SurfBuddy LogoSurfBuddy Logo

Terms of Service

Last updated: November 9, 2025

These Terms of Service (the "Terms") are a legal agreement between R28 Inc., a Delaware corporation ("R28," "we," "us," or "our"), and the person or entity accessing or using the SurfBuddy application provided by R28 (the "Service"). By accessing or using the Service, you agree to these Terms. Please also review our Privacy Policy, which explains how we collect, use, disclose, and process personal data.

If you use developer tools, SDKs, or APIs available on r28.ai, separate Developer/API Terms may apply and govern those features. In the event of conflict, those terms control for the features they cover.

If you are entering into these Terms on behalf of an entity, you represent that you have authority to bind that entity, and “you” or “Customer” refers to that entity. If you are using the Service under a separate master agreement with R28 (e.g., an enterprise MSA), that agreement controls to the extent of conflict.

1. The Service; Summary of Functionality

1.1 What SurfBuddy Does. SurfBuddy is an AI assistant/chat application. You can:

  • Send prompts and messages;
  • Mention connected apps with @ (e.g., @gmail) and trigger tools with / (e.g., /events_insert);
  • Attach images and paste links for server-side validation/enrichment.

A “Supervisor” model routes tasks to worker agents (e.g., email/calendar/docs/sheets integrations, weather lookups, transcript summarization via a first-party fetcher), and may invoke vision features when you provide images. We may substitute models to manage cost/latency while preserving functionality.

1.2 Integrations You Authorize. You may connect third-party accounts via OAuth. When connected, you instruct us to access and process data from those services only to perform actions you request (e.g., read a thread, draft/send an email, list/create calendar events, read/update documents, read/append spreadsheets). Your use of each integration is also governed by that provider’s terms and privacy policy. You may disconnect at any time; related features will stop working.

1.3 Processors & Hosting. The Service is operated on third-party cloud infrastructure and may rely on service providers for identity, storage, payments, AI inference, observability, and other operational functions (collectively, “Service Providers”). We may change Service Providers over time. We share personal data with Service Providers only as needed to operate, secure, and support the Service, as described in the Privacy Policy.

1.4 Server-Side Fetching. When our servers validate links, the target site sees our server IP, not yours.

2. Eligibility and Accounts

2.1 Eligibility. You must be at least the age of majority where you live (and in any case not under 13, or under 16 where applicable law requires) and capable of forming a binding contract.

2.2 Account Registration. Access requires an account authenticated via our identity provider. You must keep your credentials secure and promptly notify us of any breach or unauthorized use. You are responsible for all activities under your account.

2.3 Entity Users. If you register with a work email or under a company plan, you represent that you are authorized and that your employer or organization is our Customer.

3. Your Content, Outputs, and Rights

3.1 Definitions.

  • “Inputs” means content you provide (text, prompts, images, links) and any context you configure.
  • “Outputs” means content returned by the Service (including model/tool responses, drafts, summaries, transformations).
  • “Content” means Inputs and Outputs together.
  • “Usage Data” means telemetry about how the Service is used (e.g., request timing, feature flags, rate-limit events, device metadata), excluding Content.

3.2 Ownership. As between you and R28, you own your Inputs. To the extent permitted by law, we assign to you our rights in Outputs generated for your Inputs, subject to (i) these Terms, (ii) any third-party rights/providers’ terms, and (iii) the understanding that similar outputs may be generated for others. You remain responsible for ensuring your use of Outputs complies with applicable law and third-party rights.

3.3 License to Operate the Service. You grant R28 a worldwide, non-exclusive, royalty-free license to host, cache, process, transmit, display, and create derivative works of your Content as necessary to provide and secure the Service, including to:

  • Stream, store, and retrieve conversations;
  • Validate and enrich links;
  • Transmit Inputs, attachments, tool outputs, and relevant context to AI inference providers and integrations you invoke;
  • Generate conversation titles and maintain metadata;
  • Enforce Terms, comply with law, and protect the Service and users.

3.4 Model Training. R28 does not train first-party models on your Content under the current codebase. Third-party AI inference providers receive Content you cause to be sent for inference and handle it under their own terms. Where configurable, we endeavor to disable provider training/retention, but providers’ policies govern. See our Privacy Policy for details and any opt-outs.

3.5 Limits of Outputs. Outputs are generated automatically and may be inaccurate, incomplete, or inappropriate. You must evaluate Outputs and are solely responsible for decisions or actions based on them. The Service is not professional advice.

4. Use of the Service

4.1 Acceptable Use (Examples). You will not:

  • Violate laws or others’ rights (IP, privacy, publicity);
  • Upload or link malware, exploits, or illegal content;
  • Probe, scan, or test the Service or others’ systems;
  • Attempt to extract or steal models or weights, or use the Service to build/train a competing model or service;
  • Circumvent rate limits, quotas, or security controls;
  • Harvest/scrape data except via documented APIs and only as permitted;
  • Misuse integrations or exceed scopes you authorized;
  • Use in high-risk scenarios where errors could cause death, personal injury, or severe harm.

4.2 Uploads & Links. The Service may sanitize and optimize image uploads and apply size/type limits before storage. For links, we may validate the URL, check headers/size, and extract titles or icons; certain file types may be blocked for safety.

4.3 Rate Limits & Fair Use. We apply configurable request and quota limits (e.g., streaming, uploads, link validation). Exceeding limits may throttle or block requests, or result in suspension.

4.4 Security Responsibilities. We implement industry-standard administrative, technical, and organizational safeguards appropriate to the nature of the data we process. You remain responsible for securing your devices, networks, and accounts, testing Outputs before use, and complying with organizational policies.

4.5 Sensitive Data. Do not submit data subject to specialized regimes (e.g., HIPAA, GLBA, PCI) unless we expressly agree in writing. You represent you have all rights and consents necessary for your Inputs and connected accounts.

5. Plans, Fees, and Taxes

5.1 Paid Features. Some features require a paid plan via a third-party payment processor. Fees, plan descriptions, and billing cadence are shown at purchase.

5.2 Auto-Renewal. Subscriptions renew automatically for successive periods unless you cancel through the Billing Portal or as otherwise provided. Cancel at least 24 hours before renewal to avoid the next charge.

5.3 Changes. We may change prices or plan features prospectively with notice where required. Taxes are extra and your responsibility (except taxes on our net income).

5.4 Non-Refundable. Except where required by law or explicitly stated, fees are non-refundable and partially used periods are not prorated. If we terminate without cause, we will refund prepaid, unused fees pro-rata.

5.5 Delinquency. We may suspend the Service for unpaid amounts and charge reasonable late fees/interest permitted by law.

6. Third-Party Services & Providers

6.1 Integrations You Choose. When you connect third-party services, your use is governed by those providers’ terms. We are not responsible for their products or acts/omissions. Disconnecting may delete tokens and disable related features.

6.2 AI Inference. When you use AI features, we transmit relevant Inputs and context to third-party AI inference providers to generate Outputs. We may substitute models or providers to maintain reliability and manage cost while preserving functionality. Provider-specific data handling is described in the Privacy Policy.

6.3 Third-Party Policies. Certain providers impose additional privacy or platform requirements. We use and share data obtained via such integrations only to provide user-facing features you request, do not sell it, do not use it for ads, and only share as necessary to provide the Service and as disclosed in the Privacy Policy.

6.4 Google API Services — Limited Use. We access Google user data only to provide user-facing features you request (e.g., read selected threads, draft/send email, list/create calendar events, read/update documents, read/append spreadsheets).

  • No ads or model training. We do not use Google user data for advertising and do not retain or use Google user data to develop, improve, or train generalized AI/ML models.
  • Processor-only disclosure. We do not sell Google user data. We disclose Google user data only to our service providers acting as processors under written agreements and only as necessary to operate the Service and subject to confidentiality; they may not use it for their own purposes.
  • No human review (by default). We do not allow human review of Google user data, except with your explicit consent, to comply with law, or for security/abuse investigations.
  • User control. You can disconnect at any time in the Service and via your Google Account permissions; upon disconnection, tokens are revoked.
  • Data handling. Access is scoped to the permissions you grant; data is stored only as needed to provide the requested feature and deleted in accordance with our retention policy.
  • Compliance. Our handling of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

7. Beta, Preview & Experimental Features

Features labeled alpha/beta/preview may be unstable, changed, or discontinued at any time, may lack support, and are provided “as is.” Use at your own risk.

8. Privacy; Data Location; Retention

8.1 Privacy Policy. Our Privacy Policy is incorporated by reference and describes categories of personal data, purposes, legal bases, sharing, retention, and your choices/controls.

8.2 Location & Transfers. Primary hosting occurs in the United States. Service Providers may process data globally per their policies. By using the Service, you consent to international transfers subject to appropriate safeguards (e.g., SCCs), as described in the Privacy Policy.

8.3 Retention & Deletion. Conversations and uploads persist until you delete them or close your account, subject to reasonable backup, security, legal, and billing record retention. Hard-delete may be available; some data may remain in backups for a limited period.

9. Ownership; Licenses; Feedback

9.1 R28 IP. We and our licensors own the Service, software, documentation, selection/orchestration logic, and branding. No rights are granted except as expressly stated.

9.2 License to You. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service for personal or internal purposes.

9.3 Feedback. If you provide ideas or suggestions, you grant us a perpetual, irrevocable, worldwide, royalty-free license to use them without restriction.

10. Suspension; Termination

10.1 By You. You may stop using the Service at any time and can cancel subscriptions in the Billing Portal.

10.2 By Us. We may immediately suspend or terminate your access for violations of these Terms, security risks, non-payment, requests by licensors/providers, or if we discontinue the Service. We will provide required notices where applicable.

10.3 Effect. Upon termination, your license ends and you must stop using the Service. Sections intended to survive (including 3–6, 8–17) will survive. We may delete your Content after termination, subject to backup/retention obligations.

11. Confidentiality

Each party may receive Confidential Information of the other. The receiving party will use it only to perform these Terms, protect it with reasonable care, and disclose it only to personnel/agents under similar obligations or as required by law.

12. Disclaimers

THE SERVICE AND ALL OUTPUTS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, AND QUIET ENJOYMENT. WE DO NOT WARRANT THAT THE SERVICE OR OUTPUTS WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE.

Consumer rights notice. Some jurisdictions (including the UK, EU, and Australia) provide non-excludable statutory rights/guarantees. Nothing here limits rights that cannot be limited by law.

13. Indemnities

13.1 Your Indemnity. You will defend and indemnify R28 and its affiliates, officers, employees, and agents from third-party claims, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising from: (a) your Content; (b) your use of the Service (including Outputs and integrations you invoke); (c) your violation of these Terms or law.

13.2 Our IP Indemnity. We will defend and indemnify you from third-party claims alleging that the Service, when used as permitted, directly infringes U.S. copyrights, trademarks, or trade secrets. We may, at our option: (i) procure rights; (ii) modify/replace the Service; or (iii) terminate access and refund prepaid fees for the remaining term. This obligation does not apply to claims arising from your Content, combinations not provided by us, or use contrary to documentation.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, R28 AND ITS AFFILIATES, OFFICERS, EMPLOYEES, AGENTS, SUPPLIERS, AND LICENSORS SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING FROM OR RELATED TO THE SERVICE OR OUTPUTS, EVEN IF ADVISED OF THE POSSIBILITY.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR AGGREGATE LIABILITY FOR ALL CLAIMS SHALL NOT EXCEED THE GREATER OF (A) USD $100 OR (B) THE AMOUNTS YOU PAID TO R28 FOR THE SERVICE IN THE SIX (6) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. The foregoing limits do not apply where prohibited by law.

15. Dispute Resolution; Governing Law; Arbitration

15.1 Governing Law & Venue. These Terms are governed by the laws of the State of Delaware, excluding its conflict-of-laws rules. Subject to arbitration below, the parties consent to the exclusive jurisdiction of state and federal courts in Delaware.

15.2 Arbitration Agreement (U.S. users). You and R28 agree that any dispute or claim arising out of or relating to these Terms or the Service will be resolved by binding arbitration on an individual basis, and class actions are waived. The Federal Arbitration Act governs interpretation and enforcement. Arbitration will be administered by AAA under its Consumer Arbitration Rules (or JAMS Streamlined Rules for business customers), by a single neutral arbitrator. You may opt out within 30 days of first accepting these Terms by emailing legal@r28.ai with your name, the email tied to your account, and a clear statement that you opt out of arbitration. If you opt out, or if arbitration is found unenforceable, disputes will be heard in Delaware courts.

15.3 Informal Resolution. Before filing, you agree to email legal@r28.ai with a Notice of Dispute and attempt in good faith to resolve within 60 days.

15.4 Confidentiality. Arbitration proceedings and awards are confidential, to the extent allowed by law.

16. Export; Sanctions; Anti-Abuse

You must comply with export, sanctions, and trade laws. You represent you are not on a prohibited-party list and will not use the Service in embargoed regions or for prohibited end uses. You will not use the Service for spam, fraud, or deceptive practices.

17. Changes; Assignment; Miscellaneous

17.1 Changes to the Service. We may modify or discontinue features (including beta) with notice where required. Retain copies of critical Content; you are responsible for backing up your Content.

17.2 Changes to these Terms. We may update these Terms from time to time. Material changes will be notified by updating the date above and, where required, via additional notice. If you continue to use the Service after changes take effect, you accept the updated Terms.

17.3 Assignment. You may not assign these Terms without our prior written consent, except to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets. We may assign without restriction.

17.4 Publicity. We may identify you (name/logo) as a customer in marketing materials, subject to your reasonable brand guidelines. You can opt out by emailing legal@r28.ai.

17.5 Severability; Waiver. If any provision is unenforceable, it will be modified to achieve its intent or severed, and the remainder will remain in effect. A failure to enforce is not a waiver.

17.6 Notices. Legal notices to R28 must be sent to legal@r28.ai and to our registered office (see Contact). We may provide notices via the Service, email, or your account.

17.7 Entire Agreement. These Terms, the Privacy Policy, and any Order Forms constitute the entire agreement and supersede prior agreements on the Service’s subject matter. No conflicting purchase-order terms apply.

17.8 Copyright / DMCA Notices. If you believe material available through the Service infringes your copyright, you may submit a notice to legal@r28.ai containing:

  1. Your physical or electronic signature;
  2. Identification of the copyrighted work you claim has been infringed;
  3. Identification of the material you claim is infringing, with enough detail for us to locate it;
  4. Your contact information;
  5. A good-faith statement that the use is not authorized by the copyright owner, its agent, or the law;
  6. A statement that the information provided is accurate and, under penalty of perjury, that you are authorized to act on behalf of the copyright owner.

We may remove or disable access to material alleged to be infringing and may terminate accounts of repeat infringers.

18. Contact Information

For general support, account issues, cancellations, billing, or questions about using the Service, contact us at support@r28.ai.

For questions about these Terms, privacy or compliance matters, or to submit copyright infringement notices or arbitration notices, contact legal@r28.ai.

R28 Inc. is the entity responsible for the Service. Written legal notices may also be sent to the mailing address listed above.