Draft, pending legal review

Terms of Service

Draft for legal review · Version of 25 October 2026

If the language versions differ, the Polish version prevails. This English text is a translation provided for convenience.

These Terms of Service set out the rules for using Korfi (korfi.app): a cloud for documents and files with a macOS app. They are terms of service within the meaning of Article 8 of the Act of 18 July 2002 on the provision of electronic services. We make them available free of charge, before the contract is concluded, in a form you can save and print from your browser.

You keep your files with us as a copy, not a mirror. What that means in practice, and what we do not guarantee, is described in section 3. Personal data is described in the Privacy Policy, and refunds and withdrawal from the contract in the Refund Policy.

The key points in brief (this summary does not replace the Terms): you open an account by invitation; the Archive blocks deletion of a file for 30 days, including by us; for Private and Vault folders we do not have the key to the contents, so loss of the recovery key cannot be undone; the AI assistant can be wrong and deletes nothing; payments are taken by Paddle as the seller; you report illegal content at abuse@korfi.app.

1. Provider and contact

1.1The provider is Artur Witoś, a sole trader, address: Wólka Zatorska 16, 07-217 Wólka Zatorska, Poland, NIP: 5681625642, REGON: 386254514, entered in the Central Register and Information on Economic Activity (CEIDG) (“Korfi” or “we”).

1.2Contact: email hello@korfi.app, telephone: [TO BE DECIDED: telephone number. Art. 12(1)(3) of the Polish Consumer Rights Act requires one where the trader has a telephone]. We publish full contact details, the point of contact for Users and authorities (Articles 11 and 12 of Regulation (EU) 2022/2065, the Digital Services Act, DSA) and the languages of communication (Polish, English) on the Contact page.

1.3Korfi is a service provider within the meaning of the Act on the provision of electronic services. As regards storing Users’ content, Korfi provides a hosting service within the meaning of Article 14 of that Act and Article 6 of the DSA.

1.4Payments for paid Plans are taken and settled by Paddle as the seller (section 13). Korfi is a party to the contract for the provision of the Service described in these Terms and is responsible for its conformity with the contract.

2. Definitions

Service: the Korfi service: storing files in the cloud, together with the features described in section 3.
App: the Korfi app for macOS (and in the future also for Windows), provided by Korfi.
Website: the website at korfi.app, including the download pages for Share Links (korfi.app/s/...) and Buckets (korfi.app/u/...).
Account: the set of resources and settings assigned to a User’s email address.
User: a person who has an Account. A User may be a Consumer or a Business User.
Consumer: a natural person performing a legal act that is not directly related to their business or professional activity (Article 22(1) of the Civil Code). Consumer protection rules also apply to a natural person running a sole-proprietor business where the contract shows that it is not of a professional nature for them (Article 7aa of the Act of 30 May 2014 on consumer rights, the “Consumer Rights Act”).
Business User: a User who is not a Consumer.
File, Folder: a document or other file sent to Korfi, and a folder in which Files are organised.
Privacy level: a Folder setting: Standard (the server sees the contents), Private or Vault (contents encrypted end-to-end on the User’s Mac). Described in section 9.
Protected: a mark on a File or Folder that requires fresh confirmation before deletion, moving outside the Folder or removing protection.
Trash: the place where deleted Files and Folders wait 30 days to be restored.
Archive: an area in which a File is locked against deletion and change for 30 days from upload (section 8).
Recovery Key: the key that the App shows you to save when you first turn on encryption. It lets you regain access to encrypted Files on a second Mac or after losing the first. Korfi does not have it.
Share Link: a korfi.app/s/... address through which a recipient without an Account downloads a chosen File.
Bucket: a korfi.app/u/... address through which a person without an Account sends Files to a chosen User Folder.
Inbox: an email address in the in.korfi.app domain at which a User receives attachments into their own Account.
AI Assistant: the chat in the App that uses artificial intelligence models from an external provider through Korfi’s proxy.
Paddle: Paddle.com Market Limited and other Paddle group entities (depending on the buyer’s country), acting as the seller (reseller, Merchant of Record) of paid Plans.
Plan, Price list: a package of limits and features of the Service, described in the price list on korfi.app.
Report: a notice of allegedly illegal content or a breach of the Terms, submitted under section 7.

3. Description of the Service

3.1Korfi is a cloud for documents and files. You send Files from your Mac to Korfi, browse them, search them, download them, protect them against deletion and encrypt chosen Folders. The Service is available by invitation, in beta.

3.2A copy, not a mirror. Sending a File creates a separate copy in Korfi. Korfi does not sync Folders in both directions. Changing or deleting a File on your Mac does not change the copy in Korfi, and vice versa.

3.3The Service includes the following, as further features are released in subsequent versions of the App:

a cloud browser: folders, sorting, preview, renaming, moving, descriptions, and Trash with restoring;
uploading and downloading Files, including whole Folders, with resuming of interrupted uploads;
protection against deletion (Protected) and the Archive with a 30-day lock;
File version history (each new upload adds a version, and earlier ones stay until you deliberately delete them);
Folder privacy levels: Standard, Private, Vault, including end-to-end encryption;
search by names, descriptions and contents (on the server for Standard Folders, locally on the Mac for Private ones);
the AI Assistant (section 10);
Share Links and Buckets (section 11) and the Inbox (section 12);
sign-in with an email code, optional 2FA (a TOTP app), passkeys, and a list of devices and sessions with remote sign-out;
email notifications about Account security and, if you turn them on, informational ones.

3.4Features described in the Terms as planned or offered in beta may not yet be available in your version of the App. A given feature becomes part of the Service from the moment it is available to you. We show the current state of features in the App and on korfi.app.

3.5No backup guarantee. Korfi is not a backup service or a record-keeping system required by law (for example for accounting or personnel records). Apart from the features expressly described in the Terms (Trash for 30 days, version history, Archive), we do not guarantee that a deleted, overwritten or lost File can be recovered. Keep the originals of important documents and take responsibility for your own backup strategy.

3.6The scope of features, storage limits and other parameters depend on the Plan (section 14). In the beta the default storage limit per User is 50 GB.

4. Technical requirements, risks and software

4.1To use the Service you need: a Mac running macOS version [TO BE COMPLETED: minimum macOS version and supported processor architectures], an internet connection, an email address with access to the mailbox and, for passkeys, a browser that supports WebAuthn. Windows support is planned for later.

4.2We inform you of the particular risks of services provided by electronic means (Article 6 of the Act on the provision of electronic services): in particular interception of email or of your device, phishing, malware and loss of a device. Korfi never asks you for a sign-in code, a backup code or the Recovery Key in an email, in a chat or by phone. You enter a code only in the App or on the korfi.app/passkey page opened from the App.

4.3The App is installed on your computer. It stores the session token in the macOS Keychain and, once encryption is turned on, the master key as well. It checks for updates on launch and every 6 hours, and asks you whether to install and restart. Updates are signed with Korfi’s key. If you do not install within a reasonable time an update that we informed you about, together with the consequences of not installing it, we are not liable for a lack of conformity of the Service with the contract resulting solely from the lack of that update (Article 43k(4) of the Consumer Rights Act).

4.4In the beta the App may be signed differently from apps in the App Store, and macOS may require you to allow the first launch manually. [TO BE DECIDED: update this description after purchasing Apple Developer and notarisation; the lawyer to assess whether installing the App and automatic updates require additional consent (Article 399 of the Electronic Communications Law)]

5. Account, age and contract

5.1You open an Account by invitation from Korfi. An invitation lets you open one Account and must not be resold or published. You sign in with your email address and a one-time code that we send to that address (no passwords). The code is valid for 10 minutes and allows a limited number of attempts.

5.2The contract for the provision of the Service by electronic means (opening and maintaining the Account) is concluded when you confirm your email address with the code and accept the Terms. It is concluded for an indefinite period. Termination of the contract is described in section 16.

5.3Acceptance of the Terms. When you open an Account you accept the Terms in the version shown in the App (version number and date). We record the version and the date of acceptance. When we change the Terms, we ask you to accept the new version again in accordance with section 20.

5.4Age. The Service may be used by a person who is at least 16 years old. People aged 16-17 have limited legal capacity and use the Service to the extent permitted by law and, where needed, with the consent of a legal representative. [TO BE DECIDED: the minimum age of 16 was set by the owner; the lawyer to assess the effects of contracts with minors (Articles 15-20 of the Civil Code), the ability to buy a paid Plan and Paddle’s requirements, e.g. whether buying a paid Plan should be limited to adults]

5.5Account data and security. You provide a real email address and look after access to it, to your Mac, to your 2FA backup codes, passkeys and the Recovery Key. You are responsible for actions taken from your Account unless they result from our fault. If you suspect that your Account has been taken over, sign out your devices in the settings and write to us.

5.6You can turn on a second factor (TOTP) and passkeys. Critical actions (for example removing protection, emptying Trash, turning off 2FA, deleting a passkey, changing your email, deleting the Account) require fresh confirmation. You may have one Account. The Account is personal and must not be shared with other people.

5.7Consumers and Business Users. The provisions of the Terms concerning Consumers also apply to the persons referred to in Article 7aa of the Consumer Rights Act. Business Users who process third parties’ personal data in Korfi as controllers can conclude a data processing agreement with us based on the template.

6. Acceptable use and prohibited content

6.1Korfi is for storing your own documents and files and files you have the right to. It is prohibited to upload, store, share and receive in Korfi (including through Share Links, Buckets and the Inbox) content that:

infringes the copyright or other intellectual property rights of third parties, including works distributed without the required consent;
is or contains malware, including viruses, spyware and ransomware, or is used for phishing or fraud;
depicts the sexual abuse of children or otherwise exploits children (this material is illegal regardless of the privacy level of the Folder);
is otherwise illegal under Polish law or European Union law, including terrorist content, content inciting violence or hatred on grounds protected by law, criminal threats and other content constituting a criminal offence;
violates the privacy or personal data of third parties, including disclosing their sensitive data, identity documents, recordings or photos without the required legal basis, or is used for harassment.

6.2The following is also prohibited:

using Korfi as public website hosting, a CDN or storage for mass distribution of files [TO BE DECIDED: whether Share Links should be for private sharing only and not for public distribution];
sending unsolicited mass messages using Korfi, and using the Inbox for anything other than receiving documents into your own Account (section 12);
circumventing limits, safeguards and locks (including the Archive lock), testing security without Korfi’s consent, overloading the system, and automating the Service other than through the official App;
sharing the Account, reselling the Service and opening accounts to get around a block;
using the AI Assistant for purposes prohibited by the usage policy of the model provider.

6.3You are responsible for the content you upload, share or receive, and for having the right to it. If Files contain third parties’ personal data, you are responsible for the lawfulness of processing it. Korfi has no obligation to check content (Article 15 of the Act on the provision of electronic services, Article 8 of the DSA), but may act under section 7.

7. Abuse reports and moderation

7.1Scope. As a hosting provider we do not review Users’ content on our own initiative and have no general obligation to monitor it. Content in Standard Folders is processed automatically only so that features such as search or the AI Assistant work (see the Privacy Policy), not to assess its legality. Content in Private and Vault Folders is unreadable to us.

7.2Automated moderation. [TO BE DECIDED: whether Korfi uses automatic detection of malware or of known material depicting the exploitation of children (e.g. hash matching) and mechanisms that detect abuse. If so, Article 14(1) DSA requires describing the tools used and human oversight here. For now it is assumed that decisions to restrict content are made by a human]

7.3How to report. Anyone, including a person without an Account, can report allegedly illegal content or a breach of the Terms through the Report abuse page or by email to abuse@korfi.app. A Report should contain: an indication of the content (the identifier or address of the Share Link or Bucket), a sufficiently substantiated explanation of why the content is illegal or breaches the Terms, the name and email of the person reporting (the email is optional for a Report concerning the exploitation of children) and a statement of good faith and accuracy (Article 16(2) DSA). [TO BE DECIDED: the abuse@korfi.app address and the form of Reports; an online form will be added separately]

7.4What we do after a Report. Without undue delay we confirm receipt to the person reporting, assess the Report diligently and objectively, take a decision and inform the person reporting of it and of the options for appeal. We may disregard Reports that are manifestly unfounded or made in bad faith, and after repeated abuse of Reports we may restrict the ability to submit them.

Actions we may take

7.5We choose the mildest measure sufficient to remedy the breach, taking into account its seriousness, its repetition, intent, possible harm and the fundamental rights of the people concerned. We may:

disable a Share Link or a Bucket;
place a File in quarantine: block its download, sharing and processing, while leaving it in the Account (the owner sees that the File is blocked);
block the Account’s public links: disable all Share Links and Buckets and prevent the creation of new ones;
block the Account: suspend access to the Account and the Service;
delete the content where the law or an authority’s order requires it (subject to the Archive lock, section 8);
preserve evidence for 90 days: retain the data needed to clarify the breach and, if applicable, to pass to authorities, including metadata and, where necessary and possible, a copy of the blocked content, for up to 90 days from the decision or longer if an authority or the law requires; once the basis ceases, we delete the preserved data;
notify law enforcement or other competent authorities where we suspect a criminal offence, including one that threatens the life or safety of people (Article 18 DSA).

7.6In serious cases (in particular material depicting the exploitation of children, malware, an immediate threat) we may apply a measure immediately, without prior notice.

7.7After [TO BE COMPLETED: number] confirmed breaches by the same person, or after one serious breach, we may block the Account permanently and end the contract. [TO BE DECIDED: the number of confirmed breaches justifying an Account block (policy on repeated copyright infringement)]

Statement of reasons

7.8When we restrict content or an Account, we send a statement of reasons (Article 17 DSA) to the Account’s email address, without undue delay and at the latest when the restriction is imposed or immediately after. The statement of reasons contains:

what was restricted (a File, link, Bucket, features or the Account), to what extent and for how long;
the facts and circumstances we took into account, including whether the decision results from a Report (without disclosing the identity of the person reporting unless strictly necessary);
the basis: the category of the breach and the provision of the Terms (for example “section 6, item 2, malware”) or the legal provision from which the illegality of the content follows;
whether the decision was taken by a human and whether automated means were used to detect the content or to take the decision;
information on the possibility of appeal (below) and on other remedies: a court, out-of-court proceedings for Consumers and a complaint to the competent authority.

7.9We will not provide the statement of reasons, or will delay it, only where the law or an authority prohibits it, or where providing it would hinder an investigation or endanger people’s safety. We will tell you when the obstacle ceases.

Appeal

7.10You can appeal against a decision by replying to the message with the statement of reasons or by writing to hello@korfi.app or abuse@korfi.app, within [TO BE COMPLETED: number] days of receiving the statement of reasons. State the Account, the decision and your arguments. [TO BE DECIDED: the appeal deadline (proposal: 30 days) and the response deadline (proposal: 14 days)]

7.11A human reviews the appeal, where possible someone other than the person who took the decision. We will reply by email with reasons within 14 days. If the appeal is justified, we promptly restore the content or access. An appeal does not deprive you of the right to bring claims before a court or, as a Consumer, to use out-of-court proceedings (section 22). You can also lodge a complaint with the national digital services coordinator. [TO BE DECIDED: the authority competent in Poland as digital services coordinator (to be verified by the lawyer) and whether Korfi is subject to the internal complaint-handling system under Article 20 DSA, which applies to online platforms and not to mere hosting]

End-to-end encryption and moderation

7.12In Private and Vault Folders we do not see the contents of Files and cannot assess them. We then act on the basis of the Report and metadata (names, sizes, dates, Share Links): we can disable a link, block access to an object by its identifier, block the Account’s public links or the Account itself. That is why the description given by the person reporting is crucial for us. Encryption does not protect illegal content from the effects of this section.

7.13Files in the Archive cannot be physically deleted before the lock ends (section 8). However, we can block access to them and delete them once the lock ends.

7.14We accept orders from Member State authorities (Articles 9 and 10 DSA) through the point of contact described on the Contact page.

8. Archive, Trash and deletion: what is irreversible

8.1Trash. Deleting a File or Folder moves it to Trash for 30 days. During that time you can restore it. After 30 days the File is deleted permanently by an automated job that we run daily, so actual deletion happens shortly after the 30 days have passed. Emptying Trash deletes Files irreversibly and requires fresh confirmation.

8.2Protected. The Protected setting requires fresh confirmation (a passkey, a TOTP code or an email code) before deletion, moving outside the Folder and removing protection. Protection reduces the risk of accidental loss, but it is not a guarantee against every data loss.

8.3Archive. A File sent to the Archive is locked for 30 days from upload. During that time it cannot be deleted or changed: not by you, not by us, and not by the system administrator. The lock works on the data storage side, where we keep Files in the European Union. Deleting the Account, changing the Plan or terminating the contract does not end it. The App tells you this before upload and asks for confirmation. A File in the Archive takes up space in your limit. If you send to the Archive a File that should not be there, we can block access to it, but we will not delete it before the lock ends.

8.4Versions. Each version of a File in the Archive has its own 30-day lock from upload. New versions can be added; old ones cannot be deleted before the lock ends. A single deleted version goes to Trash for 30 days. “Restore” creates a new version with the contents of the old one, and the history only grows.

8.5Unfinished uploads. Interrupted and unfinished uploads are cleaned up after about 24 hours.

8.6No recovery after deletion. After 30 days in Trash, after emptying Trash and after the Account deletion procedure is complete (section 16), Files cannot be recovered, even by us. Because of internal infrastructure mechanisms, copies of metadata may remain in the database history for up to 30 days, without the User being able to restore them.

9. End-to-end encryption and the Recovery Key

9.1Every Folder has one of three privacy levels:

Standard: the server sees the contents of Files. This is what makes text extraction and OCR, search by content, AI answers from content, the Inbox, Buckets and duplicate detection work.
Private: the contents are encrypted end-to-end on the Mac before upload. The server sees the ciphertext, names and metadata. Text, OCR and the search index are computed locally on the Mac. By default AI sees only File names, and excerpts of the contents only with your consent in a given conversation.
Vault: like Private, but with no processing of the contents, including locally. AI sees only names.

9.2File and Folder names, descriptions and metadata (size, dates, settings) remain visible to the server in Private and Vault Folders as well.

9.3Raising the level applies to Files uploaded from that moment and does not encrypt Files uploaded earlier. In the same operation we remove from the server’s indexes the data concerning Files in that Folder. Lowering the level to Standard is not possible. A subfolder has the same or a stricter level than its parent.

9.4Recovery Key. When you first turn on encryption, the App generates a master key, which it stores in your Mac’s Keychain, and shows you the Recovery Key to save (ideally to print). Korfi has neither the Recovery Key nor the master key in a form that would let it read Files. If you lose the Recovery Key and access to the Mac holding the key, we will not be able to recover your encrypted Files or access to them. This loss cannot be undone. We do not provide any workaround, even at your request.

9.5You are responsible for keeping the Recovery Key in a safe place and for the security of your Mac. We are not liable for the consequences of losing the key or for disclosure of contents resulting from a takeover of your device, unless they result from an error in the App or the Service for which we are liable under general rules (section 17).

9.6Encryption is performed by the App on your Mac. Its effectiveness depends on the App working correctly, on your software being up to date and on the security of your device. Duplicate detection for Private and Vault Folders happens only locally. The Inbox and Buckets initially work only for Standard Folders.

9.7Share Links to encrypted Files contain the File key in the part of the address after the “#” sign, which the browser does not send to the server. Anyone who has the full link can decrypt the File. Pass it only to people you trust.

10. AI Assistant

10.1The AI Assistant is a helper tool. It searches, summarises and organises your Files: it helps you find a document, download it, upload a file to the cloud, change a description or a name. It does not generate images, faces or voices, and it does not classify or evaluate people.

10.2The Assistant uses artificial intelligence models from an external provider, through Korfi’s proxy. The proxy does not store the contents of your requests or replies: we store only usage metadata (model, number of tokens, cost, time, status), assigned to your Account. The model provider and the details are in the Privacy Policy. This does not mean the model provider does not process data: it processes it under its own terms.

10.3The Assistant can be wrong. Answers may be untrue, incomplete or out of date, may omit files or misstate the contents of documents. It is not legal, tax, medical or financial advice. Verify important information in the original document. For the Assistant, the contents of Files are data, not instructions, but the model can be misled by instructions hidden in documents, which is why it presents changes as cards for you to approve.

10.4The Assistant deletes nothing, either locally or in the cloud. Every action that changes something (upload, move, rename, change of description) requires your approval with one click.

10.5In Private and Vault Folders the Assistant by default sees only File names. We show the Assistant excerpts of contents from a Private Folder only with your consent in a given conversation. Contents from Vaults are not passed on. The chat shows which Files the Assistant has seen.

10.6You are talking to an artificial intelligence system, not to a human. You are responsible for what content you give the Assistant and for its lawfulness, in particular where it contains third parties’ data. [TO BE DECIDED: limits on using the AI Assistant in Plans (today usage is assigned to the user and visible to the administrator, with no limit); the lawyer to assess the obligations under Regulation (EU) 2024/1689 (AI Act), including Article 50]

12. Inbox (email)

12.1The Inbox is for receiving documents into your own Account: attachments from emails sent to your address in the in.korfi.app domain go to the “Inbox” Folder. By default we accept messages only from addresses you add. The Inbox is intended only for receiving. It is not for mass mailing or for sending messages on your behalf.

12.2It is prohibited to use the Inbox address to sign up for mass mailings in order to get around limits, for spam, or to receive prohibited content. We may reject messages (for example ones that are too large, contain malware or come from unauthorised senders) and disable an alias that is being abused.

12.3We establish the sender’s identity from a DKIM signature verified in our system, not from headers that the sender can write. You are responsible for the lawfulness of receiving and storing messages. The Inbox works only for Standard Folders.

13. Plans, payments and Paddle

13.1We publish the prices and scope of Plans in the price list on korfi.app. [TO BE DECIDED: plans and prices: the price list has not yet been set or published, and Paddle requires price information to be available on the domain. Until the price list is set, the beta Service is provided free of charge by invitation]

13.2Paddle is the seller. Paddle sells paid Plans as the seller (reseller, Merchant of Record). Paddle is the party to the contract of sale of the Plan, takes payments, issues invoices or proofs of purchase, calculates and remits taxes (including VAT) and processes refunds. Korfi does not issue invoices to buyers and does not demand payment from them. A purchase is also subject to Paddle’s terms for buyers and Paddle’s refund policy. We do not see your card number or other full payment details. [TO BE DECIDED: the division of roles and responsibility between Paddle and Korfi towards the Consumer (seller of the Plan versus provider of the digital service), including who receives requests under Articles 43m-43o of the Consumer Rights Act]

13.3Support. First-line billing support (invoices, payments, refunds, order questions) is provided by Paddle. Technical support for the Service (how the App works, the Account, Files) is provided by Korfi.

13.4Subscriptions. Paid Plans run in billing periods and renew automatically for the next period of the same length until you cancel them. You see the price and the period before purchase in the Paddle checkout. When we change the price or terms of a Plan, we notify you in advance and, where the law requires, ask for your consent. If you do not agree, you can cancel the subscription before the change takes effect. [TO BE DECIDED: the notice period for a price change (proposal: 30 days) and any trial period]

13.5Cancellation. You cancel a subscription directly: in the Account settings in the App or through the “Manage subscription” link in the message from Paddle. [TO BE DECIDED: the cancellation path in the App; Paddle requires a direct cancellation path. Until it is implemented, describe only the link from Paddle] Cancellation stops further renewals and takes effect at the end of the current billing period, to which you keep access. The unused part of the period is not refunded unless the law requires it or the Refund Policy provides otherwise.

13.6Refunds and withdrawal. Paddle processes refunds. The rules, including the Consumer’s right to withdraw from the contract within 14 days and the consents at checkout, are described in section 19 and in the Refund Policy.

13.7Failed payment. When a renewal payment fails, Paddle may retry and may cancel the subscription. We may then restrict paid features in accordance with section 14. [TO BE DECIDED: the grace period after a failed payment and the rules for Files above the free Plan limit] We will not delete your Files because of non-payment without warning and without a chance to download them.

13.8Free Plans. Korfi may, at its discretion, grant free Plans (for example to invited people, testers, or in promotions), including manually for selected Accounts. A free Plan involves no payment or refund. We state its scope and duration when it is granted. We may change or end it, observing the period from section 16 and with the ability to download Files.

14. Limits and Plan changes

14.1The Account storage limit covers all File versions, Files in Trash and in the Archive, and Files received through Buckets. Once the limit is exceeded you cannot upload new Files, and Files already stored remain available for download. Each Plan has the limits set out in the price list. [TO BE DECIDED: Plan limits: storage, maximum file size, number of links and Buckets, use of AI]

14.2We apply technical security and anti-abuse limits, for example a limit on the number of sign-in codes per hour, on the number of attempts to enter a code and on the number of attempts at a Share Link password. They may temporarily stop a feature from working.

14.3A Plan change is made through Paddle. If you lower your Plan and use more storage than the new limit allows, we do not delete Files automatically: you can download them, delete them or return to a higher Plan. [TO BE DECIDED: the exact rules after a Plan downgrade or the end of a subscription, including a read-only period before any deletion]

15. Availability, updates and changes to the Service

15.1We do our best to keep the Service running without interruption, but in the beta we do not guarantee any particular level of availability. We may carry out maintenance, and the Service depends on infrastructure providers and artificial intelligence model providers, whose outages may limit how it works. We will announce planned interruptions where possible.

15.2We provide updates to the App, including security updates, necessary to keep the Service in conformity with the contract, for as long as the Service is provided.

15.3We may change the Service, including adding, changing and withdrawing features, if the change results from a valid reason: a change in law or in authorities’ requirements, security considerations, bug fixes, technological development, a change of infrastructure or AI model provider, or changes to the service model. The change does not entail costs for a Consumer. Where a change significantly and negatively affects your access to the Service, we will inform you in advance on a durable medium (email), and as a Consumer you may terminate the contract without notice within 30 days of the change or of being informed of it (Articles 43p and 43q of the Consumer Rights Act).

15.4We will announce the end of the whole Service [TO BE COMPLETED: number] days in advance and allow you to download your Files. [TO BE DECIDED: the notice period for ending the Service]

16. Termination, suspension and Account deletion

16.1Deleting the Account yourself. You can delete the Account at any time in the App settings (a critical action requiring fresh confirmation) or by writing to us. The contract for the Service then expires under the rules below. Before deleting, you can download your Files and data (the “Download my data” feature). Deleting the Account does not itself cancel the subscription with Paddle: cancel it earlier under section 13. [TO BE DECIDED: whether deleting the Account should automatically cancel the Paddle subscription; whether the Delete account and Download my data features will be available in the released version (until then, deletion and export on request at hello@korfi.app)]

16.230-day cooling-off period. After you request deletion of the Account, we put it on hold for 30 days. During that time you can cancel the deletion by signing in or using the link in the confirmation email. After 30 days we delete the Account entirely: Files, Folders, versions, Trash, links and Buckets, sessions, passkeys, wrapped keys and Account data.

16.3Exceptions to full deletion:

Files in the Archive that are still under lock disappear only after the lock ends (up to 30 days from their upload);
evidence preserved under section 7 or at an authority’s request is deleted once the preservation is released (up to 90 days, unless an authority or the law requires longer);
data that we must keep by law or to defend claims, to the extent and for the period described in the Privacy Policy;
copies of metadata in the database history may exist for up to 30 days after deletion.

16.4Termination by Korfi. We may terminate the contract for a valid reason: a breach of the Terms (including section 6), a threat to the security of the Account or the Service, an obligation under law or a judgment, non-payment for a paid Plan, long-term inactivity of a free Account, or ceasing to provide the Service. Termination is made with a notice period of [TO BE COMPLETED: number] days and with the ability to download Files, and without a notice period where the breach is serious. [TO BE DECIDED: the notice period and the period of inactivity justifying termination]

16.5Suspension and blocking. The rules for blocking an Account, public links, Share Links, Buckets and Files because of breaches are set out in section 7. We may also suspend an Account because of a threat to its security (for example a suspected takeover). We inform you of a block by email with a statement of reasons. During a block because of a breach we do not provide access to Files, unless the law requires otherwise or the block does not concern lawful content.

16.6After the contract expires, provisions that by their nature continue (sections 17, 21 and 23) remain in force.

17. Liability

17.1We are liable for non-performance or improper performance of the contract under general rules. Nothing in the Terms excludes or limits Consumer rights that cannot be excluded, including rights arising from a lack of conformity of digital content or a digital service with the contract (Articles 43k-43o of the Consumer Rights Act) and liability for damage caused intentionally.

17.2We are not liable in particular for:

Users’ content, and Share Links and Buckets created by Users and sent by third parties, where we did not know of their unlawful nature and, after receiving a credible notice, promptly disabled access (Article 14 of the Act on the provision of electronic services, Article 6 DSA);
loss of the Recovery Key and the consequences of losing access to encrypted Files (section 9);
the consequences of the Archive lock, including the inability to delete a File before the lock ends (section 8);
the content of the AI Assistant’s answers and decisions taken on their basis (section 10);
interruptions and damage resulting from causes beyond our control, including outages of infrastructure providers, of networks and of your device, and force majeure;
a takeover of your Account where it results from sharing codes, keys or a device with third parties.

17.3As regards Business Users, Korfi’s liability is limited to actual direct damage and may not exceed [TO BE COMPLETED: amount or multiple of fees] (the total fees for the Service over the previous 12 months), excluding lost profits, within the limits permitted by law. This limitation does not cover damage caused intentionally. [TO BE DECIDED: whether and in what amount to limit liability towards Business Users; the effectiveness of the limitation in cases of gross negligence (Article 473 of the Civil Code); clauses on data loss (the lawyer to assess)]

17.4The User is liable to Korfi and to third parties for damage resulting from uploading, sharing or receiving prohibited content and from breaching the Terms, under general rules.

18. Complaints

18.1You can submit a complaint about how the Service works (including a lack of conformity of the Service with the contract) by email to hello@korfi.app with the subject “Complaint” or in writing to the correspondence address: Wólka Zatorska 16, 07-217 Wólka Zatorska, Poland. Give the email address of the Account, a description of the problem, when it occurred, and what you ask for (for example bringing the Service into conformity with the contract, a price reduction or withdrawal from the contract).

18.2We will reply to a Consumer’s complaint within 14 days of receiving it, on a durable medium (email). Failing to reply within that period means the complaint is deemed accepted (Article 7a of the Consumer Rights Act). We handle Business Users’ complaints within the same period unless we need additional information.

18.3If the Service is not in conformity with the contract, we will bring it into conformity within a reasonable time, without significant inconvenience and at our expense. Where this is not possible or has not happened within a reasonable time, as a Consumer you may demand a price reduction or withdraw from the contract under Articles 43m-43o of the Consumer Rights Act. We are liable for a lack of conformity that occurred or became apparent during the period in which the Service was to be provided.

18.4Send complaints about payments, invoices and refunds to Paddle first (section 13). If you write to us, we will pass the matter to Paddle and tell you so. Appeals against moderation decisions are made under section 7.

19. Right of withdrawal and information for Consumers

19.1A Consumer who has concluded a distance contract may withdraw from it within 14 days without giving a reason (Article 27 of the Consumer Rights Act). For paid Plans the seller is Paddle, which accepts the statement and returns the money, including through the withdrawal button in its customer portal (see the Refund Policy). We count the period from the conclusion of the contract; later subscription renewals do not, as a rule, start a new period.

19.2Consent to start of performance before the 14 days expire. In the Paddle checkout you can expressly consent to the Service starting, or the digital content (the App) being made available, before the 14 days expire, and acknowledge that you may consequently lose the right of withdrawal (Article 38(1) and (13) of the Consumer Rights Act) and, if you withdraw after performance has begun, pay for the performance rendered up to the time of withdrawal (Article 35). [TO BE DECIDED: the legal classification (digital content or digital service) and the exact wording of the consents in the Paddle checkout; the lawyer to check compliance with Article 38(1) and (13) and Article 35]

19.3Free Plan. You can delete a free Account at any time without giving a reason (section 16). Because a free Plan involves no payment, this gives rise to no refund.

Information required for a distance contract

Main features of the Service: section 3. Price and method of payment: the price list on korfi.app and the Paddle checkout (section 13). Duration of the contract: indefinite for the Account; a paid Plan for a billing period with automatic renewal. Termination of the contract: section 16.
Functionality, compatibility and interoperability: the Service works with the App on macOS and with a browser (link pages and passkeys). Apart from encryption at your request, we do not apply technical content protection measures (DRM).
Liability for conformity of the Service with the contract and the complaints procedure: section 18.
Out-of-court ways of handling complaints and pursuing claims: section 22.

20. Changes to the Terms

20.1We may change the Terms for valid reasons: a change in law, judgments or authorities’ requirements, changes to features of the Service, security considerations, technological changes, a change of providers, or correcting errors and ambiguities. A change does not affect contracts that have already ended.

20.2We notify you of a change by email to the Account address and in the App at least 30 days before it takes effect, indicating the changes and the date. Before the change takes effect you can terminate the contract (delete the Account) without incurring costs. If you do not terminate the contract, the change binds you from the date it takes effect (Article 384 of the Civil Code). At your next sign-in after the change takes effect we will ask you to accept the new version again; until then we may limit use of the Service to downloading Files.

20.3Changes required by law or serving security may take effect on a shorter notice, to the extent necessary. Changes that significantly and negatively affect a Consumer’s access to the Service are also subject to Article 43q of the Consumer Rights Act (section 15).

20.4We make earlier versions of the Terms available on request. We mark the version in force with a number and a date.

21. Governing law and courts

21.1Polish law governs the contract for the Service. The choice of Polish law does not deprive a Consumer of the protection afforded by the provisions of the law of the country of their habitual residence that cannot be derogated from by agreement (Article 6(2) of Regulation (EC) No 593/2008, Rome I).

21.2Disputes with Consumers are resolved by courts competent under the general rules. A Consumer may sue Korfi before the court of their place of residence. Disputes with Business Users are resolved by the court competent for Korfi’s registered office. [TO BE DECIDED: the competent court for disputes with Business Users]

21.3The contract of sale of a Plan with Paddle is subject to Paddle’s terms for buyers, including the rules on governing law and courts set out in those terms.

22. Out-of-court resolution of consumer disputes

22.1A Consumer may use out-of-court ways of handling complaints and pursuing claims, in particular mediation or arbitration before an entity authorised to resolve consumer disputes out of court (the list is kept by the President of UOKiK at uokik.gov.pl), and may also ask for free help from the county (municipal) consumer ombudsman, the provincial inspectorate of the Trade Inspection, or a consumer organisation.

22.2Agreeing to take part in such proceedings is at Korfi’s discretion. We will inform you of our position where a complaint is not resolved, in accordance with the Act on out-of-court settlement of consumer disputes. [TO BE DECIDED: whether Korfi agrees to take part in ADR proceedings; the wording of the required information after an unresolved complaint]

22.3The European Commission’s ODR platform was shut down on 20 July 2025, so we do not refer to it.

23. Intellectual property and licence

23.1The App, the Website, trademarks and Korfi software belong to Korfi or its licensors. We grant you a non-exclusive, non-transferable licence to use the App in order to use the Service, for the duration of the contract. Copying, decompiling and circumventing the App’s safeguards is prohibited beyond what the law permits. The App contains open-source components under their licences. [TO BE COMPLETED: information on open-source licences and the address where they are available]

23.2You keep all rights in your content. You grant Korfi a non-exclusive licence, limited to what is necessary to provide the Service at your instruction: storing, transmitting, making technical copies, processing within the features you use (for example search or the AI Assistant), sharing through Share Links and Buckets, and preserving and deleting content under the Terms. The licence ends when the content is deleted, subject to the deletion periods in the Terms.

23.3Korfi does not use Users’ content to train artificial intelligence models. [TO BE DECIDED: confirm in the terms of the infrastructure and AI model providers that data passed through the API is not used to train models]

23.4We may use comments and ideas that you give us about the Service without payment, without disclosing your content.

24. Final provisions

24.1If any provision of the Terms turns out to be invalid or non-binding, the remaining provisions stay in force.

24.2The Polish version of the Terms is the binding one. This English text is a translation provided for convenience. We conduct correspondence about the Service in Polish or English, to the Account email address and in the App.

24.3We may transfer rights and obligations under the contract to a legal successor running the Service, provided this does not worsen the User’s position; we will inform you in advance. [TO BE DECIDED: whether the User’s consent is required for a transfer of the contract, especially for Consumers]

24.4The Terms apply from [TO BE COMPLETED: effective date after legal review]. The version of 25 October 2026 is a draft for legal review and does not apply until it is approved and published without working markers.

Questions about the Terms: hello@korfi.app. Abuse reports: abuse@korfi.app.