Soma1. Intended use and boundaries
These terms apply to agreed AI features such as drafting, summaries, extraction, search and workflow assistance. EUTS offers self-hosted open-weight approaches; availability, model choice and processing boundaries must be agreed per deployment. This does not claim every installation uses the same model or has completed a regulatory conformity assessment.
Before enabling a feature, document the operator, hosting/support locations, data sent, retention, training policy, output destination and permissions. External models, web search, geocoding or voice services require the applicable approval and safeguards.
2. Data use and training
Customer data must not train shared models or models for others. Organisation-specific fine-tuning needs a separate documented instruction, source rights, retention and agreed environment. Prompts, outputs, embeddings, voice, files and diagnostic previews can contain personal or confidential information and must be minimised and included in the processing schedule.
3. Human oversight and transparency
AI output may be inaccurate, biased or fabricated. An authorised person must validate material facts, sources and consequences before professional reliance, external communication or consequential actions. Review must be meaningful, with information and authority to correct or stop. Agents must remain within approved roles and action limits, with records and approvals appropriate to risk.
Inform people when interacting with AI and label generated or manipulated content where law requires. Provide suitable staff AI literacy. EUTS and the customer must assess their actual provider/deployer roles and intended purpose under the EU AI Act, including transparency and applicable implementation dates; a product label does not decide classification.
4. Restricted and high-risk uses
Prohibited practices remain prohibited. Employment, credit, essential services, biometric and similar uses need assessment before deployment. Solely automated decisions with legal or similarly significant effects need a lawful Article 22 GDPR basis and safeguards. A human approval checkbox alone does not resolve legal duties. Healthcare, legal and financial content needs qualified review; planned or illustrative modules are not approved regulated systems.
5. Connected accounts and Google data
Connectors require authority, minimal scopes and an accurate notice identifying data, purposes, provider roles, recipients, retention, disconnection and deletion. Disconnection does not necessarily erase records already lawfully copied into a workspace; documented retention and instructions govern them.
Where an approved Google Workspace integration is offered, use and transfer of Google API data must comply with the Google API Services User Data Policy, including applicable Limited Use requirements. Google data must not be sold, used for targeted advertising or train a generalised AI model. Human access and transfers must fit permitted purposes and lawful instructions. This does not assert OAuth verification is complete or specific scopes are active.
6. Concerns
If a feature exceeds permissions, exposes data or produces harmful output, stop the workflow where safe and contact your administrator and contact@euts.ai. Preserve only necessary evidence. Use the agreed incident route for a suspected breach. EUTS remains responsible for its own defects and legal duties.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub