The terms, in plain words.

1. Who

Provider: Sarsa Formation OÜ, a private limited company registered in the Estonian Commercial Register under registry code 17290516, registered office Lõõtsa tn 1a, 11415 Tallinn (Lasnamäe linnaosa, Harju maakond), Estonia, email sana@muoto.xyz (“we”). Buyer: the company that buys one wrong-answer diagnosis through the payment link on our website (“you”). You confirm that you are buying for business purposes and have authority to bind the Buyer. Accepting these terms at checkout, or paying, is agreeing to them as they read on that date; the version is at the foot.

2. What you buy, and the price

One wrong-answer diagnosis of one AI feature: up to 20 questions, up to five steps of the feature, about 50 pages of documents in total, and one report. Price: €900, fixed, paid up front. Sarsa Formation OÜ is currently not registered for Estonian VAT and adds no Estonian VAT. Where reverse charge or another mandatory tax treatment applies to you, each of us accounts for it as the law requires, and the invoice says so. Anything larger is quoted in writing before any work starts, and is a separate agreement.

3. How it works, and how either of us stops

1. Your expert writes the answers first. We send a template; we never write your answers. Before any model sees your documents the answers are locked, and we both keep their fingerprint (a hash), so neither of us can change them afterwards.
2. Before we run anything, we send you the run plan, and nothing runs until you agree to it. It names the steps we will test, in order, and the price of each — equal shares of €900 across the steps named (five steps, €180 each; three steps, €300 each); where we expect the feature to fail, and what result would prove us wrong; and the data details in §10 (what kinds of personal data are involved, which model providers each call goes to and with what settings, and where the data is processed).
3. If the answers cannot be written, or you cannot share documents, you get a full refund before anything runs. Stopping here costs you nothing.
4. You may stop at any time after we start, for any reason or none. A step already started is earned at the plan’s price; you receive everything produced so far; anything unearned is refunded within ten business days.
5. We may stop if we cannot perform a step (and cannot check it from the outside), if the material is unlawful or is not yours to give us, if we hear nothing from you for 30 days, for a security reason we name, or if you materially breach these terms. What is earned depends on who stopped and why: if we stop because we cannot perform a step, that step is not earned; if we stop because of your breach, unlawful material or missing cooperation, a step already started is earned. Either way you receive what was produced and the rest is refunded within ten business days.
6. Steps we cannot run ourselves — your private code, your live data — are checked from the outside: what goes in and what comes out. The report says which steps we could not open.

4. What you keep, and what you may do with it

Yours: your documents and your expert’s answers. They were always yours.

Ours: our method, and the tools, code and know-how we had before working with you (“our existing IP”). Nothing here transfers it.

What we deliver: the report, the run plan, the run settings, every reply from the model with its cost and why it stopped, the files specific to your diagnosis, and the scripts we used. We grant you a perpetual, worldwide, royalty-free, non-exclusive right to use, copy and change all of it, including any of our existing IP inside the scripts, for your internal purposes — which include use by contractors and professional advisers working for you under confidentiality. You may not offer the scripts to others as a standalone service.

What works without us: the report can be reproduced from the files we deliver, without contacting us. The scripts depend on no service we host. Re-running them depends on the model providers and models you choose and pay for still being available and behaving the same; a provider can retire or change a model, and we do not promise otherwise. Nothing needs an account with us, and nothing stops working when we are done.

5. Your material: confidentiality, security, where it goes

• Confidential. Your documents, your answers, the details of your AI feature and the report are confidential. We use them only for your diagnosis and to answer your questions about the report. We never use your name, the engagement, your material or the findings publicly without your written permission.
• Security. Your material is encrypted in transit and at rest; only the people working on your diagnosis can reach it, with the least access they need, behind multi-factor authentication; it is never put into a consumer AI product; it is deleted on the schedule in §10.9; and it reaches only the model providers the run plan names, set up the way the plan says. We tell you without undue delay after becoming aware of a security breach affecting your material.
• Model providers. To run the diagnosis we send your material to model providers through their business APIs, under their data-processing terms, never through a consumer product. The providers we may use are Anthropic, OpenAI and OpenRouter; where OpenRouter is used, the run plan names the provider behind it that the call is fixed to, and both are listed as processors. The run plan names the providers, models, locations and settings for your diagnosis, and the run log records, for every call, which provider and model answered.
• Training. Neither we nor any model provider used for your diagnosis may use your material, or what the models return, to train or improve general-purpose models. Before we run anything we set up and contract each provider accordingly, and the run plan names the settings.
• How long we keep it. We keep our copy of your material and the model replies until 30 days after we deliver the report, so we can answer your questions — that is part of the service — unless you ask us to delete it sooner. Then it is deleted from our working systems; any backup expires within 90 days and is not otherwise used. Invoices and this agreement are business records we keep as the law requires, separately from your material.

6. What the report is not

Not a benchmark score, a certificate, or a promise that your AI feature is right. It tells you what your expert’s answers could catch, for the questions in it, and nothing more. What you do with it is your decision.

7. Liability

Our liability under this agreement is capped at the price you paid. Neither of us is liable to the other for indirect loss. This cap does not apply to intentional non-performance, and nothing here limits liability that cannot be limited under Estonian law.

8. Law

Estonian law. Disputes go to Harju County Court, Estonia, unless a mandatory rule where you are gives you another forum.

9. Changes and ending

These terms are the ones on our website on the date you paid; the version is at the foot. Either of us can end the engagement in writing at any time under §3, and what is then owed is only what §3.4–3.5 say.

10. Data-processing schedule — applies automatically if your material contains personal data

This schedule is part of these terms and applies, without anyone asking, whenever the material you give us contains personal data. For that material you are the controller and we are the processor. For our own billing, contracting, security and legal-administration data (your name, address, payment record, this agreement) we are the controller.

1. Subject matter and duration: processing the personal data in your documents, your answers and the model replies, until 30 days after we deliver the report, unless you tell us to delete or return it sooner or the engagement ends under §3.
2. Nature and purpose: running your AI feature as it is, and again with one step at a time given the right answer; comparing the results with your expert’s answers; writing the report; and answering your questions about it during those 30 days. Nothing else.
3. Types of data and data subjects: the run plan records, for your diagnosis, the kinds of personal data and the groups of people it concerns (usually the people named in the documents or requests your feature reads). Do not give us special-category data under Article 9 GDPR, or data about criminal convictions and offences, unless the run plan expressly says we have agreed to process it; if it does, the plan also records your legal basis and the security, provider and transfer checks made before anything runs.
4. Instructions. We process only on your documented instructions, which are these terms and the run plan you agreed to, including for transfers outside the EEA. If we think an instruction breaks the law, we tell you.
5. People. Everyone who handles your data is bound to confidentiality.
6. Security. The measures in §5, and any others the risk requires.
7. Sub-processors. The run plan is your written authorisation of the sub-processors for your diagnosis. It names each model provider — both of them, where one routes calls to another — its processing location, the retention and training settings for the calls, and the basis for any transfer outside the EEA (the EU–US Data Privacy Framework where the provider is certified; otherwise the provider’s standard contractual clauses). Our scripts send calls only by the route the plan names, with automatic fallback to other providers and provider data collection switched off, and refuse any call that would leave it; the run log records which provider and model answered each call. We add or replace a provider only in a run plan you have agreed to, and you may object, in which case §3.5 applies. Every provider we use is bound by data-processing terms carrying duties equivalent to these; a provider whose terms do not is not used for personal data.
8. Assistance. We help you answer requests from the people your data concerns, and help with security, breach notification, impact assessments and prior consultation, as far as the data we hold allows. We notify you without undue delay after becoming aware of a personal-data breach affecting personal data processed under this engagement.
9. End. When processing ends (§10.1) we delete or return your personal data, as you choose — returning means handing over any personal data we still hold that you have not already received — and delete our copies as §5 says, unless the law requires us to keep them; backups expire within 90 days and are not otherwise used.
10. Audit. We give you the information needed to show these duties are met, and allow an audit by you or an auditor you appoint, on reasonable notice, at your cost.