Terms and privacy in plain words
Read what you agreed to: prepaid credits never refunded, who owns the results, what you may not do, and how long your data is kept.
Intelligence has two public legal documents: the Terms of Service and the Privacy Policy. Both open without an account, in English, French or Chinese. This page is a reading guide for whoever has to answer “what did we agree to”, usually an admin, a finance lead or the person about to click Buy. The documents themselves are the agreement. This page is not.
The short version
The product is prepaid. You buy credits, each run takes its price off the balance, and credits are never refunded. You own what you put in and what the product writes for you, and you are expected to check results before you use them. Hong Kong law governs, because the company behind the product is a Hong Kong company. Everything below expands on those points, in the order people ask about them.
Where the documents are
Every page carries Terms of Service and Privacy Policy at the bottom. Both are also linked from the sign-in page, and the Terms again from the Buy Credits page.
The two share a frame. A dark band at the top gives three facts: Effective, the date that version took effect, Version, and Operator, which reads Beyond Border Group Limited, Hong Kong SAR. Each document carries its own date, so the two rarely match.
| Control | What it does |
|---|---|
| Read in | Switches the text between English, French and Chinese. |
| Prints the document, or saves it as a PDF, with the page furniture dropped. | |
| Privacy Policy / Terms of Service | Opens the other document, in the language you were reading. |
| Contents | The list of sections down the left. Click one to jump to it. |
| Back to top | Turns up once you are inside the text. |
A thin rule across the top of the window fills as you scroll, so you can see how much is left. When legal or finance asks for the version on file, Print is the fastest way to give it to them.
The English text is the binding one. The French and Chinese versions are a convenience, and both documents say so in their last section.
Note: You do not have to be signed in to read either one. If you are, the band offers Back to Buy Credits and Back to the app. If you are not, both links read Sign in.
When you accept the Terms
Three moments, and most people meet two of them:
- Creating an account on your own, at the sign-up step.
- Joining an organization from an invitation, on the Join page.
- Before your first purchase of credits. The Buy button on the Buy Credits page stays gray until the box is ticked.
That third tick is recorded with its date, its time and the network address it came from. It covers every later purchase made under the same version. Change the text in substance and the version date moves, which brings the tick box back at your next purchase.
If you sign for a company, the Terms treat you as having the authority to bind it. If you do not agree with them, the only option they leave is not to use the product.
To keep a copy of what you accepted, open the Terms and use Print. The version date on the page is the one your tick was recorded against.
The money rules
Money is what people actually come here for.
Credits are prepaid. You buy them first, and each run takes its price off a balance as it happens. At zero, AI features stop and the rest of the product keeps working. Prices can move at any time, including between two runs of the same kind, and the one that counts is the price in force when the run executes. You see each amount on the run and in your usage log. If an admin buys the credits for everyone, the tick and the purchase are theirs, but the Terms bind the organization, not just the person who clicked.
Then the hard part. Credits are not refundable. Not in part, not when they sit unused, not when a purchase was larger than you meant, not when an answer turns out useless, not after a price change, not for downtime, and not when an account closes. The Terms give it a section of its own. Credits are not money in any other sense either. They earn no interest. They do not move between organizations. They do not turn back into cash.
Important: There is no cooling-off period on credits, and no partial refund on a balance you stop using. Buy in the amounts you expect to spend, and let automatic top-up handle the rest rather than loading the account in advance.
Automatic top-up counts as a purchase like any other, so every charge it makes is final too. You can switch it off, or change the threshold, the amount, the daily limit or the card, whenever you want. See automatic top-up.
Storage is billed as well. Files you keep carry a daily rent, downloads are charged by size, and if a balance cannot cover the rent, access to the stored files can be restricted and the files deleted after notice.
The product is sold for business use, which is why the refund section reads the way it does. The Terms add that nothing in it removes a right a consumer holds under Hong Kong law that a contract cannot exclude.
Payments run through Stripe. Card and Alipay purchases are charged in US dollars. WeChat Pay is charged in Chinese yuan at the fixed rate shown before you pay, and you still receive the dollar amount you chose. Prices exclude any tax that applies where you are; Hong Kong itself levies no value added tax and no sales tax.
Two endings are worth knowing about before they happen. Disputing a purchase whose credits you already hold can suspend the account and the organization and reverse the credits until it is settled. And a balance left over when access ends is forfeited, whatever ended it.
Who owns what
Your data stays yours. The operator gets the right to host it, copy it and process it to run the product for you, keep it secure and meet legal obligations. That is the whole of the license.
You own the results the product generates, and you can use them for any lawful purpose. Two caveats come with that. AI models can hand two customers the same answer, so nothing guarantees a text or an image is unique to you. And a result can carry material that belongs to somebody else, which is your problem to clear before you publish, not after.
The product itself is not yours. The software, its design, the prompts behind it, the workflows, the agent definitions and the skills shipped with it stay with the operator. Suggestions you send in are free for it to use.
What you may not do
Ten clauses cover acceptable use. Most describe things you were never going to do. These are the ones an ordinary customer can trip over:
- Sharing a login. Everyone gets their own account.
- Reselling the product, or opening it to people outside your organization.
- Working around usage limits, prices, daily allowances or access controls.
- Feeding in data you have no right to use.
- Generating content that is illegal, defamatory, harassing or deceptive, including anything that passes itself off as a real person.
- Letting a result decide something with legal weight about a person, in credit, employment, insurance, housing or law enforcement, with no human in the loop.
- Presenting a result as an independently verified fact.
Break one and the account can be suspended or closed. Nothing already spent or bought comes back with it.
You are also asked to check results before relying on them. The Terms are blunt about it: AI is probabilistic. A result can be incomplete, out of date, biased or simply invented, and it can read as authoritative while being wrong. Nothing the product writes is legal, financial, medical or tax advice.
What the Privacy Policy says
That covers the Terms. The second document is shorter and answers a different question: not what you agreed to, but what happens to the data once it is in.
The policy splits your data in two. That split decides who has to answer when somebody asks about it. Data access and privacy covers the same ground from the product side, brand by brand.
For the data an account needs to exist, the operator is the controller: your name, your address, your role, your sign-ins, your usage records, your billing. The policy is your reference there.
For the content your organization puts in, the operator is a processor and your organization is the controller: files, records, prompts, connected systems and everything produced from them. To know what is held about you in that pile, ask your organization. A request sent to the operator is passed along to it.
What is collected
Your account data comes first: name, address, role, interface language, the brands you belong to. Then the security trail, where every sign-in, sign-out and password reset is stamped with a date, a time, a network address and the browser used. Usage records follow the work itself: which module, which model, how long the run took, what it cost. On top of that sit billing data, the content your organization submits, and a log of every email the product sends you, kept so support can confirm a delivery or send a link again.
Full card numbers never reach the product. Stripe collects them on its own pages and is the controller of them. Passwords are never stored in a readable form.
The policy also states what is not done with any of it: no selling, no renting, no advertising.
What happens on an AI run
Each run sends what it needs to the model running it: your prompt, the instructions of the module or the agent, and any file or image attached. The model’s name, the maker behind it and the price appear in the product and are recorded afterward.
Your content is not used to train models. The policy says providers are picked because their terms do not train on what is submitted through the channel the product uses. Once content reaches a provider, that provider’s own terms and retention rules apply, and those are not something the product can vary for you.
Where the data sits, and how it is guarded
The operator works from Hong Kong and its providers work from several countries, so personal data is processed outside Hong Kong and, for European users, outside the European Economic Area. Those transfers run under the contractual protections the agreements require, including the European Commission’s standard contractual clauses where they apply.
On the security side, access follows the organization, the brand and the role: you see your organization, the brands you were granted and the connected systems an admin opened to you, and nothing more. Traffic is encrypted in transit, passwords are held as hashes, sign-ins and administrative actions are logged. If a breach touches your personal data and is likely to harm you, the policy commits to telling you and the authority.
Systems you connect
Only admins add, change or remove a connection, and who may read each one is set person by person. The credential is stored, used only for the calls the work needs, never shown back in full, and revocable at any time. See connections.
Cookies
No advertising cookie, no third-party tracking. Your browser holds a cookie for your interface language, a cookie the server reads to render your pages, and the session tokens that keep a reopened tab signed in. Signing out clears them.
How long things are kept
| Data | Kept |
|---|---|
| Account data | While the account exists |
| Your organization’s content | While your organization keeps it |
| Sign-in, security and usage records | While they are useful for security and billing questions, then removed or reduced to figures that name no one |
| Invoices and billing records | Seven years, as Hong Kong law requires |
| The email log | While the account exists, so a message can be confirmed or sent again |
Deleting a file, a record or an asset in the product takes it out of the product. Copies sitting in ordinary backups age out with those backups rather than vanishing the same day.
Logins are deactivated, never erased, so an organization’s billing history and audit trail stay truthful. See users and invitations.
Children, and decisions taken by machine
The product is professional software and is not meant for anyone under 18. No account is knowingly created for a child.
Nothing in the product decides anything with legal effect about a person on its own. It writes, analyzes, prices runs and deducts credits automatically, but a proposal is there for a person to read and act on.
Your rights
You can ask what is held about you, have it corrected, get a portable copy, have it erased, restrict or object to a particular use, and withdraw a consent without that touching what was done before. Hong Kong’s Personal Data (Privacy) Ordinance gives a right of access and of correction, answered within forty days. If the European GDPR or China’s PIPL applies to you, you hold the rights they grant too.
Write through the contact form, giving the address of your account and the name of your organization. If the answer does not satisfy you, you can complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong, or to the authority of your own country.
The clauses that bite
Availability and support
No uptime is promised. Neither is the continued availability of any given model or feature, and downtime earns no service credit. Support runs by email and through the contact and bug report forms, in Hong Kong business hours, on a reasonable-effort basis. In practice that means an answer, not a deadline.
Liability
Liability is capped at what you paid for credits in the twelve months before a claim, and never above what you paid in total. Indirect losses, lost profit and decisions taken on the strength of a result sit outside it.
Law, disputes and changes
Disputes start with a written notice and thirty days to talk. After that they go to arbitration in Hong Kong, one arbitrator, in English. Class actions are out.
Both documents can be amended. The version date at the top tells you which text you are looking at, a material change is announced in the product or by email, and using the product after it takes effect counts as accepting it.