Such Much Voice Terms of Service

These Terms of Service (the “Terms”) govern access to and use of the Such Much Voice websites at https://suchmuch.ai/ and related domains, the Such Much Voice application at https://suchmuch.ai/app, exports, support, documentation and professional services (collectively, the “Services”).

The Services are provided by UAB Such Much AI, a private limited liability company incorporated in Lithuania, company code 306405204, registered address Bukčių g. 6-38, Vilnius, LT-04127, Lithuania, VAT number LT100017966319 (“Such Much AI”, “we”, “us” or “our”). Such Much AI is the sole provider and operator of the Services and the only Such Much AI group company that is a party to these Terms. SIA “Such Much AI” (Latvia) and Such Much AI, Inc. (Delaware, United States) are separate legal persons, are not parties to these Terms and do not receive access to Customer Data.

By creating an Account, placing an order, signing or accepting an Order Form, clicking to accept these Terms, or otherwise accessing or using the Services, the Customer agrees to these Terms. A person accepting these Terms on behalf of an organization represents and warrants that they have authority to bind that organization.

1. Definitions

1.1“Account” means a registered profile or workspace used to access the Services.

1.2“Acceptable Use Policy” or “AUP” means the Such Much Voice Acceptable Use Policy set out in Annex 2 to these Terms, as updated from time to time.

1.3“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a party, where “control” means direct or indirect ownership of more than 50% of the voting interests or the legal power to direct the management of the entity.

1.4“Authorized User” means an employee, official, contractor or other individual whom the Customer permits to use the Services under its Account.

1.5“Customer” means the legal entity, public authority, organization or other person that enters into these Terms or an Order Form.

1.6“Customer Data” means Recordings, uploaded files, meeting metadata, speaker labels, settings and any other content submitted to the Services by or on behalf of the Customer, including personal data contained in that content.

1.7“Documentation” means the user guides, product descriptions, technical documentation, supported-language and accuracy information, onboarding materials and other materials describing the intended use, operation and limitations of the Services made available by Such Much AI, including the AI Transparency Notice.

1.8“DPA” means the Such Much Voice Data Processing Agreement set out in Annex 1 to these Terms and any additional data-processing terms incorporated into an applicable Order Form.

1.9“Exportable Data” means Customer Data and Output that the Customer may export from the Services, as specified in Section 12 and in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal.

1.10“Order Form” means an ordering document, signed proposal, procurement agreement, purchase order, statement of work, online plan selection, subscription confirmation or other written or electronic ordering instrument that identifies the applicable Services and incorporates or references these Terms.

1.11“Output” means content generated, returned, suggested, transformed or exported by the Services from Customer Data, including transcripts, speaker-labelled transcripts, summaries, meeting notes, action items and other derived text.

1.12“Participant” means a natural person whose voice, image, statements or other personal data are captured in a Recording, whether or not that person is an Authorized User.

1.13“Policies” means the then-current policies referenced by these Terms, including the Privacy Policy (with its cookie section), the AUP, the AI Transparency Notice in Part C of the Legal Notice and Trust Information page and any security or support policies made available through the Services or Such Much AI websites.

1.14“Professional Services” means consulting, onboarding, training and related implementation services described in an applicable Order Form or statement of work.

1.15“Recording” means any audio or audio-visual recording or audio file submitted to or captured through the Services, including recordings made through the in-browser recorder.

1.16“Term” means the period during which these Terms and the applicable Order Form remain in effect.

2. Intended Customers; Business Use; Consumer Rights

2.1Intended customers. The Services are designed and offered for business, professional, institutional and public-sector use (B2B/B2G). We do not market paid plans as consumer services.

2.2Business-use representation. By entering into these Terms or using paid Services, the Customer represents that it acts in the course of its trade, business, profession or public function and that the person accepting these Terms has authority to act on its behalf.

2.3Consumer fallback. If a natural person uses the Services for purposes outside their trade, business, profession or public function, the mandatory consumer-protection provisions of the Civil Code of the Republic of Lithuania and the Law on Consumer Protection apply, including the 14-day right of withdrawal from a distance contract. If the consumer expressly requests that the Services begin during the withdrawal period and then withdraws, the consumer pays a proportionate amount for the Services provided until withdrawal; the right of withdrawal is lost once the Services have been fully performed with the consumer’s prior express consent and acknowledgement. Provisions of these Terms that conflict with non-waivable consumer rights apply only to the extent permitted by law, and a Lithuanian-language version of these Terms is made available to consumers before they conclude the contract.

3. Contract Formation; Order of Precedence

3.1Parties. The contract for the Services is entered into solely between the Customer and Such Much AI. No other Such Much AI group company is a party to or liable under these Terms.

3.2Order of precedence. If documents forming the parties’ agreement conflict, the following order of precedence applies, from highest to lowest: (a) a specifically negotiated procurement agreement, service agreement, Order Form or statement of work; (b) the DPA, for data-protection matters only; (c) these Terms; (d) the AUP; and (e) the other Policies and Documentation. A document prevails only regarding the subject matter of the conflicting provision. Mandatory law always prevails to the extent it cannot be contractually modified.

3.3Electronic contracting. These Terms, Order Forms, acceptances, notices and related records may be formed, signed, stored and evidenced electronically to the extent permitted by law.

4. Accounts; Access; Authorized Users

4.1Accounts. The Customer is responsible for all activity under its Account, for keeping credentials confidential and for promptly notifying us of any suspected unauthorized access or misuse. The Customer must use available security features, including multi-factor authentication where offered.

4.2Access right. Subject to these Terms, the applicable Order Form and payment of applicable fees, Such Much AI grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right, revocable as set out in Sections 11 and 12, during the Term to access and use the Services for the Customer’s internal lawful business, professional, institutional or public-administration purposes.

4.3Authorized Users. The Customer may permit Authorized Users to use the Services on its behalf, within the user and usage limits of the applicable plan. Authorized Users must be at least 18 years old. The Customer remains responsible for their compliance with these Terms and the AUP.

4.4Technical requirements. The Customer is responsible for ensuring that its devices, browsers, microphones and networks satisfy the technical requirements reasonably specified in the Documentation. Transcription quality depends on audio quality, and the Services cannot compensate for inaudible, corrupted or heavily degraded Recordings.

4.5Third-party platforms. The Services do not connect to meeting platforms, calendars or other third-party tools. Recordings made with other tools may be uploaded as files; the Customer must hold the necessary rights to those recordings and comply with the terms of the tool used to make them.

4.6Changes to the Services. We may modify, update or enhance the Services from time to time. We will not materially reduce the core paid functionality during a committed subscription term except where required by law, security, third-party dependency changes or measures necessary to address misuse or material risk.

5. Recordings and Participants

5.1Customer responsibility. The Customer is solely responsible for the lawfulness of making, capturing, uploading and processing each Recording, including: (a) ensuring that it has a lawful basis under the GDPR and applicable national law for recording and processing Participants’ personal data; (b) informing Participants in accordance with Articles 13 and 14 GDPR and obtaining their consent where consent is required by applicable law, the rules of the meeting platform or professional rules; (c) complying with laws protecting the confidentiality of communications and prohibiting covert recording, including Articles 166, 167 and 168 of the Criminal Code of the Republic of Lithuania, Article 2.23 of the Civil Code of the Republic of Lithuania and equivalent laws in every jurisdiction where a Participant is located; (d) complying with employment-law rules on monitoring where employees are recorded; and (e) complying with confidentiality, professional-secrecy and classified-information rules that apply to the Customer.

5.2No covert recording. The Customer will not use the Services to record any conversation, call or meeting where a Participant has not been informed of the recording when the law requires such information, or to record communications to which the Customer or its Authorized User is not a party without lawful authority. The Recording and Participant Notice Guidelines in Part D of the Legal Notice and Trust Information page at suchmuch.ai/legal provide practical guidance and template notices; they are not legal advice.

5.3No meeting assistant. The Services do not join video or audio meetings and do not capture audio from meeting platforms. Recordings are made through the in-browser recorder using the device microphone or are uploaded as files.

5.4Participant requests. If a Participant contacts us about a Recording, we will refer the Participant to the Customer and assist the Customer under the DPA. The Customer is responsible for responding to Participants’ requests, objections and complaints concerning Recordings and Output.

5.5No biometric identification. The Services label speakers within a single Recording (for example “Speaker 1”). The Services do not create persistent voiceprints or other biometric templates and do not identify individuals by voice across Recordings. Any future voice-enrolment or speaker-recognition feature will be opt-in, documented and subject to a separate written agreement covering Article 9 GDPR.

6. Restrictions; Acceptable Use

6.1Restrictions. The Customer will not, and will not permit any third party to: (a) reverse engineer, decompile, disassemble or attempt to derive source code, underlying models or non-public components of the Services, except to the extent such restriction is prohibited by mandatory law; (b) bypass usage limits, access restrictions, authentication measures or security controls; (c) use the Services to develop, train, benchmark for publication or provide a competing product or service without our prior written consent; (d) scrape, spider, crawl or otherwise access the Services by automated means; (e) introduce malware, harmful code, denial-of-service traffic or material that may disrupt the Services or third-party systems; (f) use the Services in violation of law, third-party rights, procurement rules, confidentiality obligations or binding professional duties; (g) use the Services for AI practices prohibited by Article 5 of Regulation (EU) 2024/1689 or for unlawful manipulation, deception, discrimination or rights-infringing content; (h) use the Services to make solely automated decisions producing legal or similarly significant effects on natural persons; (i) use the Services or Output to infer the emotions of a natural person in the workplace or in education, to categorize Participants by biometric data, or to clone, imitate or impersonate a natural person’s voice; (j) submit classified information or information subject to professional secrecy without appropriate written agreement and safeguards; or (k) represent Output as a verbatim, certified, sworn or human-reviewed transcript when that is not true.

6.2Special categories of personal data. The Services are not designed for the systematic processing of special categories of personal data under Article 9 GDPR or criminal-offence data under Article 10 GDPR, and the Customer will not use them for that purpose unless expressly agreed in writing with appropriate safeguards. The Customer acknowledges that Participants may incidentally mention such information during a recorded conversation; the Customer is responsible for ensuring that a condition under Article 9(2) GDPR applies to any such processing, for minimizing it and for deleting Recordings and Output that it is not entitled to retain.

6.3Acceptable Use Policy. The AUP forms part of these Terms. We may apply reasonable technical controls, including rate limits, concurrency limits, storage limits, maximum file sizes and durations, fair-use controls and anti-abuse measures, to protect the security, integrity and stability of the Services.

7. AI-Specific Terms; Intended Purpose; Human Oversight

7.1Nature of the Services. The Services use probabilistic machine-learning techniques, including automatic speech recognition, speaker diarization and large language models, to transcribe, label, summarize and structure spoken content. Output may be incomplete, inaccurate, outdated, biased or otherwise unsuitable without review.

7.2Intended purpose. Unless an Order Form states otherwise, the Services are intended as transcription, note-taking and document-processing assistance tools within the scope described in the Documentation. They are not offered as, and must not be used as, certified transcription services, official records of judicial or administrative proceedings, biometric identification or categorization systems, emotion-recognition systems, lie-detection or credibility-assessment tools, or as the basis for decisions in employment, education, credit, insurance, law enforcement, migration or access to essential services that would make the Customer’s use a high-risk use under Annex III of Regulation (EU) 2024/1689. Use for such purposes requires a prior written assessment and agreement.

7.3Known limitations. Transcription and summarization accuracy varies with audio quality, background noise, microphone placement, overlapping speech, accents, dialects, code-switching, domain-specific terminology, proper names, numbers, dates and the languages supported as listed in the Documentation. Speaker labels may be wrong or inconsistent. Summaries may omit, over-weight or misattribute statements.

7.4Human oversight. The Customer is responsible for reviewing, validating and approving Output before use, publication, filing, distribution or reliance, including Output that will be used as minutes, records of decisions, evidence, quotations, contractual commitments or communications to third parties. The Services do not provide legal, medical, financial, procurement, HR or other regulated professional advice.

7.5Similarity of Output. Because of the nature of machine-learning systems, Output generated for different Customers from similar input may be similar or identical.

7.6AI literacy. In line with Article 4 of Regulation (EU) 2024/1689, as amended, the Customer will take measures to support the AI literacy of the Authorized Users who use the Services. The AI Transparency Notice and Documentation support, but do not replace, the Customer’s obligation.

8. Transparency and Marking of AI-Generated Content

8.1Marking. We label transcripts as AI-generated in the interface and in exports and, for summaries, meeting notes and other generated text, we apply machine-readable marking using the method described in the AI Transparency Notice, in line with Article 50(2) of Regulation (EU) 2024/1689 and the applicable Code of Practice on the transparency of AI-generated content.

8.2Interactive features. The Services do not include an AI assistant, chat or question-answering feature. If such a feature is introduced, the interface will make clear that the user is interacting with an AI system.

8.3Marker limitations and downstream disclosure. Markers may not survive copy-paste, format conversion, editing, re-authoring, external processing or downstream publication. The Customer is responsible for any disclosure, labelling or transparency measures required by law for its own use or publication of Output, including where markers have been removed or do not persist.

8.4No synthetic speech. The Services convert speech to text and text to text. They do not generate synthetic speech, clone voices or create audio deepfakes. If we introduce any such feature, we will update the AI Transparency Notice and these Terms before it is made available.

9. Professional Services

9.1Scope. Professional Services are limited to the configuration, implementation, onboarding, training and support described in the applicable Order Form and performed within the documented functional scope of the Services. They do not change the intended purpose or legal classification of the Services unless the parties expressly agree otherwise after an appropriate assessment.

9.2Cooperation and acceptance. The Customer will provide timely access, information, decisions and cooperation reasonably required for Professional Services; Customer-caused delays may affect timelines, scope and fees. Unless an Order Form provides specific acceptance criteria, deliverables are deemed accepted unless the Customer rejects them in writing within 10 business days of delivery, stating the non-conformity.

10. Fees; Billing; Usage; Taxes

10.1Fees. The Customer will pay the fees stated in the applicable Order Form or selected plan. Usage may be measured in minutes or hours of audio processed, number of Recordings, storage, Authorized Users or other metrics stated in the plan.

10.2Billing. Fees may be billed monthly, annually or as otherwise specified in the Order Form. Unless stated otherwise, subscription fees are billed in advance and usage-based fees are billed in arrears.

10.3Included usage and credits. Included minutes, credits and other usage entitlements may be subject to reset periods, plan limits and fair-use controls. Unless an Order Form states otherwise, unused included usage does not roll over.

10.4Overages. We may charge for usage exceeding plan limits at the rates stated in the applicable Order Form or published pricing.

10.5Payment terms. The Customer will pay undisputed invoices by the stated due date. Overdue amounts may accrue statutory late-payment interest and recovery costs under the Law of the Republic of Lithuania on the Prevention of Late Payment in Commercial Transactions, or the applicable statutory rules for consumers.

10.6Suspension for non-payment. We may suspend access to paid Services for overdue payment after at least 10 days’ written notice, unless prohibited by the applicable Order Form or mandatory law.

10.7Taxes. Fees exclude VAT and other taxes unless stated otherwise. The Customer is responsible for applicable taxes unless a reverse-charge or other mechanism applies and the Customer provides the information reasonably required to apply it, including a valid VAT identification number.

10.8Refunds. Fees are non-refundable except where required by mandatory law, where expressly stated in an Order Form or where Section 17.3 or Section 21.3 of these Terms or Section 6.5 of the DPA applies.

10.9Trials and free plans. Free trials, free plans, pilots, beta features and other free Services may be modified, limited, suspended or withdrawn at any time and are provided without warranties to the fullest extent permitted by law. Recordings and Output on free plans may be subject to shorter retention periods stated in the Documentation.

11. Term; Renewal; Suspension; Termination

11.1Term. These Terms begin when the Customer first accepts them or first uses the Services and continue while an Account or Order Form remains active.

11.2Subscription term and renewal. Paid subscriptions continue for the term stated in the Order Form. Unless the Order Form states otherwise, subscriptions renew for successive periods equal to the initial term. Either party may prevent renewal by giving notice before the deadline stated in the Order Form or, if no deadline is stated, at least 20 days before the next renewal date. Monthly online plans may be cancelled at any time with effect from the end of the current billing period.

11.3Suspension. We may suspend access where reasonably necessary to: (a) address a material security risk, abuse, fraud or service-integrity issue; (b) comply with law or a binding instruction from a competent authority; (c) prevent material harm to us, the Customer, Participants, other customers or third parties; or (d) address the Customer’s material breach, including non-payment (subject to Section 10.6) or a breach of Section 5 or the AUP. Where reasonably practicable, we will notify the Customer before suspension and limit the suspension to the affected Services or Accounts.

11.4Termination for cause. Either party may terminate an Order Form for material breach that is not cured within 30 days after written notice. Termination may be immediate if the breach cannot be cured, if immediate termination is required by law or if it is necessary to prevent material harm, including harm to Participants.

11.5Effect of termination. Upon termination or expiry: (a) the Customer’s access rights end, subject to the retrieval period in Section 12; (b) accrued and outstanding fees become due; (c) Customer Data and Output are returned, deleted or rendered inaccessible in accordance with Section 12 and the DPA; and (d) provisions that by their nature should survive, including accrued fees, confidentiality, intellectual property, limitations of liability, indemnities, data return and deletion and dispute resolution, survive.

12. Switching, Data Portability and Exit (Regulation (EU) 2023/2854)

12.1Right to switch. The Customer may at any time request to switch to another provider of data processing services or to on-premises infrastructure, to port Exportable Data, or to erase Exportable Data, by giving notice to us. The notice period for initiating the switching process is one month and in no case exceeds two months. The affected Order Form is considered terminated, and we will notify the Customer of the termination, upon successful completion of the switching process or, where the Customer requests only erasure of Exportable Data on service termination, at the end of the notice period. Any early-termination fee stated in the Order Form applies in accordance with Section 12.7.

12.2Exportable Data. The categories of data and digital assets that can be ported are: (a) original Recordings in the format in which they were uploaded or captured; (b) transcripts, including speaker labels and timestamps; (c) summaries, meeting notes, action items and other generated Output; (d) workspace settings created by the Customer; and (e) Account, user and usage metadata. The formats available for each category, the export methods (in-app download and account export) and known technical limitations are specified in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal, which also serves as our online register of data structures, formats and interoperability specifications under Article 26 of Regulation (EU) 2023/2854. Exportable Data does not include our software, models, prompts, system templates, Documentation or other assets that are protected by our intellectual-property rights or trade secrets.

12.3Transitional period. We will support the Customer’s exit strategy and complete the switching process within a mandatory maximum transitional period of 30 calendar days starting at the end of the notice period in Section 12.1, during which the parties’ agreement continues to apply and we will maintain business continuity and the agreed level of security. If switching within 30 days is technically unfeasible, we will notify the Customer within 14 working days of the request, giving reasons and an alternative transitional period not exceeding seven months. The Customer may extend the transitional period once for a period it considers appropriate.

12.4Retrieval period. After the transitional period ends, or after termination for any other reason, the Customer may retrieve Exportable Data for at least 30 days (the “Retrieval Period”). During the Retrieval Period the Services remain available in read-only or export mode as described in the Documentation.

12.5Deletion. After the Retrieval Period, or earlier at the Customer’s documented request, we will delete Exportable Data and all other Customer Data from active systems and, unless an Order Form states otherwise, from backups through ordinary backup rotation within 90 days thereafter, except where Union or Member State law requires retention. Deletion is confirmed on request.

12.6Information on risks. Known risks to continuity in the provision of functions or services during the switching process, including the loss of in-app search after export, are described in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal.

12.7Charges. We do not impose switching charges, including data-egress charges, for the actions described in this Section. Where an Order Form provides a committed term, an early-termination fee stated in that Order Form may apply if the Customer terminates before the end of the committed term; such a fee reflects the agreed minimum commitment and is disclosed before the contract is concluded.

12.8Good faith. Both parties will cooperate in good faith to make switching effective, timely and secure.

13. Intellectual Property; Customer Data; Output

13.1Service rights. Such Much AI and its licensors retain all right, title and interest in and to the Services, including software, source code, models, prompts, algorithms, workflows, templates, user interfaces, Documentation, configurations, know-how, improvements and related intellectual-property rights. No rights are granted except as expressly stated in these Terms or an Order Form.

13.2Customer Data. As between the parties, the Customer retains all rights in Customer Data. The Customer grants Such Much AI and its authorized subprocessors a limited, non-exclusive, worldwide, royalty-free right to host, process, transmit, reproduce, display and otherwise use Customer Data solely as necessary to provide, secure, maintain and support the Services, perform Professional Services, comply with documented instructions, enforce the parties’ agreement and comply with law.

13.3Output. As between the parties, the Customer owns Output to the extent ownership is recognized under applicable law. To the extent transferable rights in Output vest in Such Much AI, Such Much AI assigns those rights to the Customer upon payment of applicable fees. This does not transfer any rights in the Services, underlying technology, templates, workflows or Documentation. The Customer acknowledges that Output reproduces statements made by Participants and may embody third-party rights (for example in a recorded lecture or performance), and remains responsible for its use, publication, filing and reliance on Output.

13.4Feedback. If the Customer provides suggestions, ideas or feedback concerning the Services, we may use them without restriction or compensation, provided that doing so does not disclose Customer Data or the Customer’s Confidential Information.

13.5No training without opt-in. We do not use Recordings, other Customer Data or Output to train or fine-tune speech, language or other models for other customers or for general model improvement unless the Customer expressly opts in through a specific written agreement describing the scope, purposes and safeguards.

13.6Aggregated and de-identified data. Unless prohibited by an Order Form, we may generate and use aggregated, statistical and de-identified information (for example average audio duration, language distribution or feature usage) to operate, secure, support and improve the Services, provided that it does not identify the Customer, any Participant or any other individual and does not disclose Customer Data. This Section does not authorize use of Customer Data for model training.

13.7No sale of Customer Data. We do not sell Customer Data or Output.

14. Data Protection; Hosting; Security

14.1Roles. For personal data contained in Customer Data, the Customer is the controller and Such Much AI is the processor unless otherwise expressly agreed in writing. For account administration, contracting, billing, support communications and similar data processed for our own purposes, Such Much AI is a separate controller as described in the Privacy Policy at suchmuch.ai/privacy.

14.2DPA. The DPA applies whenever we process personal data in Customer Data on the Customer’s behalf and is incorporated into these Terms. A more specific data-protection schedule in an Order Form prevails to the extent of its specific requirements.

14.3EU hosting. Customer Data and Output are stored and processed in Microsoft Azure data-center regions located in the European Union, as listed in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal; limited remote support access by Microsoft is described in Section 11.3 of Annex 1. Speech-to-text and language-model processing is performed in EU Azure regions. We do not transmit Customer Data to foundation-model APIs outside that environment. We will not store or process Customer Data outside the European Union without the Customer’s prior written agreement.

14.4Security. We implement appropriate technical and organizational measures designed to protect the confidentiality, integrity and availability of Customer Data, taking into account the nature and risks of the processing. The baseline measures are described in Schedule 2 to the DPA.

14.5Subprocessors. We use Microsoft Ireland Operations Limited (Microsoft Azure) and the other subprocessors listed in Part B of the Legal Notice and Trust Information page at suchmuch.ai/legal to provide the Services, in accordance with the DPA. Our Affiliates do not receive access to Customer Data.

14.6Incidents. We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data and provide available information reasonably necessary for the Customer to fulfil its notification and documentation obligations.

15. Confidentiality

15.1Confidential Information. Each party may receive non-public information from the other party that is marked confidential or reasonably should be understood as confidential given its nature and the circumstances of disclosure (“Confidential Information”). Confidential Information includes Customer Data, Output, security information, non-public product information, pricing, business plans and trade secrets.

15.2Obligations. The receiving party will: (a) use Confidential Information only to perform or exercise rights under the parties’ agreement; (b) protect it using at least reasonable care and no less care than it uses for its own similar information; and (c) disclose it only to personnel, subprocessors, contractors or professional advisers who need to know it for an authorized purpose and are bound by appropriate confidentiality obligations.

15.3Exclusions. Confidentiality obligations do not apply to information that the receiving party can demonstrate is or becomes public without breach of the parties’ agreement, was lawfully known without restriction before disclosure, is lawfully received from a third party without a confidentiality restriction, or is independently developed without using the disclosing party’s Confidential Information.

15.4Required disclosure. A party may disclose Confidential Information where required by law, court order or competent authority, provided that it gives prior notice where legally permitted and reasonably cooperates to limit the disclosure.

15.5Survival. Confidentiality obligations survive for five years after termination. Trade secrets and personal data remain protected for as long as required by applicable law or while they retain their protected status.

16. Warranties; Disclaimers

16.1Authority. Each party warrants that it has authority to enter into the parties’ agreement.

16.2Service standard. We warrant that paid Services will be provided in substantial conformity with the applicable Documentation under normal use, subject to the limitations stated in these Terms and the Order Form.

16.3Availability. Unless an Order Form states a specific service level, we do not guarantee uninterrupted or error-free operation. Maintenance, updates, security measures and third-party dependencies may cause temporary interruptions.

16.4Output. Output is an assistive draft. We do not warrant any particular transcription accuracy, word-error rate, speaker-labelling accuracy or completeness of summaries. The Customer is responsible for reviewing, validating and approving Output and deciding whether to use or rely on it.

16.5General disclaimer. Except as expressly stated in these Terms or an Order Form, the Services, Output, beta features, trials and Professional Services are provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim implied warranties, including merchantability, fitness for a particular purpose and non-infringement.

16.6No professional advice. The Services and Output do not constitute legal, tax, procurement, accounting, employment, medical or other regulated professional advice, and transcripts are not certified or sworn transcripts.

17. Indemnities

17.1IP indemnity. Subject to this Section, Such Much AI will defend the Customer against a third-party claim alleging that the unmodified paid Services, as provided and used in accordance with these Terms, directly infringe a third party’s copyright, trademark or EU/EEA patent, and will pay finally awarded damages or settlement amounts approved by Such Much AI, provided that the Customer promptly notifies us, allows us to control the defense and settlement, and reasonably cooperates at our expense.

17.2Exclusions. Section 17.1 does not apply to the extent a claim arises from Customer Data or Output; use outside the Documentation or intended purpose; modification by the Customer or a third party; combination with products, services or data not provided or approved by us; or continued use of a non-current version after notice, where the claim would have been avoided by using the current version.

17.3Remedies. If an infringement claim is made or appears likely, we may modify the affected Services to be non-infringing, obtain the right for the Customer to continue using them, replace the affected component, or terminate the affected Services and refund prepaid fees for the unused terminated portion.

17.4Customer indemnity. To the extent permitted by applicable law, the Customer will defend and indemnify Such Much AI against third-party claims, including claims by Participants and regulatory fines to the extent lawfully recoverable, arising from: (a) Customer Data, including Recordings made or uploaded without the notice, consent or lawful basis required by applicable law; (b) the Customer’s unlawful, misleading or rights-infringing use of the Services or Output; (c) publication, filing or operational use of Output without appropriate review; or (d) the Customer’s material breach of these Terms, the AUP or third-party rights.

18. Limitation of Liability

18.1Non-excludable liability. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under mandatory law, including liability for damage caused intentionally or by gross negligence (Article 6.252 of the Civil Code of the Republic of Lithuania), liability for death or personal injury, or liability that the GDPR or other mandatory data-protection law prohibits the parties from limiting.

18.2Aggregate cap. To the maximum extent permitted by law, the total aggregate liability of Such Much AI, its Affiliates, licensors, subcontractors and personnel arising out of or relating to the Services, an Order Form, Professional Services or these Terms will not exceed the total fees paid or payable by the Customer under the affected Order Form during the 12 months preceding the event giving rise to the claim. This is one aggregate cap and is not multiplied by the number of claims or entities involved.

18.3Excluded damages. To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, exemplary, punitive or consequential damages, or for lost profits, lost revenue, lost business, loss of goodwill or business interruption.

18.4Output-related allocation. Without limiting Section 18.2, we are not liable for decisions, minutes, filings, publications, procurement actions, legal positions or operational actions taken by the Customer or a third party based on Output, or for claims by Participants arising from the Customer’s recording practices, except to the extent directly caused by our breach of an express contractual obligation.

18.5Application. The protections, exclusions and limitations in this Section apply to Such Much AI, its Affiliates, licensors, subcontractors and personnel to the extent a claim arising from the Services is made against any of them.

19. Export Controls; Sanctions

The Customer will comply with applicable EU and other export-control and sanctions laws. We may suspend or terminate access to the extent reasonably necessary to comply with such laws or binding authority instructions.

20. Public Sector; Procurement; Mandatory Law

20.1Public-sector customers. If the Customer is a contracting authority or other public-sector body subject to mandatory public-law or procurement requirements, including the Law of the Republic of Lithuania on Public Procurement, these Terms apply only to the extent consistent with those requirements and the applicable procurement agreement.

20.2Mandatory adjustments. A provision conflicting with non-waivable public-law, procurement or regulatory requirements will be modified only to the minimum extent necessary. The remaining provisions remain in effect.

20.3Authorized instructions. Operational requests and documented instructions from a public-sector Customer must be issued by persons authorized under the applicable Order Form or the Customer’s notified governance arrangements.

21. Changes to the Terms

21.1Updates. We may update these Terms and the Policies from time to time.

21.2Notice. For material changes, we will provide at least 30 days’ notice through the Services, by email, or both, and specify the effective date, unless a shorter period is required by law, security or urgent service needs.

21.3Committed terms. Changes will not retroactively modify a signed Order Form during its committed term unless required by law or security needs, or expressly agreed in writing. If a material change adversely affects the Customer during a committed term, the Customer may terminate the affected Order Form with effect from the change’s effective date and receive a refund of prepaid fees for the unused portion.

21.4Continued use. Where legally permitted and where no committed Order Form prevents the change, continued use after the effective date constitutes acceptance of the updated Terms.

22. Governing Law; Dispute Resolution

22.1Governing law. These Terms and any non-contractual obligations arising out of or in connection with them are governed by the law of the Republic of Lithuania, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods.

22.2Courts. The competent courts of Vilnius, Lithuania, have exclusive jurisdiction, unless an Order Form specifies otherwise.

22.3Good-faith negotiations. Before filing a claim, the parties will attempt in good faith to resolve the dispute through negotiations for 30 days, except for claims requiring urgent injunctive or interim relief.

22.4Consumers. A consumer may bring proceedings in the courts of their habitual residence where mandatory law so provides and may refer a dispute to the State Consumer Rights Protection Authority of the Republic of Lithuania (Vilniaus g. 25, LT-01402 Vilnius, www.vvtat.lt) for out-of-court resolution. Mandatory consumer, data-protection, public-sector and procurement rules remain applicable regardless of this Section.

23. Notices; Points of Contact

23.1Operational notices. We may send operational notices to the email address associated with the Customer’s Account or specified in the applicable Order Form.

23.2Formal notices. Formal legal notices to Such Much AI must be sent to UAB Such Much AI, Bukčių g. 6-38, Vilnius, LT-04127, Lithuania, with a copy to info@suchmuchai.com. Email alone constitutes formal notice only where the applicable Order Form permits it or we acknowledge receipt in writing.

23.3Notices to the Customer. The Customer must maintain current postal and email contact details. Formal notices may be sent to the address specified in the Account or applicable Order Form.

23.4Points of contact under Regulation (EU) 2022/2065. To the extent the Services qualify as an intermediary service, our single point of contact for Member State authorities, the European Commission, the European Board for Digital Services and recipients of the Services is info@suchmuchai.com, in English or Lithuanian. Notices of allegedly illegal content stored through the Services may be submitted to the same address and will be handled diligently and without undue delay.

24. Miscellaneous

24.1Assignment. The Customer may not assign its rights or obligations without our prior written consent, except to an Affiliate or in connection with a merger, reorganization or sale of substantially all relevant assets, provided the assignee agrees in writing to be bound. We may assign an Order Form to an Affiliate or successor in connection with a reorganization, merger, financing or sale of the relevant business, subject to mandatory law, provided that EU hosting and the other material rights of the Customer are preserved.

24.2Subcontracting. We may use subprocessors and subcontractors to perform the Services. Such delegation is not an assignment and does not relieve us of obligations for which we remain responsible under the parties’ agreement or applicable law.

24.3No partnership or agency. The parties are independent contractors. These Terms do not create a partnership, joint venture, employment, fiduciary or agency relationship.

24.4Severability. If a provision is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions remain in effect.

24.5No waiver. Failure or delay in enforcing a provision is not a waiver.

24.6Entire agreement. These Terms, the applicable Order Form, the DPA and the incorporated Policies constitute the entire agreement between the Customer and Such Much AI regarding the Services and supersede prior discussions on that subject.

24.7Language. The English version governs for business and public-sector Customers unless the applicable Order Form or mandatory law requires another language to prevail. Where Lithuanian law requires information to be provided to consumers in Lithuanian, the Lithuanian version prevails for those consumers.

24.8Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations. The affected party will use reasonable efforts to mitigate the impact and resume performance.

24.9Contact. Questions concerning these Terms may be sent to info@suchmuchai.com.

Annex 1 — Data Processing Agreement (Article 28 GDPR)

This Data Processing Agreement (the “DPA”) forms part of the Such Much Voice Terms of Service and any applicable Order Form between the Customer and UAB Such Much AI, company code 306405204, Bukčių g. 6-38, Vilnius, LT-04127, Lithuania (the “Processor” or “Such Much AI”). It applies whenever Such Much AI processes personal data contained in Customer Data on the Customer’s behalf. Capitalized terms not defined here have the meaning given in the Terms. “GDPR” means Regulation (EU) 2016/679; “Applicable Data Protection Law” means the GDPR, the Law of the Republic of Lithuania on the Legal Protection of Personal Data and any other data-protection law applicable to the processing.

1. Roles and Scope

1.1For personal data contained in Customer Data, including Recordings, transcripts and other Output, the Customer is the controller and Such Much AI is the processor, unless the parties expressly agree otherwise in writing. Where the Customer itself acts as a processor for a third-party controller, the Customer warrants that it is authorized to engage Such Much AI as a sub-processor on these terms.

1.2Each party will comply with the obligations applicable to its role under Applicable Data Protection Law. The allocation of roles in this DPA does not change the legal classification that follows from the parties’ actual processing activities.

1.3For account, contracting, billing, support and similar data processed for Such Much AI’s own purposes, Such Much AI acts as a separate controller as described in the Privacy Policy. Such processing is outside this DPA.

2. Subject Matter, Duration, Nature and Purpose

2.1The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Schedule 1 and may be supplemented by an applicable Order Form.

2.2Processing continues for the term of the applicable Services and the post-termination retrieval, return and deletion period described in Section 12 of this DPA, unless Applicable Data Protection Law requires longer retention.

2.3Such Much AI will not process Customer Data for its own purposes except where expressly permitted by the Order Form or required by Union or Member State law. In particular, Such Much AI will not use Recordings, transcripts or other Output to train or fine-tune models, except on the basis of a separate written opt-in agreement with the Customer.

3. Documented Instructions

3.1Such Much AI will process personal data only on the Customer’s documented instructions, which consist of the Terms, this DPA, the applicable Order Form, the Customer’s and its Authorized Users’ configuration and use of the Services (including upload, recording, transcription, summarization, export and deletion actions) and documented support requests.

3.2If Union or Member State law requires processing outside the Customer’s instructions, Such Much AI will inform the Customer of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.

3.3Such Much AI will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until the instruction is confirmed, modified or withdrawn.

3.4The Customer is responsible for the lawfulness of its instructions, for having a lawful basis for recording and processing Participants’ personal data, for providing the information required by Articles 13 and 14 GDPR to Participants and other data subjects, and for informing Participants before recording; the Recording and Participant Notice Guidelines provide non-binding assistance for this purpose.

4. Confidentiality

Such Much AI will ensure that persons authorized to process personal data are bound by contractual or statutory confidentiality obligations and have access to Recordings, transcripts and other Customer Data only to the extent necessary for their duties, such as resolving a support request raised by the Customer or investigating a security event.

5. Security

5.1Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to data subjects, Such Much AI will implement the technical and organizational measures described in Schedule 2 in accordance with Article 32 GDPR.

5.2Such Much AI may update the measures in Schedule 2 provided that the update does not materially reduce the overall level of security during the applicable Services term.

5.3The Customer is responsible for securely configuring its Account, managing Authorized Users, protecting credentials, enabling multi-factor authentication where offered, configuring retention and automatic-deletion settings and using available security features appropriately.

6. Subprocessors

6.1Specific authorization. The Customer specifically authorizes Such Much AI to engage Microsoft Ireland Operations Limited (Microsoft Azure, including Azure AI speech and language-model services) as a cloud-infrastructure and AI-services subprocessor, in European Union regions only.

6.2General authorization. The Customer grants general written authorization for the other subprocessors listed in Part B of the Legal Notice and Trust Information page (suchmuch.ai/legal) at the Effective Date. Such Much AI’s Affiliates are not subprocessors and do not receive access to Customer Data.

6.3Subprocessor obligations. Such Much AI will impose on each subprocessor written data-protection obligations that provide at least the protection required by this DPA and Article 28(4) GDPR, taking into account the nature of the subprocessor’s services, and will remain responsible for the performance of its subprocessors’ obligations.

6.4Changes. Such Much AI will give the Customer at least 30 days’ prior notice of any intended addition or replacement of a subprocessor by updating Part B of the Legal Notice and Trust Information page and by email or in-app notice to the Customer’s administrator. A shorter period may apply where an urgent change is required for security, legal compliance or service continuity, in which case Such Much AI will notify the Customer as soon as reasonably practicable.

6.5Objections. The Customer may object to a new subprocessor within 14 days after notice on reasonable and substantiated data-protection grounds. The parties will work in good faith to address the objection. If no reasonable solution is available within 30 days, either party may terminate the affected Services with effect from the date the new subprocessor would begin processing, and Such Much AI will refund prepaid fees for the unused portion.

7. Assistance with Data-Subject Rights

7.1Taking into account the nature of the processing, Such Much AI will assist the Customer through appropriate technical and organizational measures, including in-app search, export and deletion functions, in responding to requests from data subjects, including Participants, to exercise their rights under Chapter III GDPR.

7.2If Such Much AI receives a request concerning Customer Data directly from a data subject, it will refer the requester to the Customer within five working days and will not respond substantively unless instructed by the Customer or required by law.

8. Personal-Data Breaches

8.1Such Much AI will notify the Customer without undue delay and, where feasible, no later than 48 hours after becoming aware of a personal-data breach affecting Customer Data, by email to the Customer’s administrator contact.

8.2The notification will describe, to the extent information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point. Such Much AI will provide further information in phases as it becomes available.

8.3The Customer remains responsible for determining whether notification to a supervisory authority or data subjects is required and for making those notifications.

9. Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to it, Such Much AI will provide reasonable assistance to the Customer in carrying out data-protection impact assessments under Article 35 GDPR, which the Customer should consider in particular before systematic recording of employees, customers, patients, pupils or members of the public, and in prior consultations with the supervisory authority under Article 36 GDPR.

10. Information and Audits

10.1Such Much AI will make available all information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, including the current Schedule 2, subprocessor information and summaries of security assessments.

10.2The Customer may conduct or mandate an audit no more than once per year, except where required by a supervisory authority, Applicable Data Protection Law or a reasonably substantiated security incident or material compliance concern.

10.3Audits are subject to reasonable prior notice of at least 30 days, confidentiality, proportionality, security restrictions and minimal disruption. An auditor must not be a competitor of Such Much AI and must be bound by confidentiality.

10.4Such Much AI may satisfy an audit request by providing recent independent audit reports, certifications, security summaries, completed questionnaires or equivalent evidence, including Microsoft Azure compliance reports for the hosting layer. An on-site or remote inspection may be conducted where such evidence is reasonably insufficient.

10.5The Customer bears its own audit costs. Such Much AI may charge reasonable costs for assistance beyond information ordinarily made available, unless the audit identifies a material breach by Such Much AI.

11. Location of Processing and International Transfers

11.1Customer Data is stored and processed in Microsoft Azure regions located in the European Union, as listed in Part B of the Legal Notice and Trust Information page. Speech recognition and language-model processing take place in those regions. Such Much AI’s personnel access Customer Data only from within the European Economic Area, except as agreed in writing with the Customer.

11.2Such Much AI will not transfer Customer Data to, or permit access from, a country outside the European Economic Area unless the transfer is authorized by the applicable Order Form or the Customer’s documented instructions and is protected by a lawful mechanism under Chapter V GDPR.

11.3The Customer acknowledges that Microsoft may, in the limited circumstances documented in Microsoft’s EU Data Boundary documentation (for example remote access by Microsoft engineers to resolve a security incident or a support request initiated by Such Much AI), access Customer Data from outside the European Union. Any such access is governed by Microsoft’s data-protection terms, including the Standard Contractual Clauses, and by the safeguards described in Part B of the Legal Notice and Trust Information page.

12. Return and Deletion

12.1The Customer may delete Recordings, transcripts and other Customer Data at any time through the Services and may configure automatic deletion of source audio after transcription and retention periods for Recordings and Output, where those features are available. The Customer may also agree in writing to a process-only configuration in which Recordings are processed transiently and are not stored beyond what immediate processing and security logging require.

12.2Upon termination of the relevant Services, the Customer may export Customer Data and Output during the retrieval period of at least 30 days described in Section 12 of the Terms. Unless the Customer requests earlier deletion, Such Much AI will delete Customer Data from active systems after that period and from backups through ordinary backup rotation within 90 days thereafter, unless Union or Member State law requires continued storage.

12.3Where law requires continued storage, or where the Customer provides a lawful documented retention instruction, the retained data remains protected under this DPA and is not processed for any other purpose.

12.4Such Much AI will confirm deletion in writing on request.

13. Special Categories, Participants and Restricted Data

13.1The Services are not designed for the systematic processing of special categories of personal data under Article 9 GDPR, criminal-offence data under Article 10 GDPR, classified information or data subject to professional secrecy. The Customer will not use the Services for such processing unless expressly agreed in writing with additional safeguards described in the applicable Order Form.

13.2The Customer acknowledges that recorded conversations may incidentally contain special categories of personal data. The Customer is responsible for ensuring that a condition under Article 9(2) GDPR applies, for minimizing such content and for deleting Recordings and Output that it is not entitled to retain.

13.3Such Much AI does not create voiceprints or other biometric templates from Recordings and does not use Recordings to uniquely identify natural persons. Speaker labels are generated per Recording and are not linked across Recordings except where the Customer manually assigns names.

14. Records, Cooperation and Authority Requests

14.1Each party will maintain the records required by Article 30 GDPR for its processing activities.

14.2Such Much AI will cooperate with competent supervisory authorities, including the State Data Protection Inspectorate of the Republic of Lithuania, in accordance with Applicable Data Protection Law.

14.3Unless prohibited by law, Such Much AI will notify the Customer of any binding request from a public authority or court specifically concerning Customer Data before disclosure, will challenge the request where it has reasonable grounds to consider it unlawful, and will disclose only the minimum information legally required.

15. Liability and Precedence

15.1Liability arising under this DPA is subject to Section 18 of the Terms, except to the extent a limitation is prohibited by Applicable Data Protection Law, including Article 82 GDPR, or the applicable Order Form provides otherwise.

15.2If this DPA conflicts with the Terms regarding the processing of personal data, this DPA prevails. A specifically negotiated data-protection provision in an Order Form prevails over this DPA.

16. Contact

Data-protection questions relating to this DPA may be sent to info@suchmuchai.com with the subject line “DPA — Such Much Voice” or to the contact specified in the applicable Order Form. Data Protection Officer: Edmundas Balčikonis, info@suchmuchai.com.

Schedule 1 — Details of Processing

• Subject matter. Provision of the Such Much Voice Services and Professional Services described in the applicable Order Form, including capture and upload of audio and audio-visual Recordings, automatic speech recognition, speaker labelling, AI-generated summaries, meeting notes and action items, search, storage, export, support and related platform administration.
• Duration. For the term of the applicable Order Form and the post-termination retrieval, return and deletion period described in Section 12 of this DPA, unless law requires longer retention.
• Nature and purpose. Collection, recording, storage, organization, structuring, transcription, summarization, analysis, retrieval, consultation, disclosure to Authorized Users designated by the Customer, export, restriction, erasure and other operations necessary to provide, operate, secure and support the Services on the Customer’s documented instructions.
• Categories of data subjects. Depending on the Customer’s use: the Customer’s employees, officials, contractors and Authorized Users; Participants in recorded meetings, calls, interviews, lectures, hearings, consultations and events; customers, suppliers, applicants, patients, pupils, residents and other persons who take part in or are discussed in recorded conversations; and other persons whose personal data the Customer lawfully submits.
• Types of personal data. Voice recordings and, where applicable, video recordings; transcripts and summaries reproducing statements, opinions and information expressed by Participants; speaker labels; names, titles, organizations and contact details of Participants; meeting metadata such as titles, dates and durations; files uploaded by the Customer; Authorized User account, role and access data; and technical, usage and security logs.
• Special categories. Not authorized for systematic processing. Incidental special-category or criminal-offence data mentioned in recorded conversations is processed only as part of the Recording or Output in which it appears, on the Customer’s responsibility, as described in Section 13 of this DPA. No biometric data is processed for the purpose of uniquely identifying a natural person.
• Frequency. Continuous or occasional, depending on the Customer’s use of the Services during the Term.
• Retention. Recordings and Output are retained until deleted by the Customer, until the end of any retention period configured by the Customer or stated in the plan, or until the end of the post-termination retrieval period, as described in Section 12 of this DPA. [State default retention periods for free and paid plans and whether source audio is deleted automatically after transcription.]

Schedule 2 — Technical and Organizational Measures

Such Much AI maintains the following baseline measures, appropriate to the nature and risk of processing voice recordings and transcripts.

• Governance and confidentiality: documented allocation of security and data-protection responsibilities; confidentiality obligations for all personnel; access to Recordings and transcripts limited to personnel who require it for a specific support or security purpose; security and data-protection awareness training for personnel with relevant responsibilities.
• Access control: individual accounts and strong authentication for Authorized Users; role-based authorization; least-privilege and multi-factor authentication for all administrative and infrastructure access; documented procedures for granting, reviewing and revoking access; logging of administrative access to Customer Data.
• Encryption: encryption in transit using TLS 1.2 or higher between user devices and the Services; encryption at rest of Recordings, transcripts, databases and backups using Azure platform encryption; managed key storage in Azure Key Vault; no storage of passwords in readable form.
• Hosting and data separation: Customer Data stored and processed exclusively in European Union Azure regions; logical separation of Customer workspaces and access permissions; controls designed to prevent cross-customer access; network segmentation and restriction of inbound access to the production environment.
• AI processing controls: speech-to-text and language-model requests sent only to Azure AI services in European Union regions under terms that prohibit use of Customer Data for model training; no transmission of Customer Data to external foundation-model APIs; automated content filtering and abuse-monitoring settings configured in accordance with the subprocessor information published in Part B of the Legal Notice and Trust Information page.
• Logging and monitoring: logging of authentication, administrative, security and relevant system events; monitoring designed to identify operational and security anomalies; log retention proportionate to security, operational and legal requirements.
• Availability, backup and recovery: backups appropriate to the Services with defined restore procedures; measures supporting availability and restoration after an operational incident; periodic review of business-continuity and recovery arrangements.
• Secure development and maintenance: security updates, patching and dependency management; vulnerability assessment and remediation proportionate to identified risks; change management and testing before production deployment.
• Incident management: procedures for identifying, assessing, containing and responding to security incidents; internal escalation and documentation; procedures supporting the notification obligations in Section 8 of this DPA.
• Subprocessor and personnel controls: due diligence before engaging material subprocessors; contractual confidentiality, security and data-protection obligations; periodic review of subprocessor compliance.
• Retention and deletion: Customer-controlled deletion of Recordings and Output; configurable retention and automatic deletion of source audio where available; deletion from active systems after the retrieval period and from backups within 90 days through backup rotation; retention beyond standard periods only where required by law or by a lawful documented Customer instruction.

Such Much AI may replace or update individual measures as technology and risks evolve, provided that the overall level of protection is not materially reduced during the applicable Services term.

Annex 2 — Acceptable Use Policy

This Acceptable Use Policy (the “AUP”) forms part of the Such Much Voice Terms of Service and applies to every Customer and Authorized User of the Such Much Voice Services provided by UAB Such Much AI (“we”, “us”). Capitalized terms have the meaning given in the Terms. The Customer is responsible for ensuring that its Authorized Users comply with this AUP.

1. Lawful and Respectful Use

You may use the Services only for lawful purposes and in accordance with the Terms, this AUP, applicable law and the rights of others. You must not use the Services to: violate any law, regulation, court order or binding professional duty; infringe the intellectual-property, privacy, publicity or other rights of any person; harass, threaten, defame, intimidate or discriminate against any person; or upload, store, generate or distribute content that is illegal in the European Union or in the jurisdiction where you or a Participant is located, including child sexual abuse material, terrorist content and content inciting violence or hatred.

2. Recording Rules

2.1Inform before you record. Do not record any meeting, call, interview, lecture, consultation or other conversation unless every Participant has been informed that it is being recorded and transcribed, in the manner required by the law applicable to you and to each Participant. Where consent is required, obtain and keep evidence of it. Our Recording and Participant Notice Guidelines in Part D of the Legal Notice and Trust Information page at suchmuch.ai/legal provide practical help.

2.2No covert or unauthorized recording. Do not record conversations to which you are not a party without lawful authority, intercept communications, or record in locations or situations where recording is prohibited (for example in court rooms, in certain public-sector proceedings or where a meeting host has prohibited recording).

2.3Respect objections. If a Participant objects to being recorded and the law or your organization’s rules require you to respect that objection, stop recording or remove the Participant’s contribution.

2.4Recordings from other platforms. When uploading a recording made with a meeting platform or another tool, comply with that platform’s terms and recording rules.

2.5Employees, pupils and vulnerable persons. Recording employees, pupils, students, patients, clients in care, detainees or other persons in a position of dependence requires particular care, including a lawful basis, an assessment of necessity and proportionality, consultation where required and, in many cases, a data-protection impact assessment. Do not use the Services for systematic monitoring of such persons without that assessment.

3. Prohibited AI Practices

You must not use the Services, their Output or any data derived from them for practices prohibited by Article 5 of Regulation (EU) 2024/1689 or for the following purposes:

• inferring or evaluating the emotions, stress, sincerity or psychological state of a natural person in the workplace or in education, or using voice analysis for lie detection or credibility assessment;
• categorizing Participants on the basis of their voice or other biometric data to deduce or infer race, ethnic origin, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation;
• creating voiceprints, speaker-recognition models or other biometric templates from Recordings, or identifying individuals by voice across Recordings;
• social scoring, predictive policing based solely on profiling, or manipulative or deceptive techniques that materially distort a person’s behaviour or exploit vulnerabilities of age, disability or social or economic situation;
• making solely automated decisions that produce legal or similarly significant effects on a natural person, including hiring, promotion, dismissal, grading, credit, insurance or benefit decisions, on the basis of Output.

4. Voice Cloning, Impersonation and Synthetic Media

The Services do not generate synthetic speech. You must not: use Recordings, Output or exported audio to train, create or improve voice-cloning or speech-synthesis models that imitate a real person without that person’s explicit, informed consent; use the Services to help impersonate a natural person or organization; or edit transcripts or summaries so as to misrepresent what a Participant said and present the result as an accurate record.

5. High-Risk and Regulated Contexts

The Services are assistive transcription and note-taking tools. Do not use them: as certified, sworn or official transcripts of judicial, arbitral, parliamentary or administrative proceedings; as the sole basis for decisions in employment, education, credit, insurance, law enforcement, migration, asylum or access to essential public services; for medical diagnosis or treatment decisions; or for any other use that would be classified as high-risk under Annex III of Regulation (EU) 2024/1689, unless you have carried out the assessments required by law and we have agreed to the use in writing.

6. Sensitive and Restricted Data

Do not use the Services for the systematic processing of special categories of personal data (Article 9 GDPR) or criminal-offence data (Article 10 GDPR), or for classified information, state secrets, information protected by legal professional privilege or medical confidentiality, or other data subject to professional-secrecy rules, unless this has been expressly agreed in writing with appropriate safeguards. Where such information is mentioned incidentally in a recorded conversation, ensure that you have a lawful basis to process it, minimize it and delete what you are not entitled to keep.

7. Third-Party Content and Rights

Only upload Recordings and files that you have the right to process. Do not upload podcasts, broadcasts, lectures, performances, call recordings or other content in which third parties hold copyright, performers’ rights or confidentiality rights unless you hold the necessary rights or licences.

8. Security and Integrity of the Services

You must not: share credentials or allow use of an Account by persons who are not Authorized Users; circumvent usage limits, plan limits, authentication or security controls; probe, scan or test the vulnerability of the Services without our prior written permission; reverse engineer, decompile or attempt to extract models, prompts or source code; access the Services by automated means; introduce malware or harmful code; or use the Services to build, train or benchmark a competing product.

9. Enforcement

We may investigate suspected violations and may, with notice where reasonably practicable, remove or disable access to content, suspend or restrict Accounts, terminate the Services for material breach in accordance with the Terms and report illegal activity to competent authorities. We give priority to the protection of Participants and third parties. Decisions on content removal are taken by our personnel; we do not use solely automated content-moderation decisions to terminate Accounts, and we provide a statement of reasons for a restriction where Regulation (EU) 2022/2065 requires it.

10. Reporting

To report a suspected violation of this AUP, allegedly illegal content or a security vulnerability, contact info@suchmuchai.com with the subject line “Abuse Report” or “Security Report”. Please include enough information for us to locate the content or activity. We acknowledge reports and act on them diligently and without undue delay.

11. Changes

We may update this AUP as described in Section 21 of the Terms. The current version states its effective date.