Terms and Conditions

1. Scope of Application

These Terms and Conditions ("T&Cs") apply to the use of our software-as-a-service (SaaS) platform (hereinafter referred to as "the Platform"). By creating an account or using the Platform, you accept and agree to these T&Cs.

2. Governing Law and Jurisdiction

These T&Cs are governed exclusively by the laws of Austria. Any disputes arising in connection with these T&Cs or the use of the Platform shall be subject to the exclusive jurisdiction of the competent courts in Austria.

3. Account Registration and Pricing

Free Registration: Creating a user account on the Platform is free of charge.
Tenant Fees: Fees apply to tenants who use the Platform for data management or other professional services. The fee structure is communicated during the service selection process.
Price Adjustments: We reserve the right to adjust pricing for our services at any time. Any price changes will be communicated to affected users via email or in-app notification at least 30 calendar days before they take effect. Continued use of the Platform after the effective date of a price change constitutes acceptance of the new pricing. Users who do not agree with the adjusted pricing may cancel their subscription before the new pricing takes effect.

4. Service Packages and Changes to Packages

What a Package Is: Every tenant is assigned a package (plan). A package defines the features available to the tenant and the included quotas for the metered resources — stored volume, delivered traffic, API read and write operations, AI tokens, workflow runs, webhook deliveries and sub-tenants — together with the price charged for usage beyond those quotas.
Right to Adjust Packages: We reserve the right to change the composition of a tenant's package at any time. This includes adding, changing or removing features, raising or lowering the included quotas and technical limits, moving a tenant to a successor package, and discontinuing a package entirely.
30 Days Notice: Any change that reduces the scope of a package for the affected tenant — a lower quota or limit, the removal of a feature, a higher price, or the discontinuation of the package — will be communicated to the affected tenant via email or in-app notification at least 30 calendar days before it takes effect. Changes that only extend a package, such as additional features, higher quotas or lower prices, may take effect immediately and without prior notice.
Acceptance and Cancellation: Continued use of the Platform after the effective date of a package change constitutes acceptance of the changed package. Tenants who do not agree with the change may cancel their subscription before it takes effect.
Technical Enforcement: Once a package change has taken effect, the quotas and limits of the new package are enforced technically. This may mean that requests beyond a limit are rejected or throttled, or that a feature is no longer available in the interface or the API.
Immediate Changes for Legal or Security Reasons: Where a change is required to comply with a legal obligation, or to avert an immediate security or availability risk to the Platform or its users, it may take effect without the notice period described above. We will inform affected tenants as soon as reasonably possible.

5. Use of the Platform

The Platform is provided "as is" and "as available" without any guarantees regarding uninterrupted availability, error-free operation, or suitability for a specific purpose.
Users are responsible for ensuring that the data they manage on the Platform complies with all applicable laws and regulations.
We reserve the right to suspend or terminate accounts that violate these T&Cs or applicable laws.

6. Usage Measurement, Statistics and Audit Logs

Operating a hosted asset platform requires us to measure how it is used. By using the Platform, users acknowledge and agree to the following.

What We Record: For every asset delivered through our file proxy we record the requested file, the time of the request, the transferred volume and technical request data such as the IP address and the user agent of the requesting client. In addition we maintain aggregated counters per tenant and per file for stored volume, delivered traffic, API read and write operations, AI tokens, workflow runs, webhook deliveries and sub-tenant usage. Changes to assets and to workspace configuration are recorded in an audit log together with the acting account and the values that changed.
Why We Record It: (a) to calculate usage-based fees and to substantiate invoices, counted as defined in Section 7, (b) to apply and enforce the quotas and limits of the tenant's package as described in Section 4, (c) to detect and stop abuse, fraud, and other threats to the availability and security of the Platform, (d) to provide tenants with the usage statistics and audit trail shown in their workspace, (e) to plan capacity and improve the performance of the service, and (f) to assess and respond to copyright and DMCA notices as described in Sections 14 to 16.
Retention: Request-level records are retained for 30 calendar days and are then deleted automatically. Aggregated counters and audit log entries are retained for as long as they are required for billing, accounting, and statutory retention obligations. The audit log of an individual asset is limited to its most recent entries.
Web Analytics: The measurement described here concerns the operation of the Platform and is separate from the analytics used on our public website, which is subject to consent. Details of both, including the legal basis for each purpose, are set out in our
Privacy Policy
.
Tenant Responsibility: Tenants deliver our asset URLs to their own visitors and end users, whose requests are recorded as described above. Tenants are responsible for describing this processing in their own privacy notice and for obtaining any consent required from those individuals.

7. How Metered Usage Is Counted

Section 4 lists the metered resources a package includes a quota for. This section defines what each of them counts, because a quota is only meaningful once the unit behind it is stated.

Stored Volume: The number of bytes of the originals held for a tenant, measured on the storage that serves them. Renditions and cached variants we generate from an original are not counted separately.
Delivered Traffic: The number of bytes leaving our storage on behalf of a tenant. This includes assets delivered through the file proxy, and it equally includes bytes that leave in any other way we performed for the tenant — in particular the copies written by a backup to a target of the tenant's choosing, and files imported from a connected disk. Bytes are counted once per transfer; a transfer that fails part way is not counted.
API Read Operations: Counted per object, not per call. A call that returns fifty assets is fifty read operations, whether it was made against the GraphQL API, the REST API or an MCP tool. This is deliberate: counting per call would price the same work differently depending on how a client chose to phrase it. Reads answered from the gateway cache are counted as reads.
API Write Operations: Counted per object, on the same principle. Creating, changing, moving, blocking, archiving or deleting an object through the API is one write operation per object affected. A bulk call that creates one hundred files is one hundred write operations; a mutation that takes a list of twenty identifiers is twenty. In addition, each file copied to a backup target is one write operation, because that copy is an object written on the tenant's behalf.
What Is Not a Write Operation: Working in the web interface while signed in is use of the product, not of the API, and is not counted. Neither is a call that did not succeed: a request rejected by validation, by a permission check or by a quota produces no write operation. Reading, listing and searching are never write operations, irrespective of the HTTP method a call uses.
AI Tokens: The tokens consumed by the AI models we call on a tenant's behalf, as reported by the respective model provider, for descriptions, alternative texts, tags, focal points and comparable features.
Workflow Runs and Webhook Deliveries: One workflow run is one execution of a configured workflow, however many assets it touched. One webhook delivery is one attempt to deliver one event to one endpoint; retries of a failed delivery are counted as separate deliveries.
Sub-Tenants: The number of sub-tenants attached to the tenant during the billing period.
When It Is Counted: Usage is accumulated per workspace per calendar day and reported to our payment provider for the current billing period. Figures reported for a period that has closed are not revised retroactively, other than to correct a demonstrable error on our side.
Where It Can Be Seen: The counters described here are shown to the tenant in the statistics area of the workspace and are the same figures the invoice is calculated from.
Changes to Counting: A change to the way a resource is counted that increases the recorded usage for unchanged behaviour is a change that reduces the scope of a package within the meaning of Section 4, and is subject to the notice period stated there.

8. Caching and Cache Invalidation

Delivery Through Caches: Assets are delivered through a caching file proxy. They may additionally be cached by content delivery networks, intermediate proxies, corporate networks and end user browsers that are not under our control.
Invalidation Is Asynchronous: When an asset is changed, replaced, blocked, restricted or deleted, the resulting cache invalidation is not performed synchronously with the request that triggered it. It is placed in a queue and processed in the background. A successful response from the interface or the API confirms that the change has been accepted and recorded, not that every cached copy has already been discarded.
Variable Delay: The time between a change and the moment the new state is served to every requester depends on the current load of the Platform, the length of the processing queue, and the number of cached variants of the asset. This delay varies and may be considerably longer during periods of high load. We do not warrant any specific propagation time, and no service level applies to it.
Downstream Caches: Copies already held by third-party content delivery networks, proxies or browsers expire according to their own caching rules and cannot be purged by us.
No Liability for the Delay: We are not liable for damages arising from the continued delivery of a previous version of an asset, or of an asset that has been blocked or deleted, during the invalidation period. Users who depend on a change taking effect at a precise moment must account for this delay in their own processes, for example by publishing under a new asset URL rather than by replacing an existing one.

9. Liability Disclaimer

To the fullest extent permitted by Austrian law:

No Liability for Data Loss: We are not responsible for any data loss, corruption, or unauthorized access that may occur during the use of the Platform. Users are encouraged to maintain regular backups of their data.
Backups: The Platform does not keep independent backup copies of uploaded files. File backups are provided exclusively through the backup feature, which mirrors files to a storage target configured by the user; setting up, scoping and verifying that mirror is the user's responsibility. Excepted from this is the metadata held in the Platform's database — such as descriptions, rights information and custom fields — which is covered by our internal database backups.
Limited Liability: Our liability for any direct damages is limited to the fees paid by the user in the 12 months preceding the event that gave rise to the claim.
Exclusion of Indirect Damages: We disclaim any liability for indirect, consequential, incidental, or punitive damages, including but not limited to lost profits, loss of business opportunities, or reputational harm.

10. Data Privacy and Security

We implement industry-standard measures to protect user data. However, we cannot guarantee absolute security and shall not be held liable for any breaches beyond our reasonable control.
Users are responsible for ensuring the confidentiality of their login credentials and for any activity conducted under their account.

11. Modifications

We reserve the right to update or modify these T&Cs at any time. Users will be notified of significant changes, and continued use of the Platform after the changes indicates acceptance. For pricing-related changes a minimum notice period of 30 calendar days applies as described in Section 3, and the same period applies to package changes that reduce the scope of a package as described in Section 4.

If you do not wish to accept a change, you may object to it. An objection ends the agreement 30 calendar days after we receive it. Until that date, the version of these T&Cs that applied before the change continues to govern your account.

12. Termination of Services

We may terminate or suspend access to the Platform at our discretion, including but not limited to cases of:

Non-compliance with these T&Cs,
Legal or regulatory requirements,
Security threats to the Platform or its users.

13. Indemnification

Users agree to indemnify and hold us harmless from any claims, damages, or expenses (including legal fees) arising out of their use of the Platform, violation of these T&Cs, or breach of applicable laws.

14. DMCA and Copyright Complaints

We respect the intellectual property rights of others and comply with the Digital Millennium Copyright Act (DMCA) and equivalent international regulations.
Users may file DMCA takedown notices for content that allegedly infringes their rights. Upon receipt of a valid DMCA notice, we will review the claim and notify the affected user ("Tenant") accordingly.
Tenants have 30 days from the date of notification to respond with a counter-notice or to remove the reported content.

15. Automatic Suspension After 30 Days of Inaction

If a Tenant fails to respond to a DMCA takedown notice within 30 calendar days of receiving the notification, we reserve the right to:

Automatically suspend or disable the reported file(s) without further notice, and
Restrict access to the affected content until the matter is resolved or clarified.

Such actions are taken to ensure legal compliance and protect the rights of all parties involved. Users acknowledge and agree that this process does not constitute a breach of service on our part. Suspending a file removes it from delivery through the caches described in Section 8, which is subject to the invalidation delay set out there.

16. Disclosure of Tenant Contact Information

In cases where a valid DMCA takedown notice has been filed and the affected Tenant does not respond within 30 calendar days, we reserve the right to share the Tenant’s contact information (such as name, email address, or company details) with the original complainant.

This disclosure is made solely for the purpose of resolving the rights infringement matter and in accordance with applicable data protection and legal requirements.

17. Contact

For any inquiries or support, please contact us at:
Email: support@sushi.dev
Address: Sushi Dev GmbH, Wiedner Gürtel 28/6 – 1040 Vienna, Austria

Effective Date: 05.08.2026