Terms and Conditions

These Terms and Conditions (the «Conditions») govern the contractual relationship between talqi (Pablo Fernández Torres, Barcelona) and the professional client or business (the «Client») contracting conversational AI agent services.

Contracting the service implies full acceptance of these Conditions. If the Client does not agree, they must not contract the service.

1. Definitions

• ●«AI Agent»: conversational artificial intelligence system configured by talqi to serve the Client's end customers via one or more messaging channels, using a custom system prompt containing the Client's information, tone, and business rules.
• ●«Messaging Channel» or «Channel»: communication platform through which the AI Agent interacts with end customers. Includes, without limitation: WhatsApp Business API, Instagram Messaging API, Telegram Bot API, integrated web chat, and other channels talqi may incorporate.
• ●«Channel Provider»: entity owning the messaging platform (Meta Platforms for WhatsApp and Instagram, Telegram for Telegram, etc.).
• ●«System Prompt»: technical and content instructions defining the AI Agent's behaviour, knowledge, and personality, written by talqi using the Client's information.
• ●«Administration Panel»: interface through which the Client monitors conversations, intervenes manually, and receives AI Agent alerts. In the current version, implemented via Telegram; talqi may migrate to a proprietary web interface in future versions.
• ●«Takeover»: functionality allowing the Client to take control of a conversation, temporarily pausing the AI Agent to respond personally.
• ●«End Customer»: natural or legal person communicating with the Client's business via a messaging channel and served by the AI Agent.

2. Service description

talqi provides a managed conversational AI agent service including:

• ●System prompt design and writing, personalised and including the knowledge base (FAQs, services, pricing, hours, policies).
• ●Technical configuration: integration with the contracted messaging channel APIs, webhook configuration, connection to the Anthropic (Claude) API, and agent deployment.
• ●Administration Panel: interface where the Client receives escalation alerts, can take control of conversations, and check agent status.
• ●Operation and maintenance: monitoring, prompt updates, incident resolution, and conversational performance optimisation.
• ●Periodic reports: usage metrics (messages, resolution rate, response time, escalations) delivered monthly.

2.1. Service limitations

The service does not include, unless expressly agreed:

• ●Creation or management of the Client's accounts on messaging platforms (Meta Business, Telegram, etc.).
• ●Mass messaging (broadcast) campaigns or outbound marketing automation.
• ●CRM, ERP or other system integrations, except those included in the proposal.
• ●Development of custom web applications, mobile apps, or dashboards.

2.2. AI — scope and limitations

The AI Agent uses large language models (LLMs) from Anthropic PBC (Claude models). The AI Agent is not infallible: it may generate inaccurate or inappropriate responses. talqi continuously optimises the prompt but does not guarantee 100% accuracy. The human escalation mechanism (takeover) is mandatory for this reason.

3. Supported messaging channels

talqi offers AI Agent deployment on the following messaging channels, subject to technical availability and each channel provider's terms of service:

The Client contracts one or more channels in the individual proposal. Adding further channels may result in an adjustment to the monthly fee, communicated to the Client in advance.

talqi does not guarantee continuity or stability of third-party provider APIs. Changes in policies, pricing, or channel availability by its provider are beyond talqi's control and do not constitute a breach of contract.

Platform policies: each messaging channel has its own usage policies. The Client undertakes to comply with the relevant provider's terms of service. In particular, since January 2026 Meta's WhatsApp Business API prohibits general-purpose chatbots; talqi agents comply with this regulation by being tied to a specific business.

4. Contracting process

The contracting process follows these steps:

• ●Initial consultation: the Client requests information via the Website, messaging, or email.
• ●Free audit (optional): talqi analyses the Client's current communications and presents opportunities.
• ●Personalised demo: talqi configures a test agent with real business data.
• ●Proposal and acceptance: detailed proposal with scope, channels, price, and conditions. Written acceptance formalises the contract.
• ●Onboarding: the Client provides the necessary information and talqi deploys the AI Agent within 1 to 2 weeks.
• ●Go-live: after joint testing, the AI Agent is activated on the contracted channels.

5. Pricing and payment

5.1. Pricing structure

Prices exclude VAT (21%). The final price will be detailed in the individual proposal.

5.2. Billing and payment

• ●The setup fee is invoiced in full before configuration begins.
• ●The monthly fee is invoiced in advance within the first 5 days of each month.
• ●Payment methods: bank transfer and SEPA direct debit.
• ●Non-payment exceeding 15 days entitles talqi to suspend the service (with 5 days' prior notice).
• ●Unpaid amounts shall accrue late-payment interest at the statutory rate plus two percentage points.

5.3. Third-party API costs

The monthly fee includes a reasonable volume of API usage. In case of excessive volume, talqi will pass on the additional costs at cost price, without markup, with full transparency.

6. Term and termination

6.1. Term

The contract has an indefinite term with monthly billing. There is no minimum commitment period.

6.2. Termination by the Client

The Client may terminate by giving 15 calendar days' notice by email to pfernandez@talqi.io. Fees for the current period are non-refundable.

6.3. Termination by talqi

talqi may terminate for:

• ●Repeated non-payment (two or more consecutive unpaid fees).
• ●Use of the AI Agent for unlawful purposes or contrary to regulations.
• ●Material breach of the Client's obligations.
• ●Force majeure making service provision impossible for more than 30 consecutive days.

Force majeure definition: pandemics, epidemics, or declared health emergencies; unilateral changes to the APIs, policies, or terms of service of channel providers (Meta Platforms, Telegram, etc.) or the AI provider (Anthropic); suspension or revocation of access to the WhatsApp Business API or other APIs by the provider's decision; natural disasters; armed conflicts; acts of terrorism; general strikes; cyberattacks on third-party infrastructure; large-scale electricity, internet, or telecommunications outages; governmental orders, judicial or administrative resolutions preventing service provision; and legislative or regulatory changes making service provision impossible or unlawful under the agreed conditions.

6.4. Effects of termination

Upon termination: (a) the AI Agent will be deactivated on all channels; (b) talqi will provide a data export within 15 days (CSV/JSON); (c) after 30 days, talqi will delete the data, unless legally required to retain it.

7. Client obligations

• ●Provide truthful and up-to-date information for AI Agent configuration.
• ●Keep active their accounts on the contracted messaging platforms and comply with their terms of service.
• ●Designate at least one administrator with access to the administration panel.
• ●Inform their end customers that they may be served by an AI system (EU Regulation 2024/1689).
• ●Notify talqi of changes in their business that affect the AI Agent.
• ●Not use the AI Agent for spam, unlawful content, or content infringing third-party rights.
• ●Comply with GDPR/LOPDGDD in their relationship with end customers.
• ●Pay fees on time.

7.1. Opt-out mechanism (STOP)

In accordance with AEPD guidelines on chatbots and artificial intelligence, the AI Agent will incorporate an opt-out mechanism allowing end customers to request that automated communications cease. The AI Agent will be configured to:

• ●Recognise and respect opt-out keywords: «STOP», «no more messages», «unsubscribe» and equivalent expressions.
• ●Confirm to the end customer that their opt-out request has been received.
• ●Immediately cease automated communications with that end customer.
• ●Record the opt-out request to prevent future automated communications.

The Client undertakes not to deactivate or modify the opt-out mechanism, and to respect opt-out requests from their end customers, in accordance with Article 21 of the GDPR.

8. talqi obligations

• ●Provide the service with professional diligence.
• ●Configure the AI Agent according to the agreed specifications.
• ●Maintain the operational infrastructure and monitor the agent.
• ●Notify technical incidents affecting the service.
• ●Attend to modification requests within a maximum of 48 working hours.
• ●Comply with data protection regulations as data processor.
• ●Deliver monthly performance reports.
• ●Not access or disclose Client data for purposes other than the service.

9. Service level (SLA)

Outages caused by channel providers (Meta, Telegram, etc.), the AI provider (Anthropic), or force majeure do not count towards availability calculations.

10. Personal data processing — Data Processor

talqi acts as data processor (Art. 28 GDPR) with respect to end customer data. The detailed data processing conditions are set out in Annex I — Data Processing Agreement (DPA), which forms an integral part of these Conditions and is deemed accepted automatically upon acceptance of the Conditions.

10.1. Data processed

• ●End customer identifier on the messaging channel (phone number, username, profile ID).
• ●Profile name (if available on the channel).
• ●Message content (text, images, documents, voice notes).
• ●Data voluntarily provided in the conversation.
• ●Metadata: date, time, duration, channel used.

10.2. Purpose and retention

Data is processed exclusively to provide the service. Maximum retention: 90 days from the last message (configurable). Automatic deletion upon expiry of the retention period.

10.3. Sub-processors

Sub-processors may vary depending on the contracted channels. talqi will inform the Client of any new sub-processors with sufficient advance notice.

10.3.1. International data transfers

Processing by Anthropic PBC involves the transfer of data to the United States. In accordance with Articles 44 to 49 of the GDPR and CJEU case law (Schrems II, C-311/18), talqi has adopted the following safeguards:

• ●Standard Contractual Clauses (SCCs): the relationship with Anthropic PBC is governed by Anthropic's Data Processing Agreement (DPA), which incorporates the Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914).
• ●Transfer Impact Assessment (TIA): talqi maintains documented TIA for the US transfer, considering the nature of customer service conversational data (not special categories), complementary technical measures (TLS 1.3 transit encryption, transitory processing without persistent storage by Anthropic per their API policy) and the legal framework of the destination country.
• ●Complementary measures: Anthropic does not use API data to train AI models. Data is processed transiently and not stored beyond the time required to generate the response, per Anthropic's current API data policy.

The Client may request a copy of documentation relating to international transfers (including the applicable TIA and SCCs) by writing to pfernandez@talqi.io.

10.4. Security measures

• ●Encryption of credentials and tokens at rest (AES-256).
• ●Encrypted communications (TLS 1.3) in transit.
• ●Data isolation by tenant (unique identifier, logical segregation).
• ●Automated daily backups.
• ●Access control: only authorised talqi personnel, exclusively for service provision.
• ●Cryptographic verification of incoming webhooks.
• ●Retention policy: automatic deletion after 90 days (configurable).

10.5. Processor obligations

• ●Not to process data for purposes other than those indicated.
• ●Not to disclose data to third parties other than authorised sub-processors.
• ●To assist the Client in fulfilling their GDPR obligations.
• ●To notify security breaches to the Client within a maximum of 48 hours of detection.
• ●To return or delete data upon contract termination (clause 6.4).

11. Artificial intelligence and automated decisions

In accordance with Article 22 of the GDPR:

• ●The AI Agent does not make decisions with legal or significant effects. Its function is informational.
• ●The end customer may request human attention at any time.
• ●talqi does not use conversation data to train AI models.
• ●Conversations processed by Anthropic are subject to their no-training-on-API-data policy.

EU AI Act (Regulation (EU) 2024/1689): the service is generally classified as a limited-risk AI system (transparency obligation, Art. 50). However, the risk classification may vary depending on the Client's sector: an agent handling health-related queries (dental or aesthetic clinics) could be classified as high-risk under Annex III of the Regulation. talqi will carry out a risk-level assessment for each deployment and take appropriate additional measures. The Client undertakes not to deactivate or conceal transparency information and to cooperate with talqi in the risk assessment.

12. Confidentiality

Both parties undertake to maintain the confidentiality of reserved information, an obligation that survives 2 years after contract termination.

Exceptions: (a) publicly available information; (b) disclosure required by law; (c) information legitimately received from third parties.

talqi may reference the Client as a customer (name and sector), unless the Client objects in writing.

13. Limitation of liability

talqi shall not be liable for damages arising from:

• ●Erroneous AI Agent responses (generative AI is not infallible).
• ●Interruptions or changes to channel provider APIs.
• ●Changes in policies or pricing of Meta, Telegram, Anthropic, or other providers.
• ●Client actions, including lack of supervision or outdated information.
• ●Force majeure or unforeseen circumstances.
• ●Loss of profit, loss of revenue, data loss, reputational damage, or any indirect or consequential damage.

Direct damages: talqi's total cumulative liability to the Client for direct damages shall not exceed the total fees paid in the last 6 months prior to the causative event.

Indirect damages: talqi shall in no event be liable for indirect, incidental, special, consequential, or punitive damages, including — without limitation — loss of profit, loss of revenue, loss of business opportunities, data loss, or reputational damage, regardless of whether talqi had been advised of the possibility of such damages.

These limitations shall not apply in cases of wilful misconduct or gross negligence by talqi, nor where mandatory legislation prohibits limiting liability.

14. Intellectual property

talqi's source code, architecture, tools, and procedures are the exclusive property of talqi. The business content of the prompt (FAQs, pricing, services) is and shall remain the property of the Client, who may request a copy after termination.

15. Communications

• ●Email: pfernandez@talqi.io and the Client's address.
• ●Administration Panel: for operational matters relating to the agent.
• ●Termination, complaints, and legal matters: by email only.

16. Amendments

talqi may amend these Conditions with 30 days' notice for material changes. The Client may terminate without penalty before the changes take effect. Minor amendments apply without prior notice. Current version at talqi.io/legal.

17. Dispute resolution

Spanish law applies. The parties will attempt amicable resolution before resorting to legal proceedings. Jurisdiction: Courts and Tribunals of Barcelona.

EU online dispute resolution platform: https://ec.europa.eu/consumers/odr/

18. Final provisions

• ●Assignment: the Client may not assign the contract without talqi's written consent.
• ●Partial invalidity: if any provision is declared void, the remaining provisions retain their validity.
• ●Waiver: tolerance does not constitute a waiver of the right to demand future compliance.
• ●Entire agreement: these Conditions and the accepted proposal constitute the entire agreement.
• ●Right of withdrawal: as a B2B service, the consumer right of withdrawal does not apply. However, if the Client acts as a consumer under applicable consumer protection law, they shall have 14 calendar days to withdraw from the contract from its formation, by written notice to pfernandez@talqi.io.

Last updated: April 2026 · Version 1.0

Document prepared for: talqi (Pablo Fernández Torres) · Barcelona, Spain.

Drafted in accordance with applicable Spanish legislation (LSSI-CE, GDPR, LOPDGDD, EU AI Act Regulation (EU) 2024/1689, Spanish Consumer Law) and AEPD guidelines on chatbots and AI. Professional legal review is recommended before publication. The owner's Tax ID (NIF) MUST be filled in before publishing at talqi.io/legal.

Annex I — Data Processing Agreement (DPA)

This Data Processing Agreement (the «DPA») forms an integral part of the Terms and Conditions of Service. Acceptance of the Conditions by the Client constitutes automatic acceptance of this DPA, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

For the purposes of this DPA, the Client acts as data controller and talqi (Pablo Fernández Torres) as data processor. This DPA enters into force on the date the Client accepts the Terms and Conditions — whether by signing the service proposal, confirmation by email, or any other means evidencing acceptance — and shall remain in force while talqi processes personal data on behalf of the Client.

A1. Subject matter

The Client instructs talqi to process end customers' personal data exclusively for the provision of the conversational AI agent service described in the Terms and Conditions. talqi shall process personal data only in accordance with the Client's documented instructions, unless required to do so by Union or Member State law.

A2. Personal data processed

A2.1. Categories of data subjects

End customers of the Client communicating via the contracted messaging channels.

A2.2. Types of personal data

• ●Channel identifiers: phone number, profile name, username, user ID.
• ●Message content: free text, images, documents, voice notes sent during the conversation.
• ●Voluntarily provided data: full name, email, address, preferences, enquiry details.
• ●Metadata: date, time, conversation duration, channel used, status (bot/human).

A2.3. Special categories of data

talqi does not intentionally request or collect special categories of data (Art. 9 GDPR). However, end customers may spontaneously disclose health or other sensitive data in free conversation. The AI Agent is configured not to store or specifically process such data, and to redirect the end customer to human attention when such queries are detected.

A3. Purpose and duration of processing

Purpose: to provide the conversational agent service (answering queries, managing escalations, capturing leads, generating performance reports).

Duration: processing shall continue for the duration of the contractual relationship between the parties. Conversation messages are automatically deleted 90 days after the last message (configurable by the Client). Captured lead data is retained until contract termination, at which point it is exported to the Client and deleted in accordance with clause 6.4 of the Terms and Conditions.

A4. Processor obligations (talqi)

talqi, in its capacity as data processor, undertakes to:

• ●Process personal data only in accordance with the Client's documented instructions.
• ●Ensure that persons authorised to process data have committed to confidentiality or are subject to a statutory confidentiality obligation.
• ●Implement the technical and organisational measures described in clause A6 of this DPA.
• ●Not engage another processor (sub-processor) without prior general authorisation from the Client, which is deemed granted for the sub-processors listed in clause 10.3 of the Terms and Conditions. talqi will inform the Client of any changes to sub-processors with 30 days' advance notice, allowing the Client to object.
• ●Assist the Client, taking into account the nature of the processing, through appropriate technical and organisational measures, to fulfil its obligation to respond to requests for the exercise of data subjects' rights (access, rectification, erasure, portability, objection, restriction).
• ●Assist the Client in ensuring compliance with obligations relating to processing security, breach notification, impact assessment, and prior consultation (Arts. 32–36 GDPR).
• ●At the Client's choice, delete or return all personal data upon completion of service provision, and delete existing copies unless Union or Member State law requires their retention.
• ●Make available to the Client all information necessary to demonstrate compliance with the obligations in Art. 28 GDPR, and allow and contribute to audits or inspections carried out by the Client or an authorised auditor.

A5. Controller obligations (Client)

The Client, in its capacity as data controller, undertakes to:

• ●Ensure it has a legitimate legal basis for processing its end customers' data via the AI Agent.
• ●Inform its end customers of the data processing and use of artificial intelligence, facilitating the exercise of their rights.
• ●Provide documented instructions to talqi regarding data processing.
• ●Notify talqi of any updates to its Record of Processing Activities that affect the service.

A6. Technical and organisational measures

talqi implements the following security measures in accordance with Article 32 of the GDPR:

Technical measures:

• ●Encryption of data at rest (AES-256) for credentials and access tokens.
• ●Encryption of data in transit (TLS 1.3) for all communications.
• ●Logical data isolation by tenant (tenant_id in all database documents).
• ●Cryptographic verification of incoming webhooks (Meta signature, Telegram).
• ●Automated daily database backups with 30-day retention.
• ●TTL indexes in MongoDB for automatic deletion of messages after the retention period.
• ●Continuous monitoring via Grafana Cloud with real-time alerts.

Organisational measures:

• ●Restricted access: only authorised talqi personnel (currently one person) access data, exclusively for service provision.
• ●Documented retention policy: 90 days for messages (configurable), contract duration for leads.
• ●Documented security breach management procedure.
• ●Periodic security measure reviews (at least annually).

A7. Security breach notification

In the event of a personal data security breach, talqi shall:

• ●Notify the Client without undue delay and, in any case, within a maximum of 48 hours of becoming aware of the breach.
• ●Provide the Client with the information necessary for it to comply with its obligation to notify the AEPD within 72 hours pursuant to Article 33 of the GDPR.
• ●Cooperate with the Client in investigating, mitigating, and documenting the breach.

The notification periods to the Client (48h) and to the AEPD (72h) run simultaneously from the moment of detection, not consecutively.

A8. International transfers

International data transfers are governed by clause 10.3.1 of the Terms and Conditions. In summary: the transfer to Anthropic PBC (USA) is made on the basis of Standard Contractual Clauses (SCCs) and a documented Transfer Impact Assessment (TIA), with complementary technical measures (encryption, transitory processing, no training on API data).

A9. Audits

The Client has the right to carry out audits or inspections to verify compliance with this DPA, directly or through a third-party auditor subject to confidentiality. Audits shall be conducted with a minimum of 15 working days' advance notice, during business hours, and in a manner that does not disproportionately interfere with talqi's operations. talqi may demonstrate compliance through third-party certifications or audit reports, where available.

A10. DPA term

This DPA enters into force automatically when the Client accepts the Terms and Conditions of Service, and shall remain in force while talqi processes personal data on behalf of the Client. Confidentiality obligations and those relating to the return or deletion of data shall survive termination of the DPA and the service contract.

Acceptance of the Terms and Conditions — by any means evidencing the Client's consent (proposal signature, email confirmation, acceptance on a web form) — constitutes the execution of this DPA in accordance with Article 28.9 of the GDPR, which expressly permits electronic format.

Integrated acceptance: this DPA does not require a separate signature. It is deemed accepted and binding from the moment the Client accepts talqi's Terms and Conditions of Service, of which this Annex forms an integral part. Art. 28.9 GDPR expressly recognises the validity of data processing contracts in electronic format.

Last updated: April 2026 · Version 1.0

Document prepared for: talqi (Pablo Fernández Torres) · Barcelona, Spain.