Terms of Service
Effective date: 23 September 2026
These Terms govern your use of Kaja, a free account-based web service operated by Andras Serfozo, an individual based in England, United Kingdom, as a personal project.
Contact: subztep@gmail.com
Acceptance
By creating an account or using Kaja, you agree to these Terms. If you do not agree, do not use the service.
The Service
Kaja is an AI assistant. These Terms cover the cloud service — the API, the website, cloud terminal chat, the Kaja Telegram bot, and the embeddable website widget — which is currently offered for free.
Kaja is also open-source software you can run entirely on your own machine. Running it locally is governed by its licence, not by these Terms, and needs no account.
Kaja may change, suspend, or discontinue any part of the cloud service at any time. If a change materially affects users, reasonable notice will be provided where practical.
AI Output
Kaja’s replies are generated by language models. They can be wrong, incomplete, or misleading, and they are not professional advice — medical, legal, financial, or otherwise. Check anything that matters before you rely on it.
Kaja can run tools on your behalf, including shell commands when you approve them locally. You are responsible for what you approve; the confirmation prompt and its warnings are an advisory cue, not a safety guarantee.
Abilities you turn on can call outside services (for example a weather API or a documentation search). Those services are run by third parties, not by Kaja, and their own terms apply to what they receive and return.
Widgets
If you embed a Kaja widget on a site you operate, conversations from your visitors are stored against your account, and you are responsible for telling your visitors that the chat is powered by an AI assistant and for having a lawful basis to process what they type. Keep your widget key’s allowed-origins list limited to sites you control.
Data Processing For Widgets
When you create a widget key, you are the controller of your visitors’ personal data and Kaja is your processor. These terms are the contract Article 28 of the UK GDPR (and EU GDPR) requires between you and Kaja, and they apply automatically whenever you use a widget.
- What is processed: what your visitors type into the widget, the assistant’s replies and tool calls, memory notes and dataset answers made during those conversations, and a random visitor id. The visitors are the data subjects.
- Purpose and duration: only to run the widget chat on your site, for as long as your widget key or your account exists.
- Your instructions: Kaja processes this data only as your widget configuration (persona, skills, allowed origins) and these Terms direct, unless the law requires otherwise; Kaja will tell you if it believes an instruction breaks data protection law.
- Confidentiality and security: only the operator has access to it, and it is protected by the measures described in the Privacy Policy.
- Sub-processors: you authorise the providers listed under “Sharing Data” in the Privacy Policy. Kaja will update that list before adding or replacing one, and you can object by email or stop using widgets. Kaja passes these same data protection obligations on to them.
- Transfers: data leaves the UK and EU only as described under “International Transfers” in the Privacy Policy.
- Helping you: Kaja will help you answer your visitors’ requests to exercise their rights, and with any data protection impact assessment or regulator consultation, as far as it reasonably can.
- Breaches: Kaja will tell you without undue delay after becoming aware of a personal data breach affecting your visitors’ data.
- Deletion: revoking a widget key stops the widget; deleting your account deletes all of your visitors’ conversations straight away.
- Audits: Kaja will give you the information you reasonably need to show these obligations are met, and allow for audits by you or an auditor you choose, on reasonable notice.
You are responsible for telling visitors about the processing (for example in your own privacy policy), and for any special category data (such as health information) your visitors share through your widget.
Accounts
You must be 18 or over to create an account.
You are responsible for:
- providing accurate account information;
- keeping your login credentials secure;
- all activity under your account;
- notifying Kaja if you suspect unauthorized access.
Kaja may refuse, suspend, or terminate accounts that violate these Terms, create risk, or abuse the service.
Acceptable Use
You must not use Kaja to:
- break the law or violate anyone’s rights;
- send spam, phishing, malware, or abusive content;
- attempt unauthorized access to accounts, systems, or data;
- probe, scan, or attack the service except through responsible security research;
- overload, disrupt, or degrade the service;
- reverse engineer or bypass security controls except where legally allowed;
- use the service for high-risk, illegal, or harmful activity.
User Content And Data
You keep ownership of data you submit to Kaja.
You grant Kaja the limited permission needed to store, process, transmit, and display that data only to provide and secure the service.
Do not submit data you do not have the right to use.
Privacy
Kaja’s handling of personal data is described in the Privacy Policy, which also explains the health data consent you give when you create an account.
Security Research
Good-faith security reports are welcome. Do not access, modify, delete, or disclose other users’ data. Do not perform destructive testing or denial-of-service testing.
Report issues to subztep@gmail.com.
Intellectual Property
Kaja, including its software, design, documentation, names, and branding, is owned by its respective owners and contributors.
Open-source parts of Kaja remain governed by their applicable open-source licenses.
These Terms do not give you ownership of Kaja’s software, branding, or documentation.
Third-Party Services
Kaja may rely on third-party providers for hosting, databases, email delivery, analytics, monitoring, or similar infrastructure. Their terms and policies may also apply to their services.
Key providers:
- Hetzner Online GmbH (hosting, database and image storage)
- Telegram, for the Kaja Telegram bot
- Google, if you use Google sign-in
Availability
Kaja is provided on an “as is” and “as available” basis. There is no guarantee that the service will be uninterrupted, secure, or error-free.
No Warranties
To the maximum extent permitted by law, Kaja disclaims all warranties, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, and non-infringement.
Limitation Of Liability
To the maximum extent permitted by law, Kaja and its operator will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, data, goodwill, or business opportunities.
Kaja’s total liability for any claim relating to the service is limited to GBP 0.
Nothing in these Terms limits or excludes liability that cannot be limited or excluded by law, including liability for death or personal injury caused by negligence, or for fraud, and nothing affects your statutory rights as a consumer.
Some jurisdictions do not allow certain limits, so parts of this section may not apply to you.
Termination
You may stop using Kaja at any time.
Kaja may suspend or terminate your access if you violate these Terms, create legal or security risk, or abuse the service. Where practical, notice will be provided.
Sections that by nature should survive termination will continue to apply, including intellectual property, disclaimers, limitation of liability, and governing law.
Governing Law
These Terms are governed by the laws of England and Wales, without regard to conflict-of-law rules.
Courts located in England and Wales will have exclusive jurisdiction unless applicable consumer law requires otherwise.
Changes
These Terms may be updated from time to time. Material changes will be posted on this page, and the effective date will be updated.