Terms and Conditions of Use

Informational translation. The legally binding version is the Spanish original, available at /legal/terminos.html. In case of discrepancy, the Spanish version shall prevail.

1. Purpose and parties

This document (the "Terms") governs the contractual relationship between ITRION SOFTWARE, S.L., with address at Calle Francisco Silvela, 110, floor 2, 28028 Madrid, Spain, Tax ID B19913797 (hereinafter, "ITRION", "the operator" or "we"), and the natural person who accesses or uses the ULOX service (hereinafter, "the user" or "you").

ULOX is a private end-to-end encrypted communication service and encrypted personal storage, operated from the European Union and accessible internationally, as described in section 4. Nature of the service.

2. Acceptance and validity

Use of the Service requires the prior reading, understanding and acceptance of these Terms, as well as the Privacy Policy, the Community Rules, the Minors Policy, the Cookie Policy and the Reports and Moderation Policy (collectively, the "Legal Documents").

Acceptance of these Terms is expressly carried out by ticking the acceptance box during the registration process for a new account or ULOX ID. Without that express acceptance it is not possible to create an account or use the Service. Continued use of the Service implies tacit acceptance of any updated version published, without prejudice to the user's right to deregister in the event of non-conformity with the changes.

These Terms enter into force at the moment the user accepts them and remain in force until the cancellation of the account, whether voluntary or decided by ITRION pursuant to these Terms.

3. Definitions

4. Nature of the service

ULOX is an information society service that offers:

• End-to-end encrypted messaging and file communication between users.
• Private universes (Private LOX) intended for encrypted personal storage, accessible only by the user.
• Shared universes (Shared LOX) accessible to those who know the correct coordinates.
• Auxiliary tools: password vault, notes, file management, photos, audios and videos, all encrypted on the client before leaving the device.

ITRION's server stores exclusively opaque encrypted data that it cannot interpret. ITRION has no technical capability to read, decrypt, index or moderate user content. This model, called "blind server", is deliberate and forms part of the value proposition of the Service.

As a consequence of the above, the user acknowledges and accepts that liability for the Contents they create, store, share or transmit lies exclusively with them, and that the technical impossibility of moderating content a priori does not exempt the user from complying with the law at all times nor excludes the possibility of complaint, investigation and prosecution by the competent authorities in their jurisdiction.

5. Minimum age

The Service is intended for persons of legal age or, failing that, persons who have reached the minimum age required by the legislation of their country or region of residence to provide valid consent for the use of digital services and for the processing of personal data.

For merely indicative purposes:

• European Union / European Economic Area: 16 years as a general rule, or the lower age set by applicable national law (between 13 and 16 years depending on the Member State).
• United Kingdom: 13 years (UK GDPR).
• United States: 13 years (COPPA).
• Rest of the world: civil age of majority in their country or, failing that, 16 years.

Regardless of the local legal minimum, ITRION may establish a higher minimum age if it considers it necessary for the protection of minors or for regulatory compliance. See the Minors Policy for details. Accounts created in violation of this section will be suspended or deleted as soon as the fact is known.

6. Registration and ULOX ID

To use the Service the user must register a ULOX ID and a master key. Registration does not require email, phone number or real name; the user is free to choose the identifier they wish within the technical rules of the Service.

The user is solely responsible for:

• The custody of their master key, their LOXs and any other cryptographic secret.
• The veracity of the data they decide to provide, where applicable.
• All activities carried out from their account.

Critical technical notice: given the cryptographic model of the Service, ITRION cannot recover keys, forgotten LOXs or access private universes. The loss of the master key or of a LOX implies the irreversible loss of access to the corresponding universe and its content. This feature is structural and deliberate, not a defect.

7. Licence of use

ITRION grants the user a personal, worldwide, free (or, where applicable, subject to the economic conditions published for paid plans), non-exclusive, non-transferable, non-sublicensable and revocable licence to access the Service and use it in accordance with these Terms and the other Legal Documents.

This licence does not imply any transfer of ownership over the software, the trademark, distinctive signs, or any other element owned by ITRION. Any use beyond the scope of the licence requires express written authorisation from ITRION.

8. User obligations

The user undertakes to:

• Comply with the legislation applicable in their jurisdiction of residence and any other from which they use the Service.
• Respect other users, their rights, their privacy and their dignity.
• Not use the Service for illegal, fraudulent or harmful activities towards third parties.
• Diligently safeguard their master key, their LOXs and any cryptographic secret generated or adopted for use of the Service.
• Immediately communicate to ITRION any suspicion of unauthorised use of their account through support@ulox.org.
• Comply with the Community Rules, which form an integral part of these Terms.

9. Prohibited conduct

Without prejudice to the provisions of the Community Rules, the user expressly undertakes not to use the Service for:

9.1. Illegal content or content affecting human dignity

• Producing, storing, distributing, sharing, soliciting, promoting or consuming child sexual abuse material (CSAM) in any form, medium or representation, including artificially generated images. This conduct will be immediately reported to the competent authorities.
• Any form of pornography or sexually explicit material, including consensual adult pornography. ULOX is not a platform oriented to sexual content and expressly prohibits any material of this nature, regardless of the consent of the persons represented.
• Non-consensual dissemination of intimate or sexual images (revenge porn, sextortion), even if the persons represented are adults.
• Content promoting, glorifying or facilitating the exploitation or trafficking of human beings, forced prostitution, human trafficking or slavery.
• Content that violates the dignity of persons, including incitement to hatred, xenophobia, racism, discrimination on grounds of gender, sexual orientation, gender identity, religion, disability or any other personal or social circumstance.

9.2. Violence, threats and hostile conduct

• Threats of death, injury, physical, psychological or property damage directed at specific persons or groups.
• Harassment, intimidation, stalking, cyberbullying or any form of coercive behaviour, whether individual or coordinated.
• Doxxing — the disclosure of identifying personal data of third parties without their consent — and any practice intended to expose, persecute or intimidate persons on the basis of personal information.
• Content that glorifies, encourages or coordinates terrorist acts, violent extremism or any form of organised violence.
• Content related to suicide or self-harm that may induce or instruct third parties to cause themselves harm.

9.3. Criminal offences and illegal markets

• Trafficking, sale, distribution or promotion of illegal drugs, controlled substances or restricted medicines without a valid prescription.
• Trafficking, sale, distribution or promotion of firearms, bladed weapons, explosives, ammunition or similar material, except through legally authorised channels.
• Money laundering, terrorist financing and any crime typified in international regulations against financial criminality.
• Scams, frauds, pyramid schemes (Ponzi), phishing, scams, identity theft and any conduct intended to obtain illegitimate benefit from third parties.
• Trade in stolen information, leaked credentials, personal data obtained illicitly, stolen credit cards or any product of cybercrime.
• Tax evasion, smuggling, illegal trade in protected species, stolen cultural goods or any goods whose transmission is legally restricted.

9.4. Intellectual and industrial property

• Distribution of works protected by copyright, trademarks, patents, designs or any other intellectual or industrial property right without the rights holder's authorisation.
• Mass sharing of pirated software, stolen licence keys, unlicensed audiovisual content or similar material.
• Use of the trademark, distinctive signs or graphic identity of ULOX to mislead, impersonate the service or create the appearance of non-existent affiliation or endorsement.

9.5. Security and technical abuse

• Distribution of malware, viruses, worms, trojans, ransomware, spyware, keyloggers, intrusion tools, exploit kits or any code intended to compromise systems or data of third parties.
• Carrying out or coordinating denial of service attacks (DoS, DDoS), mass spam, unauthorised automated sending, aggressive scraping, or any conduct that compromises the availability, integrity or confidentiality of the Service or the communications of other users.
• Attempts to bypass, manipulate, disable or breach the technical measures of security, encryption, authentication or any other control implemented by ITRION.
• Reverse engineering, decompilation or disassembly of Service components beyond what is permitted by applicable mandatory law.
• Mass creation of accounts, abusive automation, impersonation of other users, or use of false identities with fraudulent intent.

9.6. Minors and vulnerable victims

• Any conduct of approach, sexual communication or exploitation directed at minors (grooming, sexting with minors, recruitment, etc.).
• Any form of exploitation, manipulation or abuse of persons in a situation of special vulnerability.

9.7. General clause

The use of the Service for any purpose contrary to applicable law, public order, good morals or human dignity is equally prohibited, as well as any other conduct that, in ITRION's reasonable judgement, is incompatible with the legitimate purposes of the Service. ITRION reserves the right to interpret the scope of this clause with the diligence and reasonableness proper to a responsible operator.

10. User-generated content

The Contents that the user creates, stores, shares or transmits through the Service are and shall remain their exclusive property. ITRION does not claim or acquire intellectual property rights over them.

To make the provision of the Service possible (storage of encrypted blobs, relay of packets between devices, synchronisation between clients), the user grants ITRION a limited, free, non-exclusive, worldwide licence for the duration equal to that of the service, to process, store and transmit those Contents exclusively in the form in which they are encrypted, without technical possibility for ITRION to access their plaintext content.

The user declares and warrants that they have all the necessary rights over the Contents they use with the Service and that their transmission, storage or exchange does not infringe third-party rights or applicable regulations.

The user is fully aware that civil, administrative and criminal liability over the Contents lies exclusively with them.

11. Encryption and operator non-access

The Service incorporates end-to-end encryption and client-side encryption for content stored in private universes. ITRION lacks the cryptographic keys necessary to decrypt such content, does not store LOX in plaintext and has no technical capability to access the user's universe content.

This feature, essential to the Service, implies that:

• ITRION cannot recover for the user forgotten keys, lost LOXs or data encrypted with non-accessible keys.
• ITRION cannot examine a priori the encrypted content of communications or of private storage.
• In the face of a binding legal request from a competent authority, ITRION cooperates by delivering the data it actually holds (see the Privacy Policy) and providing the technical assistance that is reasonably possible within the service model.

12. Intellectual property

All software, code, design, trademark, distinctive signs, documentation and content of the Service are the property of ITRION or of third-party licensors, and are protected by international intellectual and industrial property regulations. Use of the Service does not transfer to the user any right over these elements beyond the licence described in section 7.

Any feedback, suggestion, idea or improvement proposal that the user submits to ITRION about the Service shall be deemed offered freely, gratuitously and non-exclusively, and may be implemented by ITRION without this entailing any obligation towards the user.

13. Suspension and cancellation

ITRION may suspend or cancel immediately, totally or partially, the user's access to the Service when any of the following circumstances occur:

• Breach, even reasonable suspicion thereof, of these Terms or of the other Legal Documents.
• Conduct foreseen in section 9. Prohibited conduct.
• Judicial, administrative, regulatory request or request from legally competent law enforcement bodies.
• Serious risk to the integrity, security or availability of the Service or to other users.
• Technical, operational, regulatory reasons or closure of the Service.

Cancellation of the account will terminate the user's access to the Service. Given the cryptographic characteristics of the Service, cancellation may imply the irreversible loss of access to the user's content.

The user may deregister from the Service at any time from the application itself or, failing that, by request to support@ulox.org. Deregistration will terminate the contractual relationship, without prejudice to legal retention obligations of certain data for limited periods (see the Privacy Policy).

14. Availability and support

ITRION will use reasonable means to keep the Service operational on an ongoing basis, but does not guarantee absolute availability. The Service may suffer scheduled interruptions (maintenance, updates, deployments) or unscheduled ones (technical failures, attacks, force majeure, provider unavailability).

Support will be provided through the channels published in the Legal Notice, in European working hours and in Spanish and English. ITRION does not guarantee specific response times unless agreed in specific conditions of paid or enterprise plans.

15. Warranties and disclaimers

Without prejudice to the mandatory consumer rights applicable in their jurisdiction of habitual residence, the Service is provided "as is" and "as available". ITRION does not warrant:

• That the Service will satisfy specific user needs.
• That the Service will operate without interruptions, errors, defects or vulnerabilities.
• That the results obtained from using the Service will be accurate, complete or reliable.
• That Contents sent or received will always be delivered or retained.

To the maximum extent permitted by applicable law, ITRION disclaims any implied warranty of merchantability, fitness for a particular purpose or non-infringement.

16. Limitation of liability

To the maximum extent permitted by applicable law, ITRION shall not be liable for indirect, consequential, special, incidental, punitive damages or loss of profit arising from or related to the use or inability to use the Service, including, without limitation: loss of data, of keys, of LOXs, of business opportunities, of reputation or of communications.

ITRION's aggregate and total liability towards the user for any claim arising from the Service shall be limited, to the maximum extent permitted by applicable law, to the lesser of the following amounts: (i) the amounts effectively paid by the user to ITRION in the twelve (12) months prior to the event giving rise to liability; or (ii) one hundred (100) euros.

The limitations of this section do not apply in cases where mandatory law does not allow their exclusion or limitation (for example, wilful misconduct, gross negligence, damage to life or physical integrity, nor to inalienable consumer rights). In such cases, ITRION's liability shall be limited to the greatest extent permitted by applicable law.

17. Indemnity

The user undertakes to hold ITRION, its directors, employees, collaborators and suppliers harmless against any claim, demand, sanction, loss or expense (including reasonable attorneys' fees) arising from: (i) the user's use of the Service; (ii) the Contents created, stored or transmitted by the user; (iii) breach of these Terms or of the other Legal Documents; (iv) infringement of third-party rights or applicable legislation by the user.

18. Force majeure

ITRION shall not be liable for breach of any obligation under these Terms when such breach is due to circumstances of force majeure or unforeseeable event, including without limitation: natural disasters, armed conflicts, terrorist acts, government decisions, unavailability of critical infrastructure providers, mass communications network failures, pandemics or any other event beyond ITRION's reasonable control.

19. Modifications

ITRION may modify these Terms at any time. Modifications will be published in this same section indicating the date of entry into force. When modifications are substantial, ITRION will endeavour to notify the user through the Service itself with reasonable advance notice.

The user may reject the modifications by ceasing use of the Service and requesting deregistration before the entry into force of the changes. Continued use of the Service once the modifications are in force will imply their acceptance.

20. Assignment

The user may not assign these Terms or their rights or obligations arising therefrom without prior written consent from ITRION. ITRION may assign these Terms and associated contracts, in whole or in part, to any entity of its group, successor or acquirer of the business, without need for user consent, provided that the assignment does not negatively affect the user's rights.

21. Integrity and partial invalidity

If any clause of these Terms is declared null or unenforceable, totally or partially, by a competent court, such nullity shall not affect the validity of the remaining clauses, which shall retain their full effectiveness. The affected clause shall be replaced by another, in accordance with law, that most closely approximates the meaning and purpose of the original clause.

22. Applicable law and jurisdiction

These Terms are governed by and construed in accordance with Spanish law, without application of its conflict of laws rules. For any dispute arising from these Terms or the use of the Service, the parties submit to the Courts and Tribunals of the city of Madrid (Spain), with express waiver of any other jurisdiction.

The above is understood without prejudice to the mandatory rights that assist the consumer user by virtue of the consumer protection legislation of the country or region of their habitual residence, including those relating to the choice of competent court and applicable law, when such legislation is mandatorily applicable.

23. Alternative dispute resolution

The consumer user resident in the European Union has at their disposal the European online dispute resolution platform (ODR Platform) accessible at https://ec.europa.eu/consumers/odr/.

As a prior or alternative measure to the judicial path, the user may contact ITRION at legal@ulox.org to attempt an amicable resolution of any dispute.

24. Language

The original version of these Terms is drafted in Spanish. Translations into other languages are provided for informational purposes only. In case of discrepancy between the Spanish version and any translation, the Spanish version shall prevail, unless the law applicable to the consumer user provides otherwise.

25. Contact

For any query about these Terms, the user may contact ITRION SOFTWARE, S.L. through:

• Email: legal@ulox.org
• Postal: Calle Francisco Silvela, 110, floor 2, 28028 Madrid, Spain. Att.: "Legal Department — ULOX".