer Terms and this DPA constitute the Customer's instructions. If the Supplier considers that an instruction infringes data protection law, the Supplier shall inform the Customer. If the law requires the Supplier to process the personal data otherwise, the Supplier shall inform the Customer before the processing, unless that law prohibits it.

2.2 The Supplier shall ensure that persons with access to the personal data are bound by confidentiality.

2.3 The Supplier shall implement appropriate technical and organisational measures to secure the personal data, in accordance with Article 32 GDPR. The measures are described in Appendix 2.

2.4 The Supplier shall, as far as is reasonable given the nature of the processing, assist the Customer in fulfilling data subjects' rights and the Customer's obligations under Articles 32 to 36 GDPR.

2.5 The Supplier shall not use personal data processed on the Customer's behalf to train generative AI models.

3. Sub-processors

3.1 The Customer gives general authorisation for the Supplier to use sub-processors. Current sub-processors are listed on the Supplier's website, see Sub-processors.

3.2 The Supplier shall notify the Customer of new or replaced sub-processors in reasonable time, and as a rule at least 30 days, before the change takes effect. The Customer may object on reasonable grounds. If the parties cannot find a solution, the Customer may terminate the Customer Agreement with effect from the change.

3.3 The Supplier shall impose the same data protection obligations on sub-processors as follow from this DPA, and is liable to the Customer for the sub-processors' performance of them.

4. Location of processing

4.1 Personal data is stored and processed within the EU/EEA. Transfers to countries outside the EU/EEA take place only on a valid transfer basis under Chapter V GDPR.

5. Personal data breaches

5.1 The Supplier shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer. The notice shall, as far as it is known, contain the information the Customer needs to fulfil its obligations under Articles 33 and 34 GDPR.

5.2 The Supplier shall promptly take the measures necessary to limit the consequences, and keep the Customer informed until the incident is closed.

6. Audits

6.1 The Supplier shall make available the information necessary to demonstrate compliance with this DPA.

6.2 The Customer may, itself or through an independent auditor bound by confidentiality, carry out an audit on reasonable notice, at a time agreed between the parties. The Supplier shall contribute to the audit. The audit shall be carried out without undue disruption to the Supplier's operations and at the Customer's cost.

7. Term, deletion and return

7.1 This DPA applies for as long as the Supplier processes personal data on the Customer's behalf.

7.2 When the Customer Agreement ends, the Supplier shall, at the Customer's choice, delete or return the personal data and delete existing copies, unless the law requires them to be retained. The Supplier confirms the deletion in writing on request. Data in backups and logs is deleted when their fixed retention periods expire.

8. Liability and precedence

8.1 Liability under this DPA is governed by the Customer Terms, including the limitations of liability.

8.2 In case of conflict between this DPA and the Customer Agreement or the Customer Terms, this DPA prevails in matters concerning the processing of personal data.

8.3 If the parties have entered into a separate data processing agreement, that agreement prevails over this one.

Appendix 1: The processing

Purpose: To deliver the Service to the Customer, including user access, search, storing and sharing projects within the Customer's organisation, and user support.

Nature of the processing: Collection, storage, structuring, use, sharing within the Customer's organisation and deletion.

Data subjects: The Customer's employees and others the Customer gives access to the Service, and persons referred to in content that users enter themselves.

Categories of personal data:

• User details: name, e-mail address and employer
• Sign-in and security logs
• Information about use of the Service
• Search text
• Project content: saved results, notes and comments

Special categories: The Service is not intended for special categories of personal data under Articles 9 and 10 GDPR, and users should not enter such data in searches or notes.

Duration: The term of the agreement, then as set out in clause 7. User accounts inactive for 24 months are deleted automatically.

Appendix 2: Security measures

• The Service runs on Microsoft Azure within the EU/EEA. Sign-in is handled by Microsoft Entra ID.
• Data is encrypted in transit and at rest.
• Access to Customer Data is limited to a small number of named persons at the Supplier, with multi-factor authentication.
• Customer Data is kept separate between customers and is never added to the search indexes, which contain only public sources.
• Customer Data is kept in the production environment and is not copied to development environments or laptops.
• Data is backed up automatically and can be restored.
• Sign-ins and events in the Service are logged.
• The Supplier has written procedures for handling security incidents, business continuity and recovery.
• The Supplier carries out regular internal security reviews.

More information is on the Security page.

Appendix 3: Sub-processors

See Sub-processors.

These providers process customer data on our behalf when we deliver Reliable. The list forms part of the data processing agreement. We notify customers before we start using new sub-processors.

Providers we use for our own purposes, such as the website, e-mail and customer follow-up, are described in the privacy policy.

Changes

• 15 October 2026: First published version.

Reliable is used by lawyers working on client matters. This page describes how we protect the data in the service.

What the service contains

The search indexes contain only public legal sources. Customer data is never added to the search indexes and never shared between customers. The data we hold about customers is user accounts, sign-in logs, usage data, search text and whatever users save in their projects.

Search text

Each user decides whether their searches are stored, and can switch it off in the service. A customer can also switch storage off for all its users. Stored search text has no name, e-mail address or user ID attached, is deleted or anonymised automatically after at most 90 days, and is not used to train generative AI models.

Search is run by models in our own Azure environment.

Hosting and data location

The service runs on Microsoft Azure, and sign-in is handled by Microsoft Entra ID. All customer data is stored and processed within the EU/EEA. We run no servers of our own, and customer data is never stored on laptops or removable media.

Encryption

All traffic is encrypted, both between the user and the service and within the hosting environment. Data is encrypted at rest.

Access control

Only a small number of named people at Reliable have access to customer data, all with multi-factor authentication and only the access they need. Users see only their own projects and projects that colleagues in the same organisation have shared with them.

Development

Code changes are reviewed and tested before release, and a new version can be rolled back quickly. Customer data stays in the production environment and is never copied to development environments.

Backups and recovery

Data is backed up automatically and can be restored. We have written business continuity, crisis management and disaster recovery plans, which are reviewed regularly.

Incidents

We have a written procedure for handling security incidents. Affected customers are notified without undue delay and kept informed until the incident is closed.

Reviews and certifications

We carry out regular internal security reviews of code, hosting environment, access and third-party components. Reliable AI holds no certifications of its own. Our hosting platform, Microsoft Azure, is certified to standards including ISO/IEC 27001 and SOC 2.

Documentation

For customers and procurement processes, we can provide further security documentation and answer vendor questionnaires. See also the data processing agreement and sub-processors.

Reporting vulnerabilities

If you have found a possible vulnerability, please contact us at hei@reliableai.no. We will respond as quickly as we can.

Reliable AI AS (private limited company, aksjeselskap)

Akersbakken 30, 0172 Oslo, Norway

Organisation number: 934 343 786, registered in the Norwegian Register of Business Enterprises (Brønnøysund Register Centre)

VAT number: NO 934 343 786 MVA

Managing director: Markus Kreutzer

E-mail: hei@reliableai.no