14-Day Sandbox Pilot Terms & Conditions

1. Sandbox Evaluation License

The 14-Day Sandbox Pilot grants your enterprise ("Licensee") a non-exclusive, revocable, non-transferable evaluation license to deploy OmitPII software on up to ten (10) designated staff computers or internal private server container instances for internal testing, workflow integration, and statutory risk assessment.

2. Data Controller Allocation & Regulatory Governance (Jersey DPL 2018 & GDPR)

Data Controller Allocation: In accordance with the Jersey DPL 2018 (Data Protection (Jersey) Law 2018, Art. 1(1)), UK GDPR (Art. 4(7)), and EU GDPR (Art. 4(7)), Licensee acts as and remains the sole and exclusive Data Controller in respect of all client documents, prompt queries, settlement files, trust portfolios, and personal data processed through OmitPII.

Absence of Processor Relationship for Local Workstation Processing: Because OmitPII executes entirely on-device and does not transmit, host, log, or access unmasked client personal data on external servers, OmitPII does not act as a data processor for prompt content. Consequently, no Article 28 / Jersey DPL data processing agreement is triggered for local workstation execution. Where OmitPII processes Licensee's corporate contact data for licensing and support, it does so as an independent controller under its Privacy Policy.

Accountability Records: Licensee remains responsible for its own record of processing activities (Art. 30 UK/EU GDPR), its data protection impact assessments (Art. 35), and its transfer risk assessments. OmitPII's local audit database and Evidence Locker are designed to supply the technical evidence those records require, but they do not constitute the records themselves.

Human-in-the-Loop (HITL) Validation: Licensee acknowledges that OmitPII operates as a deterministic redaction shield and technical compliance aid. Licensee retains sole operational accountability for reviewing outputs prior to external dispatch, in alignment with UK GDPR Art. 22, Jersey DPL 2018 Art. 38, and Art. 14 and 26 of the EU AI Act.

3. EU AI Act Role Allocation & Applicability

Classification of OmitPII: OmitPII performs deterministic pattern detection, tokenization, and local rehydration. The parties agree that OmitPII is not a general-purpose AI model within the meaning of Art. 3(63), is not a high-risk AI system listed in Annex III, and is not placed on the market as a safety component of a product covered by Annex I. OmitPII is properly characterised as a data governance and data minimisation control that supports Licensee's obligations under Art. 10 (data and data governance).

Licensee as Deployer: When Licensee transmits a sanitized prompt to a third-party model, Licensee acts as the deployer of that AI system under Art. 3(4) and retains the deployer obligations in Art. 26, including assigning human oversight to persons with the necessary competence, training and authority (Art. 26(2)), and the transparency obligations in Art. 50. Licensee also retains the Art. 4 duty to take measures supporting the development of AI literacy among its staff.

Prohibited Practices: Licensee shall not use OmitPII, or any AI system accessed through it, for any practice prohibited by Art. 5, which has been in force since 2 February 2025.

Amended Applicability Dates: The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) revised the AI Act timetable. Art. 5 and Art. 4 apply from 2 February 2025; general-purpose AI model obligations from 2 August 2025; Art. 50 transparency obligations from 2 August 2026, with Art. 50(2) extending to systems already on the market from 2 December 2026; high-risk obligations from 2 December 2027 (stand-alone Annex III systems) and 2 August 2028 (AI embedded in Annex I products).

4. Third-Party LLM Endpoints & BYOK Architecture

When configured to connect with external Large Language Models (such as OpenAI, Anthropic, Google Gemini, or OpenRouter), client workstations communicate directly with the third-party provider's API endpoints using Licensee's own credentials ("Bring Your Own Key" / BYOK). Zero prompt payload passes through OmitPII cloud infrastructure. Third-party provider terms and privacy policies govern external model inference.

Licensee is solely responsible for selecting its model providers, for the terms on which it contracts with them, for the lawful basis of any disclosure to them, and for satisfying itself as to their data residency, retention, subprocessing and model-training practices. OmitPII gives no warranty in respect of any third-party provider.

5. Bundled and Embedded AI Assistants: Routing Diligence

Licensee acknowledges that AI assistants bundled into productivity, collaboration, or developer suites (including but not limited to Microsoft Copilot, GitHub Copilot, Google Gemini for Workspace, and in-application assistants) are cloud-hosted services. Prompt content, and any organisational data used to ground a response, is processed on the vendor's infrastructure and is outside the scope of OmitPII's on-device processing.

Vendor-Controlled Routing: Licensee further acknowledges that the processing location, the model selected, and the identity of AI subprocessors in such services are determined by vendor configuration and default settings, which vendors may change unilaterally by product update, and which may place processing outside the Licensee's own jurisdiction or outside the EU Data Boundary. Licensee is responsible for reviewing its tenant settings, subprocessor disclosures, and vendor change notifications on an ongoing basis.

Nothing in this clause constitutes a representation by OmitPII that any named third-party service is unlawful, non-compliant, or unsuitable. Such services are commonly operated under substantial contractual and certification frameworks. This clause allocates the responsibility for assessing them to Licensee, who alone controls its tenant configuration.

6. Cross-Border Transfers & Channel Islands Position

Licensee is responsible for ensuring that any transfer of personal data to a third country arising from its use of external AI providers satisfies Chapter V of the UK/EU GDPR or Part 4 (Articles 66-69) of the Jersey DPL 2018, as applicable, including the completion of a transfer risk assessment where an adequacy decision is not available.

Jersey-specific acknowledgement: Licensees established in Jersey acknowledge that professional secrecy duties and Jersey Financial Services Commission outsourcing expectations may apply independently of, and in addition to, data protection law.

7. Acceptable Use & No Circumvention

Licensee shall not disable, bypass, or reconfigure OmitPII's redaction controls in order to transmit unmasked personal data to an external model; use OmitPII to represent to any regulator, client, or insurer that a processing activity is compliant when Licensee has not assessed it; reverse engineer, decompile, or extract the detection rule set except as permitted by applicable law; or use the software to process data in furtherance of any practice prohibited by Art. 5 of the EU AI Act.

8. No Automatic Billing & Zero Financial Commitment

The 14-day sandbox pilot is provided at zero cost with no deposit or credit card required. Following the 14-day evaluation period, the evaluation license concludes without automatic billing. Continued enterprise use requires an agreed enterprise subscription agreement.

9. Regulatory Exposure & Limitation of Statutory Liability

OmitPII provides deterministic redaction and signed cryptographic audit logs designed to assist Licensee in mitigating regulatory exposure under the Data Protection Authority (Jersey) Law 2018 (Art. 26-27: administrative fines with upper limits between £5M and £10M depending on the provisions breached, subject to a cap of £300,000 or 10% of total global annual turnover, whichever is higher), UK GDPR (Art. 83: up to £17.5M or 4% of total worldwide annual turnover, whichever is higher), and the EU AI Act (Art. 99: up to €35M or 7% of total worldwide annual turnover for prohibited practices, and up to €15M or 3% for most other breaches, whichever is higher). During the evaluation period, software is provided on an "as-is" basis for testing purposes, and OmitPII disclaims liability for statutory fines or consequential damages arising from Licensee's evaluation.

10. Security Incidents & Cooperation

Each party shall notify the other without undue delay on becoming aware of a security incident affecting the pilot deployment that is relevant to the other party's legal obligations. Because OmitPII holds no unmasked prompt content, a breach of OmitPII infrastructure cannot expose Licensee client data processed locally.

11. Confidentiality & Local Audit Ownership

Both parties agree to treat technical evaluation documentation and configuration parameters as confidential. All local audit databases and Evidence Locker records generated by OmitPII remain encrypted and under the exclusive operational control and ownership of Licensee.

12. Term, Termination & End of Evaluation

The evaluation term runs for fourteen (14) days from license provisioning. Either party may terminate at any time on written notice, with no penalty. On expiry or termination, Licensee shall cease use of the software and may uninstall it; because all pilot data, audit records, and token mappings are held locally, Licensee retains sole custody of them and no data return or deletion request to OmitPII is necessary in respect of prompt content. Clauses 2, 3, 5, 6, 7, 9, 11 and 13 survive termination.

13. Governing Law & Support

These evaluation terms are governed by and construed in accordance with the laws of England and Wales or the Bailiwick of Jersey, corresponding to the Licensee's jurisdiction of incorporation, and the courts of the corresponding jurisdiction shall have non-exclusive jurisdiction over any dispute. Where Licensee is incorporated elsewhere, the laws of the Bailiwick of Jersey apply. Pilot participants receive direct founding engineering onboarding support via hello@omitpii.com.

These T&Cs describe a software evaluation and allocate responsibilities between the parties. They are not legal advice, and they do not replace Licensee's own regulatory, professional-conduct, or outsourcing analysis.