Terms and Conditions

1. Contract and eligibility

These terms form the agreement between Digital Transformation Luxembourg Sàrl-s (Digitrans, we or us) and the person or organisation creating or using an account (you or Customer). By creating an account, you affirmatively accept the version displayed at that time. We record evidence of that acceptance. If you act for an organisation, you confirm that you have authority to bind it.

CDFlow AI is designed principally for businesses, sole traders, accountants and fiduciaries acting professionally. If you qualify as a consumer, all mandatory consumer protections remain unaffected and prevail over any conflicting term.

2. Service scope

CDFlow AI provides organisation-separated document storage, AI-assisted document processing and accounting work products, issue resolution, VAT return and annual-accounts preparation, validation, approval records, exports and a controlled handoff for manual eCDF XML transfer. AI may be used through the built-in chat, MCP with a compatible assistant, or an API selected in Expert mode. Focused AiLexLux research may support accounting, tax and filing questions.

Features, filing types, quotas and retention depend on the selected plan. eCDF transfer requires the agent organisation's own eCDF account, XML-transfer right, assigned prefix and compatible professional LuxTrust certificate. CDFlow AI does not authenticate to eCDF or transmit through an API. A downloaded XML becomes a submission only after an authorised user uploads it in eCDF and eCDF reports a successful result.

3. Human responsibility and professional advice

CDFlow AI is a software workflow and not an accountant, auditor, tax adviser, lawyer or public authority. Explanations, classifications, legal research and suggested entries are informational assistance, not a professional opinion. You must appoint a qualified professional where required or appropriate.

You alone are responsible for complete and accurate records, lawful accounting policies, tax positions, deadlines, review of evidence and values, selection of the correct entity and period, and approval and submission of each filing. Nothing is transmitted merely because an AI proposes it; an authorised human must approve the exact controlled version.

4. AI-specific limitations

Generative AI is probabilistic. It may hallucinate facts or citations, omit transactions, misread documents, lose conversational context, use a tool incorrectly, perform inconsistent arithmetic or claim an action occurred when it did not. Risk normally increases with smaller or less capable models. Model compatibility does not establish accounting competence.

CDFlow AI reduces risk through organisation scoping, source references, structured tools, fixed arithmetic and schema checks, held items, immutable versions and human approval. These controls do not guarantee that every source was supplied, interpreted correctly or treated appropriately. Verify important output against the portal record and original evidence.

5. Filings and eCDF

Validation confirms only the checks identified in the interface. A passed technical check does not mean that held items are resolved or that the filing is substantively correct. eCDF delivery is complete only when the platform records the relevant response or receipt; you must verify its status. CTIE or another authority may reject, delay or later question a filing.

Trial accounts are limited to the stated trial period. After human approval, a trial filing can be downloaded only as an Excel XLSX report; XML generation, XML or CSV download and eCDF transfer require a paid plan. Paid transfer workflows also require the authorised user to download the XML and upload it manually through the agent organisation's own eCDF account.

6. Customer data and lawful use

You retain rights in documents and data you provide. You grant us the limited rights needed to host, copy, parse, transform and transmit them to your selected services to perform the contract. You confirm that the data is lawful, accurate enough for the requested work, and that you have authority and a valid legal basis to upload and process personal data, employee data and third-party records.

Do not upload unnecessary special-category, criminal-offence or highly sensitive personal data. Do not use the service for unlawful surveillance, deception, evasion, fraudulent filings, unauthorised access, infringement, malware, model abuse or activity that breaches a provider’s acceptable-use rules.

7. Data protection, confidentiality and AI providers

For customer accounting and document data processed on your instructions, the Customer generally acts as controller and Digitrans as processor under GDPR; the applicable Article 28 data-processing terms are available from [email protected]. Digitrans acts as controller for account administration, billing, security, legal compliance and service operation. The Privacy Notice explains purposes, rights, recipients and retention.

The CDFlow AI application and customer workspace are hosted in the EU. Managed AI, MCP and Expert-mode data is sent to the provider selected or connected by you. That provider’s terms, privacy conditions, retention and processing locations apply. CDFlow AI cannot guarantee OpenAI processing location. You are responsible for assessing transfers and confidentiality when choosing a provider. We apply reasonable confidentiality and security controls, but no internet service is risk-free.

8. Accounts and security

Keep credentials, OAuth grants, API keys and devices secure; use only authorised users; keep details current; and notify us promptly of suspected compromise. You are responsible for activity under your account unless caused by our breach. Organisation and support access is logged. Support personnel may enter a tenant only through the recorded, time-limited support-access workflow.

9. Plans, prices and payment

Current plan contents, prices, taxes, billing intervals, usage rates and promotions are shown before purchase. Consumer prices are displayed in euros including applicable VAT where required. Paid subscriptions renew for the period shown until cancelled. You may cancel future renewal through the available account process or by contacting us; cancellation takes effect at the end of the paid period unless mandatory law requires otherwise.

If a recurring payment becomes overdue, a 14-day grace period applies. We notify the billing contact on the first overdue day, around day 7 and on the final day. If payment remains unresolved when the grace period ends, the account becomes read-only for a further 14-day retrieval period: existing data may be viewed and downloaded, but changes, AI workflows and submissions are blocked. Payment recovery restores service. When retrieval ends, access closes and the account is flagged for administrator-reviewed manual deletion; customer operational data is never automatically deleted. Statutory billing records, submission evidence, security logs and other legally required records may be retained.

Managed AI is prepaid and metered using provider-reported or, where unavailable, reasonably estimated token usage. Input, cached input, output, reasoning and tool-related context may incur usage. A failed or interrupted generation may still consume provider tokens. Credit is added only after confirmed payment or an explicit Digitrans grant. MCP and Expert mode do not carry a CDFlow AI AI-usage charge, but your external provider may charge you. Fees are non-refundable except where these terms or mandatory law require a refund.

The daily GPT-6 Luna allowance is a limited service benefit, not stored monetary credit. It resets each day at Luxembourg midnight, does not roll over, cannot be transferred or exchanged, and is subject to the published account, security and fair-use limits. A request that reaches provider processing may use one included chat even if it fails or is interrupted. Usage beyond the allowance is charged against prepaid AI balance.

10. Trials, filing passes and promotions

A trial lasts 14 days unless stated otherwise. It includes the preparation, validation, review and approval workflow and permits only the final Excel XLSX filing report to be downloaded. It does not permit filing XML generation or download, CSV filing export or eCDF transfer. It includes five GPT-6 Luna chats per user each day, subject to the daily-allowance terms above, but no prepaid managed-AI credit by default. Any discretionary trial credit is conditional and has no cash value. A filing pass is valid for one month, does not renew, and creates a temporary workspace for the purchased filing; its source data is removed according to the stated lifecycle after completion, subject to legal retention, security records and backups. Promotions may have eligibility, duration and non-combination rules shown with the offer.

11. Consumer withdrawal and remedies

If you contract as a consumer at a distance, you normally have a 14-day right of withdrawal from the contract without giving a reason. Contact us with an unambiguous statement at [email protected]. If you expressly request paid service to begin during that period, applicable law may require payment proportionate to service already supplied. Any loss of a withdrawal right for fully supplied services or digital content applies only after the legally required express consent and acknowledgement.

Mandatory rights concerning conformity, updates, price reduction, termination, reimbursement and damages for digital services remain unaffected. Nothing in these terms limits a remedy that cannot legally be excluded.

12. Customer content, service IP and output

CDFlow AI, its software, branding, workflows and documentation remain ours or our licensors’. We grant a limited, non-exclusive, non-transferable right to use the service during the contract. You may use and export your generated accounting and filing work products, subject to third-party rights and applicable law. AI output may not be unique and no exclusive right or non-infringement guarantee is given.

Feedback may be used to improve the service without identifying confidential customer content. We do not use customer documents to train a general model unless separately and expressly agreed.

13. Availability, maintenance, changes and third parties

We carry out scheduled and emergency maintenance to protect the security, integrity and reliable operation of the service, including security patches, feature and infrastructure updates, synchronisation of application, backend and database components, and backup, restoration and continuity measures. Scheduled maintenance will normally be performed outside regular Luxembourg business hours and, where reasonably practicable, at night or on weekends. Access to all or part of the service may be restricted or temporarily unavailable during a maintenance window.

We will use reasonable efforts to give advance notice of planned maintenance where its likely impact justifies notice and to restore availability without undue delay. Urgent security, integrity or continuity work may be performed at any time and without advance notice. We do not promise uninterrupted availability, and interruptions may also result from security incidents, networks, eCDF, payment or AI providers, customer systems or circumstances beyond our reasonable control. This clause does not limit mandatory statutory rights or any service level expressly agreed in a specific order.

We may change features for security, legal, technical or product reasons while preserving contractual conformity and mandatory rights. Material adverse changes will be notified within a reasonable period. Third-party services remain governed by their own terms and availability.

14. Data export, switching and termination

You may download provided source documents and available work products, filing packages and relevant metadata in the formats offered by the service. On a valid switching request, we will cooperate in good faith and begin the switching process within the legally permitted period, which will not exceed two months unless a justified extension is notified. A retrieval period of at least 30 calendar days applies after the agreed transition period, unless you request earlier deletion or law requires retention.

After that retrieval period, exportable data is erased in accordance with our retention process, subject to statutory records, security logs and backup cycles. Until 12 January 2027, any switching charge will be limited to directly incurred switching costs and disclosed in advance; after that date no switching charge applies where Regulation (EU) 2023/2854 prohibits it. You should export needed data before account closure.

15. Suspension and termination

You may stop using the service and cancel as described above. We may place an account on an immediate read-only administrative hold where reasonably necessary to address security risk, abuse, unlawful use, material breach or threats to other customers. The reason is recorded and notified to the account contact where legally and operationally practicable. Existing data remains available for viewing and download unless access itself would create a security, legal or third-party risk. Either party may terminate for a material breach not remedied within a reasonable notice period, or immediately where remedy is impossible or law requires it.

Termination does not affect accrued payment obligations, audit evidence, legal retention or provisions intended to survive. We will not delete submitted filing audit records where law or legitimate compliance needs require their retention.

16. Warranties and liability

We will provide the service with reasonable care and skill and in conformity with mandatory law. Subject to that obligation, we do not warrant that AI output, legal research, classifications, calculations, provider services or authority acceptance will be error-free or fit for a decision without human review.

To the maximum extent permitted by law, neither party is liable for indirect or consequential loss. For professional Customers, our aggregate liability arising in a 12-month period is limited to fees paid for the affected service in that period. This cap and exclusion do not apply to fraud, wilful misconduct, gross negligence, death or personal injury, breach of confidentiality or data-protection obligations where liability cannot be limited, or any other mandatory liability. Consumer rights and remedies remain unaffected.

17. Changes to these terms

We may update these terms for legal, security, provider or service changes. The current version and effective date are published here. We will give reasonable advance notice of material changes and request renewed acceptance where the change requires it. Changes do not retroactively remove accrued rights.

18. General and governing law

Luxembourg law governs this agreement, without prejudice to mandatory consumer protections of your country of residence. Courts of Luxembourg City have jurisdiction for professional Customers; consumers may use any forum available under mandatory law. The parties should first try to resolve concerns through [email protected].

If a term is invalid, the remainder continues. Failure to enforce a right is not a waiver. Neither party is liable for delay caused by events beyond reasonable control. These terms, the plan/order details, Privacy Notice and any data-processing agreement form the agreement; specific order terms prevail over these general terms where they expressly conflict. The language version presented and accepted applies, subject to mandatory law.