General Terms and Conditions (GTC) of aethos

Last updated: 16 October 2026

1. Scope and contracting party

1.1 These General Terms and Conditions ("GTC") apply to the use of the aethos platform ("Platform") by Users. The Platform is operated by aethos, owner Michael Peklo (sole proprietor), Goldschlagstraße 3/22, 1150 Vienna, Austria, VAT ID ATU73975647 ("aethos").

1.2 The Platform is intended exclusively for entrepreneurs within the meaning of Section 1 of the Austrian Consumer Protection Act (KSchG). By registering, the User confirms that it uses the Platform exclusively for the purposes of its business and is authorised to enter into the contract. Consumers are excluded from use.

1.3 These GTC apply to all contracts between aethos and the User concerning the Platform, including trial access. Different, conflicting or supplementary terms of the User do not become part of the contract, even if aethos does not expressly object to them.

1.4 Individual agreements may be made for enterprise customers and special cases (e.g. on prices, credits, term, availability/SLA or additional data protection agreements). They take precedence over these GTC to the extent that they expressly deviate from them.

1.5 "User" means any company that creates an account on the Platform, together with the team members it invites. Users may act as rights holders ("Licensor") or as acquirers ("Licensee").

2. Services and role of aethos

2.1 aethos provides a technical infrastructure through which Users can upload assets, submit and accept licence requests, sign licence documents electronically, pay subscription and credit fees to aethos via Stripe, and keep records of licences. The exact scope of functions depends on the plan booked and the current service description on the Platform.

2.2 aethos is exclusively a service provider and provider of the infrastructure. aethos is not a party to licence agreements concluded between Users via the Platform. aethos is neither licensor nor licensee, nor the agent, intermediary, broker, trustee or guarantor of any party.

2.3 aethos does not carry out any review of content, legal matters or commercial matters, in particular regarding

• the existence, scope and transferability of rights in uploaded assets (chain of rights),
• copyrights, neighbouring rights, trademarks, personality rights and data protection rights of third parties,
• the content, validity and adequacy of the licence terms and prices agreed between Users,
• the identity, creditworthiness and contractual reliability of other Users, unless expressly warranted.

2.4 Functions such as duplicate detection, reverse image search (scan), hashing and the transparency log are technical aids. aethos provides only the service for this purpose, delivers raw results and does not evaluate them. Users decide for themselves whether and how they use results, and pursue any resulting claims themselves and at their own cost. Scan results are visible only in the User's account. The results do not constitute proof of rights, legal advice or a guarantee of completeness or accuracy.

2.5 The User receives a non-exclusive, non-transferable right, limited to the term of the contract, to use the Platform in accordance with these GTC for its own business purposes.

3. Registration, account and identity verification (KYC)

3.1 Use requires an account. The User provides truthful and complete information on registration and keeps it up to date. There is no entitlement to conclusion of a user contract. The contract is concluded upon confirmation of registration by aethos or upon activation of the account.

3.2 The User acts through a natural person authorised to represent it. The User is responsible for all actions under its account and the accounts of its team members and must keep access credentials confidential. Suspected misuse must be reported to aethos without delay.

3.3 A prerequisite for activation of the account is an identity verification of the authorised representative, which aethos uses as a trust measure. It is carried out via the service provider Stripe Identity. aethos receives only the verification result and a session identifier. If the User refuses the verification or it fails, the account will not be activated or may be blocked. The verification is a trust signal. aethos gives no warranty as to the identity, creditworthiness or authorisation of the User and accepts no liability for the reliance that other Users place on it.

3.4 The User ensures that it provides the technical prerequisites for use (browser, internet access) itself.

3.5 The User may only invite team members if they are authorised to use the Platform for its business. The number of seats depends on the plan.

4. Licence agreements between Users

4.1 Licence agreements are concluded exclusively between the Users involved. A licence comes into existence only when the counterparty agrees to the licensed subject matter and the terms and has signed the licence document digitally. Before that, there is no licence. aethos does not create or activate any licence on its own. The Users agree among themselves on the content, scope (territory, term, type of use, exclusivity), price and handling. aethos does not influence these agreements and is not liable for their performance.

4.2 Templates, fields, standard texts or forms that the Platform offers for convenience are non-binding technical aids. The User checks them for suitability before use and is solely responsible for the content of its agreements.

4.3 Electronic signature is provided via a technical signature service (currently OpenSign). aethos only provides the interface. The legal effect and evidentiary value of the signature are governed by applicable law. aethos gives no assurance as to the quality of the signature within the meaning of the eIDAS Regulation, unless expressly stated.

4.4 Disputes between Users (e.g. about payment, scope of use, chain of rights, breaches of contract) are resolved by the Users among themselves. aethos is not obliged to mediate in such disputes, but may disclose information in accordance with Section 6 and legal obligations.

4.5 The transparency log publishes daily a Merkle root hash formed from the hashes of the licence documents recorded on that day, together with the number of contracts. Hashes of individual documents, names or other content are not published. It serves as a technical integrity record without any warranty as to evidentiary value or legal effect. The User agrees that the hash of its licence documents is included in this Merkle root. Deletion of Merkle roots that have already been published is technically not possible, but neither documents nor persons can be derived from them.

5. User content and warranties

5.1 The User is solely responsible for all content it uploads or makes available via the Platform (images, metadata, texts, documents).

5.2 The User warrants and represents that it

• holds the necessary rights in the uploaded assets to license them as intended, and that the intended licensing does not infringe third-party rights,
• has obtained the necessary consents and rights of persons depicted (personality and image rights, data protection),
• keeps content free of malware and unlawful content and does not upload content that violates laws or third-party rights.

5.3 Uploaded image files may contain metadata (e.g. EXIF data with location or camera data) and may depict persons. The User removes metadata itself if it does not wish to pass it on. Content is visible in the account only to the User or its company and is passed on only to persons to whom the User releases it. aethos does not publish, promote or recommend content.

5.4 aethos uses content exclusively on behalf of and on the instructions of the User in order to provide the Platform, and not for its own purposes. For this purpose, the User grants aethos the non-exclusive right, limited to the term of the contract, to store content, process it technically (in particular to hash it, to scale it, to pass it on to the service providers used for scans) and to display it to the User. aethos receives no further right of use.

5.5 The User may not misuse the Platform, in particular may not

• impair the security or availability, circumvent interfaces or query them automatically to an unreasonable extent,
• share access credentials or use other accounts,
• use the Platform to circumvent third-party rights or for fraudulent purposes.

5.6 The User may use scan results only for content in which it holds rights or for which it can demonstrate a legitimate interest. It may not use them to identify, monitor, track or harass persons.

5.7 The User does not upload content that recognisably discloses special categories of personal data within the meaning of Art. 9 GDPR (e.g. health, religion, sex life) or images of minors, unless it can demonstrate the necessary consents (in the case of minors, those of the legal guardians).

6. Infringements, notices and blocking

6.1 Anyone who alleges an infringement via the Platform may report it electronically via a form on the website or by e-mail to office@aethos.one. The notice contains (a) a sufficiently substantiated explanation of why the content is allegedly unlawful, (b) the exact location (link or asset ID), (c) the name and e-mail address of the notifying party and (d) a statement that the information is correct and complete to the best of their knowledge. aethos confirms receipt, reviews carefully and promptly, and informs the notifying party and the affected User of the decision.

6.2 aethos is not obliged to monitor content actively or to investigate circumstances indicating unlawful activity. If aethos obtains knowledge of an infringement through a notice under 6.1 or otherwise, aethos reviews the content without delay and blocks or removes it if the infringement is manifest or is established after review.

6.3 aethos may block content, accounts or individual functions temporarily or permanently if

• there is a well-founded suspicion of an infringement or of a breach of these GTC,
• statutory, official or court orders require it,
• the security or integrity of the Platform is at risk,
• the User is in default of due payments despite demand and grace period under 7.4.

For every block or removal, the User receives a clear and specific statement of reasons (type of measure, facts, legal basis or the contractual provision concerned, indication of any automated means used). The User may lodge a complaint at any time with office@aethos.one, which will be reviewed by a natural person. Statutory remedies remain unaffected. Exceptions apply where a statement of reasons is prohibited by law or by an authority.

6.4 Where legally required, aethos discloses data to authorities, courts and persons entitled to claims. The User agrees to the extent that disclosure is permissible for the pursuit of rights arising from infringements in connection with the Platform.

6.5 Blocks and deletions do not give rise to claims by the User against aethos if aethos acted appropriately after careful review.

6.6 aethos does not enforce rights. aethos does not decide on the existence of rights and does not pursue legal claims for Users. The pursuit and enforcement of claims (including those arising from scan findings) lies solely with the Users concerned and their legal representatives. aethos acts only within the scope of Sections 6.2 to 6.4 and legal obligations.

7. Prices, credits and payment

7.1 The prices for plans, seats and credits displayed on the Platform at the time of booking apply. All prices are net, plus statutory VAT, unless stated otherwise. Subscriptions are taken out either monthly or annually.

7.2 Payments are processed via Stripe. The User agrees to Stripe's payment terms. Subscriptions renew automatically for the booked term unless terminated.

7.3 Credits entitle the User to use certain paid functions according to the price list. Credits included in plans are reset every month; unused credits expire at the end of the month (also for annual subscriptions). Additionally purchased credits (top-ups) do not expire as long as the account exists. When credits are used, included credits are used first, then purchased credits. Credits are not transferable and are not refunded in cash, except where mandatory by law. Purchased credits expire upon termination of the contract and are not refunded, unless aethos terminates ordinarily or discontinues the service: in that case aethos refunds unused purchased credits.

7.4 Fees are due in advance at the start of each billing period or on purchase of credits and are collected via Stripe. Invoices are provided electronically. If a payment fails, aethos may, after a demand and with a grace period of 7 days, suspend services until payment is made in full. In the event of default, default interest under Section 456 of the Austrian Commercial Code (UGB) (9.2 percentage points above the base rate) and reimbursement of reasonable collection costs apply.

7.5 aethos charges no licence fees and is not involved in the flow of payments between Users. aethos's remuneration consists exclusively of subscription fees and credits. Licence fees, usage fees and other payments between Users are agreed and settled by the Users themselves outside the Platform. Price information in licence data serves documentation purposes only. aethos assumes neither collection nor the risk of non-payment nor any verification of payment.

7.6 Price changes for existing contracts are announced at least 30 days before they take effect. The change applies only from the first billing period after the notice period has ended. Until then, the User may terminate with effect from the end of the current billing period.

8. Term and termination

8.1 The user contract is concluded for the subscription period booked (monthly or annually) and renews automatically (see 7.2) as long as it is not terminated. The User may terminate at any time. The subscription then continues until the end of the paid period and ends thereafter without renewal. There is no pro rata refund for the remainder of the paid period. aethos may terminate the contract ordinarily with 30 days' notice to the end of the billing period. Termination is possible in text form (e-mail is sufficient) or via the function on the Platform.

8.2 The right of both parties to terminate extraordinarily for good cause remains unaffected. Good cause for aethos exists in particular if the User materially breaches these GTC, is in default of payment despite a grace period, or fails the identity verification.

8.3 Ongoing licence agreements between Users remain unaffected by termination of the user contract between aethos and a User. aethos will keep records (e.g. signed licence PDFs) available for retrieval for 12 months after the end of the contract or make them available to the User for export before termination.

8.4 After termination, aethos will delete or anonymise the User's data after a transition period of 30 days, unless statutory retention obligations (e.g. accounting and tax law) or the provision of the records under 8.3 or the pursuit of legal claims prevent this. Merkle roots already published in the transparency log remain (see 4.5).

8.5 The User is itself responsible for backing up its data in good time before the end of the contract. A request for data export may be addressed to support@aethos.one.

9. Availability and warranty

9.1 aethos endeavours to ensure high availability of the Platform but does not owe uninterrupted availability. No particular availability (SLA) is promised, except in an individual agreement. Maintenance work will be announced in advance where possible. Outages of third-party providers (e.g. Supabase, Stripe, OpenSign) and force majeure do not constitute a breach of duty by aethos.

9.2 aethos warrants that the Platform substantially corresponds to the service description. Defects must be reported without delay, stating the circumstances. aethos remedies defects within a reasonable period by rectification or workaround. Further warranty claims are excluded where permissible, except for price reduction and rescission under 9.3. The warranty period is 6 months.

9.3 The User notifies defects without delay after discovery. If rectification under 9.2 is not successful within a reasonable period, the User may demand a price reduction or, in the case of material defects, termination of the contract with effect for the future.

9.4 The Platform integrates third-party services (including Stripe, OpenSign, Google Vision). Their terms apply in addition for their services. aethos is not liable for these services beyond its own obligations.

9.5 aethos may further develop the Platform and change functions, provided the essential scope of services is retained.

10. Liability

10.1 aethos is liable for damages only in cases of intent and gross negligence. For slight negligence, aethos is liable only for breach of essential contractual obligations (obligations whose fulfilment is essential for performance of the contract) and limited to the typically foreseeable damage. Liability for personal injury and under the Product Liability Act remains unaffected.

10.2 aethos's liability is limited per case of damage and in total per contract year to the amount of the fees paid by the User in the 12 months before the damaging event, but at least EUR 5,000, unless intent or gross negligence is involved.

10.3 In the case of slight negligence, aethos is not liable for lost profits, missed savings, indirect damages and consequential damages, nor for damages arising from loss of data, insofar as the User could have avoided them through reasonable data backup.

10.4 Within the scope of 10.1, aethos is not liable for

• content that Users upload or make available,
• the existence, validity or performance of licence agreements between Users,
• the accuracy of results from duplicate detection, reverse image search and similar auxiliary functions,
• actions or omissions of other Users,
• damages arising from outages or errors of third-party providers, insofar as aethos selected them with due care.

10.5 Claims against aethos become time-barred, where legally permissible, within 12 months of knowledge of the damage and the tortfeasor. This does not apply in cases of intent.

10.6 The limitations of liability also apply in favour of the governing bodies, employees and vicarious agents of aethos.

11. Indemnification

11.1 The User indemnifies and holds harmless aethos, its governing bodies, employees and vicarious agents against all third-party claims, insofar as these claims are based on content or actions of the User and arise from the following circumstances:

• content that the User uploads or makes available, including alleged infringement of copyrights, neighbouring rights, trademarks, personality rights, image rights, data protection rights or other rights of third parties,
• conclusion, content, performance or non-performance of licence agreements to which the User is a party,
• breaches by the User of these GTC or of laws,
• claims of other Users against aethos arising from the relationship of the User with those Users.

11.2 The indemnification also covers reasonable costs of legal defence (attorneys' and court fees, including out-of-court), settlement payments and damages payments.

11.3 aethos informs the User without delay of claims asserted and coordinates the legal defence with the User where reasonable. aethos may take over the defence itself or transfer it to a legal representative if the User does not itself provide a remedy within a reasonable period. Without the User's consent, aethos will not conclude any settlement that obliges the User, unless legally required.

11.4 aethos is entitled to demand from the User a reasonable advance on costs for the legal defence.

11.5 This obligation continues after the end of the contract. It does not apply to the extent that aethos itself caused the claim through its own intent or gross negligence.

12. Data protection

12.1 aethos processes personal data of Users and their team members as controller within the meaning of the GDPR, insofar as this is necessary for contract performance, billing, security and compliance with legal obligations. Details are set out in the privacy policy, which is available on the website and on the Platform.

12.2 Insofar as the User processes personal data of third parties via the Platform (e.g. persons depicted in uploaded assets, contact details of contractual partners), the User is controller and aethos processes this data as processor under Art. 28 GDPR. The data processing agreement in Annex 1 of these GTC applies, which is deemed concluded upon acceptance of the GTC. Insofar as aethos itself decides on the purposes and means of processing in an individual case, aethos acts as controller.

12.3 The User ensures that it has a legal basis for the processing of personal data that it brings into the Platform and has informed data subjects.

12.4 In the event of a breach of these requirements, Section 11 (Indemnification) applies.

13. Changes to the GTC

13.1 aethos may amend these GTC with effect for the future if this is necessary for objective reasons (e.g. change in law, adaptation to case law or regulatory requirements, non-burdensome technical or functional adjustments). Changes are notified to the User by e-mail at least 30 days before they take effect.

13.2 The changes are deemed approved if the User does not object in text form within this period. In the notice, aethos expressly points out the period, the legal consequence of silence and the right to object.

13.3 If the User objects, the previous GTC continue to apply, but aethos may terminate the contract ordinarily with effect from the date the changes would take effect.

13.4 Changes to services and fees that materially shift the balance between performance and consideration require the express consent of the User.

14. Final provisions

14.1 Austrian law applies, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

14.2 The court with subject-matter jurisdiction in Vienna, Innere Stadt, has exclusive jurisdiction for all disputes arising out of or in connection with this contract. aethos may also sue the User at its general place of jurisdiction.

14.3 Notices from aethos to the User are sent by e-mail to the address stored in the account. The User keeps it up to date.

14.4 The User may transfer rights and obligations under this contract only with the consent of aethos in text form. aethos may transfer the contract to an affiliated company or a legal successor in the course of a restructuring.

14.5 Should individual provisions be invalid or unenforceable, the contract remains valid in all other respects. The invalid provision will be replaced by a valid provision that comes closest to the economic purpose.

14.6 Amendments and supplements require text form. This also applies to any waiver of this formal requirement.

14.7 The German version prevails. Translations are for information only.

14.8 There are no oral side agreements.

Annex 1: Data processing (Art. 28 GDPR)

A1.1 Scope. Insofar as aethos processes personal data on behalf of the User on the Platform ("Processed Data"), this Annex applies. The User is controller, aethos is processor. Not covered is data that aethos processes as controller (account, billing, result of identity verification, security). The privacy policy applies to such data. This Annex is part of the GTC and is deemed a concluded contract under Art. 28 GDPR upon acceptance of the GTC.

A1.2 Subject matter of processing.

A1.3 Instructions. aethos processes Processed Data only on documented instructions of the User. Instructions are these GTC including this Annex and the use of the functions of the Platform. The User gives further instructions in text form to support@aethos.one, insofar as they are technically reasonable and within the agreed services. aethos informs the User without delay if, in its opinion, an instruction infringes data protection law, and may suspend its execution until clarified. The User is responsible for the lawfulness of the instructions and the Processed Data (see 12.3).

A1.4 Confidentiality. aethos obliges all persons who have access to Processed Data to confidentiality and to data secrecy under Section 6 of the Austrian Data Protection Act (DSG). Access is limited to what is necessary.

A1.5 Security of processing. aethos implements appropriate technical and organisational measures under Art. 32 GDPR, in particular:

• encryption in transit (TLS) and of stored data by the hosting providers
• access restriction at database level (row-level security) and role-based permissions
• content visible only in the User's account and to contractual partners to whom the User releases it
• verification of webhook signatures, separation of production and test, regular security updates
• backup and emergency procedure, logging of access without content data

aethos reviews the measures regularly and adapts them to the state of the art.

A1.6 Sub-processors. The User grants aethos general authorisation to use the sub-processors named below. aethos contractually binds each sub-processor to the same data protection obligations that apply in this Annex (Art. 28(4) GDPR) and is liable for it as for itself. aethos notifies the User of intended changes (new or replaced sub-processors) by e-mail at least 30 days in advance. The User may object in text form within 14 days for an important data protection reason. If the parties cannot agree, the User may terminate the contract extraordinarily with effect from the date of the change. A pro rata refund for the remainder of the paid period does not apply in that case under 8.1.

Stripe processes payment and identity data on its own responsibility or on behalf of aethos. This is not Processed Data of the User. GitHub receives no personal data.

A1.7 Third countries. aethos transfers Processed Data only to the sub-processors named above. Insofar as data reaches countries outside the EEA (in particular at Google and, through group links, at Supabase, Inc. and Mailgun Technologies, Inc.), aethos relies on the Standard Contractual Clauses of the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework.

A1.8 Assistance to the User. aethos forwards requests from data subjects concerning Processed Data to the User within five business days and does not respond to them itself. aethos supports the User with suitable technical means in access, rectification, erasure and export. aethos also supports the User in obligations under Art. 32 to 36 GDPR (security, notification of breaches, data protection impact assessment, consultation of the supervisory authority). For considerable additional effort, aethos may demand reasonable reimbursement of expenses.

A1.9 Personal data breaches. aethos notifies the User of a breach of Processed Data without undue delay after becoming aware of it, as a rule within 48 hours, by e-mail. The notification contains, as far as known, the nature of the breach, the data and persons concerned, the likely consequences and the measures taken. aethos provides missing information subsequently. Notification of the supervisory authority and of data subjects is the responsibility of the User as controller.

A1.10 Evidence and audits. On request, aethos provides the User with the information necessary to demonstrate compliance with this Annex. The User may audit compliance once a year and for a specific reason, itself or through an independent auditor bound to confidentiality. The audit is announced with 30 days' notice, takes place during business hours, does not impair operations or other customers and is carried out primarily on the basis of documentation, reports and certificates. Audits at sub-processors take place within the framework of their contracts. The User bears the costs, unless the audit reveals a material breach by aethos.

A1.11 Return and deletion. After the end of the contract, the User may export its Processed Data under 8.5. aethos deletes it after the transition period under 8.4 and deletes backup copies within a further 30 days. Exceptions are data for which statutory retention obligations exist and records that the User can retrieve under 8.3. aethos confirms deletion on request.

A1.12 Liability. Sections 10 and 11 apply to liability between the parties. Claims of data subjects under Art. 82 GDPR remain unaffected.

A1.13 Precedence and changes. In the event of conflicts between this Annex and the GTC, this Annex prevails on data protection matters. aethos may adapt this Annex upon changes in law or in the sub-processors used in accordance with Section 13 and A1.6.