Terms of Service

Version: v1.0 — 2026-07-23 Effective date: 2026-07-23

These Terms of Service (the "Terms") are entered into between Vestibo ("Vestibo", "we", "us", or "our") and the person or entity that accepts these Terms ("Customer", "you", or "your"). Our full registered company details and postal address are available on request at legal@vestibo.com. By clicking "I agree", creating an account, or using the Service, you agree to these Terms on behalf of yourself and any entity you represent. If you do not agree, do not use the Service.

If you are entering into these Terms on behalf of an entity, you represent and warrant that you have authority to bind that entity to these Terms.

These Terms incorporate by reference our Privacy Policy, Acceptable Use Policy, Data Processing Addendum, Sub-processors list, and (for paid plans) the Service Level Agreement.

1. The Service

1.1 Definition. The "Service" means the Vestibo platform, including the website at https://vestibo.com, the hosted dashboard, the agent runtime (voice, SMS, WhatsApp, email, and web chat, plus additional channels and capabilities — such as the experimental Browser Agent — where and when we enable them for your account), the embeddable widget, the public agent profile pages, the template marketplace, the APIs, and any related documentation, software, or services we make available to you.

1.2 Account. To use the Service, you must register an account with accurate information and keep it current. You are responsible for safeguarding your credentials and for all activity under your account, whether or not authorised by you. Notify us promptly at security@vestibo.com of any suspected unauthorised use.

1.3 Eligibility. You must be at least eighteen (18) years of age, or the age of majority in your jurisdiction, whichever is older. The Service is not intended for or directed to individuals under the age of sixteen (16). If you become aware that an individual under the relevant age has provided personal information through the Service, contact us at privacy@vestibo.com so we can delete it.

1.4 Modifications. We may modify the Service from time to time. Material adverse changes to functionality will be announced at least thirty (30) days in advance through the dashboard or by email. We may make non-material changes (including bug fixes, security patches, and new features) at any time.

2. AI agents — what the Service does and does not do

2.1 What it does. The Service lets you configure an AI agent that takes voice calls, sends and receives SMS and WhatsApp messages, sends and receives email, and answers through web chat and an embeddable widget. Where enabled for your account, the agent can also perform actions in a controlled web browser (the experimental "Browser Agent", which is off by default and not available on every plan). The agent's behaviour is shaped by the configuration you provide (industry, persona, guardrails, business information, knowledge base) and by large-language-model providers we integrate with (see SUBPROCESSORS.md).

2.2 What it does not do. The Service is not:

• a substitute for licensed professional advice (medical, legal, financial, mental-health, immigration, tax, or otherwise);
• an emergency service. The agent must not be used as a primary channel for 911, 999, 112, or any other emergency number, and your configuration must clearly direct callers to dial emergency services in life-threatening situations;
• a guarantor of factual accuracy. AI models can produce inaccurate or fabricated information (commonly referred to as "hallucinations"). You are responsible for the guardrails, prompts, and human review you put in place. The Service surfaces tools (constraints, the Trust Score, the audit log, and the suggested-improvements queue) to help you mitigate this risk; using them is your responsibility.

2.3 Human-in-the-loop. Several Service features (the suggested improvements queue, the agent escalation flow, and the BAA review flow) require owner-mediated approval before any change to your agent's behaviour takes effect. You are responsible for reviewing these queues in a timely fashion.

2.4 Recording and consent. Many jurisdictions require one-party or two-party consent before recording a telephone call or storing the contents of a text message. You are the controller of those interactions and you are responsible for collecting any consents required by applicable law, including but not limited to:

• the U.S. Telephone Consumer Protection Act ("TCPA");
• the U.S. CAN-SPAM Act;
• the EU GDPR and the ePrivacy Directive;
• state wiretap and two-party-consent statutes (e.g. California, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Washington);
• the Canadian PIPEDA and CASL;
• the UK Privacy and Electronic Communications Regulations.

The Service provides a configurable disclosure (the "recording-and-AI" greeting), which is on by default; you are responsible for keeping it enabled and customising it to match the consents you have collected.

3. Plans, fees, and taxes

3.1 Plans. The Service is offered in tiers (currently Free, Solo, Team, a HIPAA-eligible Clinic tier, and a custom Enterprise tier), plus optional higher usage allowances. The current tiers, their included usage, and prices are published at /pricing and may change with at least thirty (30) days' notice (no price change will apply to a pre-paid period you have already paid for).

3.2 Billing. Paid plans are billed in advance, monthly or annually, in the currency posted at checkout. Usage beyond the allowance included in your plan (for example, additional voice minutes or additional outbound texts) may be billed in arrears as itemised overage on your invoice, at the rates shown for your plan.

3.3 Taxes. All fees are exclusive of taxes. You are responsible for all applicable sales, use, VAT, GST, or similar taxes (excluding taxes based on Vestibo's net income).

3.4 Refunds. Except where required by applicable consumer protection law, all fees are non-refundable. We may, in our reasonable discretion, refund a pro-rated portion of pre-paid fees if we terminate the Service for our convenience under § 11.2.

3.5 Failed payment. If a payment fails, we will attempt to collect via Stripe's standard retry schedule. After seven (7) days, we may suspend paid features (your data remains intact). After thirty (30) days of non-payment, we may terminate your account under § 11.3.

4. Customer data

4.1 Ownership. You retain all rights, title, and interest in and to your Customer Data, which means any data you, your end-users, or your agent's callers/recipients submit to or through the Service, including configuration, transcripts, recordings, knowledge-base content, and embedding outputs derived from it.

4.2 Licence to Vestibo. You grant Vestibo a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display, and process Customer Data to the extent necessary to (a) provide the Service to you, (b) prevent or address security or technical issues, (c) comply with legal process, and (d) produce de-identified aggregated statistics for internal product improvement. We will not train any third-party foundation model on Customer Data without your written consent. Where we use a sub-processor (e.g. OpenAI, Anthropic) we contract for the same restriction (see SUBPROCESSORS.md).

4.3 Data Processing Addendum. Where you submit personal data subject to the GDPR, the UK GDPR, the Swiss FADP, the CCPA, or any other applicable data-protection law, our processing is governed by the Data Processing Addendum, which is incorporated into these Terms by reference.

4.4 PHI / HIPAA. You may not submit Protected Health Information ("PHI") as defined under HIPAA to the Service unless: (a) your account is on a HIPAA-eligible tier, (b) you have an executed Business Associate Agreement with us, and (c) every required sub-processor BAA is in place. Submitting PHI without a BAA in place is a material breach of these Terms.

4.5 Retention and deletion. We retain Customer Data while your account is active. Within thirty (30) days of termination we will delete or anonymise Customer Data, except where a longer retention period is required by law or is needed for backup integrity (in which case the data will be deleted from rolling backups within ninety (90) days). We will provide an export of Customer Data on request at any time before deletion.

5. Customer obligations

You agree:

• to comply with the Acceptable Use Policy;
• to collect every consent and provide every disclosure required by law for the channels you enable (see § 2.4);
• not to use the Service to send unsolicited commercial communications in violation of CAN-SPAM, the TCPA, CASL, the UK PECR, or any other applicable anti-spam or telemarketing law;
• not to upload or process PHI without a BAA (see § 4.4);
• to keep your agent's configuration accurate (e.g. business hours, pricing, services offered) — Vestibo is not responsible for consequences of an out-of-date configuration;
• to monitor the dashboard's audit log, suggested-improvements queue, and escalation queue, and to act on items that require your review;
• to maintain your own copy of any Customer Data you cannot afford to lose.

6. Intellectual property

6.1 Our IP. The Service, the Vestibo name and logo, the Signet design system, the editorial voice, and all other intellectual property in the Service are and remain our property (and our licensors'). We grant you a limited, non-exclusive, non-transferable licence to access and use the Service in accordance with these Terms.

6.2 Feedback. If you provide ideas, suggestions, or feedback, we may use them without restriction or compensation.

6.3 Marketplace. If you publish a template to the marketplace, you grant Vestibo a perpetual, worldwide, royalty-free licence to host, display, distribute, and let other customers install the template, subject to the automated sanitiser scrub we apply to published templates. You represent and warrant that the template does not infringe any third-party right.

6.4 White-label / custom branding. White-label and custom-domain branding are not yet generally available. If and when we enable them for your account, we grant you a limited right to apply your brand colour, logo, and custom domain to the Service to the extent then supported. The Vestibo name, the Signet design system, and the underlying engine remain ours.

7. Third-party services

The Service depends on third-party providers (LLMs, voice, email, SMS, calendaring, payments — see SUBPROCESSORS.md). You acknowledge that:

• third-party services have their own terms; some require you to accept them separately (e.g. Stripe Connect, Twilio messaging compliance);
• third-party services may be modified, suspended, or discontinued outside our control. We will give reasonable notice of any sub-processor change and use commercially reasonable efforts to provide a substitute of comparable quality.

8. Confidentiality

Each party agrees to protect the other's Confidential Information with the same degree of care it uses to protect its own confidential information (and no less than a reasonable degree of care), to use it only to perform under these Terms, and not to disclose it to any third party except as expressly permitted. "Confidential Information" includes the terms of these Terms, non-public technical and business information, and any information marked confidential. Confidential Information does not include information that is or becomes public through no fault of the receiving party, was rightfully known to the receiving party before disclosure, or is independently developed without use of the disclosing party's information.

9. Warranties and disclaimers

9.1 Limited warranty. We warrant that the Service will perform materially in accordance with the documentation when used in accordance with these Terms.

9.2 Disclaimer. EXCEPT FOR THE LIMITED WARRANTY IN § 9.1, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY AI OUTPUT WILL BE ACCURATE OR APPROPRIATE FOR YOUR USE CASE.

10. Indemnification

10.1 By Customer. You will defend, indemnify, and hold harmless Vestibo, its affiliates, officers, directors, employees, and agents from and against any third-party claim, demand, suit, action, loss, liability, damage, cost, or expense (including reasonable attorneys' fees) arising out of or related to (a) your or your end-users' use of the Service in violation of these Terms or applicable law, including the AUP and consent obligations in § 2.4 and § 5; (b) your Customer Data; (c) your unauthorised submission of PHI; or (d) your breach of § 5.

10.2 By Vestibo. We will defend you against any third-party claim that the Service, as provided by us and used in accordance with these Terms, infringes the intellectual property rights of that third party. We will pay damages finally awarded against you (or amounts agreed in a settlement we approve). We have no obligation under this section to the extent the claim arises from your configuration, your Customer Data, or your combination of the Service with anything not provided by us.

10.3 Process. The indemnified party must (a) promptly notify the indemnifying party in writing, (b) give the indemnifying party sole control of the defence and settlement (provided no settlement imposes a non-monetary obligation on the indemnified party without its consent), and (c) cooperate reasonably at the indemnifying party's expense.

11. Term and termination

11.1 Term. These Terms continue while your account is active.

11.2 Termination for convenience. Either party may terminate the Service for any reason on thirty (30) days' written notice.

11.3 Termination for cause. Either party may terminate immediately on written notice if the other party materially breaches these Terms and fails to cure within thirty (30) days of written notice. We may suspend or terminate immediately if you breach § 4.4 (PHI without BAA), the AUP, or applicable law, or if continued provision of the Service would expose us or other customers to material legal or security risk.

11.4 Effect of termination. On termination: (a) your access to the Service stops; (b) we will delete or return Customer Data per § 4.5; (c) any fees accrued before the termination date remain payable; (d) Sections 4, 6, 8, 9, 10, 12, 13, 14, 15, and 16 survive.

12. Limitation of liability

EXCEPT FOR (a) AMOUNTS PAYABLE TO THIRD PARTIES UNDER § 10 (INDEMNIFICATION), (b) BREACH OF § 8 (CONFIDENTIALITY), (c) YOUR BREACH OF § 4.4 (PHI WITHOUT BAA) OR § 5 (CUSTOMER OBLIGATIONS), AND (d) EITHER PARTY'S GROSS NEGLIGENCE, WILFUL MISCONDUCT, OR FRAUD:

• IN NO EVENT WILL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS EXCEED THE AMOUNTS PAID OR PAYABLE BY YOU TO VESTIBO IN THE TWELVE (12) MONTHS IMMEDIATELY BEFORE THE EVENT GIVING RISE TO THE CLAIM; AND
• IN NO EVENT WILL EITHER PARTY BE LIABLE FOR LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF GOODWILL, OR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, EVEN IF ADVISED OF THE POSSIBILITY.

The foregoing limitations apply to the maximum extent permitted by applicable law.

13. Governing law and disputes

13.1 Governing law. These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict of laws principles.

13.2 Forum. The parties submit to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware for any dispute arising out of or related to these Terms.

13.3 Injunctive relief. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

14. Notices

Legal notices to Vestibo must be sent to legal@vestibo.com with a copy to our registered agent. We may send legal notices to you to the email address on your account or by in-product notification.

15. Force majeure

Neither party is liable for failure or delay in performance caused by circumstances beyond its reasonable control, including acts of God, war, terrorism, civil unrest, public-health emergencies, internet or telecommunications outages, denial-of-service attacks, power outages, governmental actions, or labour disputes.

16. Miscellaneous

16.1 Assignment. You may not assign these Terms without our written consent, except to a successor in connection with a merger, acquisition, or sale of substantially all assets. We may assign freely.

16.2 No waiver. Failure to enforce a provision is not a waiver of the right to enforce it later.

16.3 Severability. If any provision is held unenforceable, the rest of these Terms remain in effect.

16.4 Entire agreement. These Terms (including the documents incorporated by reference) are the entire agreement between the parties and supersede any prior agreements on the subject.

16.5 Order of precedence. In the event of conflict, the order is (1) any signed order form, (2) the BAA (where applicable), (3) the DPA, (4) these Terms, (5) policies referenced from these Terms.

16.6 Independent contractors. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship.

16.7 Export controls. You will comply with all applicable export controls and sanctions laws and represent that you are not located in a country subject to a US government embargo and are not listed on any US government list of prohibited or restricted parties.

16.8 US Government end-users. The Service is "commercial computer software" and "commercial computer software documentation" under FAR 12.212 / DFARS 227.7202.

Changelog

• v1.0 (2026-07-23) — first published version; rebranded to Vestibo and reconciled to the current product.
• v0.1 (2026-05-16) — initial internal draft.