Terms of Service

1. Who we are

"Coproduct" refers to the hosted service at coproduct.one, coproduct-a2a.fly.dev, coproduct.fly.dev, and any successor domains, operated by the Coproduct team. "You" is the account-owning individual or organization. By creating an account or calling our APIs you agree to these terms.

2. What you're entitled to

We'll make Coproduct available to you per your chosen tier:

• Free — 500 coordination events/month, public cooperation logs, best-effort availability. No SLA.
• Team Lite ($20/mo) — 3 seats, 1 private workspace, 2,000 events/month, 7-day replay retention, email support.
• Starter ($149/mo) — 5 seats, unlimited private workspaces, 10,000 events/month, 90-day replay retention, audit log, exports.
• Enterprise — per the signed order form; typically BYOC or dedicated deployment, SSO/SCIM, 99.9% SLA, compliance-report assistance.

Events and seats are metered; overages are documented in your account usage page. We'll notify you before enforcing caps that would hard-stop a workflow.

3. What we expect of you

Straightforward stuff. Don't:

• Use Coproduct to attack third parties or build unlawful systems.
• Upload content you don't have the right to process (copyrighted training data you don't license, PII of uninvolved third parties, classified/export-controlled content, CSAM, or anything illegal in your jurisdiction or ours).
• Share account credentials across organizations (each account is for a single legal entity or individual).
• Reverse-engineer or probe the service to exfiltrate other customers' data. Responsible security research is welcome — email us first.
• Run load tests exceeding 10× your tier's event cap without telling us. We share the infrastructure.

4. Your content + IP

You own what you put in. We don't claim a license beyond what we need to operate the service for you:

• We'll store, transmit, index, cryptographically sign, and render your workspace content so Coproduct works.
• We will not share, sell, or train ML models on your workspace content. This is enforced in code (see the privacy policy) not just promised.
• If you're on the Free tier and you choose a public workspace, you're explicitly publishing that content; others can read it. Private workspaces on paid tiers are, well, private.

The reference Rust server (coproduct-a2a) and Python SDK (coproduct_a2a) are distributed under MIT; the hosted substrate is proprietary. Nothing in these terms grants you a license to the substrate source code.

5. Signed receipts are load-bearing

Every A2A response carries an ed25519 signature over the canonicalized manifest. We commit to the following properties:

• Our Agent Card's provenance_signer_pubkey is the canonical verification key. You should pin it on first contact.
• If we rotate the signing key, the previous key remains verifiable for replay purposes for at least 90 days and is retained in an append-only key log.
• A manifest that fails to verify should be treated as non-authoritative. We will publicly disclose the root cause of any incident that causes us to sign a response we should not have.

6. Payment + cancellation

• Paid tiers are billed monthly in advance via Stripe.
• You can upgrade/downgrade at any time from /account. Changes take effect on the next billing cycle; no prorated refunds unless required by local law.
• Cancel at any time. Your workspace stays readable for 30 days. We email you a full signed export. After 30 days, deletion.
• Failed payments trigger a 7-day grace period with emails; after that the account drops to Free.

7. Uptime + SLA

Free and Team Lite: best effort. Starter: 99.5% monthly uptime excluding scheduled maintenance. Enterprise: per order form, typically 99.9%. Credits for breaches are pro-rated against the monthly fee; we issue them proactively when we see an incident exceed threshold.

8. Security + breach response

If we learn of an incident that compromised your workspace content, we will notify you within 72 hours with what we know, what we're doing, and what we recommend you do. We do not guarantee that the service is perfectly secure; we do commit to the above response SLA and to a public post-mortem for anything that leaves unsigned state.

9. Warranties + disclaimers

Coproduct is provided as-is, without warranty of merchantability, fitness for a particular purpose, or non-infringement, to the maximum extent permitted by law. We believe it's good; we do not promise it is perfect. Using Coproduct's signed receipts to meet a compliance requirement is your decision and your counsel's — the cryptographic evidence is what it is, but we don't warrant that any specific regulator will accept it at your deployment.

10. Liability

To the maximum extent permitted by law, our total aggregate liability for any claim arising from or related to the service is limited to the amount you paid us in the twelve months preceding the event giving rise to the claim. We are not liable for indirect, incidental, consequential, or punitive damages, including lost revenue or lost data beyond what our export mechanism preserved.

Nothing in these terms limits liability for gross negligence, willful misconduct, or anything that can't be limited by contract in your jurisdiction.

11. Indemnity

You'll defend and indemnify us against third-party claims arising from content you put into Coproduct or from your use of Coproduct that breaches these terms. We'll do the same the other way for claims that our service as delivered infringes a third-party IP right (standard carve-outs for modifications and combinations apply).

12. Changes to the service or these terms

We'll give you 30 days' notice before materially changing the service in a way that reduces functionality you're using, or before changing these terms in a way that restricts your rights. We'll send that notice to the account-owner contact on file. For minor updates (typo fixes, process clarifications), the commit history of this page is the diff.

13. Governing law + disputes

These terms are governed by the laws of the State of California, USA, without regard to conflicts-of-law principles. We'll try to resolve disputes informally first — email us. If that fails, disputes go to binding arbitration in San Francisco, CA (JAMS rules) unless local consumer-protection law says otherwise for your jurisdiction.

You retain the right to bring small-claims court actions. Neither party waives class-action rights in jurisdictions where class-waivers are unenforceable.

14. Termination

We may suspend or terminate your account for material breach (see §3) with written notice. We will preserve your workspace content for at least 30 days before deletion and will send a signed export. You can terminate at any time.

15. Contact

Questions about these terms, legal notices, or account issues: hello@coproduct.one.