Terms of Service

Terms of Service

Version 1.0 · Effective 16 October 2026

1. About these terms

1.1 These terms govern use of Holoh Workspaces, including the web app at holoh.app, the desktop apps and related services (the "Service").

1.2 The Service is provided by TMRW Spain S.L.U. ("TMRW", "we", "us"). Company details are in our Legal notice. Contact: info@holoh.com.

1.3 "Customer" means the organisation that creates an organisation account in the Service, or the professional individual who does so on the free plan. "User" means any person the Customer allows to use the Service, including invited guests. "Customer Content" means all data that Users submit to the Service, including messages, files, meeting audio, transcripts, recordings, prompts and AI outputs.

1.4 By creating an account, or by accepting an order form that refers to these terms, the Customer agrees to these terms. A person who accepts for an organisation confirms they are authorised to bind it.

1.5 The following documents form part of these terms: the Acceptable Use Policy, the Data Processing Agreement (DPA), and any order form signed by the Customer. If they conflict, this order applies: (a) a signed order form; (b) the DPA (for personal data); (c) these terms; (d) the Acceptable Use Policy. The Privacy Policy explains how we process personal data as controller; it is not a contract term.

2. Accounts

2.1 Each User needs an account. Users must give accurate information and keep their sign-in details secure. The Customer is responsible for all activity under its organisation's accounts and must tell us promptly of any unauthorised use.

2.2 Each organisation has one owner, who can appoint admins and transfer ownership.

2.3 The Service is offered only for business and professional use. It is not offered to consumers. By signing up, each User confirms that they use the Service for a business, organisation or profession.

2.4 The Customer is responsible for the guests it admits to its meetings.

3. Plans, seats, included usage and credits

3.1 Free plan. The free plan has the limits shown at /pricing. Credits cannot be bought or used on the free plan. We may change or end the free plan with 30 days' notice.

3.2 Paid plans. Paid plans are sold per seat, per month, at the prices shown at /pricing or in an order form. A seat is one named User, and every member of an organisation on a paid plan holds one.

3.3 Included usage. Each seat includes an amount of AI usage. How much, and when it renews and expires, is shown at /pricing. Unused included usage does not carry over.

3.4 Credits. The Customer may buy credits in advance, in packs. One euro of credits pays for one euro of AI usage at the prices shown at /pricing. Credits:

• (a) belong to the organisation and are shared by its members;
• (b) are used, on paid plans only, for AI usage beyond included usage, including usage by the organisation's coworker agents;
• (c) expire 12 months after purchase;
• (d) cannot be transferred to another organisation or exchanged for cash, and are refunded only under clause 4.6 or where the law requires;
• (e) are lost when the organisation is deleted.

AI usage is charged on the tokens the model provider reports, including for requests that fail or are stopped part-way.

3.5 Enterprise plans. Enterprise plans are agreed in an order form. They are invoiced by TMRW and paid by bank transfer unless the order form says otherwise.

3.6 Fair use. We may limit usage that harms the Service or other customers, such as automated load far above normal use. We will contact the Customer first where practical.

4. Billing and taxes

4.1 Who sells. Paid seats and credits bought in the Service are sold through Stripe Managed Payments. Its operator, Sold through Link, LLC, acts as merchant of record: it takes the payment, charges any VAT and issues the invoice, under the Sold Through Link Terms (link.com/terms#sold-through-link-terms). Enterprise plans are invoiced by TMRW directly.

4.2 Monthly billing. Paid seats are billed monthly in advance, in the currency shown at checkout, and renew automatically each month until cancelled. The Customer authorises recurring charges to its payment method.

4.3 Seat changes. Adding a seat, or moving a member to a higher seat type, takes effect at once and is charged pro rata for the rest of the month. Removing a seat, or moving a member to a lower seat type, takes effect at the next renewal. Cancellation takes effect at the end of the current month.

4.4 Taxes. Prices exclude VAT. VAT is added where it applies.

4.5 Failed payment. If a payment in the Service fails and is not fixed within 7 days, the organisation moves to free-plan limits until payment succeeds. Enterprise invoices are payable within 30 days; if one is overdue, we may suspend paid features after 14 days' written notice.

4.6 Refunds. Seats and used usage are not refunded. Unused credit packs are refunded on request within 14 days of purchase. Otherwise fees are refunded only where these terms or the law provide.

4.7 Price changes. We may change prices with at least 30 days' notice. A change applies from the next renewal. The Customer may cancel before then.

5. The Service

5.1 We will provide the Service with reasonable skill and care, in line with good industry practice. No availability commitment or service level is offered in these terms.

5.2 We may change the Service.

5.3 The Service depends on third-party providers, including our hosting, calling and AI providers (listed in our subprocessor list). Features that depend on third parties may change if a provider changes or withdraws its service.

5.4 Beta features are marked as such, are provided "as is", and may change or be withdrawn at any time.

6. AI features

6.1 AI outputs can be wrong. Users must review them before relying on them. They are not advice from TMRW.

6.2 Agents act for the Customer. When a User instructs an agent or connects a service (for example a code repository or mailbox), the agent acts on that User's and the Customer's instructions and permissions. The Customer is responsible for the permissions it grants and for actions agents take within them.

6.3 As between TMRW and the Customer, the Customer owns AI outputs generated for it, to the extent the law allows.

6.4 The Customer must not remove or hide the Service's AI notices, and must give Users and participants any information the law requires, including under the AI Act (Regulation (EU) 2024/1689).

7. Meetings, transcription and recording

7.1 The Customer is responsible for informing all participants (including employees, guests and external attendees) before their audio is transcribed or recorded, and for obtaining any consent or meeting any other requirement under applicable law, including employment and workplace-monitoring law. The Service displays in-call indicators, but these do not replace the Customer's own legal duties.

7.2 In Microsoft Teams meetings, the Teams organiser's settings and Microsoft's terms apply.

8. Customer Content

8.1 The Customer and its Users keep all rights in Customer Content.

8.2 The Customer grants TMRW a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, process and display Customer Content only as needed to provide, secure and support the Service, and as instructed by the Customer. This licence ends when the content is deleted from the Service, subject to clause 13.

8.3 The Customer confirms it has the rights and lawful bases needed to submit Customer Content and to have us process it.

8.4 Personal data. Our DPA applies to personal data in Customer Content. We process it as the Customer's processor.

8.5 Feedback. If a User sends us suggestions, we may use them without obligation.

8.6 Usage data. We may use aggregated and de-identified data about use of the Service (for example, feature counts and token totals) to run, bill, secure and improve the Service. This data does not identify the Customer or any person.

9. Acceptable use and illegal content

9.1 Users must follow the Acceptable Use Policy.

9.2 Anyone can report content they believe is illegal to info@holoh.com or through Report a problem in the app. We review reports and act on them in line with Regulation (EU) 2022/2065 (the Digital Services Act), and tell the reporter and, where required, the affected User our decision and how to challenge it.

10. Confidentiality

10.1 Each party will keep the other's confidential information confidential, use it only to perform these terms, and share it only with staff, advisers and subcontractors who need it and are bound by similar duties. Customer Content is the Customer's confidential information.

10.2 This does not apply to information that is public through no fault of the receiving party, already known to it, independently developed, or lawfully received from a third party. A party may disclose information if required by law, giving notice where lawful.

10.3 These duties last for the term and 5 years after.

11. Intellectual property

11.1 TMRW and its licensors own the Service, its software, design and documentation. We grant the Customer a non-exclusive, non-transferable right to use the Service during the term under these terms. The desktop apps are also covered by the Desktop End-User Licence.

11.2 The Customer must not copy, modify, reverse engineer (except as permitted by Article 100 of the Spanish Intellectual Property Law), resell or build a competing product from the Service.

12. Suspension

12.1 We may suspend access, in whole or in part, if:

• (a) a User breaches the Acceptable Use Policy;
• (b) use poses a security risk to the Service or others;
• (c) payment is overdue as set out in clause 4.5;
• (d) the law or an authority requires it.

12.2 We will limit suspension to what is needed, give notice in advance where reasonable (and otherwise promptly after), and restore access when the cause is fixed.

13. Term, termination and data

13.1 These terms apply until the Customer's account is closed. Paid subscriptions are monthly and renew under clause 4.2.

13.2 The Customer may cancel at any time in the Service or by notice to us; cancellation takes effect at the end of the current paid period.

13.3 Either party may terminate on written notice if the other materially breaches these terms and does not fix the breach within 30 days of notice, or becomes insolvent.

13.4 We may close free-plan accounts that have been inactive for 12 months, after 30 days' notice.

13.5 Data on exit. For 30 days after termination, the Customer may ask for an export of its Customer Content at info@holoh.com. We then delete it as set out in the DPA (clause 11).

13.6 Switching to another provider. Where Chapter VI of Regulation (EU) 2023/2854 (the Data Act) applies, the Customer may ask us to help it move its data to another provider or to its own systems, or to delete it, by notice to info@holoh.com. The switch starts at the end of the current billing period, and never more than 2 months after the notice. We then support a transition period of up to 30 days, during which the Service continues and we export the Customer's exportable data (all Customer Content and its organisation's settings) in a structured, commonly used and machine-readable format. If a 30-day transition is technically not feasible, we will tell the Customer within 14 working days and may extend it to up to 7 months. The Customer may extend the transition period once. After the transition the Customer has at least 30 days to retrieve its data; we then delete it as set out in clause 13.5. We do not charge for switching.

13.7 Clauses 3.4(d), 4 (for amounts due), 8.6, 10, 11, 14, 15 and 18 survive termination.

14. Warranties and disclaimers

14.1 Each party warrants that it has authority to enter into these terms.

14.2 Except as stated in these terms, and to the extent the law allows, the Service is provided "as is". We do not warrant that it will be uninterrupted or error-free, or that AI outputs will be accurate.

15. Liability

15.1 Nothing in these terms limits liability for: (a) wilful misconduct (dolo) or gross negligence; (b) death or personal injury caused by negligence; (c) any liability that cannot be limited by law. (Article 1102 of the Spanish Civil Code prohibits waiving liability for wilful misconduct.)

15.2 Subject to 15.1, neither party is liable for indirect or consequential loss, or for loss of profit, revenue, business, goodwill or data (except our duty to restore data from backup where we caused the loss).

15.3 Subject to 15.1, each party's total liability under these terms in any 12-month period is limited to the fees paid and payable by the Customer in that period. For free-plan Customers it is limited to EUR 100.

15.4 Customer indemnity. The Customer will indemnify TMRW against third-party claims arising from Customer Content or from the Customer's breach of the Acceptable Use Policy or of clause 7.1.

16. Changes to these terms

16.1 We may change these terms. We will give at least 30 days' notice of material changes by email or in the Service. Changes apply from the next renewal for paid plans. If the Customer does not agree, it may cancel before the change takes effect, and receives a pro-rata refund of prepaid fees for the unused period.

16.2 Changes needed to comply with law, or changes that only benefit the Customer, may apply sooner.

17. General

17.1 Assignment. The Customer may not transfer these terms without our consent. We may transfer them to a group company or a successor to our business, with notice.

17.2 Subcontractors. We may use subcontractors and remain responsible for them. Other TMRW group companies may own or operate infrastructure used to provide the Service; they act as our subcontractors under this clause.

17.3 Force majeure. Neither party is liable for delay caused by events beyond its reasonable control.

17.4 Notices. Notices to us go to info@holoh.com; notices to the Customer go to the organisation owner's email.

17.5 Entire agreement. These terms and the documents in clause 1.5 are the whole agreement on their subject.

17.6 Severability and waiver. If a clause is invalid, the rest stays in force. A failure to enforce a right is not a waiver.

17.7 Language. These terms are written in English. If we provide a translation, the English version prevails.

17.8 Export and sanctions. The Customer will not use the Service in breach of EU or other applicable sanctions or export laws.

18. Law and disputes

18.1 These terms are governed by Spanish law.

18.2 The courts of Alicante (Spain) have exclusive jurisdiction.

Acceptable Use Policy

Version 1.0 · Effective 16 October 2026

This policy is part of the Holoh Workspaces Terms of Service. It applies to every User, guest and AI agent acting for a User. Capitalised terms have the meaning in the Terms.

1. Illegal and harmful content

You must not use the Service to create, store, send or share content that:

1.1 is illegal under EU law or the law that applies to you, including child sexual abuse material, terrorist content, illegal hate speech, and content that infringes intellectual property or privacy rights;

1.2 harasses, threatens, defames or discriminates against any person;

1.3 contains malware or code designed to damage or gain unauthorised access to systems;

1.4 is fraudulent, deceptive or impersonates another person or organisation;

1.5 is unsolicited bulk communication (spam).

2. Recording, transcription and other people's data

2.1 You must not record, transcribe or analyse a meeting or conversation unless the participants have been informed and, where the law requires, have consented.

2.2 You must not hide, cover or remove the Service's indicators that AI is present, that transcription is on, or that a recording is running.

2.3 You must not use the Service to monitor employees or others in a way the law does not permit.

3. AI features and agents

You must not use the AI features or agents to:

3.1 generate content listed in clause 1, or instructions for weapons capable of mass harm;

3.2 carry out practices prohibited by Article 5 of the EU AI Act (Regulation (EU) 2024/1689), such as manipulative techniques, social scoring, or emotion recognition in the workplace or in education;

3.3 make decisions with legal or similarly significant effects on a person (for example hiring, credit or dismissal) based solely on AI output, without human review;

3.4 present AI output as made by a human where that would mislead people;

3.5 bypass the safety controls of the Service or of a model provider ("jailbreaking"), or extract a model's weights, system prompts or training data;

3.6 develop a competing AI model using outputs, where the model provider's terms forbid it;

3.7 send an agent to access systems, accounts or data you are not authorised to use.

4. Security and the Service

You must not:

4.1 probe, scan or test the vulnerability of the Service without our written permission (report vulnerabilities to info@holoh.com);

4.2 access another organisation's data, or any account that is not yours;

4.3 overload or disrupt the Service, including by automated traffic beyond normal use;

4.4 get around plan limits, usage limits or access controls, for example by creating multiple free organisations;

4.5 resell or provide the Service to third parties without our written agreement;

4.6 share your account or sign-in details.

5. Reporting and enforcement

5.1 Report breaches of this policy or illegal content to info@holoh.com.

5.2 If we find or are told of a breach, we may remove content, restrict features, suspend accounts or close them, in proportion to the breach, as set out in the Terms (clause 12). We explain our decision to the affected User and how to challenge it, as required by the Digital Services Act.

5.3 We may report illegal content to the authorities where the law requires it.

Data Processing Agreement

Version 1.0 · Effective 16 October 2026

This Data Processing Agreement ("DPA") is between the Customer (the "Controller") and TMRW Spain S.L.U., registered address Av. Jean Claude Combaldieu N5, 03008 Alicante, Spain, NIF B42557777 (the "Processor"). It forms part of the Holoh Workspaces Terms of Service or the order form between the parties (the "Agreement"). It meets the requirements of Article 28 of Regulation (EU) 2016/679 ("GDPR") and Article 33 of Spain's Organic Law 3/2018 ("LOPDGDD").

1. Definitions

1.1 "Personal Data", "Processing", "Data Subject", "Personal Data Breach", "Controller", "Processor" and "Supervisory Authority" have the meanings in GDPR Article 4.

1.2 "Customer Personal Data" means Personal Data in Customer Content that the Processor processes for the Controller under the Agreement.

1.3 "Subprocessor" means a third party the Processor engages to process Customer Personal Data.

1.4 "Restricted Transfer" means a transfer of Customer Personal Data to a country outside the European Economic Area (EEA) without an adequacy decision.

2. Scope and roles

2.1 The Controller determines the purposes and means of processing Customer Personal Data. The Processor processes it only on the Controller's behalf.

2.2 Annex 1 describes the processing: subject matter, duration, nature, purpose, data types and Data Subjects.

2.3 This DPA does not cover Personal Data the Processor processes as a controller (for example account, billing, security and metering data). The Privacy Policy covers that data.

3. Instructions

3.1 The Processor processes Customer Personal Data only on the Controller's documented instructions. The Agreement, this DPA, and the Controller's use and configuration of the Service are the Controller's instructions.

3.2 The Processor will tell the Controller immediately if, in its opinion, an instruction breaches the GDPR or other EU or Member State data protection law.

3.3 If EU or Member State law requires the Processor to process Customer Personal Data otherwise, it will tell the Controller first unless the law forbids it.

3.4 The Processor will not use Customer Personal Data to train AI models, sell it, or use it for its own purposes, except for aggregated, de-identified statistics needed to run, bill and secure the Service.

4. Controller's duties

4.1 The Controller is responsible for the lawfulness of the processing, including having a lawful basis, giving notices to Data Subjects, and obtaining any required consent. This includes the duty to inform meeting participants and employees before their audio is transcribed or recorded (including under LOPDGDD Arts. 87–89), and to select connected services whose data location it accepts.

5. Confidentiality

5.1 The Processor ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, by contract or by law, and processes it only as needed.

6. Security

6.1 The Processor implements the technical and organisational measures in Annex 2. They are designed to give a level of security appropriate to the risk, as required by GDPR Article 32.

6.2 The Processor may update the measures, as long as the overall level of security is not reduced.

7. Subprocessors

7.1 The Controller gives general authorisation for the Processor to engage Subprocessors. The current Subprocessors are listed in Annex 3.

7.2 The Processor will notify the Controller of any intended addition or replacement of a Subprocessor at least 30 days in advance, by email to the organisation owner and by updating Annex 3.

7.3 The Controller may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith. If they cannot resolve it, the Controller may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.

7.4 The Processor imposes on each Subprocessor, by written contract, data-protection obligations that give at least the same protection as this DPA. The Processor remains liable to the Controller for each Subprocessor's performance.

7.5 The AI models available in the Service are chosen by the Processor; their providers are Subprocessors listed in Annex 3. Where the Controller itself chooses a third-party service (for example a connected service such as GitHub, or a custom MCP server), the Controller instructs the Processor to send data to it.

8. International transfers

8.1 The Processor hosts Customer Personal Data in the EU by default. This is not a commitment that all processing takes place in the EU. Subprocessors outside the EU and processing locations are listed in Annex 3.

8.2 Where a subprocessor processes personal data outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses. The subprocessor list shows which applies to each. The Processor does not use Subprocessors hosted in China for Customer Personal Data.

9. Assistance

9.1 Data Subject requests. The Processor will forward any request it receives from a Data Subject about Customer Personal Data to the Controller without undue delay, and will not answer it except on the Controller's instructions. Taking into account the nature of the processing, the Processor will help the Controller answer requests.

9.2 Other assistance. The Processor will help the Controller with data protection impact assessments, prior consultations with Supervisory Authorities, and security, as GDPR Articles 32 to 36 require, taking into account the information available to it.

10. Personal Data Breaches

10.1 The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2 The notice will describe, as far as then known: the nature of the breach, categories and approximate numbers of Data Subjects and records, likely consequences, measures taken or proposed, and a contact point. The Processor will add information as it becomes available.

10.3 The Processor will take reasonable steps to contain and remedy the breach. Notification is not an admission of fault.

11. Deletion and return

11.1 At the end of the Agreement, the Processor will, at the Controller's choice, return Customer Personal Data in a common machine-readable format and then delete it, or delete it. A deleted account, organisation or workspace can be restored for 30 days; after that, its personal data is permanently deleted within 15 days, unless EU or Member State law requires it to be kept. Backups are kept for 35 days and then deleted; a restore does not re-apply erasures made after the backup.

12. Audits

12.1 The Processor will make available the information needed to demonstrate compliance with this DPA and GDPR Article 28.

12.2 The Controller may audit compliance once a year, or after a Personal Data Breach, with at least 30 days' notice, during business hours, without access to other customers' data, and at its own cost. The Processor may meet this first by providing written answers, policies, and any third-party certifications or audit reports it holds. An on-site audit is carried out by an independent auditor bound by confidentiality.

13. Liability and term

13.1 Each party's liability under this DPA is subject to the limits in the Agreement. Nothing limits liability to Data Subjects under GDPR Article 82.

13.2 This DPA lasts as long as the Processor processes Customer Personal Data.

13.3 If this DPA conflicts with the Agreement about Personal Data, this DPA prevails.

13.4 This DPA is governed by Spanish law, with the same jurisdiction as the Agreement.

Annex 1: Description of processing

Annex 2: Technical and organisational measures

A2.1 Location. Customer data is stored in the EU by default.

A2.2 Encryption. Data is encrypted in transit and at rest. Access tokens for connected services are additionally encrypted.

A2.3 Access control. Sign-in is through a central identity service. Customer access is role-based. Staff access is limited to staff who need it, needs a separate sign-in, and is logged.

A2.4 Confidential AI. In confidential AI, prompts are encrypted before leaving our service and processed by Privatemode only after the provider's hardware and software are verified by remote attestation. When the provider updates its software, we may use the new version at once and complete our own verification within 96 hours. If verification fails, we stop using it. There is no fallback to non-confidential processing.

A2.5 Minimisation and retention. We collect only what the Service needs. Retention periods are enforced automatically (Privacy Policy, section 6).

A2.6 Agent isolation. Agents run tools in isolated, temporary environments and reach only what they are given access to.

A2.7 Secure development. Code is reviewed and tested before deployment. Secrets are kept out of code.

A2.8 Resilience. Databases can be restored to any point in the last 30 days. Files are stored redundantly.

A2.9 Incidents. Personal data breaches are assessed, contained, recorded and notified to the Controller under clause 10.

A2.10 Staff. Everyone who processes personal data for us is bound by confidentiality, by contract or by law (Article 5 of Organic Law 3/2018).

Annex 3: Subprocessors

A3.1 See the Subprocessors document (published at /terms#subprocessors). It forms part of this Annex.

Subprocessors

Version 1.0 · Effective 16 October 2026

TMRW Spain S.L.U. ("TMRW", "we") uses the subprocessors below to provide Holoh Workspaces (the "Service"). This list forms Annex 3 of our Data Processing Agreement (DPA). We will notify customers of changes as set out in the DPA, clause 7.

Where a subprocessor processes personal data outside the EEA, the list shows the transfer basis. We use no subprocessor hosted in China for customer content. The infrastructure is subject to the law of the countries shown. To protect data held in the EU against foreign government access that conflicts with EU law, we store it in the EU by default and encrypt it in transit and at rest.

1. Core infrastructure

2. AI processing

3. Billing and monitoring

4. TMRW group companies

4.1 Other TMRW group companies operate parts of the Service, including live positions in 3D calls and the camera background-removal model, on Cloudflare's network (see 1.1). They act as our subcontractors under clause 17.2 of the Terms, under the same data protection obligations.