# Ristmark — Terms of Service

**Version 2026-10-21 · Last revised 21 October 2026 · Applies when accepted**

Ristmark helps businesses turn documents into reusable templates and generate documents from their data. AI migration can make mistakes: review the complete output and keep your own copies of important documents.

Paid subscriptions renew until cancelled. We do not charge automatic usage overages. We do not guarantee uptime, and section 20 limits most business claims to fees paid in the preceding 30 days, which can be zero. Read that section before using Ristmark for work whose loss would exceed that amount. Mandatory legal rights remain protected.

## 1. Who contracts with whom

NUTLET SIA, trading as Ristmark, operates the service. We are a Latvian limited liability company, registration number **40203464033**, VAT **LV40203464033**, registered at **Pļavu iela 6, Sēbruciems, Babītes pag., Mārupes nov., LV-2107, Latvia**, in the Commercial Register of the Republic of Latvia. Contact **support@ristmark.app**. Our [imprint](/imprint) carries the same details.

“You” means the individual, sole trader or organisation accepting this agreement. Someone accepting for an organisation must have authority to bind it. People you authorise to use your workspace are authorised users; they do not become personally liable for your organisation's fees merely by using it.

## 2. Documents forming the agreement

These terms cover our hosted application, website and API. **Annex A (data processing), Annex B (security measures) and Annex C (switching and export)** form part of them. The plan and price selected at purchase also form part of the agreement. The [recipient list](/subprocessors) identifies authorised recipients subject to Annex A. Our [privacy policy](/privacy) explains our processing of personal data; it is a notice, not consent to processing and not a substitute for Annex A.

Mandatory law prevails. Applicable international-transfer clauses prevail over conflicting provisions of this agreement; Annex A prevails on personal-data processing, and Annex C on switching. Current pricing does not change a period already purchased. Changes follow section 23.

## 3. Acceptance and contract copies

You accept this version by expressly agreeing to it when creating a workspace or placing an order. We record the accepting identity, customer name, version and time. An invitation to use an existing workspace does not authorise its recipient to bind another person to a new purchase.

You can [download this version](/legal/2026-10-21/terms.txt) and the [privacy notice](/legal/2026-10-21/privacy.txt) and retain them. Contact support for a copy of your acceptance record. Merely visiting our website does not create a paid subscription.

The contract is made in English. To create a workspace, enter the customer and workspace details, review the linked documents and confirm business use and acceptance. You can correct those details before submitting. To buy a plan or credits, select the purchase in the application, review and correct the checkout information, then use the payment confirmation control. The application shows the outcome; contact support if the payment result is unclear before trying again. We retain the accepted version and acceptance record. Our welcome email links the accepted version; it does not attach the full contract. If mandatory law requires confirmation on a durable medium, we provide it in that form.

## 4. Business use and eligibility

The service is intended and offered only for a trade, business, craft or professional purpose, including use by sole traders and businesses that are not VAT registered. Personal or household use is outside the permitted scope. At signup you must expressly declare that business purpose; each order also confirms it. You must have legal capacity and authority to contract for the named customer. We may seek reasonable evidence of business status and decline or end service if it cannot be established, subject to mandatory rights and content-return obligations.

**United Kingdom.** The service is not currently offered to businesses established in the United Kingdom. At signup you confirm that yours is not; if that is or becomes untrue, tell us and we will end the service and return your content under Annex C.

A VAT number is optional and affects tax treatment, not eligibility to buy. A business-purpose declaration is evidence of purpose; it does not determine a person's legal status by itself.

**Mandatory-rights safeguard.** If, despite this eligibility rule, the law treats you as a consumer, its mandatory protections apply regardless of your declaration or a label in this agreement. In particular, sections 19–20 do not exclude statutory conformity rights or compensation that cannot be excluded, section 24 does not remove your protected choice of court, and a paid change or withdrawal of service remains subject to statutory remedies.

**EU/EEA withdrawal.** Where the applicable consumer law grants a distance-contract withdrawal right, you normally have 14 days from concluding the service contract to withdraw without giving a reason. Starting an ongoing service does not by itself extinguish that right. We do not rely on a blanket waiver for immediate access. If you withdraw, we do not deduct a charge for service supplied during that period unless we obtained the legally required express request and provided the required information. Payment may still be collected when you order and reimbursed on withdrawal. Rights and longer periods provided by mandatory law remain available.

To withdraw, send an unambiguous statement to **support@ristmark.app** or our registered address before the period expires. You may use this form, but do not have to:

> To NUTLET SIA, support@ristmark.app, Pļavu iela 6, Sēbruciems, Babītes pag., Mārupes nov., LV-2107, Latvia:
>
> I/We hereby give notice that I/We withdraw from my/our contract for the Ristmark service.
>
> Ordered on:
>
> Name of consumer(s):
>
> Address of consumer(s):
>
> Signature of consumer(s), only if submitted on paper:
>
> Date:

Complete those customer fields when sending the form, deleting the wording that does not apply. A workspace or order reference helps us find the purchase but is not required to exercise the right.

For a valid withdrawal we reimburse payments covered by that right without undue delay and no later than 14 days after receiving notice, using the original payment method unless another method is expressly agreed without additional cost to you. We end access to the withdrawn paid service; your content-return rights remain protected. Purchased credits do not waive withdrawal or other mandatory remedies. Other countries' mandatory consumer rights also apply where required.

## 5. What the service does

You can migrate source documents into reusable templates, review and edit templates, bind data and generate PDF, DOCX or HTML documents. Editing and generation are deterministic. Migration uses AI to reconstruct layout from page images and identify variable fields. Proposed bindings are applied to the draft before your review. Confidence scores help review; they are not guarantees. The keyed generation API uses approved templates.

Word and RTF inputs can be cross-checked against their source structure. PDFs and scanned images provide less structural evidence and require closer review. Consolidation groups similar templates and presents proposals; a merge requires your action.

## 6. Product limits

Only the first **7 pages** of a migration source are processed; longer sources are truncated with a notice. Current upload limits are 25 MB for migration documents and 10 MB for spreadsheets. Rate limits apply, including tighter limits on generation and AI operations; the application or API reports a refusal.

DOCX export uses editable flow and can differ from the original. Lists are flattened into paragraphs with marker characters; some table-cell styling and drawing features are lost or replaced with labelled placeholders, and letterhead backgrounds are omitted. Review every output format. Writing systems, fonts and page layout have additional limitations described in [Languages and scripts](/docs/languages-and-scripts). A successful render does not establish that an invoice, contract, barcode or other document is legally valid, complete or suitable for its intended use. We promise no particular accuracy percentage or fidelity for your documents. Current technical limits may change subject to your purchased rights and section 23.

## 7. Beta features and review

Migration and similar-template consolidation are Beta capabilities. They may produce incorrect text, fields, structure or layout and may change as we develop them. A paid Beta operation consumes the disclosed credits. You are responsible for checking outputs before relying on or distributing them. A Beta label does not remove mandatory quality or refund rights.

## 8. No professional advice

The service processes your documents. It does not provide legal, tax, medical, accounting or other professional advice, and its output has not been reviewed by a professional for you. Decide whether your documents and their use comply with applicable law; obtain professional review where appropriate. Do not rely on an AI confidence score for that decision.

## 9. Workspace and credentials

A workspace has an Owner and may have other users with assigned roles and team permissions. The Owner controls billing, API keys and workspace deletion. Keep your membership list current and credentials secure. You are responsible for authorised users' use within your control. Report suspected compromise to support. Saving blocks as a recipe creates a separate copy in the selected team library; it may include text, sample values and picture references. Check its contents and who can access that team. Deleting the source template does not delete the recipe.

Sign-in is handled by an identity provider; the application does not store your password. Our operator access is role-restricted, time-limited and audited. We access content only as needed to provide requested support, investigate faults/security incidents, or comply with law and Annex A. Support-level impersonation is read-only; higher operator levels may make changes.

## 10. API and export

API keys belong to the workspace and are created by the Owner. A key is shown once; we retain its digest and display prefix. Revoke keys no longer needed. Keyed generation consumes the same credits as application generation. Listing approved templates and exporting a template are not metered. There is no separate API availability or version-support guarantee; material adverse changes follow section 23 and mandatory switching rights remain available.

## 11. Plans and credits

The [pricing page](/docs/pricing) describes plans, prices and allotments. A billing period starts on the subscription date; the **credit month is the calendar month in UTC**. Monthly credits reset on the first day and do not roll over.

Generation is charged for each rendered page, at the credits per page shown on the pricing page when the document is generated; it is counted per page and not rounded up for each document. Migration currently costs twelve credits per source page on all standard plans; seven pages therefore cost 84 credits. An increase in the credit cost of an operation is a price change under section 23. Document-count illustrations assume four pages per document and are estimates, not a separate entitlement.

Purchased top-up credits have no automatic expiry and survive plan changes. They are removed to the extent still unspent if their payment is refunded or charged back. A free workspace may receive a one-time migration grant subject to the programme's monthly issuance limit; the usage screen shows the actual balance.

Operations stop when available credits are exhausted. There is no automatic top-up or usage overage charge. The service shows usage warnings and sends usage-cap emails where a deliverable contact is available. Export is not charged against credits. Deleting a workspace forfeits its remaining credits except where a refund is required by law or this agreement; export your content first.

## 12. Payment, tax and invoices

**NUTLET SIA is the seller.** Stripe processes payments and provides hosted checkout/billing facilities. It does not replace us as seller. It may process some payment data for its own legal and fraud-prevention purposes, as described in its own notice.

A purchase shows its price, billing interval and applicable taxes before you pay. Public net-price labels do not replace the tax-inclusive total provided before a consumer is bound. Subscription charges recur until cancellation; top-ups are one-off purchases. Invoices are issued for subscription and top-up payments. Contact support if an invoice is missing or needs a lawful correction.

Latvian domestic supplies are subject to Latvian VAT where required; a Latvian VAT number does not itself produce reverse charge. Eligible cross-border EU business supplies use reverse charge, with the required invoice wording. EU consumer supplies are taxed in Latvia where the small-supplier place-of-supply conditions apply, and otherwise at the applicable destination rate. We collect other taxes where legally required. Providing incomplete or incorrect tax details can require a correction. We remain responsible for our own registration, invoicing and collection duties; we do not transfer our penalties or compliance failures to you.

If a subscription becomes delinquent or otherwise inactive, metered operations may stop while reading, editing and export remain available. We may suspend the workspace for non-payment no sooner than 14 days after the first failed payment, after notice. Termination for non-payment follows section 21. A failed payment does not itself request deletion of your content.

## 13. Cancellation and refunds

Cancel a paid plan through Settings → Plans and the hosted billing portal, or contact support. Ordinary cancellation takes effect at the end of the current paid billing period, prevents the next renewal and returns the workspace to Free. Purchased credits remain available. Upgrade timing and any adjustment are shown before confirmation.

Ordinary cancellation does not refund the current period or unused monthly credits. This is subject to section 4, section 20's serious-failure refund and any other mandatory remedy. Refund requests are handled by a person at support@ristmark.app; an automatic refund screen is not required to make a request. A refund of purchased credits removes the corresponding unspent credits.

## 14. Content and intellectual property

Your content remains yours or your licensors'. You must have the rights and authority to upload and process it. You grant us and our authorised recipients the non-exclusive rights needed to host, transmit, render, transform and return it solely to provide the service, subject to Annex A. Any residual backup licence is limited to protected storage pending deletion; it does not permit further use.

We do not use your documents or reviewer corrections to train, fine-tune or evaluate shared AI models. Corrections may improve suggestions within your own workspace; they are not pooled across customers. The recipient list identifies the AI provider, and the privacy policy describes its retention.

Our software and documentation remain ours or our licensors'. We grant you a non-exclusive right to use the hosted service during the agreement. You may use, edit and export the templates and documents you create, including those based on our samples, subject to third-party rights. Feedback may be used without payment; that does not license your confidential document content for unrelated purposes.

## 15. Confidentiality

Each party protects the other's non-public information with reasonable care, uses it only for this agreement and discloses it only to authorised people under confidentiality duties. This excludes information lawfully public, already known, independently developed or lawfully received without restriction. Disclosure compelled by law is limited to what is legally required, with notice where permitted. Document content remains confidential while held; other confidential information remains protected for three years after termination, and trade secrets for as long as legally protected.

## 16. Acceptable use and suspension

Do not upload unlawful content or content you lack rights to process; infringe others' rights; compromise accounts or systems; distribute malware; evade access controls, rate limits or credit caps; or resell the hosted service without permission. Use must also comply with sanctions and export restrictions applicable to you or to our provision of the service. Statutory rights to interoperability and other non-excludable rights are unaffected. Producing documents for your own customers is permitted.

The standard service is for ordinary business documents. **Do not submit special-category personal data** (health, genetic data, biometric data used to identify a person, racial or ethnic origin, political opinions, religion or philosophical beliefs, trade-union membership, or sex life/sexual orientation), criminal-conviction or offence records, or similarly regulated sensitive personal data. This restriction applies to uploads, templates, generation inputs, filenames, workspace names and support attachments. Ordinary business contact details, signatures, invoices and contracts remain permitted when they do not contain these excluded categories and you have lawful authority to process them.

Do not submit payment-card numbers, security codes or other PCI-DSS cardholder/authentication data, passwords or private access keys. Payment details belong only in the payment provider's designated checkout. Do not use the standard service for processing that requires a HIPAA business associate agreement or another sector-specific agreement we have not entered into. Any future exception requires our separate written agreement and suitable vendor coverage and safeguards **before** the data is submitted; a support request or your own consent does not create an exception. Minimise permitted content, restrict workspace access and review outputs before use affecting a person's life, safety or legal rights. If you discover an excluded upload, stop processing it and contact support without resending the content.

We may restrict access where reasonably necessary for unlawful use, a material breach, compromise or a legal duty. Where practicable we notify you and allow correction first; urgent protective action may be immediate. We explain the reason, scope and available means to challenge the restriction unless legally prohibited, and lift it when its cause is resolved. Write to support@ristmark.app to challenge a restriction or report unlawful content, identifying the content, location and reason. We review substantiated notices promptly, without requiring public disclosure of private documents.

## 17. Best-effort service and support

We provide the service with reasonable skill and care on a best-effort basis. There is no guaranteed uptime, response time, uninterrupted availability, accuracy level or service-credit programme. Support is by email; one business day is an aim, not a service level. Statutory and Annex A deadlines still apply.

We may maintain, change or withdraw capabilities. Material adverse changes to paid capabilities follow section 23. If we permanently withdraw a paid core capability without an adequate replacement, you may end the affected paid service without waiting for another renewal. Statutory reimbursement and content-return rights remain available; section 20 addresses a serious failure attributable to us.

## 18. Personal data and recipients

For customer content we act as your processor, or sub-processor where you process for another controller. You must have authority to instruct us. For account administration, billing and support correspondence administration we act as controller. Troubleshooting document content on your instructions remains within Annex A.

The [recipient list](/subprocessors) states each recipient's role, data, location and transfer safeguard. We send personal data to a recipient only once the required agreement and lawful transfer basis are in place. Annex A governs authorisation, prior notice, objections and onward duties.

## 19. Warranties and your checks

Except for reasonable skill and care, express commitments in this agreement and rights required by law, the service is provided **“as is” and “as available.”** To the extent lawful we disclaim implied warranties of fitness, accuracy, non-infringement and uninterrupted operation. You choose whether the service suits your needs and must review outputs and keep your own copies. These checks do not excuse our own mandatory obligations or remove consumer conformity remedies.

## 20. Liability and serious-failure refund

Nothing limits or excludes liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or anything else that cannot lawfully be limited. Individuals' statutory data-protection compensation rights remain unaffected.

**Business customers.** Subject to those exceptions, our aggregate liability arising from the service or this agreement is capped at the service fees you actually paid us, excluding taxes, during the **30 days immediately preceding the first event giving rise to the claim**. This includes subscription and top-up fees in that period. Related events count together and do not create repeated caps. If you paid nothing in that period, the cap is zero. This is a low cap: keep independent copies and checks for work whose loss would exceed it. It applies to claims in contract, tort (including ordinary negligence) or otherwise, only to the extent lawful. It does not reduce a separate obligation to repay charges under this agreement or mandatory law, or limit a regulator's powers.

Subject to the same exceptions and only where lawful, neither business party is liable for lost profits, revenue, business, goodwill, anticipated savings, or loss/corruption of data, whether direct or indirect. A contribution claim under GDPR Article 82(5) is subject to a contractual limitation only to the extent applicable law permits; this agreement does not assert that a statutory recourse right can always be capped.

**Serious failure by us.** If a material failure attributable to us prevents use of a paid core capability and we cannot remedy it within a reasonable period after notice, you may cancel the affected service and request repayment of the latest monthly subscription charge for the affected period. This is a repayment remedy, not a promise of availability or a substitute for mandatory remedies. It does not limit refunds required on withdrawal or for undelivered performance. For the same loss, amounts already recovered are taken into account to avoid double recovery where lawful.

**Consumers.** The business cap and business loss exclusions do not apply to you. We remain responsible to the extent required by the law applicable to your contract. No “use at your own risk” statement removes those rights.

## 21. Duration, termination and deletion

The agreement starts on acceptance. Cancelling a subscription leaves the Free workspace and this agreement in place. To end the workspace service, request workspace deletion or contact support for return/deletion under Annex A.

We may terminate for a material breach not remedied within 30 days of written notice, serious irremediable abuse, non-payment remaining unresolved for 30 days after written notice, or a legal requirement. For a planned discontinuation for other reasons we give 30 days' notice where reasonably practicable and provide the exit assistance required by Annex C. We do not promise 90 days of continued operation regardless of circumstances. Termination does not remove accrued mandatory repayment rights.

Export an approved template and its referenced assets through the export API. Without using the API, the workspace Owner can ask for any template or the whole workspace through **Settings → Your data → Request my data export**, or by writing to support; we deliver it under Annex C. Export is unmetered and available despite an exhausted credit balance or unpaid subscription while access remains lawful. Annex C describes the scope and formats.

A workspace-deletion request disables ordinary access and starts a **30-day grace period**, during which the request can be cancelled through settings. Once due, the scheduled erasure process removes data in batches and may require retries; the grace-end date is not a guarantee that every copy has been destroyed at that instant. Deletion of a workspace also requests immediate subscription cancellation, rather than ordinary period-end cancellation. Deleting a template places it in trash for **90 days** before scheduled purge. Completed destruction cannot be reversed through the application.

The [privacy policy](/privacy) explains category-specific retention and residual records, including backup and third-party limitations. Ordinary UI grace periods do not override a valid statutory erasure deadline or a documented end-of-processing instruction. Contact support for either. We retain only records necessary for legal obligations or substantiated claims, with restricted access and periodic review. Data-protection, confidentiality, accrued payment and liability obligations survive to the extent relevant.

## 22. Separate deployments

On-premises, BYOK and other separately licensed deployments require their own written agreement. These terms grant no software-distribution or self-hosting licence.

## 23. Changes

We change terms or paid features for a legal, security, technical or commercial reason and identify material changes. A change materially reducing your contractual rights or increasing charges applies no earlier than the first renewal at least **30 days after written notice**, allowing cancellation before it takes effect. A legally necessary urgent change may apply sooner only to the extent necessary and with notice as soon as permitted. Applicable consumer rules for changes to digital services prevail.

Changes do not increase charges for an already paid period or reduce purchased-credit balances. If a change materially prevents use of purchased credits, we provide an appropriate remedy rather than relying on a nominal unchanged balance. Sub-processor changes follow Annex A. We retain the previously accepted version; continued use is not relied on where law requires express agreement.

## 24. Law and disputes

Latvian law governs, subject to mandatory protections applicable elsewhere. For business disputes Latvian courts have jurisdiction, without restricting legally available interim relief. Consumers retain the protections and forums provided by applicable consumer law; this is not an agreement to sue them only in Latvia. Data subjects and supervisory authorities retain their statutory remedies and jurisdiction. Contact support first if you want us to try to resolve a concern; this does not restrict court or regulator access.

## 25. General and notices

Send notices to support@ristmark.app or our registered office. We send contractual notices to the workspace Owner's email and any additional legal/billing contact you designate in writing; keep these current. Notices may be sent manually. We remain responsible for subcontracted performance to the extent required by this agreement and law.

Neither party may transfer this agreement in a way that unlawfully reduces the other's rights. We may transfer it with the business on written notice; you may object and end the affected service before transfer, subject to mandatory remedies. Events outside reasonable control excuse delay only to the extent legally permitted and do not excuse data-protection duties, required refunds or reasonable mitigation. Either party may end affected performance after a prolonged disruption of 60 days.

These documents are the agreement for the hosted service. Failure to enforce a provision is not waiver. If a provision is unenforceable, the remaining provisions apply where lawful; an unfair consumer term is not rewritten merely to preserve its effect. English is the drafting language, without overriding required local-language information.

## 26. Contact

**support@ristmark.app** · NUTLET SIA, registration 40203464033, VAT LV40203464033 · Pļavu iela 6, Sēbruciems, Babītes pag., Mārupes nov., LV-2107, Latvia.

# Annex A — Data processing terms

**A1. Scope and roles.** This annex applies to personal data in customer documents, templates, saved block recipes, input data, generated outputs, source images, review decisions and document-content support requests. You are controller or an authorised processor; we are processor or sub-processor accordingly. Subject matter: hosted document migration, editing, consolidation and generation. Activities: receiving, storing, rendering, rasterizing, reconstructing, classifying fields, transforming, returning and deleting content. Processing lasts for the service and the agreed return/deletion period.

Expected individuals are your staff, contractors, customers, suppliers, correspondents and people identified in ordinary business documents. Expected data includes names, business/personal contact details, ordinary identifiers, signatures contained in source files, contract/invoice details and text/image content. You select and minimise that content and remain responsible for notices, legal grounds, authority for your instructions and any assessment required of you. **No special-category or criminal-offence data is authorised under the standard service.** The exclusions in section 16 apply throughout this annex. We assist required assessments and must not use a recipient whose terms or safeguards do not permit the processing. If excluded data is submitted inadvertently, this annex's confidentiality, security, incident, assistance and return/deletion duties still apply; its arrival does not authorise continued routine processing or a new purpose.

**A2. Instructions and transfers.** We process only on your documented instructions, including lawful use of the agreed features and written support/return requests. These instructions include only transfers to authorised recipients with a lawful mechanism. We inform you if we believe an instruction infringes applicable data-protection law and suspend the disputed processing while it is resolved. If EU or Member State law requires other processing, we notify you first unless prohibited. A third-country disclosure demand is assessed against applicable law, including GDPR Article 48; its receipt alone does not authorise disclosure. We seek narrowing/challenge where appropriate and notify you where permitted.

**A3. Confidentiality.** Authorised personnel are subject to confidentiality and receive only the access needed for their tasks. Section 15 and Annex B apply.

**A4. Security.** We maintain measures appropriate to the risk under GDPR Article 32. Annex B is the agreed security schedule. Measures may evolve without materially reducing overall protection. No certification is implied. Assistance with security, breach notifications, DPIAs and prior consultations takes account of the processing and information available to us.

**A5. Sub-processors.** You generally authorise the sub-processors identified for your content on the recipient list, subject to established contracts and lawful transfers. We impose equivalent applicable data-protection obligations on each downstream processor and remain responsible as Article 28(4) requires. An infrastructure provider used by one of our vendors is identified on the list as indirect.

We actively notify your Owner/designated contact in writing at least **30 days before** adding or replacing a content sub-processor that we engage directly and update the list. For changes further down a listed provider's processing chain, we pass on its notice promptly and before the new recipient processes your affected data, giving you a reasonable opportunity to object; the available period may be shorter than 30 days. We require prior-notice and objection arrangements in that chain. You may object on reasonable data-protection grounds during the applicable notice period. We discuss an alternative; pending resolution we do not send your affected data to the disputed recipient, including by stopping the affected processing where necessary. If no reasonable alternative is available, you may terminate the affected service, with no further charges after the current period and with mandatory reimbursement rights preserved. The ordinary commercial remedy does not include cashing out credits merely because of an objection.

For an urgent replacement we use an already-authorised alternative, obtain your specific prior written authorisation for a shorter period, or suspend affected processing. Service continuity alone does not excuse prior authorisation or lawful-transfer requirements.

**A6. Breach.** We notify you without undue delay after awareness of a personal data breach affecting your content. We provide available facts about the incident, data/individuals affected, likely consequences, containment and contact, and supplement them as investigation progresses. We do not wait for a completed investigation. You decide controller notifications; we assist and meet any separate legal duty applying to us.

**A7. Rights and assistance.** We forward content-related data-subject requests to you and help you respond, considering the processing and technical means available. We do not independently answer on your behalf without instruction except as law requires. Reasonable fees for exceptional assistance must be agreed in advance and must not obstruct statutory compliance; assistance necessitated by our own breach is not charged to you.

**A8. Return and deletion.** At the end of the content-processing service you choose return followed by deletion, or deletion. We make export available before destruction and delete remaining copies once return is complete, subject only to applicable legal retention and the protected backup retirement procedure. Ordinary cancellation to Free does not end processing. A deletion instruction covers downstream copies; we obtain appropriate confirmation, not merely forward an email. Any legally retained copy is isolated, limited to that legal purpose, and deleted when the requirement ends. Backup residuals remain inaccessible for ordinary use; after a restore, outstanding deletions are re-applied before reopening service. The ordinary settings countdown does not prevent an earlier lawful deletion instruction. Annex C governs applicable switching and retrieval rights.

**A9. Demonstrating compliance.** We provide necessary compliance information and allow and contribute to audits, including inspections by you or a mandated independent auditor. Routine audits normally start with documents and reasonable notice, ordinarily 30 days, and may be coordinated to avoid duplicate work. They are not automatically satisfied by our written answers. An incident, substantiated compliance concern or regulator requirement permits additional audits and shorter notice proportionate to urgency. Protect other customers and confidential information. Reasonable routine costs may be agreed; costs or scheduling must not defeat the right or legally required access.

**A10. US state protections.** Where applicable, we act as service provider/contractor or processor for customer personal information. The specific business purposes are storing customer documents, converting and rendering them, identifying/template-binding fields, generating requested documents, maintaining workspace-specific review corrections and troubleshooting that processing. We do not sell or share this information, use or disclose it for other commercial purposes or outside the direct business relationship, or combine it with information from other customers or our own unrelated interactions, except where the applicable law expressly permits.

We comply with applicable privacy requirements and provide the same level of protection required of the business. We assist consumer requests, security obligations and applicable risk assessments, audits and automated-decision requirements. You may take reasonable and appropriate steps to monitor compliance and, on notice, stop and remediate unauthorised use. We notify you if we determine that we can no longer comply. Our downstream contracts carry the corresponding restrictions and duties. We cooperate in deletion/correction/access and enable you to provide the legally required response. These obligations apply to covered customer processing independently of whether our separate controller business meets a revenue threshold.

# Annex B — Security measures (version 2026-10-07)

- Identity-provider sign-in; workspace and team authorisation enforced by the server and scoped repository queries. We do not claim database row-level security.
- API keys stored as digests; file access requires short-lived signed workspace grants. Support impersonation grants are shorter-lived and operator actions are audited.
- Transport security and browser hardening headers; restrictive application access and a limited database runtime role.
- Logging minimises content and masks specified sensitive patterns. Error-report payloads are allowlisted; redaction cannot guarantee that no unforeseen personal data ever enters a diagnostic record.
- Database backup bundles are encrypted; off-site object copies use provider encryption and object-lock protection. Backups currently require operator execution; there is no scheduled-backup or recovery-time guarantee. Backup retirement and restored-data deletion are operator responsibilities under Annex A.
- Access control, confidentiality, incident handling, rights requests, retention review and vendor authorisation are administered by the service operator under the SIA's responsibility. We maintain records of these actions and review measures as risks change.

We hold no SOC 2 or ISO 27001 certification. These measures do not promise perfect security or a particular availability level.

# Annex C — Switching, return and export

Use **Settings → Your data → Request my data export**, or contact support@ristmark.app, to request switching to another provider, movement to your own infrastructure or return/deletion. Identify the workspace and desired scope; we verify authority and agree a practical schedule. No minimum notice is required to start a request. Where the EU Data Act applies, we provide reasonable assistance, maintain security and continuity to the extent required, and remove obstacles within our responsibility.

We begin without undue delay and normally complete the transition within **30 calendar days** of your request, or a later start you request. If the applicable Data Act conditions for technical infeasibility are met, we explain the reasons within 14 working days of your request and propose an alternative transition no longer than seven months. You may extend the transition once for a period you consider more appropriate as provided by that Act. We provide at least **30 calendar days to retrieve exportable data after transition**, unless you choose earlier deletion. Termination occurs on successful switching or at the agreed lawful deletion point; mandatory law prevails over ordinary billing-period rules. We do not charge a separate switching or data-egress fee. Ordinary charges for service supplied during transition may continue as disclosed, subject to mandatory rules.

**Exportable data and formats:** templates, their field/schema definitions, sample data and referenced assets are available as canonical JSON with embedded base64 assets: approved templates through the export API, and any template on request through Settings or support. On request, workspace-level customer content (including saved block recipes and their available assets), review decisions, relevant customer usage/job records and membership information are returned in JSON/CSV and original available asset formats. Generated exports are streamed to you and are not retained as a separate output archive; keep the files you download. Return covers files still held and does not recreate files already lawfully deleted under the disclosed schedule. Credentials, security secrets, proprietary model/system instructions and internal platform implementation data are excluded; exclusions do not remove customer-provided content or lawfully exportable metadata. The [export register](/docs/export) describes interfaces and formats.

We assist transfer of exportable data and digital assets within our control but do not promise that another product can reproduce every Ristmark feature. After retrieval we delete remaining customer content under Annex A, except any legally required copy. We do not erase content during an agreed retrieval period without your instruction.