Who we are
Ponte Digital, KvK 42036253, VAT NL005445928B45, Reitseplein 384, 5037 AA Tilburg, the Netherlands.
You reach us at hello@pontedigital.co.
Commercial terms
What you buy
The First Issue: €450 ex VAT, once per workspace. It covers one issue: scoped, built, checked by us and delivered as a pull request, with a preview link where your previews let us, as clauses 3.11 and 3.12 of the general terms describe. It doesn't expire while your account is open, and it stays yours beside any lane until it is used. If the account closes before it is used, it lapses as clause 3.12 of the general terms says.
A lane: €2,950 ex VAT a month. It runs one active issue at a time, with an unlimited queue that you order. A workspace can hold up to three lanes, each billed on its own. You start with the First Issue. Lanes come after it, while we have capacity.
Paying and renewals
The amount is stated at checkout before you pay, VAT included where it applies. We charge it that day. Prices change only as clause 14 of the general terms says.
A lane renews every month on the day you started it. In a month without that day it renews on the month's last day, and goes back to its own day the month after.
We charge each renewal to the payment method you set up at checkout: your card, or SEPA Direct Debit from your bank account if you paid by iDEAL, Bancontact or a similar bank payment. You authorise these charges until the lane ends.
We write to you 3 days before each renewal with the amount. For SEPA Direct Debit that message is your pre-notification, and you agree to 3 days instead of 14.
If a renewal fails, we try again 1, 3 and 5 days later. If the last try fails, the lane goes on hold: it takes no new work, and your other lanes keep running. Pay on Billing and a new month starts that day. A lane on hold for 30 days ends.
We are based in the Netherlands. Clients in the Netherlands pay 21% VAT. A business elsewhere in the EU with a VAT number VIES confirms pays no VAT to us: the reverse charge applies. Without such a number it pays 21% Dutch VAT. Clients outside the EU pay no Dutch VAT. We check the VAT number with VIES at each charge. If VIES can't answer, we use our last check of that number if it is less than 30 days old. Otherwise we don't charge until VIES answers.
Pausing and stopping
You can pause or stop a lane on Billing once its current month is paid. It takes effect at the end of that month: you keep the month you paid, and nothing more is charged. Until that day you can change your mind. An objection to a new sub-processor is the exception: if we find no solution with you, you may stop the affected lanes at once, and we refund the unused part of the month (Annex A, clause A7.3, of the general terms).
A pause has no time limit, and your queue keeps its order. Resuming charges a full month from the day you resume, and that day becomes the lane's monthly date.
Apart from that, we don't refund a partial month when you pause or stop. The general terms say when a lane can end early for other reasons and what is refunded then (clauses 11.3, 13.5 and 13.6), and when an unused First Issue is refunded (clauses 3.12 and 14.3). Work that started inside a paid month carries on after it ends, as clause 3.15 of the general terms describes.
Invoices
Every payment gets an invoice, dated the day you paid. Moneybird, our bookkeeping system, sends it by email to the invoice address on Billing.
General terms
The commercial terms above say what you buy, what it costs, and how it renews, pauses and stops. These general terms say how we work together. Annex A, at the end, is our data processing agreement. Together they form the agreement between you and us.
1. Who and what these terms cover
1.1 Ponte is provided by Ponte Digital, registered with the Dutch Chamber of Commerce (KvK) under number 42036253, VAT number NL005445928B45, Reitseplein 384, 5037 AA Tilburg, the Netherlands. You reach us at hello@pontedigital.co.
1.2 In these terms, these words mean the following.
(a) "We", "us" and "our": Ponte Digital, the business registered under KvK number 42036253, and anyone the agreement is transferred to under clause 15.2.
(b) "You": the business for which an account admin accepts these terms in the portal.
(c) "Ponte": our service, as these terms describe it.
(d) "Workspace": your Linear workspace, connected to Ponte.
(e) "Portal": portal.pontedigital.co. "Account admin": a portal user with the account admin role for your workspace.
(f) "Issue": a Linear issue you delegate to our agent. "Agent": our AI coding agent.
(g) "Scope": the description of the result that our agent posts for an issue, as you approve it.
(h) "Change": what we make for an issue. That is the code on the branch we push to your repository, the pull request and its text, and any documentation we write for it.
(i) "Delivery": the moment we mark a change's pull request ready for review and post our delivery summary on the issue.
(j) "Preview": a deployment of a branch that your hosting makes for testing, not for your users.
(k) "Production": any system, database or account that serves your real users, holds real data, sends real messages or moves real money.
(l) "Providers": the third parties we rely on to provide Ponte.
(m) "Commercial terms": the section headed Commercial terms above. "Lane" and "First Issue" mean what the commercial terms say.
1.3 Ponte is for businesses only. Whoever accepts these terms for you confirms that you act for a trade, business or profession, and that they may bind you. If they may not, they answer for it themselves (article 3:70 of the Dutch Civil Code, BW). We don't contract with consumers. If it turns out you are one, we may end the agreement at once and refund what you paid for work we haven't done.
1.4 These terms apply to every order and every use of Ponte. Your own purchasing conditions or other terms don't apply. We reject them expressly.
1.5 If documents conflict, this order applies:
(a) a written agreement for your workspace, signed by both of us, that names the clause of these terms it changes;
(b) Annex A, for personal data;
(c) the commercial terms, for amounts, dates, and how payment, renewal, pausing, stopping and invoicing work;
(d) these general terms, for everything else, including what we deliver and our liability;
(e) scopes, messages, help texts and other product copy.
1.6 Where these general terms say how a commercial term works, as clauses 3.11, 3.12, 3.15, 7 and 13 do, the two apply together, and the general terms don't give way to the commercial terms there. An approved scope decides what we build for an issue. It never changes these terms, our liability, any date or what you pay.
1.7 Our privacy statement explains what we do with personal data as a controller. It informs you. It is not part of the agreement.
2. Forming the agreement
2.1 The agreement starts when an account admin accepts these terms in the portal for your business. Each First Issue or lane you buy or we grant you afterwards is an order under the agreement. If we worked for you before you accepted, these terms govern that work from acceptance: lanes you bought earlier continue as orders under the agreement, and clause 8 also covers changes we delivered earlier.
2.2 We start no work on your issues before the agreement starts. Until then our agent reads no issue, calls no AI model and copies no repository. We process only what we need to set up your account and ask you to accept: your workspace's name, address and plan in Linear, the names and email addresses of its admins, and, if you install our GitHub App, which account installed it and which repositories it can reach. If someone delegates an issue before then, Linear sends it to us, but we keep only its identifiers and when it was delegated. Linear also sends us a notification of every change in your workspace that our app can see, such as new and changed issues and comments. Before the agreement starts we discard them without reading them, all but two kinds: the notice that an issue was delegated to our agent, and notices about an issue we are already holding, such as that it was closed. We use those only to hold, answer or let go of that issue. For a discarded notification, our service logs keep only its kind and your workspace's identifier. We reply on the issue that an account admin needs to accept our terms first, and start it once your workspace can take it (clause 3.10). We do this as controller, as our privacy statement describes.
2.3 Before you accept, the portal shows these terms, with the commercial terms and Annex A, and lets you download them to keep. It says how to accept, and lets you check and correct your company's details first. Once you accept, we confirm it by email to the person who accepted and to your account admins, with the terms attached.
2.4 We keep a record of the first acceptance of each version: the version, the business it was accepted for and the details given for it, who accepted it (name where we have it, email address and portal role), when, and from which IP address and browser. Anyone in your portal can download the version you accepted from Settings, and an account admin can also download our record there. Ask us and we send you any version that applied to you. A renewal runs under the version that applies on its date (clause 14.2). The agreement is in English. If we ever give you a translation, the English text applies.
2.5 Between businesses, articles 6:227b(1) and 6:227c BW don't apply to orders under the agreement, as far as the law allows.
2.6 Anyone in your Linear workspace, and anyone you give access to the portal, may instruct us for you. Their requests, approvals and replies count as yours. You decide who has that access.
3. How Ponte works
3.1 You delegate an issue to our agent in Linear. The agent reads the issue and the context it links to, and posts a scope: what it will deliver. You then approve the scope, ask for a revision, or cancel. Only choosing Approve scope, or a reply whose first line is just those words (capitals don't matter), approves it. Anything written below that line reaches the agent as a note and doesn't change the approved scope. Any other reply doesn't approve it. We build nothing before you approve.
3.2 The approved scope is the specification for that issue. What isn't in it, we don't owe. A change of mind after approval is a new issue, or a revised scope that you approve again.
3.3 Our agent works in the repositories you connect through our GitHub App, and in your workspace through our Linear app. It is instructed and set up to build on a new branch, open a draft pull request, push only to branches it creates for your issues, and leave merging to you. It is software, and it can get this wrong. That is why clause 4.5 asks you to protect your default branch, so that GitHub refuses anything else, and clause 4.2 asks you to keep production out of reach. Merging and deploying to production are not part of our work. We don't sign in to your hosting provider. We find previews through GitHub and open them with the access you give us.
3.4 Our process has a person at Ponte Digital check each change before we deliver it. We check the change on your preview where there is one, otherwise on the code alone. The check confirms, as far as that review can show, that the change does what the approved scope says. It is not a full test, a security audit, a performance or accessibility test, or a review of your system.
3.5 The agent is an AI system. We run Ponte on the Anthropic Claude model we select, normally one of Anthropic's most capable current models, with a smaller Claude model for minor internal steps. We choose the models, and we may change them to keep the quality of our work current. We don't promise a specific model, or any speed or result: clause 3.6 applies whichever model runs. A person at Ponte Digital checks each change before we deliver it (clause 3.4). AI output can be wrong, incomplete or insecure in ways that neither the agent nor our reviewer notices. Messages from our agent in Linear and GitHub are generated by AI, for us, unless they say a person wrote them. Don't rely on factual statements in them without checking.
3.6 We work with the care of a good contractor who uses AI tools. That is an obligation of effort (inspanningsverplichting), not a promise of a result. We promise a specific result only where these terms say so in so many words, as in clause 6.4.
3.7 We don't promise that Ponte or any change is error-free or secure, fits a particular purpose, works with your other systems, or makes your product meet any law or standard. Ponte can be interrupted. We offer no uptime, service levels or response times.
3.8 Any date, time or duration we mention is an estimate. It is never a deadline that puts us in default on its own (fatale termijn). A lane buys capacity: one active issue at a time. It doesn't buy a number of issues or a turnaround time.
3.9 We may decline, split or stop an issue that is too large for one pull request, unclear, unlawful or unsafe, against these terms, or that needs access or production changes we don't make. We tell you why.
3.10 If you delegate an issue before the agreement starts, or while your workspace can't take new work, for example without a lane or First Issue to run it, we don't start it. We hold it and start it on our own once your workspace can take it. If you delegated it before the agreement started, we start it in a new thread on the issue. After 30 days, not counting time your lanes are paused or we can't reach your workspace, we let it go and say so on the issue. We hold up to 200 issues per workspace at a time. Past that, we let the oldest go and say so on it.
3.11 The First Issue covers one issue. An issue becomes your First Issue when we accept it for work. If you cancel it in Linear before the work reaches our review, the First Issue is free again for another issue. Once the work has reached our review, the First Issue is used, even if you cancel later. Fixing a defect in it under clause 6 is included.
3.12 If we decline your First Issue before you approve its scope, you may delegate another issue in its place. If we can't deliver a First Issue whose scope you approved, for a reason on our side, we refund the First Issue fee, unless you'd rather use it on another issue. Delivery under clause 6.1 counts as delivering. A change that does what the approved scope says is no reason for a refund, even if it isn't what you hoped for. A First Issue that hasn't reached our review (clause 3.11) when the account closes lapses. If no issue had become your First Issue by then, and you reconnect the same workspace within 90 days after closing, it comes back, unless an account admin chose Delete everything now. We don't refund a lapsed First Issue, except in four cases, where we refund its fee in full: (a) the agreement ended because of force majeure (clause 11.3), or because we ended it for a reason that isn't yours (clauses 13.4 and 13.5(d)); (b) you ended the agreement over a change to these terms (clause 14.3); (c) you dissolved the agreement because we failed to perform; (d) you ended the agreement under Annex A, clause A7.3. We may also refund it in other cases, at our discretion.
3.13 On a delivered issue you can ask questions and request changes. A request that goes beyond the approved scope isn't a defect. We restate it as a new scope for you to confirm, and it then runs in your lane as new work.
3.14 While a pull request we delivered is still open, we may bring its branch up to date with your base branch. Where that leads to a conflict, we rework the change. Checks that fail because of your own CI, configuration or other code are yours to resolve.
3.15 The commercial terms say that work started inside a paid month carries on after it ends. This is how. When a lane pauses, ends or goes on hold, we keep working on the issues that were in progress or in review in it, review and rework rounds included. We do so until each is merged or closed, or for 14 days after the lane stopped taking new work, whichever comes first. This doesn't apply when we suspend or end work under clause 12 or 13 because of something you did or failed to do, or when we can no longer reach your workspace.
3.16 We may use employees, freelancers and subcontractors to do the work. Towards you we remain responsible for their work, within these terms. The providers named in clause 11.1 and in Annex A are not subcontractors for this purpose: clause 11 applies to their outages and withdrawals, clause 11.2 to their failures with your data, and for personal data Annex A, clause A7.2. Articles 7:404 and 7:407(2) BW don't apply.
3.17 We may change how Ponte works inside, such as the models (clause 3.5), tools and providers we use, as long as what you buy stays substantially the same. Changes to the providers that process personal data for you follow Annex A.
4. What you do
4.1 You make sure that you may let us work in the repositories, workspace and previews you connect, and that we may use the material you give us for the work.
4.2 You keep production out of our reach. Everything our installs and the access you give us can reach must hold no production secrets and no production data. That includes previews, environment variables, build settings and test accounts. It also includes CI workflows, GitHub Actions secrets, deploy hooks and database migrations that a push to a branch, or a pull request, can trigger. Make sure a push to a branch other than your default branch, or a pull request, can't deploy to production or use production secrets. Nothing within our reach may be able to send real messages or move real money. Use test-mode keys only. Test accounts you give us must be non-production accounts on non-production data.
4.3 Don't give us production secrets, such as live API keys, production database credentials or signing keys. We don't need them. If you give us one anyway, or one sits in a repository we work on, rotate it at once. We don't look for them and aren't obliged to. If we notice one, we tell you and remove it where we reasonably can. Copies can remain with our providers, in our logs and in backups until they are deleted as Annex A, clause A12, says. We aren't liable for misuse of a secret you gave us or left within our reach, unless the misuse results from our breach of clause 9 or Annex A; then clause 10 applies.
4.4 Your answers to our setup questions, and what you tell us about your hosting and previews, bind you. We can't see your hosting. We rely on what you tell us and don't check it. If an answer is wrong, the consequences are yours.
4.5 You keep your own backups of your code and data. You protect your default branch, for example with branch protection, so that GitHub refuses a push or merge you didn't approve. You limit our GitHub App to the repositories we work on.
4.6 You review every change before you merge it. You test it as you would a change from any developer, security included. Merging and deploying are your decisions, and at your risk.
4.7 Builds, CI minutes, preview hosting and other usage that our work causes on your accounts run at your cost, under your contracts with those providers. Your Linear, GitHub and hosting accounts are yours. We aren't responsible for their availability or their terms.
4.8 You answer our questions on an issue within a reasonable time. Delay caused by missing answers, access or information isn't ours.
4.9 You decide who has access to the portal and to your workspace, and you're responsible for what they do. Keep the inboxes used to sign in secure. Tell us at once if you think someone used your access without permission.
4.10 If you don't do what this clause 4 asks, you bear the consequences. We aren't liable for damage that results from it.
5. Acceptable use
5.1 You don't use Ponte, and you don't let anyone use it:
(a) for anything unlawful, or anything that infringes someone else's rights;
(b) to create malware, collect credentials, get round licences, access controls or security measures, or scrape where that isn't allowed;
(c) against the usage policies of our AI providers, including Anthropic's Usage Policy (anthropic.com/legal/aup), or from a country those providers don't serve or that is under sanctions;
(d) on repositories, workspaces or systems you may not let us work on;
(e) for systems whose failure could cause death, injury or serious damage to property or the environment, unless we agreed to it in writing first;
(f) to build or train AI models that compete with our AI providers' models;
(g) to extract our prompts, instructions or tooling, or to reverse-engineer the agent;
(h) to overload or disrupt Ponte, or test its security, without our written consent;
(i) while you, or anyone who owns or controls you, is subject to EU, UN, UK or US sanctions.
5.2 Your repositories and their dependencies may be installed and run on our servers while we work. You make sure they contain no malicious code.
5.3 Don't put any of the following in issues, attachments, repositories we work on, or previews: special categories of personal data (such as health data), data about criminal convictions, payment card data, or production credentials.
5.4 Treat the people who work for us with respect. Abuse of our people is a serious breach of these terms.
6. Delivery, acceptance and defects
6.1 We deliver a change when we mark its pull request ready for review and post our delivery summary on the issue.
6.2 A change is accepted when you merge it, in whole or in part, or 30 days after delivery if you haven't reported a defect by then, whichever comes first. After acceptance, what we still owe for that change is the fix in clause 6.4.
6.3 A defect is a reproducible failure of a delivered change to do what its approved scope says. It isn't a defect if it is caused by changes made after delivery, by you or others; by other code, dependencies, data, configuration or infrastructure; by use outside what the scope describes; or by your not meeting clause 4.
6.4 Report a defect in writing, with enough detail for us to reproduce it, within 30 days after delivery. For a defect you couldn't reasonably have noticed in that time, report it within 30 days after you noticed it or should have, and in any case within 90 days after delivery. We then fix it without charge, within a reasonable time, on the same branch or in a follow-up pull request. This is your first remedy. You can claim damages over a defect, or end the agreement over it, only after we failed to fix it following your notice of default under clause 10.6.
6.5 Report any other complaint about our work within 30 days after you noticed the problem or should have.
6.6 If you don't report a defect or complaint within 30 days after you noticed it or should have (clauses 6.4 and 6.5), you lose your rights for it, as far as the law allows. After the 90 days in clause 6.4 we no longer owe a free fix. Your other rights for a defect you couldn't reasonably have noticed within those 90 days remain, subject to clause 10. None of this applies to a defect we knew of and didn't tell you about.
7. Payment
7.1 You pay in advance, as the commercial terms say. Fees are due whether or not you delegate issues in a paid month.
7.2 If a renewal fails, the commercial terms say what happens: the lane goes on hold, and we don't claim a month we couldn't charge. If a payment is reversed or charged back after it succeeded, the amount stays due, and you also owe the fees our payment provider charges us for it. We may then put the affected lane on hold at once, as if its renewal had failed.
7.3 If you pay late, you owe statutory commercial interest (article 6:119a BW) from the day after the due date, without a reminder. You also owe collection costs under the Dutch decree on extrajudicial collection costs (Besluit vergoeding voor buitengerechtelijke incassokosten), with a minimum of €40.
7.4 You may not set off what you owe us against a claim you have, or believe you have, against us. You may not suspend payment because of such a claim either. This doesn't apply to a claim we have accepted in writing, or that a court has established in a final judgment, nor to suspending payment for a lane month in which we are in default.
7.5 Tell us within 30 days after the invoice date if you think an invoice is wrong. That doesn't postpone payment.
7.6 You give us correct billing and VAT details. If your VAT number turns out to be invalid, or your details are wrong, you owe the VAT and the costs that follow.
7.7 We refund only where these terms or the commercial terms say so, or where we took a payment by mistake: twice, for the wrong amount, or for something you couldn't buy. Refunds go to the payment method you used.
8. Intellectual property
8.1 Your code, issues and other material stay yours. You give us the right to access, copy, run, change and store them as far as the work needs, while the agreement runs and during the deletion periods after it.
8.2 We are obliged to transfer to you all intellectual property rights that exist or arise in a change, once the fee for the First Issue, or for the lane month in which work on it started, has been paid; or on delivery, if we granted that lane or First Issue without charge or waived its fee in writing. They include the rights to reproduce, adapt, publish, distribute and license it, in every form and medium, worldwide, for as long as those rights last. These terms are the written agreement for that transfer (article 2(3) of the Dutch Copyright Act, Auteurswet). The transfer takes effect once we have signed a deed of transfer (akte, article 3:95 BW) and, for each change, the condition in the first sentence is met. At your request we sign that deed without charge within 14 days, covering every change for your workspace, those still to come included (article 3:97 BW). Where people who work for us but aren't our employees contribute to a change, we make sure their rights pass to us first, so that we can transfer them to you. Until the transfer takes effect, clause 8.3 applies. If a payment the transfer rests on is later reversed or charged back, and not paid again within 14 days, the transfer and the licence in clause 8.3 end (ontbindende voorwaarde), the rights return to us, and you stop using the change.
8.3 Until the transfer takes effect, or where it isn't possible, you get an exclusive, perpetual, irrevocable, worldwide and royalty-free licence to do everything a rights holder could, with the right to sublicense, subject to the payment condition in clause 8.2. These terms are the written agreement for that licence (article 2(3) Auteurswet).
8.4 We keep everything that isn't specific to you: our agent, prompts, instructions, skills, workflows, tools, templates, know-how, and general methods and code patterns. Where any of it ends up in a change, you get a perpetual, royalty-free, non-exclusive licence to use, change and distribute it as part of your software, and to let others do so.
8.5 Changes may contain or depend on open-source software. That software stays under its own licence. You decide which licences you accept, and by merging you accept the ones in the change.
8.6 Code written with AI may not be protected by copyright at all. Similar code may exist elsewhere, or be written for others. We don't promise that a change is protected, original, exclusive or free of other people's rights. We don't knowingly copy third-party code against its licence.
8.7 You accept each change subject to any rights third parties have in it, open-source licences included. Article 7:15 BW doesn't apply. You won't use the rights you get under clause 8.2 against us or our other clients over code that is similar but made separately.
8.8 As far as the law allows, we waive our moral rights (persoonlijkheidsrechten) in changes and won't invoke them against you.
8.9 You get no rights in Ponte itself, the portal or our tooling, beyond using them as these terms allow.
9. Confidentiality and your data
9.1 Each of us takes reasonable care, at least the care it takes with its own information, to keep the other's confidential information confidential, and uses it only for the agreement. Confidential information is what the other side marks as confidential, or what is clearly confidential by its nature. On your side that includes your code, issues, plans and credentials. On ours it includes our prompts, tooling, and any prices agreed with you individually. For personal data, Annex A, clause A6, sets the measures.
9.2 We share your information only with people and providers who need it to provide Ponte and are bound to confidentiality. Annex A lists the providers.
9.3 Confidentiality doesn't cover information that is or becomes public without a breach, that the receiving side already had or developed independently, or that the law, a court or a regulator requires to be disclosed. In that last case the disclosing side tells the other first, where the law allows.
9.4 This duty lasts while the agreement runs and five years after it. For trade secrets it lasts as long as they stay secret.
9.5 We don't use your code, issues or other material to train or fine-tune AI models, and we don't let anyone else do so. Our AI provider, Anthropic Ireland, Limited, processes them under its Commercial Terms and data processing addendum, which don't allow it to train models on that content. Our agent sends them to Anthropic through its commercial API. We never put them into the Claude assistant our staff use for our own administration.
9.6 We may use what we learn in general, such as better ways to scope, build and review, as long as it doesn't disclose your confidential information or personal data. We may use figures about the service itself, such as the timings, size classes and costs of deliveries, to run, bill and improve Ponte. Those figures are about the work, not about people, and we keep personal data out of them. For each issue we record how many agent sessions it took, which models they used and what we estimate they cost, against the issue's identifiers in Linear. These are our business records: they hold no personal data beyond those identifiers. We delete them 90 days after the issue's last activity, or earlier when the account closes, and they leave the backups of our agent server within a further 7 days (Annex A, clause A12.4).
9.7 We process personal data for you under Annex A. For personal data we process for our own purposes, see our privacy statement.
9.8 We don't name you as a client, or show your logo, without your written consent. An email is enough, and you can withdraw it.
10. Liability
10.1 We are liable to you only for direct damage caused by a failure attributable to us. Direct damage means only:
(a) the reasonable cost of making our work do what the approved scope says, where you first gave us the chance to fix it under clauses 6.4 and 10.6;
(b) reasonable costs of establishing the cause and extent of that damage;
(c) reasonable costs of preventing or limiting it, as far as you show they did;
(d) reasonable costs you incur because we breached clause 9 or Annex A: rotating exposed credentials, investigating and containing a breach, restoring data from your backups, notifying people and authorities, and what you pay data subjects under article 82 GDPR, as far as the breach was ours.
10.2 We aren't liable for any other damage. That includes:
(a) lost profit, revenue or savings;
(b) business interruption;
(c) except as clause 10.1(d) covers, loss or corruption of data, and its restoration;
(d) harm to reputation or goodwill;
(e) except as clause 10.1(d) covers, claims by your customers or other third parties;
(f) fines and penalties;
(g) damage in your production systems, or damage that arises after you merged or deployed a change, apart from the cost of fixing that change under clause 10.1(a).
10.3 For one event, or a series of connected events, our liability is limited to the fees you paid for the affected lane in the three months before the event. Where an event concerns more than one lane, or no lane in particular, the limit is the fees you paid for all lanes in those three months. Where it concerns the First Issue, or you hold no lane, the limit is €5,000. In every case the limit is at least €5,000.
10.4 For all events in any period of twelve months together, our liability is never more than €25,000.
10.5 The exclusions and limits of our liability in these terms, those in clauses 4.3, 4.10 and 10.1 to 10.4 included, don't apply:
(a) to damage caused by intent or conscious recklessness (opzet of bewuste roekeloosheid) of Ponte Digital or its management;
(b) to damage caused by intent or gross negligence (grove nalatigheid) on our part, or on the part of the people in clause 3.16, in meeting our obligations about your data, such as keeping it confidential and secure, returning it and deleting it (article 13 of the EU Data Act, Regulation (EU) 2023/2854);
(c) where the law doesn't allow them otherwise.
Where a limit can't be relied on in one case, it still applies in every other case, as far as the law allows.
10.6 A right to damages arises only if you give us written notice of default promptly, describing the failure as precisely as you can and giving us a reasonable period to fix it, and we still fail after that period. No notice is needed where fixing is permanently impossible.
10.7 Report damage to us in writing as soon as you can after it arises. A claim against us lapses if you don't start court proceedings for it within one year after you knew, or should reasonably have known, the facts it rests on.
10.8 These limits apply to every claim against us, in contract, in tort or otherwise. Our owner, directors and shareholders, and our employees, freelancers, reviewers and subcontractors, may rely on these limits and on clauses 4.10 and 10.9 as if they were parties to these terms (article 6:253 BW).
10.9 You indemnify us, and the people in clause 10.8, against claims by third parties, your customers and users included, that arise from: (a) your material, instructions, repositories or systems; (b) your use, merging or deployment of changes, or the products and services you provide with them; (c) your breach of these terms or of the law. You also pay our reasonable costs of dealing with such claims. This doesn't apply as far as a claim results from intent or conscious recklessness of Ponte Digital or its management. Nor does it apply as far as a claim results from damage that we, or the people in clause 3.16, caused in carrying out the agreement, unless that damage came about through a change you merged or deployed, or through your not meeting clause 4 or 5.
10.10 Your liability is not limited for fees you owe, for intent or gross negligence, for breaching clause 5.1(a), (b), (h) or (i), or for third-party claims under clause 10.9(a) and (b). Otherwise clauses 10.3 and 10.4 limit it as they limit ours.
11. Force majeure
11.1 Neither of us is liable for a failure caused by force majeure: circumstances outside its reasonable control. For us these include:
(a) outages, failures, restrictions or withdrawal of services by providers we depend on, such as our AI model provider, GitHub, Linear, our hosting, and network and payment providers;
(b) changes to their terms or services that stop us from providing Ponte as agreed;
(c) cyberattacks we couldn't reasonably prevent;
(d) failure of the internet or the power supply;
(e) government measures;
(f) illness of the person doing the work where no reasonable replacement is available.
Articles 6:76 and 6:77 BW don't apply to those providers, as far as this clause covers them.
11.2 A failure we caused ourselves isn't force majeure. Nor is a provider's failure to keep your data confidential or secure, or to delete it when we ask. For that we answer as for our own conduct, within clause 10.
11.3 During force majeure the affected obligations are suspended. We may switch to a comparable provider or model to get going again. If force majeure lasts more than 30 days, either of us may end the affected lane, or the agreement, by written notice. You then get back the fees for the part of a paid month in which we couldn't work. Beyond that, neither of us owes the other compensation.
12. Suspension
12.1 We may suspend Ponte for your workspace, completely or in part, if:
(a) a lane is on hold for payment, as the commercial terms describe, or a payment was reversed or charged back;
(b) you breach clause 4 or 5;
(c) there is a security risk to you, to us or to other clients, or a reasonable suspicion of misuse;
(d) the law, a court, a regulator or one of our providers requires it.
12.2 We tell you why, in advance where we reasonably can. We resume once the cause is gone.
12.3 A suspension under clause 12.1(a) or (b) doesn't extend or refund a paid month. If we suspend under clause 12.1(c) or (d) for a reason that isn't yours, we add the days lost to the lane's paid month.
13. Term and ending
13.1 The agreement runs for an indefinite period. Lanes run month by month, as the commercial terms say.
13.2 You end a lane by stopping it on Billing. A paid lane ends at the end of its paid month, as the commercial terms say, or at once when you stop it under Annex A, clause A7.3. A lane on hold for payment ends the day you stop it. A lane we granted you ends when you ask us. Ending a lane or the agreement doesn't refund a paid month or a paid First Issue, except where these terms say so (clauses 3.12, 11.3, 13.6 and 14.3, and Annex A, clause A7.3). Articles 7:408(1), 7:411 and 7:764 BW don't apply.
13.3 Once no lane is running, you can end the agreement as a whole at any time. An account admin does so with Delete everything now in Settings, or by email to us.
13.4 We may end a lane, or the agreement, for any reason, with at least 30 days' notice, effective at the end of a paid month.
13.5 We may end a lane, or the agreement, with immediate effect by written notice if:
(a) a payment that was reversed or charged back is still unpaid 14 days after a reminder;
(b) you seriously breach these terms, clauses 4 and 5 included, or keep breaching them after a warning;
(c) you are declared bankrupt, are granted a suspension of payments, or stop your business, as far as the law allows us to end the agreement for that reason;
(d) continuing would break the law or a provider's terms, or clause 5.1(i) applies.
13.6 If we end a lane for a reason that isn't yours, under clause 13.5(d) or otherwise, you get back the fees for the unused part of its paid month. If we end it under clause 13.5(a), (b) or (c), or because clause 5.1(i) applies, you don't.
13.7 If our Linear app is removed from your workspace, or our access stops working for a reason on your side, we keep your workspace as it is for a grace period. It lasts at least 14 days, or until the day after the last paid day of your lanes if that is later. We charge no renewal in that time. If you reconnect in time, you carry on. If you don't, the account closes when the grace period ends, and the agreement ends with it. Your lanes end at that moment. Paid months are not refunded.
13.8 When the account closes:
(a) we revoke our access to your Linear workspace and delete our tokens for it;
(b) we delete the working copies of your code on our servers that day, and from our backups within a further 7 days (Annex A, clause A12.4);
(c) we delete our other copies of your data as Annex A, clause A12, says;
(d) an account admin can download your record from Settings until 90 days after closing;
(e) we uninstall our GitHub App from each GitHub account where it served only your workspace. If that fails, we tell you, and you remove it in your GitHub settings.
13.9 Your record holds your work items, deliveries and invoices, as CSV and JSON. Your code and issues are already in your own GitHub and Linear, so nothing else needs to move back. The record doesn't include our prompts, tooling, internal notes or logs. We charge nothing for leaving or for your record.
13.10 We keep a record that your workspace has had its First Issue, so it isn't sold to the same workspace twice. We keep billing records for seven years, because the law requires it. We keep our records of your acceptance of these terms for seven years after the end of the year in which the agreement ends.
13.11 If you dissolve (ontbinden) the agreement, or part of it, that has effect for the future only. What we did and delivered before in line with these terms stays done, and what you owe for it stays due, unless you show that we are in default for the essential part of it. Article 6:271 BW doesn't apply to that extent.
14. Changes to these terms and prices
14.1 We may change these terms, Annex A and our prices for a valid reason. Valid reasons are: changes in the law; changes in what our providers charge, allow or offer; security; changes in our costs; and changes to Ponte. Changes to the list of sub-processors follow Annex A, clause A7, instead of this clause.
14.2 We announce a change by email to your account admins at least 30 days before it takes effect, with the new text and a summary of what changes. We also show it in the portal, where an account admin can accept it at once. For a lane, a change applies from its first renewal after that date. It never applies to a month already paid, and never retroactively. For everything else, it applies from the date in the announcement. Work doesn't stop while you consider a change.
14.3 If you don't accept a change, you can stop your lanes before it applies to them, or end the agreement as clause 13.3 says, at no cost. You then pay nothing more, and we refund an unused First Issue (clause 3.12).
14.4 A change the law requires, or one that only benefits you or isn't material, may apply sooner.
14.5 A change to Annex A, other than to the list of sub-processors (clause A7), applies to you only once an account admin accepts it in the portal. Until then the earlier Annex A applies.
15. Other provisions
15.1 Notices. We write to the email addresses of your account admins, and about money also to your invoice address. About an issue, we may also write on the issue itself. You write to us at hello@pontedigital.co. Email counts as writing, including for a notice of default or for ending the agreement. A message counts as received once it reaches the recipient's mailbox.
15.2 Transfer. You may not transfer the agreement, or your rights under it, without our written consent. You agree now that we may transfer the agreement, in full or in part, to whoever takes over our business or Ponte, or to a company we control (article 6:159 BW). We tell you when we do. If we transfer it to a company we control without our business or Ponte going with it, we remain liable to you for that company's performance.
15.3 Non-solicitation. While the agreement runs and for 12 months after it ends, you don't hire or engage, directly or through others, anyone who worked on your issues for us in the 12 months before, unless we agree in writing. Someone who answers a public job advertisement on their own initiative doesn't count. If you breach this, you owe us €10,000 per person. Article 6:92(2) BW doesn't apply: you also owe the damage above that amount.
15.4 Evidence. Our records, such as the history in Linear and GitHub, our payment records, our records of acceptance and our logs, can serve as evidence. This doesn't change who must prove what under the law.
15.5 Entire agreement. These general terms, the commercial terms, Annex A and anything agreed under clause 1.5(a) are the whole agreement about Ponte. They replace earlier offers, statements and arrangements about it. Scopes, emails, chat and support messages don't change these terms, our liability, any date or what you pay, unless they meet clause 1.5(a).
15.6 Severability. If a provision is void or is annulled, the rest stays in force. The provision is then replaced by a valid one that comes as close as possible to its purpose.
15.7 No waiver. If we don't enforce a right at once, we don't give it up.
15.8 Survival. Provisions that by their nature continue after the agreement ends stay in force. They include clauses 3.15, 4.10, 5, 6.6, 7, 8, 9, 10, 13.8 to 13.11, 15 and 16, and Annex A for as long as we hold your personal data.
16. Law and disputes
16.1 Dutch law governs the agreement. The United Nations Convention on Contracts for the International Sale of Goods (CISG) doesn't apply.
16.2 Disputes go to the District Court of Zeeland-West-Brabant (Rechtbank Zeeland-West-Brabant) in the Netherlands. Where the law makes that choice ineffective, as article 108(2) of the Dutch Code of Civil Procedure (Rv) does for claims of €25,000 or less, the court the law designates hears the dispute.
Annex A. Data processing agreement
This annex is the agreement between you and us about the personal data we process for you, as article 28(3) of the General Data Protection Regulation (GDPR) requires. It is part of the terms above, and you accept it with them. Words defined in the GDPR have the same meaning here.
A1. Roles
A1.1 For the personal data we process to provide Ponte to you, you are the controller and we are your processor. This annex calls it "client personal data".
A1.2 For the personal data we process for our own purposes, we are the controller. That covers portal accounts, including the accounts we create for your Linear admins; billing; and our correspondence with you, apart from client personal data you put in messages about your work (clause A8.7). Our privacy statement describes it. This annex doesn't apply to it.
A1.3 Your own Linear, GitHub and hosting providers are your processors, under your contracts with them. They are not our sub-processors.
A1.4 Before the agreement starts we process no client personal data for you. Clause 2.2 of the terms says what we do process then, as controller.
A2. Subject, nature, purpose and duration
A2.1 Subject: building and delivering the issues you delegate to us.
A2.2 Nature. We receive, read, store, copy, analyse, change, send and delete client personal data. In practice:
(a) we read issues, comments and attachments, and the context they link to, in your workspace. Our Linear app can see your workspace as far as Linear's permissions allow, and Linear sends us a notification of every change it can see there, such as new and changed issues and comments, delegated or not. We use what the delegated issues need, and the workspace details we need to run Ponte, such as members, admins and teams. We don't use notifications about other issues. Before the agreement starts we discard them all without reading them, except the notice that an issue was delegated to us and notices about an issue we are holding, as clause 2.2 of the terms says;
(b) we clone and read your repositories and their history, and install and run your code on our servers;
(c) we send that material to AI models;
(d) we write code, comments and pull requests;
(e) we open your previews with the access you give us;
(f) we show the status of your work in the portal and send emails about it;
(g) for our reviewers, we keep a copy of each issue in our own Linear workspace, and a copy of your repository's history up to each branch we build, in a private repository for your workspace in our own GitHub organisation.
A2.3 Purpose: only to provide Ponte to you. That means scoping, building, reviewing, delivering and supporting your issues, and keeping your account and the status of your work in the portal.
A2.4 Duration: while the agreement runs, and after it until we have deleted the data as clause A12 says.
A3. Data subjects and data
A3.1 Data subjects:
(a) your staff and contractors who use your Linear workspace and repositories, such as members, admins, commenters and commit authors;
(b) people whose data you put in your issues, attachments, repositories, test data or previews;
(c) the holders of test accounts you give us.
A3.2 Personal data:
(a) names, usernames, email addresses, avatars and account ids in Linear and GitHub;
(b) workspace membership and roles;
(c) the content of issues, comments and attachments;
(d) git history, including commit authors' names and email addresses;
(e) any personal data in your code, test data, logs or previews;
(f) login details of test accounts you give us.
A3.3 Special categories of personal data and data about criminal convictions are not part of the processing. Clause 5.3 of the terms says you don't give us any. If we notice some anyway, we tell you and process it only as far as the work can't avoid it.
A4. Instructions
A4.1 We process client personal data only on your documented instructions, transfers to other countries included. Your instructions are these terms, the issues you delegate, the scopes you approve, the settings you choose in the portal, and what you ask of us by email.
A4.2 We process client personal data otherwise only if we are required to do so by Union or Member State law to which we are subject. We then tell you first, unless that law forbids it.
A4.3 If we think an instruction breaks data protection law, we tell you immediately. We may then wait to carry it out until you confirm or change it.
A4.4 We don't use client personal data for our own purposes, and we don't use it, or let it be used, to train AI models.
A4.5 If a court, regulator or other public authority asks us for client personal data, we tell you at once, unless the law forbids it. We disclose only what we are legally obliged to, and we challenge a request we reasonably consider unlawful. A request under the law of a country outside the EEA is not, on its own, a requirement under clause A4.2.
A4.6 We keep your instructions with this annex: your acceptance of these terms, and what you ask of us by email.
A5. Confidentiality
A5.1 We make sure that everyone who processes client personal data for us is bound to confidentiality, by contract or by law, and processes it only on your instructions. People who work for us, freelancers included, work on our systems, under our instructions and bound to confidentiality; they are not sub-processors. Any other company we engage to process client personal data is a sub-processor under clause A7.
A6. Security
A6.1 We take appropriate technical and organisational measures to protect client personal data, taking into account the state of the art, the costs, and the risks of the processing. No set of measures removes all risk, and we don't promise that ours do.
A6.2 These are the measures in place when this annex takes effect. Connections to the portal, to our servers and to our providers are encrypted in transit (TLS). Portal records are encrypted with AES-256-GCM before they are stored, in storage that is private and never publicly addressable.
A6.3 Portal sign-in works with single-use links that expire after 15 minutes. Sessions are held in a signed cookie that scripts can't read and that expires after 14 days. Portal users have roles, and only account admins can pay or delete the account. Our staff can view your portal as you see it, to support you, and each time is logged.
A6.4 Each issue gets its own working copy of your repository on our servers. We delete it when the issue is completed or cancelled, and in any case on the day the account closes. It leaves our backups within a further 7 days (clause A12.4).
A6.5 Our GitHub App reaches only the repositories you choose. The GitHub token we put in a session's environment is limited to the one repository it works on, and GitHub makes it expire after an hour. The agent and the commands it runs, your repository's own scripts included, can use it while the session runs. We never write it into your repository's configuration. The other credentials we hold, those you give us and our own, are stored outside your repository, in files that only our server account and our administrators can read. Each client workspace has its own Linear credentials. Preview access links and test-account logins also appear in our copy of the issue in our own Linear workspace, for our reviewers (clause A8.5). The token is not the limit of what a session can reach: clause A6.6 says what is.
A6.6 Our agent runs the sessions for all our clients on one server, under one account. Every session on your issues or your repositories runs its commands in an operating-system sandbox, together with every program they start, including your repository's own scripts when a command runs them. Those commands are the only way your repository's scripts run on our server: we don't run the setup or teardown scripts a repository can provide for preparing or removing its working copy. The sandbox lets them write only to the working copy of that issue (clause A6.4), to temporary files kept for that issue, and to a package cache kept for your workspace. It hides our service's files, the files in which we keep credentials, other clients' working copies and session records, and the server's other processes. It removes the credentials our service holds from their environment, the key the agent uses to call Anthropic's models among them. Only the GitHub token for your repository stays (clause A6.5). Their network traffic goes through a proxy of ours, which refuses addresses on our own server and on private networks. If the sandbox can't run, the session doesn't start. The agent's own tools for reading and writing files run outside the sandbox. A check on every use keeps their writes to the places the sandbox allows, and keeps their reads out of our service's files, other clients' working copies and session records, and the files in which we keep credentials. The agent doesn't load settings or tool connections from your repository. These measures narrow what a session can reach. They have limits:
(a) the agent itself runs outside the sandbox and holds the key it uses to call Anthropic's models. That key works in every client's Anthropic workspace, not only yours. Our service, and the steps it takes around a session, such as preparing and removing the working copy, also run outside the sandbox, with our server account's access. Those steps run our own code, not your repository's scripts;
(b) the sandbox shares the server with everything else on it. It is not a separate machine or user account, so a flaw in the operating system or in the sandbox itself could let a session past it;
(c) public internet addresses stay reachable, because builds need package registries, GitHub and your previews. A session can send what it can read, your code included, to any of them;
(d) work we do outside Ponte runs on the same server without this sandbox. That work, and the scripts it runs, can read what our server account can read: your working copies and session records, and the credentials we hold, among them our GitHub App's private key, which gives access to every repository our GitHub App is installed on.
A6.7 Our process has a person check each change before we deliver it. Our reviewer opens your preview where there is one. Clause 4.2 of the terms and clause A14.2 require it to hold no production data and no real personal data.
A6.8 The portal keeps a log of account actions. When the account closes, we revoke our Linear access, delete our tokens, delete our working copies of your code and uninstall our GitHub App (clause 13.8(e) of the terms).
A6.9 Our agent servers are in data centres in the European Union.
A6.10 We review these measures at least once a year, and may change them as long as the overall level of protection doesn't go down.
A7. Sub-processors: authorisation
A7.1 You give us general authorisation to use sub-processors. The sub-processors on the list in clause A8 are authorised when you accept these terms.
A7.2 We engage each sub-processor under a written contract that imposes the obligations article 28(3) GDPR requires. Where its terms differ from this annex in detail, we still answer to you for its performance as for our own (article 28(4) GDPR). If it fails to meet its data protection obligations, we remain responsible to you for that, within the limits of clause 10 of the terms as far as the law allows. Clause 11 of the terms doesn't release us from that.
A7.3 We tell your account admins by email at least 14 days before we add or replace a sub-processor. You can object within those 14 days, on reasonable grounds relating to data protection. We then look for a solution with you. If there isn't one, you may stop the affected lanes, or end the agreement, at once. We then refund the fees for the unused part of the paid month, and an unused First Issue (clause 3.12 of the terms).
A7.4 If we must replace a sub-processor urgently, for example because it fails or has a security problem, we may do so with shorter notice. We still tell you before the new sub-processor processes client personal data, and your right to object in clause A7.3 still applies.
A7.5 Each sub-processor in clause A8 uses its own sub-processors, listed at the address given in its entry. When one of them tells us it is adding or replacing one, we pass that on to your account admins promptly, and before the change takes effect where the sub-processor's notice allows it. You can object as clause A7.3 says.
A8. Sub-processors: the list
A8.1 Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, and its affiliate Anthropic, PBC, United States. Runs the AI models our agent uses (clause 3.5 of the terms), under Anthropic's Commercial Terms and data processing addendum, which don't allow it to train models on what we send it. It receives what the agent reads and writes: issues, comments, attachments, workspace details, code and repository history, what it sees on your previews, the test-account logins and preview access links it uses, and our reviewers' notes on your issues. Our agent sends client personal data to Anthropic through its commercial API. We never put it into the Claude assistant our staff use for our own administration. Our sessions on your issues run in an Anthropic workspace in our organisation that is dedicated to your workspace and tagged with your Linear workspace's identifier. We create it only after you accept these terms. Until it is ready, your sessions may run in our organisation's default workspace. The dedicated workspace shows the use and cost of your work apart from other clients'. It doesn't separate access: the key our sessions use works in every client's workspace (clause A6.6). The same terms, retention and security apply to both. When the account closes, we archive your dedicated workspace. Anthropic keeps an archived workspace, with its tag, in our organisation. Our portal creates and archives these workspaces, and reads what each one used and cost, with our organisation's administrative key for Anthropic. That key is kept only in our portal, never on our agent servers. Anthropic stores data in the United States; the models may run in other countries. Under its retention policy when these terms take effect, it deletes what we send it, and what its models return, within 30 days. Content its automated systems flag under its usage policy it may keep for up to two years, and the scores of that check for up to seven years. The law may require longer. Its usage and cost reports, which say what each workspace used and cost per day and per model, are billing records and hold no content. Its sub-processors: anthropic.com/subprocessors.
A8.2 Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hosts our agent servers: working copies of your repositories, issue data, session records, logs, and the credentials you give us. Location: Helsinki (Finland, run through Hetzner Finland Oy) and Germany. No transfer outside the EEA. Its sub-processors: hetzner.com/AV/subunternehmer.pdf.
A8.3 Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. Hosts the portal and its encrypted storage: the status and history of your work, issue titles, our questions, scopes and delivery summaries, links to pull requests and previews, repository names, delivery measurements, and the names of your workspace's members. Portal accounts, including admins' names and email addresses, are ours as controller (clause A1.2). Location: mainly the United States; Vercel may process data in other countries where it or its sub-processors operate. Its sub-processors: security.vercel.com.
A8.4 Plus Five Five, Inc., trading as Resend, 2261 Market Street #5039, San Francisco, CA 94114, United States. Sends our emails, which may contain names, email addresses, issue identifiers and titles, and the questions our agent asks you about an issue. It stores all data in the United States, and keeps the emails it sends for 30 days. Our emails carry no open or click tracking. Its sub-processors: resend.com/legal/subprocessors.
A8.5 Linear Orbit, Inc., 2261 Market St STE 10632, San Francisco, CA 94114, United States. Hosts our own Linear workspace, where our reviewers keep a copy of each delegated issue, in a team only our own staff and our own apps can access. Linear's own AI features are switched off in our workspace. The copy holds the issue with its scope, our review notes, links to your pull request and preview, preview access links, the test-account logins you give us, and the code changes Linear shows from our review copies. Location: the European Union, where our workspace's data is hosted. Linear keeps workspace and account information, usage data, and the notification emails it sends for 7 days, in the United States. Its sub-processors: trust.linear.app/subprocessors.
A8.6 GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, United States. Hosts a private repository for your workspace in our own GitHub organisation, where our reviewers get a copy of your repository's history up to each branch we build for you. Location: the United States, and other countries where GitHub or its sub-processors operate. Its sub-processors: github.com/subprocessors.
A8.7 Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, with its affiliate Google LLC, United States. Hosts our email, including client personal data you put in messages about your work, which we process under this annex. Location: any country where Google or its sub-processors have facilities, including the United States. Its sub-processors: workspace.google.com/terms/subprocessors.html.
A9. Transfers outside the EEA
A9.1 We transfer client personal data outside the European Economic Area only to the sub-processors and countries in clause A8, for the processing described there.
A9.2 For the providers outside the EEA that we contract with directly, Vercel, Resend, Linear and GitHub, the transfer rests on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, module three, processor to processor) in that provider's data processing terms. Vercel, Resend and GitHub are also certified under the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), and the transfer to them rests on that too.
A9.3 Where we contract with a provider's entity in the EEA, as with Anthropic Ireland, Limited and Google Cloud EMEA Limited, that entity passes the data on to its affiliates and sub-processors outside the EEA under the safeguards in its own terms, such as the standard contractual clauses.
A9.4 We keep an assessment of these transfers, and review it at least once a year and whenever the law or a provider's safeguards change. On request we send it to you with a copy of the safeguards, commercial details removed. If a safeguard stops being valid, we tell you, and we either use another one or stop the transfer.
A10. Assistance
A10.1 If a data subject asks us about client personal data, we pass the request on to you within five working days. We don't answer it ourselves, unless you ask us to.
A10.2 We help you, as far as we reasonably can with the information we have, to answer data subjects and to meet your duties on security, personal data breaches, data protection impact assessments and prior consultation (articles 32 to 36 GDPR).
A10.3 This help is free, unless requests are excessive. We then tell you our costs before we charge them.
A11. Personal data breaches
A11.1 We tell your account admins by email without undue delay, and at the latest within 48 hours after we became aware of it, about any personal data breach involving client personal data. We tell you even if we don't know everything yet.
A11.2 We tell you, as far as we know: what happened; which kinds of data and roughly how many people are involved; the likely consequences; what we have done and will do about it; and who you can contact. We keep you updated until the breach is closed.
A11.3 We don't notify a regulator or data subjects on your behalf, unless you ask us to or the law requires it.
A11.4 We keep a record of every personal data breach involving client personal data: the facts, the effects and what we did. You get the part that concerns you on request.
A11.5 Breach notices go to your account admins by email. You reach us about a breach at privacy@pontedigital.co.
A12. Return and deletion
A12.1 Your code and issues stay in your own GitHub and Linear. That is where they are returned. An account admin can also download your record from Settings until 90 days after the account closes. By accepting these terms you choose deletion at the end (article 28(3)(g) GDPR). If you'd rather have a copy of client personal data we hold returned first, an account admin tells us before the account closes, and we send it before we delete.
A12.2 While the agreement runs, we keep client personal data for these periods:
(a) a working copy of your repository on our servers: until its issue is completed or cancelled. Our clone of your repository, from which we make the working copies, stays until the account closes, and so does the package cache your sessions share (clause A6.6);
(b) session records, logs of the agent's work, issue attachments, and the temporary files of the issue's sessions on our servers: until 90 days after the issue is completed or cancelled. Session records include the transcripts that Claude Code, the tool our agent runs in, keeps of each session. Claude Code also keeps working files for each session, such as task lists, file-edit history, shell snapshots and debug logs, and deletes them within 90 days after they were last changed;
(c) our copies of an issue in our Linear workspace: until 90 days after the issue is closed;
(d) review copies: we delete their branches when the issue ends. GitHub keeps the commits of a closed pull request until its repository is deleted, so the review repository for your workspace keeps them until clause A12.3 applies;
(e) our service logs: 30 days;
(f) delegations we hold until your workspace can take them: as clause 3.10 of the terms says;
(g) preview access values and test-account logins you give us: until you ask us to remove them;
(h) the status and history of your work in the portal, and the names of your workspace's members there: while the account is open;
(i) copies our staff make to support you, such as extracts from logs and notes: we delete them within 30 days after the support case closes.
A daily run deletes what (b) and (c) cover once its period has passed, apart from Claude Code's working files, which Claude Code deletes itself. Where Linear only lets us move an issue to its trash, Linear erases it within 30 days after that. What we delete from our agent server leaves its backups within a further 7 days (clause A12.4).
A12.3 When the account closes, we delete client personal data as follows:
(a) working copies and our clones of your repositories on our servers: that day, and from backups within a further 7 days;
(b) preview access values and test-account logins you gave us: from our servers within 30 days, and from backups within a further 7 days. The copies in our Linear workspace go with our copies of your issues, under (e);
(c) session records, logs of the agent's work, issue attachments, and your sessions' temporary files and package cache on our servers: within 30 days, and from backups within a further 7 days. Claude Code's working files (clause A12.2(b)) go within 90 days after they were last changed, and from backups within a further 7 days;
(d) the review repository for your workspace in our GitHub organisation: within 30 days. GitHub may keep a deleted repository restorable for up to 90 days;
(e) our copies of your issues in our Linear workspace: within 90 days. Where Linear only lets us move one to its trash, Linear erases it within 30 days after that;
(f) portal records that came from your workspace: 90 days after closing, or at once if an account admin chose Delete everything now;
(g) copies our staff made to support you: within 30 days.
A12.4 Our agent server (clause A6.6) is backed up daily. Hetzner keeps the last seven daily backups, in the European Union, and deletes the oldest when it makes a new one. We keep no other backups or copies of that server, and use the backups only to restore our systems. So what we delete from our agent server leaves its backups within a further 7 days.
A12.5 Anthropic deletes what we sent it as clause A8.1 says.
A12.6 We keep client personal data beyond these periods only where Union or Member State law requires it. Where you have made a claim against us, or told us you will, we keep what we need to deal with it, as controller, until it is settled. On request we confirm deletion in writing.
A13. Audits
A13.1 On request we give you the information you need to check that we meet this annex: this annex, our security measures, and the certifications or audit reports of our sub-processors that we are allowed to share.
A13.2 If that isn't enough, you, or an independent auditor bound to confidentiality, may audit us once every twelve months, with 30 days' written notice, during working hours, and without access to other clients' data or to our sub-processors' premises. You bear the costs, unless the audit shows that we materially breached this annex. A regulator may always audit us as the law allows.
A13.3 The twelve-month limit doesn't apply after a personal data breach involving client personal data, or where a supervisory authority asks you to audit us.
A13.4 We don't charge for our own time in an audit up to one working day a year. Beyond that we charge reasonable rates, which we tell you in advance.
A14. What you do
A14.1 You make sure you have a legal basis for the processing, that your instructions comply with the law, and that you inform the people concerned, your staff included, that you use Ponte.
A14.2 You meet clauses 4 and 5 of the terms. In particular, previews and test data hold no real personal data. If a preview does show real personal data, our reviewer may see it.
A15. Liability and precedence
A15.1 Liability under this annex falls under clause 10 of the terms, as far as the law allows. It doesn't change what each of us owes data subjects under article 82 GDPR. Each of us bears the fines imposed on it.
A15.2 On the protection of personal data, this annex prevails over the rest of the terms.
A15.3 This annex applies for as long as we process client personal data, including after the agreement ends.