General terms and conditions

These general terms and conditions (hereinafter the “Terms”) govern access to and use of The Company Land platform (hereinafter the “Service”), published by TCL Global Investment Pte. Ltd. (hereinafter “The Company Land” or the “Publisher”).

• Service: The Company Land SaaS platform for accounting, financial and administrative management for businesses.
• User: any natural or legal person holding an active account on the Service.
• Account: the personal space created by the User to access the Service.
• Content: all data, documents and information provided or generated by the User within the Service.

Signing up for and using the Service implies unreserved acceptance of these Terms. The User acknowledges having read them before creating their Account.

The Company Land is an online service that notably enables accounting management, invoicing, bank transaction tracking, electronic document management and tax compliance tracking. The exact features may change over time.

Access to the Service requires creating an Account. The User undertakes to provide accurate, complete and up-to-date information, and to update it if it changes.

The User is solely responsible for keeping their credentials confidential. Any login or action performed from their Account is deemed to have been performed by them.

The Publisher strives to ensure maximum availability of the Service, without being able to guarantee it. Interruptions may occur for maintenance, updates or any other cause beyond its control.

The Service is offered under the subscription plans in force, available from the Service or the Publisher's website. Prices are stated in euros, excluding and including taxes. Payment is made by direct debit or bank card, through a secure payment provider.

Where a subscription is purchased through Apple's App Store, payment will be processed by Apple and will be subject to the applicable Apple Media Services terms and App Store billing rules. Subscription management, renewal and cancellation may be handled through the User's Apple account.

All subscriptions are payable in advance. In the event of non-payment, the Publisher reserves the right to suspend access to the Service after a formal notice has remained unanswered.

The subscription is taken out for the term chosen at subscription and is automatically renewed for successive equivalent periods, unless terminated by either party before the end of the current term.

The User may cancel their subscription at any time from their Account settings. Cancellation takes effect at the end of the current subscription period, without refund of amounts already paid.

The Publisher may automatically suspend or terminate the Account in the event of a serious breach of these Terms, in particular in the event of fraudulent use, non-payment or harm to the security of the Service.

The User undertakes to:

• use the Service in accordance with its intended purpose and applicable regulations;
• not harm the security, integrity or availability of the Service;
• not upload unlawful or defamatory content, or content infringing the rights of third parties;
• keep, by their own means, a backup copy of their essential data and documents.

Your privacy is important to us. Unless otherwise specified, The Company Land is responsible for the processing of personal data in connection with the Services.

We process personal data in accordance with applicable data protection and privacy laws and regulations, including, where applicable, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable local data protection requirements.

Sections 9.1 to 9.6 below describe our main practices regarding the collection, use, disclosure, retention, protection and processing of personal data in connection with the Services. Additional information about our privacy practices, including information that may be required under applicable local laws, is available in our Privacy Policy.

The provisions of this Section 9 and our Privacy Policy should be read together and form part of the framework governing the processing of personal data in connection with your use of the Services.

Where the Services integrate with third-party services or APIs, the processing of data may also be subject to the applicable terms and privacy requirements of those third parties, including, where relevant, the Google API Services User Data Policy and Google APIs Terms of Service.

The Publisher collects and processes the following categories of data:

• Account data: last name, first name, email address, password (hashed), phone number, business information (company name, SIRET number, etc.).
• Service data: invoices, accounting entries, bank account and transaction data made available through connected banking services, uploaded documents, settings and activity logs.
• Technical data: IP address, session identifiers, browser type, connection logs.

When the User signs in with “Sign in with Google” or connects a Gmail mailbox to the Service, the Publisher accesses the following data, with the User's explicit consent collected through Google's OAuth screens:

• Basic Google profile (Google ID, name, email address, profile picture) — solely to authenticate and identify the User.
• Gmail messages and attachments, read-only — solely to automatically detect and import invoices, receipts and accounting documents into the Service.
• Message metadata (sender, date, subject, size) — solely to identify emails likely to contain attachments relevant to accounting.

Data is used solely for the following purposes:

• creating and managing the User's Account;
• providing, operating, maintaining and improving the features of the Service;
• ensuring security, preventing fraud and fighting abuse;
• complying with applicable legal obligations (in particular accounting and tax obligations);
• communicating with the User about the operation of the Service and support.

In accordance with the Google API Services User Data Policy, and in particular its “Limited Use” requirements, Google user data obtained through Google APIs is used only to provide or improve user-facing features of the Service (authentication and automatic import of invoices and receipts from Gmail). In particular, the Publisher undertakes:

• not to use this data to serve, target or display advertising;
• not to sell, rent or transfer this data to any third party;
• not to use this data, whether raw, aggregated or anonymized, to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models;
• not to transfer this data to third-party artificial intelligence services that would use it to train their own models;
• not to allow any human to read this data, except (a) with the User's explicit consent, (b) for security purposes (fighting abuse, legal compliance), or (c) where the data is aggregated and anonymized for internal statistical purposes.

The Company Land's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Attachments imported from Gmail are processed by the Publisher's own systems to determine whether they are accounting documents and to extract their content. To provide the artificial intelligence features of the Service (such as structuring invoice data or the in-app assistant), data derived from these documents may be processed by OpenAI (API), acting as a processor, for the sole benefit of the User. Files imported from Gmail are never sent to OpenAI in their original form, and under OpenAI's API terms data sent to OpenAI is not used to train its models.

The Publisher does not sell or rent personal data. Data is shared only with the processors strictly necessary to provide the Service, listed below:

• Hosting: Amazon Web Services EMEA SARL (Luxembourg) — data stored in the AWS Paris region (eu-west-3).
• Google authentication: Google LLC — for the “Sign in with Google” feature.
• Email connection: Nylas, Inc. — technical intermediary providing the secure OAuth connection to Gmail accounts and the retrieval of attachments (the Publisher does not use Nylas for any other purpose).
• Bank connection: Powens (France) — open banking technology provider used to connect the User's bank accounts and retrieve, with their authorization, account and transaction information.
• AI processing: OpenAI, L.L.C. (USA) — artificial intelligence features of the Service, without receiving files imported from Gmail in their original form and without use of the data to train its models.
• Payment: Stripe Payments Europe Limited — processing of subscription payments.
• Transactional communications: Novu (in-app notifications) and SMTP providers for sending service emails.

Each processor is bound by a contract compliant with Article 28 of the GDPR and acts only on the Publisher's documented instructions. Data may also be disclosed to administrative or judicial authorities upon lawful request.

Data is hosted within the European Union (AWS, Paris region, eu-west-3). Any transfers outside the EU (in particular to Google and OpenAI) are governed by the European Commission's Standard Contractual Clauses and supplemented by additional security measures.

The Publisher implements the following appropriate technical and organizational measures: TLS encryption in transit, encryption at rest, strict role-based access control following the principle of least privilege, access logging, multi-factor authentication for administrative access, regular audits, a strong password policy and incident response procedures.

Google and Nylas OAuth tokens are stored encrypted and are accessible only to the automated processes strictly necessary to provide the Service.

Account data is retained for as long as the Service is used. Upon termination of the Account, it is deleted within thirty (30) days at most. Certain information may be retained for longer periods where required by applicable law, including for the period required under applicable accounting, tax and regulatory laws in the relevant jurisdiction(s), which may vary depending on the country and the nature of the records concerned.

Google user data (retrieved Gmail emails, OAuth tokens) is deleted immediately when the User disconnects their mailbox in the Service, deletes their Account, or revokes access from https://myaccount.google.com/permissions. Attachments already imported into the Service are kept like any other accounting document, in compliance with the applicable legal retention periods.

The User may request the deletion of their data at any time by deleting their Account directly from the Service settings. The request is processed within thirty (30) days at most.

Depending on the laws applicable to the User, the User may have certain rights in relation to their personal data, including the right to access, correct, update, delete or obtain a copy of their personal data, as well as the right to object to or restrict certain processing activities and, where applicable, to data portability and withdrawal of consent.

Users located in jurisdictions where the GDPR applies may exercise the rights provided under the GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability and objection, as applicable.

Users may exercise their rights by contacting us at tech@thecompanyland.ai. Where applicable, Users also have the right to lodge a complaint with the competent data protection or supervisory authority in their country or jurisdiction.

Users who have connected their Google account to the Services may revoke The Company Land's access to their Google data at any time through their Google Account permissions settings.

The Publisher is and remains the owner of all intellectual property rights relating to the Service (software, interface, trademarks, databases). Nothing in these Terms shall be construed as a transfer of these rights to the User.

The User retains full ownership of their Content. They grant the Publisher a non-exclusive license, for the term of the contract only, solely for the purposes strictly necessary to provide the Service.

The Publisher is bound by an obligation of means. It cannot be held liable for indirect damages (loss of revenue, data, business or reputation) suffered by the User in connection with the use of the Service.

In any event, the Publisher's liability is capped at the amount, excluding taxes, actually received for the Service during the twelve (12) months preceding the event giving rise to liability.

The Publisher does not replace a chartered accountant or a tax advisor. It is the User's responsibility to check the accuracy and compliance of the processing performed.

Neither party shall be liable for any failure or delay in performing its obligations under these Terms to the extent that such failure or delay results from circumstances beyond its reasonable control, including, without limitation, natural disasters, fire, flood, epidemic or pandemic, war, terrorism, civil unrest, governmental or regulatory action, widespread telecommunications or internet failures, power outages, cyberattacks affecting third-party infrastructure, or failures of essential third-party service providers beyond the affected party's reasonable control.

The affected party shall use reasonable efforts to mitigate the effects of the event and resume performance as soon as reasonably practicable.

The Publisher reserves the right to amend these Terms at any time. Users are informed of changes by any appropriate means (notification in the Service, email). Failing any objection expressed within thirty (30) days, the new terms are deemed accepted.

These Terms and your use of the Services are subject to applicable laws and regulations, including any mandatory provisions that may apply in the jurisdiction in which you are established or use the Services.

In the event of any dispute, claim or controversy arising out of or in connection with these Terms or the Services, the parties agree to first attempt to resolve the matter amicably and in good faith.

If an amicable resolution cannot be reached, the applicable law, jurisdiction and dispute resolution mechanism shall be determined in accordance with the applicable legal and regulatory framework and, where relevant, any specific terms applicable to the Service, country or region concerned.

Nothing in these Terms shall limit or exclude any rights or remedies that cannot be limited or excluded under applicable law.