Commercial terms of service

1. The agreement

1.1. Parties and acceptance. These commercial terms (“Terms”) form an agreement between GAL Runtime Ltd, an Israeli company, registration number 517139382 (“GAL”), and the business identified in the applicable order or acceptance record (“Customer”). The individual accepting must be at least 18 and authorized to bind Customer. If that authority is absent, the individual must not accept on Customer’s behalf.

1.2. When they apply. The agreement begins when Customer expressly accepts this version through GAL’s acceptance process or signs an order incorporating it (“Effective Date”). Merely visiting the website, booking a call or receiving a proposal does not accept these Terms. A draft marked “For review” is not an offer to activate service.

1.3. Order of precedence. An order or design-partner agreement signed by both parties (“Order”) controls conflicting commercial terms. An agreed data processing agreement (“DPA”) controls personal-data processing. These Terms govern the remaining matters. A different GAL entity is a party only if the Order names it. Existing agreements remain effective until changed under their own terms.

1.4. Referenced documents. An Order must identify the applicable versions of these Terms and the Acceptable Use Policy. A customer DPA must include completed deployment schedules; the DPA review draft is not a completed processing arrangement. A purchase order, procurement portal or vendor form does not change the agreement unless both parties expressly accept its changes. Website information is addressed separately in the Website Use Notice.

2. Services and permitted access

2.1. Scope. The “Services” are the GAL dashboard, APIs, configuration distribution features and related support supplied under the Order. During the agreed term, GAL grants Customer a limited, non-exclusive right to use them for its authorized business operations. Access for affiliates, resale or managed services for others requires an agreed scope.

2.2. Configuration distribution. GAL helps distribute approved rules, skills and settings and report installed versions. A signature or installation report does not prove that an agent loaded, obeyed or safely executed a configuration. Customer retains responsibility for sandboxing, runtime enforcement, access approvals, testing, backups and recovery.

2.3. Trials and previews. Trial duration, limits, charges and any research participation must be agreed expressly. Preview features may be incomplete or change. Demonstrations and illustrative fleet counts are not service-level or capacity commitments. Availability, offline operation, air-gapped installation and compatibility commitments apply only if specified in the Order.

2.4. Changes. GAL may maintain and improve the Services. During a paid committed term, GAL will not materially reduce the core functionality promised in the Order without agreement, except where necessary to address an urgent legal or security requirement. Where practical, GAL will give advance notice of a material adverse change and discuss an appropriate remedy.

2.5. Support and compatibility. Support requests go to [email protected]. Supported versions, maintenance windows, response targets and any service warranty must be recorded in the Order. An acknowledgment or support conversation is not a resolution-time guarantee. Where practical, GAL will notify Customer before withdrawing an agreed API or configuration format and identify the available migration path; urgent legal or security changes remain subject to section 2.4.

3. Accounts and customer responsibilities

3.1. Authorized users. Customer is responsible for accurate account information and for people it authorizes to use the Services (“Users”). Customer must protect credentials, remove access when no longer needed and promptly notify [email protected] of suspected compromise.

Customer’s responsibility for its Users does not excuse GAL’s own breach or make Customer responsible for credential misuse to the extent caused by GAL’s breach.

3.2. Approvals and deployment. Customer must have rights to the systems, configurations and recipients it selects. Customer controls bundle contents, approvals, signing-key custody and deployment destinations. Test changes before wider use. A valid signature establishes integrity and origin within the configured trust model; it does not establish that the contents are safe.

3.3. Restricted uses and data. Customer must not use the Services for unlawful access, malware delivery, evading access controls, service disruption or infringement. No classified information, controlled defense technical data or other specially regulated material may be supplied unless the parties first agree a suitable written handling scope and obtain required approvals. Public forms, meeting invitations and ordinary email are not approved channels for secrets or restricted material.

3.4. Applicable law. Each party must comply with laws applicable to its own activities, including relevant sanctions, export controls and privacy obligations. Defense-sector positioning is not an accreditation or authorization. Safety-critical use requires a separately agreed and validated deployment; GAL must not be relied upon as the sole safeguard against injury or physical harm.

4. Content and intellectual property

4.1. Customer Content. Customer retains ownership of configurations, rules, skills, settings and related material it supplies (“Customer Content”). Customer grants GAL only the rights needed to host, reproduce, transmit and otherwise process that material to provide the agreed Services, authorized support and legally required retention. Customer warrants that it has the necessary rights and permissions.

4.2. GAL technology. GAL and its licensors retain their rights in the Services, software, documentation and branding. No ownership transfers except where expressly agreed. Customer may not copy or reverse engineer proprietary components except as permitted by mandatory law or the applicable license. Separately licensed open-source software retains its own license and associated rights.

4.3. Feedback and publicity. GAL may use voluntarily supplied product suggestions without payment, but this permission does not include Customer’s confidential material, personal data or brand. Customer names, logos, recordings and case studies require separate written permission. GAL will not use Customer Content to train general-purpose AI models under this agreement. Sending feedback does not waive confidentiality or grant a training permission.

4.4. Third-party systems. Customer selects and authorizes its identity, source-control and agent-harness integrations. Their providers’ terms apply to them. GAL does not assume their obligations, but remains responsible for its own commitments under this agreement.

4.5. Operational measurements. GAL may process the operational records needed to provide, secure and troubleshoot the agreed Services, subject to the Privacy Policy, confidentiality obligations and applicable DPA. Calling a record telemetry, a hash or an aggregate does not remove those protections. This clause grants no unrestricted or perpetual right to reuse Customer Content, no right to identify Customer in published benchmarks, and no additional model-training permission.

5. Confidentiality and personal data

5.1. Confidential Information. Non-public information identified as confidential, or reasonably understood to be confidential from its nature and circumstances, is “Confidential Information”. Customer Content is covered even if Customer has not marked it confidential, subject to the exceptions below. The recipient must use it only for the agreement and apply safeguards at least as careful as those it uses for its own comparable confidential material, with reasonable care as the minimum. Access is limited to personnel, service providers and advisers who need it for the agreed work and are subject to confidentiality duties protecting that material. Each party remains accountable under this agreement for the handling of the material by people and providers it authorizes to access it.

5.2. Exceptions and disclosure. These duties do not cover information the recipient can demonstrate was already lawfully known, became public without breach, was independently developed or was lawfully received without restriction. If disclosure is legally required, the recipient will disclose only what is required and, where lawful, give notice and reasonable assistance in seeking protection.

5.3. Return and retention. On request or termination, each party must return or delete the other’s Confidential Information, except copies required by law or retained in routine backups until their normal expiry. Retained copies remain protected and may not be used for unrelated purposes. These duties continue for five years after termination and, for trade secrets, while they remain legally protected as such.

5.4. Personal data. The Privacy Policy explains GAL’s handling of business and account data. Where GAL processes personal data for Customer, a DPA addressing the actual deployment must be in place before that processing begins. It must identify the processing scope and instructions, security measures, authorized subprocessors, incident notifications, assistance with individual rights, return or deletion, and any required transfer safeguards. These Terms do not certify that those arrangements have already been completed. Customer remains responsible for its instructions and notices to affected individuals. Research participation, optional marketing and recording require separate choices; acceptance of these Terms does not supply that consent.

6. Fees and commercial commitments

6.1. Orders. Fees, currency, payment dates, usage limits and any renewal mechanism must be stated in an accepted Order. No paid subscription or automatic renewal arises solely from a call, inquiry or trial. Fees may not be increased during an agreed fixed term unless its Order expressly permits that change.

6.2. Taxes and disputes. Customer is responsible for applicable transaction taxes identified on the invoice, excluding taxes on GAL’s net income. Legally required withholding must be documented; no additional gross-up obligation is created without an Order. Notify GAL promptly of a good-faith invoice dispute and pay undisputed amounts when due. The parties will work to resolve disputed items before collection action on those items.

7. Suspension and termination

7.1. Term and cure. An Order controls any committed term. Otherwise, either party may end ongoing access on 30 days’ written notice. Either party may terminate for a material breach not remedied within 30 days after written notice describing it, or immediately if performance is unlawful.

7.2. Proportionate suspension. GAL may suspend affected access where reasonably necessary to address an active security threat, unlawful use or material breach, including undisputed overdue fees after notice and a reasonable opportunity to pay. GAL will limit the scope and duration, give notice where lawful and practical, and restore access when the cause is resolved.

7.3. Consequences. On termination, service access rights end and accrued undisputed payment obligations remain. If GAL terminates a prepaid term for convenience, or Customer terminates for GAL’s uncured material breach, GAL will refund prepaid fees attributable to the unused terminated period. Other refunds follow the Order or mandatory law.

7.4. Content and survival. Customer should keep its own copies. On a request made within 30 days after termination, GAL will provide a reasonable opportunity to retrieve Customer Content it still holds, unless legally prohibited or unsafe; retention and deletion follow the DPA and applicable law. Ending hosted access does not transfer ownership of Customer Content or cancel rights that continue under a separate software license. Ownership, confidentiality, accrued payments, liability, dispute and other provisions intended to continue survive termination.

8. Warranties and disclaimers

8.1. Authority. Each party represents that it has authority to enter into and perform the agreement. Express commitments in an Order remain binding.

8.2. SERVICE LIMITATIONS. EXCEPT FOR EXPRESS COMMITMENTS IN THE AGREEMENT AND RIGHTS THAT LAW DOES NOT ALLOW TO BE EXCLUDED, THE SERVICES ARE PROVIDED AS AVAILABLE. GAL DOES NOT GIVE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. GAL DOES NOT GUARANTEE ERROR-FREE OR UNINTERRUPTED OPERATION, UNIVERSAL COMPATIBILITY, AGENT COMPLIANCE WITH A CONFIGURATION, OR PREVENTION OF EVERY SECURITY INCIDENT.

8.3. Preview suitability. Customer must assess whether a preview is suitable for its intended use. A website description or demonstration does not establish defense accreditation, regulatory compliance, a service-level agreement or a fitness commitment beyond the express agreement.

9. Limits on liability

9.1. EXCLUDED LOSSES. SUBJECT TO SECTION 9.3, NEITHER PARTY IS LIABLE TO THE OTHER FOR INDIRECT OR CONSEQUENTIAL LOSS, LOST PROFITS, LOST BUSINESS OPPORTUNITIES OR LOST GOODWILL ARISING FROM THE AGREEMENT. THIS DOES NOT EXCLUDE A REMEDY THAT MANDATORY LAW REQUIRES.

9.2. Aggregate cap. Subject to section 9.3, each party’s total liability arising from the agreement is limited to the greater of US$1,000 and the fees paid or payable for the affected Services during the 12 months before the event first giving rise to the claim. Related events count together, and multiple claims do not multiply the cap. The cap applies to contractual and other legal claims, including negligence and the indemnity in section 10, where law permits.

9.3. Exceptions. The exclusions and cap do not limit fraud, wilful misconduct, payment obligations for Services supplied, or liability that applicable law prohibits limiting, including death or personal injury where exclusion is prohibited. An Order may expressly agree different limits for a defined risk. Nothing restricts an individual’s statutory data-protection rights.

9.4. Allocation of risk. These limits reflect the agreed scope and fees. They do not excuse a party from performing its obligations or erase an express refund or correction remedy. Any invalid limitation applies only to the extent legally permitted.

10. Third-party claims

10.1. Customer responsibility. Customer will defend GAL against a third-party claim that Customer Content infringes that third party’s rights or that Customer’s unlawful use of the Services caused it harm, and pay damages and reasonable defence costs finally awarded or agreed in a settlement approved by Customer. This obligation is subject to section 9 and does not apply to the extent caused by GAL’s breach, unlawful conduct or unauthorized modification of Customer Content.

10.2. Claims process. GAL must promptly notify Customer and provide reasonable cooperation at Customer’s expense. Delay reduces the obligation only to the extent it materially prejudices the defence. Customer may control the defence using competent counsel. A settlement may not require GAL to admit wrongdoing, pay an uncovered amount or undertake a continuing obligation without GAL’s written consent, not to be unreasonably withheld.

10.3. Additional protection. Any indemnity from GAL for intellectual-property or other claims must be expressly agreed in an Order. Its absence does not remove Customer’s ordinary remedies for GAL’s breach or mandatory rights.

11. Notices and disputes

11.1. Notices. Contract notices must be sent in writing to [email protected] for GAL and to Customer’s designated business contact for Customer. Electronic notice takes effect when received; a failed or bounced message is not notice. This clause does not replace legally required service of court documents.

11.2. Good-faith resolution. Before starting ordinary proceedings, a party should describe the dispute in writing and allow 30 days for good-faith discussions. This does not delay urgent relief, a regulatory complaint or a filing needed to preserve a legal deadline.

11.3. Governing law. Unless an Order provides otherwise, Israeli law governs the agreement and disputes may be brought in the competent courts of Tel Aviv–Jaffa. Any mandatory law or non-waivable jurisdictional right remains applicable. These Terms do not impose US arbitration or a class-action waiver.

12. Changes and general provisions

12.1. Changes. Revised terms apply only through the notice and acceptance process applicable to Customer’s agreement. GAL will identify the version and provide a copy for review. A new webpage does not retrospectively change an accepted agreement. Material changes to a committed Order require agreement by both parties.

12.2. Assignment. Neither party may transfer the agreement without the other’s written consent, except with a merger or transfer of substantially all the relevant business where the successor assumes its obligations and confidentiality and data-protection duties continue. The transferring party must give notice. Assignment does not by itself release accrued obligations.

12.3. Events beyond control. A party is not responsible for delay caused by events beyond its reasonable control if it gives prompt notice and takes reasonable steps to reduce the impact. This does not excuse accrued payment duties or security and confidentiality obligations that can still be performed.

12.4. Remaining provisions. An unenforceable provision is limited or severed only as necessary; the rest remains effective. Delay in enforcing a right is not a waiver. The parties are independent contractors. The agreement, including its Order and DPA, states their complete agreement on its subject, without overriding an existing signed agreement that remains in force or excluding liability for fraud. No third party gains enforcement rights except where law requires.