Note on this translation
This is an English translation of the German original.
German version: Allgemeine Geschäftsbedingungen (AGB) für XHANA
Key points at a glance
We have summarised everything you need to know here to save you time:
- Businesses only: The Service is intended exclusively for commercial users (B2B), not for consumers.
- AI-assisted LinkedIn content: XHANA creates posts based on the WhatsApp content you send (voice, text, images).
- Full control and approval: Every post is published on LinkedIn only after your express approval.
- Your editorial responsibility: As the customer, you are responsible for reviewing the content (accuracy, third-party rights) before publication.
- AI notice: Because AI models can make mistakes ("hallucinations"), we give no guarantee as to the accuracy of content or business results.
- Data protection and data use: Your data is not used to train external AI models; anonymised data is used solely for internal optimisation of the Service.
- 99% availability: Target value of 99% as a monthly average in accordance with clause 11.
- Analytics: XHANA shows you the performance figures for your LinkedIn posts. The figures come from LinkedIn via the official Community API.
1. Scope and contracting parties
1.1 These Terms and Conditions (AGB) apply to all contracts for the use of the service "XHANA" (hereinafter the "Service") between XHAUER Media GmbH, Stephansplatz 8/20, 1010 Vienna, Austria, company register number FN 571965 a (hereinafter the "Provider"), and its customers.
1.2 The Service is intended exclusively for businesses (Unternehmer) within the meaning of § 1 UGB (Austrian Commercial Code) or § 1 Abs. 1 Z 1 KSchG (Austrian Consumer Protection Act) that use the Service in the course of their professional or commercial activity. Concluding a contract with consumers within the meaning of § 1 Abs. 1 Z 2 KSchG is expressly excluded. On concluding the contract, the Customer confirms that it is acting as a business in the course of its business operations.
1.3 Conflicting or deviating terms of the Customer shall not apply unless the Provider expressly agrees to them in writing.
2. Description of the Service
2.1 XHANA is an AI-assisted service for creating and publishing LinkedIn posts. The Customer sends content (voice messages, texts, images, documents) via WhatsApp; using AI systems, the Service creates draft posts from this content and, after approval by the Customer (clause 5), publishes them on the Customer's LinkedIn profile via the official LinkedIn interface.
2.2 To create content, the Service uses generative AI models from external providers (currently: Anthropic PBC and OpenAI OpCo, LLC or – for customers in the EEA – OpenAI Ireland Ltd, or their respective contracting entities; in each case via their business-customer interfaces). The Provider is entitled to change the models and model providers used, provided that this does not materially impair the scope of the Service. Changes of sub-processors are governed by the Data Processing Agreement (clause 10).
2.3 The Service further includes: the creation and maintenance of a customer profile for personalising the content ("Second Brain"), proactive suggestions for topics and questions, a web application for planning and managing posts, and the analysis of the performance of the Customer's LinkedIn posts (clause 4.4).
2.4 When interacting via WhatsApp, the Customer communicates with an AI system. The Provider points this out at the start of use.
2.5 The Customer is prohibited from transmitting special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. health data, political opinions, religious beliefs or trade union membership) to the Service via WhatsApp, texts, documents or voice messages. The Customer shall fully indemnify the Provider against all third-party claims, regulatory fines and legal representation costs resulting from a breach of this prohibition.
2.6 The Provider offers the Service in different service tiers (plans), which may differ in their functional scope; the respective scope is set out in the service description in the ordering process or in the Provider's current plan overview. The Provider may also offer free service tiers. The Provider may change the functional scope of free service tiers at any time or discontinue them with reasonable notice; for ongoing paid plans, the scope of services agreed at the time of booking remains unaffected by the introduction, modification or discontinuation of other service tiers; otherwise, clause 13 applies.
3. Conclusion of contract, trial period, free use
3.1 The contract is concluded in one of the following ways:
a) Trial period / free use: by the Customer registering for the free trial period. This concludes a free-of-charge contract of use – for the duration of the trial period with the trial scope stated in the plan overview and, where the Provider offers this, subsequently continued in a free basic service tier (clause 2.6); or
b) Paid plan: by booking a paid plan – following the trial period or free use, or directly – by completing the ordering process.
3.2 These Terms, including Annex 1, apply in full from the first day of use – including during the trial period and any free use. If the Provider does not offer a free basic service tier following the trial period, access ends automatically when the trial period expires unless the Customer switches to a paid plan; clause 9.4 (data deletion) applies accordingly.
3.3 In the case of permanently free use, the Provider is entitled to terminate the contract if the Customer has not used the Service for more than 3 months; the termination shall be announced in text form at least 7 days in advance. After the end of the contract, clause 9.4 (data deletion) applies.
4. Third-party services, platform requirements
4.1 Use of the Service requires that the Customer has its own LinkedIn profile and its own WhatsApp access and grants the Provider the authorisations required for publication and analysis (LinkedIn OAuth authorisation). The Customer's contractual relationships with LinkedIn and Meta/WhatsApp remain unaffected; the Customer is itself responsible for complying with their terms of use.
4.2 The Provider publishes posts exclusively via the platforms' official interfaces and only after approval by the Customer. The Customer authorises the Provider to publish approved posts in the Customer's name and on the Customer's profile.
4.3 The Provider is not liable for temporary interruptions, service restrictions or throttling (rate limits) resulting from restrictions, rule changes or technical failures of these third-party platforms, unless the Provider caused them intentionally or through gross negligence. Claims of the Customer for damages or price reduction are excluded to that extent.
4.4 Once the Analytics function has been activated and the necessary authorisations have been granted in the LinkedIn OAuth process, the Provider regularly retrieves performance data on the Customer's posts and profile via the official LinkedIn interface (in particular impressions, members reached, reactions, comments, reposts, saves, sends, link clicks, and changes in the follower count over time), and stores and analyses this data for the Customer. The results are made available to the Customer and its users authorised for this purpose in the web application. A weekly report via WhatsApp and the AI-assisted drafting of reports and optimisation suggestions are provided only insofar as the processing and transmission of the respective data required for this are permitted under the applicable LinkedIn terms. Otherwise, the results are made available in the web application; a WhatsApp message may point to the report available there. Concerning other LinkedIn members, this Analytics function retrieves exclusively aggregated numerical values, and no content of comments or messages and no profile data. Clause 10 in conjunction with Annex 1 applies to the engagement of sub-processors.
a) The performance data is provided by LinkedIn; according to LinkedIn's own statement, it provides the data on a best-effort basis and with a time delay (usually 24 to 48 hours). The Provider gives no warranty for the completeness, accuracy, timeliness or constant availability of this data.
b) If LinkedIn changes the scope, terms or availability of the interface or discontinues it, the Provider may adjust the scope of the Analytics function accordingly or discontinue it; clause 4.3 applies accordingly.
c) The performance data and reports derived from it are processed exclusively to provide the Analytics service to the Customer. The processing required for this by the sub-processors listed in Annex 1 is permitted under the conditions set out there and only to the extent permitted under the applicable LinkedIn terms. Any further disclosure or use for third parties' own purposes is not permitted. A general export function is not owed. Contractual restrictions on the output or disclosure of individual data categories leave mandatory statutory rights unaffected, in particular data subject rights and the right to choose to have the data returned under Art. 28(3)(g) GDPR. Section 10.1 of Annex 1 applies to return and deletion.
d) If the Customer revokes the access authorisations required for this or requests deletion of the performance data, or if the contract of use ends, the Provider ceases further retrieval and ongoing analysis of the performance data concerned. A revocation declared at LinkedIn is detected at the next automated retrieval (usually within one day); from detection, no further retrievals or analyses take place. Section 10.1 of Annex 1 applies to the deletion of the stored performance data, of reports and analyses derived from it and of existing copies, and to any request for return. Any later use of Analytics requires an existing contract of use, reactivation and valid LinkedIn authorisations; data already deleted is not restored as a result.
e) Notes and recommendations derived from the performance data are non-binding; clause 6.1 applies accordingly.
5. Approval procedure and editorial responsibility of the Customer
5.1 The Service does not publish any post without the Customer's prior express approval (in the chat or in the web application).
5.2 The Customer is obliged to review the content of every draft post before approval, in particular for: factual accuracy of statements of fact, figures and references; third-party rights (copyright, trade mark and personality rights); admissibility under competition law and professional rules; and any industry-specific labelling obligations.
5.3 By giving approval, the Customer assumes editorial and legal responsibility for the post in the sense of human review and editorial control. Approvals are logged by the Provider.
5.4 The Customer remains free to edit drafts, request changes or refuse approval. The Customer is under no obligation to give approval.
6. Nature of AI-generated content, rights, confidentiality and AI Act
6.1 Warranty and accuracy of content: AI-generated draft posts are created using probabilistic systems. The Customer is aware that these drafts may contain inaccuracies or misinterpretations ("hallucination effects"). The Provider owes the provision of the Service in accordance with the contractually agreed interfaces and functionalities, but gives no warranty for the accuracy, completeness or legal admissibility of the content of the AI outputs generated, nor for the achievement of particular business results (e.g. reach or engagement targets). Statutory warranty claims regarding the technical functionality of the software-as-a-service platform remain unaffected.
6.2 Rights to AI-generated content (output): To the extent that AI-generated content does not enjoy copyright protection under the Austrian Copyright Act (§§ 1, 2 UrhG) for lack of a sufficient level of human creativity, the Customer may use this content freely and without restriction as to time, territory and subject matter. To the extent that copyrights or related rights of the Provider or the persons engaged to perform its contractual obligations (Erfüllungsgehilfen) nevertheless arise in the content created, the Provider transfers these to the Customer upon approval or grants the Customer an unrestricted, transferable and sublicensable exclusive licence (Werknutzungsrecht under § 24 UrhG) in them. The Provider will not assert any rights of its own in this content against the Customer. No exclusivity vis-à-vis third parties is promised; the Customer acknowledges that third parties may freely use similar or identical AI-generated content. The customer profile ("Second Brain") created in the course of use, and any trade secrets contained in it, remain exclusively within the Customer's sphere of control and legal protection under §§ 26a et seq. of the Austrian Federal Act against Unfair Competition (UWG), in particular § 26b UWG; clause 6.5 applies in addition.
6.3 Rights to content submitted (input): The Customer grants the Provider a non-exclusive, worldwide licence (Werknutzungsbewilligung), limited to the term of the contract and the purposes of the contract, in all content submitted by the Customer (in particular voice messages, texts, images, documents and profile information). It covers reproduction and storage (§ 15 UrhG), transcription, editing and adaptation to create drafts and posts (§ 14 Abs. 2 UrhG), disclosure to the sub-processors and service providers engaged in accordance with the contract, and making available to the public (§ 18a UrhG) — the latter exclusively after the Customer's express approval of the respective post. The Customer warrants that it holds the necessary rights to the content submitted and that no third-party rights conflict with the grant of rights.
6.4 AI model training and protection of customer data: The Provider warrants that the content data transmitted by the Customer and the content generated or stored within the Service, in particular chat histories, audio files, documents, draft posts, other AI outputs and the structured customer profile ("Second Brain"), will not be used to train, fine-tune or improve models of external third parties (e.g. OpenAI or Anthropic). The Provider is, however, entitled to process this content as source material for improving its own Service and for training, fine-tuning and evaluating its own or internally operated models, provided that the content is technically and organisationally prepared in accordance with the following requirements before such use. Personal data may be used for these purposes only after complete and irreversible anonymisation. In addition, direct and indirect references to the Customer as well as customer-specific confidential information and trade secrets are removed, abstracted or transformed to such an extent that they can neither be attributed to a particular customer nor be reconstructed or reproduced as specific customer-specific information from the training data used or the resulting models. Personal data in raw, directly identifiable or merely pseudonymised form are not used for training purposes. To the extent that copyright or other rights of use in the content transmitted by the Customer or generated within the Service are required for the processing steps referred to above, the Customer grants the Provider a non-exclusive licence (Nutzungsbewilligung) limited to this purpose. This covers exclusively the acts necessary for anonymisation, de-identification, abstraction, aggregation and technical preparation, and for the subsequent use of the resulting data for the purposes stated in this clause. Any further use of customer-specific content is not covered. The anonymisation of personal data takes place as the final step of the processing on behalf of the Customer, on the Customer's documented instruction in accordance with Section 2.1 of Annex 1. Only after anonymisation has been completed does the Provider process the resulting anonymous data for the aforementioned own purposes outside the processing on behalf of the Customer and under its own responsibility. The Provider takes appropriate state-of-the-art technical and organisational measures to prevent personal data, trade secrets or other customer-specific confidential information from being extracted or reproduced from the data used or from the models trained on it. It documents the anonymisation, transformation and training methods used, carries out suitable tests for possible extraction or reproduction of personal or customer-specific content before productive use, and regularly reassesses the residual risk. The Customer may object to use under this clause at any time without any formal requirement, in particular by email or via the system settings, with effect for the future (opt-out). The objection covers all content transmitted by the Customer and generated for the Customer, including the customer profile ("Second Brain") and any information about third parties contained in it. From receipt of the objection, no further data of this Customer will be prepared or used for the training and improvement purposes governed by this clause. Data that has already been effectively anonymised and transformed in accordance with the above requirements before then, and that no longer relates to any person or customer, remains unaffected.
6.5 Confidentiality and trade secrets: "Confidential Information" means all information that is not generally known and that one party makes available to the other in connection with the contract, in particular the contents of the customer profile ("Second Brain"), strategy, customer and pricing information, and trade secrets within the meaning of § 26b UWG. This provision applies in addition to the data-protection confidentiality under the Data Processing Agreement (Annex 1) and also covers non-personal information. Both parties undertake to keep the other party's Confidential Information secret, to use it exclusively for performing this contract and to make it accessible only to those employees and service providers (including sub-processors) who need it to provide the services and who are bound to equivalent confidentiality in writing or by law. By way of derogation, the processing of content for the purposes of improving the Provider's own Service and of training, fine-tuning and evaluating its own or internally operated models, as expressly governed by clause 6.4, is permitted, provided that the requirements set out there regarding anonymisation, removal of references to the Customer and protection of confidential information and trade secrets are fully complied with. The use of specific customer-specific confidential information or trade secrets as such for training or improvement purposes is not permitted. Excluded is information that is or becomes publicly known without breach of this provision, was lawfully obtained from third parties, was demonstrably developed independently, or must be disclosed by law or by order of an authority or court; in the latter case, the disclosing party shall inform the other party in advance where legally permissible. At the end of the contract, Confidential Information shall be returned or deleted on request; for personal data, the deletion rules of Annex 1 take precedence. The confidentiality obligation continues for three years after the end of the contract, and for trade secrets within the meaning of § 26b UWG indefinitely for as long as the requirements for such protection are met. This provision also serves as a reasonable secrecy measure within the meaning of § 26b Abs. 1 Z 3 UWG in favour of the Customer.
6.6 Labelling obligations (EU AI Act):
a) The Provider ensures that AI-generated outputs of the Service are marked in a machine-readable format and are detectable as artificially generated or manipulated in accordance with Art. 50(2) of Regulation (EU) 2024/1689 (EU AI Act).
b) With regard to the publication of the content, the Customer acts as a deployer. Under Art. 50(4) of Regulation (EU) 2024/1689, the Customer is obliged to disclose AI-generated text only if it is published with the purpose of informing the public on matters of public interest; this obligation does not apply where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility. The approval procedure under clause 5 constitutes such a process, provided that the Customer actually carries out the review under clause 5.2. Assessing and fulfilling any transparency obligations of its own remains the Customer's responsibility.
c) The Customer must not deliberately remove, suppress or manipulate the machine-readable markings applied by the Provider; ordinary editorial editing of drafts within the scope of clause 5 is not deemed manipulation.
7. Fees, payment processing and reseller relationship
7.1 Commercial payment processing: Paid purchases of the Service are made via Digistore24 as reseller. The purchase contract is concluded between the Customer and the company of the Digistore24 group identified as the seller in the respective order form (by way of example, not exhaustively: Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany). This purchase transaction — including payment processing, invoicing, subscription billing and the unwinding of the purchase transaction, including refunds — is governed by the terms and conditions of the respective Digistore24 company available during the ordering process.
7.2 SaaS service relationship: These Terms govern exclusively the use of the Service (in particular the grant of rights of use, service provision, availability, the Customer's obligations and the Provider's liability as service provider) in the relationship between XHAUER Media GmbH and the Customer. The purchase contract with Digistore24 remains unaffected. Where these Terms and the terms and conditions of the respective Digistore24 company govern the same subject matter, the Digistore24 terms take precedence for the purchase and payment transaction, and these Terms take precedence for the use of the Service. Claims for performance, software-related warranty rights and support requests concerning the functionality of XHANA must be asserted exclusively against the Provider.
8. Obligations of the Customer
8.1 The Customer ensures that the content it transmits (including information about third parties) is lawful and does not infringe any third-party rights. Clause 2.5 applies to special categories of personal data.
8.2 The Customer does not use the Service to create unlawful, misleading or discriminatory content and complies with the terms of use of the platforms (LinkedIn, WhatsApp) and the usage policies of the AI providers.
8.3 The Customer designates the persons who may give approvals on its behalf and ensures that they are familiar with how the Service works and its limitations. The Provider makes information material available for this purpose (Art. 4 EU AI Act — AI literacy).
8.4 The Customer indemnifies the Provider against all third-party claims arising from the publication of posts approved by the Customer or from unlawful content transmitted by the Customer, including reasonable costs of legal defence, unless the Customer is not responsible for the infringement.
9. Term, termination, consequences of termination
9.1 The contract is concluded for an indefinite period. Ordinary termination of a paid plan takes place exclusively via the Digistore24 subscription management (clause 7); access to the paid scope of services continues until the end of the billing period already paid for. If the Provider offers a free basic service tier (clause 2.6), the contract is subsequently continued in that tier; otherwise it ends when the billing period expires. If termination via Digistore24 is not possible for reasons for which the Customer is not responsible, text form exceptionally suffices (clause 9.3).
9.2 The right to extraordinary termination for good cause remains unaffected. Good cause for the Provider exists in particular if the Customer repeatedly breaches clause 5 or 8.
9.3 Any other termination of the contract of use — in particular during the trial period, during free use and after continuation in the basic service tier — is effected by notice of termination in text form (e.g. email to team@xhauer.com). Notices of termination by the Provider are likewise given in text form.
9.4 After the end of the contract (including the end of a trial period without a change of plan and termination of free use under clause 3.3), the Provider deletes or returns the personal data processed on behalf of the Customer in accordance with the Data Processing Agreement (Annex 1) within 90 days, unless statutory retention obligations prevent this. Posts already published on the Customer's LinkedIn profile remain unaffected by the termination.
10. Data protection
10.1 Where the Provider processes personal data on behalf of the Customer in providing the Service, this is done on the basis of the Data Processing Agreement pursuant to Art. 28 GDPR (Annex 1). This includes in particular transmitted messages, voice recordings, images, the customer profile and any third-party data contained therein and, where the Analytics function is activated, the performance data constituting personal data retrieved via the LinkedIn interface, its analysis and the reports produced from it.
10.2 The Provider engages sub-processors to provide the services, including providers that process data in third countries (in particular the USA). For Analytics, this includes, insofar as permitted under clause 4.4, the storage and processing of performance data, the AI-assisted drafting of reports and optimisation suggestions, and the transmission of reports via WhatsApp. The sub-processors, their respective tasks and the transfer mechanisms (EU-US Data Privacy Framework or EU standard contractual clauses) are set out in Annex 1. In each case, only the data required for the task in question is processed.
10.3 As controller, the Customer is responsible for the lawfulness of the processing carried out on its behalf. This applies both to the data it transmits and to the performance data constituting personal data retrieved via LinkedIn at its instigation. In particular, the Customer ensures that there is an appropriate legal basis, that the required information obligations towards data subjects are fulfilled and that it is entitled to connect the LinkedIn profiles concerned. The technical OAuth authorisation replaces neither this assessment nor any consent that may be required under data protection law. The Provider's own statutory and contractual obligations remain unaffected.
11. Availability, support
11.1 The Provider provides the Service with an availability of 99% per calendar month (target value). Availability is calculated as follows: (total minutes in the calendar month − countable downtime minutes) ÷ total minutes × 100. The measuring point is the point at which the Service is handed over to the public internet at the exit of the hosting infrastructure used by the Provider. The Service is "available" if its essential functions (login and core functionality) are technically usable at the measuring point. The following do not count as downtime: (a) announced maintenance windows under clause 11.2, (b) disruptions outside the Provider's area of responsibility (in particular general internet and network disruptions, disruptions of third-party platforms under clause 4.3, and the Customer's systems and connection), (c) force majeure and (d) interruptions for which the Customer is responsible.
11.2 Planned maintenance is announced at least 48 hours in advance in text form or within the Service and, where possible, carried out outside normal business hours (CET/CEST); announced maintenance is limited to 8 hours per calendar month. Maintenance exceeding this limit or unannounced maintenance counts as downtime; this does not apply to urgent emergency maintenance to avert security risks.
11.3 The Customer sends support requests by email to team@xhauer.com. The Provider answers requests within a reasonable time during normal business hours (Mon–Fri, 9 am–5 pm). There is no entitlement to specific response or resolution times.
12. Liability
12.1 The Provider has unlimited liability for intent and gross negligence.
12.2 In the case of slight negligence, the Provider is liable only for breach of material contractual obligations (obligations whose fulfilment is essential to the proper performance of the contract and on whose observance the Customer may regularly rely), limited to the foreseeable damage typical for this type of contract, but in any event to no more than the fees paid in the last 12 months.
12.3 The Provider is not liable for damage resulting from the publication of posts that the Customer approved in breach of its review and approval obligations (clause 5), nor for the accuracy of the content of AI-generated drafts (clause 6.1), unless the Provider is guilty of intent or gross negligence.
12.4 The limitations of liability in this clause do not apply to intent and gross negligence, to injury to life, body or health, to claims under the PHG (Austrian Product Liability Act) or to other cases of mandatory statutory liability. Claims of data subjects under Art. 82 GDPR and the powers of supervisory authorities are not limited by these Terms; to that extent, the liability provisions concern exclusively the internal relationship between the parties.
13. Amendments to these Terms
13.1 The Provider may amend these Terms with effect for the future insofar as the amendment is necessary (a) due to changes in legislation or case law, (b) due to changed terms of the platform or AI providers, or (c) for technical or organisational reasons, and does not shift the contractual balance between performance and consideration to the Customer's detriment.
13.2 Amendments are announced to the Customer in text form at least four weeks before they take effect. If the Customer does not object within this period, the amendments are deemed approved; the announcement will point this out. If the Customer objects, either party is entitled to terminate the contract with effect from the date on which the amendment takes effect. The deemed consent under the second sentence does not apply to material amendments, in particular not to restrictions of the core services of a booked paid plan, the introduction or increase of fees, changes to the liability provisions (clause 12), changes to this amendment clause itself, or amendments to the Data Processing Agreement (Annex 1) that are detrimental to the Customer; such amendments require the Customer's express consent in text form — if the Customer does not give it, the contract continues unchanged, without prejudice to both parties' right of termination under the third sentence. For free service tiers, clause 2.6 remains unaffected.
14. Final provisions
14.1 The laws of the Republic of Austria apply, excluding the UN Convention on Contracts for the International Sale of Goods (CISG) and conflict-of-laws rules.
14.2 The courts of Vienna shall have exclusive jurisdiction for all disputes arising out of or in connection with this contract, provided that the Customer is a business.
14.3 Should individual provisions of these Terms be or become invalid, the validity of the remaining provisions remains unaffected.
Annexes
Annex 1: Data Processing Agreement (DPA) pursuant to Art. 28 GDPR