Customer Terms for Toolcape

Version 1.0, effective from 4 November 2026

This is a translation. The Norwegian version of the agreement applies (clause 18.3).

Key terms in brief

• Dyst's total liability for the whole term of the agreement is limited to the fees for the twelve months before the incident, and is at least NOK 25,000 (clause 12.3).
• Dyst is not liable for indirect loss, including lost profit, business interruption, third-party claims, fines and penalties imposed on the Customer, and loss of data beyond restoration from backup (clauses 12.2 and 12.5).
• Claims must be notified in writing within three months after the matter was discovered, and no later than 24 months after it occurred (clause 12.8).
• The Customer is responsible for users, setup and access, also when a partner does the setup, and for checking results before relying on them (clause 4 and the product terms).
• The Customer indemnifies Dyst against third-party claims caused by the Customer's data, instructions or use in breach of the Agreement or the law (clause 13).
• The Customer may terminate at any time, effective at the end of the month (clause 10.2).

This summary is an overview. In case of conflict, the clauses it refers to apply.

1. About the Agreement

1.1 These customer terms apply when a business (the "Customer") uses Toolcape (the "Service"), which is provided by Dyst AS, org. no. 934 222 946, Losbyveien 1, 1475 Finstadjordet, Norway ("Dyst").

1.2 The agreement between the Customer and Dyst (the "Agreement") consists of:

a) these customer terms, b) the product terms for the Service, c) the data processing agreement with its annexes, d) the prices under clause 9, and e) any special agreements under clause 1.5.

1.3 In case of conflict, the documents apply in this order: special agreements, the data processing agreement, the product terms, the customer terms and the prices shown in the Service. The data processing agreement nevertheless prevails only for duties when processing personal data, not for liability. Clauses 12 and 13 prevail over all other documents, unless a special agreement expressly refers to and amends them. The privacy policy is information and not part of the Agreement. The Documentation describes the Service, but gives the Customer no rights other than those that follow from clause 3.2.

1.4 The Service is offered to businesses only. The Customer must have an organisation number and use the Service in its business. A sole proprietorship may be a Customer when the Service is used in its business. The Service may not be used for private purposes.

1.5 Price, invoicing, trial period and other commercial terms may be agreed specially with the Customer. A special agreement must be in writing, which includes email, and confirmed by Dyst. It does not amend clauses 12 and 13 unless it expressly says so.

1.6 The Agreement is entered into when an Administrator accepts it in the Service on behalf of the Customer, or when it is signed. Until the Service has a solution for such acceptance, the Customer accepts the Agreement by using the Service after this version has been published. Anyone who accepts, signs or uses the Service on behalf of the Customer confirms that they have authority to bind the Customer. When the Agreement is accepted in the Service, Dyst stores the accepted version and sends a copy to the person who accepted.

2. Definitions

• "Administrator": a User with the right to administer the Customer's account, access and agreements in the Service.
• "User": a person to whom the Customer has given access to the Service.
• "Documentation": Dyst's descriptions of the Service, as available at any time in the Service or on Dyst's websites.
• "Incident": a matter that gives rise to a claim. Several claims caused by the same fault, failure or cause count as one Incident.
• "Customer Data": data that the Customer, the Users or Connected Services enter into or make available through the Service, including personal data.
• "Partner": a business other than Dyst that sells, sets up or follows up the Service for the Customer.
• "Connected Services": systems, AI clients and other services that the Customer connects to the Service, see clause 5.4.
• "Fees": the amounts the Customer pays or is to pay for the Service, excluding VAT.

3. The Service

3.1 The Customer receives a non-exclusive right to use the Service during the term of the Agreement in its own business, with the modules and scope the Customer has chosen. The right cannot be transferred or sublicensed.

3.2 Dyst shall deliver the Service with professional care, and the Service shall essentially work as described in the Documentation. Dyst makes no other promises about the Service's features, results or fitness for a particular purpose, unless the Agreement says so.

3.3 Dyst develops the Service continuously and may change, add and remove features. If Dyst removes or reduces material features the Customer pays for, Dyst shall give at least 30 days' notice, and the Customer may terminate the Agreement with effect from the change.

3.4 Dyst works to keep the Service available and working, but does not promise a specific uptime or error-free operation. Planned maintenance is announced when practically possible. An agreement on availability and compensation (SLA) applies only when specially agreed.

3.5 Support is provided at [email protected]. Response times are not guaranteed unless specially agreed.

3.6 Features marked as beta or test may be incomplete and may be changed or removed without notice. Clause 12 also applies to them.

3.7 Some features use artificial intelligence (AI) to create text, explanations, summaries or suggestions. Such content may be wrong or incomplete. The Customer shall check it before relying on it, and it shall never be the only basis for decisions that have legal or similarly significant effects for a person.

4. The Customer's responsibility

4.1 The Customer decides who shall be Users and Administrators, and is responsible for the Users' use of the Service as for its own. The Customer shall ensure that the Users follow the user terms, that login details are kept secret, and that access is removed when no longer needed. The Customer shall notify Dyst without undue delay if unauthorised access is suspected.

4.2 The Customer is responsible for setup, settings, access, integrations and other content in the Service, also when this is done by Partners or others acting on the Customer's behalf.

4.3 The Customer shall use the Service in accordance with the Agreement and the law. The Customer shall not, and shall ensure that the Users do not:

a) enter or spread unlawful content or malicious code, b) attempt to circumvent security measures or gain access to the data of others, c) load the Service in a way that hinders operations or the use of others, d) copy, decompile or imitate the Service beyond what the law permits, e) resell the Service or give third parties access to it without an agreement with Dyst, or f) use the Service to develop a competing service.

4.4 The Customer is responsible for Customer Data, including that it is correct and lawful, that the Customer has a legal basis for the processing, that the data subjects have been informed, and that the Customer fulfils its own statutory duties on documentation, retention and reporting. The Customer shall check results from the Service before relying on them, and is responsible for decisions, actions and omissions based on them.

4.5 The product terms describe what the Customer must additionally check and is responsible for in the Service.

5. Partners and Connected Services

5.1 Partners are independent businesses. They act for the Customer and are not Dyst's subcontractors, agents or employees. A Partner cannot enter into, amend or waive agreements on behalf of Dyst, and promises from a Partner do not bind Dyst.

5.2 The Customer decides whether a Partner shall have access to the Service, may withdraw the access at any time, and answers for the Partner's actions in the Service as for its own. The Customer shall have its own agreement with the Partner, with a data processing agreement when the Partner gets access to personal data.

5.3 Dyst may pay Partners commission for customers they have referred or follow up.

5.4 Systems, AI clients and other services that the Customer connects to the Service are provided on the provider's terms and are the Customer's providers, not Dyst's. Dyst is not liable for Connected Services, for data after it has been delivered to them, or for changes, errors or outages at them.

6. Subcontractors

Dyst may use subcontractors to deliver the Service. Subcontractors that process personal data are listed in the list of subprocessors at toolcape.com/en/subprocessors. The list is changed in accordance with the data processing agreement.

7. Customer Data and Dyst's use of data

7.1 The Customer retains all rights to Customer Data. Dyst may use Customer Data only to deliver the Service in accordance with the Agreement and the data processing agreement.

7.2 Dyst may create anonymised and aggregated data from Customer Data and use it for statistics, comparisons, quality work, development of the Service and publication of statistics. Such data shall no longer reasonably be linkable to the Customer, a User or another person, and shall not reveal the Customer's trade secrets. Pseudonymised data does not count as anonymised. Dyst does not use Customer Data for other purposes of its own.

7.3 Dyst processes information about the use of the Service, such as logs, error messages and performance data, to operate, secure, troubleshoot and invoice the Service. When such information is used to improve the Service, it is used in anonymised or aggregated form.

7.4 Dyst backs up Customer Data as described in the data processing agreement. The Customer is itself responsible for exporting and retaining data the Customer is legally obliged to retain.

7.5 The Customer may export Customer Data during the term of the Agreement and for 60 days after termination, in a common machine-readable format, itself in the Service or on request. Customer Data is then deleted in accordance with the data processing agreement. Dyst never withholds Customer Data because of a dispute about payment.

8. Rights

8.1 Dyst and Dyst's licensors hold all rights to the Service, the software, the Documentation and improvements to them, also when the improvements are based on feedback from the Customer. The Agreement gives the Customer a time-limited right of use and does not involve a sale of software or goods.

8.2 Dyst may freely use suggestions and feedback from the Customer and the Users.

8.3 If a third party claims that the Service infringes the third party's intellectual property rights, Dyst may change or replace the part of the Service the claim concerns, obtain the necessary rights, or terminate the Agreement and refund prepaid Fees for the period after termination. Beyond this, the Customer may only claim damages under clause 12. This clause does not apply to claims caused by Customer Data, Connected Services, the Customer's changes or use in breach of the Agreement.

9. Price and payment

9.1 The prices are those agreed with the Customer under clause 1.5, or those shown in the Service. How the price is calculated is set out in the product terms.

9.2 Unless otherwise agreed, the Service is invoiced monthly in arrears based on actual use during the month. The payment term is 14 days. Late payment interest accrues under the Norwegian Late Payment Interest Act (forsinkelsesrenteloven). Objections to an invoice must be made in writing within 60 days of the invoice date.

9.3 Dyst may change the prices with at least 30 days' notice. A price change applies from the first day of a calendar month. The Customer may terminate the Agreement before the change takes effect, and then pays the current price until the Agreement ends. Price reductions may apply immediately.

9.4 The Customer may be given a trial period. The trial period is free unless otherwise agreed, and its length and terms follow from a special agreement or from what is shown in the Service. The Agreement also applies during the trial period. When the trial period expires, the Agreement continues against payment, unless the Customer terminates before it expires. Dyst notifies the Customer before the trial period expires.

9.5 Prices are stated excluding VAT and other public charges.

10. Term, termination, suspension and expiry

10.1 The Agreement applies until terminated.

10.2 The Customer may terminate the Agreement at any time, effective at the end of the calendar month in which the notice is received. Use until the end of the month is invoiced.

10.3 Dyst may terminate the Agreement with six months' notice. For free use and during trial periods, the notice is 30 days.

10.4 Either party may terminate the Agreement with immediate effect if the other party materially breaches the Agreement and has not remedied the breach within 30 days after written notice. Dyst may also terminate the Agreement with immediate effect if the Customer uses the Service unlawfully, or if continued delivery would cause Dyst to breach the law or sanctions rules.

10.5 Dyst may suspend the Service in whole or in part:

a) immediately, when necessary to avert a security threat, unlawful use or serious harm, or when an authority requires it, and b) for non-payment, when an amount due has not been paid within a deadline of at least 14 days after written notice.

The suspension shall be proportionate. The Customer shall be notified as soon as possible, and the Service shall be reopened when the reason has ceased. Customer Data is not deleted during the suspension.

10.6 On expiry, the Customer's right of use ends. The Customer pays for use until expiry, and may export Customer Data under clause 7.5. Clauses 7.5, 8, 11, 12, 13, 17 and 18 continue to apply after expiry.

11. Confidentiality

11.1 The parties shall keep confidential information they receive about each other through the Agreement secret, and use it only to perform the Agreement. The duty applies during the term of the Agreement and for three years after expiry. For trade secrets, the duty applies as long as they remain secret.

11.2 The duty does not apply to information that is generally known, that the party already had or has developed itself, or that the party must disclose under law or an order from an authority. The party shall in that case notify the other party when permitted.

11.3 The parties shall ensure that employees, subcontractors and advisers who get access to confidential information are bound by a corresponding duty of confidentiality.

12. Liability and limitation of liability

12.1 Dyst is liable in damages to the Customer only for direct loss caused by Dyst's negligent breach of the Agreement.

12.2 Dyst is not liable for indirect loss. Indirect loss includes, among other things:

a) lost profit, turnover, savings and goodwill, b) loss due to business interruption, downtime or the Service not being usable as intended, c) loss due to the Customer's agreements with third parties lapsing or not being fulfilled, d) claims from third parties, including the Customer's employees, drivers, customers and suppliers, except recourse claims under clause 12.6, e) fines, administrative penalties (overtredelsesgebyr), coercive fines, taxes, duties, additional tax, back pay with interest and other sanctions or claims from public authorities against the Customer, f) loss due to loss of a licence, permit or good repute, and g) loss of or damage to data, except restoration under clause 12.5.

12.3 Dyst's total liability for all claims in connection with the Agreement is, for the whole term of the Agreement, limited to the higher of:

a) the Fees the Customer has paid or is to pay for the Service for the twelve months before the first Incident giving rise to a claim, and b) NOK 25,000.

If the Agreement has run for less than twelve months, the amount under letter a is calculated from the average monthly Fees multiplied by twelve. The limit also covers claims for price reduction and repayment and claims under the data processing agreement. For free use and during trial periods, the limit in letter b applies.

12.4 The limitations in clauses 12.2, 12.3, 12.5 and 12.7 do not apply:

a) to loss caused intentionally or by gross negligence by Dyst or anyone Dyst is responsible for, except providers of standardised cloud services on the list of subprocessors, b) in case of personal injury, or c) to the extent mandatory law prevents them.

12.5 If Customer Data is lost or damaged due to circumstances Dyst is responsible for, Dyst shall restore the data from the latest available backup at no cost to the Customer. This is the Customer's only remedy for loss of or damage to data.

12.6 The limitations also apply to claims between the parties in connection with the processing of personal data, including claims under the data processing agreement, liability for subprocessors and recourse claims under Article 82(5) of the General Data Protection Regulation. Such recourse claims count as direct loss within the limit in clause 12.3. The Agreement does not limit the rights of data subjects or the powers of the authorities. Each party bears any administrative fine, coercive fine and other sanction imposed on that party, and cannot claim it covered by the other party.

12.7 The limitations apply to every claim in connection with the Agreement, whether the claim is based on contract, tort or another ground. The Customer cannot claim more from Dyst's employees, board members or subcontractors for matters covered by the Agreement than the Customer could have claimed from Dyst under this clause 12.

12.8 Claims must be made in writing, with a description of the matter and the estimated loss, within three months after the Customer discovered or should have discovered the matter. Claims can in any case not be made later than 24 months after the matter occurred. The deadlines do not apply in case of intent or gross negligence as referred to in clause 12.4 letter a, or if Dyst has otherwise acted contrary to honesty and good faith.

12.9 In case of errors in the Service, Dyst shall remedy the error within a reasonable time after being notified of it. If Dyst does not remedy a material error within a reasonable time, the Customer may terminate the Agreement with immediate effect and shall not pay for the period after termination. Beyond this, the Customer may only claim damages under this clause 12.

12.10 The limit in clause 12.3 applies correspondingly to the Customer's liability towards Dyst. It does not, however, apply to the Customer's payment obligations, to indemnification under clause 13, to breach of clause 4.3 or clause 8, or to loss caused intentionally or by gross negligence.

12.11 If a limitation or deadline in this clause 12 cannot be fully enforced, it applies to the extent the law permits, and the other limitations and deadlines apply in full.

12.12 The parties agree that the prices for the Service are set on the basis of the allocation of liability in clauses 12 to 14.

13. The Customer's indemnification

13.1 The Customer shall indemnify Dyst against claims from third parties, and against reasonable costs of handling such claims, to the extent the claim is caused by:

a) Customer Data, the Customer's instructions or the Customer lacking a legal basis for the processing, or b) the Customer, the Users, Partners or Connected Services having used the Service in breach of the Agreement, the terms of the provider of a Connected Service or the law.

Third parties include, among others, data subjects, the Customer's employees and drivers, the Customer's customers and providers of Connected Services.

13.2 Clause 13.1 does not apply to the extent the claim is caused by Dyst's breach of the Agreement, and does not cover administrative fines or other sanctions imposed on Dyst.

13.3 Dyst shall notify the Customer of the claim without undue delay and give the Customer an opportunity to comment before the claim is settled.

14. Force majeure

14.1 Neither party is liable for breach caused by circumstances beyond the party's control, which the party could not reasonably have foreseen when the Agreement was entered into, and whose consequences the party could not reasonably have avoided or overcome. Such circumstances include war, terrorism, natural disaster, fire, pandemic, extensive failure of power supply, the internet or other general infrastructure, orders from authorities and labour disputes.

14.2 Such circumstances also include:

a) cyberattacks that could not have been prevented by security measures that were reasonable at the time, and b) failure at Dyst's subcontractors caused by a circumstance as referred to in clause 14.1 for the subcontractor, when Dyst could not reasonably have limited the consequences.

Failure to implement the security measures described in the data processing agreement does not count as force majeure.

14.3 The affected party shall notify the other party without undue delay. If the circumstance lasts for more than 60 days, either party may terminate the Agreement with immediate effect.

15. Changes to the Agreement

15.1 Dyst may change the Agreement. Changes are notified by email to the Customer's Administrators and in the Service.

15.2 Changes that are materially to the Customer's detriment take effect no earlier than 30 days after the notice. An Administrator must accept them before the Customer can continue using the Service after they have taken effect. The Customer may instead terminate the Agreement with effect from the date of the change, at no cost.

15.3 Other changes may take effect from the notice.

15.4 Changes required by law or authorities, or necessary for security reasons, may take effect with shorter notice than under clause 15.2.

15.5 Price changes follow clause 9.3. Changes to the data processing agreement follow the rules of the data processing agreement.

16. Assignment

Dyst may assign the Agreement to a company in the same group or to whoever takes over the business or the Service, with notice to the Customer. The Customer may not assign the Agreement without Dyst's written consent.

17. Notices

Notices under the Agreement are given in writing, which includes email. Dyst sends notices to the Administrators and the contact person the Customer has registered in the Service. The Customer sends notices to [email protected]. The Customer shall keep the contact details up to date.

18. Governing law, disputes and language

18.1 The Agreement is governed by Norwegian law.

18.2 Disputes shall first be sought resolved through negotiations. Disputes not resolved within 30 days after a party has requested negotiations shall be settled by the ordinary courts, with Oslo District Court (Oslo tingrett) as the exclusive venue.

18.3 The Norwegian version of the Agreement applies. Translations are for information only.

19. Entire agreement and earlier use

19.1 The Agreement is the entire agreement about the Service and replaces earlier terms. Information in marketing, sales material or from Partners does not form part of the terms unless included in the Agreement.

19.2 The Agreement also applies to the Customer's use of the Service before the Agreement was entered into, including use under the earlier terms for the beta version, but not to matters Dyst knew of and had not disclosed to the Customer.

Product Terms for Toolcape

Version 1.0, effective from 4 November 2026

These product terms apply together with the customer terms for Toolcape. Capitalised words have the same meaning as in the customer terms.

1. What Toolcape is

Toolcape connects AI clients and other tools the Customer uses to the Customer's business systems and other sources ("Sources"), and performs operations in the Sources for the Customer's Users within the access the Customer has granted. AI clients and Sources are Connected Services under clause 5.4 of the customer terms.

2. The Customer decides

The Customer decides which Sources, operations, access, Users and AI clients may be used, and which instructions and settings apply. This also applies to setup that Partners or others do on the Customer's behalf, see clauses 4.2 and 5 of the customer terms.

3. Operations count as the Customer's

3.1 Operations are performed with the access the Customer and the User have granted, and count as performed by the Customer. This also applies to operations that change, delete, send or pay, and to operations caused by errors in an AI client or by manipulation, for example instructions hidden in content an AI client reads.

3.2 Dyst shall enforce the access as it has been set up. Dyst is liable under clause 12 of the customer terms if an operation is caused by Dyst's failure to enforce the access, or other breach on Dyst's part.

4. AI clients

4.1 Dyst is not liable for instructions, answers or actions from AI clients or other tools the Customer uses.

4.2 AI providers the Customer chooses are the Customer's own providers and processors, not Dyst's subprocessors. By connecting an AI client, the Customer instructs Dyst to make data available to it as the access permits. Once the data has been delivered, the Customer is responsible for it, including for transfers outside the EEA.

4.3 The Customer shall only use AI services that have a data processing agreement for personal data, and shall not use Toolcape together with tools or MCP servers the Customer has no reason to trust.

5. Risk of write access

The Customer assesses the risk of access that changes, deletes, sends or pays, ensures human approval where needed, and checks the results.

6. The Sources' terms

6.1 The Customer shall ensure that the use of each Source complies with the provider's terms. Data from a Source shall only be used for the Customer's own purposes.

6.2 Dyst may limit or suspend the use of a Source if the provider requires it, if the use breaches the provider's terms, or if necessary for security reasons.

6.3 On expiry, Dyst deletes access keys and data from the Sources in accordance with the data processing agreement.

7. Employees' email and files

The Customer is responsible for access to employees' email, files and other accounts through Toolcape being lawful, including under the rules on an employer's access to email accounts and other electronically stored material.

8. Bank and payment

Sources that give access to bank accounts or payments are available only by special agreement.

9. Business use only

Toolcape may only be used in the Customer's business. Personal accounts and organisations in Toolcape shall only be used in connection with the Customer's business.

10. Price

The price is calculated per User per month, as agreed with the Customer or shown in the Service.