These Terms of Service (the “Terms”) form the agreement between KINDI (provisional)(“KINDI”, “we”, “us”) and the person or legal entity that opens an account on, or sends an API request to, the KINDI service (“Customer”, “you”).

You accept these Terms by (i) creating a KINDI account, (ii) using a KINDI API key to send a request, or (iii) clicking an “I agree” control where one is presented. If you accept these Terms on behalf of an organisation, you represent that you are authorised to bind it.

KINDI is a server-side service that detects personal data in submitted text, replaces each detected span with a deterministic placeholder, and returns the placeholdered text alongside an encrypted envelope containing the placeholder-to-original mapping. The mapping is encrypted under a key derived from the requesting API key and can be decrypted only by a party that holds that API key.

KINDI is not a medical, legal, financial, or other licensed professional service. The service’s masking is best-effort, evaluated against published accuracy benchmarks, and is not warranted to detect every instance of personal data in every input.

Your use of the service is subject to KINDI’s Acceptable Use Policy, which is incorporated into these Terms by reference. A breach of the Acceptable Use Policy is a breach of these Terms.

You are responsible for maintaining the confidentiality of your account credentials and of any API key issued to you. KINDI displays each API key once, at the moment of creation, and does not store a recoverable copy. You are responsible for the consequences of any request made under an API key issued to your account, whether or not authorised by you.

Revocation of an API key invalidates every encrypted envelope previously returned under that key, by construction: the envelope can no longer be decrypted by any party. This is the intended security property and is not a defect.

The service is offered on a prepaid pay-as-you-go basis at the rate published on kindi.me/pricing. A free daily quota applies as described on the same page. Calls that exceed the free quota are debited from a prepaid balance at the moment of request.

All amounts are stated and charged in Saudi Riyals. VAT at the prevailing rate in the Kingdom of Saudi Arabia is itemised on each receipt. Top-ups are non-refundable. Unused balance does not expire and remains spendable indefinitely on the account that purchased it.

Where the text you submit to the service contains personal data as defined by the PDPL, you are the Controller and KINDI is the Processor. The terms on which KINDI processes that data on your behalf are stated in the Data Processing Addendum, which is incorporated into these Terms by reference and forms part of the agreement between us.

The data KINDI processes about you as an account holder (your registered email, your billing identity, your usage history) is governed by the Privacy Notice; for that processing, KINDI is the Controller.

Each party will treat as confidential any non-public information disclosed by the other in the course of the agreement, will use that information only for the purposes of the agreement, and will protect it with the same care it applies to its own confidential information of similar sensitivity. These obligations survive termination of the agreement for three years. They do not apply to information that is, or becomes, public through no breach by the receiving party, or that the receiving party is required to disclose by law or by a court of competent jurisdiction.

The service is provided on an “as is” and “as available” basis. KINDI does not warrant that the service will be uninterrupted, error-free, or free of every instance of undetected personal data. KINDI disclaims, to the maximum extent permitted by the law of the Kingdom of Saudi Arabia, all implied warranties, including the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

To the maximum extent permitted by applicable law, the aggregate liability of either party arising out of or in connection with the agreement is capped at the total fees paid by the Customer to KINDI in the twelve months preceding the event giving rise to the claim. Neither party is liable for indirect, consequential, special, or exemplary damages, or for lost profits or lost data, whether in contract, tort, or any other theory, even if advised of the possibility of such damages.

Nothing in this section limits a party’s liability for fraud, wilful misconduct, gross negligence, breach of confidentiality, or any liability that cannot be limited by law.

Customer will defend and indemnify KINDI against any third-party claim arising from (i) Customer’s breach of these Terms or the Acceptable Use Policy, (ii) Customer’s submission of content the Customer did not have the right to submit, or (iii) Customer’s violation of applicable law in connection with the use of the service.

KINDI will defend and indemnify Customer against any third-party claim that the service, as supplied and used in accordance with these Terms, infringes a Saudi-registered intellectual-property right.

The agreement runs from acceptance until terminated. Either party may terminate at any time on written notice (an email to the registered contact suffices). KINDI may suspend or terminate immediately on a confirmed breach of the Acceptable Use Policy, or where required by law.

On termination, API keys cease to function, unused balance on a Customer-initiated termination is refunded pro-rata within thirty (30) days, and the Customer’s personal data held by KINDI is returned or deleted as set out in the Data Processing Addendum.

KINDI may modify these Terms on at least thirty (30) days advance notice to the registered contact for the account. Continued use of the service after the effective date of a modification constitutes acceptance of the modified Terms. A Customer that does not accept a modification may terminate the agreement under § XI and receive a pro-rata refund of any unused prepaid balance.

These Terms are governed by the laws and regulations of the Kingdom of Saudi Arabia, including the PDPL and the controls issued by the National Cybersecurity Authority, without reference to conflict-of-laws principles. The competent courts of Riyadh have exclusive jurisdiction over any dispute arising out of or in connection with these Terms.

Legal notices to KINDI must be sent to contact@kindi.me. Data-protection correspondence should be sent to dpo@kindi.me. KINDI will send notices to the registered email address on the Customer’s account; the Customer is responsible for keeping that address current.

These Terms, together with the documents they incorporate by reference (the Acceptable Use Policy, the Privacy Notice, and the Data Processing Addendum), are the entire agreement between the parties on the subject and supersede any prior understanding.

If any provision of these Terms is found to be unenforceable, the remainder remains in full force. The failure of either party to enforce a provision is not a waiver of that provision. Neither party may assign the agreement without the other’s written consent, except as part of a transfer of substantially all of its business.