VibeCFO Terms and Conditions

These Terms and Conditions (Terms) govern your access to and use of the VibeCFO Platform. The VibeCFO Platform, including the EVA AI service, its associated websites, domains, subdomains, mobile applications and software-as-a-service offerings (together, the Platform), is owned and operated by One Place Business Platform Pty Ltd (ACN 621 278 180), trading as VibeCFO (VibeCFO, we, us, our).

By signing up for, accessing or using the Platform, you (the Customer, you, your) agree to be bound by these Terms. If you do not agree, you must not access or use the Platform.

These Terms incorporate by reference our Privacy Policy, our End User Licence Agreement (which governs the access rights of your end users and client invitees), and where executed by the parties, our Data Processing Addendum.

1. Definitions

In these Terms:

• “Advisor” means an accounting firm, bookkeeper or other professional services firm that subscribes to the Platform to deliver services to its Clients.
• “Client” means an end-customer business whose data is accessed, imported or analysed through the Platform, typically the client of an Advisor.
• “Client Invitee” means an individual invited by a Customer or Advisor to access Client-facing functions of the Platform.
• “Customer Data” means all data submitted to, imported into, generated by or processed through the Platform on behalf of you or your Clients, including financial data ingested from Third-Party Connectors.
• “Documentation” means the user guides, help documentation, security documentation and policies published at vibecfo.ai or otherwise made available to you.
• “EVA” means the AI-powered conversational and analytical features of the Platform.
• “Personal Information” has the meaning given in the Privacy Act 1988 (Cth).
• “Third-Party Connector” means a third-party data source (such as Xero, MYOB, simPRO, BuildXact, Reapit, Unleashed, CIN7, Shopify or similar) to which the Platform connects.
• “Third-Party Supplier” means a third party we engage to provide infrastructure, services or technology used to operate the Platform, including Amazon Web Services (AWS), Anthropic, Microsoft, Stripe, Ezidebit and Brevo, as published on our subprocessor list at vibecfo.ai/subprocessors.
• “User” means any individual authorised by you to access the Platform, including your officers, employees, contractors, Client Invitees and (where applicable) your Clients.

2. Grant of Access

VibeCFO grants you a non-exclusive, non-transferable, revocable licence to access and use the Platform for the conduct of your business, subject to these Terms and payment of applicable fees.

The features and Users available to you are determined by the subscription plan you select. You must not exceed the limits of your plan or seek to circumvent them.

You must not, and must ensure your Users do not: (a) alter or attempt to alter the source code or object code of the Platform; (b) reverse engineer, decompile or disassemble the Platform except to the extent permitted by law; (c) use the Platform to develop a competing product; (d) resell, sublicense or otherwise commercially exploit the Platform other than as expressly permitted; or (e) use the Platform for any unlawful purpose.

You are responsible for: (a) all activity that occurs under your account and the accounts of your Users; (b) maintaining the confidentiality of credentials and access tokens; (c) the authority of any person to whom you grant access; and (d) ensuring your Users comply with these Terms and the End User Licence Agreement.

3. EVA and AI Features

Access to the Platform includes access to EVA, our AI service. EVA's primary function is text-to-SQL: translating natural-language questions into SQL queries against your Platform database. EVA does not generate financial numbers; the numbers it returns come from your database.

VibeCFO uses large language models supplied by Anthropic and OpenAI to power EVA. Those models are accessed through Amazon Bedrock under our agreement with Amazon Web Services, and we also use Anthropic's own API directly for web search, for producing document exports and as a backup. To answer a question, EVA sends the question and the data needed to answer it to the model for processing. Model processing may take place outside Australia, as described in our Privacy Policy. Model developers do not receive your Customer Data through Amazon Bedrock, and no model is trained on your Customer Data. We select the specific model versions we use and change them from time to time as newer versions are released; the current suppliers, and the country in which each processes data, are published at vibecfo.ai/subprocessors. We will update that list, and give notice where these Terms require it, if a supplier, a country of processing or the categories of data we send to a model change. EVA can, at a User's request, produce export files from Customer Data and, where you have connected an external tool, propose and, on the User's confirmation, perform actions in that tool. Under our Xero partnership obligations, we are contractually prohibited from using Customer Data sourced from Xero to train AI models.

On the user profile page, individual Users may opt in or out of having the phrasing of their EVA questions used to improve EVA's natural-language understanding. This setting covers question phrasing only -- never financial data, numerical results, Personal Information or Client information.

EVA is provided as an analytical and decision-support tool. EVA's output is not financial advice, taxation advice, audit assurance, or a substitute for the professional judgement of a qualified accountant, advisor or other professional. You are responsible for reviewing EVA's output before relying on it.

The terms applicable to AI-generated content are set out in the EVA Disclaimer, User Agreement and Content Generation Terms, which form part of these Terms.

4. Third-Party Connectors and Suppliers

The Platform integrates with Third-Party Connectors at your direction. Your agreement with any Third-Party Connector is solely between you and that connector. To the extent of any inconsistency between a Third-Party Connector's terms and these Terms with respect to VibeCFO's rights or obligations, these Terms prevail.

You are responsible for: (a) holding the necessary authority to connect a Third-Party Connector and to import the Customer Data; (b) any content you create, transmit, display or analyse that is based on Third-Party Data; and (c) complying with the terms of each Third-Party Connector.

VibeCFO engages Third-Party Suppliers to operate the Platform, including Amazon Web Services, Anthropic, Microsoft, Stripe, Ezidebit and Brevo, as published on our subprocessor list at vibecfo.ai/subprocessors. A current list of material subprocessors, with the country in which each processes data, is published at vibecfo.ai/subprocessors. We will provide reasonable advance notice of material changes to our subprocessor list.

5. Fees and Payment

Fees are set out in the pricing schedule applicable to your subscription. Unless otherwise agreed in writing, fees are billed monthly in advance and payable by the due date specified on the invoice.

If any fee is unpaid more than 14 days after its due date, we may suspend access to the Platform, in whole or in part, after providing written notice. Suspension does not relieve you of the obligation to pay outstanding fees.

We may vary fees on no less than 30 days' written notice. If you do not agree to a fee variation, you may terminate your subscription before the new fees take effect.

All fees are exclusive of GST and other applicable taxes unless stated otherwise.

6. Service Levels

VibeCFO will use commercially reasonable efforts to make the Platform available with a target uptime of 99.5% per calendar month, measured at the application layer and excluding Excluded Downtime (defined below).

“Excluded Downtime” means downtime caused by: (a) scheduled maintenance notified at least 24 hours in advance; (b) emergency maintenance reasonably necessary to address a security or stability risk; (c) failures of a Third-Party Connector or Third-Party Supplier outside our reasonable control; (d) force majeure events; or (e) acts or omissions of the Customer, its Users, or its end users.

Service-level targets are operational commitments. Service credits, if any, are as set out in your subscription order or in the Data Processing Addendum (where executed).

7. Security

VibeCFO implements and maintains technical and organisational security measures appropriate to the risk of processing Customer Data, including:

• encryption in transit using TLS 1.3 for all connections to the Platform from the internet;
• encryption at rest (AES-256) of uploaded documents, logs and backups of platform records, and, from the completion of the scheduled migration targeted for 2026-10-16, of the production database;
• a separate database for each business, with access restricted by application-level authorisation and per-business database credentials;
• multi-factor authentication available to all Users, able to be required by the Customer for all of its Users, and required for all VibeCFO personnel;
• role-based access controls with the principle of least privilege;
• logging of infrastructure events and administrative actions in our cloud environment, auditing of database connections, and tracing of EVA requests;
• threat detection and monitoring of our cloud environment;
• vulnerability management under a documented policy, automated dependency and secret scanning of every code repository on a continuous basis, and continuous monitoring of our cloud configuration through our compliance platform; and
• an information security management system maintained against ISO/IEC 27001:2022 and ISO/IEC 42001, reviewed at least annually.

VibeCFO is working towards certification against both standards with a target date of December 2026. Current security practices and progress are published at vibecfo.ai/security.

Detailed security commitments, including audit log retention, backup objectives and breach notification, are set out in clauses 8 to 10 below and, where executed, in the Data Processing Addendum.

8. Backup and Recovery

Customer Data is hosted on AWS Aurora in the AWS region assigned to the Customer's account, which at the date of these Terms is the Asia Pacific (Sydney) region in Australia, with continuous point-in-time recovery over a rolling 7-day period. Financial and accounting data received from Third-Party Connectors is derived from the Customer's own source systems; if it were lost from the Platform it is re-obtained from the source system through the authorised connection rather than restored from long-term backup. The Platform's own records (firms, users, clients, connections, schedules and EVA configuration) are additionally backed up daily to immutable storage, encrypted at rest (AES-256), retained for at least 35 days, copied to a second AWS region in Australia, and restore-tested on a scheduled basis. Encryption at rest of the primary database and of its point-in-time recovery data forms part of the migration described in clause 7.

Our target Recovery Point Objective (RPO) is 5 minutes for the primary database and 24 hours for the Platform's own records held in the daily backup. Our target Recovery Time Objective (RTO) for restoring the Platform's own records and making the Platform available is 24 hours. Where Customer Data must be re-obtained from a Third-Party Connector, the time to complete re-derivation depends on the volume of data and the rate limits of the source system and is measured and published following each disaster recovery test. RPO and RTO are targets, not guarantees.

You are responsible for maintaining your own backups of any Customer Data you wish to retain independently of the Platform.

9. Audit Logs

VibeCFO maintains two layers of logging:

• Infrastructure logs, including AWS API activity and administrative actions (retained for 365 days), database connection audit records (retained for 365 days), load balancer and storage access logs, ETL job execution records, and EVA request traces. Application-level authentication and user activity logs are being extended and will be described here when they operate. Log classes are retained for no less than 90 days unless a shorter period is stated in our Documentation.
• User-facing audit indicators -- surfaced within the Platform, including last login, last opened, and access events at the Client-organisation level.

On request, we will provide an export of audit log activity relating to your account before the effective date of termination.

On termination, audit logs relating to Customer Data are deleted in line with our data deletion practices set out in clause 13, except where retention is required by law.

10. Incident Response and Breach Notification

VibeCFO maintains an incident response process covering detection, triage, containment, eradication, recovery and post-incident review.

If we become aware of a confirmed security incident that has resulted in unauthorised access to, disclosure of, or loss of your Customer Data, we will notify your nominated security contact without undue delay and in any event within 72 hours of confirmation of the incident.

Initial notification will include the information reasonably available at the time, including: (a) the nature of the incident; (b) the categories of data affected, to the extent known; (c) likely consequences; and (d) the measures taken or proposed to address the incident. Further information will be provided as it becomes available.

Where the incident constitutes an eligible data breach under the Privacy Act 1988 (Cth), we will cooperate with you and where applicable with the Office of the Australian Information Commissioner. Each party retains its own statutory notification obligations.

Notifications do not constitute an admission of fault or liability.

11. Data Ownership and Use

As between the parties, you own all Customer Data. You grant VibeCFO a non-exclusive, royalty-free, worldwide licence to host, copy, process, transmit and display Customer Data solely as necessary to provide and improve the Platform and to comply with these Terms.

VibeCFO may use de-identified and aggregated data derived from Customer Data for the purposes of operating, securing, benchmarking, improving and analysing the Platform, provided that such data does not identify you, any User, any Client or any individual.

VibeCFO does not sell Customer Data and does not use Customer Data to train third-party AI models.

12. Confidentiality

Each party will keep confidential, and not disclose to any third party other than as permitted by these Terms, the Confidential Information of the other party. “Confidential Information” means information disclosed by one party to the other that is identified as confidential or that a reasonable person would understand to be confidential, including Customer Data.

The obligations of confidentiality do not apply to information that: (a) is or becomes publicly available other than by breach of these Terms; (b) was rightfully in the receiving party's possession without obligation of confidentiality prior to disclosure; (c) is independently developed without reference to the disclosing party's Confidential Information; or (d) is required to be disclosed by law, court order or regulatory authority.

13. Term, Termination and Offboarding

These Terms continue while you have an active subscription to the Platform.

Either party may terminate the subscription: (a) at the end of the then-current billing period, by giving notice in accordance with the subscription plan; or (b) immediately, by written notice, if the other party commits a material breach that is not cured within 30 days of written notice.

VibeCFO may suspend or terminate access immediately if: (a) fees remain unpaid for more than 30 days; (b) we reasonably believe your use of the Platform presents a security risk; (c) you become insolvent or the subject of insolvency proceedings; or (d) we are required to do so by law.

On termination: (a) your right to access the Platform ends; (b) you may request an export of your Customer Data within 30 days of termination; and (c) after that 30-day period, we will delete your Customer Data from production systems within 90 days and from backups in line with backup retention cycles. Audit logs are deleted on the same timeline, except where retention is required by law.

VibeCFO will provide written confirmation of deletion on request.

Clauses that by their nature should survive termination (including 11, 12, 14, 15, 16 and 17) survive termination.

14. Disclaimers

Except as expressly set out in these Terms and to the extent permitted by law, the Platform is provided on an “as is” and “as available” basis, and VibeCFO makes no warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement.

VibeCFO does not warrant that the Platform will be uninterrupted, error-free or free from inaccuracies arising from Third-Party Connector data, and the operational availability target in clause 6 is the sole commitment regarding uptime.

EVA output is generated by AI and may contain errors. You must review EVA output before relying on it for material decisions.

15. Liability

Nothing in these Terms excludes, restricts or modifies any right or remedy that cannot be excluded, restricted or modified by law, including consumer guarantees under the Australian Consumer Law.

To the maximum extent permitted by law, neither party is liable to the other for any indirect, incidental, special or consequential loss, loss of profits, loss of revenue, loss of goodwill, loss of business opportunity, or loss or corruption of data (other than Customer Data which is the subject of a security incident), arising out of or in connection with these Terms, whether in contract, tort, statute or otherwise.

To the maximum extent permitted by law, VibeCFO's total aggregate liability arising out of or in connection with these Terms (whether in contract, tort, statute or otherwise) is limited to the fees paid by you to VibeCFO in the 12 months preceding the event giving rise to the liability.

Where liability for breach of an implied term cannot be excluded but may be limited, our liability is limited, at our option, to: (a) the supply of the Platform again; or (b) the payment of the cost of having the Platform supplied again.

16. Variation

VibeCFO may amend these Terms from time to time. We will notify you of material changes by email to your nominated billing contact and by an in-platform notification, with at least 30 days' notice before the changes take effect.

If you do not agree to a material change, you may terminate your subscription before the changes take effect, in which case you will receive a pro-rata refund of any pre-paid fees relating to the period after termination.

Continued use of the Platform after the effective date of a notified change constitutes acceptance of the amended Terms. We will not require re-signature or re-acceptance for variations notified in accordance with this clause.

Minor, non-material changes (including changes to correct typographical errors, reflect legal or regulatory requirements, or reflect operational changes that do not adversely affect your rights) may be made without notice.

17. General

• Governing law: These Terms are governed by the laws of South Australia. The parties submit to the non-exclusive jurisdiction of the courts of South Australia and courts of appeal from them.
• Assignment: You may not assign these Terms without our written consent. We may assign these Terms to an affiliate or to an acquirer of all or substantially all of our business.
• Notices: Notices must be in writing and may be given by email to the address most recently nominated by the receiving party.
• Severability: If any provision of these Terms is held invalid or unenforceable, the remaining provisions continue in full force.
• Entire agreement: These Terms, together with the EULA, the Privacy Policy and (where executed) the Data Processing Addendum, constitute the entire agreement between the parties in relation to their subject matter.
• No partnership: Nothing in these Terms creates a partnership, joint venture, agency or employment relationship between the parties.

Contact

One Place Business Platform Pty Ltd (ACN 621 278 180), trading as VibeCFO
PO Box 6233, Linden Park, South Australia 5065
Email: support@vibecfo.ai