NexusScope — Terms of Service

Version 1.0 — Effective 16 September 2026

Last updated: 16 September 2026

1. Who we are and how to reach us

NexusScope ("NexusScope", "we", "us", "our") is operated by:

• Provider: Noah Baumann, sole proprietor, trading as NexusScope

• Registered address: Registered address coming soon, Switzerland

• Commercial register / UID (if registered): UID registration details coming soon

• VAT number (if registered): VAT registration details coming soon

• Contact e-mail: legal@nexusscopes.com

• Support: support@nexusscopes.com

• Website: https://nexusscopes.com

EU/EEA representative (data protection, Art. 27 GDPR): Details coming soon. Because we offer the Service to users in the EU/EEA from outside the Union, an EU representative is designated in writing as required by Article 27 GDPR, unless an exemption applies.

These identification details are provided to satisfy the information duties applicable to information society services and distance contracts under EU and Swiss law.

2. Scope and acceptance

2.1 These Terms of Service ("Terms") govern your access to and use of the NexusScope web application, APIs, documentation, and related services (together, the "Service").

2.2 By creating an account, clicking "I accept", or otherwise using the Service, you enter into a binding contract with us on these Terms. If you do not accept them, you must not use the Service.

2.3 Business vs. consumer users. Some clauses apply only to one category:

• A "Consumer" is a natural person acting wholly or mainly outside their trade, business, craft, or profession.

• A "Business Customer" is any other user, including anyone acting for a company, public body, or self-employed activity.

Clauses marked [Consumers only] do not apply to Business Customers, and clauses marked [Business Customers only] do not apply to Consumers. Where the two conflict, the consumer-protective rule prevails for Consumers.

2.4 No conflicting terms. [Business Customers only] Your own general terms and conditions do not apply, even if we do not expressly object to them and perform without reservation.

2.5 Eligibility. You must be at least 16 years old (or the higher age of digital consent in your country of residence) and have legal capacity to contract. The Service is not directed at children.

3. What the Service does — and what it does not do

3.1 Description. NexusScope provides regulatory readiness orientation for overlapping cyber-incident reporting regimes in Germany (NIS2UmsuCG/BSIG), Austria (NISG 2024) and Switzerland (ISG). Based on a short company profile and a passive public-footprint check, it produces regime applicability assessments, reporting clocks, gap lists, and reasoning with cited public sources. Outputs are informational orientation for internal assessment — not legal advice. A current functional description and any tier-specific limits are set out at https://nexusscopes.com and in the order confirmation.

3.2 No legal advice — critical limitation. NexusScope is software, not a law firm. Its outputs (scores, findings, gap analyses, checklists, templates, and recommendations) are informational only, are generated in whole or in part automatically, and:

• do not constitute legal, regulatory, audit, or certification advice;

• do not guarantee compliance with the GDPR, the Swiss FADP/revDSG, the ePrivacy rules, the AI Act, the NIS2 Directive, the DSA, the Data Act, or any other legal requirement;

• are not a substitute for review by a qualified lawyer, data protection officer, or auditor;

• may be incomplete, out of date, or incorrect, particularly where source data is inaccessible, ambiguous, or changes after a scan.

You remain solely responsible, as controller or processor of your own data, for your compliance decisions. Any reliance on the Service's output is at your own responsibility, subject to Section 12 (which does not exclude liability where the law forbids exclusion).

3.3 Automated processing and AI components. Parts of the Service use automated analysis, heuristics, and machine-learning or large language models. Such systems can produce inaccurate or "hallucinated" statements. We label AI-assisted output where practicable and you must apply human review before acting on it. We do not use the Service to make automated decisions producing legal or similarly significant effects on natural persons within the meaning of Art. 22 GDPR / Art. 21 revFADP.

3.4 Third-party sources and targets. You may only direct the Service to scan, query, or analyse domains, systems, repositories, and accounts that you own or for which you hold documented authorisation. You are responsible for obtaining that authorisation. We may suspend scans that appear unauthorised.

3.5 Changes to the Service. We may improve, modify, or discontinue features. For paid plans, we will not materially degrade the core functionality you paid for during a current billing period; where a change would materially and negatively affect you, Section 15 (changes) and your termination rights apply. Where the EU Digital Content Directive applies, modifications beyond what is necessary to maintain conformity will only be made for a valid reason, at no extra cost, with reasonable advance notice, and with a right for Consumers to terminate free of charge if the change negatively impacts access or use more than insignificantly.

4. Accounts and security

4.1 You must provide accurate registration information and keep it up to date.

4.2 You are responsible for safeguarding credentials and API keys and for all activity under your account. Notify us without undue delay at security@nexusscopes.com if you suspect unauthorised access.

4.3 [Business Customers only] You are responsible for your authorised users (employees, contractors, affiliates) and their compliance with these Terms as if their acts were your own. Seat limits per plan apply.

4.4 We may require multi-factor authentication and may suspend an account where necessary to protect the Service, other users, or third parties.

5. Acceptable use

5.1 You must not, and must not permit anyone to:

a) use the Service unlawfully or in breach of Swiss, EU, or other applicable law, including data protection, export control, and sanctions law;

b) scan, probe, or test systems without authorisation, or use the Service for penetration testing of third-party infrastructure you do not control;

c) upload malware, or attempt to circumvent, disable, or overload the Service, its rate limits, or its security controls;

d) reverse engineer, decompile, or derive source code except to the extent such restriction is unenforceable under mandatory law (including Art. 21 Swiss Copyright Act / Art. 6 Directive 2009/24/EC on interoperability);

e) resell, sublicense, white-label, or provide the Service to third parties as a service bureau unless a written partner agreement permits it;

f) use the Service or its output to train competing models or to build a competing product;

g) upload special categories of personal data (Art. 9 GDPR / Art. 5(c) revDSG), payment card data, or data subject to sector-specific secrecy (medical, banking, attorney-client) unless we have agreed to this in writing in advance;

h) infringe intellectual property, publicity, or privacy rights.

5.2 Notice and action. If you believe content accessible through the Service is illegal or infringes your rights, notify us at abuse@nexusscopes.com with the information required by Art. 16 of the Digital Services Act (your contact details, a substantiated explanation, the exact electronic location, and a good-faith statement). We will handle notices in a timely, diligent, non-arbitrary and objective manner, inform you of our decision, give a statement of reasons where we restrict content or an account, and tell you about available redress including out-of-court dispute settlement and judicial remedy.

5.3 Enforcement. Where you materially breach this Section, we may warn you, restrict features, remove content, suspend, or terminate. Except where immediate action is required by law or to prevent serious harm, we will give prior notice and an opportunity to cure within a reasonable period.

6. Your content and our rights

6.1 Ownership. You retain all rights in the data, documents, configurations, and materials you upload or connect ("Customer Content"). We claim no ownership.

6.2 Licence to us. You grant us a non-exclusive, worldwide, royalty-free licence to host, store, transmit, display, and process Customer Content solely to provide, secure, and support the Service, and to comply with law. This licence ends when the content is deleted, subject to backup cycles described in Section 10.

6.3 No training on your content by default. We do not use Customer Content to train or fine-tune general-purpose AI models. Where a feature would do so, it is strictly opt-in and separately described.

6.4 Aggregated statistics. We may generate and use aggregated, irreversibly anonymised statistics (e.g. counts of findings by category) that do not identify you, your users, or any natural person.

6.5 Warranty. You warrant that you have the rights and lawful basis needed for us to process Customer Content as contemplated here.

7. Our intellectual property and licence to you

7.1 The Service, its software, models, databases, rule sets, user interface, and branding are owned by us or our licensors and are protected by copyright and other rights.

7.2 Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, revocable right to access and use the Service during your subscription term for your internal business or personal purposes.

7.3 Reports. You may use, copy, and share reports generated for you internally and with your advisors, auditors, and authorities. You may not sell them or present them as an independent certification.

7.4 Feedback. If you send suggestions, we may use them without restriction or compensation.

7.5 Open source. Third-party open-source components are licensed under their own terms, listed at /legal/oss.

8. Plans, fees, billing, and taxes

8.1 Subscriptions. The Service is offered on monthly or annual subscription plans. Prices, features, quotas, and any usage-based charges are those displayed at /pricing and in your order confirmation at the time of purchase.

8.2 Price transparency. For Consumers, prices are shown inclusive of all taxes and unavoidable charges, together with the total amount payable and the billing frequency, before you place the order. For Business Customers, prices may be shown excluding VAT, clearly labelled as such. The order button is labelled to make clear that the order entails an obligation to pay.

8.3 Payment. Fees are charged in advance for each billing period through our payment provider Stripe. You authorise recurring charges to your payment method until you cancel.

8.4 Automatic renewal and cancellation. Subscriptions renew automatically for successive periods equal to the initial term unless cancelled before the end of the current period. You can cancel at any time in your account settings (/account/billing) with effect from the end of the current billing period. For annual plans, we will send a reminder of the upcoming renewal and the applicable price at least 30 days before renewal. Cancellation is possible online, without needing to contact support, and with no more steps than were required to subscribe.

8.5 Taxes. Swiss VAT and EU VAT (including OSS/MOSS treatment of B2C electronically supplied services and reverse charge for B2B) are applied as legally required. Business Customers must supply a valid VAT ID where applicable.

8.6 Price changes. We may change prices with at least 30 days' notice by e-mail, effective from the start of the next billing period. If you do not accept the new price, you may terminate with effect from the date the change would take effect; the old price applies until then.

8.7 Late payment. [Business Customers only] If payment fails, we may suspend the Service after notice and a grace period of 10 days and charge default interest at 5% p.a. under Art. 104 of the Swiss Code of Obligations. For Consumers, statutory default rules apply and we will send a reminder before any suspension.

8.8 Refunds. Except for the withdrawal right in Section 9, statutory conformity remedies in Section 11, and any refund we grant at our discretion, fees are non-refundable for the period already started. We do not charge for periods after a valid termination takes effect.

8.9 Free trials and free tiers. Where offered, trials run for the stated period and convert into a paid subscription only if you actively confirm, or, where automatic conversion is offered, only after clear prior notice of the date and price. Free tiers may be modified or discontinued on 30 days' notice.

9. Right of withdrawal — Consumers in the EU/EEA

[Consumers only — EU/EEA]

9.1 If you are a Consumer resident in the EU/EEA, you have the right to withdraw from this contract within 14 days without giving any reason, in line with the EU Consumer Rights Directive as applied to distance contracts. The period starts on the day the contract is concluded.

9.2 To exercise it, inform us by a clear statement (e-mail to legal@nexusscopes.com or post to the address in Section 1). You may use the model withdrawal form in Annex A. Sending the notice before the deadline expires is sufficient.

9.3 Effects. We will reimburse all payments received from you without undue delay and no later than 14 days from the day we are informed, using the same means of payment you used, at no cost to you.

9.4 Early performance and loss of the right. If you asked us to begin supplying the digital service during the withdrawal period, you must pay a proportionate amount for what was supplied up to the moment you withdrew. You lose the right of withdrawal once the service has been fully performed, where performance began with (i) your prior express request and (ii) your acknowledgement that you thereby lose the right of withdrawal. We collect both confirmations at checkout.

9.5 Switzerland. Swiss law does not provide a general statutory right of withdrawal for contracts concluded online; the statutory 14-day revocation right in Art. 40a ff. of the Swiss Code of Obligations covers doorstep and telephone sales. As a voluntary contractual commitment, we nevertheless grant Consumers resident in Switzerland the same 14-day withdrawal right described in this Section 9, on identical conditions.

10. Data protection

10.1 Two roles.

• Where we process personal data about you as a visitor, account holder, or billing contact, we act as controller. Our Privacy Policy at /privacy explains what we collect, the legal bases, retention, recipients, international transfers, and your rights.

• Where we process personal data contained in Customer Content on your behalf, we act as processor (Art. 28 GDPR) or as commissioned processor (Art. 9 revDSG), and you act as controller.

10.2 Data Processing Agreement. The DPA at /dpa is incorporated into these Terms by reference and applies automatically where we act as processor. It sets out subject matter, duration, nature and purpose of processing, categories of data and data subjects, confidentiality, security measures (Art. 32 GDPR), sub-processor rules with prior notice and objection rights, assistance with data subject requests and DPIAs, breach notification without undue delay, and deletion or return at the end of the contract.

10.3 Applicable regimes. We process personal data in accordance with the GDPR (Regulation (EU) 2016/679) and the revised Swiss Federal Act on Data Protection (revFADP/revDSG), in force since 1 September 2023, whose protection level the Swiss Federal Data Protection and Information Commissioner describes as broadly aligned with the GDPR.

10.4 Hosting and transfers. Production data is hosted in Switzerland and/or the EU. Exact providers and regions are published when confirmed. Transfers outside Switzerland and the EEA take place only to countries with an adequacy decision, or under EU Standard Contractual Clauses supplemented for Swiss law by the FDPIC-recognised Swiss addendum, together with a transfer impact assessment. A current list of sub-processors and hosting locations is at /legal/subprocessors.

10.5 Security. We maintain appropriate technical and organisational measures, including encryption in transit and at rest, access control, logging, backup, and vulnerability management, described at /security.

10.6 Cookies and tracking. Non-essential cookies and similar technologies are used only with your prior consent, obtained through our consent banner, and consent can be withdrawn at any time as easily as it was given.

10.7 Your rights. Data subjects may request access, rectification, erasure, restriction, portability, and object to processing, and may lodge a complaint with a supervisory authority in the EU/EEA or with the FDPIC in Switzerland. Contact privacy@nexusscopes.com.

10.8 Data export and switching. You can export Customer Content and generated reports in a structured, commonly used, machine-readable format at any time during the subscription, and we will assist with switching to another provider in good faith consistent with Chapter VI of the EU Data Act.

10.9 Deletion. After termination, Customer Content remains available for export for 30 days, after which it is deleted from production systems and, within a further 90 days, from backups, unless retention is required by law.

11. Warranties, conformity, and service levels

11.1 [Consumers only] Statutory conformity. We supply the Service in conformity with the contract, the description, and what you can reasonably expect from a digital service of this type, and we keep it in conformity throughout the subscription, including by supplying updates, as required by Directive (EU) 2019/770 on digital content and digital services and its national implementations. If the Service is not in conformity, you are entitled to have it brought into conformity, and, where that is impossible, fails, or would cause significant inconvenience, to a proportionate price reduction or termination of the contract. Nothing in these Terms limits those rights. Swiss Consumers benefit from the equivalent guarantee and non-performance rules of the Swiss Code of Obligations, and we voluntarily apply the substance of this Section to them.

11.2 [Business Customers only] Limited warranty. We warrant that the Service will perform materially as described in the documentation. Your exclusive remedy for a breach of this warranty is correction within a reasonable period or, failing that, termination and a pro-rata refund of prepaid, unused fees. Except as expressly stated, and to the extent permitted by law, the Service is provided "as is" and we disclaim implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

11.3 Availability. We target 99.5% monthly availability, excluding announced maintenance, emergency maintenance, and events outside our reasonable control. Where a written Service Level Agreement applies to your plan, it governs and provides service credits as its sole remedy for missed targets.

11.4 No compliance guarantee. For the avoidance of doubt and consistent with Section 3.2, we give no warranty that use of the Service will result in, demonstrate, or maintain compliance with any law, standard, or certification.

12. Liability

12.1 [Consumers only] We are liable without limitation for death or personal injury, for damage caused intentionally or by gross negligence, for damage caused by our unlawful intent or gross negligence under Art. 100(1) of the Swiss Code of Obligations, under applicable product liability law, and wherever mandatory law does not permit limitation. For slight negligence, we are liable only for breach of an essential contractual obligation (an obligation whose fulfilment makes proper performance possible and on which you may reasonably rely) and then only for foreseeable damage typical of this type of contract. Nothing in these Terms limits your mandatory statutory remedies.

12.2 [Business Customers only] Subject to Section 12.3, our total aggregate liability arising out of or in connection with the contract, whether in contract, tort, or otherwise, is limited to the fees you paid to us for the Service in the 12 months preceding the event giving rise to the claim. We are not liable for indirect or consequential loss, loss of profit, loss of business, loss of goodwill, regulatory fines imposed on you, or loss or corruption of data to the extent avoidable by your own backups.

12.3 Never excluded. No provision of these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for intent or gross negligence (Art. 100(1) CO), or for any liability that cannot be excluded or limited under mandatory Swiss or EU law.

12.4 Your responsibility. You are responsible for maintaining your own backups of Customer Content and for verifying the Service's output before relying on it.

12.5 Indemnity. [Business Customers only] You will indemnify us against third-party claims arising from your unlawful use of the Service, from scanning systems without authorisation, or from Customer Content infringing third-party rights.

13. Term, suspension, and termination

13.1 Term. The contract begins on account activation and continues for the subscription period selected, renewing under Section 8.4.

13.2 Termination by you. You may cancel at any time with effect from the end of the current billing period, or immediately where you have a statutory right to do so (including Sections 9, 11.1, and 15.3).

13.3 Termination by us. We may terminate a free account on 30 days' notice, and a paid subscription for cause where you materially breach these Terms and fail to cure within 14 days of written notice, or immediately where the breach is incurable or where required by law. On termination for cause we will refund prepaid, unused fees unless the termination results from your breach.

13.4 Suspension. We may suspend access immediately where there is a credible security risk, suspected unlawful activity, or a legal obligation, with notice as soon as reasonably possible.

13.5 Effect. Sections 3.2, 6.1, 7, 10.9, 12, 14, and 16 survive termination.

14. Governing law, consumer protection, and disputes

14.1 Governing law. These Terms and any non-contractual obligations arising from them are governed by Swiss substantive law, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

14.2 [Consumers only] Mandatory protection preserved. This choice of law does not deprive a Consumer of the protection afforded by mandatory provisions of the law of their country of habitual residence, in line with Article 6 of the Rome I Regulation. Where the law of your country of residence gives you stronger mandatory rights, those rights continue to apply.

14.3 Jurisdiction — Business Customers. [Business Customers only] The exclusive place of jurisdiction is Zurich, Switzerland.

14.4 Jurisdiction — Consumers. [Consumers only] A Consumer may bring proceedings against us in the courts of their place of residence or at our registered seat, and we may sue a Consumer only in the courts of their place of residence, in accordance with mandatory consumer jurisdiction rules (including the Lugano Convention where applicable).

14.5 Complaints and ADR. Please contact legal@nexusscopes.com first; we aim to respond within 10 working days. EU Consumers may also use national alternative dispute resolution bodies; we are not committed to participating in ADR proceedings before a consumer arbitration body. Swiss Consumers may contact the relevant cantonal conciliation authority (Schlichtungsbehörde).

15. Changes to these Terms

15.1 We may amend these Terms to reflect changes in the Service, in law, or in our business.

15.2 We will notify you by e-mail and in-app at least 30 days before changes take effect, highlighting the substance of the change.

15.3 If a change is to your material disadvantage, you may terminate free of charge with effect from the date the change takes effect; say so before that date and we will refund prepaid, unused fees. For Consumers, silence is not treated as acceptance of a materially disadvantageous change; we will obtain express consent or, failing that, the contract continues on the previous terms until the end of the current period and then ends.

15.4 Continued use of the Service after the effective date, following clear notice, constitutes acceptance for Business Customers.

16. General

16.1 Assignment. You may not assign the contract without our written consent, not to be unreasonably withheld. We may assign it to an affiliate or in connection with a merger or sale of assets, provided your rights are not diminished; Consumers may terminate if the assignment materially disadvantages them.

16.2 Severability. If a provision is invalid or unenforceable, the remainder stays in force, and the invalid provision is replaced by a valid one that comes closest to its economic purpose. In relation to Consumers, an invalid provision is simply replaced by the applicable statutory rule.

16.3 Fairness of terms. These Terms are intended to comply with Art. 8 of the Swiss Unfair Competition Act (UWG/UCA), which makes it unfair to use general terms that, contrary to good faith, create a significant and unjustified imbalance between contractual rights and obligations to the detriment of consumers (SECO), and with Directive 93/13/EEC on unfair terms in consumer contracts. Any clause that would be unfair under those rules does not apply to Consumers.

16.4 Entire agreement. These Terms, the DPA, the Privacy Policy, any SLA, and the order confirmation form the entire agreement, superseding prior understandings. This does not exclude liability for fraudulent misrepresentation.

16.5 Force majeure. Neither party is liable for failure to perform caused by events beyond its reasonable control, excluding payment obligations.

16.6 Notices. Notices to us go to legal@nexusscopes.com; notices to you go to the e-mail on your account or via in-app message.

16.7 Language. These Terms are concluded in English. Where we publish a German, French, or Italian translation and a discrepancy arises, the English version prevails, except where mandatory consumer law in your country requires otherwise.

Annex A — Model withdrawal form

(Complete and return this form only if you wish to withdraw from the contract.)

To: Noah Baumann / NexusScope, registered address coming soon, Switzerland — legal@nexusscopes.com

I/We () hereby give notice that I/We () withdraw from my/our (*) contract for the supply of the following service:

Ordered on ()/received on (): ______________

Name of consumer(s): ______________

Address of consumer(s): ______________

Signature of consumer(s) (only if this form is notified on paper): ______________

Date: ______________

(*) Delete as appropriate.

Annex B — Documents incorporated by reference