Terms of Service

1. Scope, Contracting Party and Business Customers Only

These Terms of Service ("Terms") govern all contracts between Mustafa Serhat Dündar, trading as Konfidant, Bergstraße 70, 10115 Berlin, Germany ("Konfidant", "we", "us", "our") and the customer ("Customer", "you") regarding the website https://www.konfidant.app, the dashboard, the download pages (including download pages served on custom domains), the REST API, the official SDKs and the documentation (together, the "Services").

Conflicting, deviating or supplementary terms of the Customer do not become part of the contract, even if we do not expressly object to them or perform the contract without reservation. Individually negotiated agreements in text form (for example, an Enterprise order form) take precedence over these Terms. The Data Processing Agreement ("DPA") forms part of the contract. If the DPA and these Terms conflict regarding the processing of personal data, the DPA prevails.

The contract language is English.

2. Description of the Services

Konfidant enables Customers to share confidential texts (such as passwords, API keys or credentials) and files with recipients through one-time links. The core functions are:

• Client-side encryption: content is encrypted on the sender's device (in the browser or by our official SDKs) with AES-256-GCM, using a random key generated for each share. The key is placed in the part of the share link after the "#" sign, which browsers do not transmit to servers. We receive and store only encrypted content.
• One-time links: each share link also contains a single-use access token. The encrypted content can be retrieved once; the token becomes invalid when it is used, and the recipient's device decrypts the content with the key from the link.
• Expiry: each share expires after the time to live ("TTL") selected by the Customer within the limits of its plan. After expiry, the encrypted content can no longer be retrieved and is deleted; encrypted files are deleted at the latest 30 days after upload.
• Burn after reading: after a share has been opened, we delete the encrypted content.
• Depending on the plan: organizations with multiple users, a choice of storage region for files (EU or US), audit logs, verified burn (recording of the time a share was opened), custom download domains and API access.

The features, limits (such as maximum file size, maximum TTL and number of API shares) and prices of each plan are those shown on our pricing page and in the dashboard at the time of your order. Features marked as "coming soon", "beta" or similar are not owed until they are made generally available. Statements on our website, in blog articles or in marketing materials are descriptions, not guarantees (§ 443 BGB); a guarantee requires an express written declaration designated as such.

3. Security Model and Its Limits

We design the Services to protect confidential content, and we describe the technical and organizational measures we apply in Annex 2 of the DPA. To allow you to make an informed decision about whether the Services are suitable for your purposes, you acknowledge the following characteristics:

• We cannot read your content, and cannot recover it. Encryption and decryption take place on the devices of the sender and the recipient. We never receive the decryption key, so we can neither access the content of a share nor restore it if a link is lost. We do learn technical metadata, such as the size of the encrypted content and the times of upload and access.
• Trust in the code we deliver. When you use the web application, your browser runs the encryption code that we deliver. Its protection therefore depends on the integrity of that code and of your device and browser. Our official SDKs encrypt locally without depending on code delivered at the time of use.
• Links are bearer credentials. Anyone who obtains a share link before it is used or expires can open the share. We cannot verify the identity of a recipient. The person who opens the link first consumes it. You are responsible for choosing a suitable channel to transmit links and, where appropriate, for transmitting particularly sensitive content in separate parts or through separate channels.
• Recipient devices are outside our control. Once a recipient has opened a share, the content is displayed or downloaded on the recipient's device. We have no influence over copies, screenshots, caching, malware or further disclosure on that device.
• Automated link processing. A share is only consumed when someone actively opens it on the download page, so ordinary link previews do not consume it. Automated tools that interact with web pages, and anyone who obtains the full link, can still open it.
• No absolute security. No system is free of vulnerabilities. We do not owe a specific level of security beyond the measures described in the DPA and the state of the art appropriate to the risk (Art. 32 GDPR).

4. No Storage, Archiving or Backup Service

The Services are designed to make content irretrievable. Content is deleted or becomes permanently undecryptable after it has been opened or when its TTL expires, and this cannot be reversed. Our database backups (kept for 7 days) contain text shares only in encrypted form, and we never have the keys, so we cannot restore deleted, expired or consumed shares, including where a link was consumed by mistake or by an automated link scanner.

The Services are not a storage, archiving or backup service. You must keep your own copies of any content you share and must not use the Services as the only location of any data. You are responsible for complying with any retention obligations that apply to you.

5. Conclusion of Contract

The presentation of plans on our website is not a binding offer. A contract for the free plan is concluded when you complete the registration and your account is created. For paid plans, you select a plan and the number of seats (and, where applicable, an API add-on) in the dashboard and are redirected to the checkout page of our payment provider Stripe. Before submitting the order, you can review and correct all entries. By clicking the order button, you submit a binding offer; the contract is concluded when the paid plan is activated for your organization or we confirm the order, whichever occurs first.

Product demos that you book through our website are free of charge and do not create any obligation to purchase. Information given in a demo or other pre-contractual communication, including about features, prices or roadmap, is non-binding and does not amend these Terms unless we confirm it in text form.

The current version of these Terms is available at any time at https://www.konfidant.app/terms and can be saved and printed. Your subscription and invoices are available in the dashboard and the Stripe customer portal. The obligations under § 312i (1) sentence 1 nos. 1 to 3 BGB are waived to the extent permitted between businesses.

6. Accounts, Organizations, Seats and API Keys

You must provide accurate information when registering and keep it up to date. Accounts are personal; each seat may be used by one natural person only. The administrators of an organization manage its members, settings, API keys and subscription and act on behalf of the Customer.

You must keep login credentials and API keys confidential, protect them according to the state of the art, and share API keys only with persons and systems within your organization. We recommend enabling multi-factor authentication. You must notify us without undue delay if you suspect misuse and revoke affected API keys in the dashboard. You are responsible for all activities carried out through your accounts and API keys unless you are not responsible for the misuse.

If your organization has more members than paid seats or more API keys than your plan permits (for example, after a downgrade), we may restrict the use of the Services for some members or keys until the number has been reduced or additional seats have been purchased.

7. Customer Responsibilities

You are solely responsible for:

• the content you or your users share, and for having all rights and legal bases required to share it;
• selecting recipients, the TTL and the transmission channel for links, and for informing recipients where this is required by law (for example, under Art. 13 or 14 GDPR for personal data you share);
• assessing whether the Services meet the legal, regulatory and contractual requirements that apply to you;
• the security of your own systems, devices, networks and integrations, including the systems through which you call our API;
• keeping your own copies of shared content (see Section 4).

8. Acceptable Use and Prohibited Content

You must not use the Services, and must not allow others to use them, to:

• share content whose distribution or possession is illegal, including child sexual abuse material, terrorist content, content that infringes intellectual property rights, trade secrets or personal rights of third parties, or content obtained through criminal acts;
• distribute malware, ransomware or other harmful code, or to conduct phishing, fraud, extortion or the exfiltration of data from systems or organizations you are not authorized to remove it from;
• send spam or unsolicited mass communications, or distribute links publicly as a file hosting service;
• circumvent plan limits, quotas, rate limits or technical restrictions, create multiple free accounts, or share accounts between persons;
• test, scan or attack the security of the Services (including load testing) without our prior consent in text form, except as described in Section 23;
• decompile or reverse engineer the Services, except where mandatory law permits it (§ 69e German Copyright Act, UrhG), or use the Services to build a competing product;
• violate applicable law, including export control and sanctions law.

Because content is encrypted, we do not monitor or scan it and are under no general obligation to do so. We act on specific notices as described in Section 9.

9. Notices of Illegal Content and Restrictions

This section contains the information required by Art. 14 of the Digital Services Act (Regulation (EU) 2022/2065, "DSA").

Reporting illegal content. Anyone can notify us of content they consider illegal or in breach of these Terms by email to hello@konfidant.app with the subject "Content notice". A notice should contain the share link or other information identifying the content (such as the custom domain or the time of receipt), an explanation of why the content is considered illegal, the name and email address of the person submitting the notice (except for notices concerning offences relating to child sexual abuse material), and a statement that the notice is submitted in good faith and is accurate and complete (Art. 16 DSA). We confirm receipt and decide on notices in a timely, diligent, non-arbitrary and objective manner. We do not use automated systems to moderate content.

Possible measures. Because share content is encrypted and single-use, we usually cannot view it. Measures we may take, limited to what is proportionate, include disabling a specific share or link, blocking a custom domain, suspending API keys, suspending individual users or the account, and terminating the contract. Where we suspect a criminal offence involving a threat to the life or safety of persons, we inform the competent authorities (Art. 18 DSA).

Statement of reasons and complaints. If we restrict your use of the Services, we inform you of the reasons, unless this is prohibited by law or an order of an authority (Art. 17 DSA). You can object to our decision by email to hello@konfidant.app; we will review it and inform you of the result. Your right to take legal action remains unaffected.

Points of contact. Our single point of contact for authorities, the European Commission and the European Board for Digital Services, and for recipients of the Services (Art. 11 and 12 DSA) is hello@konfidant.app. Communication is possible in English and German.

10. Regulated and Special Categories of Data

The Services are a general-purpose sharing tool. Unless expressly agreed in text form, we do not assume any obligations specific to particular industries or regulatory regimes, and we do not provide certifications or enter into agreements such as HIPAA Business Associate Agreements, PCI DSS attestations or similar.

If you intend to share special categories of personal data (Art. 9 GDPR), personal data relating to criminal convictions (Art. 10 GDPR), payment card data, classified information, or information subject to professional secrecy (for example, § 203 German Criminal Code, StGB), you must assess in advance, based on the description in Section 3 and the DPA, whether the Services are suitable and whether additional measures are necessary. For professional secrecy holders, the DPA contains a confidentiality undertaking pursuant to § 203 (3) and (4) StGB.

11. Custom Domains and Branding

On eligible plans, you can serve download pages on a subdomain you control. You must own or be authorized to use the domain and must create and maintain the DNS records we specify. We obtain the TLS certificate for the domain through our provider Cloudflare. You are responsible for the domain, its DNS configuration and any content associated with it; we are not liable for interruptions caused by changes to your DNS records or the expiry of your domain.

On plans that include branding, you can show a company name and logo on the download pages of your custom domain. You may only use names and logos that you own or are authorized to use. They must not infringe the rights of third parties, in particular trademark, name or copyright, and must not be misleading, in particular by suggesting that the download pages come from a company other than yours. You grant us a non-exclusive, royalty-free right, limited to the term of the contract, to store the name and logo and display them on your download pages and in the dashboard. You are responsible for them as for your content (Section 7) and indemnify us against claims by third parties arising from their use as described in this Section; you are not liable if you are not responsible for the infringement.

We may hide or remove a name or logo if there are concrete indications that it infringes the rights of third parties or is misleading; Section 20 applies accordingly. If your plan no longer includes branding, your download pages show Konfidant branding again; the stored name and logo are kept until you remove them or the contract ends.

12. API, SDKs and Usage Limits

For the term of the contract, we grant you a non-exclusive, non-transferable, non-sublicensable right to use the Services, including the API, for your own business purposes within the limits of your plan. SDKs and other software we publish under an open-source license are governed by that license.

Each plan includes the number of API shares, request rates and other limits shown on the pricing page or in the dashboard. Without an API add-on, requests beyond the included limit are rejected. With an API add-on, shares beyond the included volume are charged as overage at the price shown at the time of your order. We may apply reasonable technical rate limits to protect the stability of the Services.

We may deprecate API versions or endpoints. We will announce changes that require you to adapt an integration at least 30 days in advance by email, unless an earlier change is necessary for legal or urgent security reasons.

13. Prices, Usage-Based Fees and Payment

All prices are stated in US dollars (USD). In accordance with § 19 of the German VAT Act (UStG, small business regulation), no VAT is charged. You are responsible for any taxes, duties or withholdings payable in your country; if withholding tax is deducted, you must pay the amount required for us to receive the full price.

Subscription fees (per seat and, where applicable, the base fee and API add-on) are payable in advance at the beginning of each billing period. Usage-based fees (such as API overage) are calculated based on our records and charged at the end of the billing period in which they arise. Our usage records are decisive unless you prove that they are incorrect. Changes to the number of seats or to the plan during a billing period are charged or credited on a pro-rata basis as calculated by Stripe.

Payments are processed by Stripe; the available payment methods are shown at checkout. You authorize us to charge the payment method you have provided for all fees due. Invoices are provided electronically. If a payment fails, the paid features of your plan are suspended until the outstanding amount has been paid: the limits of the free plan apply, and only administrators can continue to use the Services, so that they can update the payment method and settle the amount. Members other than administrators cannot create shares during this time. Objections to invoices must be raised in text form within 30 days of receipt.

14. Term, Renewal and Cancellation

Free plan: The contract runs for an indefinite period. Either party can terminate it at any time; you can do so by deleting your account or notifying us.

Paid plans: Subscriptions have the billing period selected at checkout (currently one month) and renew automatically for the same period unless cancelled before the end of the current period. Cancellation takes effect at the end of the current billing period. Fees already paid are not refunded, except as provided in Sections 16, 20 and 26.

Administrators can cancel in the dashboard via the Stripe customer portal. You can also cancel by email to hello@konfidant.app. Text form is sufficient. The right of both parties to terminate for good cause (§ 314 BGB) remains unaffected.

When the contract ends, access to the Services ends. Shares that have not yet expired become inaccessible and are deleted. We delete account data as described in our Privacy Policy and the DPA. If you need an export of your audit logs, you must request it before the contract ends.

15. Availability, Maintenance and Support

We aim for high availability of the Services but do not guarantee a specific level of availability unless a service level agreement has been concluded in text form. The current status is published at konfidant.openstatus.dev. Planned maintenance is announced in advance where possible. Interruptions caused by circumstances beyond our reasonable control (for example, failures of the internet, of our infrastructure providers, attacks, or force majeure) are not a breach of our obligations.

Support is provided by email. Response times stated on the pricing page are targets, not guarantees.

16. Changes to the Services

We continuously develop the Services and may change them, provided that the essential functions of your plan are maintained and the change is reasonable for you, in particular to comply with legal requirements, to address security risks, or for technical improvement. If a change materially impairs your use of the Services, we will inform you at least 30 days in advance (unless an earlier change is necessary for legal or urgent security reasons), and you may terminate the affected subscription with effect from the change taking effect. We will refund fees paid in advance for the period after termination on a pro-rata basis.

17. Warranty

We provide the Services in a condition suitable for contractual use. You must report defects without undue delay in text form with a description that allows us to reproduce them. We will remedy reported defects within a reasonable period. Strict liability for defects already existing when the contract is concluded (§ 536a (1) first alternative BGB) is excluded. Claims for damages are subject to Section 18.

The free plan is provided free of charge; for it, we are liable for defects only if we fraudulently concealed them (§ 600 BGB applies accordingly), without prejudice to Section 18 paragraph 1.

18. Limitation of Liability

We are liable without limitation for damages caused intentionally or by gross negligence, for injury to life, body or health, under any guarantee we have given, for fraudulently concealed defects, under the German Product Liability Act (Produkthaftungsgesetz), and wherever liability cannot be limited by law, including under Art. 82 GDPR to the extent mandatory.

In cases of slight negligence, we are liable only for breaches of essential contractual obligations, meaning obligations whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance you may regularly rely (cardinal obligations). In that case, our liability is limited to the damage that is foreseeable and typical for this type of contract. Otherwise, liability for slight negligence is excluded.

The parties consider the damage that is foreseeable and typical within the meaning of the preceding paragraph to amount to no more than the greater of (a) the fees paid by you for the Services in the 12 months before the event giving rise to the damage and (b) EUR 2,500, per contract year. If you expect higher potential damage, please inform us before concluding the contract so that we can agree on an individual limit.

Liability for indirect damage, lost profit and lost savings is excluded in cases of slight negligence. For the loss of data, we are liable only to the extent that the loss would also have occurred if you had kept proper own copies (Section 4); the deletion of content after it has been opened or has expired is the intended function of the Services and is not a loss of data.

For the free plan, we are liable only for intent and gross negligence, without prejudice to paragraph 1.

Claims for damages against us become time-barred one year after the beginning of the statutory limitation period, except in the cases listed in paragraph 1. The above limitations also apply to the personal liability of our employees, representatives and vicarious agents.

19. Indemnification

You indemnify us against all claims by third parties (including recipients and authorities) arising from content shared through your account, or from your or your users' breach of these Terms or of applicable law, provided that you are responsible for the breach. This includes the reasonable costs of legal defense at statutory rates and fines imposed on us as a result of such breach, to the extent legally permissible. We will inform you of such claims without undue delay, will not acknowledge them without your consent, and will give you the opportunity to defend against them.

20. Suspension and Termination by Us

We may temporarily block access to the Services, individual users, API keys, shares or custom domains if there are concrete indications that (a) the Services are being used in breach of Section 8 or applicable law, (b) the security or stability of the Services or of third parties is at risk, (c) an account or key has been compromised, or (d) a payment is overdue as described in Section 13. We limit any block to what is necessary, inform you without undue delay (unless prohibited by law or this would defeat the purpose of the block), and lift it once the reason no longer applies.

We may terminate paid subscriptions with 30 days' notice to the end of a billing period. If we terminate for a reason for which you are not responsible, we refund fees paid in advance for the period after termination on a pro-rata basis. Our right to terminate for good cause remains unaffected; good cause includes in particular serious or repeated breaches of Section 8, payment default of more than two months' fees, or the use of the Services by a consumer.

21. Data Protection and Data Processing Agreement

For content and related metadata that you share through the Services, you are the controller and we act as your processor. Our Data Processing Agreement pursuant to Art. 28 GDPR applies and is concluded when you accept these Terms. For account, billing and website data, we are the controller; details are in our Privacy Policy.

22. Confidentiality

Each party will keep confidential all non-public information of the other party that is marked as confidential or whose confidential nature is evident, and use it only to perform the contract. This does not apply to information that is publicly known, was lawfully known to the receiving party beforehand, is independently developed, or must be disclosed by law or an order of an authority or court (in which case the other party will be informed where legally permitted). The obligation continues for three years after the end of the contract. Obligations regarding share content are governed by the DPA, without time limit.

23. Security Vulnerability Reports

We welcome reports of security vulnerabilities. Please send them to hello@konfidant.app with the subject "Security report" and give us reasonable time to fix the issue before any disclosure. When investigating, you must only use accounts and shares you own, must not access, modify or delete data of others, must not degrade the Services (no denial-of-service or automated mass testing), and must stop and report as soon as you have established a vulnerability. We will not pursue legal action against good-faith research that complies with these rules. This is not a bug bounty program, and no reward is owed.

24. Intellectual Property and Feedback

All rights in the Services, including the software, documentation, website content, and the Konfidant name and logo, remain with us. You retain all rights in your content; you grant us only the rights necessary to process it to provide the Services.

You may name us as your provider. We may name your organization as a customer, including your logo, only with your prior consent. If you give us feedback, we may use it without restriction or compensation.

25. Export Controls and Sanctions

The Services include encryption technology. You must comply with applicable export control and sanctions law. You confirm that neither you nor your users are listed on sanctions lists of the European Union, the United Nations, Germany or the United States, or are located in, or acting on behalf of persons in, a country or region subject to comprehensive EU or US sanctions. We may refuse or terminate the contract to comply with sanctions law.

26. Changes to These Terms and Prices

We may amend these Terms with effect for the future if there is a valid reason, in particular changes in the law or case law, changes to the Services, or the closing of gaps in the provisions, provided that the amendment does not shift the balance between performance and consideration to your disadvantage. We will inform you of the amendments in text form at least 30 days before they take effect. If you do not object in text form before the amendments take effect, they are deemed accepted; we will point out this consequence in our notice. If you object, the previous Terms continue to apply, and either party may terminate the contract with effect from the date the amendments were to take effect.

We may increase prices for existing subscriptions with effect from the next billing period by giving at least 30 days' notice in text form. In that case, you may terminate the subscription with effect from the date the increase takes effect. Price reductions may be applied at any time.

27. Governing Law and Jurisdiction

These Terms and all contracts under them are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules.

The exclusive place of jurisdiction for all disputes arising out of or in connection with the contract is Berlin, Germany, if the Customer is a merchant (Kaufmann), a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany. We may also bring an action at the Customer's general place of jurisdiction.

28. Final Provisions

If any provision of these Terms is or becomes invalid, the validity of the remaining provisions remains unaffected. You may transfer rights and obligations under the contract only with our prior consent in text form; § 354a German Commercial Code (HGB) remains unaffected. You may only set off claims that are undisputed or have been finally established by a court. Declarations under the contract can be made in text form (for example, by email); we send notices to the email address of the account owner or administrators.

We are not willing or obliged to participate in dispute resolution proceedings before a consumer arbitration board.

29. Contact and Legal Notice

You can reach us by email at hello@konfidant.app or by post at Mustafa Serhat Dündar, Bergstraße 70, 10115 Berlin, Germany. Our full legal notice is available in the Impressum.

Overview of related documents

• Data Processing Agreement (including technical and organizational measures and sub-processors)
• Privacy Policy
• Impressum