Legal document changelog

This page records the version history of the Terms of Use, the Data Processing Agreement, the Privacy Policy and the Sub-processors list, and states from which date each version applies.

Version 2.0

Published 31 August 2026. Effective 1 October 2026. Applies to the Terms of Use, the Data Processing Agreement and the Privacy Policy.

Contracting entity

The contracting entity and data controller under these documents is Subgen AI Spain, S.L., a company incorporated under the laws of Spain, with Spanish tax identification number (NIF) B40656274, registered with the Commercial Registry of Valencia under Section 8, Sheet V-192386, with its registered office at Calle Colón 8, Puerta 2, 46004 Valencia, Spain.

It replaces Subgen AI Limited (Company No. 15374966, United Kingdom), which was named as the contracting entity in version 1.0 of these documents. Subgen AI Spain, S.L. has been the contracting party with effect from 1 November 2025.

Governing law and jurisdiction

• Spanish law now governs the Terms of Use, replacing French law.
• Spanish law now governs the Data Processing Agreement, replacing the reference to "the laws of the United Kingdom".
• The courts of Valencia, Spain have exclusive jurisdiction, replacing the courts of London.
• The ICC arbitration clause, which designated London as the seat, has been removed.

Consumer protection

An express carve-out has been added to the applicable law and jurisdiction clauses of the Terms of Use: a Consumer does not lose the protection of the mandatory provisions of the law of their country of residence, nor the right to bring proceedings before the courts of their place of residence.

Dispute resolution

The reference to the European Online Dispute Resolution (ODR) platform has been removed. That platform ceased to operate on 20 July 2025 under Regulation (EU) 2024/3228, which repealed Regulation (EU) 524/2013. It has been replaced with a complaints mailbox and a link to the European Commission's directory of alternative dispute resolution bodies.

Sub-processors

The Sub-processors list is now published as a public page and linked from clause 6 of the Data Processing Agreement and from section 6 of the Privacy Policy.

Clause 6 of the Data Processing Agreement now distinguishes two categories of Sub-processor. Platform Sub-processors support the platform for every Customer and remain subject to general authorisation with 30 days of prior notice. Customer-Elected Model Providers are engaged only when a Customer enables the corresponding Model, so the notice period does not apply to the addition of a Model to the catalogue.

Section 7, on international data transfers, has been rewritten to describe that same split. The previous wording stated that Subgen AI only transferred Personal Data under an adequacy decision, appropriate safeguards or a derogation, without distinguishing between the two categories.

Availability and service levels

Section 5.2 of the Terms of Use no longer states that Subgen AI is not liable for any unavailability of the Services, nor that downtime does not entitle the Customer to a refund regardless of its duration. Liability for unavailability is now governed by section 12 (Liability), which applies only to the extent permitted by the applicable law. The exclusion of service credits is now expressed as applying to Commercial Customers, and leaves room for different terms to be agreed in Additional Terms.

An express saving has been added for Consumers: nothing in section 5.2 limits the rights available to a Consumer where the Services are not in conformity with the Agreement.

Two cross-references to the definition of Force Majeure Event have been corrected. Section 9 pointed to section 18 and section 12.1 pointed to section 14; the definition is in section 17.

Training on Customer data

Clause 2.2 of the Data Processing Agreement no longer authorises Subgen AI to process User Data to improve the training of its Models. It now states expressly that Subgen AI does not use User Data to train or fine-tune its Models. This aligns the Data Processing Agreement with section 4 of the Privacy Policy, which already said that service improvement excludes training on user data.

Personal data breaches, return and deletion

The definition of "Personal Data Breach" has been aligned with Article 4(12) of the GDPR. The previous definition required a breach to be "likely to result in a risk for the rights and freedoms of Data Subjects" before it counted, which made the notification duty depend on Subgen AI's own risk assessment rather than the Customer's.

Clause 9.1 now places the choice between return and deletion of Personal Data with the Customer, as Article 28(3)(g) requires, sets a period for making that choice, provides for deletion in the absence of one, and covers existing copies.

Consumer provisions

Clause 15.2 no longer refers the Consumer to an Exhibit 1 that does not exist in the Terms of Use. It now sets out the legal guarantee of conformity by reference to Articles 114 to 127 of Royal Legislative Decree 1/2007 and states the remedies available.

Clause 18.2.2 now records that Subgen AI may bring proceedings against a Consumer only before the courts of the Consumer's place of residence, and that the Consumer may sue either there or in Valencia. This reflects Article 18 of Regulation (EU) 1215/2012, which cannot be varied by an agreement made before a dispute arises.

Right of withdrawal

Clause 15.1 no longer extracts a blanket waiver of the right of withdrawal from every Consumer subscribing to a Paid Service. A prior waiver of consumer rights is null under Article 10 of Royal Legislative Decree 1/2007.

The clause now sets out the fourteen-day right, how to exercise it, the effects of withdrawal and the reimbursement period, the proportionate payment due where the Consumer asks for performance to begin during the period, the circumstances in which the right is lost for a fully performed service and for digital content not supplied on a tangible medium, and a model withdrawal form. The heading no longer carries the French label "Droit de retractation".

Limitation of liability and Outputs

The liability caps in Section 12 are now expressed as applying to Commercial Customers. For Consumers, liability is determined by the applicable law, and nothing in the Agreement excludes liability for death or personal injury, wilful misconduct or gross negligence, or anything else that cannot lawfully be excluded. Articles 86.1 and 86.2 of Royal Legislative Decree 1/2007.

The Output disclaimer in Section 6 previously excluded liability for direct damages with no qualification. It is now expressed to the extent permitted by the applicable law, is made subject to Section 12, and carries a Consumer saving.

Changes to these Terms

Section 16 previously reserved a right to modify the Agreement at any time for anything Subgen AI classified as non-substantial. It now lists the reasons for which a non-substantial modification may be made, as Article 85.3 of Royal Legislative Decree 1/2007 requires, and requires the modified Agreement to be published with an updated version number and revision date. The thirty-day notice for a substantial modification no longer depends on Subgen AI judging that the modification adversely affects the Customer.

Late payment

The late payment clause set out the French statutory regime: three times the legal interest rate, with that rate defined as the European Central Bank refinancing rate plus ten points. It now applies the Spanish regime under Ley 3/2004: the European Central Bank main refinancing rate plus eight points, with the forty euro fixed recovery indemnity.

Cross-references

Several internal cross-references cited the wrong section number. The survival clause omitted Section 17 and cited Section 18 twice; two references to termination pointed at Section 14 (Personal Data) instead of Section 13; a reference to Your User Data pointed at Section 7 (Fees) instead of Section 6; and two references to the definition of Force Majeure Event pointed at Sections 14 and 18 instead of Section 17. All have been corrected.

Location of Processing

A new clause 7.4 of the Data Processing Agreement states where Processing takes place: the platform, the Customer's Inputs and Outputs and account data are hosted within the European Economic Area; data reaching a third-party Model, Skill or feature provider is Processed in the region identified for that provider; and the Customer may restrict its Workspace to providers that Process within the European Economic Area.

The same clause states that Subgen AI does not use the Customer's Inputs or Outputs to train or fine-tune its Models, and that where a third-party provider is enabled, that provider's own terms govern whether it does so.

Product names

The documents named four products: Serenity* AI Hub, Serenity* AI Chat, Serenity* Compliance and Serenity* Health Research. Two of those are not products, and the other two have both been renamed.

Serenity* Compliance and Serenity* Health Research have been removed. Neither was ever released as a separate product; compliance features ship as a module within the platform. Their entries in Exhibit 1, which described the processing carried out for them, and in Exhibit 2, which described security measures specific to them, have been removed with them.

Serenity* AI Hub has been renamed Serenity* Star, which is the current name of the platform.

Serenity* AI Chat is being renamed Serenity* AI. While that change is rolled out, both documents define the product under its new name and record the former one, so that the term matches the product whichever name a Customer encounters.

The Preamble no longer describes the ecosystem as three Models-as-a-Service platforms. That framing is no longer used.

Document control

The Terms of Use, the Data Processing Agreement and the Privacy Policy now each carry a version number, an effective date and a last-revised date. This changelog is the version history they refer to.

Version 1.0

The previous versions of each document, superseded by version 2.0:

Document	Date
Terms of Use	1 July 2024
Data Processing Agreement	1 January 2024
Privacy Policy	1 July 2024, last reviewed 13 May 2026