Wavelike Terms of Service

Last updated: November 12, 2026

These Terms of Service (the "Terms") are a binding agreement between Velos Mobile LLC, a California limited liability company ("Velos", "we", "us" or "our"), and the person or entity that accepts them ("you" or "your"). They govern your access to and use of Wavelike.

You accept these Terms by affirmatively agreeing to them through a process that presents these Terms for your review, such as an acceptance checkbox or a button clearly labeled to indicate agreement, or by signing an agreement that incorporates them. If you accept on behalf of a company or other organization, you represent that you have authority to bind it, and "you" refers to that organization. If you do not have that authority, or do not agree, do not access the Services or incorporate the SDK into an application. End Users do not become parties to these Terms merely by using another customer's App.

The Services are intended for businesses and developers, not for personal or household use, and you represent that you are using them for business purposes.

1. Definitions

• "Account" means the Wavelike organization you create or administer, including its members, Apps, credentials and credit balance.
• "App" means an application you configure in the Services, together with the software you build that calls the Services.
• "Customer Data" means Inputs, Outputs and other data that you or your End Users submit to or store in the Services, including request logs captured under your settings. Customer Data does not include Usage Data.
• "Documentation" means the Wavelike documentation we make available at wavelike.ai/docs or in the dashboard, as updated from time to time.
• "End User" means any person or system that uses your App, including app users you register or authenticate through the Services.
• "Input" means any content submitted to the Services for processing, such as prompts, messages, files, images and tool results. "Output" means content the Services return in response to an Input, such as model responses.
• "Model Provider" means a third party whose models or AI services the Services call on your behalf, whether through our provider accounts or through credentials you supply.
• "SDK" means the Wavelike software development kits, including the Wavelike framework for Swift, together with their Documentation and any updates we provide.
• "Services" means the Wavelike dashboard, application programming interfaces, command-line tools, SDKs, Documentation and related services we provide.
• "Usage Data" means data about the operation and use of the Services, such as request counts, token counts, model and provider identifiers, latency, cost, error rates and policy metadata, that the Services generate. Usage Data does not include the content of Inputs or Outputs, or End User records, identifiers or other metadata that you or your End Users supply, which are Customer Data.

2. Accounts

2.1 Eligibility. Each individual who accepts these Terms or uses the Services on your behalf as a member of your organization must be at least 18 years old. End User age requirements are addressed separately in section 4.4. You may not use the Services if you are barred from doing so under applicable law.

2.2 Account information. You must provide accurate and complete registration information and keep it current.

2.3 Responsibility for your Account. You are responsible for activity under your Account, including activity by members of your organization and by anyone using your API keys, tokens or other credentials, except to the extent caused by our breach of these Terms or the DPA, negligence or willful misconduct. You must keep your credentials confidential and must not embed unrestricted credentials in software you distribute. Notify us promptly if you believe your Account or a credential has been compromised.

3. Using the Services

3.1 Access. Subject to these Terms, we grant you a non-exclusive, non-transferable, non-sublicensable right during the term of these Terms to access and use the Services to develop, test and operate your Apps, in accordance with the Documentation.

3.2 Restrictions. You will not, and will not permit anyone else to:

1. copy, modify or create derivative works of the Services, except as these Terms expressly allow;
2. decompile, disassemble, reverse engineer or otherwise attempt to derive the source code or underlying structure of the Services, except to the extent applicable law expressly permits despite this restriction;
3. sell, resell, rent, lease or provide the Services to third parties on a stand-alone basis, except as part of your App;
4. circumvent or interfere with quotas, rate limits, billing, authentication, data-policy enforcement or other technical limits of the Services;
5. access the Services by automated means other than through the APIs, command-line tools, SDKs and other interfaces we provide for that purpose;
6. probe, scan or test the vulnerability of the Services, except under a security research program we publish or with our written permission;
7. interfere with or disrupt the integrity or performance of the Services or of others' use of them;
8. access the Services to build a competing product or service, or to benchmark the Services for publication without our written consent; or
9. remove or obscure any proprietary notice in the Services.

3.3 Acceptable use. You will not use the Services, and will not permit your End Users to use them, to:

1. violate any law or regulation, or infringe, misappropriate or violate anyone's intellectual property, privacy or other rights;
2. generate, store or distribute child sexual abuse material, or content that sexualizes minors;
3. harass, threaten, defame or exploit others, or promote violence or terrorism;
4. create or distribute malware, conduct phishing, gain unauthorized access to systems, or carry out other security attacks;
5. engage in fraud or deceptive practices, including impersonating others or presenting AI-generated content as human-generated where that would mislead;
6. send spam or other unsolicited communications at scale;
7. make automated decisions that have legal or similarly significant effects on individuals, such as decisions about credit, employment, housing, insurance, education or access to essential services, without appropriate human review and any disclosures the law requires; or
8. violate the usage policies of any Model Provider that processes your requests.

3.4 Usage limits. The Services are subject to the usage limits, quotas and rate limits described in the Documentation or shown in the dashboard. We may apply reasonable limits to protect the Services and other customers. Support is provided as available. No service-level agreement, guaranteed support response time or service credits apply unless we expressly agree in a signed writing.

3.5 Beta features and private beta. Services or features identified as beta, preview or experimental before your participation begins ("Beta Features") are for development, testing and evaluation. Production use requires our prior written approval, including by email from an authorized representative, for a limited pilot identifying the Account, Apps, permitted use, duration and limits. Stay within that approval and obtain further written approval before expanding or extending it. Account access, payment or support alone does not approve production use.

Unless expressly agreed in writing, Beta Features have no availability, performance, support-response, maintenance, backward-compatibility or eventual-launch commitment. We may make breaking changes, withdraw pilot approval or end beta access by notifying you, with advance notice where reasonably practicable. This replaces the 30-day convenience-termination notice in section 12.3 only for beta access. It does not shorten notice for non-beta Services, price increases under section 9.7 or amendments under section 16.2. Ending all Services available to your Account is termination under section 12.3; applicable refund rights remain in effect. Maintain appropriate data copies and a plan to stop or replace beta functionality.

Non-public beta information is protected under section 10, including its exceptions. An approved pilot permits disclosure of its functionality to approved End Users as needed for that pilot. Feedback and publicity remain governed by sections 11.2 and 18.5. Dashboard monitoring, including session replay during the beta, is described in sections 2 and 6 of the Privacy Policy. Beta participation or acceptance of these Terms does not replace any consent that the law requires.

Beta status does not reduce our privacy, security, confidentiality, no-training or DPA obligations, applicable privacy rights, refund rights, or the liability limits in section 14. Sections 6.5 and 12.4 govern surviving SDK rights, data return and deletion. Beta qualifications end prospectively when the relevant feature becomes generally available or beta access ends; accrued and surviving obligations remain. We will not apply beta qualifications to existing non-beta use merely by relabeling it.

4. Your Apps and End Users

4.1 Responsibility. You are responsible for your Apps, for how your Apps use the Services, and for your End Users' use of your Apps, including their compliance with these Terms. Any act or omission by an End User that would breach these Terms if done by you is treated as your breach.

4.2 End-user terms and notices. You must make terms of use and a privacy notice available to your End Users that are consistent with these Terms and accurately describe how their data is sent to and processed by us and by Model Providers. You must obtain all consents and provide all disclosures that applicable law and app marketplace rules require for the Customer Data you submit.

4.3 Sensitive data. Except under the exception process below, you will not knowingly submit, and will not design or configure your Apps to collect and submit, to the Services:

1. protected health information subject to the U.S. Health Insurance Portability and Accountability Act;
2. payment card data subject to the Payment Card Industry Data Security Standard;
3. government-issued identification numbers, financial account credentials or similarly sensitive identifiers; or
4. any data whose processing requires a specific agreement or certification that we have not entered into or obtained.

An exception requires a separate agreement signed by both parties that expressly identifies the permitted data, use case and conditions, and our written confirmation that legal and technical review has verified that Wavelike and the relevant providers can support that use. Required agreements, safeguards and any required certifications must be in place before processing begins. Beta enrollment, production-pilot approval, payment, a support request or use of your own provider credentials does not authorize an exception. No exception permits processing prohibited by applicable law or binding provider requirements. These restrictions do not prevent payment through our designated billing processor using its intended payment flow; do not put payment-card details in prompts, logs or support messages.

4.4 Children. You are responsible for determining your Apps' audiences and for complying with applicable children's privacy and safety laws in connection with your Apps and the Customer Data you submit. You must provide all required notices and obtain all required consents and authorizations, including verifiable parental consent where required, before the relevant collection, use or disclosure. You must comply with applicable Model Provider age and use restrictions and the data restrictions in section 4.3. You may not submit children's personal data or enable use by children where prohibited by applicable law or the applicable Model Provider terms. We process personal data on your behalf under the DPA; nothing in this section relieves either party of its own obligations under applicable law or the DPA. The adult eligibility requirement in section 2.1 applies to customer personnel, not automatically to your Apps' End Users.

5. Model Providers and Third-Party Services

5.1 Model Providers. The Services route requests to the Model Providers selected in your configuration. Model Providers are third parties that operate their own models; we do not warrant their Outputs or continued model availability. This allocation of responsibility for model behavior does not determine a provider's status as a subprocessor or reduce our obligations under the Data Processing Addendum or applicable law. You will comply with the applicable terms and usage policies of each Model Provider that processes your requests. Each Model Provider publishes its own terms and usage policies, and you are responsible for reviewing those that apply to the models you select. Model Providers may change, restrict or withdraw models, and we may do the same in the Services, subject to our obligations under these Terms.

5.2 Your provider credentials. If you configure the Services with your own credentials for a Model Provider, your use of that provider is also governed by your agreement with it, and you are responsible for the charges it bills you. You authorize us to use those credentials to process requests on your behalf.

5.3 Third-party services. The Services may interoperate with other third-party services you choose to connect, such as tool servers and identity providers. Your use of them is governed by their terms. We do not control their independent services; this does not limit our responsibilities for our own integration, processing or subprocessor obligations under the Data Processing Addendum or applicable law.

6. The SDK

6.1 License. Subject to these Terms, we grant you during the term of these Terms a non-exclusive, worldwide, royalty-free, non-transferable license, which you may not sublicense except as this section 6.1 allows, to:

1. install, use, reproduce and, where supplied in source form, compile the SDK to develop, test and operate your Apps; and
2. distribute the SDK in object-code form, including object code produced by permitted compilation, without other modification, solely as incorporated into and as part of your Apps, directly or through app marketplaces and other distributors, and permit End Users to use it as part of your Apps under terms that comply with section 6.3,

in each case solely to enable your Apps to access the Services, except for the limited rights that survive termination under section 6.5.

6.2 Restrictions. You will not:

1. distribute the SDK on a stand-alone basis or as part of any software development kit, library, framework or developer tool;
2. modify, decompile, disassemble, reverse engineer or otherwise attempt to derive the source code of the SDK, except to the extent applicable law expressly permits despite this restriction;
3. remove, alter or obscure any proprietary notice in the SDK; or
4. use the SDK to access any service other than the Services.

6.3 End-user terms. The terms under which you distribute your Apps must protect the SDK at least as well as this section 6 does, must disclaim on our behalf all warranties and liability to End Users to the extent the law allows, and must not purport to make any commitment on our behalf.

6.4 Open-source components. The SDK may include or depend on components licensed under open-source licenses, which are identified in the notices accompanying the SDK. Those licenses govern those components, and nothing in these Terms limits your rights under them.

6.5 Rights after termination. When these Terms terminate, the license in section 6.1 ends except for the following limited rights. You may continue to reproduce and distribute, without a removal deadline, SDK versions lawfully incorporated into your Apps before termination, solely in object-code form as part of those same Apps. This includes later releases of those Apps that retain those SDK versions and distribution to existing or new End Users. Where an SDK version was supplied in source form, you may retain and compile that version only as needed to exercise these surviving rights. End Users may continue to use the SDK as part of those Apps, subject to the limits below.

These surviving rights remain subject to sections 6.2 through 6.4, including the restrictions on SDK modification and stand-alone distribution, preservation of proprietary notices and applicable End User terms. They do not authorize integrating the SDK into new Apps or adding SDK versions not already integrated before termination. Rights independently granted under an open-source license remain governed by that license as described in section 6.4.

Continued distribution or possession of SDK code does not grant continued access to the Services or APIs after termination, or any right to bypass disabled credentials or other access controls. We have no obligation under these surviving rights to provide hosting, support, maintenance or SDK updates. You are responsible for ensuring that continued distribution and use comply with applicable law.

7. Customer Data

7.1 Ownership. As between you and us, you retain all rights in your Customer Data. To the extent we have any rights in Outputs, we assign them to you. You acknowledge that Outputs may not be unique, that other users may receive similar Outputs, and that a Model Provider's terms may affect your rights in Outputs.

7.2 License to us. You grant us a worldwide, non-exclusive, royalty-free license to host, copy, transmit, process and display Customer Data as necessary to provide, secure, maintain and support the Services, including to transmit Inputs to the Model Providers your requests reach, and as required by law.

7.3 No training by Wavelike. We do not use Customer Data to train or fine-tune machine-learning models.

7.4 AI data policies. The Services let you set data-handling policies for an App or a request, such as a policy that requires routes whose Model Providers do not train on Inputs, or a policy that requires zero retention, as described in the Documentation. When a policy applies, we route the request only to Model Providers and configurations that satisfy it, based on the providers' published terms and any attestations recorded in the Services, and we refuse requests that no available route can satisfy. If you record in the Services that credentials you supply are covered by no-training or zero-retention terms with a Model Provider, you are responsible for the accuracy of that record, and we rely on it without verifying it. A Model Provider's handling of Inputs is otherwise governed by the applicable provider arrangements. We do not control its independent operations, but this does not limit our obligations for selecting and engaging subprocessors, our routing commitments, or our responsibilities under the Data Processing Addendum or applicable law.

7.5 Logging and retention. We record request metadata, including model, usage, cost and timing. Request and response content is captured according to your capture settings. Dashboard test runs capture content even when ordinary capture is disabled, unless zero retention applies. Retention follows the applicable settings and the criteria in section 7 of the Privacy Policy.

We may temporarily cache responses to serve repeated requests; caches expire no later than the applicable content-retention deadline. Zero retention overrides ordinary capture, dashboard test capture and response caching. It permits transient processing needed to answer a request and retention of metadata, End User records, and billing or security records that do not contain request or response content.

The Privacy Policy describes analytics, diagnostic retention and isolated backup handling. The DPA governs deletion and return of personal data processed on your behalf. Model-provider retention is governed by the applicable provider arrangements and our routing commitments in section 7.4. None of these provisions permits using telemetry or backups to bypass a zero-retention policy.

7.6 Usage Data. We may collect and use Usage Data to operate, secure, bill for, support and improve the Services. We may produce anonymous aggregate statistics for internal product improvement and business reporting, and retain them after deleting the underlying records, only after verifying that they cannot reasonably identify an individual or customer organization, including through combination with other reasonably available information. We retain those statistics only while useful for these purposes and periodically review their continued need and anonymity. The retained statistics exclude prompts, responses, session replays, credentials and identifiable activity histories. Creating statistics does not extend retention of the underlying records. This permission does not authorize model training, sale of the statistics or public customer benchmarking. Usage Data may be personal data when linked to an identifiable person. Its contractual classification does not remove protections under applicable privacy law. The Privacy Policy describes our independent processing purposes; the Data Processing Addendum applies to personal data we process on your behalf, including Usage Data to the extent processed in that role. This section does not authorize using Customer Data for model training or purposes outside section 7.2 and the Data Processing Addendum.

7.7 Your responsibilities. You represent that you have all rights, consents and authorizations needed to submit Customer Data to the Services and to have it processed as these Terms describe. You are responsible for the accuracy, quality and legality of Customer Data.

7.8 Personnel access. Our personnel may view Customer Data, including Inputs and Outputs, only as reasonably necessary to follow your authorized instructions, resolve a support issue you raise, protect security or service integrity, investigate suspected abuse, or comply with legal obligations. A support request from you or a person authorized to act for you authorizes access reasonably necessary to investigate and resolve that issue, without separate approval for each investigative step. It does not authorize unrelated access; that requires separate authorization unless one of the security, service-integrity, abuse or legal exceptions above applies.

Access is limited to authorized personnel with a need to know, subject to confidentiality obligations, restricted permissions and access records. We do not routinely review customer prompts or responses for product research. This section does not expand the purposes permitted under section 7.2 or the DPA, authorize model training, extend retention, override zero-retention settings, or permit ordinary support access to isolated backups. Dashboard session replay remains subject to the separate rules in the Privacy Policy.

8. Privacy and Security

8.1 Privacy Policy. Our Privacy Policy describes how we handle personal data about you and the people who use the dashboard on your behalf.

8.2 Data Processing Addendum. Schedule A below is our Data Processing Addendum ("DPA") and forms part of these Terms. It applies without a separate request when we process personal data on your behalf as a processor, subprocessor or service provider. The subprocessor register is in section 5 of the Privacy Policy. Changes to the DPA follow section 16.2 and applicable law; subprocessor changes follow section 8.4. Replacing a linked document alone does not amend these obligations.

8.3 Security. We maintain reasonable administrative, technical and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure or loss. Captured request and response payloads are stored encrypted with a key specific to your organization; section 3 of the Privacy Policy describes the searchable extract we keep alongside them. We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf. Our initial notice will include information then available; we will not wait for a completed investigation to notify you. We will provide further relevant information without undue further delay as it becomes available, and provide cooperation as required by the DPA and applicable law. Any stricter notification requirement under applicable law, the DPA or a separately agreed contract takes precedence.

8.4 Subprocessors. Subject to the DPA, you give general authorization for the subprocessors identified in the published list referenced in section 8.2 to process personal data on your behalf for the listed purposes. We will maintain that list and email affected customers at least 30 days before an added or replacement subprocessor begins processing their personal data. You may object in writing during that notice period on reasonable data-protection grounds, explaining the concern through the legal-notice channel in section 18.3. Updating the list alone does not replace this notice or the opportunity to object.

We will work with you in good faith to address a timely objection, including by seeking a reasonable alternative. If we have not resolved it within 30 days after receiving it, or either party reasonably concludes sooner that no suitable alternative is available, either party may terminate the affected Services by written notice. You may instead close your Account if the remaining Services no longer meet your needs. We will refund unused prepaid amounts allocated to the terminated Services, or your full unused purchased credit balance if you close the Account. A shared balance not allocated to specific Services remains available for the remaining Services unless you elect to close the Account and receive its unused purchased balance. Section 12.3 governs refund timing and section 9.9 governs fee and tax treatment; credits refunded are removed and cannot also be spent. We will not begin the objected-to processing for you while a timely objection remains unresolved. If no suitable alternative is available, the affected processing must cease; we need not continue an unavailable or unsafe service during resolution.

This authorization does not override your model-routing selections, data policies or approved sensitive-data restrictions. The DPA and mandatory data-transfer provisions govern where they impose additional or overriding requirements. You may specifically authorize an earlier start for an identified new subprocessor, including one needed for an optional integration you request, after receiving its identity, purpose and relevant processing information. Enabling a feature without that disclosure is not specific authorization. An emergency does not automatically waive these requirements: if timely lawful authorization is unavailable, we may suspend the affected processing under section 12.2 while resolving the issue.

9. Fees and Payment

9.1 Prepaid credits. Requests that use our Model Provider accounts are charged against your organization's prepaid credit balance at the prices shown in the dashboard or the Documentation at the time of the request. The Services may decline requests when your balance is insufficient. Some charges are determined only after a request completes, so your balance may become negative. You must pay any negative balance, and we may deduct it from credits you later purchase or charge it to your payment method. Credit purchases may include a fee. We show the total you will be charged before you pay.

9.2 Automatic recharge. If you enable automatic recharge, you authorize us and our payment processor to charge your saved payment method, whenever your balance falls to or below the threshold you set, the amount needed to restore your balance to the target you set, subject to any minimum purchase and purchase fee we have disclosed to you and to the monthly limit you set, until you disable automatic recharge. The limit applies to the total amount charged, including any purchase fee, and resets at the start of each calendar month in UTC. A recharge that would exceed the limit is reduced to fit within it, so it may not restore your balance to the target. The limit governs automatic credit purchases, not total service usage, manual purchases or settlement of amounts already owed under section 9.1. Disabling recharge stops future automatic purchases but does not reverse completed charges.

9.3 Your provider credentials. Requests that use your own Model Provider credentials are billed to you directly by that provider. Any fees we charge for those requests are shown in the dashboard or the Documentation before they apply.

9.4 Payment processing. We use Stripe, Inc. to process payments. You authorize us and Stripe to charge your payment method for amounts due under these Terms, and you agree to keep your payment information current.

9.5 Credits. Purchased credits do not expire while your Account remains open. Promotional or free credits expire as stated when they are granted. Credits have no cash value, cannot be transferred, and are non-refundable, except as sections 8.4, 9.9 and 12.3 or applicable law provide. Credits are used only to pay for the Services. Where we need to determine which credits a charge used, for example to calculate a refund, we treat promotional credits as used before purchased credits, earliest expiry first, and purchased credits as used oldest purchase first. Credits do not lock in a token quantity or a price for future requests.

9.6 Taxes. Prices do not include taxes. You are responsible for all sales, use, value-added and similar taxes associated with your purchases, other than taxes based on our net income. Where we are required to collect taxes, we will add them to your charges.

9.7 Price changes. We will email affected customers at least 30 days before increasing Wavelike-controlled prices for existing Services, including Beta Features. We may use a shorter period solely to pass through an increase in a Model Provider's cost for the same service, without increasing our markup. We will email affected customers before that change applies, give as much advance notice as practicable, identify the affected rates and effective time, and show the new rates in the dashboard or Documentation. Our own markup increases remain subject to 30 days' notice. Price reductions may take effect sooner.

Prices for new optional models or features are disclosed before you elect to use them; no advance waiting period applies. A price change never applies to a request made before its effective time, including usage billed later. These notices also apply to Accounts with automatic recharge. You may stop affected usage and disable recharge before the change takes effect; disabling recharge alone does not stop usage or change existing payment obligations. Price changes alone do not create a refund right beyond sections 8.4, 9.9, 12.3 or applicable law.

9.8 Disputed charges. Please notify us of a suspected billing error within 60 days of the charge so we can investigate promptly. This period does not shorten any non-waivable statutory or payment-provider dispute rights. We encourage you to contact us first, but do not require you to forgo a lawful chargeback or other remedy. We will not suspend your Account solely because you raise a good-faith billing dispute or exercise those rights. We may suspend access for unpaid undisputed amounts or reasonably suspected fraud under section 12.2.

9.9 Purchase refund window. You may request a refund of the unused portion of each purchase of credits, including an automatic recharge, within 24 hours after the payment is successfully processed. You do not need to close your Account. Submit your request to billing@wavelike.ai and identify the purchase you want refunded. The 24-hour period is measured from the successful payment timestamp to the time we receive your request through that channel, not to when we review or process it. A timely request remains eligible if we need additional information afterward to verify your authority or identify the transaction.

Only purchased credits attributable to that transaction that remain unused when we process the refund are refundable, after accounting for usage already incurred but not yet posted. Continued usage after your request may reduce the refundable amount. We remove the corresponding credits from your balance when processing the refund so they cannot also be spent. Promotional or free credits are not refundable. We will initiate an eligible refund within 30 days after receiving your request, ordinarily to the original payment method; your payment provider may take additional time to make the funds available. The same credits cannot be refunded more than once under this section, section 8.4 or section 12.3.

Separately disclosed purchase fees are non-refundable to the extent permitted by applicable law, including for refunds under this section, section 8.4 or section 12.3. We adjust related taxes and refund fees where applicable law requires. We do not impose an additional refund-processing fee or deduct undisclosed charges from the unused credit amount otherwise refundable.

After this 24-hour window, the refund rights in sections 8.4 and 12.3 and any rights required by applicable law remain available. This window does not shorten the billing-dispute process in section 9.8 or any non-waivable rights.

10. Confidentiality

10.1 Definition. "Confidential Information" means non-public information that one party (the "Discloser") discloses to the other (the "Recipient") in connection with these Terms that is marked confidential or that a reasonable person would understand to be confidential. Customer Data is your Confidential Information. The non-public aspects of the Services, such as the SDK's internal design and any non-public Documentation, are our Confidential Information.

10.2 Exclusions. Confidential Information does not include information that is or becomes public through no fault of the Recipient, was known to the Recipient without restriction before receipt, is independently developed by the Recipient without use of the Discloser's information, or is rightfully received from a third party without a duty of confidentiality.

10.3 Obligations. The Recipient will use Confidential Information only to exercise its rights and perform its obligations under these Terms, will disclose it only to its employees, contractors and advisors who need to know it and are bound by confidentiality obligations at least as protective as these, and will protect it with at least reasonable care. We may also disclose Customer Data as section 7.2 permits, including to the Model Providers your requests reach and to our subprocessors under the Data Processing Addendum.

10.4 Compelled disclosure. The Recipient may disclose Confidential Information when required by law, after giving the Discloser prompt notice where legally permitted and reasonable assistance, at the Discloser's expense, if it seeks to limit the disclosure.

11. Intellectual Property and Feedback

11.1 Our rights. We and our licensors own all rights, title and interest in and to the Services, including the SDK, and all improvements and derivative works of them, but not your Apps or Customer Data. Except for the rights expressly granted in these Terms, we reserve all rights.

11.2 Feedback. If you give us suggestions, ideas or other feedback about the Services, we may use them for any purpose without restriction or obligation to you. This permission does not extend to Customer Data, personal information or your Confidential Information included with feedback; their use remains subject to the other provisions of these Terms, the Privacy Policy and the DPA, as applicable.

12. Term, Suspension and Termination

12.1 Term. These Terms begin when you first accept them and continue until terminated as described below.

12.2 Suspension. We may suspend your access to all or part of the Services immediately if we reasonably believe that (a) your use breaches section 3, 4 or 6; (b) your use poses a security risk to the Services or to others; (c) your use could subject us, a Model Provider or a third party to liability; (d) your Account has an unpaid, undisputed balance; or (e) activity under your Account involves reasonably suspected fraud. Section 9.8 protects good-faith billing disputes. Where practicable, we will notify you in advance, limit suspension to what is reasonably necessary, and restore access promptly once the cause is resolved. A billing dispute does not require us to extend additional credit for new requests.

12.3 Termination. You may terminate these Terms at any time by closing your Account. We may terminate these Terms (a) for convenience on 30 days' notice; (b) if you materially breach these Terms and fail to cure the breach within 30 days of notice; or (c) immediately on notice if you materially breach section 3.3, 6.2 or 18.1, or commit a material breach that cannot be cured. Section 3.5 governs notice for ending beta access and withdrawing pilot approval, without reducing the refund rights below.

We will refund your unused purchased credit balance if we terminate for convenience or discontinue the Services, or if you terminate because:

1. we materially breach these Terms and fail to cure within 30 days after your written notice, or our material breach cannot be cured; or
2. you reject a change under section 16.2 that materially reduces your rights or increases your obligations, or a change under section 16.1 materially reduces core functionality, and you notify us and close your Account within 30 days after the later of notice of the change or its effective date.

We will initiate a termination refund, including one under section 8.4, within 30 days after termination of the affected Services or Account, ordinarily to the original payment method. Promotional or free credits are not refundable. Outside these circumstances, unused credits are forfeited on Account closure or termination, subject to the subprocessor-change rights in section 8.4, the purchase-refund right in section 9.9 and applicable law. Closing an Account does not invalidate that right or a timely refund request. Termination does not eliminate amounts properly owed for Services already provided. Purchase-fee and related tax treatment follows section 9.9.

12.4 Effect of termination. On termination, your right to use the Services and APIs ends, and any amounts owed become due. The limited SDK rights in section 6.5 survive without extending service or API access. For 30 days after termination you may request export of Customer Data that the Services still hold, subject to the return and deletion provisions of the DPA. This opportunity does not extend a shorter configured retention period, require retention contrary to your instructions or recreate data already deleted. We will delete remaining Customer Data after that period in accordance with the DPA, unless earlier deletion is required by your instructions or applicable law. Residual backups follow the isolation, expiry and restoration rules in section 7 of the Privacy Policy and the DPA. Legally required retention is limited to the affected information and purpose. Neither exception authorizes unrelated use.

Sections 1, 6.2 through 6.5 and 7.1 survive termination. Sections 7.2 through 7.5, 7.8, 8.2 through 8.4 and Schedule A survive for as long as we hold Customer Data or personal data processed on your behalf. Sections 7.6, 7.7, 9 (as to accrued payment obligations, billing disputes and refund rights), 10, 11, 12.3 (as to refunds and forfeiture), 12.4, 13 through 15, 17 and 18 also survive termination.

13. Disclaimers

13.1 General. THE SERVICES, THE SDK AND ALL OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT PERMITTED BY LAW, WE AND OUR LICENSORS DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE, OR THAT ANY MODEL WILL REMAIN AVAILABLE. THESE DISCLAIMERS DO NOT NEGATE OUR EXPRESS OBLIGATIONS UNDER THESE TERMS OR THE DATA PROCESSING ADDENDUM.

13.2 AI Outputs. Outputs are generated by machine-learning models and may be inaccurate, incomplete, biased, offensive or otherwise unsuitable. You are responsible for evaluating Outputs before relying on them, for how your Apps present them to End Users, and for implementing appropriate human review. Outputs do not constitute professional advice.

14. Limitation of Liability

14.1 Exclusion of damages. TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL OR DATA, ARISING OUT OF OR RELATING TO THESE TERMS, EVEN IF ADVISED OF THEIR POSSIBILITY.

14.2 Cap. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID US UNDER THESE TERMS IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY AND (B) US$100.

14.3 Exceptions. Sections 14.1 and 14.2 do not limit your obligation to pay amounts properly due, your liability for breach of sections 3.2, 3.3 or 6.2, or your obligations under section 15. They do not reduce refunds expressly owed under these Terms. Our liability remains subject to sections 14.1 and 14.2, including for confidentiality, security and DPA claims, except as section 14.5 or mandatory data-transfer provisions require otherwise. A different cap requires a separate signed agreement.

14.4 Basis of the bargain. The parties agree that these limitations are an essential element of the bargain between them and apply even if a limited remedy fails of its essential purpose.

14.5 Non-excludable liability. Nothing in these Terms limits either party's liability for fraud, gross negligence or willful misconduct, or any liability that cannot be limited under applicable law. Nothing in this section limits rights of data subjects or regulatory powers that the parties cannot contractually restrict.

15. Indemnification

You will defend Velos and its affiliates, and their officers, employees and agents, against any third-party claim arising out of (a) your Apps, (b) your Customer Data, or (c) your or your End Users' use of the Services in breach of these Terms or applicable law, and will pay any damages, costs and reasonable attorneys' fees finally awarded against them or agreed in a settlement you approve. We will give you prompt notice of the claim (delay relieves you only to the extent it materially prejudices the defense), sole control of its defense and settlement (except that you may not settle a claim that imposes any obligation on us without our consent), and reasonable cooperation at your expense. Your obligations do not apply to the extent a claim results from our breach of these Terms or the DPA, our negligence or willful misconduct, or infringement by the Services themselves. A claim based solely on an unmodified Output is not covered unless it results from infringing or unlawful Inputs you supplied, your prohibited use, or your other breach of these Terms. This exclusion does not itself create an indemnity obligation for us.

These Terms do not require us to defend or indemnify you against intellectual property claims concerning the Services, the SDK or Outputs. Any such obligation must be expressly set out in a separately negotiated written agreement signed by you and us. This does not eliminate our other express obligations under these Terms or the DPA, or any liability that cannot be excluded under applicable law.

16. Changes

16.1 Changes to the Services. We may change the Services from time to time. If a change materially reduces the core functionality of the Services, we will give you reasonable notice where practicable. Section 12.3 describes your termination and refund rights for a material reduction in core functionality.

16.2 Changes to these Terms. We may update these Terms. We will post updated Terms at wavelike.ai/terms and change the "Last updated" date and identify their effective date. If an update materially reduces your rights or increases your obligations, we will notify you by email at least 30 days before it takes effect, and may also notify you in the dashboard. A shorter period applies only to the extent required by law or to terms solely concerning a new optional feature that you elect to use; new-feature changes do not accelerate changes to rights or obligations for existing features.

Where applicable law requires affirmative acceptance, we will obtain it before applying the update to you. Otherwise, your continued use after the effective date and the required notice constitutes acceptance to the extent permitted by law. If you do not agree, stop using the Services and close your Account; section 12.3 provides refund rights for qualifying changes. An update does not retroactively change accrued claims or charges for Services already provided.

17. Governing Law and Disputes

17.1 Informal resolution. Before filing a claim, other than a claim for equitable relief under section 17.3 or to collect amounts due, a party will give the other written notice of the dispute under section 18.3, and the parties will try to resolve it by negotiating in good faith for at least 30 days from that notice. Limitation periods are tolled during that period.

17.2 Governing law. These Terms are governed by the laws of the State of California, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

17.3 Venue. The state and federal courts located in San Francisco County, California have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each party consents to their personal jurisdiction. Either party may nonetheless seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

17.4 Preserved rights. These Terms do not require mandatory arbitration or waive class-action rights. Nothing in this section overrides rights or protections that applicable law does not allow the parties to waive, including any right to bring a claim in another court or to complain to or cooperate with a regulator. The informal-resolution process does not delay privacy-rights requests or regulatory complaints, prevent a filing needed to preserve a claim, or override applicable deadlines. It does not displace rights or remedies under mandatory data-transfer clauses incorporated into the Data Processing Addendum.

18. General

18.1 Export and sanctions. You will comply with all applicable export-control and sanctions laws. You represent that you are not located in, and will not make the Services available to anyone located in, a country or region subject to comprehensive U.S. sanctions, and that you are not on a U.S. government restricted-party list. You will not knowingly make the Services available to anyone on such a list.

18.2 Assignment. Neither party may assign these Terms without the other's prior written consent, except that either party may assign them without consent to a successor in a merger, acquisition, corporate reorganization or sale of all or substantially all of its relevant business or assets. Any other attempted assignment is void.

18.3 Notices. We may give notices to the email address associated with your Account or through the dashboard, except where a specific provision requires a particular method or advance notice. You may send legal notices to the legal-notice email or postal address in the Contact section below. Email notices are effective when delivered, provided no delivery failure is received; permitted dashboard notices are effective when posted. Postal notices are effective on receipt. These rules do not shorten any required advance-notice period or replace any method required by applicable law.

18.4 Electronic communications. You consent to receive communications from us electronically, and agree that electronic communications satisfy any legal requirement that a communication be in writing.

18.5 Publicity. We may publicly identify you as a customer or beta participant, or use your name or logo in marketing materials, only with your prior written permission from an authorized representative, including by email. We will use that permission only within its agreed scope and follow any agreed brand guidelines. Accepting these Terms, joining the beta or receiving production-pilot approval does not itself grant publicity permission. Declining permission does not affect your access to the Services or eligibility for a pilot.

You may withdraw permission at any time by notifying us under section 18.3 or by replying to the correspondence in which permission was obtained. Upon receipt, we will promptly stop new uses and, within 30 days, remove your identification, name and logo from marketing materials under our control. We are not required to recall printed materials already distributed before withdrawal, but will stop further distribution of printed materials containing them. We do not control copies independently retained or republished by third parties. These withdrawal and removal obligations continue after termination of these Terms.

18.6 Force majeure. Neither party is liable for any delay or failure to perform, other than a payment obligation, caused by events beyond its reasonable control, including outages of Model Providers, hosting providers or telecommunications networks that the affected party could not reasonably prevent or mitigate. The affected party will give notice where practicable and take reasonable steps to mitigate the effects. This provision does not waive data-protection or security obligations, excuse failure to maintain agreed safeguards, or remove refund and termination rights under these Terms or mandatory law.

18.7 U.S. government users. The Services and the SDK are "commercial products", and the SDK is "commercial computer software", as defined in FAR 2.101 and DFARS 252.227-7014. U.S. government users acquire only the rights set out in these Terms, consistent with FAR 12.212 and DFARS 227.7202.

18.8 Relationship of the parties. The parties are independent contractors. These Terms do not create a partnership, joint venture, agency or employment relationship, and, except for the persons indemnified under section 15 or rights required by applicable law or mandatory data-transfer clauses, there are no third-party beneficiaries of these Terms.

18.9 Entire agreement and precedence. These Terms, together with the documents they incorporate by reference, are the entire agreement between the parties about their subject matter and supersede all prior agreements and understandings about it. If you and we have signed a separate agreement covering the Services, that agreement controls where it conflicts with these Terms. The Data Processing Addendum controls over these Terms as to the processing of personal data. If these Terms conflict with the Documentation, these Terms control. Nothing in these Terms excludes mandatory consumer or other statutory protections that apply to you and cannot lawfully be waived, regardless of how your use is labeled.

18.10 Severability and waiver. If any provision of these Terms is held unenforceable, it will be enforced to the maximum extent permissible and the remaining provisions will remain in effect. A party's failure to enforce a provision is not a waiver of its right to do so later.

18.11 Interpretation. Headings are for convenience only. "Including" means "including without limitation".

Contact

Legal-notice email: legal@wavelike.ai
Billing and refunds: billing@wavelike.ai

Privacy rights requests use the contact methods in section 13 of the Privacy Policy.

Velos Mobile LLC
3130 20th Street, Suite 100
San Francisco, CA 94110

Schedule A — Data Processing Addendum

A.1 Scope and roles. This DPA is part of the Terms and has the same effective date. It governs personal data in Customer Data and any Usage Data we process on your behalf ("Customer Personal Data"). You are the controller, or a processor authorized by your controller to appoint us; we are your processor or subprocessor. For independently determined processing of business contacts, billing and service administration information, the Privacy Policy describes our controller purposes. Neither those descriptions nor a data label permit us to repurpose Customer Personal Data. Each party will comply with data-protection laws applicable to its role and processing. Mandatory transfer clauses prevail over this DPA; this DPA prevails over conflicting Terms concerning personal-data processing.

A.2 Processing details. The subject matter is operation of Wavelike for your Apps. Processing is continuous or on demand during the Services and limited return, deletion and legally required retention afterward. You determine the permitted content, data subjects and uses through your Apps, instructions and settings.

A.3 Instructions and customer responsibilities. Your documented instructions consist of this DPA, the Terms, your permitted settings and requests, and additional written instructions we agree to implement. We will process Customer Personal Data only on those instructions, including for transfers, unless applicable law requires otherwise. Where legally permitted, we will inform you of that legal requirement before processing. We will promptly inform you if, in our opinion, an instruction infringes applicable data-protection law and may suspend the affected processing until the issue is resolved. We will not treat refusal of an unlawful instruction as permission to process for another purpose. You are responsible for lawful instructions, authority from any controller you represent, notices, permissions and data minimization. Instructions beyond the agreed Services may require a separate agreement, but this does not restrict mandatory assistance obligations.

A.4 Confidentiality and security. Personnel authorized to process Customer Personal Data must be subject to confidentiality duties. We will maintain measures appropriate to the risk, including encryption in transit and of captured payloads at rest; restricted personnel access and access records under section 7.8; logical separation of customer access; credential protection; vulnerability and change management; incident response; and backup, restoration and deletion procedures consistent with Privacy section 7. We will assess and test the effectiveness of the safeguards and may update them without materially reducing the agreed protection. No certification, independent audit report, dedicated environment or particular data residency is promised unless separately agreed in writing.

A.5 Subprocessors. Section 8.4 and the register in Privacy section 5 govern authorization and changes. Before a subprocessor processes Customer Personal Data, we will enter into a written contract requiring the applicable protections imposed on us by this DPA, including confidentiality, security, permitted use and assistance. We remain responsible to you for its performance of those obligations. You are responsible for providers you engage independently, but use of your credentials alone does not establish that a provider is independent or release us from duties for our own processing or selection of subprocessors.

A.6 Individual rights and compliance assistance. Taking account of the nature of processing and information available to us, we will provide appropriate technical and organizational assistance with individual requests, security obligations, breach response, data-protection impact assessments and required regulator consultations. If we receive a request concerning Customer Personal Data, we will promptly refer it to you and assist rather than substantively responding on your behalf without instructions, except where law requires. We may charge reasonable, pre-agreed fees for assistance beyond standard functionality where lawful, but not to remedy our breach or as a condition that prevents legally required assistance.

A.7 Personal data breaches. A personal data breach includes a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. We will investigate, take appropriate containment and mitigation steps, and notify you as section 8.3 requires. Information provided as available will include the nature of the breach, affected data and people, likely consequences, measures taken or proposed and a contact for follow-up. We will cooperate with your lawful notification duties and retain necessary incident records subject to applicable retention requirements. Notice is not an admission of liability. We retain our own legal notification duties.

A.8 Demonstrating compliance. We will make available information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections by you or an independent auditor you appoint. Start with available documentation and remote review where sufficient. Reviews are subject to reasonable confidentiality, security, scope and scheduling protections for our systems and other customers, and ordinarily reasonable advance notice and no more than once annually. Those arrangements do not restrict a regulator, mandatory rights, or additional or urgent review reasonably necessary following a breach or credible compliance concern. You bear your review costs and any reasonable assistance fees agreed in advance where lawful, except costs attributable to establishing or remedying our material noncompliance. We do not promise that a SOC 2 or other independent assurance report exists or that a report replaces mandatory audit rights.

A.9 Return and deletion. At the end of the relevant Services, you may choose return of available Customer Personal Data followed by deletion, or deletion without return, subject to section 12.4. We will also implement lawful earlier deletion instructions. We will delete copies, including through applicable backup expiry, except where law requires preservation. Preserved data remains protected and restricted to the required purpose. Existing shorter retention, zero retention and backup isolation rules continue to apply; no export period recreates deleted data or authorizes additional collection. We will provide written confirmation of completed deletion on reasonable request, accurately identifying any lawful preservation or backup expiry still pending.

A.10 International transfers. We will make restricted transfers only after applicable safeguards are in place, including any necessary transfer assessment, supplementary measures and legally effective transfer mechanism covering both our receipt and onward transfers. The applicable mechanism must identify the parties, roles, transfers, recipients and safeguards and include any required completed annexes. Signing these Terms alone does not create an adequacy decision or establish that an uncompleted transfer mechanism is effective. We will provide relevant safeguard information on request subject to lawful confidentiality protections. During the private beta, no transfer mechanism under EEA, UK or Swiss data-protection law is in place between you and us. Do not submit Customer Personal Data whose transfer to us those laws restrict unless we have first agreed a transfer mechanism with you in writing. To ask for one, write to the legal-notice email in the Contact section.

A.11 U.S. state service-provider provisions. Where applicable U.S. privacy law treats us as your service provider or contractor, we process Customer Personal Data for the specified business purposes in A.2 and as otherwise permitted by that law. We will not sell or share it for cross-context behavioral advertising, retain, use or disclose it outside those purposes or our direct business relationship, or combine it with personal information from other sources except as legally permitted. We will comply with applicable obligations, provide the same level of protection required by those laws, and notify you if we determine we can no longer do so. You may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized use. We certify that we understand and will comply with these restrictions. This paragraph does not expand processing permissions under the rest of the DPA.