Terms of service

These terms govern the use of Entumo (the “Service”), operated by MomentumQ GmbH, Leutschenbachstrasse 95, 8050 Zürich, Switzerland (“we”, “us”). By using the Service you accept these terms. Last updated: 17 October 2026.

1. The service

Entumo is a platform on which configurable AI agents (“AI employees”) carry out work you assign and, where you connect third-party tools, act in those tools on your behalf. The Service is provided on an “as available” basis and may evolve over time.

Optional workflows support accounting preparation and review, Swiss company operations, campaigns, company playbooks, software fixes and data work. Their availability depends on your connected services, permissions, configuration and provider capabilities. An accounting pack, formation checklist or VAT handover is not a professional audit, company registration or statutory filing. A payment file is not a released or settled payment; an accepted provider request or code merge is not proof of completion or deployment. Required external actions and qualified reviews remain yours to complete and verify.

Your business records. The Service is not an archive under the Swiss accounting records ordinance (GeBüV). Keeping your books, accounting vouchers and business correspondence for the statutory period (Art. 958f CO) remains your duty: keep them in your accounting software or another archive, and export what you need before you delete a workspace or let a paid subscription end. A workspace whose paid subscription ended without renewal may be deleted 90 days later, as section 7 of the privacy policy describes.

2. Account & eligibility

You must provide accurate account details, keep your credentials confidential, and be authorised to bind the organisation you act for. You are responsible for all activity under your workspace. The Service is offered only to businesses and other organisations for their professional or commercial activity, not to consumers for personal or household use. By creating a workspace or accepting an invitation you confirm that you act for such an organisation. To create a workspace you must be at least 18 years old and have capacity to act (Art. 13 ZGB). A person the organisation invites to its workspace — an apprentice, for example — must be at least 15 years old; for a member under 18, the organisation is responsible for their use of the Service and for obtaining any consent the law requires. The Service is not directed at children.

You also confirm that neither you nor anyone who owns or controls your organisation is on a sanctions list of Switzerland, the EU, the UN or the United States or acts for a person who is, and that your organisation is not the government of the Russian Federation, nor an organisation established in the Russian Federation or in a territory listed in Annex 6 of the Swiss Ordinance on measures in connection with the situation in Ukraine (SR 946.231.176.72), nor established in another state or territory to which Swiss sanctions law prohibits us from providing the Service. You will not use the Service for such persons or make it available to them. Swiss sanctions law provides exceptions — for example for an organisation in the Russian Federation that is owned or controlled by an organisation established under Swiss, EEA-state or partner-state law (Art. 28e para. 8 lit. a of that Ordinance); if you believe an exception applies to you, tell us before you use the Service and we will assess it with you. Where the law requires it, we may suspend or end the Service (Section 10) and inform the competent authority.

3. Your responsibility for the agents’ actions

You direct the agents and decide which tools they may use and which actions they may take. By default, consequential actions — moving money, messaging customers, writing financial records, signing — pause for your explicit approval. For eligible actions, an owner may give a scoped standing permission or configure the existing workspace approval settings; a matching action can then run without a new approval click. The scope, limits, expiry and non-overridable controls still apply. Creating a workflow or saving a procedure does not itself grant permission. You remain responsible for the briefs you give, the tools you connect, the actions you approve, and the use of any output. AI output can be incomplete or incorrect — review it before relying on it.

4. Acceptable use

You must not use the Service unlawfully, to infringe others’ rights, to send spam or unsolicited mass advertising (Art. 3 para. 1 lit. o UWG), to collect or copy data from third-party websites or services in breach of their terms of use, to process data you are not entitled to process, or to attempt to circumvent its security or guardrails. You must not use the Service to generate, edit or distribute sexually explicit or intimate images or videos of an identifiable person without that person’s consent, or any depiction of the sexual abuse of children. You must comply with the terms of any third-party tool you connect and with the usage policies of the AI model providers that run your agents, as they publish them; you must not use the Service’s output to develop a competing AI model where a provider’s terms forbid it. Where a provider requires it, we may suspend the use concerned (Section 10). E-mails that the Service writes in a campaign run carry, stamped by the platform and not by the AI, your company’s name (and its address where you have entered it) as sender and a free way to refuse further messages (reply “stop”). A message from a campaign run to an address on your workspace’s “Do not contact” list is refused, and any other message or mailing-list action that names such an address is held for a person’s decision; the list covers e-mail addresses only — not telephone numbers or chat contacts, and not a whole stored list that a provider expands itself. These functions support your own duty to have the consent or customer relationship that Art. 3 para. 1 lit. o UWG requires; they do not replace it.

Campaign permissions authorize the agent to act for you; they are not consent from a recipient. Before marketing outreach, establish the required recipient consent or applicable legal exception, identify the sender and provide a simple, free way to object. Honor objections across campaigns and channels. A public contact address, an AI fit assessment or a saved prospect record does not establish permission to send. You must also provide any required privacy information to contacts whose data you collect indirectly.

Reporting unlawful content. Anyone, with or without an account, can report content processed with the Service that they consider unlawful or infringing — in particular of copyright or of personality rights — through the form at /report-abuse or by e-mail to abuse@momentumq.com. A report should identify the content, explain why it is unlawful and, for an infringement, name the right concerned and the reporter’s relation to it. We review every report and may block or remove the content concerned, suspend the use concerned (Section 10) and preserve records under the legal hold described there. We inform the owners of the workspace concerned and give them the opportunity to respond, unless the law or an authority prevents it or informing them would jeopardise the investigation of a serious offence. If a report proves unfounded, we lift the block.

5. Third-party tools & AI providers

Third-party tools you connect are operated by third parties under their own terms; we are not responsible for the availability, changes or suspension of those tools or of your account with them. When you connect a tool, you authorise the Service to access it with the credentials you provide, for the actions you enable. Some providers restrict or prohibit sharing API keys or tokens with third-party services, or require their own sign-in flow — where a provider requires this, the Service offers only that sign-in path. By supplying a credential (including for a custom connector you define), you confirm that the provider’s terms and your role at the account permit granting this access. AI model providers and the other sub-processors listed in the privacy policy work for us in providing the Service: we answer for their performance of the processing as set out in Section 12(d), within the limits of Sections 8 and 9, but we do not guarantee that they are available without interruption.

6. Fees & prepaid credits

Where a paid plan applies, the subscription fee and billing cycle are those stated when you subscribe, and usage is charged at the usage rates set out in the next paragraph; AI and connector usage may incur model-provider costs. MomentumQ GmbH is not registered for Swiss VAT (Art. 10 MWSTG); no VAT is charged at present, and fees stated on the pricing page are final for as long as that remains so. If we become liable to register, Swiss VAT is added to fees from the date the registration takes effect, as a change to fees under Section 14 with its notice and termination right. Fees are non-refundable except as required by law or as these terms provide (Sections 6, 10, 12(d) and 14). Paid plans renew automatically for successive one-month periods until you cancel; cancellation takes effect at the end of the current paid month, and that month’s fee is not refunded. You can cancel online at any time without contacting us: a workspace owner opens our payment processor’s billing portal with “Manage billing” in the workspace’s billing panel and cancels there; the portal shows the date on which the cancellation takes effect.

Usage of the Service is paid from a prepaid credit balance. One credit is worth CHF 1, and that value never changes, including for credits you have already purchased. Usage is charged in credits at our usage rates: the provider’s published standard price for the model, tool and region that serve the usage (temporary introductory discounts are not passed on), converted to CHF at the exchange rate we apply, plus our margin — for usage on a provider key of your own, our margin only. A change in a provider’s price applies to usage from when it takes effect; a change to our margin or to that exchange rate is a change to fees under Section 14. Your plan’s included credits are added to your balance each month and roll over for twelve months: included credits still unused twelve months after they were added expire without compensation, and the product shows the date and amount beforehand. Included credits added before 22 September 2026 are not subject to this expiry. Usage is drawn from included credits first, oldest first. Credits you purchase remain available and roll over while your subscription is active; when it ends they remain yours as set out below. Credits are a prepayment for Service usage only: they cannot be exchanged for cash, carry no interest and are non-refundable, save where mandatory law requires otherwise or these terms expressly provide for a refund (this Section 6 and Sections 10, 12(d) and 14). When your subscription ends — whoever ends it, and including where a payment failed, where we end the Service or where you delete your workspace — unused included credits lapse without compensation, and unused purchased credits are refunded to you on request. You can request the refund at any time, in writing, at the contact given in the legal notice (Impressum); we refund the unused balance of purchased credits, calculated from our ledger (usage counts against included credits first, as set out above) and less any amount you owe us, to the payment method you used or as you instruct, within 30 days of your request.

Automatic top-up. An owner can switch on automatic top-up in the workspace’s wallet. By doing so you authorise us, through our payment processor Stripe, to charge the card you saved for the top-up amount you set each time the workspace’s balance falls below the threshold you set, without a new confirmation for each charge and within the daily limits (a maximum number of charges and a maximum CHF total per day) shown to you when you switch it on. Each such top-up is a purchase of credits under this Section 6. You can switch automatic top-up off at any time in the wallet; that ends further automatic charges from that moment. Raising the amount or the threshold needs your agreement again. When you switch it on, the wallet shows you this authorisation and asks you to confirm it, and we keep a record of your confirmation: who confirmed, when, in which language, and the exact wording with the amounts and limits. A charge is attempted once and is not repeated automatically; if it fails or a daily limit is reached, automatic top-up pauses and the workspace may run out of credits until you act.

Concluding a subscription online (Art. 3 para. 1 lit. s UWG). The technical steps are: (1) you choose a plan on the pricing page or in your workspace’s billing panel; (2) you are taken to the hosted checkout page of our payment processor, Stripe, where you enter your billing details and payment method and can review and correct every entry before you press the button that confirms the order; (3) pressing that button places a binding order for the plan shown, at the price and billing cycle shown; (4) you receive an electronic confirmation without delay — the payment receipt and invoice by e-mail from our payment processor, and the active plan in your workspace’s billing panel. The contract language is stated in Section 15; these terms can be retrieved at any time at /terms and saved or printed.

7. Intellectual property

The Service, its software and marks remain ours. As between us, the content and deliverables you and your agents create remain yours and we claim no rights in them; you grant us, and the sub-processors that work for us (Section 12(d)), only the limited rights needed to operate the Service for you. AI output may not qualify for copyright or other protection, may be similar or identical to output produced for other customers, and may unintentionally resemble third-party material; we give no warranty that it is free of third-party rights. You are responsible for ensuring you hold the rights to the content you process and for checking output and using it lawfully.

8. Warranties & disclaimer

To the extent permitted by law, the Service is provided “as is” without warranties of any kind, including fitness for a particular purpose or that output is accurate, lawful or uninterrupted. The Service does not provide legal, tax, financial or medical advice, and output is no substitute for such advice; it is not intended for critical or high-risk decisions without qualified human review. If you are a fiduciary or another firm that executes payments for clients or sets up or manages legal entities for them, the duties of the Anti-Money Laundering Act (GwG, SR 955.0) remain yours — for financial intermediaries, for example the professional execution of payments for third parties (Art. 2 para. 3 lit. b) and, from 1 October 2026, for advisers (Art. 2 paras. 3bis and 3ter): affiliation with a self-regulatory organisation (Art. 14), identification of clients and beneficial owners, and the reporting of suspicion. The Service does not perform client due diligence, and the payment files it prepares are released by a person.

9. Limitation of liability

To the extent permitted by law, we are not liable for indirect or consequential damages, lost profits or data, and our total liability for any claim is limited to the fees you paid for the Service in the 12 months before the event giving rise to the claim. Liability for unlawful intent or gross negligence remains unaffected.

10. Term & termination

You may stop using the Service and delete your workspace at any time, subject to the legal hold described below. On termination, your data is handled as described in the privacy policy. We may suspend the Service for your workspace, in whole or in part, (a) for a material breach of these terms, including Sections 2, 4 and 13, or where an AI model provider requires it because of your use; (b) while we review a reasonable suspicion of abuse, of a security risk or of unlawful use; (c) where law, an authority, a court or sanctions law requires it; and (d) while a payment is overdue or has failed, or while a payment dispute concerning your account is open. We may terminate access for a material breach that you do not remedy within a reasonable period after we have notified you, or where required by law. We give you the reason by e-mail to the workspace owners or in the product — before the suspension where that is practicable and lawful, otherwise without delay afterwards — unless the law, an authority or an ongoing investigation prevents it, and we lift the suspension as soon as its reason has ended. A suspension stops new work and model usage; it does not delete your data. The subscription fee remains due during a suspension that results from your breach, from non-payment or from a dispute you opened; if we suspend although you did not breach these terms, we refund the fee for the period of the suspension pro rata on request. If we terminate for a reason other than your breach, or discontinue the Service, we give you at least 30 days’ notice where the law allows, time to export your data, and a pro-rata refund of the unused part of your prepaid fees together with your unused purchased credits (Section 6).

Legal hold. Where an abuse report, an order of a court or authority, or a statutory preservation duty concerns your workspace, we may freeze the deletion of the affected records — and, where they are needed, of the workspace or account that holds them — for as long as that is necessary. While a hold applies, a deletion you request is refused — including deleting your account, where it would delete a held workspace. The refusal tells you that a hold applies and which workspace it concerns, and confirms that nothing was changed; if you ask, we tell you the reason unless the law or the authority prohibits it, and deletion is available to you again when the hold ends.

11. Data protection

Our processing of personal data as controller is described in the privacy policy, which informs you under Art. 19 revDSG and has its own version and date. The privacy policy is not itself part of these terms, and updating it does not amend them. Only the parts of it to which Section 12 expressly refers — the list of sub-processors, the description of the providers used for supporting tasks, and the deletion and retention rules — apply as part of Section 12; changes to those parts follow Section 12(d) and Section 14.

12. Data processing on your behalf

Where your agents process personal data of your customers, employees or contacts — in connected tools or in content you provide — you are the controller and we act as your processor (Art. 9 revDSG; Art. 28 GDPR where it applies). The subject-matter and duration of the processing are your use of the Service; its nature and purpose are the automated tasks you and your agents run; the personal data and the categories of data subjects are those contained in the content and connected tools you choose. For that processing we: (a) process the data only to run the tasks you or your agents initiate and on your documented instructions — including as to any transfer of personal data outside Switzerland/the EEA, which you instruct through your choice of model providers, connectors and data-residency policy — including the providers the platform uses for supporting tasks, as described in section 4 of the privacy policy, which you can confine to the providers of your employees’ own models with the provider setting on the Security page; where the law compels us to process or disclose your data (for example on the demand of an authority), we will inform you first unless the law prohibits it, and we handle a request from a foreign authority or court only through a procedure recognised in Switzerland (for example mutual legal assistance; Art. 271 and 273 of the Swiss Criminal Code) — our sub-processors are subject to the law of their own states; (b) bind everyone we authorise to process the data to confidentiality; (c) apply the technical and organisational measures listed in the annex to this section; (d) engage only the sub-processors listed in the privacy policy, give you at least 30 days’ notice before adding or replacing one and — if you object on reasonable data-protection grounds and we cannot resolve it — let you terminate the affected part of the Service under Section 10 with a pro-rata refund of unused prepaid credits attributable to it; we bind each sub-processor by written contract or its data-processing terms to data-protection and security obligations that protect your data at least to the standard of this section, and we remain responsible to you for its performance; where a sub-processor is in a state not listed in Annex 1 DSV (for the USA: a recipient not certified under the Swiss-US Data Privacy Framework), the transfer rests on the Standard Contractual Clauses recognised by the FDPIC, with the Swiss amendments; we give that notice by e-mail to your workspace’s owners and in the app, stating the date from which the change takes effect, and a newly added AI model provider does not process your workspace’s data before that date unless an owner accepts the updated list earlier in the app; the only exceptions to these safeguards are (i) the optional China-region providers identified in the privacy policy, whose standard terms permit them to use content to improve their own services and which are not bound by such clauses — they are reachable only after you enable the China region, and enabling it is your instruction to disclose data to them on your own basis under Art. 17 revDSG (an owner confirms the activation on the Security page, and we record who confirmed it, when and the wording shown; if the GDPR applies to your processing, do not enable the China region for personal data: no transfer tool and no Art. 28(4) GDPR terms exist for those providers), and (ii) the web-search provider named in the privacy policy, whose standard terms permit it to use queries to improve its services and to pass them to its own service providers, until we have agreed data-processing terms with it that exclude this — section 4 of the privacy policy states the current position; (e) assist you, so far as reasonable and taking into account the nature of the processing and the information available to us, with data-subject requests, with your data protection impact assessment and any prior consultation of the authority (Art. 22–23 revDSG / Art. 35–36 GDPR), and with your security and breach-notification duties; (f) notify you without undue delay, and in any event within 48 hours of becoming aware of it, of a personal-data breach affecting your data, with the information listed in Art. 15 para. 1 DSV as far as it is known, supplemented as it becomes available; (g) at the end of the services, at your choice, return your personal data to you in a commonly used electronic format and/or delete it — deleting your workspace removes the active workspace records immediately, with file erasure, access revocation, deletion of the customer record held by our payment processor and restricted cleanup retention as described in the privacy policy — subject to statutory retention duties; (h) make available the information reasonably needed to demonstrate compliance with this section and allow for and contribute to audits, including inspections, by you or an independent auditor you mandate and who is bound to confidentiality, on at least 30 days’ notice and at most once in any 12-month period (or after a breach affecting your data), which we may satisfy by supplying our current security documentation or an independent audit report where one exists; and (i) inform you without undue delay if, in our reasonable opinion, an instruction you give infringes applicable data-protection law, in which case we may pause the affected processing until you confirm or withdraw it; (j) if you are bound by professional secrecy (for example under Art. 321 of the Swiss Criminal Code, Art. 730b of the Code of Obligations or Art. 62 revDSG), act as your auxiliary: everyone we authorise to access your content is bound to secrecy in writing and instructed on Art. 62 para. 2 revDSG and Art. 321 of the Swiss Criminal Code, and accesses your content only to provide support you request or to keep the Service secure; whether your secrecy permits disclosure to the model providers you enable, and whether you need your clients’ consent for it, remains your decision — the provider setting in section 4 of the privacy policy lets you keep every step with the providers you chose; and (k) where you use the Service as a processor for your own client (for example as a fiduciary), you confirm that your client has approved our engagement and the sub-processors listed in the privacy policy, and you pass on our notices under (d). This section is the data processing agreement between you and us; the annex below forms part of it.

Annex to section 12 — technical and organisational measures. Access: sign-in with salted password hashes, two-factor sign-in (required for every account by default; workspace owners can also require it of their members), re-confirmation of the password for sensitive actions, sessions that end after 12 hours without activity and at the latest after 48 hours, workspace roles, and owner-only destructive actions. Separation: every read and write is scoped to its workspace. Encryption: TLS in transit; connector credentials and keys encrypted with AES-256-GCM under a key derived per workspace and decrypted only at the moment of use; the database, file storage and backups are encrypted at rest by their providers. Integrity and control of processing: an approval guardrail pauses consequential agent actions for a human by default; payment caps, the block on irreversible deletions and the credential-leak block hold in every mode; outsider-written content is fenced as data and escalates approvals; writes to connected tools are read back and verified. Logging: a workspace audit trail of human and agent actions (the most recent 2,000 of each kind per workspace); operator actions are recorded in a platform audit trail. Availability: nightly full backups kept for 30 nights, a documented restore procedure for the whole service that has been rehearsed, monitoring of errors and of backup freshness. Data minimisation and deletion: retention limits per record type, pseudonymised abuse counters, workspace deletion with file erasure and provider revocation. Personnel and sub-processors: confidentiality undertakings, access limited to named administrators, sub-processors bound as described in (d). Incidents: a documented breach procedure with notification to you under (f) and, where we are the controller, to the FDPIC under Art. 24 revDSG. We review these measures when the processing changes and at least once a year.

13. AI transparency

Entumo is an AI system: you interact with AI agents and their work is AI-generated. The product discloses this — conversations are visibly agent-led and deliverables are attributable to the agent that produced them. When your agents write to people outside your company, the platform itself places a notice at the start of the message stating that it was written by an AI agent on behalf of your company (at the end of a public social-media post) — on every outbound channel that carries text the agent wrote; internal team channels, machine-to-machine endpoints and notifications a provider composes from its own template are excepted, and where a channel cannot carry the notice (for example a pre-approved WhatsApp template or a custom connector) the agent is instructed to state it — and marks e-mails sent through a connected mailbox or e-mail service with a machine-readable header; images and videos your agents generate carry machine-readable metadata identifying them as AI-generated. As the provider of this AI system under Art. 50(1) and (2) of Regulation (EU) 2024/1689 (applicable since 2 August 2026) we cannot let these disclosures be switched off, and you must not remove or obscure them. If you publish or pass on AI-generated output yourself, disclosure duties of your own may apply — in particular labelling deep fakes and AI-generated text published to inform the public (Art. 50(4)) — and meeting them is your responsibility; the built-in approvals, audit trail and provenance help you do so. You must not use the Service for practices prohibited by Art. 5 EU AI Act (such as manipulative techniques or social scoring and, from 2 December 2026, the generation of non-consensual intimate imagery of identifiable persons or of child sexual abuse material), nor to depict a real, identifiable person without that person’s consent. The Service may prepare recruitment correspondence and summarise applications against criteria you set; it does not rank, filter or reject applicants, evaluate employees’ performance or behaviour, or assess the creditworthiness of natural persons, and you must not use it for those purposes (high-risk uses under Annex III of that Regulation). In the recruitment workflow every message to an applicant is held for your decision in every mode — standing rules, trust grants and monitor mode cannot waive it; you owe applicants the information under Art. 19 and 21 revDSG and must return or delete a declined applicant’s dossier unless the applicant consented to its retention (Art. 328b CO).

14. Changes

We may update these terms. Each version states its date (“Last updated”), and earlier versions are available on request. The version shown applies to everyone who creates a workspace or joins one on or after its date. For existing customers, clarifications, new optional features, changes required by law or by an authority, and changes that only extend your rights or our obligations take effect when published; every other change — in particular a change to fees, to the use of credits or to your obligations — takes effect for you only after at least 30 days’ notice by e-mail to the workspace owners or in the product, stating the date from which it applies, and until then the previous version continues to apply to you. If you do not accept such a change, you may terminate your subscription and delete your workspace before it takes effect, and we then refund your unused purchased credits (usage counts against included credits first, as set out in Section 6). Continued use after that date is acceptance of the updated terms. A change to fees — including our margin and the exchange rate referred to in Section 6, and the addition of VAT if we become registered — applies only from the start of your first billing cycle that begins after it takes effect, and never changes the CHF value of credits you have already purchased.

Version history. 2026-10-17: Added since 9 October 2026: your business records — the Service is not an archive under the Swiss accounting records ordinance (GeBüV); keeping your books, vouchers and business correspondence for the statutory period (Art. 958f CO) remains your duty, and a workspace whose paid subscription ended without renewal may be deleted 90 days later (Section 1). For workspaces that existed before this version, this applies from 16 November 2026 (Section 14). The changes of 9 October 2026 remain: minimum ages — 18 to create a workspace, 15 for a person the organisation invites, applying to workspaces that existed before that version from 9 November 2026 (Section 2); reporting unlawful or infringing content (Section 4); cancelling a subscription online (Section 6). Earlier versions are available on request.

15. Governing law & jurisdiction

These terms are governed by Swiss law, excluding its conflict-of-laws rules and the CISG. The exclusive place of jurisdiction is Zürich, Switzerland, subject to mandatory law. If a provision is invalid, the remainder stays in force. These terms exist in English, German and French, and all three are binding; the contract language is the language of the terms you accepted — English, German or French as you chose, and German where your screen language is Italian, because an Italian translation has not been published. If the versions differ, the version in your contract language prevails.