These Terms of Service (the "Terms") are the contract between **PENTEVARK S.A.S.**, a Colombian simplified stock company identified with NIT 902.114.276-8 and owner of the **Custodio Legal** brand, domiciled at Carrera 17 #2-81, Sogamoso, Boyacá, Colombia, email support@custodio.legal and telephone +57 333 431 8597 ("Custodio Legal", "we"), and the law firm or legal professional that contracts the Service (the "Firm", "you"). The Service is offered in Argentina, in Brazil, in Colombia, in Costa Rica, in Ecuador, in the Dominican Republic and in Uruguay. By using Custodio Legal you declare that you have the legal capacity to contract and, if you act on behalf of a firm, the authority to bind it. Read these Terms carefully before using the application. Until October 7, 2026 the Service was provided, under the Custodio Legal brand, by the natural person who then owned it. From that date it is provided by PENTEVARK S.A.S., which succeeds that person in the contracts entered into under these Terms and in the processing of the data: your subscription, your data, your terms and your rights remain the same. ## 1. Acceptance of Terms {#section1} By creating an account or using the Service you agree to be bound by these Terms, our Personal Data Processing Policy and our Cookie Policy. If you disagree with any part, you may not use the Service. You contract the Service for the exercise of your professional activity or that of your firm, not as an end consumer; these Terms are therefore a professional business-to-business contract, without prejudice to the benefits we voluntarily grant in Section 3A and to the rules that admit no agreement to the contrary. Your acceptance is recorded with the version of these Terms you accepted, the date, the IP address and the user agent from which you gave it, in an immutable log you can consult at 'My account > Your privacy'. That record is a data message with evidentiary value under Colombia's Law 527 of 1999, Ecuador's Electronic Commerce, Electronic Signatures and Data Messages Law, Article 9 of the Dominican Republic's Ley núm. 126-02 on electronic commerce, documents and digital signatures(which gives them «la misma fuerza probatoria otorgada a los actos bajo firma privada»), Article 4 of Costa Rica's Ley N° 8454, which gives electronic documents «fuerza probatoria en las mismas condiciones que a los documentos físicos», and Article 4 of Uruguay's Ley N° 18.600, under which electronic documents «satisfacen el requerimiento de escritura y tendrán el mismo valor y efectos jurídicos que los documentos escritos, salvo las excepciones legalmente consagradas». ## 2. Accounts {#section2} When you create an account you must give us accurate, complete and current information, and keep it so. That information includes the **firm's tax identification number** —the NIT in Colombia, the RUC in Ecuador, the RNC or the cédula in the Dominican Republic and the cédula jurídica or física in Costa Rica—, which you may declare when you open your practice and which we ask for before you subscribe to any paid plan. Its accuracy is yours: the tax treatment of the transaction depends on it, and it is what identifies your firm as a professional buyer on the invoice, as Section 1 states. You can see it and correct it at any time in 'My practice > Firm profile'. You are responsible for the confidentiality of your credentials and for all activities that occur under your account and under the accounts of the members your firm invites. You must notify us immediately of any unauthorized use. Failure to comply with this section is a breach of the Terms and may lead to suspension or termination of the account under Section 5. ## 3. Intellectual Property {#section3} The Service and its original content, features, functionality, source code, design and logos are and will remain the exclusive property of Custodio Legal and its licensors, protected by intellectual property laws and applicable international treaties. What you create with the Service — your matters, your documents, your notes and the drafts you generate — is yours, on the terms of Section 4. ## 3A. Withdrawal and Return Right {#section_retracto} Although you contract the Service for your professional activity and not as an end consumer, we voluntarily grant you the right to undo the purchase of a paid subscription bought through a non-presential transaction. **What the term is, which rule of your country recognizes that right and what that rule gives as a minimum is stated by your country's annex**, which in no case gives you less than the law of your country recognizes: in Colombia, in Costa Rica, in the Dominican Republic and in Uruguay the term we grant is longer than the legal one, and in Ecuador the one in force is the legal one, which is the longest of the seven. **Argentina is the only country where this right is not one we grant you**: Article 34 of Ley 24.240 and Article 1110 of the Código Civil y Comercial give you ten calendar days and declare the faculty non-waivable, so there is nothing there to grant and nothing to reserve, and the Argentine annex transcribes both articles. **In Brazil the term we grant is longer than the statutory one too, and these Terms do not claim that Brazilian consumer law reaches you**: Article 49 of the Código de Defesa do Consumidor gives seven (7) days counted from the signature of the contract or from the receipt of the service when the contracting happens outside the commercial establishment, and the fifteen (15) calendar days this Section grants you cover it whole; the Brazilian annex transcribes the article and explains why the underlying question —whether a firm that uses the platform as an input to its profession is a «destinatário final»— stays open. What holds the same in all seven countries, and is therefore here: - To exercise it, notify us in writing before the deadline at support@custodio.legal or from 'My practice > My plan'. - We refund all the money paid, with no deductions or withholdings and through the same payment method, within fifteen (15) calendar days of your notice. - **In Colombia and in the Dominican Republic** the right does not apply when the provision of the paid Service already began with your prior and express consent: if you activated the plan and already used features exclusive to it — for example, judicial surveillance of more matters than the free plan admits, or the Artificial Intelligence features above the free allowance — we consider that provision began. This is the exception those two annexes refer to, and it is legitimate because in those two countries the right is one we grant you above the legal one. **In Ecuador it does not operate**: there the right is given by Article 45 of the Ley Orgánica de Defensa del Consumidor, which does not contemplate it and which, for services, orders precisely that the contract cease immediately — a right the law gives is not one we cut down by contract. The Ecuadorian annex transcribes the whole article. **In Costa Rica another exception applies**, that of article 73 of the Reglamento to Ley N° 7472 (Decreto Ejecutivo N° 37899): starting to use the plan does not leave you without the right, but the refund reaches only the part of the Service that had not been provided to you before your notice, and you pay proportionally for the part you did receive. The Costa Rican annex transcribes it. **And in Uruguay the digital-content exception applies**, that of Article 16-BIS, paragraph H), of Ley N° 17.250: if you expressly consent to our starting to provide the Service immediately and you begin to use it, you lose the five-business-day right of withdrawal Article 16 of that law gives the consumer — not the fifteen calendar days this Section grants you by contract, which we keep honouring all the same. The Uruguayan annex transcribes it and explains why it is written out. **In Argentina we reserve no exception**: the right is statutory and non-waivable, and neither Article 34 of Ley 24.240 nor Articles 1110 to 1116 of the Código Civil y Comercial excepts a service already begun, so neither do we. The Argentine annex says it with its articles. **In Brazil we reserve no exception either**: the sole paragraph of Article 49 of the Código de Defesa do Consumidor orders every amount paid «a qualquer título, durante o prazo de reflexão» to be returned «de imediato, monetariamente atualizados», and it excepts no service already begun, so neither do we. ## 4. Firm Content and Processing-on-Behalf Conditions {#section4} **(a) Your content.** You retain all rights to the content you upload to the Service. By uploading it you grant us a limited, non-exclusive and revocable license to process and display it, and to keep the text extracted from it and its provenance, to the extent necessary to provide you the Service. We do not keep the original file: it is processed transiently to extract its content and then deleted, as Section 10 of the Personal Data Processing Policy states. You are responsible for ensuring your content does not infringe third-party rights or violate applicable law. **(b) Roles.** For the personal data of the platform's users — you and the members of your firm — Custodio Legal is the data controller, and that processing is governed by the Personal Data Processing Policy. For the personal data of third parties that live in the matters you manage — your clients, the opposing parties, witnesses, anyone with an interest in a proceeding — **the Firm is the data controller and Custodio Legal is the processor**, which processes them on your behalf and under your instructions. This section is the transmission contract required by Article 25 of Colombia's Decree 1377 of 2013 (Article 2.2.2.25.5.2 of Decree 1074 of 2015), by Article 47 of Ecuador's Organic Law on Personal Data Protection (LOPDP) and by Article 30 of the Reglamento to Costa Rica's Ley N° 8968 (Executive Decree N° 37554-JP), under which the processor «solo podrá intervenir en el tratamiento de las bases de datos personales, según lo establecido en el contrato celebrado con el responsable y sus indicaciones». The Dominican Republic's Ley núm. 172-13 defines the processor — whoever processes the data on the controller's behalf, Article 6, paragraph 12 — but does not require a contract between the two: in the Dominican Republic this section holds by agreement between you and us, and not because a rule imposes it. In Uruguay Article 30 of Ley N° 18.331 presupposes that contract —it forbids applying the data «a un fin distinto del que figure en el contrato de servicios» and transferring them to others «ni aún para su conservación»—, so there the processing-on-behalf is additionally documented in the data processing agreement we publish as an instrument of its own, with the clauses of Annex I of URCDP Resolution N° 41/021 and every sub-processor named inside it. In Argentina the processing-on-behalf is documented in an instrument of its own too, and there the text is not ours to draft: Disposición DNPDP 60-E/2016 publishes the model and its Article 2 requires whoever departs from it to seek the AAIP's approval within thirty calendar days of signature, so we reproduce Annex II as it stands, clause by clause, with the Annex A that describes the transfer and where the data is hosted. In Brazil the processing-on-behalf is documented in an instrument of its own too, and there the text is not ours to draft either: Article 16 of Resolução CD/ANPD nº 19, de 23 de agosto de 2024, conditions the validity of the transfer on «a adoção integral e sem alteração do texto disponibilizado no Anexo II», and its § 2º forbids any other provision of our contracts from excluding, modifying or contradicting it «direta ou indiretamente», so we reproduce those cláusulas-padrão contratuais exactly as they stand, with the list of sub-processors attached. **(c) Subject matter and scope.** The engagement covers the storage, text extraction, search, summary, analysis, assisted drafting, judicial surveillance and the other operations the Service performs on the data of your matters, for the sole purpose of providing you the Service, and lasts as long as this contract lasts. **(d) Instructions.** We process those data only under your instructions, which are the Service features you and the members of your firm execute, and those you give us in writing at support@custodio.legal. We do not use them for our own purposes, do not disclose them to third parties for purposes of their own, and do not train models with them. If an instruction of yours seems contrary to law, we tell you before executing it. **(e) Authorization warranty.** You declare that you hold the authorization of the data subjects, or another legal basis, to process the personal data you upload to your matters — including the sensitive data and the data of children and adolescents a case file may contain — under Articles 6, 7 and 9 of Law 1581 of 2012, Article 12 of Decree 1377 of 2013 and Articles 7 and 8 of the LOPDP. A judicial case file contains such data by the nature of the proceeding; it is the Firm, as controller, that must have obtained the authorization the law requires, and that answers to the data subjects and the authorities for it. We do not ask you for those data nor collect them on our own. **(f) Data subject rights.** When a data subject exercises before us a right over data that live in a matter of yours, we inform them that the controller is your firm, forward the request to you within the following two (2) business days and give them your contact details. You answer within the deadlines of your country; we give you the Service's tools to rectify or delete what applies. **(g) Sub-processors.** To provide the Service we use the following providers, which process data of your matters on our behalf: Nebius B.V. (the Netherlands; text generation for the Artificial Intelligence features and vector representations of the text of your documents, with Zero Data Retention enabled and with the European Union's adequacy decision in favour of Israel for the inference the provider runs in that country), Railway (United States; hosting of the application, the database and its backups), Resend (United States; transactional email), Polar (United States; payments and invoicing, which receives your account data and not the data of your matters), Sentry (United States; technical error monitoring, which receives the path where the error occurred and your internal user identifier; no email, no name and no IP address), Cloudflare (United States; delivery network and protection of the public site and of access to our internal documentation) and Oracle America, Inc. (United States, with the virtual machine in its São Paulo region, Brazil; network exit to the Diário de Justiça Eletrônico Nacional, only for firms whose country is Brazil, with the content encrypted end to end and not stored; active since October 14, 2026). Each of those providers incorporates into its terms a data processing agreement that we accept when contracting it. **Google is not on this list**, and not by oversight: it does not process data of your matters, either on our behalf or on its own. The product makes three uses of it, and its role is not the same in all of them. In two -sign-in with your Google account and the public-site Ads tag- it acts as an independent controller, so for them we hold no processor agreement with it; Section 15 of the Personal Data Processing Policy explains it, naming the version of each instrument that governs that relationship. In the third -measurement of the use of the public site with Google Analytics 4, which in the application only runs at the instant an account is created, to count that sign-up- it acts as our processor, under its Data Processing Terms, and receives browsing data of whoever visits the site and the notice that an account was created, not data of your matters; Section 10 (ix) of that Policy and Section 4 of the Cookie Policy say so. **Microsoft is not on this list either**, for the same reason: it does not process data of your matters. The product makes a single use of it, sign-in with a Microsoft account, personal or work or school, for whoever chooses that button, and in it it acts as an independent controller: we hold no processor agreement with it, and naming it is not the addition of a new sub-processor that this point governs with its thirty days' notice. Section 15 (iii) of the Personal Data Processing Policy explains it. The list in force, with what each provider receives and under which safeguard, is published and kept up to date at https://custodio.legal/subprocessors. The Personal Data Processing Policy (Sections 9, 10 and 14) says, provider by provider, what is sent to it and under which safeguard. If we change the text generation provider or the jurisdiction the data are transferred to, we raise the version of that Policy and ask you for a new authorization before continuing; for any other new sub-processor we give you thirty (30) days' notice and you may terminate the contract without penalty if you disagree. **(h) Confidentiality.** We treat the data of your matters as confidential information covered by your firm's professional secrecy. Our staff are bound by a duty of confidentiality and **do not enter your account with your identity**: what they can and cannot do to support you is set out in Section 9. This obligation survives termination of the contract. **(i) Security.** We apply the technical, human and administrative measures described in Section 5 of the Personal Data Processing Policy and on the security and compliance page: encryption in transit, AES-256-GCM encryption of sensitive fields at rest, access control by role and by firm, audit logging, database backups and security monitoring. **(j) Incidents.** If a security incident affecting personal data of your matters occurs, we notify you without delay and at the latest within the two (2) business days following our becoming aware of it, with what we know about its nature, the data affected, the likely consequences and the measures taken, so you can meet your own notification obligations. For the data we are controller of, we inform your country's supervisory authority, where your country has one to present it to, within the term that country's privacy annex states -which also says whether the term is set by a rule or adopted by our own decision-, and the data subject in any case without undue delay. **(k) On termination.** When the contract ends, the data of your matters stop being available in the Service and are deleted or anonymized within the ninety (90) days following termination, unless a legal obligation requires keeping them, under Section 11 of the Personal Data Processing Policy, which is the retention policy in force. The records of authorization, audit and data subject requests are kept as proof of compliance. According to what that provider publishes, the data we have sent to the text generation provider are not stored by it after each request is processed, on the terms of Section 21 (h) -which also states what that declaration does not cover and from when it holds. ## 5. Termination {#section5} You may cancel your account at any time from 'My account', and your subscription from 'My practice > My plan' under Section 12. We may terminate or suspend your access to the Service for violation of these Terms with thirty (30) days' prior notice, except in cases of serious violation — illegal use, an attack on the platform or on another firm's data, prolonged non-payment — where suspension may be immediate. You have the right to request a copy of your account personal data under the portability right recognized by the data protection legislation of your country; you may exercise it at any time, even after terminating your account, through the channels of Sections 6 and 7 of our Personal Data Processing Policy. What happens to the data of your matters on termination is stated in Section 4 (k). ## 6. Limitation of Liability – Third-Party Services and Judicial Integrations {#section6} To the maximum extent permitted by law, Custodio Legal is not liable for indirect, incidental, special, consequential or punitive damages. Our total liability does not exceed the amount you paid in the preceding twelve (12) months. These limitations do not apply in cases of willful misconduct or gross negligence, or where applicable law expressly prohibits them. **CRITICAL DISCLAIMER – THIRD-PARTY JUDICIAL APIs**: Custodio Legal acts as a technology intermediary that queries information systems operated by third parties, such as the Colombian Judicial Branch (Tyba, SAMAI), the Superior Council of the Judicature, the Ecuadorian Judicial Branch (eSATJE/Manticore), the Poder Judicial de Costa Rica (Sistema de Gestión en Línea and Archivo Judicial), the Poder Judicial del Uruguay (case file lookup by IUE and hearings lookup), the public case-file lookups of the judiciaries of the City of Buenos Aires, Catamarca, Mendoza and Salta in Argentina — the federal judiciary and the Province of Buenos Aires are out of scope, and the Argentine annex says why — and the public case-file lookups of the e-SAJ of the Tribunal de Justiça de São Paulo, the Tribunal de Justiça do Amazonas and the Tribunal de Justiça do Acre in Brazil, where coverage is per court and not per country, and where neither the Conselho Nacional de Justiça’s DataJud nor the Diário de Justiça Eletrônico Nacional is queried, as the Brazilian annex explains. Those systems are operated by independent governmental entities. Custodio Legal does NOT and CANNOT guarantee: - (i) The continuous availability of such governmental APIs; - (ii) The accuracy, completeness or timeliness of information published by those entities; - (iii) The response times of judicial systems; - (iv) That judicial statuses and updates are reflected in real time. Accordingly, Custodio Legal is NOT liable for: - (a) Expiration of procedural deadlines due to failures or unavailability of third-party judicial systems; - (b) Errors in official information published by governmental entities; - (c) Changes in governmental API structures or interfaces that temporarily affect the Service. **Looking up a court record with no account.** When the site offers looking up a court record by its number to someone with no account, everything stated in this Section applies to it in full, with three further points. First: that lookup **is not an official source and does not replace the judiciary's portal**; what it returns is what the portal answered at that moment, trimmed, and the official source remains the portal. Second: **we do not promise that a case file will appear**, nor that what is shown is up to date. Third, and this is the one that changes with the country, so it is named: the lookup of the Poder Judicial del Uruguay **runs one (1) business day behind and does not cover criminal matters**, and Costa Rica's answers from the **Archivo Judicial** and not from the live docket. Custodio Legal is not liable for a decision taken on what that lookup shows without checking it against the portal. You are responsible for verifying critical procedural information directly with official sources and for meeting the procedural deadlines established by law. Do not rely exclusively on the system's automated notifications for the computation of legal deadlines. ## 7. Governing Law {#section7} The Service is offered in Argentina, in Brazil, in Colombia, in Costa Rica, in Ecuador, in the Dominican Republic and in Uruguay. These Terms are governed by the law of the country where the Firm is domiciled, and that country's annex declares it by name, together with the personal data protection legislation that applies to it and that country's consumer protection rule. This is a professional contract: those consumer rules apply insofar as they admit no agreement to the contrary and insofar as these Terms expressly grant them to you, such as the right in Section 3A. ## 8. Age and Capacity Requirements {#section8} The Service is designed for law firms and legal professionals. By using it you declare that you are at least eighteen (18) years old or the age of majority in your country and have the capacity to contract. We do not open accounts for minors. The data of children and adolescents a case file may contain reach the platform inside the matter your firm manages, and are processed under Section 4 (e): it is the Firm, as controller, that must hold the authorization the law requires for them. ## 9. Service Description, Confidentiality and Support Access {#section9} Custodio Legal is a legal practice management platform: management of judicial and extrajudicial matters, parties, documents with extracted text, notes, agenda and deadlines, surveillance of the judicial records and the judicial publications of your country according to the plan, Artificial Intelligence features under Section 21, access through the API on the plans that include it and the connection of MCP clients on every plan with an active subscription, under Section 22, which says which part of that connection depends on the plan. The originals you upload are processed transiently to extract their content; we keep the extracted text and the matter's metadata, not the file. We reserve the right to modify, suspend or discontinue features with thirty (30) days' prior notice. **Confidentiality of the case file.** We know that what you manage in the Service is covered by the attorney's professional secrecy: Article 28, paragraph 9, of Colombia's Law 1123 of 2007; the Código Orgánico de la Función Judicial in Ecuador; Article 19 of the Code of Ethics of the Bar Association of the Dominican Republic, ratified by Decree núm. 1290 of 1983, which extends professional secrecy to matters known «por intermedio de empleados o dependientes»; Article 41 of Costa Rica's Código de Deberes Jurídicos, Morales y Éticos del Profesional en Derecho, which requires the attorney to warn «a su personal de apoyo de la confidencialidad de los asuntos» and of the «deber de reserva que los cobija»; in Uruguay, Article 11 of Ley N° 18.331, which binds to the professional secrecy of Article 302 of the Código Penal anyone taking part in any phase of the processing, and keeps that duty after the relationship ends; in Argentina, Article 10 of Ley 25.326, which binds to professional secrecy anyone taking part in any phase of the processing and makes that duty subsist «aun después de finalizada» the relationship with the holder of the data file; and, in Brazil, Article 7º, II of Lei nº 8.906, de 4 de julho de 1994 (Estatuto da Advocacia e a OAB), which declares the attorney’s working instruments and electronic correspondence inviolable, and Article 34, VII of that same law, which makes breaking professional secrecy a disciplinary offence. All our staff are bound to confidentiality over the content of your matters, and access to the Service is separated by firm: no firm sees another's data. **Support access.** Our staff **do not enter your account or your case files with your identity**. The Service has no feature that lets them sign in as you, see your screens as if they were you, or act on your behalf. Support is provided with the information you share with us —what you write to us, the screenshots you send, what we reproduce in our own environment— and with operational logs that contain none of the content of your matters. What we can do, and we would rather state it precisely: at your firm's request, or to serve a portability request, we can generate a copy of your firm's data —the account, the users, the matters and their sources— and hand it to you. That act is recorded in **your own firm's** audit log, with who performed it and when, and is visible to you inside the Service. **Availability.** We work toward a monthly availability **target** of 99.5%. It is a service target, not a guarantee: we publish the Service's status and the incidents that affect it, and we give advance notice of scheduled maintenance, which falls outside that calculation. We agree to no credit, discount or liquidated compensation for missing that figure. None of this curtails the rights the law grants you in the event of serious breach, nor does it affect what Sections 6 and 14 expressly preserve in cases of wilful misconduct or gross negligence, nor the claims channel of Section 19. ## 10. Personal Data Protection {#section10} The processing of your personal data as a user is governed by our Personal Data Processing Policy; by accepting these Terms you also accept it and grant the authorization it describes. The processing of third parties' personal data that live in your matters is governed by Section 4. We comply with the data protection legislation of the seven countries where we offer the Service: Ley 25.326 and its Decreto 1558/2001 in Argentina, Lei nº 13.709/2018 (LGPD) in Brazil, Law 1581 of 2012 and Decree 1377 of 2013 in Colombia, Ley N° 8968 and its Reglamento (Decreto Ejecutivo N° 37554-JP) in Costa Rica, the LOPDP and its Regulation in Ecuador, Ley núm. 172-13 in the Dominican Republic, and Ley N° 18.331 and its amending Ley N° 19.670 in Uruguay. ## 11. Firm Obligations {#section11} You agree to: - (a) Provide truthful and updated information. - (b) Not use the Service for illegal or unauthorized purposes. - (c) Not attempt to access systems or data of other firms without authorization. - (d) Not reproduce, duplicate, copy, sell or resell the Service without written authorization. - (e) Keep the confidentiality of your access credentials and notify us immediately of any unauthorized use. - (f) Hold the authorization of the data subjects whose data you upload to your matters, under Section 4 (e). - (g) Answer for the members you invite to your firm and for the MCP clients you authorize, under Section 22. ## 12. Billing, Automatic Renewal and Cancellation {#section12} Subscriptions are billed in advance, for monthly periods, according to the selected plan. Each plan is billed in the currency your country's annex declares and the pricing page publishes for it; absent an annex, in United States dollars. The price of each plan is the one published on that page and the one you see on the payment screen before confirming the purchase. **The subscription renews automatically** at the end of each period for an equal period and at the price in force, unless you cancel it before. You may cancel it at any time from 'My practice > My plan', which takes you to our payment provider's portal; the cancellation takes effect at the end of the period already paid and until then you keep access to the plan. Apart from the withdrawal right of Section 3A there is no refund of the current period. Prices may change with thirty (30) days' prior notice; the new price applies from the next billing period, and if you disagree you may cancel before it takes effect. Non-payment may lead to suspension of the Service after a ten (10) day grace period. You have the right to an electronic invoice under the tax legislation of your country. **The prices we publish are net of taxes.** The price of your plan and that of any top-up do not include the taxes, withholdings or advance collections that the law of your country imposes on the transaction or on the payment. If that law requires you to withhold or collect a tax on what you pay us, that burden is yours and does not reduce what you owe for the Service. If you need a tax residence certificate from us in order to apply a double taxation treaty, request it at support@custodio.legal. ## 13. Warranties and Exclusions {#section13} We provide the Service with reasonable diligence. Apart from the express warranties in these Terms, the Service is provided 'as is', without implied warranties of merchantability or fitness for a particular purpose, to the extent the law admits. We do not guarantee that the Service will be uninterrupted or error-free. These exclusions do not affect the rights the law grants you without admitting agreement to the contrary. ## 14. Indemnification {#section14} You agree to indemnify and hold harmless Custodio Legal from any claim arising from: - (a) Your use of the Service in violation of these Terms. - (b) Content you upload that infringes third-party rights. - (c) Illegal activities conducted through your account. - (d) The processing of third parties' personal data in your matters without the authorization or legal basis Section 4 (e) requires of you. This obligation does not apply in cases of our willful misconduct or gross negligence, nor does it limit the rights the law grants you without admitting agreement to the contrary. ## 15. Modifications to Terms {#section15} We may modify these Terms. We notify you of substantial changes by email and/or through a prominent notice on the platform at least thirty (30) days in advance. Continued use of the Service after the effective date constitutes acceptance of the modified Terms. If you do not accept the changes, you may cancel your account before they take effect. The version of these Terms in force is 0.0.29, effective as of October 30, 2026. Version 0.0.29 adds to Section 4 (g) a paragraph saying why Microsoft is not on the list of sub-processors: the product makes a single use of it, sign-in with a Microsoft account, and in it it is an independent controller, as Section 15 (iii) of the Personal Data Processing Policy explains in its version 0.0.35. No sub-processor is added, so the thirty (30) days' notice of that point does not run. No price, none of your rights, none of our obligations, no sub-processor, no counterparty and no annex change; that is why **we do not ask you to accept it again**: if you already accepted 0.0.24, 0.0.25, 0.0.26, 0.0.27 or 0.0.28, that acceptance covers this version. The new authorization is asked for by the Personal Data Processing Policy 0.0.35, on the same screen. It replaces 0.0.28, effective October 15, 2026. Version 0.0.28 corrects, in Section 4 (g), the status of Oracle America, Inc.: the network exit through which the queries of firms whose country is Brazil go out to the Diário de Justiça Eletrônico Nacional is active since October 14, 2026; 0.0.27 said «registered and with no traffic». The thirty (30) days' notice that point asks for before a new sub-processor receives data from your matters had no addressees: that day no firm in Brazil was active, and whoever signed up since then accepted 0.0.27, which already named it. No price, none of your rights, none of our obligations, no sub-processor, no counterparty and no annex change; that is why **we do not ask you to accept it again**: if you already accepted 0.0.24, 0.0.25, 0.0.26 or 0.0.27, that acceptance covers this version. It replaces 0.0.27, effective October 14, 2026. Version 0.0.27 adds to the list of sub-processors in Section 4 (g) Oracle America, Inc., which operates in São Paulo (Brazil) the network exit through which the queries of firms whose country is Brazil would go out to the Diário de Justiça Eletrônico Nacional; it then received no data. A new sub-processor is exactly what that point governs: we give you thirty (30) days' notice before it receives data from your matters, and you may terminate the contract without penalty if you disagree. No price, none of your rights, no other obligation of ours, no counterparty and no annex change; that is why **we do not ask you to accept it again**: if you already accepted 0.0.24, 0.0.25 or 0.0.26, that acceptance covers this version, and the new authorization over the processing is asked for by the Personal Data Processing Policy in its version 0.0.32. It replaces 0.0.26, effective October 11, 2026. Version 0.0.26 corrects Section 22 (a), which said that no tool of an MCP client can write without a person's approval: as of this version the client may also ask for a lookup in the public judicial portal of your country by a filing number or by a party, the same one the screen for opening a matter makes, and that lookup is recorded without approval, as a lookup that expires after two (2) hours and not as data of your firm. The rule that protects your data does not change: no tool writes your firm's data without a person's approval. No price, none of your rights, none of our obligations, no sub-processor, no counterparty and no annex change; that is why **we do not ask you to accept it again**: if you already accepted 0.0.24 or 0.0.25, that acceptance covers this version. It replaces 0.0.25, effective October 11, 2026. Version 0.0.25 makes precise, in Sections 9 and 22, which part of the MCP client channel depends on the plan: connecting a client and reading through it is on every plan with an active subscription, and preparing actions —the opening of a new matter included, which a person of the firm signs— is on Pro, Max and Teams, as the pricing page publishes. No price, none of your rights, none of our obligations and no sub-processor change, nor does the rule that nothing is written without a person's approval, and no annex moves; that is why **we do not ask you to accept it again**: if you already accepted 0.0.24, that acceptance covers this version. It replaces 0.0.24, effective October 7, 2026. Version 0.0.24 changes who your counterparty is: up to the previous version the Service was provided by the natural person who then owned the Custodio Legal brand, and from this version it is provided by PENTEVARK S.A.S., a Colombian simplified stock company identified with NIT 902.114.276-8, which succeeds that person in the contracts entered into under these Terms, with the same domicile, the same email and the same phone number. No price, none of your rights, none of our obligations and no sub-processor change; but because your counterparty changes, **we ask you to accept this version expressly** the next time you enter the platform, on the same screen where your data-processing authorization is renewed, and your acceptance is recorded with its version. It replaces 0.0.23, effective October 1, 2026. Version 0.0.23 corrects Section 4 (g), which said that measurement with Google Analytics 4 never runs on the application's screens: as of this version it runs on one, the instant an account is created, with a single sign-up event and under the consent of the cookie notice, as the Personal Data Processing Policy describes in its version 0.0.27. Google still receives no data of your matters; no new sub-processor is appointed, and none of your rights and none of our obligations change. It replaces 0.0.22, effective September 24, 2026. Version 0.0.22 removes Voyage AI from the list of sub-processors in Section 4 (g) and from Section 21 (f): as of that date the vector representations (embeddings) of the text of your documents are computed by Nebius B.V., which was already on that list for text generation, with a model that runs in the European Union and under the same Zero Data Retention. No new sub-processor is appointed, so the thirty (30) day notice of Section 4 (g) does not run; the change of who processes that text and where is what the Personal Data Processing Policy, in its version 0.0.26, asks you to authorize again. None of your rights and none of our obligations change, and no annex moves. It replaces 0.0.21, effective September 23, 2026. Version 0.0.21 corrects Section 4 (g), which said that Google acts as an independent controller "in the two uses the product makes of it": since that same date the product makes a third, the measurement of the public site with Google Analytics 4, in which Google acts as our processor. The clause now names the three uses and Google's role in each, and refers to Section 10 (ix) of the Personal Data Processing Policy and to Section 4 of the Cookie Policy. Google still processes no data of your matters; no right of yours and no obligation of ours changes, and no annex moves. It replaces 0.0.20, effective September 19, 2026. Version 0.0.20 adds to Section 6 what the lookup of a court record by its number —offered by the site to someone with no account— does **not** promise: that it is not an official source, that it does not replace the judiciary's portal, that it does not guarantee that a case file will appear or that what is shown is up to date, and with what reach each portal answers —Uruguay's runs one (1) business day behind and does not cover criminal matters, and Costa Rica's answers from the Archivo Judicial and not from the live docket. No right of yours and no obligation of ours changes, and no annex moves: what the text gains is the limit of a feature, written before it is turned on. It replaces 0.0.19, effective September 16, 2026. Version 0.0.19 corrects Section 21, which listed the matter summary and the deep analysis among the Artificial Intelligence features, and the Service no longer runs them: the list now names document drafting, questions with citations, and the matter state with the facts extracted from its documents, and item (f) stops referring to the summary and the analysis. No right of yours and no obligation of ours changes, and no annex moves. It replaces 0.0.18, of September 16, 2026. Version 0.0.18 corrects Section 20, which said that an English version of these Terms is also published: since September 16, 2026 a Portuguese one is published as well, and the clause now names both. The Spanish version, in which these Terms are executed, still prevails. No right of yours and no obligation of ours changes, and no annex moves. It replaces 0.0.17, of September 16, 2026. Version 0.0.17 adds Brazil: the Service is now offered in seven countries, Section 3A states that there the term we grant is longer than the seven days of Article 49 of the Código de Defesa do Consumidor and that these Terms do not claim that law reaches you, and that we reserve no exception either; Section 4 (b) states that the processing-on-behalf is additionally documented in Annex II of Resolução CD/ANPD nº 19/2024 reproduced whole and unaltered; the disclaimer of Section 6 and the force majeure of Section 14 name the three public case-file lookups of the measured Brazilian e-SAJ and state that neither DataJud nor the Diário de Justiça Eletrônico Nacional is queried; Section 9 names Articles 7º, II and 34, VII of Lei nº 8.906/1994; Section 10 names the LGPD among the rules we comply with; and Section 15 states that in Brazil we designate no arbitration centre either —Clause 24 of that Annex II submits the dispute to the Brazilian courts and Article 16, § 2º forbids contradicting it— and adds the ANPD to the authorities you may complain to. No right of yours and no obligation of ours changes in the other six countries, and no annex moves. It replaces 0.0.16, of September 13, 2026. Version 0.0.16 adds Argentina: the Service is now offered in six countries, Section 3A states that there the right of withdrawal is not one we grant —it is given by Article 34 of Ley 24.240 and Article 1110 of the Código Civil y Comercial, which declare it non-waivable— and that we therefore reserve no exception, Section 4 (b) states that the processing-on-behalf is additionally documented in Annex II of Disposición DNPDP 60-E/2016 reproduced as it stands, the disclaimer of Section 6 and the force majeure of Section 14 name the four Argentine judicial lookups and the two that are out of scope, Section 9 names Article 10 of Ley 25.326, Section 10 names it among the rules we comply with, and Section 15 states that in Argentina we designate no arbitration centre either —Article 1109 of the Código Civil y Comercial holds a prorogation of jurisdiction against a consumer to be unwritten— and adds the AAIP to the authorities you can complain to. No right of yours and no obligation of ours changes in the other five countries, and no annex moves. It replaces 0.0.15, of September 12, 2026. Version 0.0.15 adds Uruguay: the Service is now offered in five countries, Section 1 names Article 4 of Ley N° 18.600 for the evidentiary value of your acceptance, Section 3A notes the exception to withdrawal that applies there —that of Article 16-BIS, paragraph H), of Ley N° 17.250—, Section 4 (b) says what Article 30 of Ley N° 18.331 presupposes and where the data processing agreement lives, the disclaimer of Section 6 and the force majeure of Section 14 name the two Uruguayan judicial sources, Section 9 names Article 11 of that same law, Section 10 names it among the rules we comply with, and Section 15 states that in Uruguay we designate no arbitration centre and adds the URCDP to the authorities you can complain to. No right of yours and no obligation of ours changes in the other four countries, and no annex moves. It replaces 0.0.14, of September 12, 2026. Version 0.0.14 states in Section 12 that the prices we publish are net of taxes: the withholdings and advance collections that the law of your country imposes on the payment are yours to bear and do not reduce what you owe for the Service, and if you need our tax residence certificate in order to apply a double taxation treaty you request it through support. Neither your plan's price nor the currency you are charged in changes with this version, and no annex moves. It replaces 0.0.13, of September 11, 2026. Version 0.0.13 adds to Section 2 the declaration of the firm's tax identification number —the NIT, the RUC, the RNC or the cédula, and the cédula jurídica or física, depending on your country—, which you may give when you open your practice and which we ask for before you subscribe to a paid plan, and states that its accuracy is yours because the tax treatment of the transaction depends on it. No right of yours shrinks and no annex moves. It replaces 0.0.12, of September 10, 2026, which named the AI consumption of Section 21 with the same unit the pricing page sells —the AI credit— and published the equivalence that makes it verifiable, without moving any figure of the allowance. It replaces 0.0.11, of September 10, 2026. Version 0.0.11 corrects four clauses that claimed more about us than the Service does, and none of the four widens what you grant. Section 4 (a) no longer asks you for a license to **store** your content: it asks for the one that matches what actually happens -to process it, display it and keep the extracted text and its provenance- because the original file is not kept, which is what Section 10 of the Personal Data Processing Policy and the security page already said. Section 4 (g) **takes Google out of the sub-processor list**: it does not process data of your matters on our behalf and we hold no processor agreement with it, as version 0.0.7 of that Policy corrected a day ago, and refers to its Section 15; in the same list, Sentry stops being described as «without personal data» and says what it receives: the path of the error and your internal user identifier, with no email, name or IP address. Section 4 (k) stops asserting as a fact of our own that the text generation provider does not store what we send it, and attributes it to what that provider publishes, on the terms of Section 21 (h). And Section 21 (f) narrows the Standard Contractual Clauses to the **text generation provider**, the only one whose agreement incorporates them, and names the destination as the Policy names it: the European Union, Israel or the United States. No right of yours shrinks and no annex moves. It replaces 0.0.10, of September 10, 2026. Version 0.0.10 completes with the Dominican and Costa Rican rules four lines that enumerated only two countries from before there was a third: Section 1 names Article 9 of Ley núm. 126-02 and Article 4 of Ley N° 8454 for the evidentiary value of your acceptance; Section 4 (b) names Article 30 of the Reglamento to Ley N° 8968 and says that Ley núm. 172-13 defines the processor but does not require the contract, so in that country this section holds by agreement between the parties; Section 9 names Article 19 of the Dominican Code of Ethics and Article 41 of the Costa Rican Código de Deberes; and Section 15 adds the two arbitration venues of those countries. No right of yours and no obligation of ours changes, in any of the four countries, and no annex moves. It replaces 0.0.9, of 10 September 2026. Version 0.0.9 adds Costa Rica: the Service is now offered in four countries, Section 7 and Section 10 also name Ley N° 8968 and its Reglamento, the disclaimer of Section 6 and the force majeure of Section 14 name the two Costa Rican judicial sources —the Sistema de Gestión en Línea and the Archivo Judicial of the Poder Judicial de Costa Rica— and Section 3A notes the exception to withdrawal that applies there, article 73 of the Reglamento to Ley N° 7472. No right of yours and no obligation of ours changes in the other three countries, and no annex moves. It replaces 0.0.8, of 9 September 2026. Version 0.0.8 changes no right of yours and no obligation of ours: it splits the same text between this trunk and your country's annex. The withdrawal right of Section 3A, the governing law of Section 7, the incident notice term of Section 4 (j) and the transfer safeguard of Section 21 (f) were stated twice, once here with the rules of two countries —the Dominican Republic appeared only in its annex— and once in each country's annex. The trunk now states what held the same in the three countries offered at the time and refers to the annex, and the annex states your country's term, rule and legal minimum. The fifteen (15) calendar days to withdraw and the fifteen for us to refund you are still the same. It replaces 0.0.7, of 9 September 2026, which took the currencies out of the trunk: the general rule of Section 12 no longer says that Colombia pays in pesos and everyone else in dollars -which stopped being true when the Dominican Republic began billing in Dominican pesos- but that each plan is billed in the currency your country's annex declares, and in United States dollars where there is no annex. For the same reason Section 22 (c) no longer quotes per-country top-up figures: the minimum amount and how many AI credits each unit of your currency buys are published on the pricing page and shown on the top-up screen before you pay. Neither the currency you are charged in nor your plan's price changes with this version. It replaces 0.0.6, of September 2026, 0.0.5, 0.0.4 and 0.0.3, of September 2026, 0.0.2, of August 2026, and 0.0.1, of February 2026. Version 0.0.6 withdrew support access through an impersonation session —our staff can no longer enter your account with your identity, because that feature no longer exists in the Service—, states precisely the only support act that reaches the content of your matters (the copy of your firm's data, audited under your own firm and visible to you), and declares the 99.5% monthly availability as a service target rather than a guarantee, with no credit or liquidated compensation and without curtailing the rights the law grants you. Version 0.0.5 declared the professional nature of the contract, identified the party, granted the withdrawal right, incorporated the processing-on-behalf conditions of Section 4, corrected the allowances and prices, left arbitration to your choice and withdrew the one-year period to claim. Each version applies until the next one replaces it, and the one you accepted is recorded under Section 1. ## 16. Dispute Resolution {#section16} We first try to resolve any dispute directly, within thirty (30) days after one party communicates it in writing to the other. If we do not succeed, **you choose** between going to the ordinary courts of your domicile or submitting the dispute to arbitration: in Colombia, before the Arbitration and Conciliation Center of the Bogotá Chamber of Commerce, under Law 1563 of 2012; in Ecuador, before the Mediation and Arbitration Center of the Quito Chamber of Commerce, under the Arbitration and Mediation Law; in the Dominican Republic, before the Corte de Arbitraje y Resolución Alternativa de Conflictos (CRC) of the Cámara de Comercio y Producción de Santo Domingo, under Ley núm. 489-08 on commercial arbitration, whose Article 2 admits arbitration of disputes «sobre materias de libre disposición y transacción»; in Costa Rica, before the Centro de Conciliación y Arbitraje of the Cámara de Comercio de Costa Rica, under Ley N° 8937, the Ley de Arbitraje, and Article 2 of Ley N° 7727, which recognises the right to resort to arbitration for «diferencias patrimoniales de naturaleza disponible». **In Uruguay we designate no arbitration centre**: the Uruguayan annex submits disputes to the Uruguayan courts, and we do not name a centre we have not checked. **In Brazil we designate none either, and there the reason is the hardest of the three**: the data processing agreement adopts the cláusulas-padrão contratuais of Annex II of Resolução CD/ANPD nº 19/2024, whose Clause 24.1 submits any dispute to the competent courts of Brazil, whose 24.2 lets the data subject sue before the court of their own residence and whose 24.3 admits only arbitration seated in Brazil; Article 16, § 2º of that resolution forbids any other provision of our contracts from excluding, modifying or contradicting them «direta ou indiretamente», so an arbitration seat outside Brazil would not merely be unenforceable: it would void the international transfer entirely. **In Argentina we designate none either**, and there a rule adds a reason: the Argentine annex submits disputes to the Argentine courts, and Article 1109 of the Código Civil y Comercial holds a prorogation-of-jurisdiction clause against a consumer to be unwritten, so a forum clause would not bind you even if you signed it. Arbitration is never mandatory for you. None of this limits your right to file complaints with the Superintendence of Industry and Commerce (SIC) in Colombia, with the People's Ombudsman or the Personal Data Protection Superintendency (SPDP) in Ecuador, with the Unidad Reguladora y de Control de Datos Personales (URCDP) in Uruguay, with the Agencia de Acceso a la Información Pública (AAIP) in Argentina, with the Agência Nacional de Proteção de Dados (ANPD) in Brazil, or with the competent authority of your country. ## 17. Software Platform — Not Legal Advice {#section17} Custodio Legal is a software platform designed to automate administrative and document management tasks in law firms. The use of the platform, its judicial tracking features, document generation, synchronization with governmental APIs, deadline computation or any other feature does NOT constitute, under any circumstances, legal advice, legal representation, professional attorney counsel or an attorney-client relationship. Procedural, substantive and strategic decisions are the exclusive responsibility of the legal professional using the platform. Custodio Legal assumes no fiduciary duty and no liability arising from your legal decisions. No automation of the platform replaces the attorney's professional judgment. ## 18. Force Majeure {#section18} Custodio Legal is not liable for failures or delays in the provision of the Service caused by circumstances beyond its reasonable control, including without limitation: - (a) Failures, interruptions, unscheduled maintenance or unilateral changes in the technology systems of governmental entities (including the Colombian Judicial Branch, SAMAI, Tyba, Ecuador's Judicial Branch (eSATJE/Manticore), the Poder Judicial de Costa Rica (Sistema de Gestión en Línea and Archivo Judicial), the Poder Judicial del Uruguay (case file lookup by IUE and hearings lookup), the public case-file lookups of the judiciaries of the City of Buenos Aires, Catamarca, Mendoza and Salta in Argentina, and the public case-file lookups of the e-SAJ of the Tribunal de Justiça de São Paulo, the Tribunal de Justiça do Amazonas and the Tribunal de Justiça do Acre in Brazil); - (b) Natural disasters, pandemics, acts of terrorism or war; - (c) Power, internet or telecommunications infrastructure failures affecting cloud service providers; - (d) Changes in legislation or regulation requiring technical modifications to the platform; - (e) Cyberattacks by third parties on our providers' infrastructure. If a force majeure event lasts more than thirty (30) calendar days, you may suspend your subscription without penalty until the Service is restored. ## 19. Claims {#section19} You may submit any claim about the Service or these Terms to support@custodio.legal. We answer within the following fifteen (15) business days. The time limits for bringing legal actions are those set by applicable law; these Terms do not shorten them. ## 20. General Provisions {#section20} If any provision of these Terms is found invalid or unenforceable, the remaining provisions remain in effect with the minimum adjustments necessary to preserve the intent of the parties. These Terms, together with the Personal Data Processing Policy and the Cookie Policy, are the entire agreement between the parties regarding the Service and supersede any prior agreement, oral or written. Failure to exercise a right does not imply its waiver. No oral representation by employees or agents of Custodio Legal constitutes a warranty or a condition of the contract. These Terms are executed in Spanish; the English and Portuguese versions are published for your convenience and, in case of conflict, the Spanish version prevails. For inquiries: support@custodio.legal. ## 21. Use of Artificial Intelligence (AI) {#section21} Custodio Legal includes Artificial Intelligence features (currently: document drafting, questions with citations over your documents, and the matter state with the facts extracted from its documents), optional and subject to the following conditions: - (a) NATURE OF OUTPUT: AI-generated results are administrative support material. They are NOT, under any circumstances, legal advice, professional opinion or a substitute for the attorney's judgment (reinforcing Section 17). - (b) VERIFICATION OBLIGATION: You are responsible for reviewing, validating and verifying every AI output before using it in any professional, contractual or procedural action. AI may produce errors, omissions, inaccuracies or incorrect statements ('hallucinations'). - (c) MONTHLY AI CREDIT ALLOWANCE: AI features are consumed against a monthly allowance of AI credits included in your plan: 750,000 on Free, 5,250,000 on Solo, 12,000,000 on Pro, 22,500,000 on Max and 12,000,000 per seat on Teams, which is contracted from two (2) seats. **One AI credit equals one (1) equivalent token of the provider**, which is the unit the Service measures consumption in and the one you see on the pricing page and in the application. The equivalent token is not the provider's raw token: an operation executed on a more expensive model draws it down in proportion to that model's public rate, so the same allowance goes further on lighter models than on heavier ones. The allowance renews with each calendar month, and what you do not consume in one month does not roll over to the next. Once it runs out, AI stops: there is no automatic overage charge and no consumption beyond the allowance. To keep using AI within the same month you may buy a pay-what-you-want top-up, charged in the same currency your subscription is billed in (Section 12). The minimum amount and how many AI credits each unit of that currency buys are published on the pricing page, currency by currency, and you see them on the top-up screen with the total in AI credits before paying; that is the rate in force. Purchased AI credits do not expire and carry over from one month to the next until they are spent. AI credits consumed by already-executed operations are non-refundable, except for a verified failure attributable to Custodio Legal. - (d) LIMITS AND RATE LIMITING: We may apply reasonable usage limits to prevent abuse, protect the stability of the Service and control infrastructure costs. Those limits are communicated on the pricing page or in the AI settings. - (e) PROHIBITED USES: You agree NOT to use the AI features to: (i) generate illegal, defamatory, discriminatory content or content that infringes third-party rights; (ii) process third parties' personal data without valid authorization from the data subject or an applicable legal basis; (iii) attempt to extract, re-identify or reverse-engineer information about other firms or the model; (iv) automate mass submissions, scraping or evasion of usage limits; (v) generate documents intended to deceive judicial or administrative authorities. Non-compliance may result in immediate suspension of AI access and, in serious cases, termination of the account under Section 5. - (f) DATA SENT TO PROVIDER: By executing an AI operation, you expressly authorize the international transfer of the necessary data to our AI providers under the conditions described in the Personal Data Processing Policy (Sections 9, 10 and 14). Today text generation is provided by Nebius B.V., a company domiciled in Schiphol, the Netherlands, which operates the Nebius Token Factory service; embeddings are provided by the same provider, through the same service; and Anthropic (United States) and JINGSHENG HENGXING TECHNOLOGY PTE. LTD. (Singapore, the z.ai service) are registered as alternate text generation providers that receive none of your data today. The provider declares that it runs inference in the European Union, in Israel or in the United States depending on the model; which safeguard backs each of those destinations under your own law is stated by your country's privacy annex. **Towards the text generation provider**, and only towards it, the transfer further relies on the Standard Contractual Clauses its data processing agreement incorporates and on this authorization of yours; the other destinations of Section 4 (g) rely on whatever your country's annex declares, which for two of them says expressly that the Clauses are not the basis. If we change the text generation provider or the jurisdiction your data are transferred to, we raise the version of the Personal Data Processing Policy and ask you for a new authorization before continuing. For the drafting we do not send file attachments; for the questions with citations (Q&A) we do send the content of the documents of the selected matter. We never send data from matters other than the selected one. - (g) AVAILABILITY: AI features depend on third-party services. Custodio Legal does not guarantee uninterrupted availability and is not liable for outages, model changes or price changes by such providers that temporarily impact the Service. In case of extended unavailability (more than 72 continuous hours), we grant AI credits for the portion of the monthly allowance the outage prevented you from using. - (h) NO-RETRAINING CLAUSE: We have Zero Data Retention enabled on our organization with the text generation provider as of 4 September 2026. According to what it publishes, with that option your inputs and outputs are not stored after each request is processed, are not used for speculative decoding, and are not used to train, fine-tune or improve any model. It is a statement published by the provider and not a control we have audited; it operates going forward and not over submissions made before that date, to which the default processing of its terms of service applied; and its published documents do not say whether it reaches abuse-detection records or responses delivered as a stream. The embeddings provider applies the opt-out we have active, which prevents it from using your content to train future models. The Personal Data Processing Policy (Section 14 (iii) and (iv)) says so in the same detail, and with the same caveat: we hold no separately signed contract today and no certifications audited by us, only the instruments the provider itself publishes and incorporates into its terms. - (i) FEATURE EVOLUTION: AI features may change, expand or be retired. We notify material changes at least thirty (30) days in advance. - (j) WARRANTY EXCLUSION: To the maximum extent permitted by law, AI features are provided 'as is', without warranty of accuracy, fitness or freedom from errors. Responsibility for using the outputs lies solely with the Firm. ## 22. MCP Clients and OAuth Access {#section22} On every plan with an active subscription —Free and Solo included—, your firm may authorize an Artificial Intelligence client compatible with the MCP protocol to connect to the Service through OAuth 2.1, with the consent an authorized member of the firm grants on the authorization screen. What depends on the plan is what that client can do: on every plan it reads the firm's information that the person who authorized it can see and, where the Service offers that lookup in your country, looks up the public judicial portal by a filing number or by a party, as the screen for opening a matter does; **preparing actions** —a draft, a follow-up, a task or the opening of a new matter— is included in Pro, Max and Teams, as the pricing page publishes. Without an active subscription the client can neither connect nor use the channel. The conditions are these: (a) the client reads information, looks up the public judicial sources the Service offers in your country and, on the plans that include it, prepares actions; every action that modifies your firm's data —the opening of a matter included— requires a person to approve it within the Service session, and no tool can write your firm's data without that approval. A lookup in a public judicial source that the client asks for is recorded as a lookup, like the one made from the screen for opening a matter: it is not incorporated into any matter, it does not count as a matter of your plan and it is deleted when it expires, after two (2) hours; what the portal answers enters your firm's data only when a person incorporates it or approves the action that incorporates it; (b) the Firm answers for the clients it authorizes, for what that client does with the data it reads, and for the model providers that client uses, which are not sub-processors of ours; (c) the client may revoke its credentials at any time through the protocol's revocation endpoint, and you may ask us in writing at support@custodio.legal to revoke the authorization of any client, which we attend without delay; (d) Sections 17 and 21 apply to everything an MCP client produces with data from the Service.