These terms govern the use of Kernflow by business customers. The included data processing agreement supplements them where Kernflow processes personal customer content on behalf of the customer. Individual agreements and the service description agreed at the time of booking remain authoritative.
The provider is Kernflow UG (haftungsbeschränkt), Postplatz 2, 01067 Dresden, Germany; email: office@kernflow.io, website: https://kernflow.io, hereinafter Kernflow.
The offering is directed exclusively at business operators within the meaning of section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. The customer uses Kernflow for their independent professional or commercial activities. A consumer contract is not part of this offering. The customer's actual status as a business operator is decisive.
Individual agreements take precedence over these terms. Deviating customer terms apply only where expressly agreed. For data protection obligations in the processing relationship, the data processing annex takes precedence. The privacy policy explains processing and does not constitute blanket consent.
The website presents the offering. A paid contract is formed in the activated booking process through an order and express acceptance or confirmed activation by Kernflow. Outside this process, a contract may be formed through an expressly accepted offer in text form. Merely selecting a plan on a booking page that is not active does not create a subscription.
Before concluding the contract, the customer receives the price, billing interval, term, agreed services, these terms and, where applicable, the data processing annex. The service description agreed when the contract is concluded is authoritative; the contract confirmation documents the order. Kernflow provides the agreed contract documents in a format that can be saved.
Kernflow is software provided over the internet for content research and the preparation of ideas, hooks, scripts and content plans. Export and performance functions are owed only within the scope of the services actually booked. Individual advice, a specific publication or a specific economic outcome is owed only where expressly agreed in an additional agreement.
The standard plans shown comprise Starter with one client account, Growth with up to five, Pro with up to ten and Scale with up to twenty client accounts. A client account is a separate workspace for a managed client or brand. This does not promise differing numbers of user logins; user limits must be expressly stated before booking.
An available or properly archived client workspace may be reassigned. Continuously swapping client profiles to serve more active clients in parallel than booked is not permitted. Export and permitted archiving must not be made unreasonably difficult as a result.
Script creation is included within reasonable use appropriate to the booked plan and the agreed purpose of the service (Fair Use). Unlimited request volume is not promised. Abuse includes, in particular, automated bulk queries, bypassing technical safeguards and uses that significantly impair the platform's stability or security. In the event of such use, Kernflow may notify the customer of the irregularity and impose proportionate usage limits after allowing a reasonable opportunity to remedy it. Where there is a specific acute threat to security or availability, temporary immediate protective measures are permitted. Normal agency use, including intensive use, is not treated as abuse solely because of its volume.
The price and tax status stated at the time of conclusion apply. The B2B prices shown are net prices. VAT is charged additionally only insofar as it is legally owed; the tax treatment stated at booking and the total amount shown are authoritative.
The monthly or annual fee is billed in advance through the agreed payment method, in particular Stripe. The billing period begins with the confirmed start of the paid subscription; any expressly agreed different billing dates are communicated before conclusion. No setup fee applies to the standard plans.
Monthly subscriptions run for one monthly billing period at a time and renew for a further monthly period unless notice of termination is received beforehand. The customer may terminate at any time with effect at the end of the current period. There is no additional advance notice period. The period end stated in the contract confirmation and account is decisive, rather than automatically the end of the calendar month.
Annual subscriptions run for twelve months from the confirmed start and renew for a further twelve months unless notice of termination is received beforehand. The customer may give notice at any time with effect at the end of the current annual period. Access continues until then. Ordinary termination or voluntary non-use does not result in a pro rata refund of the agreed annual fee.
Notice of termination may be given through the account function provided or by email to the provider. Termination does not require a telephone appointment or a signed form. Kernflow confirms receipt and the contract end date in text form. For ordinary termination by Kernflow, a notice period of at least 30 days to the end of the relevant period applies; for monthly contracts, to the next permissible period end if necessary.
Rights to extraordinary termination for good cause, statutory refund claims and mandatory rights to switch providers remain unaffected. Neither tokens nor the extent of use extinguish such rights.
An upgrade takes effect upon express booking at the costs displayed beforehand and at the time stated there. Any pro rata additional charge or change to the billing date must be apparent before confirmation. A downgrade generally takes effect at the end of the current paid period unless otherwise agreed.
Before a downgrade, the customer is notified of excess active client accounts and may select which workspaces remain active. Kernflow does not delete content without the agreed rule for doing so and the necessary opportunity to export. Technical limits must not prevent statutory data access rights.
The customer provides accurate contract and billing details, keeps access credentials confidential and grants access only to authorised persons. If there are signs of unauthorised access, the customer informs Kernflow without undue delay. The customer needs a suitable internet connection and a current supported browser; technical requirements are described before conclusion.
The customer may enter or make content available only where the necessary rights and data protection legal bases exist. Unlawful content, infringements of third-party rights, bypassing security measures, malware and automated overloading are prohibited. Independent resale of Kernflow access requires an agreement; normal service to the agency's own clients is permitted.
Downloading or providing third-party videos is permitted only with the corresponding authorisation. Using a research link or transcript does not grant a licence to third-party videos, music, trademarks or images of persons. Mandatory statutory rights of use remain unaffected.
The customer retains their rights to entered content. They grant Kernflow only the rights of use necessary for contractual performance through the agreed provision, storage, technical processing, transmission to permitted subcontractors and output. Use as a reference, public display of customer content or publication on behalf of the customer requires a separate agreement.
Kernflow does not claim additional exclusive rights to customer-specific AI outputs. To the extent that Kernflow holds transferable rights to such outputs, the customer receives a non-exclusive right, unlimited in time and territory, to use and modify the outputs for their own purposes and their managed clients. Existing statutory rights are not restricted by this.
AI outputs may be similar or identical for other users and need not be protected by copyright. Third-party rights may continue to exist. Kernflow does not promise exclusivity or comprehensive clearance of rights. Rights to the platform, software and proprietary templates remain with their respective rights holders.
AI outputs are working drafts. Before publication, the customer checks factual accuracy, required labelling, third-party rights and suitability for their specific use. Kernflow does not guarantee a particular reach, virality, ranking position or impact on revenue. These notices do not remove the obligation to provide the platform in accordance with the contract or statutory rights relating to defects.
The display of external social media content also depends on the respective platforms. Content may be changed, deleted or restricted by the platform provider. Kernflow may provide an external link instead of an unavailable embed, provided this preserves the agreed contractual purpose. This does not permit arbitrary discontinuation of paid core services.
Kernflow provides the agreed services with reasonable care and handles reported errors. Without a separate agreement, no particular availability percentage or round-the-clock staffed support is promised. This does not release Kernflow from providing a service suitable for the contractual purpose. Where possible, significant planned maintenance is announced in good time and limited to a reasonable extent.
Support is provided through the agreed contact channels, including WhatsApp for the standard plans. Where possible, a suitable protected support channel should be used for personal content. A general guarantee of particular response times exists only under an additional agreement.
Kernflow may access workspaces and content administratively only to the extent necessary to provide the agreed service, handle a support case requested by the customer, resolve errors or investigate specific security and abuse cases. Access must be limited to authorised persons bound by confidentiality. Further inspection or changes require a separate instruction. Processing of personal content is additionally governed by the data processing annex. There is no general authorisation to log into connected social media accounts or publish there.
For due, undisputed payments, Kernflow may proportionately restrict access after a payment reminder, a reasonable grace period generally of at least 14 days and notice of suspension. Legitimate objections, price reduction and rights of retention must be respected.
Where there are specific significant security risks or manifestly unlawful use, an immediate necessary protective suspension is possible. Kernflow informs the customer without undue delay insofar as legally and technically permissible from a security perspective, gives reasons for the measure and allows clarification. Access is restored once the reason ceases to apply. A suspension does not justify automatic deletion or an additional penalty fee. Statutory export and retrieval rights remain in place.
Technical developments, security adjustments and changes due to statutory or mandatory external requirements are permitted insofar as they preserve the agreed contractual purpose and do not unreasonably disadvantage the customer. Material restrictions to agreed functions are not introduced unilaterally under a general reservation of the right to make changes.
Price changes for new orders do not change existing contracts. Changes to prices or terms of an ongoing contract require an effective agreement; mere silence does not generally constitute consent. Kernflow may give timely notice of termination at the permissible contract end and submit a new offer. Individual agreements and mandatory rights remain in place.
In the event of defects, the customer has statutory rights unless these terms contain an effective, more specific provision. The customer reports errors in an understandable manner and enables reasonable error analysis. This is not a limitation period for defect claims. Required deadlines and statutory exceptions are governed by law.
Kernflow is liable without limitation for intent and gross negligence, injury to life, body or health, an assumed guarantee within its scope, fraudulent concealment and under mandatory statutory liability provisions, in particular the German Product Liability Act. Claims of data subjects under Article 82 GDPR are not restricted.
In the event of a breach of material contractual obligations through ordinary negligence, Kernflow is liable for damage typical of the contract and foreseeable at the time of conclusion. Material obligations are those whose fulfilment enables proper performance and on whose observance the customer may regularly rely. Otherwise, liability for ordinary negligence is excluded insofar as legally permitted. These rules also apply for the benefit of legal representatives and persons engaged to perform contractual obligations.
The customer's own fault is taken into account under the statutory rules. Reasonable safeguards taken by the customer do not release Kernflow from agreed backup and restoration obligations.
Both parties treat non-public business and customer information as confidential and use it only for contractual performance. Permitted disclosure to necessary, bound service providers or under statutory obligations remains possible. Confidentiality continues after the contract ends for as long as a legitimate interest in confidentiality exists.
The data processing annex applies to personal customer content. Kernflow may process this data only on documented instructions within the agreed scope. The customer ensures the lawfulness of their own processing instruction and informs data subjects where required. Kernflow remains responsible for its own statutory obligations; there is no blanket transfer of all data protection responsibility to the customer.
Paid functional access ends when the contract effectively ends. The customer may use the agreed export functions during the term. Statutory rights of access, retrieval and switching providers also apply during suspension or after contract end under the relevant rules.
For switching providers within the scope of Regulation (EU) 2023/2854, Kernflow supports export of exportable customer inputs, outputs and relevant metadata in a commonly used machine-readable format. Exportable data comprises profile and brand details, briefings and texts provided by the customer, saved scripts and content drafts, transcripts and related planning and metadata managed by the customer. Where technically suitable, export is provided as text, CSV or JSON and may be requested at office@kernflow.io. Proprietary source code, internal system prompts, internal security logs, trade secrets and other customers' data are excluded insofar as their exclusion is legally permitted. Data that must mandatorily be exportable is not excluded as a result.
The customer may request a switch in text form. It is initiated without additional delay beyond the legally permitted period; Kernflow does not provide a separate notice period for termination for switching. A necessary switch is generally subject to a maximum transition period of 30 calendar days. If the transition period cannot be met for technical reasons, Kernflow communicates this with reasons within 14 working days of receiving the switching request and states an alternative transition period of no more than seven months, provided the statutory requirements are met. Kernflow supports continuity and security within its own area of responsibility. After the switch, data remains available for retrieval for at least 30 calendar days unless the customer requests earlier permissible deletion. The customer may extend the transition period within the statutory framework. The affected contract ends upon successful completion of the switch; Kernflow informs the customer of this time. After the retrieval period or a later expressly agreed period ends, the exportable customer data and digital assets are fully deleted, provided the switch has been successfully completed and no conflicting mandatory retention obligation exists. Kernflow does not charge separate switching or data export fees.
When switching before the end of an agreed annual term, the remaining fee is not automatically owed in full. Any agreed early termination charge would have to be stated separately, transparently and effectively before conclusion of the contract. These terms do not introduce such a charge. Mandatory switching rights take precedence over the normal term rules.
Also at ordinary contract end, personal data processed on behalf of the customer is returned or deleted at the customer's choice unless a statutory retention obligation prevents this. Kernflow informs the customer of the approaching end of data provision and allows a reasonable retrieval phase, taking mandatory statutory periods into account. In the absence of other instructions, deletion follows. The customer may send instructions to office@kernflow.io. Backup copies are blocked from other uses until their necessary replacement or deletion; deletion instructions must be reapplied upon restoration. General invoice retention does not authorise permanent retention of all customer content.
German law applies, excluding the UN Convention on Contracts for the International Sale of Goods insofar as applicable. Mandatory provisions remain unaffected. Exclusive jurisdiction at Kernflow's registered office applies only in relation to merchants, legal entities under public law or special funds under public law and only insofar as legally permitted. For other business operators, the statutory rules on jurisdiction apply.
If individual provisions are invalid, the remaining valid provisions remain in force; statutory law replaces an invalid provision. The statutory rules on the consequences of invalid contractual provisions remain authoritative.
This annex applies upon effective incorporation of these terms insofar as Kernflow processes personal customer content on behalf of the customer. It forms part of the respective contract; the confirmed booking or agreed activation determines the processing engagement. The instructing party is the customer identified in the booking or individual customer contract; the processor is Kernflow under section 1. Where the customer is itself a processor, the obligations apply correspondingly within its subprocessing chain. Necessary authorisations from the overarching controller must be ensured.
The subject matter is processing for client profiles, content research on instructions, briefings, script and idea creation, transcripts, planning, export and agreed support. Operations include, in particular, collection on instructions, storage, organisation, transmission to approved service providers, AI processing, output, return and deletion. The duration is the contract term and a lawfully agreed return or deletion phase.
Data types comprise business contact details, profile and account identifiers, content texts, scripts, transcripts, details in briefings, feedback and personal performance information. Data subjects may include employees and contact persons of the customer or its clients, depicted or quoted persons and persons in commissioned social media research. The scope and specific data are determined by lawful customer instructions. Special categories under Article 9 GDPR and criminal offence data are not part of the standard engagement without separate safeguards.
Kernflow processes data on behalf of the customer exclusively on documented instructions, including permissible instructions through the platform. Instructions outside the agreed scope require an agreement. If a law requires different processing, Kernflow informs the customer in advance insofar as permissible. Kernflow points out without undue delay any instruction it considers unlawful and may suspend its execution until clarification.
Persons handling data are bound by confidentiality or subject to a statutory duty of secrecy. Customer content must not be published independently. Data protection obligations do not end with the main contract.
Kernflow commits to appropriate measures under Article 32 GDPR. The agreed protection obligations include:
Access protection: individual permissions for users and administrators, restriction to the tasks necessary in each case, confidential access credentials, review and withdrawal of permissions no longer needed, and protection of privileged access according to the respective risk.
Transmission and separation: protection of data transmission between user, platform and commissioned services through suitable transport encryption, and logical separation of client workspaces and their access permissions.
Operation and restoration: risk-appropriate data backup, restriction of access to backups, controlled restoration, regular checks of restorability, security updates and appropriate safeguards against malware and unauthorised access.
Security incidents: defined procedures for assessing, containing and reporting personal data breaches.
Deletion: implementation of documented return and deletion instructions, limitation of retention to necessary purposes, and reapplication of deletion instructions after restoration.
Kernflow documents implementation and provides the customer with the information necessary for assessment on request. Adjustments to technology and risk must not reduce the agreed level of protection.
The customer authorises Hetzner Online GmbH, Germany, for hosting and storage of platform content and OpenAI Ireland Limited, Ireland, for commissioned AI processing through the OpenAI API. API processing may include the group companies and subprocessors named in OpenAI's data processing terms, particularly in the USA; Kernflow remains responsible for lawful engagement and a legal basis for third-country transfers. Authorisation applies only to the described tasks and the data necessary for them. Relevant provider information: https://www.hetzner.com/legal/privacy-policy/, https://openai.com/policies/data-processing-addendum/ and https://openai.com/policies/sub-processor-list/. Further subprocessors commissioned directly by Kernflow require the following change procedure; an unspecified collective category is not authorised.
Kernflow provides information in text form at least 30 days before the intended engagement or replacement of a subprocessor. The customer may object on objective data protection grounds. The parties seek an appropriate solution; without necessary authorisation, the affected processing does not begin through the new service. If no solution is possible, the affected part of the service may be terminated without a contractual penalty; prepaid amounts for services not provided in the future are refunded.
Kernflow binds subprocessors to corresponding data protection obligations and remains responsible for fulfilment of their obligations under Article 28(4) GDPR. International processing is permitted only on a lawful, documented basis and within the authorised instruction. Calendly, Zoom and Stripe for Kernflow's own business operations are not automatically subprocessors for all customer content; customer processing actually commissioned must be classified separately.
Kernflow provides appropriate assistance to the customer with data subject rights, security, personal data breaches, impact assessments and required consultations. Data subject requests addressed to Kernflow concerning data processed on behalf of the customer are forwarded to the responsible customer without undue delay; Kernflow does not respond independently on the customer's behalf.
Kernflow informs the customer without undue delay after becoming aware of a personal data breach involving data processed on behalf of the customer. The notification contains available details about the nature of the incident, affected persons and data, consequences, measures and a contact. Missing details are supplied without unreasonable delay. The customer remains responsible for its notifications; Kernflow assists with investigation and remediation.
Kernflow provides the information necessary for verification and enables legally required audits, including inspections by the customer or its independent auditor. Other customers' security and confidentiality interests must be protected. Proportionate scheduling arrangements must not prevent audits in the event of incidents or justified doubts. Certificates may supplement evidence but do not unconditionally replace every right of audit.
After completion, data processed on behalf of the customer and copies are returned or deleted at the customer's choice under section 15 unless statutory retention prevents this. Return and deletion are implemented without avoidable delay; mandatory retrieval phases and lawfully agreed return periods must be taken into account. Kernflow also arranges necessary deletions at commissioned services, including stored API objects. Technically unavoidable backup remnants are subject to access restrictions, purpose-limited retention and renewed deletion after restoration. Kernflow confirms implementation on request.