Maintained under the Freshness Protocol. Update trigger: any change to the T&C scope, posture, or product surfaces; supersession by an attorney-reviewed version. Last updated: 2026-07-11 (interim v2.5 pointer fix, Jan-GO "G3": the retired standalone /subprocessors page is replaced by the recipients overview in Privacy Policy §12 — 7 pointer spots updated (§1.3(b), §8.4, §12.1 note, §12.2(a), §19.1(c), §19.5, §19.6 bracket note). No material term changed, no re-accept triggered; registry stays v2.5-interim-2026-07-06. ATTORNEY NOTE: verify that publishing the sub-processor list inside the Privacy Policy satisfies the §305(2) BGB accessibility framing used in §8.4/§12.1.) Prior: 2026-07-06 (interim v2.5: Edit tool added to §6.1(1) + Edit credit-quote transparency §13.2(e); registry v2.5-interim-2026-07-06) Status: DRAFT v2.3-draft — NOT LEGAL ADVICE — REQUIRES GERMAN/EU ATTORNEY + INSURER REVIEW BEFORE PUBLICATION. Generated: v2.2 integration merge, 2026-06-09 — single coherent text merging TERMS_OF_SERVICE_DRAFT.md (24-section master) + TERMS_v2.1_REVISIONS.md (Jan's 7 locked decisions, see DECISIONS_LOCKED.md), with the red-team worklists ANALYSIS_10_v2.1-redteam-findings.md and ANALYSIS_11_20-persona-attack.md applied. The two-layer master/revisions structure is resolved; there is no separate "revisions" layer to read alongside this text. v2.3 surgical pass, 2026-06-10 — post-attorney-glance updates keyed to PLATFORM_CAPABILITY_MAP.md (fully synthetic humans as the platform's structural default; scraper reality) and to N.Y. S.8420 (synthetic-performer disclosure, eff. 2026-06-09) / S.8882 (deceased-personality digital replicas). Every change is itemized in V2.3_CHANGE_LOG.md and must be surfaced to the attorney at the next touchpoint.

GHOST CREATIVE — TERMS & CONDITIONS

⚠️ NOT LEGAL ADVICE — DRAFT FOR ATTORNEY REVIEW

This document is a working draft prepared for review by a qualified German/EU lawyer and the operator's liability insurer. It is not final legal advice and must not be published or relied upon as binding terms until (a) every [BRACKETED] fill-in is resolved, (b) a precise, non-machine-translated binding German version is produced (plus the Spanish (es-MX) and French (Québec) versions required by Section 24.10), and (c) an attorney has confirmed each statutory citation and the liability-cap level against actual insurance coverage. Italic lines marked "In short" are non-binding plain-language summaries; the numbered clauses are the binding text. Square-bracketed [OPERATOR NOTE: …] blocks are drafting/operations notes, not contract text, and are removed before publication.

Version: v2.2 · Effective date: 15 June 2026 · Master language: English (binding-language rule: Sections 1.7 and 24.10)

TABLE OF CONTENTS

1. Preamble, Parties & Scope of Application
2. Definitions
3. Acceptance & Incorporation of Terms
4. Eligibility, Age & Account Types
5. Account Registration, Security & Responsibility
6. Description of the Service & No Guarantee of Results
7. License to Use the Service
8. User Content: License Grant to Ghost, Service Improvement & AI Training
9. User Warranties on Uploads, including "Winner" Uploads (Image / IP / Personality Rights)
10. AI Output — Ownership & Rights Granted to You
11. Acceptable Use Policy (Prohibited Content & Conduct)
12. Third-Party Services & Flow-Down Terms
13. Credits, Pricing & Payment
14. Subscriptions, Renewal & Cancellation
15. Withdrawal (Widerruf), Cancellation Button & Credits
16. Warranties & Statutory Rights (Gewährleistung)
17. Limitation of Liability
18. Indemnification by You
19. Data Protection
20. AI Transparency, Synthetic-Content Labelling & Provenance
21. Public Gift Links & Sharing
22. Term, Suspension & Termination
23. Changes to These Terms
24. Final Provisions

Market addenda (incorporated per Section 24, applying by your market): USA Addendum · Mexico Addendum · Canada Addendum.

SECTION 1 — PREAMBLE, PARTIES & SCOPE OF APPLICATION

In short — Section 1: You are contracting with Jan Stoltenberg personally, trading as "Ghost Creative" in Germany, for an AI marketing-content tool that is open to consumers and businesses alike. These Terms plus the linked policies govern all use; you accept only by an explicit click, never by merely using the site. If you are a consumer, you keep every mandatory protection the law gives you; genuine businesses get an additional "ratchet" of stronger terms. If the business is later transferred to a successor company, you get six weeks' notice and an unconditional right to leave with a pro-rata refund. The version of the Terms in the language you actually saw and accepted is the one that binds you.

1.1 Provider; Parties to the Agreement

(a) These Terms of Service (the "Terms" or "Agreement") govern the contractual relationship between Jan Stoltenberg, a German sole proprietor (Einzelunternehmer) trading under the business designation "Ghost Creative" (a business name, not a corporation; no separate legal entity; no commercial-register entry), with a service address for legal notices (ladungsfähige Anschrift) at Lerchenhöhe 38, 22359 Hamburg, Germany, reachable at [legal@ghostcreative.ai — interim: jan.stoltenberg@t-online.de] (the "Provider," "Ghost Creative," "we," "us," or "our"); and the natural or legal person who registers for, accesses, or uses the Service (the "Customer," "you," or "your").

(b) The full statutory provider identification, VAT status, supervisory information and editorially responsible person are set out in our Impressum at [https://ghostcreative.ai/impressum], which forms part of the information made available to you and prevails over this Section 1.1 in the event of any discrepancy as to provider identity or contact details.

(c) Authority to bind an organization. If you accept these Terms on behalf of a company, agency, or other organization, you warrant that you are authorized to bind that organization, and "you"/"Customer" then means that organization. The individual accepting and the organization are jointly responsible for performance.

1.2 What the Service Is

(a) Ghost Creative operates a hosted software-as-a-service platform at https://ghostcreative.ai that enables Customers to create AI-generated marketing media — including images, multi-image carousels, "stories," and short-form videos — from a brand profile and from reference material the Customer supplies, and to manage, download, and optionally share that media (the "Service").

(b) The Service is provided solely as a creative-production tool. Generation is performed by independent third-party AI model providers (currently fal.ai and, via fal.ai, ByteDance Seedance/Seedream; OpenAI; and Anthropic), whose role, location, and risk allocation are addressed in Section 12 and in the Sub-processor List. The functional characteristics, the probabilistic nature of AI Outputs, and the absence of any warranted generation result are described in Section 6 and are an agreed part of the Service's Beschaffenheit (agreed quality), not a waiver of statutory rights.

1.3 Scope of Application; These Terms Govern All Use

(a) These Terms apply to every access to and use of the Service, in every version and on every plan (free, trial, prepaid-credit, and subscription), and to all features, application programming interfaces, and Customer communications relating to the Service.

(b) Incorporated documents. The following form an integral part of this Agreement and are incorporated by reference; you accept them together with these Terms: the Acceptable Use Policy [link]; the Privacy Policy (https://ghostcreative.ai/privacy) and, where applicable, the Data Processing Addendum [link]; the Biometric Privacy Notice [link]; the AI Transparency Notice [link]; the Cookie Policy (https://ghostcreative.ai/cookies); the Sub-processor List (published within the Privacy Policy, Section 12 — https://ghostcreative.ai/privacy); the DMCA Policy [link]; and the market addendum applicable to you under Section 24 (USA Addendum, Mexico Addendum, or Canada Addendum) [links]. Each listed document is made available to you at or before the acceptance control in a form you can read, save and reproduce (Section 3.3(c)); a document not actually accessible at its stated URL at the time of your acceptance is not incorporated (Section 3.2). Only the documents expressly listed in this Section 1.3(b) are incorporated. Other descriptive material on our website — for example feature pages, blog posts, help-center articles, or a "security overview" page — is provided for information only and is not incorporated into these Terms; a hyperlink from an incorporated document does not by itself incorporate the linked page. In the event of a conflict, the order of precedence on a given subject matter is: (1) any individually negotiated written agreement signed by the Provider; (2) the Data Processing Addendum (for the processing of personal data); (3) these Terms; (4) the policies and addenda listed above.

(c) No conflicting customer terms. Your own general terms and conditions, purchase-order terms, or other standard business terms do not apply and are hereby rejected, even if we do not expressly object to them and even if we perform without reservation after receiving them. They become part of the contract only if we have expressly agreed to them in writing.

(d) Acceptance. You accept this Agreement by clicking "I agree" (or an equivalent affirmative control) before creating an account or completing a purchase, whichever happens first. Acceptance is a deliberate, affirmative act: no acceptance control is pre-ticked, and neither browsing our website nor mere continued use of the Service is treated as acceptance (Section 3.3). Where a feature requires it (e.g., a purchase, an upload of personal images, or the creation of a public gift link), additional separate consents are presented and must be given at that point; nothing in this Section 1 replaces those feature-specific consents.

1.4 Who the Service Is For — Consumers and Businesses (Everyone Welcome)

(a) Ghost Creative is offered to both consumers (Verbraucher, §13 BGB) and businesses (Unternehmer, §14 BGB). You may use the Service whether you are creating content for a private project, a side venture, a freelance practice, or an established company. We do not operate, and do not purport to operate, a business-only service.

(b) No contracting-out of consumer status. Your legal status as a consumer or an entrepreneur is determined by the actual facts and purpose of your use under §§13 and 14 BGB — not by any label, checkbox, plan name, or price tier. Nothing in these Terms is intended to, and nothing in these Terms shall be read to, deny, convert, waive, or contract you out of consumer status or any mandatory consumer protection. Any provision that attempted to shift onto you the burden of proving your consumer status is expressly disclaimed and would in any event be void (§309 Nr. 12 BGB), and any attempt to circumvent mandatory consumer law through structuring or wording is void (§306a BGB).

(c) Price is not status. Our prices (including higher-tier plans and credit packs) reflect the value and cost of the Service. They are not a representation that you are a business and do not change your statutory status. A consumer who purchases a higher-tier plan remains a consumer with full consumer rights.

(d) Age, legal capacity, account requirements, and the additional terms for genuine business users (the "business ratchet") are set out in Sections 4 and 5.

1.5 What Every Consumer Keeps (Non-Waivable Protections)

Regardless of anything elsewhere in these Terms, if you use the Service as a consumer you keep, in full, every mandatory protection the law gives you. These are not granted by us as a favour and cannot be reduced by these Terms; they include, in particular:

(a) your 14-day right of withdrawal (Widerrufsrecht) and the related information rights, subject only to the lawful loss-of-withdrawal mechanism for immediately-performed digital content with your express prior consent and acknowledgement (Section 15);

(b) your statutory conformity / warranty rights for digital products (§§327 ff. BGB) and, for consumers resident in Mexico, the mandatory rights under the Ley Federal de Protección al Consumidor (LFPC / PROFECO) (Section 16 and the Mexico Addendum);

(c) the one-click cancellation button for contracts concluded online (Kündigungsbutton, §312k BGB), reachable without logging in (Sections 14 and 22.2);

(d) the non-excludable liability the law reserves: liability for injury to life, body, or health and for intent and gross negligence is never excluded or limited (§309 Nr. 7 lit. a/b BGB); liability for the breach of an essential contractual duty (Kardinalpflicht) is never excluded, but for simple negligence it may be limited to the foreseeable damage typical for this type of contract, as set out in Sections 17.3–17.4; liability under the Produkthaftungsgesetz / the EU Product Liability Directive (Directive (EU) 2024/2853) is not excluded or capped (Sections 16.6 and 17) [OPERATOR NOTE: §306 BGB allows no geltungserhaltende Reduktion — an over-broad limitation clause is struck in full and the uncapped statutory default applies. The liability sections must stay calibrated, not maximal. RED-TEAM FIX 2026-06-09: the former "never excluded or capped" wording would have been read contra proferentem (§305c(2)) as overriding the lawful Kardinalpflicht cap in 17.3–17.4 — the consumer-guarantee clause must not destroy the calibrated liability section.];

(e) your data-subject rights under the GDPR (and, for Mexican users, under the LFPDPPP via the aviso de privacidad — see the Mexico Addendum; for Canadian users, under PIPEDA and, in Québec, Law 25 — see the Canada Addendum), which exist independently of these Terms (Section 19);

(f) access to consumer dispute resolution / a Verbraucherschlichtungsstelle to the extent provided by the VSBG (Universalschlichtungsstelle, §§36/37 VSBG) (Section 24.3) ; and

(g) the rule that, for consumers, silence is never treated as acceptance of a material change to these Terms (Sections 3.9 and 23).

No clause of these Terms shall be read to exclude, limit, or condition any of the foregoing. To the extent any clause conflicts with a mandatory consumer protection, that clause yields to the protection and the remainder of these Terms stays in force (§306 BGB).

1.6 Personally Liable Operator; Transfer to a Successor Entity (Rechtsnachfolge / Vertragsübernahme)

(a) Current operator. Ghost Creative is currently operated by Jan Stoltenberg as a German sole proprietor (Einzelunternehmer). There is no separate legal entity; the Provider is personally and without limitation liable for the business.

(b) Transfer of the Agreement. We may transfer this Agreement as a whole, with all rights and obligations under it, to a successor entity that continues the Ghost Creative business, namely: (i) a limited-liability company or corporation formed or co-founded by Jan Stoltenberg under German law (e.g., a UG (haftungsbeschränkt) or GmbH); (ii) a limited-liability company or corporation formed or co-founded by Jan Stoltenberg under the law of another country, including the United States (e.g., a Wyoming limited liability company or a Delaware C-Corporation); or (iii) an acquirer of all or substantially all of the assets of the Ghost Creative business — in each case only if the successor assumes all obligations under this Agreement, your prepaid credits and subscription entitlements carry over in full, and your contractual protections are not reduced.

(c) Advance notice in text form. We will notify you of any transfer under (b) at least six (6) weeks before it takes effect, in text form (§126b BGB) (e.g., e-mail to your account address), stating the successor's name, legal form, country of seat, the effective date, and a restatement of your termination right under (d).

(d) Your unconditional termination right. If you do not wish to continue with the successor — for any reason or no reason, and without any condition — you may terminate this Agreement in text form at any time from receipt of the notice under (c) until four (4) weeks after the transfer takes effect. Termination is effective at the transfer date or, if declared later, immediately. Upon such termination we (or the successor, who remains jointly responsible for this refund) will refund pro-rata all prepaid amounts for services not yet delivered — including unused paid credits and the unused portion of any subscription period — within fourteen (14) days, using the original payment method where possible.

(e) Operation of law. This Section 1.6 does not restrict transfers occurring by universal succession by operation of law (Gesamtrechtsnachfolge, e.g., under the German Transformation Act (UmwG)); your statutory rights in such events remain unaffected. Section 24.6 (assignment) applies subject to this Section 1.6.

[OPERATOR NOTE — what a transfer to a U.S. entity actually triggers (not Terms text; do BEFORE the transfer): (1) a German Einzelunternehmen cannot convert into a US entity under the UmwG — the transfer is a singular-succession asset deal, so 1.6(b)–(d) is the ONLY consent mechanism; plan the 6-week notice campaign operationally. (2) GDPR: the controller changes — the US controller needs an Art. 27 EU representative, refreshed Art. 13/14 privacy notices, re-papered transfer mechanisms (DPF self-certification or SCCs + TIA) and re-executed sub-processor DPAs. (3) Tier-C training opt-ins (own likeness/voice, Section 8.9) were given to controller "Jan Stoltenberg" — at minimum notify + offer objection; conservatively re-obtain consent. (4) German tax (Betriebsstätte of the US entity, Funktionsverlagerung, Stripe re-onboarding as new merchant of record) = Steuerberater Kuhl/Kelhar BEFORE formation. (5) No retroactive shield: all pre-transfer liabilities stay with Jan personally absent befreiende Schuldübernahme (§§414/415 BGB) per creditor.]

1.7 Language and Version Precedence

(a) The authoritative master text of these Terms is maintained in English. Official translations are provided for the markets we serve (German, Mexican Spanish, French); any other language is for convenience only.

(b) Binding version — language actually presented at acceptance. The version in the language actually presented to you at the acceptance control is the version that binds you — determined by the language you contracted in, not by your residence (§305(2), §305c BGB). German binds where we present German; English where we present English; Spanish (es-MX) where we present Mexican Spanish; French where we present French.

(c) Mandatory local-language overrides. Where mandatory local law requires a specific governing language or specific-language disclosures, that requirement prevails to the extent legally required: German for EU-consumer notices, the Impressum and the Widerrufsbelehrung / §312j Button-Lösung; Spanish (es-MX) for Mexico's aviso de privacidad and LFPC/PROFECO disclosures; French for Québec consumers under the Charter of the French Language (as amended by Bill 96) and the Québec Consumer Protection Act, with privacy disclosures additionally governed by Law 25 — for such users we make the French version available at or before the acceptance control. The full rule, including the order of precedence between versions, is in Section 24.10.

(d) Section headings and the italic plain-language summaries are for convenience only; the numbered binding sub-clauses control over the summaries, and any remaining ambiguity in our standard terms is construed against us as drafter (§305c(2) BGB).

SECTION 2 — DEFINITIONS

In short — Section 2: This section just defines the words we use — who counts as a business vs. a consumer (that is decided by the facts, not by a checkbox, and consumers keep their mandatory legal protections no matter what), what your uploads (Input) and the AI results (Output) are, how Credits and Subscriptions work, what a public Gift Link is, and which outside AI companies and data processors we rely on.

2.1 Purpose and use of definitions. The capitalised terms below have the meanings given in this Section wherever they appear in these Terms and in any incorporated document. Headings are for convenience only. Singular includes plural and vice versa; "including" means "including without limitation"; references to a statute include that statute as amended. Where these Terms and an incorporated document conflict on a defined term, the order of precedence in Section 1.3(b) applies. A defined term fixes meaning only; every operative obligation, warranty, licence and limitation is stated in its own substantive Section.

2.2 "Provider", "we", "us", "our" means Jan Stoltenberg, acting as a sole proprietor (Einzelunternehmen) under the business designation "Ghost Creative", with the business address stated in Section 1.1(a) (see the Impressum at https://ghostcreative.ai/impressum).

2.3 "Service" means the Ghost Creative software-as-a-service platform at https://ghostcreative.ai and related sub-domains, including the Profile builder, the AI onboarding assistant, the website-analysis feature, the creative-generation features (images, multi-image carousels, "stories" and videos), the media library and download functions, Gift Links, lead-capture and notification features, and any associated APIs, applications and documentation. The Service is a tool that produces probabilistic AI Output; it does not warrant any particular generation result (see Section 6).

2.4 "User", "you", "your" means the natural or legal person who registers for, accesses or uses the Service, or on whose behalf the Service is accessed. Each User must be at least 18 years old and have full legal capacity (volle Geschäftsfähigkeit). The Service is open to Consumers and Businesses alike (Section 1.4); whether you act as a Consumer or as a Business is determined by the actual facts and purpose of your use (Sections 2.5, 2.6 and 4.3), not by any registration label.

2.5 "Business" / "Unternehmer" means a User who, when entering into the contract, is acting in the exercise of their trade, business, craft or profession (a natural or legal person or a partnership with legal capacity), within the meaning of §14 BGB.

2.6 "Consumer" / "Verbraucher" means a natural person who enters into the contract for purposes that are predominantly outside their trade, business or profession, within the meaning of §13 BGB. Consumer status cannot be contracted away and is not converted by a checkbox (§§13, 307 BGB; §309 Nr. 12 forbids shifting the burden of proof onto the User). Where mandatory consumer-protection law applies, it overrides any conflicting term to the extent legally required, and only to that extent; the remaining terms stay in force (§306 BGB).

2.7 "Profile" means the brand record a User creates and configures within the Service — including brand name, description, values, positioning, tone, colours, keywords, platform handles, product information, audience information and any compliance-preset settings — together with the Inputs associated with that record and any analysis derived from them. A User may maintain one or more Profiles subject to the applicable Plan.

2.8 "Input" / "User Content" means all content, data and materials a User uploads, submits, pastes, types, records or otherwise provides to the Service, or that the Service collects at the User's direction, including: photographs and images (including images depicting identifiable persons and faces), logos and brand assets, audio and voice recordings, text (including prompts, briefs, notes and chat messages), files, and any website URL the User submits for analysis together with the content the Service retrieves from that URL at the User's instruction. Input does not include Output.

2.9 "Output" / "Generated Content" means the images, carousels, stories, videos, edits, variations, analyses, text and other content produced by the Service in response to a User's Input or instructions, including any provenance markings, watermarks or metadata embedded by us. Output may not be protectable by copyright and others may receive similar Output; this is agreed quality (see Sections 6 and 16). Provenance markings we apply under Art. 50(2) AI Act are part of the Output and may not be removed or altered by the User.

2.10 "Credits" means the prepaid, single-purpose digital units that a User may redeem solely to access paid features of the Service. Credits comprise (a) Allowance Credits (also "Plan Credits"), included as part of a Subscription fee and subject to the expiry/roll-over and lapse-on-termination rules of the applicable Plan; and (b) Top-Up Credits, purchased separately. Credits are redeemable only for our own Service; they are not electronic money, legal tender, a deposit or a claim to a cash payment, have no cash value, are non-transferable and non-poolable, and cannot be exchanged for cash or used to pay third parties — except where these Terms (for example Sections 1.6(d), 6.3, 13 and 15) or mandatory law provide for a refund or reimbursement of prepaid amounts.

2.11 "Subscription" means a recurring paid plan under which a User obtains ongoing access to the Service and/or a periodic Allowance of Credits in exchange for a recurring fee, on the terms in Section 14 and the applicable Plan.

2.12 "Plan" means the specific feature set, Credit allowance, price and limits selected by the User at checkout, as described on the pricing page and in any order confirmation.

2.13 "Gift Link" means a shareable URL in the form https://ghostcreative.ai/g/<code> that a User affirmatively creates to make selected Output (and any persons or content depicted in it) accessible to anyone who has the link, without requiring those recipients to hold an account. Creating a Gift Link is an affirmative act of publication by the User (see Section 21). A Gift Link recipient who has no account is not a party to these Terms.

2.14 "Sub-processor" means a third party engaged by us to process personal data on our behalf in connection with the Service, as identified in our published Sub-processor List and governed by the Data Processing Addendum.

2.15 "AI Provider" means a third-party artificial-intelligence model or infrastructure provider whose models or services we use to deliver the Service, currently including fal.ai (and, via fal.ai, ByteDance Seedance/Seedream models), OpenAI and Anthropic. AI Providers are independent third parties; we make their models available as a convenience and do not warrant their availability, output or conduct, except as required by mandatory law and except for our own non-delegable statutory duties (e.g. our Art. 50(2) AI Act marking obligation).

2.16 "Acceptable Use Policy" / "AUP", "Privacy Policy", "Data Processing Addendum" / "DPA" and "Impressum" mean, respectively, those documents as published at https://ghostcreative.ai/[acceptable-use], /privacy, /[dpa] and /impressum and as amended from time to time, each incorporated into and forming part of these Terms.

2.17 "Terms" means these Terms and Conditions together with all documents incorporated by reference.

SECTION 3 — ACCEPTANCE & INCORPORATION OF TERMS

In short — Section 3: You accept these Terms — and the policies they link to — by an explicit click before you sign up or pay; your own terms never apply; we flag the unexpected bits up front (including the AI-training licence and how to opt in or stay out of it); the Service is open to consumers and businesses alike, your legal status is decided by the facts; and we can update the Terms, but you get advance notice and an exit for anything important.

3.1 Parties. These Terms form a binding contract between you and Jan Stoltenberg, Einzelunternehmer, trading under the business designation "Ghost Creative", Lerchenhöhe 38, 22359 Hamburg, Germany, [legal@ghostcreative.ai — interim: jan.stoltenberg@t-online.de] ("Ghost Creative", "we", "us", "our"). Full legal and contact details are in our Impressum.

3.2 What these Terms include (incorporated documents). These Terms incorporate by reference, and you accept together with them, each document listed in Section 1.3(b), as published at the stated URL and as amended under Clause 3.9. Any document not actually accessible at the stated URL at the time of acceptance is not incorporated. The order of precedence is as stated in Section 1.3(b).

3.3 How you accept these Terms (Einbeziehung). (a) You accept these Terms by clicking the clearly labelled acceptance control (for example "I agree to the Terms, Acceptable Use Policy and Privacy Policy") shown to you before you can create an account or before you can complete a purchase, whichever happens first. (b) Acceptance is given by a deliberate, affirmative act. No acceptance control is pre-ticked, and we do not treat mere use or browsing of our website as acceptance. (c) Before you click to accept, we make these Terms and each incorporated document available to you at the linked URLs in a form you can read, save and reproduce (§305(2) Nr. 2 BGB). (d) We record the date, time, and version of the Terms you accepted, and associate that record with your account. This record is our evidence of your acceptance; it does not limit any right you may have under mandatory law and does not shift any burden of proof onto you (§309 Nr. 12 BGB).

3.4 Surfaced terms (no surprising clauses — §305c BGB). We draw your attention, in plain language and before you accept, to terms that could be unexpected given the nature of the Service, and you acknowledge them as part of your acceptance. These include in particular: (a) that generation is performed by third-party AI models, including fal.ai (ByteDance Seedance / Seedream), OpenAI and Anthropic, and that your inputs and outputs are transmitted to and processed by them, including outside the EU/EEA (see Section 12, the Privacy Policy and the Sub-processor List); (b) your warranties and indemnity regarding content you upload, the persons depicted in it, and any website URL you submit (see Sections 9 and 18); (c) the operation of public gift links (/g/<code>), which make media you choose to share accessible to anyone holding the link (see Section 21); (d) automatic renewal of subscriptions and the credit / refund rules (see Sections 13, 14 and 15); (e) the limitation of liability and dispute-resolution / governing-law provisions (see Sections 17 and 24); and (f) the service-improvement and AI-training licence in Section 8 — broad for non-personal content of genuine business users, and applying to consumers, to personal data, and to your own likeness or voice only under the separate, un-pre-ticked, revocable opt-in described there (see Sections 8.7–8.10). Any remaining doubt as to the meaning of a clause is resolved against us as the user of these standard terms (§305c(2) BGB).

3.5 Eligibility — open to consumers and businesses. (a) The Service is offered to both consumers (§13 BGB) and businesses (§14 BGB) (Section 1.4). By accepting these Terms you represent that you are at least 18 years old and have full legal capacity (Sections 4.1–4.2). (b) Whether you contract as a consumer or as a business is determined by the actual facts and purpose of your use (§§13, 14 BGB), not by a checkbox, plan name or price (Sections 1.4(b) and 4.3). A business user may provide an objective business identifier (such as a VAT identification number / USt-IdNr. or company name) so that we can apply the correct VAT treatment and the business-ratchet terms (Section 4.3); providing or omitting such an identifier is evidence of your purpose only.

3.6 Mandatory-law priority; containment (§306 BGB). Your statutory status cannot be contracted away (Section 1.4(b)). If any provision of these Terms conflicts with a mandatory rule protecting you — in particular mandatory consumer-protection law where you contract as a consumer (§13 BGB) — the mandatory rule prevails, but only to the extent the law actually requires; the conflicting provision is not applied and is replaced by the applicable statutory rule (§306(2) BGB), and all other provisions remain in full force and effect (§306(1) BGB). Nothing in these Terms waives, excludes or limits any right you have under mandatory law that cannot be waived, excluded or limited by agreement. This clause is a containment clause; it neither changes your status nor creates an eligibility gate.

3.7 No conflicting or additional terms of yours (§305(2) / §305b BGB). (a) These Terms apply exclusively. Any general terms, purchase-order conditions, or other terms of yours do not become part of the contract, even if we do not expressly object and even if we perform without objection after receiving them. (b) Terms of yours apply only where we have expressly agreed to them in text form (Textform) for the specific contract. (c) Individually negotiated terms agreed between you and us take precedence over these Terms (§305b BGB).

3.8 Versioning. Each version of these Terms carries a version identifier and an effective date (see the header). The version you accepted at contract conclusion governs your contract until a change takes effect under Clause 3.9 (and, where applicable, Section 23). We retain prior versions and make the currently effective version available at [URL].

3.9 Changes to these Terms. Changes to these Terms are governed by Section 23. In summary: minor/neutral changes take effect on notice; material changes require advance notice (at least 30 days for consumers; at least six weeks for business customers where reasonable), with a right to object and/or terminate; for consumers, silence is never treated as acceptance of a material change; and no change applies retroactively to fees already paid, content already generated, or gift links already created.

3.10 Language. The binding-language rule in Section 1.7 and Section 24.10 applies: the binding version is the one in the language actually presented to you at the acceptance control. Pre-contract consumer information (Art. 246/246a EGBGB), the Widerrufsbelehrung, and the §312j Button-Lösung are provided in the contract language.

SECTION 4 — ELIGIBILITY, AGE & ACCOUNT TYPES

In short — Section 4: You may use Ghost Creative if you're 18+ and legally able to contract — privately as a consumer or for your business. Everyone recognisable in what you upload or generate must be 18+ too. Whether you count as a consumer or a business is decided by the facts, never by a checkbox — genuine businesses get an extra "ratchet" of stronger terms, but a consumer's rights can never be shrunk by it. Keep one account with accurate, up-to-date details. If a minor slips through our 18+ gate, the law's incapacity rules win and we unwind the contract. And face-upload features are not available to users in Illinois, Texas, or Washington.

4.1 Who may use the Service. You may register for and use Ghost Creative (the "Service") only if you: (a) are a natural person at least eighteen (18) years old at registration (an organization registers through authorized natural persons who each meet this requirement); and (b) have full legal capacity to enter into a binding contract (in Germany: full Geschäftsfähigkeit under §§104–113 BGB). The Service is open to consumers (§13 BGB) and businesses (§14 BGB) alike — for a private project, a side venture, a freelance practice, or an established company (Section 1.4). The Service is not directed to, designed for, or offered to anyone under 18, and we do not knowingly contract with or collect data from anyone under 18.

4.2 Age — 18+ and depicted persons. (a) You represent and warrant that you are at least 18 years old. We do not knowingly contract with, or collect data from, anyone under 18. (b) Every identifiable person depicted in any content you upload, submit, cause to be scraped, or generate must be at least 18 years old, unless you hold documented written consent from that person's parent or legal guardian authorising the specific use (including AI synthesis, alteration, animation, and any public sharing). Uploading or generating content depicting minors in a commercial, public, or sexualised context is prohibited and is governed by the Acceptable Use Policy (Section 11). (c) If we learn that an account holder is under 18, or that content unlawfully depicts a minor, we may suspend or delete the account and the content immediately, and where legally required we will report it to the competent authorities. (d) Statutory incapacity prevails. A contract concluded by a minor or by a person lacking legal capacity is governed by §§104–113 BGB; nothing in these Terms — including the age representation in (a) — overrides those rules. If we learn that an account was opened by a minor, we will suspend the account and, once minor status is confirmed and absent ratification by the legal guardian (§108 BGB), treat the contract as void, refund payments received from the minor in accordance with statutory restitution law, delete the minor's personal data, and treat any consent associated with the account (including any training opt-in under Section 8.9) as void from the outset (GDPR Art. 8); content review and takedown follow Sections 11 and 21.

[OPERATOR NOTE — minor-protection red-team (ANALYSIS_11): the 18+ gate is currently textual (age representation at signup), not technically enforced. An age-screening step at registration and an on-discovery runbook (suspend → audit content → take down → refund → delete data and consents) must exist operationally before launch; JMStV / GDPR Art. 8 exposure is not cured by clause text. Whether stronger age verification (or any under-18 parental-consent flow) is built is a Jan/UX decision — this draft deliberately keeps the 18+-only posture.]

4.3 Consumer or business — status by fact; the business ratchet (Unternehmer, §14 BGB). (a) Status by fact. Your status as a consumer or an entrepreneur is determined by the actual facts and purpose of your use under §§13 and 14 BGB (Section 1.4(b)). A self-declaration, checkbox, or business identifier is evidence of your purpose — it never converts your status, and we never shift the burden of proving your status onto you (§309 Nr. 12 BGB). (b) What the ratchet is. The clauses gathered in this Section 4.3 apply additionally and more strongly to a user who genuinely concludes the contract in the exercise of a commercial or independent professional activity (an Unternehmer, §14 BGB), and likewise to legal persons under public law and public-law special funds. They do not apply to consumers. Where a clause elsewhere in these Terms is identified as applying to business customers — for example by a "(business customers / Unternehmer only)" marker or an equivalent express statement — that clause is part of this ratchet. (c) No reduction of consumer protection. The ratchet only adds to or strengthens terms for genuine businesses; it can never reduce a consumer's protection and never operates to reclassify a consumer. If a user's actual status is disputed, the ratchet clauses apply only once and to the extent the user genuinely qualifies as an Unternehmer on the facts (§14 BGB) — never on the strength of a checkbox alone. (d) Business identifiers (optional, non-determinative). A business user may provide an objective business signal — for example a VAT identification number (USt-IdNr.), a company or trading name, or selection of a business-use option — so that we can apply the correct VAT treatment (including the reverse-charge procedure for verified EU business customers) and the business-appropriate terms. Providing or omitting such a signal is evidence of purpose only; it does not by itself create or remove either status (§§13/14 BGB). (e) Stronger terms that the ratchet may engage (each set out in full in the cross-referenced Section and applying to business users only): the business warranty/conformity regime and shorter examination/notice duties (Section 16.2); business-customer notice periods (e.g. six (6) weeks for material changes instead of the consumer period) (Sections 3.9, 14 and 23); the business place of jurisdiction (Gerichtsstand) for merchants, legal persons under public law, and entrepreneurs without a general German venue (Section 24.2); and any liability or remedy provisions expressly calibrated to business customers within the limits of §307 BGB (Section 17). None of these displaces a mandatory rule.

4.4 One account; no sharing. Unless we expressly agree otherwise in writing, you may hold one account, and you must not create multiple or duplicate accounts (including via aliased or variant email addresses) to obtain free credits, trials, or benefits more than once, or to circumvent any suspension, ban, credit limit, or other restriction. Accounts are personal to you (or, for an organisation, to the registering entity); login credentials must not be shared, sold, transferred, or pooled, and credits are non-transferable as set out in Sections 2.10 and 13. You are responsible for activity under your account, including activity by anyone you allow to access it, on the same fault-tethered terms set out in Section 5.3 — including the carve-out in Section 5.3(c) (no responsibility for activity after a timely notice under Section 5.4 and a reasonable opportunity for us to act; no responsibility for activity resulting from our own intent, gross negligence, breach of an essential duty, or a security failing in our sphere; and, for consumers, responsibility only to the extent you culpably caused or enabled the use, with no burden-shift, §309 Nr. 12 BGB). Keep your credentials secure and notify us at [security@ghostcreative.ai] of any suspected unauthorised use.

4.5 Accuracy and currency of your information. You must provide information that is true, accurate, current and complete at registration and keep it up to date — in particular your name, contact email, any business identifiers, billing details and any VAT identification number. We may rely on the information you provide. If your information is false, outdated, or incomplete and this causes us loss (for example incorrect VAT treatment, failed billing, or misdirected notices), the consequences are governed by Sections 13, 18 and 22; we may suspend the account where required information is missing or cannot be verified. (The VAT-identifier and business-purpose elements of this clause are part of the Section 4.3 business ratchet and bear on consumers only where the law independently requires accurate billing information.)

4.6 Eligibility is a continuing condition. The eligibility requirements in this Section apply for the entire duration of your use of the Service. If you cease to meet them, or if any representation in this Section is or becomes untrue, we may suspend or terminate your account in accordance with Section 22.

4.7 Severability of this Section (§306 BGB). Each sub-clause of this Section is independent. If any sub-clause is wholly or partly invalid — in particular the business-ratchet mechanics in 4.3 or the account mechanics in 4.4–4.5 — the remaining sub-clauses stay fully effective, and the invalid part is replaced by the applicable statutory default (§306 BGB), not "read down" to the maximum permissible extent. The 18+ requirement (4.1–4.2), the consumer-protection guarantee (Section 1.5), the no-contracting-out rule (Section 1.4(b)), and the regional feature-availability rule (4.8) are intended to survive independently of any other part of this Section.

4.8 Regional feature availability — face uploads (Illinois, Texas, Washington). (a) Face-upload and face-containing generation features are not available to users located in the U.S. states of Illinois, Texas, or Washington. We apply feature-level controls to enforce this (including IP-based location detection at upload and a self-attestation). (b) You must not circumvent the controls in (a) or misrepresent your location to access a gated feature, and you must not upload face-bearing content where you know or ought to know that a depicted person is located in Illinois, Texas, or Washington. Doing so is a breach of the Acceptable Use Policy (Section 11), and you are responsible for the resulting claims on the terms — and subject to the carve-outs and consumer limitations — of Section 18. (c) Our biometric posture (no faceprints; no recognition, matching, or identification; no training on face data without the separate opt-in under Section 8.9) is described in Section 19.7 and the Biometric Privacy Notice; the U.S.-specific rules are restated in the USA Addendum.

[OPERATOR NOTE — code before words (ANALYSIS_11 structural fix 5; plan hard-rule): the IL/TX/WA feature-level geo-gate (IP-geo at upload + self-attestation + immediate-delete-on-detection) must EXIST IN CODE before this clause goes live — the Terms may not assert a control that is not implemented. Residual risk stays honest: an IP gate cannot prevent processing of Illinois RESIDENTS' faces uploaded from elsewhere (hence the knowledge-based representation in (b), per ANALYSIS_10 §11.4(c) fix), and BIPA/CUBI/RCW exposure is uncapped and personal until the successor entity and insurance exist.]

SECTION 5 — ACCOUNT REGISTRATION, SECURITY & RESPONSIBILITY

In short — Section 5: Give us real details, keep your login secret, you're on the hook for whatever happens under your account — but the moment you tell us it's been compromised and we've had a fair chance to act, that stops, and we never disclaim the things the law says we can't.

5.1 Eligibility and accuracy of registration data. (a) To use the Service you must register an account and provide accurate, current and complete information, and keep it updated. You confirm you are at least 18 years old and have full legal capacity. The Service is open to consumers and businesses alike (Section 1.4); the operative eligibility and age requirements are in Sections 4.1 and 4.2, and the business ratchet in Section 4.3. (b) You may not register using false identity data, another person's data without authorization, or automated means, and you may not create an account to circumvent a prior suspension or termination.

5.2 Your credentials. (a) On registration you (or we) generate access credentials — at minimum an email address and a password or a magic-link / single-sign-on mechanism. Credentials are personal to your account and issued for your use only. (b) You must keep your credentials confidential, choose a strong password where one is used, and not disclose, share, sell, lend or transfer your credentials or account access to any third party (see also Section 7.3). (c) Where the Service offers an additional security factor (e.g. two-factor authentication), we may require you to activate and use it, and may set and update reasonable technical authentication requirements as security needs change.

5.3 Responsibility for account activity. (a) You are responsible for all activity that occurs under your account, including all generations, uploads, purchases, credit consumption, content shared via gift links, and instructions given through your account, whether carried out by you, your personnel, or anyone to whom you have given access. (b) Granting any other person access to your account is at your own risk; they act for you, and you remain fully responsible for their conduct under these Terms, your warranties, and the Acceptable Use Policy. (c) Mandatory carve-out. Your responsibility under 5.3(a)–(b) does not extend to activity that occurs after we have received your notice under 5.4 and have had a reasonable opportunity to act, nor to activity that results from our own intent or gross negligence, from a breach of an essential contractual duty (Kardinalpflicht) on our part, or from a security failing within our sphere of control. To the extent you are a consumer (§13 BGB), you are responsible for unauthorized account use only where and to the extent you culpably caused or enabled it; we do not shift the burden of proving fault onto you (§309 Nr. 12 BGB).

5.4 Notification of compromise. (a) You must notify us without undue delay (unverzüglich), and in any event as soon as you become aware, if you know or reasonably suspect that your credentials have been lost, stolen, or disclosed; that your account has been accessed or used without authorization; or that there has been any other breach of your account's security. Notify us at [security@ghostcreative.ai]. (b) On receiving such a notice we will take reasonable steps to help secure your account (for example, by suspending access, forcing a credential reset, or disabling affected gift links). This is a reasonable-effort duty, not a guaranteed outcome or fixed response time. (c) Until you notify us under 5.4(a), you bear the consequences of unauthorized use to the extent it falls within 5.3; after a timely notice and a reasonable opportunity for us to act, you do not. Delayed or omitted notification that increases the loss may, to the extent you culpably caused it, reduce or remove our obligation to bear that additional loss (contributory fault, §254 BGB).

5.5 Our security role and account-security measures. (a) We maintain technical and organizational measures appropriate to the risk to protect accounts and credentials (Art. 32 GDPR). This is an obligation of appropriate effort, not a guarantee that the Service or your account can never be compromised. (b) We may suspend, lock, or require re-authentication of an account where we have reasonable grounds to believe its security is compromised or its credentials are being misused, in order to protect you, other users, or the Service. Where the circumstances permit, we will inform you and restore access once the issue is resolved. The full suspension/termination ladder is in Section 22. (c) Nothing in this Section limits our liability for death, personal injury or damage to health, for intent or gross negligence, for the breach of an essential contractual duty, under the Produkthaftungsgesetz, or under any other mandatory statutory provision (§309 Nr. 7 BGB).

SECTION 6 — DESCRIPTION OF THE SERVICE & NO GUARANTEE OF RESULTS

In short — Section 6: Ghost is an evolving AI tool that generates marketing content via third-party models — we owe you a working generator, not any specific, unique, accurate, lawful, protectable or results-driving Output. Our own marketing samples are AI-generated and labelled as such, and we don't publish fake testimonials. If you publish an Output — especially as an ad, endorsement, or sponsored post — YOU must review it first and add the disclosures and AI labels your market and platform require. We can change, add or retire features (with a pro-rata refund if a paid feature you use is materially cut).

6.1 What the Service is

1. (Definition.) "Ghost Creative" (the "Service") is a software tool that lets you generate marketing creatives — including still images, multi-image carousels, "stories", and videos (collectively, "Outputs") — from the brand profile, photographs, logos, website URLs, prompts and other materials you provide or authorize (collectively, "Inputs"). The Service also includes an AI onboarding assistant, a media library, an AI editing tool ("Edit") that analyzes photographs, video clips, and audio recordings (including voice recordings) you upload and — following your written direction — cuts, trims, crops, re-times, grades, subtitles, mixes, and assembles that material into new Outputs, optionally adding short AI-generated video scenes derived from your own uploaded material at a separately displayed Credit price (Section 13.2(e)), and optional sharing and notification features. Material you upload to Edit is Your Content for every purpose of these Terms and carries the full warranties of Section 9 — including the ownership warranty in 9.2 and the consent duties for every depicted person's image, likeness, and voice in 9.3 — and Edit results are Outputs for every purpose of these Terms, including Sections 10 (ownership), 11 (Acceptable Use), and 20 (AI transparency and labelling).

2. (AI-generated nature — disclosed.) Outputs are produced by artificial-intelligence models on a probabilistic (statistical, non-deterministic) basis. Identical or similar Inputs and prompts may produce different results on different occasions, and the same or similar Outputs may be generated for other users. You are interacting with AI-generated content and, where the assistant is conversational, with an AI system.

3. (Third-party AI models.) The Service relies on independent third-party AI model providers to generate Outputs, currently including fal.ai (running ByteDance Seedance / Seedream models), OpenAI, and Anthropic (the "Model Providers"). We provide access to these models as a convenience. Their availability, behaviour, output characteristics, content policies and pricing are outside our control, and their own terms apply to the generation performed on their systems. We may add, replace, re-route, deprecate or remove any Model Provider or model at any time, including for reasons of availability, cost, quality, safety or legal compliance, and an Output's characteristics may change accordingly. Where a Model Provider failure prevents delivery of a paid generation, the credit-restoration remedy in Sections 13 and 16 applies; where a provider change materially and lastingly reduces a paid feature you are actively using, clause 8 of this Section applies.

6.2 What we do — and do not — owe (No Guarantee of Results)

4. (Agreed Beschaffenheit — the result we owe.) The performance we owe is to make available a functioning content-generation tool that operates substantially as described in this Section and in the then-current product documentation, and that accepts your Inputs and returns AI-generated Outputs of the selected type. We do not owe any particular generation result. A specific, individual Output — its content, composition, wording, likeness, style or quality — is not part of the agreed quality of the Service; the agreed quality is the functioning of the generation tool, the result of any single generation being inherently variable.

5. (No guarantee of quality, fitness or specific results.) Subject to Sections 16 and 17 (which alone govern conformity and liability, including the mandatory carve-outs), the Service and all Outputs are provided without any guarantee that they will: (a) be of any particular quality, accuracy, completeness, reliability or aesthetic standard; (b) be unique or original, or differ from content generated for other users; (c) be fit for any particular purpose, including any specific marketing, advertising, commercial, regulatory or platform-compliance purpose, unless we have expressly agreed that purpose in writing; (d) be non-infringing of any third-party copyright, trademark, personality, design or other right, or be free of resemblance to real persons, brands or existing works; (e) be eligible for copyright or other intellectual-property protection (AI-generated material may not be protectable); or (f) achieve, contribute to or correlate with any marketing, sales, engagement, reach, conversion or other business result. Outputs may resemble real persons or existing works, may reproduce protected elements, and may contain inaccurate or misleading material. You are therefore solely responsible for reviewing, editing and verifying every Output, and for confirming you hold all necessary rights and consents and have applied all required disclosures and labels (clauses 6a–6b and Section 20), before you publish, distribute or otherwise use it. Any figures, examples or sample results shown in our marketing are illustrative only and — unless expressly stated otherwise — themselves AI-generated; they are not a promised or guaranteed outcome and do not represent any user's own creatives or typical results.

[OPERATOR NOTE — FTC/UWG red-team (ANALYSIS_11 ftc-ai 1/5): these limitation disclosures must also be surfaced PRE-PURCHASE in plain language (pricing page / checkout), not only inside the Terms — a T&C-buried disclaimer does not cure affirmative marketing claims ("agency-quality", "ready-to-publish", achievable-results framing), which create Beschaffenheitsgarantie / §5-UWG / FTC §5 exposure that NO clause cures. A separate, un-pre-ticked acknowledgment at first commercial generation is recommended (UX/public copy → Jan sign-off before build).]

6. (Non-professional-reliance.) The Service is a creative production tool and is not legal, advertising-compliance, medical, financial or other professional advice. Where your content concerns a regulated subject, you remain responsible for its lawfulness in every market in which you publish it.

6a. (Promotional, endorsement and sponsored use — your disclosure duties.) The Service is a tool for creating marketing and promotional content. If you publish or distribute an Output — in particular in advertising, sponsorships, endorsements, testimonials, "UGC-style" or native-advertising contexts — you are responsible for complying with every disclosure, labelling and advertising rule that applies to that publication, including: (a) endorsement and advertising-disclosure rules — for the United States, the FTC Act and the FTC Endorsement Guides (16 CFR Part 255: clear and conspicuous disclosure of material connections such as payment, affiliate relationships or sponsorship); for Germany and the EU, §5/§5a UWG and the applicable media-law labelling rules; and the comparable rules of every market in which you publish; (b) AI-transparency and synthetic-media labelling duties (Regulation (EU) 2024/1689 Art. 50(4) and Section 20), including the prohibition on removing our provenance markings (Section 7.3(e)); and (c) each destination platform's own synthetic-media and advertising policies (e.g., Meta/Instagram, TikTok, YouTube, LinkedIn), which change frequently and vary by region — check them before publishing; a platform may remove content or suspend accounts where required labels or disclosures are missing, and we are not responsible for a platform's enforcement against you. You must not present an Output as an authentic testimonial, review, or statement of a real person who has not actually given it (Section 11). This applies in particular where an Output is styled to resemble authentic user-generated or creator-filmed content (for example handheld-camera, selfie, or "UGC-style" framing): that styling can itself trigger advertising-labelling and endorsement rules (e.g. §5a UWG and Anhang Nr. 23 UWG in Germany; the FTC Endorsement Guides in the United States), and complying with them when you publish such an Output is your responsibility. We make no representation that any Output complies with these rules; the Service does not perform platform-specific compliance checking for you.

6b. (Our own marketing — claims discipline.) We hold our own marketing to the standards this Section asks of you: sample creatives, demo media and example "results" shown in our own marketing are AI-generated and we label them as such; we do not present AI-generated personas as real customers; and where we publish testimonials or results claims, they come from real, verifiable users, disclose any compensation or incentive given, and are not presented as typical results without substantiation. This clause describes our marketing discipline; it does not create a guarantee of any product characteristic (clauses 4–5) and does not expand the agreed Beschaffenheit.

[OPERATOR NOTE — structural fix 8 (ANALYSIS_11): marketing copy is the #1 disclaimer-killer. "Agency-quality" claims, sample outputs presented as achievable results, UGC-style testimonials and creator positioning each create §5-UWG / FTC / Beschaffenheitsgarantie exposure no Terms clause cures. The marketing-claims checklist (operations to-do, bound to this Section's language) must be applied to the live site BEFORE these Terms ship — clause 6b is only true if the site actually complies. All public-copy changes need Jan sign-off.]

This Section 6.2 describes the agreed nature of the Service and its Outputs (Beschaffenheit, §307(3) BGB). It does not exclude any statutory liability or any non-waivable consumer conformity right; those are addressed in, and not waived by, Sections 16 and 17.

6.3 Right to modify, add or discontinue features

7. (Evolution of the Service.) We may, acting on a legitimate ground (including security, legal or regulatory requirements, changes to or discontinuation by a Model Provider, technical necessity, cost, abuse-prevention, or product improvement), modify, add, update, restrict or discontinue features, models, Output types or other elements of the Service, in whole or in part.

8. (Protection for material reductions.) Where a change under clause 7 materially and lastingly reduces a paid feature you are actively using, you may terminate the affected paid service and we will refund or restore, on a pro-rata basis, the unused prepaid fees or credits attributable to that feature, as your sole remedy for the change (without limiting Section 17 for fault-based claims). Changes to these Terms (as distinct from the Service) are governed by Section 23.

6.4 Beta, preview and experimental features

9. (Beta as-is.) We may label certain features, models or Output types as "beta", "preview", "experimental" or similar (each, a "Beta Feature"). Beta Features are made available for evaluation, may be incomplete, unstable or withdrawn at any time, may produce lower-quality or unexpected Outputs, and are provided "as is" — subject in every case to the mandatory carve-outs in clause 10 below, which form one continuous clause with clause 9 and may not be read or applied separately from it.

10. (Mandatory carve-outs for Beta Features.) Nothing in clause 9 limits or excludes our liability for: (a) injury to life, body or health; (b) intent (Vorsatz) or gross negligence (grobe Fahrlässigkeit), including that of our legal representatives and agents (§278 BGB); (c) fraudulent concealment or an expressly given guarantee; (d) liability under the Produkthaftungsgesetz / Product Liability Directive; or (e) any other liability that cannot be excluded or limited under mandatory law. Where you are a consumer, your mandatory statutory rights (including statutory conformity rights for digital products and any withdrawal right) apply to Beta Features and are not affected by this Section.

6.5 Severability of this Section

11. Each clause and sub-clause of this Section is independent and severable, except that clauses 9 and 10 form one inseparable clause. If any part is held invalid or unenforceable, the remainder stays in force, and the invalid part is replaced by the applicable statutory default (§306 BGB), not by a judicially narrowed version of the struck clause.

SECTION 7 — LICENSE TO USE THE SERVICE

In short — Section 7: You get a limited, personal, revocable permission to use Ghost Creative — for your business if you're a business, for your own personal projects if you're a consumer. No reselling, scraping, reverse-engineering, bot abuse, or dodging our limits, filters, or watermarks. If abuse causes us real, documented third-party compute costs, we can recover those actual costs — with itemized proof, prior notice, and never as a penalty or for a one-time honest mistake. We can suspend or end the license if you break the rules, while your mandatory legal rights stay untouched.

This Section licenses the Service (the software/platform). The license over your uploaded content (Section 8) and the rights you receive in Outputs (Section 10) are governed separately.

7.1 Grant of license. Subject to your continuous compliance with these Terms and payment of all applicable fees, Ghost Creative grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable right to access and use the Service and its underlying software, interfaces, and documentation, solely for your own purposes — meaning your internal business purposes (including genuine agency use for your own clients, see 7.3(a)) where you act as an Unternehmer (§14 BGB), and your own personal, non-commercial purposes where you act as a consumer (§13 BGB) — during the term of your account. This is a permission to use the Service, not a sale or transfer of the Service or any rights in it; all rights not expressly granted are reserved by Ghost Creative and its licensors.

7.2 Scope and reservation of rights. The Service, including all software, models, prompt systems, classifiers, user interfaces, designs, text, and other materials made available by Ghost Creative (the "Ghost Materials"), is owned by Ghost Creative or its licensors and is protected by copyright, trade-secret, trademark, and other laws. "Ghost Materials" does not include your Outputs (see Section 10). Except for the limited license in 7.1, these Terms transfer no ownership and no other rights in the Ghost Materials to you.

7.3 Acceptable use of the license — restrictions. You will not, and will not permit, enable, or assist any third party to: (a) No resale or redistribution. Resell, rent, lease, sublicense, lend, time-share, host as a service, or otherwise make the Service or your access credentials available to any third party, or use the Service to operate a bureau, agency-resale, or "Service-as-a-Service" offering, except as expressly permitted in writing. Genuine agency use — generating creatives for the agency's own clients — is permitted under 7.1. (b) No credential or quota sharing. Share, sell, pool, or transfer your account, login credentials, API keys, or allocation of credits, generations, or other usage units; or aggregate the entitlements of multiple accounts to exceed the limits of any single plan. (c) No scraping or automated harvesting. Access, index, copy, monitor, or extract the Service, any page, or any content (including other users' content and any media reachable via a public share or gift link at /g/<code>) by means of any robot, spider, scraper, crawler, headless browser, enumeration of share codes, or other automated process, except through interfaces and within the rate limits we expressly provide. (d) No reverse engineering. Decompile, disassemble, reverse-engineer, or otherwise attempt to derive the source code, model weights, training data, prompts, prompt-engineering logic, classifiers, or the structure or internal workings of the Service or any Ghost Materials; or use the Service or any Output to train, fine-tune, distill, benchmark against, or otherwise develop any competing model, product, or service. This prohibition does not apply where, and only to the extent that, such acts are permitted by mandatory law that cannot be excluded by agreement — in particular the non-waivable rights to observe/study/test under §69d UrhG and to decompile for interoperability under §69e UrhG (Art. 5–6 Directive 2009/24/EC). The anti-competitive-training restriction is severable from, and survives independent of, this carve-out. (e) No circumvention of limits or protections. Circumvent, disable, or interfere with any rate limit, credit metering, usage cap, access control, authentication, geo- or feature-restriction (other than access from within the EU/EEA where mandatory law, including Regulation (EU) 2018/302, guarantees it), security measure, content filter, or safety mechanism of the Service — including the regional face-feature gate in Section 4.8; or remove, alter, obscure, or tamper with any watermark, content-provenance signal, or machine-readable AI-marking applied to Outputs (including C2PA / IPTC marking). This forbids users stripping the marking; it does not shift Ghost's own Art. 50(2) AI Act obligation (Section 20). (f) No automated abuse or overload. Use the Service in any manner that imposes an unreasonable or disproportionate load on our or our sub-processors' infrastructure, or that is designed to disrupt, degrade, or test the integrity of the Service. (g) No unlawful, unauthorized, or off-license use. Use the Service in violation of these Terms, the Acceptable Use Policy, or applicable law, or for any purpose other than those licensed in 7.1.

7.4 Cost recovery for abuse. Where conduct in breach of 7.3 — in particular scraping, automated abuse, quota circumvention, or credential sharing under (b), (c), (e), or (f) — causes Ghost Creative to incur documented, incremental third-party computing or model costs (for example fal.ai, OpenAI, or Anthropic usage), Ghost Creative may suspend the offending access and recover those documented, incremental, actually-incurred costs from you, subject to all of the following: (a) Traceability and substantiation. The costs must be directly traceable to your conduct and substantiated on an itemized, per-account basis; we will provide the supporting cost documentation with any demand. Lump-sum or estimated charges are not recoverable under this clause. (b) Notice and opportunity to respond. Before invoicing, we will notify you in text form, describe the conduct and the costs, and give you at least seven (7) days to respond and to stop the conduct. (c) No penalty for honest mistakes. Recovery under this clause does not apply to a one-time, good-faith mistake that you stop promptly on notice; it applies to deliberate, systematic, or repeated conduct after notice. (d) Consumer limitation. If you are a consumer, recovery applies only where and to the extent you culpably caused the costs, without any shift of the burden of proof onto you (§309 Nr. 12 BGB), and the consumer limitations and carve-outs of Section 18.3 apply mutatis mutandis. This clause provides reimbursement of actual loss only; it is not a liquidated-penalty clause, and statutory damage claims remain governed by Sections 17 and 18.

7.5 Enforcement and suspension. Ghost Creative may suspend or restrict your access where reasonably necessary to prevent or stop a breach of this Section, to protect the Service, other users, or third parties, or to comply with law. For curable breaches we will, where proportionate, give notice and a reasonable opportunity to cure before terminating for cause; for serious or incurable breaches (including the Acceptable Use Policy's absolute-prohibition tier) we may act immediately. Termination and its consequences — including what happens to paid credits, which are governed by Sections 13, 15.8 and 22.6(b) — are set out in Section 22 (and align with §314 BGB and DSA Art. 17).

7.6 Reservation; updates. Ghost Creative may modify, update, or discontinue features of the Service in accordance with Sections 6.3 and 23. No update or change expands the license granted here beyond its stated scope.

7.7 Trade-secret status. The Ghost Materials, including prompts, the Prompt-Brain, classifiers, the face-safe pipeline, and sub-processor routing, are Ghost Creative's trade secrets within the meaning of §2 Nr. 1 GeschGehG / Directive (EU) 2016/943, and the restrictions in 7.3(c) and (d) constitute "angemessene Geheimhaltungsmaßnahmen." Ghost Creative reserves all remedies, including injunctive relief under §6 GeschGehG.

7.8 Consumer protections (severability). Where you use the Service as a consumer (§13 BGB), mandatory consumer-protection law overrides any conflicting term in this Section only to the extent legally required; the conflicting term is not applied and is replaced by the applicable statutory rule (§306(2) BGB), and the remainder of this Section stays in full force (§306(1) BGB). No part of this Section excludes or limits any right that cannot be excluded or limited by agreement.

SECTION 8 — USER CONTENT: LICENSE GRANT TO GHOST, SERVICE IMPROVEMENT & AI TRAINING

In short — Section 8: You keep ownership of everything you upload and everything you create. You give Ghost the permissions it needs to run the Service for you (including handing your content to the AI providers that actually generate it). If you use Ghost as a business, you also let Ghost use what the Service generates for you and your own non-personal uploads to improve the Service and train its AI — but never material that belongs to someone else: ads or "Winners" you uploaded from outside, competitor or reference material, and anything showing another person's face or voice are never used for training, full stop. Your own face or voice is only ever trained on if you give a separate, deliberate, un-pre-ticked "yes" — never bundled into accepting these Terms, always revocable. Consumers' content is never trained on without that same separate "yes." Anonymized stats and any feedback you send are always fair game. Nothing is made public unless you choose to share it, and these permissions end when you delete the content or close your account. Ghost does not check or validate that your uploads are really yours or that Outputs comply with any platform's rules — that stays your job.

8.1 Definitions. "User Content" means everything you upload, paste, submit, link to, or otherwise provide to the Service ("Inputs"), together with the media the Service generates from your Inputs ("Outputs"). Inputs and Outputs together are "User Content." (See Sections 2.8 and 2.9.)

8.2 You keep ownership. As between you and Ghost, you retain all right, title, and interest you hold in your Inputs, and (subject to Section 10 and to payment) in your Outputs. This Section grants Ghost licenses to operate and improve the Service — it is not an assignment or transfer of ownership of your Inputs, and it does not enlarge any rights you do not actually hold. Under §29(1) UrhG German copyright cannot be assigned; only Nutzungsrechte (rights of use) are granted.

8.3 License you grant Ghost (to run the Service). You grant Ghost a non-exclusive, worldwide, royalty-free license to host, store, cache, back up, reproduce, transmit, display to you, reformat, resize, transcode, and otherwise technically process and modify your User Content solely to the extent necessary to provide, secure, and maintain the operation of the Service for you — including operating the generation pipeline, the face-presence screening and routing feature, AI-provenance labelling, and your media library and account. The face-presence screening referenced here detects only whether an image contains a face, so that the image can be routed and handled under our consent and AI-transparency regime (Sections 9, 11, 19.7 and 20); it is a best-effort technical aid, not content moderation and not a guarantee, and this clause licenses its operation only. We do not represent that we screen Outputs for unlawful or harmful content. [OPERATOR NOTE — ANALYSIS_12 F4, 2026-06-11: narrowed from "content moderation and safety processes" because the product does NOT run a content/NSFW moderation pass on the generation paths (the provider content-safety checker is disabled — see web/src/lib/image-engine/safety-policy.ts). The external promise is deliberately limited to (a) the consent gate and (b) AI-provenance labelling. Surface to attorney with the rest of the F4 alignment.]

8.4 Sublicense to our subprocessors and AI providers (scope-limited). You authorize Ghost to sublicense the rights in 8.3 — and, where it applies to you, the license in 8.7 — only to the service providers and AI model providers listed in the Sub-Processor List, published within our Privacy Policy, Section 12 (https://ghostcreative.ai/privacy), and only to the extent they process your User Content on our behalf to perform their function for the Service. These currently include our hosting, storage, email, analytics, and orchestration providers, and the third-party AI model providers that generate or process Outputs — currently fal.ai (United States; routing to ByteDance Seedance / Seedream models, which may involve infrastructure or entities linked to the People's Republic of China — see Section 12.4), OpenAI (United States), and Anthropic (United States). No third-party model provider is authorized by these Terms to use your User Content to train its own models; any such use would have to be separately disclosed in the Sub-Processor List and would require the legal basis described there. The Sub-Processor List — including each provider's location, purpose, and transfer mechanism — forms part of these Terms and must be actually accessible to you at the acceptance control in a form you can read, save, and reproduce (§305(2) BGB); a version that is not accessible at the time of your acceptance is not incorporated. This clause grants only the IP license; the GDPR basis and cross-border transfer authorization are governed by Sections 12 and 19.

8.5 Your warranties and authority for these licenses. You represent and warrant, for each item of User Content, that you own it or hold all rights, licenses, and permissions needed to grant the licenses in 8.3–8.4 and — to the extent those licenses apply to you (see 8.7(d)–(f) and 8.9–8.10 for the exclusions, for personal data, and for consumers) — the service-improvement and training licenses in 8.7–8.8, and to have it processed by the AI providers above, and that doing so will not infringe any third party's intellectual-property, personality, or data-protection rights. The detailed rights-, face-, and consent-warranties — and the indemnity that backs them — are set out in Sections 9 and 18 and apply in full to every license in this Section.

8.6 Public sharing / gift links (separate, affirmative grant). Sharing is off by default for every user. Only if you choose to create a public gift link (e.g. a /g/<code> link) or otherwise publish an Output do you grant Ghost the additional right to make that specific Output publicly available (UrhG §19a, öffentliche Zugänglichmachung), plus the right to generate a low-resolution preview/thumbnail and short-lived cache for delivery. This grant: (a) covers only the Output(s) you affirmatively choose to share; (b) lasts for as long as the link is active plus a short technical cache window, and ends when you disable or delete the link or the Output, after which Ghost will revoke the link, purge it from active storage and invalidate caches (copies already downloaded or cached by recipients are outside Ghost's control); and (c) does not make the share perpetual or irrevocable. By creating a public link you confirm you are the publisher of that content and hold all consents required to make any identifiable person in it public (see Section 9). Creating a gift link is a distinct affirmative act with its own surfaced acknowledgment.

8.7 Service-improvement and AI-training license (business users). In addition to 8.3, and subject to the exclusions in 8.7(d)–(f), the personal-data and consumer carve-outs in 8.9–8.10, and the mandatory-law limits in 8.11, if and to the extent you use the Service as a business user (Unternehmer, §14 BGB), you grant Ghost a non-exclusive, worldwide, royalty-free license — sublicensable solely within the limits of 8.4 — to use your User Content to operate, analyze, evaluate, debug, secure, develop, and improve the Service, and to develop, train, fine-tune, evaluate, validate, and improve AI and machine-learning models, prompts, classifiers, safety filters, and related systems used in or for the Service. This grant: (a) extends to Outputs generated for you through the Service and to your own non-personal Inputs (e.g. your own logos, brand assets, and product photographs without identifiable persons, your prompts, briefs, and other material that is your own and does not contain personal data); (b) for business users, applies to the full extent set out above, as part of the agreed commercial bargain; and (c) does not extend to any User Content covered by 8.9 (personal data / faces) or 8.10 (consumers) unless and until the separate opt-in described there has been given and not withdrawn. (d) What is never used for training (excluded content). The following are excluded from this license and are never used to train, fine-tune, or develop models, regardless of plan, status, or any opt-in or warranty:     (i) any content containing the likeness, voice, or other personal data of any person other than you (see 8.9);     (ii) any externally-uploaded "Winner," reference, comparison, or competitor asset — that is, any item you uploaded into the Service rather than generated with it and then designated as a Winner, favourite, reference, seed, or re-use input — and any other Input identified as, or reasonably suspected of being, third-party material (see Section 9.2). Designating an item as a Winner never brings it into this license (Section 9.1); and     (iii) any work a rightsholder has identified to us as theirs: where a copyright owner or other rightsholder notifies us that their work was uploaded without authorization, we will cease any training use of the identified work within [10] business days and exclude it going forward. These Terms grant us no rights against a rightsholder who is not the uploading user; the uploader's warranties in Section 9 allocate risk between you and us only. (e) Pre-training screening. Before any content is used under this license, it passes an automated screening step designed to detect and exclude faces, identifiable persons and other personal data, and content excluded under (d); content flagged by the screening is excluded from training. (f) Business opt-out (business customers / Unternehmer only). You may exclude an individual item, a project, or all of your future User Content from this Section 8.7 license — for example for confidential client material — by using a "Do not train" control where the product provides one, or by notice to us in text form (Textform); the exclusion takes effect for future training runs and does not affect the operational licenses in 8.3–8.4 or your use of the Service. [OPERATOR NOTE: This is the broadest training license enforceable as standard T&C. It deliberately scopes to Ghost-generated Outputs + the uploader's own non-personal Inputs because, under §§307–308 BGB, a clause purporting to license personal data, face data, or third-party material for model training by mere acceptance of the Terms is "überraschend"/unangemessen and would be struck in full (no geltungserhaltende Reduktion, §306 BGB); the opt-in in 8.9–8.10 is what makes the own-likeness portion lawful, and the exclusions in (d) are what keep third-party copyright (DSM Art. 17 / §§97 ff. UrhG) and third-party personality rights out of the training pipeline. TWO BUILD GATES before these Terms go live: (1) the pre-training screening pipeline in (e) and the external-upload origin flag for Winners (e.g. Request Origin = external_winner_upload) must actually exist in the product — the clause documents a control, it does not replace it; (2) this training license must be named in the surfaced-surprising-terms list shown before acceptance (Section 3.4 / A.3(d)) and on the checkout surfacing screen — surfacing is what keeps it enforceable B2B (§305c(1) BGB).]

8.8 Anonymized, aggregated and feedback data (always permitted, perpetual). Independently of 8.7 and of any opt-in, you grant Ghost a perpetual, irrevocable, royalty-free license to use, on an unrestricted basis: (a) anonymized, aggregated technical and usage data that does not identify you, any individual, or your User Content (within the meaning of GDPR Recital 26; merely pseudonymized data does not qualify and is excluded — it remains personal data and is governed by 8.9); and (b) any feedback, suggestions, ideas, or ratings you voluntarily give Ghost about the Service, the models, or Outputs. Truly anonymized and aggregated data falls outside the GDPR and may be used for any purpose, including AI training and benchmarking, without further consent.

8.9 Personal data and faces — separate opt-in, limited to your OWN likeness and voice (no bundling, no third parties). Where any User Content contains personal data within the meaning of GDPR Art. 4(1) — in particular any image, video, or voice in which a natural person is identifiable, and any depiction of a face — Ghost will not use it to train, fine-tune, or develop AI/ML models under 8.7 unless all of the following are true: (a) Your own data only. The personal data relates to you: your own likeness, your own voice, or other personal data of which you yourself are the data subject. The likeness, voice, or other personal data of any person other than you is never used for training — regardless of any opt-in you give, any warranty you make, or any consent you hold (see 8.7(d)(i) and Section 9.3). An opt-in given by an uploader cannot create a lawful basis (GDPR Art. 6(1)(a), Art. 9(2)(a)) for training on a depicted third party's data, and we do not attempt to obtain one through these Terms. (b) Separate, informed, un-pre-ticked consent. You have given a separate, specific, informed, freely-given, and unambiguous opt-in consent to exactly that processing, presented outside these Terms, through a distinct, dedicated, un-pre-ticked control that is not bundled into acceptance of these Terms or tied to any other action, and is not a condition of using the Service (GDPR Art. 6(1)(a), Art. 7, and the coupling prohibition in Art. 7(4) — Kopplungsverbot). The consent request itself states in plain language what training means — including that your likeness or voice may be processed by the third-party model providers in the Sub-Processor List (including, where applicable, outside the EU/EEA — see Section 12.4), that models improved with your data may generate content for other users, and how you withdraw. For Quebec residents the request is additionally presented in French (see the Canada Addendum). (c) Special-category data. Where the content reveals special-category data (Art. 9 GDPR — e.g. biometric data processed to uniquely identify a person, or data revealing health, etc.), you have given explicit consent under Art. 9(2)(a), and the face/biometric handling described in Section 19.7 and the Biometric Privacy Notice [LINK] applies — both of which state that the default is no training and that training occurs only under this opt-in. If and to the extent mandatory law prohibits the processing notwithstanding consent, no training occurs. (d) Revocable. The consent is freely revocable at any time with effect for the future (Art. 7(3)); withdrawal stops further training use, and Section 8.12 governs erasure and remediation. (e) Logged. The consent is logged (what was consented to, when, and the version of the request) so Ghost can demonstrate consent under Art. 7(1). A consent given by a minor, or given in connection with an acceptance of these Terms that is void (e.g. for lack of capacity, §§104–113 BGB), is invalid (GDPR Art. 8); we do not operate a parental-consent path for training consents, and on learning of such a case we stop the training use and delete the data in accordance with 8.12. [OPERATOR NOTE 1: The face/biometric geo-gate for Illinois/Texas/Washington (BIPA/CUBI/RCW — uncapped, unwaivable) operates at the feature level and is described in Sections 11.4(c) and 19.7; consent here does not override that gate.] [OPERATOR NOTE 2: ATTORNEY QUESTION — whether Art. 9(2)(a) explicit consent can carry face-training at all against the Art. 9 architecture and §22 BDSG (which has no training exception) is contested; the saving sentence in (c) keeps the clause honest either way, but the attorney must settle the feature's viability for EU users before launch. The separate consent surface itself (un-pre-ticked, unbundled, logged, revocable, with the plain-language disclosure in (b)) must exist in the product before these Terms go live, and §19.7 + the Biometric Privacy Notice must be conformed in the same pass so no incorporated document still promises unconditional "no training."]

8.10 Consumers — separate opt-in required for all training on their content. If you are a consumer (Verbraucher, §13 BGB), the training license in 8.7 does not apply to your User Content by force of these Terms. Ghost will use a consumer's User Content to train, fine-tune, or develop AI/ML models only on the basis of the same separate, un-pre-ticked, freely-revocable opt-in described in 8.9 — which is likewise limited to your own likeness, voice, and personal data — requested outside these Terms and never as a condition of access. This is so whether or not the content contains personal data: bundling a consumer's training consent into "accept to use the Service" would be an unreasonable disadvantage under §307 BGB and, for any personal-data element, void consent under GDPR Art. 7. This rule applies equally to anything you designate as a "Winner," favourite, reference, or re-use input — designating an item never creates, refreshes, or expands a training consent. Sections 8.3–8.6, 8.8 (anonymized/aggregate + feedback), the warranties in 8.5/Section 9, and the user-conduct obligations of these Terms continue to bind consumers in full. [OPERATOR NOTE: This implements Decision 3 — consumers are served on the same Terms, but the training portion is ratcheted to opt-in for them; the core upload/Winner/AUP warranties still bind. Business users remain under the 8.7 grant as scoped above.]

8.11 No bundling; consent severable from contract. No consent under 8.9 or 8.10 is a precondition to entering into, or continuing, the contract for the Service, and refusing or withdrawing it has no effect on your access to the Service or on price (GDPR Art. 7(4); §307 BGB). The training consents are legally distinct from your acceptance of these Terms: if any attempt to obtain training consent is found bundled, pre-ticked, coerced, or otherwise invalid, the consent simply fails and no training license arises — the rest of these Terms and the licenses in 8.3–8.4 and 8.8 remain fully valid and unaffected.

8.12 Duration and termination of the licenses; erasure and model remediation. The licenses in 8.3–8.4 last only while the relevant User Content is in your account and for the limited, defined periods needed to operate backups and caches. They terminate when you delete the relevant User Content or close your account, subject to: (i) deletion/retention timelines and backup-purge windows in Section 22.7; (ii) your statutory right to erasure (GDPR Art. 17), which overrides any longer-sounding language here; and (iii) Ghost's right to retain copies where required by law or to establish, exercise, or defend legal claims. The opt-in-based training license in 8.7/8.9/8.10 ends on withdrawal of consent (8.9(d)) or on deletion/account closure, whichever is earlier, for all future use. Withdrawal and deletion do not by themselves undo training that was lawfully completed beforehand — but nothing in this Section limits any statutory erasure right: on a valid erasure request under GDPR Art. 17 — whether from you or from any depicted person, who holds these rights independently of these Terms (see Section 19) — we will delete the relevant personal data from our training datasets, pipelines, and stores in accordance with Section 22.7; and where personal data was used for training without a valid legal basis (including where a consent was invalid, was given by or in respect of a minor without the required authority, or related to a person other than the consenting user), we will in addition remediate any affected model as required by law — by retraining, replacing, or retiring it. The exceptions in 8.8 survive termination.

8.13 Severability within this Section. Each sub-clause stands on its own. If any part of any license grant — including the training grant in 8.7 — is found overbroad or unenforceable, it is replaced by the statutory default (§306 BGB) without affecting the validity of the remaining sub-clauses or of the rest of these Terms; in particular, invalidity of the training grant does not impair the operational licenses in 8.3–8.4 or the anonymized/feedback license in 8.8. This clause does not provide blue-pencil rescue; its function is to keep one void sub-clause from collapsing the whole Section.

SECTION 9 — USER WARRANTIES ON UPLOADS, INCLUDING "WINNER" UPLOADS (IMAGE / IP / PERSONALITY RIGHTS)

In short — Section 9: Everything you upload — including any photo, clip, or asset you mark as a "Winner" — must be your own material that you are allowed to use. You promise you own it or are licensed, that every recognizable person (and any minor's guardian) gave consent for AI use, commercial use, and public sharing, and that nothing infringes anyone's copyright, trademark, or personality rights. "Winner" never means someone else's content, and marking something a Winner never lets Ghost train on it. Training is deliberately not part of these promises, because Ghost never trains on anyone's face or voice except your own, with your separate "yes." If your promises aren't true, that's on you: you cover the resulting claims and we can take the content down — and when a rightsholder or depicted person sends us a proper notice, taking it down is our legal duty, not a favour. Your promise protects us against you, but it can't stop an outside rightsholder from coming after us first — which is why we also run a takedown process and never ask you to upload other people's material.

9.1 Scope of this Section. This Section governs every file, image, photograph, frame, video, logo, brand asset, audio or voice recording, document, and website URL you upload, submit, paste, link, select, mark, flag, favourite, or otherwise make available to the Service ("Your Content"), including any item you designate, save, or promote as a "Winner," a favourite, a reference, a seed, or a re-use input, and including any third party depicted, referenced, or identifiable in it. A "Winner" (or any equivalently-labelled item you keep or re-use) is Your Content for every purpose of these Terms and carries the full warranties below; designating something a Winner is an act of re-submission that renews these warranties. Designation does not, however, create, refresh, or expand any training consent: whether and how Ghost may use content to train AI models is governed exclusively by Sections 8.7–8.11, externally-uploaded Winners are excluded from training altogether (Section 8.7(d)(ii)), and for consumers and for any content containing personal data the separate opt-in rules in Sections 8.9–8.10 apply. The warranties and covenants below are made by you separately each time you submit, re-submit, or designate Your Content, are surfaced to you at the point of upload and at the point of designation, are a material basis on which we provide the Service at the agreed price, and are incorporated into the indemnity in Section 18 and the Acceptable Use Policy (Section 11).

9.2 Ownership and licensing of all uploads (own material only). You represent and warrant that, for each item of Your Content — including each Winner — you either (i) are the sole owner of all intellectual property and other rights in it, or (ii) hold all licenses, permissions, and authorizations necessary to upload it, to designate it, and to have it processed as described in these Terms. Your Content must be your own material. You warrant that no item of Your Content consists of, incorporates, or is derived from third-party works, stock or "inspiration" media, scraped material, competitor material, or any other person's photographs, clips, or assets that you are not the owner of or specifically licensed to use for AI processing, commercial use, and public sharing. This warranty covers copyright, related/ancillary rights including database rights and the photographer's Leistungsschutzrecht (§72 UrhG), and any rights in audio or voice recordings you provide.

9.3 Consent of every depicted person (image/personality rights). You represent and warrant that, for every natural person identifiable in Your Content — including in any Winner — you hold that person's prior, express, and informed consent, and, where the person is a minor, the consent of their parent or legal guardian, covering each of: (1) the capture or origin of the image, likeness, or voice; (2) its upload to and processing by the Service and our third-party AI sub-processors (which include providers located outside the EU, e.g. in the United States and the People's Republic of China — see Section 12); (3) the AI synthesis, alteration, animation, voice generation, and creation of derivative media from that person's likeness or voice; (4) the commercial use of the resulting output; and (5) where you choose to share output publicly (including via a public gift link, see Section 21), that public disclosure. This consent must satisfy §22 KUG (Recht am eigenen Bild) and, where personal or biometric data is involved, Art. 6, 7 and 9 GDPR, and you must be able to demonstrate it on our reasonable request. AI-model training is deliberately not part of this consent catalogue: Ghost does not train on the likeness or voice of any person other than you (Sections 8.7(d), 8.9), and neither this warranty nor any opt-in you give extends training to a depicted third party. (business customers / Unternehmer only) If you use the Service as an Unternehmer (§14 BGB), you must additionally hold the above consent in documented form, retain proof of it for as long as Your Content is on the Service and for [3] years thereafter, and produce it to us within [10] business days of our reasonable request.

9.4 No third-party IP or trademark infringement. You represent and warrant that Your Content — including each Winner — and our processing of it as described, does not and will not infringe or misappropriate any third party's intellectual property or other rights, including copyright and moral rights (§§12–14 UrhG), trademark and trade-name rights (§§14, 15 MarkenG; Art. 9 EUTMR), competition rights (UWG), trade secrets, or contractual rights. You warrant in particular that Your Content does not consist of or incorporate third-party works, stock or "inspiration" media, scraped or competitor material, or counterfeit, passing-off, or unauthorized branded content that you are not licensed to use.

9.5 Authorization to analyze submitted URLs. Where you submit a website URL for analysis, the Service retrieves publicly available business information from that site and a limited number of its sub-pages — including text, images, brand assets, and social-media links, and, where the site presents them (for example on team, founder, "about," or leadership pages), the names, roles, and photographs of persons listed there. You represent and warrant that you own that website or are authorized to have us retrieve and analyze its content (including any persons depicted or named on it), and that doing so does not violate the rights of any third party or the website's terms. Where information about such persons is collected at your direction, you are responsible for informing those persons of that processing to the extent applicable data-protection law places that duty on you (cf. Art. 14 GDPR); our own information duties as a controller are addressed in the Privacy Policy and are not shifted to you by this clause.

9.6 Outputs are not warranted to be clear of third-party rights. You acknowledge that AI-generated output is probabilistic and may resemble real persons, existing works, trademarks, or other outputs. We do not warrant that output is unique, original, non-infringing, or copyrightable, and you remain solely responsible for reviewing and clearing each output before any use or publication. This Section 9.6 describes the agreed nature of the output (Beschaffenheit) and does not limit our statutory liability under Section 17.

9.7 These warranties bind you whether you are a consumer or a business. The warranties and covenants in this Section are warranties about your own conduct and your own uploads. They apply in full to every User, including a User who qualifies as a consumer (Verbraucher, §13 BGB). They do not waive, shorten, or shift any mandatory statutory right you hold, do not reverse any burden of proof to your detriment (§309 Nr. 12 BGB), and do not exclude any of our own liability that may not lawfully be excluded (see Section 17). Because they concern what you choose to upload and designate — not the quality of our Service — they remain enforceable against consumers and businesses alike. [OPERATOR NOTE: This is the load-bearing clause for the "serve everyone" posture — the upload/Winner/AUP conduct warranties are the operator's core protection and must survive even for consumers; do not let any "business-only" reframing strip them out.]

9.8 What this warranty does — and does not — protect against (honest note). Your warranties in this Section allocate risk between you and us: if a third party brings a claim because Your Content was not in fact yours to use, or because a depicted person did not in fact consent, that is your breach and your responsibility under the indemnity in Section 18. However, your warranty to us does not bind, settle, or extinguish any third party's own rights. A rightsholder, a depicted person, a trademark owner, or a data subject may still bring a direct claim against us as well as against you (§22 KUG; §823 BGB and the general personality right; §§97 ff. UrhG; Art. 82 GDPR), and may choose to sue us first. A depicted person additionally holds their own data-subject rights (access, objection, erasure — GDPR Art. 15, 17, 21) against us independently of these Terms and without being a customer, and can exercise them through the process described in Section 19. Your indemnity is what makes us whole as between us and you; it is not a shield that stops the outside claim from arriving. For that reason, the practical protections against third-party content reaching the Service are (i) our notice-and-action / takedown processes under 9.9, Section 11.6 and Section 21 (DSA Art. 16; for U.S.-facing copyright claims, our DMCA designated-agent process; for intimate-image abuse, the expedited NCII process in Section 11.6(d)), and (ii) our standing instruction, reflected throughout the Service and its marketing, that you upload only your own material. [OPERATOR NOTE: The product UI, onboarding copy, "Winner" feature labels, templates, examples, and all marketing MUST NOT anywhere invite, suggest, or normalise uploading third-party material — remove any copy such as "competitor examples work great," "drop in any image you like," "use a celebrity/brand reference," or similar. "Winner" must be presented exclusively as the user's own best-performing or favourite own asset. This UI/marketing discipline + the takedown process are the real-world protection; the warranty alone is not.]

9.9 Our notice-and-action duties and our reserved rights. (a) Mandatory (statutory) track. Where we receive a sufficiently complete notice of claimed infringement or other illegality from an identifiable rightsholder or depicted person — under DSA Art. 16, our U.S. DMCA designated-agent process for copyright claims, or equivalent law — we will acknowledge it, assess it, and act expeditiously, removing or disabling access to content that is unlawful. This duty exists under statute; nothing in these Terms makes it discretionary or conditions it on our convenience. (b) Discretionary track. Beyond that, we may, at our reasonable discretion, remove or disable Your Content, disable or expire any associated gift link, require you to produce the proof of consent and rights described in 9.2–9.3 before continuing to process or publicly serve face-bearing or otherwise sensitive content — and refuse or disable that processing where the proof is not provided — and suspend or terminate access where we receive a credible complaint or have reasonable grounds to believe a warranty in this Section has been breached. For breaches of the absolute prohibitions in the Acceptable Use Policy this may occur immediately and without prior notice.

9.10 Prohibited uploads (cross-reference). Without limiting the Acceptable Use Policy (Section 11), you must not upload — and you must not designate as a Winner — any item that breaches 9.2–9.4, including: photos or likenesses of any person without the consent required in 9.3; minors in any commercial or publicly-shared context; likenesses of celebrities, public figures, or other real persons for non-consensual deepfakes or impersonation; third-party, stock, scraped, or competitor material you do not own or are not licensed to use; or any content uploaded for the purpose of building a facial-recognition database, biometric identification, or biometric categorisation.

9.11 Indemnity and consequences. A breach of any warranty in this Section is a material breach. You will indemnify us against third-party claims arising from that breach on the terms, and subject to the carve-outs and consumer limitations, set out in Section 18. [OPERATOR NOTE: §306 BGB bars geltungserhaltende Reduktion and §309 Nr. 7 a/b BGB bars excluding liability for injury to life, body, or health and for intent/gross negligence; the indemnity in Section 18 must therefore carve out our own intent, gross negligence, our own statutory platform duties, and any life/body/health liability rather than purport to make the user cover everything — an over-broad indemnity is struck in full and falls back to the uncapped statutory default, which is worse for the operator.]

9.12 Survival. The representations, warranties, and indemnity obligations in this Section survive termination of your account and these Terms, and continue to apply to any Winner or other item you previously uploaded or designated.

SECTION 10 — AI OUTPUT — OWNERSHIP & RIGHTS GRANTED TO YOU

In short — Section 10: Whatever rights we have in what you generate are yours for commercial use once you've paid in full and stay within the rules — but the Output is probabilistic AI material delivered as-is: we don't promise it's copyrightable, unique, or free of others' rights, and it may carry invisible model artifacts (like smoothed skin) that some platforms and laws make you disclose. Check and clear every Output before you use it. Every Output carries a machine-readable "AI-generated" mark that you must never strip.

10.1 What we assign to you. Subject to your compliance with 10.4 (payment) and 10.5 (Acceptable Use), and only to the extent We hold any transferable rights in the media, files, text, audio or video the Service generates for you in response to your Inputs (the "Output"), We hereby assign and transfer to you, and where assignment is not legally possible grant to you, all such rights for unrestricted commercial and non-commercial use, worldwide and for the full statutory term of the rights concerned.

10.2 German-law grant (Nutzungsrecht fallback). Where rights in the Output cannot be assigned to you under applicable law (German copyright is not assignable inter vivos, §29(1) UrhG), We grant you instead an exclusive, transferable, sublicensable, worldwide and (subject to 10.4) perpetual and irrevocable right to use, reproduce, modify, distribute, publicly display and otherwise exploit the Output by all known means of use, for any commercial and non-commercial purpose (umfassendes, ausschließliches Nutzungsrecht im Sinne des §31 UrhG). We retain no right to use Outputs generated for you except as required to operate the Service and as separately permitted under these Terms.

10.3 We assign only what We have — no warranty of title, copyrightability, uniqueness or non-infringement. The grant in 10.1–10.2 transfers whatever rights We actually hold, if any — it is not a warranty that any such rights exist or that you acquire enforceable ownership. The Output is generated by probabilistic AI systems and is delivered "as-is" and as-available in its agreed nature (Beschaffenheit, §307(3) BGB). We make no representation or warranty that: (a) the Output is protected by, or eligible for, copyright or any other intellectual-property right (purely AI-generated material is frequently not protectable under §2(2) UrhG and comparable laws, which require a human creator); (b) the Output is original, novel, or unique to you; (c) the Output does not resemble, reproduce, or infringe the copyright, trademark, design, personality, or other rights of any third party; or (d) you will be able to register, enforce, or prevent others from independently generating or using the same or comparable Output. Outputs may also exhibit material modifications or enhancements — for example skin smoothing, beauty or body alteration, lighting or colour changes — that arise as artifacts of the underlying AI models rather than from your explicit instructions; whether such modifications require disclosure on a given platform or under a given law (e.g. EU AI Act Art. 50(4), platform synthetic-media and filter-disclosure rules) is for you to assess and handle before publication (see Section 20.5). You are solely responsible for reviewing and clearing each Output before any commercial or public use. This clause describes the agreed nature of the Output; it does not exclude any liability that cannot lawfully be excluded — see 10.8 and Sections 16 and 17. For a Verbraucher, the mandatory digital-product conformity regime (§§327d–327f BGB) applies to the Service and is not waived by this clause. [OPERATOR NOTE: An "as-is" disclaimer is a Beschaffenheit description of an inherently variable AI result, NOT a blanket warranty exclusion — under §309 Nr. 7 / §307 BGB and the no-geltungserhaltende-Reduktion rule (§306 BGB) a disclaimer drafted as a general exclusion of liability would be struck in full and replaced by the uncapped statutory default. Keep it framed as "no warranted result," never as "no liability."]

10.4 Rights vest only on completed payment (Rechtevorbehalt). Title to and the rights in the Output transfer to you only upon Our receipt of full, final and non-reversed payment for the generation that produced it (a payment later charged back, reversed, refunded or otherwise undone is not "final"). This is a reservation of rights modelled on §449 BGB. (a) Before payment vests, and for any free, trial, preview or promotional generation, you receive only a revocable, non-exclusive, non-transferable licence to view and internally evaluate the Output; you may not use it commercially or publish it. (b) Once rights have vested under this Section, they are irrevocable and We will not claw them back. A later breach by you, account suspension or termination affects only future generations and your continued access to the Service — it does not retroactively strip you of rights in, or require you to cease using, Output you already lawfully paid for and acquired.

10.5 Conditioned on Acceptable-Use compliance. Your rights under this Section are conditioned on your ongoing compliance with the Acceptable Use Policy and these Terms. Use of any Output in breach of the AUP or applicable law is not licensed, and We may exercise the remedies in Section 11 and Section 22. Consistent with 10.4(b), enforcement operates prospectively; it does not retroactively divest rights that have already vested.

10.6 Outputs may not be unique. The Service is probabilistic. Identical or similar Inputs or prompts — whether from you or from other users — may produce identical or similar Outputs. We do not guarantee that any Output is or will remain exclusive to you. The exclusivity granted in 10.1–10.2 extends only to the rights (if any) We hold in the specific Output generated for you; it does not prevent independent generation of comparable Output for others, and the absence of uniqueness is an agreed characteristic of the Service, not a defect.

10.7 Provenance markings stay intact (your covenant). Outputs carry machine-readable provenance and AI-content marking (e.g. C2PA content credentials / IPTC metadata such as digitalSourceType or trainedAlgorithmicMedia) and, on some tiers, a visible watermark. As a continuing condition of your rights under this Section, you covenant that you will not remove, strip, alter, obscure, suppress, or falsify the machine-readable provenance marking on any Output (the "no-stripping covenant"). This covenant binds you whether you are a business or a consumer. Your separate publication-stage labelling and disclosure duties — and the allocation of who carries the EU AI Act Art. 50 obligations as between you and Us — are set out in Section 20. [OPERATOR NOTE: The no-stripping covenant binds consumers too (it is a conduct warranty, like the upload warranties in §9 — Jan's Camp 1 core protection survives consumer status). What does NOT bind a consumer is any attempt to shift Ghost's OWN Art. 50(2) provider duty onto the user, or to impose a burden-of-proof reversal — §309 Nr. 12 BGB. Keep this clause as a forward covenant + indemnity hook, not a liability cap. The C2PA/IPTC marking must actually be applied to every Output before this text goes live.]

10.8 What this Section does not exclude. Nothing in this Section limits or excludes any liability or right that cannot lawfully be limited or excluded, including liability for injury to life, body or health, for intent or gross negligence, under the Produkthaftungsgesetz / Product Liability Directive, or under mandatory consumer-protection law. If you are a Verbraucher, mandatory consumer rights prevail over any conflicting provision of this Section to the extent legally required, and the remainder remains valid (§306 BGB).

SECTION 11 — ACCEPTABLE USE POLICY (PROHIBITED CONTENT & CONDUCT)

In short — Section 11: No illegal, abusive, deceptive, infringing, non-consensual, or synthetic-political content — uploads and people-photos must be yours and consented. Serious or criminal misuse (CSAM, NCII, non-consensual deepfakes) gets your account terminated immediately with no refund and may be reported to authorities — and for intimate-image abuse we run a dedicated victim channel: anyone depicted can report, we confirm within a day and take it down within two, and confirmed material is blocked from being re-uploaded. Lesser, fixable slips normally get a warning, a chance to fix, and a written explanation you can object to. Face uploads are blocked for Illinois, Texas, and Washington because those states' biometric laws are uncapped and unwaivable. We don't watch everything you do — but once we actually know content is illegal, removing it is our legal duty, not a choice.

This Section states the binding, summary-level rules. The full operational catalogue is in our separate Acceptable Use Policy ("AUP") at [LINK], incorporated by reference. Where this Section and the AUP overlap, both apply; the more specific prohibition governs. The AUP must be linked and assented to pre-checkout / at signup and carries its own severability clause.

11.1 Scope and your core undertaking. (a) This Section governs everything you submit to, generate with, store on, or distribute through the Service, including (i) Inputs, (ii) Outputs, and (iii) your use of distribution features (downloads, the media library, public gift links at /g/<code>, lead capture, and notifications). (b) You represent, warrant, and covenant on a continuing, per-submission basis that your Inputs, Outputs, conduct, and distribution comply with this Section, the AUP, and all applicable laws. These are your warranties about your own conduct — they do not limit your statutory rights and do not exclude our own liability.

11.2 Absolute prohibitions (zero tolerance — immediate, permanent termination). The following are strictly and absolutely prohibited. There is no warning and no cure period; a single violation results in immediate, permanent termination of your account, immediate disabling of any associated gift link or public content, forfeiture of the credits consumed in, and fees paid specifically for, the violating generation(s) (and, for such serious non-curable breaches, forfeiture of the remaining unused paid top-up balance under Section 22.6(b)), preservation of evidence, and — where we are required or legally entitled to do so — reporting to the competent authorities (including, for child sexual abuse material, the BKA and/or NCMEC under 18 U.S.C. §2258A). You must not create, upload, prompt for, generate, store, or distribute: (a) Child sexual abuse material (CSAM) or any sexualized depiction of a minor, real or synthetic (§184b, §184c StGB); (b) Non-consensual intimate or sexual imagery (NCII) of an identifiable real person, including "undressing," sexualization, or intimate deepfakes created or shared without explicit written consent (§184k, §201a StGB; Mexico: Ley Olimpia); (c) Non-consensual synthetic media ("deepfakes") of a real, identifiable person created without that person's documented, explicit, informed prior written consent, in particular sexual, defamatory, or deceptive depictions (§201a StGB; §22 KUG; §823 BGB / general personality right, Art. 1, 2(1) GG); (d) Content that endangers a child or sexualizes, exploits, or grooms minors in any form; (e) Content promoting, instructing, or facilitating terrorism, mass-harm, or weapons of mass destruction (chemical, biological, radiological, nuclear, or explosive), or other serious violent extremism. CSAM and NCII — mandatory enforcement and re-upload prevention. For the prohibitions in (a) and (b), enforcement is not discretionary: on a complete notice or other actual knowledge we will remove or disable the content (for NCII, within the timelines in 11.6(d)), permanently terminate the responsible account — including on any re-upload of previously removed NCII, with no warning and no cure period, by that account or a successor account — and use hash-matching of confirmed CSAM/NCII to prevent the same material from being re-uploaded. A depicted person's own statutory claims and remedies (including under the U.S. TAKE IT DOWN Act and state intimate-image statutes, and under §§184k, 201a StGB) exist independently of these Terms, which do not bind non-parties and do not limit those claims. [OPERATOR NOTE: The dedicated NCII channel, the [24]h/[48]h service levels in 11.6(d), and the hash-based re-upload block must be LIVE in the product before these Terms are published — this clause documents the machinery; it does not create it.]

11.3 Prohibited content and conduct (catalogue). You must not use the Service to create, generate, upload, store, or distribute content that, or to engage in conduct that: (a) Hate and incitement: incites hatred or violence against, or denigrates, a person or group by reference to a protected characteristic, or constitutes Volksverhetzung (§130 StGB) or denies/trivializes genocide; (b) Harassment, defamation, threats: harasses, bullies, stalks, threatens, or defames an identifiable person, or makes or spreads false statements of fact about an identifiable person, business, or product — including claims of illegality, fraud, danger, or incompetence unsupported by documented fact — or constitutes Beleidigung, üble Nachrede, or Verleumdung (§§185–187 StGB) or Kreditgefährdung (§824 BGB) / business disparagement; (c) Fraud and forgery: is fraudulent, deceptive, or facilitates scams, phishing, fake reviews, or forged or falsified documents, identities, credentials, currency, or official papers (§263, §267, §269 StGB); (d) Impersonation: impersonates any person, brand, or entity, or falsely suggests affiliation, endorsement, or sponsorship — including by associating a person's likeness or your content with third-party trademarks, logos, or endorsements you have no authority to use; (e) Malware and security: contains or distributes malware, or is used to disrupt, overload, probe, or gain unauthorized access to the Service or any system; (f) Illegal goods and activity: advertises, offers, or facilitates illegal goods or services, controlled substances, weapons, counterfeit goods, or any other unlawful activity; (g) IP and personality infringement: infringes any third party's copyright, neighbouring right (§72 UrhG), trademark (§14 MarkenG; Art. 9 EUTMR), trade secret, or right of publicity / image rights (§22 KUG), or uses third-party "inspiration," scraped, or stock material you are not licensed to use; (h) Circumvention of safety and provenance measures: attempts to bypass, defeat, or manipulate the Service's content filters, rate limits, credit metering, face-detection, geo-gates, or other safety measures, or removes, alters, or obscures any provenance marking, watermark, C2PA metadata, or AI-origin label we apply (§95a UrhG; AI Act Art. 50); (i) Prohibited AI practices: engages in any practice prohibited by Art. 5 of Regulation (EU) 2024/1689 (the AI Act), including untargeted scraping of facial images to build or expand a facial-recognition database, and biometric categorisation of persons by protected characteristics; (j) Political and election content: generates, or uses Outputs as, synthetic or AI-generated political, campaign, or election-related media, or content intended to influence an election, referendum, or political process, or to disseminate political disinformation. This is a worldwide, viewpoint-neutral prohibition on using this Service to manufacture synthetic political media; (k) Deceased personalities: creates, uploads, or distributes a digital replica of a deceased natural person's likeness or voice without demonstrable authorization from the holder of the applicable post-mortem rights (the estate, the heirs, or their licensee) — such authorization being required, for example, under New York's deceased-personality digital-replica law (S.8882, N.Y. Civil Rights Law), Cal. Civ. Code §3344.1, and, under German law, the continuing image protection of §22 sentence 3 KUG and the postmortal personality right. The consent rules for living persons (11.2(c), Section 9.3) apply to the rights holder's authorization accordingly.

11.4 Public distribution, gift links, and the face-upload geo-gate. (a) You must not distribute any content prohibited by 11.2 or 11.3 through any Output, download, the media library, or a public Gift Link. Creating a Gift Link is an act of publication: you are the publisher and, where personal data is shown, the controller, and you are solely responsible for holding all rights and all depicted persons' consents before you share (§22 KUG; GDPR Art. 6, 9). The full Gift-Link regime is in Section 21. (b) We may disable, expire, or delete any Gift Link immediately where we have a credible indication of a violation, a non-consent complaint, or unlawful content, without prior notice and without thereby incurring liability for lawful action taken in good faith. This is a content-specific measure; full-account termination is governed by 11.5 and Section 22; the statement-of-reasons process in 11.5(b) and Section 21 applies. (c) Face-upload geo-gate (documented control). Uploading or processing images in which a natural person's face is identifiable is a feature that is geo-gated and not available to users located in the U.S. states of Illinois, Texas, or Washington. The gate is a feature-level technical control: face-bearing uploads are blocked where the upload's geolocation resolves to one of those states, an attestation step applies to face uploads from the United States, and face content detected in breach of the gate is deleted on detection. This control exists because those states impose uncapped, in some cases unwaivable, statutory regimes on the collection and use of biometric/facial data (Illinois BIPA 740 ILCS 14; Texas CUBI Tex. Bus. & Com. Code §503.001; Washington RCW 19.375), and these regimes cannot be limited by these Terms. You must not attempt to bypass, spoof, or circumvent this geo-gate (including by VPN, proxy, or falsified location or attestation), and you must not upload face content where you know or ought to know that the depicted person is located in, or a resident of, Illinois, Texas, or Washington. Doing so is a breach of 11.3(h) (circumvention of safety measures), and you are responsible for the resulting claims on the terms, and subject to the carve-outs and consumer limitations, of Section 18. Face uploads remain available in the rest of the United States, in Canada, and in Mexico, subject to the consent warranties in Section 9 and applicable local biometric and privacy law. [OPERATOR NOTE: This clause DOCUMENTS the technical control; it is not itself the protection. BIPA/CUBI/RCW are uncapped and (BIPA) carry a private right of action with statutory damages and personal exposure — the geo-gate must actually be ENFORCED in the product (feature-level block on face-detection upload when geo/IP resolves to IL/TX/WA, plus the self-attestation gate and delete-on-detection) BEFORE these words go live. A contract clause alone does not defeat BIPA, and an IP-based gate does not defeat BIPA for Illinois RESIDENTS whose faces are uploaded from elsewhere — that residual exposure is real and is an attorney/insurance item, not a drafting item. Per Jan's decision 4, gate is IL+TX+WA only; rest of US/CA/MX served normally.]

11.5 Enforcement, suspension, and graduated response. (a) No general monitoring; our reserved rights; our statutory duty on actual knowledge. We do not have, and these Terms do not create, a general obligation to monitor all content (DSA Art. 8). We may, but are not obliged to, proactively monitor, review, restrict, remove, refuse, or label content, and suspend or terminate access, where we reasonably believe this Section, the AUP, or the law has been or is likely to be violated. Our face-detection / face-presence routing is a best-effort technical aid that detects whether an image contains a face so it can be handled under our consent and AI-transparency regime (Sections 9, 19.7, 20); it is not content moderation, not a guarantee, and not a legal-compliance review (DSA Art. 7, Art. 8), and we do not represent that we screen Outputs for unlawful or harmful content. [OPERATOR NOTE — ANALYSIS_12 F4: "face-safe" is a face-detection ROUTING/BYPASS mechanism, not a content-safety system; do not frame it as moderation. Pending the broader F4 rename + fal-AUP sign-off.] What is not discretionary: where we obtain actual knowledge of manifestly unlawful content — through a sufficiently complete notice (DSA Art. 16) or otherwise — we will act expeditiously to remove or disable access to it, as the hosting-liability regime requires (DSA Art. 6; §10 DDG); nothing in these Terms reduces that statutory duty or makes it discretionary. (b) Graduated process for curable breaches; statement of reasons. For violations that are curable and not within 11.2, we will normally apply a proportionate, graduated response — notice and an opportunity to cure within a reasonable period (Abmahnung mit Fristsetzung, §314(2) BGB) — before terminating for cause. When we remove content, disable a link, or restrict or suspend access, we will provide a statement of reasons and a means to object (DSA Art. 17), except where a legal tipping-off prohibition, an order of a competent authority, or the need to act immediately against suspected CSAM or NCII prevents it — in which case we provide the statement as soon as lawfully permissible. The cure step does not apply to the absolute tier in 11.2. (c) Immediate measures for serious breaches. For violations within 11.2, or other serious, incurable, or recurring breaches, or where required to prevent imminent harm or comply with law, we may suspend or terminate immediately and without prior notice (§314 BGB), disable associated public content, and preserve and report evidence as set out in 11.2. (d) Credits and fees. Forfeiture of credits or fees applies only on user-fault for-cause termination under 11.2 / 11.3 and is limited to the credits consumed in, and fees paid specifically for, the violating generation(s). Whether the remaining unused paid top-up balance is also forfeited is governed exclusively by Section 22.6(b): it is forfeited only where we terminate immediately for a serious, non-curable breach under Section 22.5(b), and otherwise remains usable or is refunded pro-rata. Where we suspend or terminate for our own convenience or without your fault, your statutory rights, including any pro-rata refund of prepaid amounts and your mandatory consumer remedies, remain unaffected (§§307, 327 ff. BGB).

11.6 Reporting, notice-and-action, NCII channel, trusted flaggers, and indemnity hook. (a) Reporting. You can report content you believe violates this Section, including via the report mechanism on gift-link (/g/) pages or by writing to [report@ghostcreative.ai]. We operate a notice-and-action process and act on illegal content of which we obtain actual knowledge through a sufficiently complete notice (DSA Art. 16); see 11.5(a) for the mandatory character of that duty. (b) Your AI-labelling duty. Where you publish an Output that depicts a real person in a manipulated way, or that could be mistaken for authentic, you must disclose that it is AI-generated/manipulated as required by AI Act Art. 50(4). You must not remove the provenance marking we apply. Our own Art. 50(2) machine-readable marking duty remains with Ghost (Section 20). (c) Indemnity hook. Your breach of this Section triggers Section 18, subject to the mandatory carve-outs there (no indemnity for our own intent or gross negligence, for our own breach of our statutory platform duties, or for life, body, or health — §309 Nr. 7 BGB). (d) Non-consensual intimate imagery (NCII) — expedited, mandatory process. We maintain a dedicated NCII reporting channel at [ncii@ghostcreative.ai] and via the report function on every gift-link page. Any person who believes they are depicted in NCII or an intimate deepfake may report it — whether or not they are a customer, free of charge, without proof of exhausted remedies, and without contacting the uploader. We will acknowledge a report within [24] hours with a reference number, and, for content we determine on a complete notice to be NCII, remove or disable it within [48] hours of receipt or inform the reporter in text form of the grounds for refusal — this is a duty, not a discretion. Where the depicted person is identifiable, we will inform them of the removal; we will not disclose a reporter's identity to the uploader without the reporter's consent. Confirmed NCII is hashed to prevent re-upload, and the responsible account is terminated under 11.2. These commitments implement the U.S. TAKE IT DOWN Act and comparable state and EU rules; a depicted person who is not a party to these Terms is not bound by them, and their direct statutory claims are not subject to the limitation, indemnity, or dispute-resolution provisions of these Terms. [OPERATOR NOTE: Build gate — channel, SLA tracking, victim notification, and hashing must exist before publication; see 11.2. The §21.8 gift-link takedown clause and the US Addendum must reference this same channel so there is exactly ONE NCII process.] (e) Trusted flaggers — priority handling. To the extent the DSA's online-platform obligations apply to the Service, notices submitted by trusted flaggers designated under DSA Art. 22 (and, irrespective of designation, notices from recognized child-safety and image-abuse hotlines such as NCMEC or the IWF) receive priority handling: we review them ahead of standard notices, normally within [24] hours, and inform the flagger of the outcome and the grounds for any refusal. (f) Records and transparency. We keep records of notices received, moderation decisions taken (including the provision breached, whether the decision followed a notice or proactive detection, and decision times), statements of reasons issued, and objections and their outcomes, and we publish transparency reports on this activity to the extent the DSA (Arts. 15, 24) requires of a service of our size and category. You may request information about decisions concerning your own account or content (GDPR Art. 15; DSA Art. 17).

11.7 Multi-jurisdiction anchoring and severability. (a) The prohibitions above are anchored in German criminal and civil law, the AI Act, the DSA, and, for users in Mexico/LATAM, applicable local law (including Ley Olimpia and the LFPDPPP). Conduct lawful in one jurisdiction but unlawful where you or a depicted person is located remains prohibited as to that jurisdiction. (b) This Section and the AUP each contain their own severability clause: if any single prohibition or enforcement sub-clause is held invalid, the remainder stays in full force and the invalid part is replaced by the applicable statutory default (§306 BGB). (c) The binding-language rule in Sections 1.7 and 24.10 applies; any ambiguity in our standard terms is construed against us (§305c(2) BGB).

SECTION 12 — THIRD-PARTY SERVICES & FLOW-DOWN TERMS

In short — Section 12: Your content is generated and handled by outside services (fal.ai/ByteDance — including processing that may touch the US and China —, OpenAI, Anthropic, Stripe and others); you must follow their rules too. We're not liable when they have outages or change — but if a paid generation never arrives you get those credits back, and if we swap models in a way that materially and lastingly degrades a paid feature, you get notice where possible and a free exit with a pro-rata refund. If a photo shows a real person you must have that person's consent for this cross-border AI use. The providers can rely on your promises here — but never to collect the same loss twice, and never directly against consumers: only Ghost itself can seek reimbursement from a consumer, within the consumer indemnity rules.

12.1 The Service Relies on Third-Party Providers

To generate, process, store, deliver and bill for content, the Service routes data through independent third-party providers ("Providers"):

The authoritative, regularly updated list of Providers — including each one's processing location, transfer mechanism and data-handling stance — is the Sub-Processor List, published within our Privacy Policy, Section 12 (https://ghostcreative.ai/privacy), which forms part of these Terms and is accessible at the acceptance control together with the Privacy Policy (see Section 8.4). The model-provider list may be amended via the sub-processor notice-and-objection process in Section 19.5 and the Data Processing Agreement; Section 23 governs only amendments to the text of these Terms.

12.2 You Must Comply With Each Provider's Terms (Flow-Down)

(a) When you use the Service, your Inputs, prompts and Outputs are processed by one or more Providers; your use is therefore also subject to each relevant Provider's own terms, acceptable-use, usage and content policies ("Provider Terms"), as they apply to the data you submit and the content you generate. The current Providers are identified in the Sub-Processor List (Privacy Policy, Section 12); each Provider's Terms are published on that Provider's own website. (b) You agree to comply with all applicable Provider Terms, including each Provider's acceptable-use and prohibited-content rules. You must not use the Service to do, via a Provider, anything you are prohibited from doing under that Provider's own rules. (c) A breach of a Provider's Terms through your use of the Service is also a breach of these Terms and of our Acceptable Use Policy, and may trigger the enforcement and termination measures in Sections 11 and 22. We may pass through, suspend or terminate access to comply with, or to act on a request or restriction imposed by, a Provider.

12.3 No Liability for Provider Outages, Changes or Discontinuation

(a) The Providers are independent third parties we do not control. Their availability, performance, features, models, pricing, output behaviour and policies can change, degrade, be rate-limited, be deprecated, or be discontinued at any time, with or without notice to us. (b) Subject to the mandatory ceiling in 12.3(d) and to Section 17, we are not liable for, and the Service does not warrant against: (i) any outage, interruption, latency, rate-limiting, error, or reduced quality originating with a Provider; (ii) any change, deprecation, withdrawal or discontinuation of a Provider, a Provider model, or a Provider feature; or (iii) any act, omission, content decision, or policy of a Provider. (c) We may substitute Providers or models of comparable function at our discretion, and may suspend or remove a Provider where required for legal, security, sanctions, or operational reasons. Where we plan a Provider or model substitution that we expect to materially and lastingly reduce a paid feature, we will give you advance notice in text form where reasonably possible; and wherever a substitution in fact materially and lastingly reduces a paid feature you rely on, your remedy is in Section 6.3 (cancellation and pro-rata refund of prepaid amounts for the affected, undelivered feature). A material, lasting degradation of the generation quality or capability of a paid feature counts as a material reduction for this purpose. (d) Mandatory ceiling. The exclusions in 12.3(b) are subject to, and do not apply to, the mandatory liability that survives under Section 17 — in particular liability for injury to life, body or health, for intent or gross negligence (ours or our Erfüllungsgehilfen's, §§278, 309 Nr. 7 BGB), for breach of an essential contractual duty (Kardinalpflicht, limited there to foreseeable contract-typical damage), under the Produkthaftungsgesetz, for fraud, and under any express guarantee. A verified extended Provider outage that prevents delivery of a paid generation does not let us keep the prepaid amount: the affected credits are restored or refunded pro-rata (§326 BGB). Choosing a Provider is our Beschaffungsrisiko and a chosen-Provider failure within our sphere is not fully swallowed by an outage disclaimer.

12.4 Cross-Border Processing, Including Processing in the People's Republic of China (PRC)

(a) Disclosure. Several Providers process data outside the European Economic Area, including in the United States and — for AI image/video generation served via fal.ai using ByteDance models — potentially with infrastructure or entities linked to the People's Republic of China (PRC). The PRC has no EU adequacy decision, and PRC laws (including the Cybersecurity Law, Data Security Law and Personal Information Protection Law) may grant state authorities access to data. The specific location and transfer mechanism for each Provider is stated in the Sub-Processor List at [LINK]. (b) What this means for you. If your Inputs include photographs of, or other personal data about, identifiable persons (including faces and voices), that personal data may be transmitted to and processed by these Providers, including in the United States and PRC-linked infrastructure, as part of generating your content. (c) Transfer safeguards. For these transfers we rely primarily on the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) together with a transfer-impact assessment and, where appropriate, supplementary measures. Where, and only where, no other lawful basis is available, a transfer may be made on the basis of your explicit, informed, separately-obtained consent under Article 49(1)(a) GDPR. The details are governed by our Privacy Policy and DPA, which prevail over this Section on data-protection matters. (Per EDPB Guidelines 2/2018, Art. 49(1)(a) consent is not a valid basis for routine, systematic transfers — SCCs + TIA are the primary mechanism.) (d) Your warranty and responsibility for depicted persons. Because you choose what to upload, you represent and warrant that, for every identifiable person depicted in your Inputs, you hold the consent described in Section 9.3 — covering AI processing, cross-border processing (including in the United States and PRC-linked infrastructure), and the specific generated use — in the form Section 9.3 requires (for business customers, documented form; for consumers, demonstrable on our reasonable request). You indemnify us for third-party claims arising from your failure to hold such consent, on the terms (and subject to the carve-outs) of Section 18. This binds the uploader only and does not extinguish a depicted third party's direct GDPR Art. 14/82 or KUG §22 claim.

12.5 Provider Risk Pass-Through; Providers as Beneficiaries

(a) We provide access to the Providers as a convenience. Except as required by mandatory law, we make no representation or warranty regarding any Provider, its outputs, its security or its compliance, and we disclaim liability for Provider conduct to the extent set out in 12.3 and Section 17. (b) The named Providers are intended third-party beneficiaries of the user warranties, acceptable-use obligations and indemnity in these Terms to the extent your conduct gives rise to a claim against them (consistent with Section 18.9). In aggregate, recovery by Ghost Creative and all such protected third parties under these Terms may not exceed the loss actually incurred; there is no double recovery for the same loss. Against a consumer, no protected third party may invoke this beneficiary status at all (Section 18.9); only Ghost Creative itself may seek reimbursement from a consumer, and only within the consumer indemnity regime of Section 18.3 and always subject to the mandatory carve-outs in Section 18.5. (c) Each Provider remains solely responsible for its own statutory and regulatory obligations (including, where applicable, its obligations as a general-purpose AI model provider under the EU AI Act). Nothing in this Section shifts to you, or excludes, our own non-delegable legal duties — including our EU AI Act Article 50(1)/(2) transparency and provenance-marking obligations — which we retain.

SECTION 13 — CREDITS, PRICING & PAYMENT

In short — Section 13: You buy Credits (single-purpose, no cash value, non-transferable) and pay by card via Stripe; consumer prices are always shown as the full price including VAT, and we run standard German VAT (no small-business scheme); if a payment fails we retry, then pause access. Generations you validly asked us to start right away are not refundable — but your legal 14-day withdrawal, defect, and pro-rata-if-we-fail rights always stand. Paid Top-Up Credits last at least 36 months, and if they ever expire unused we reimburse the paid value. A card chargeback is not the same thing as a legal withdrawal: real fraud gets a full refund, but disputes over Credits you knowingly spent get investigated, not rubber-stamped.

13.1 Credits — what they are

(a) The Service is operated on a credit model. A Credit is a single-purpose prepaid unit of account redeemable solely for generations and other features within Ghost Creative's own Service. (b) Credits are not electronic money, legal tender, a deposit, a payment instrument, a security, or a claim to any sum of money. They have no cash value, cannot be exchanged, redeemed, refunded or paid out for cash — except for the reimbursement of unused paid value under Sections 13.7(a) and 15.8(a), the refund routes in Section 13.8, and wherever mandatory law requires a refund — and confer no interest. (c) Credits are personal to your account: non-transferable, non-assignable, non-poolable across accounts, and may not be sold, gifted, traded, or used to pay any third party. (d) Two kinds of Credits. (i) Plan Credits (Allowance Credits) are included as part of a subscription fee and refresh each billing cycle. Unused Plan Credits may, where the plan so states, roll over for [BRACKETED: e.g. one billing cycle] or otherwise lapse at the end of the cycle; Plan Credits lapse when the subscription ends (see 14.6). (ii) Top-Up Credits are purchased separately for a one-off price. Paid Top-Up Credits remain valid for at least 36 months from purchase, and their unused paid value is reimbursable on expiry (see 13.7 and 15.8).

13.2 Prices and what is included

(a) Current plan and Credit prices are shown on the pricing page at https://ghostcreative.ai/pricing. Indicative subscription tiers are [BRACKETED: EUR 29 / EUR 79 / EUR 199] per [month/year]. (b) How prices are displayed (binding display rule). Prices are displayed on the pricing page, at checkout before any commitment, and on the invoice in the form required by applicable law: (i) For consumers and for all visitors who have not provided a verified business VAT-ID: prices are displayed as the total price including all applicable VAT (Gesamtpreis inkl. Umsatzsteuer), prominently and clearly labelled as including VAT (§3 PAngV — German Price Indication Ordinance). (ii) For customers who provide, and we verify, a valid EU VAT-ID or another legitimate reverse-charge claim: prices at checkout (after VAT-ID entry and verification) are displayed as the net price excluding VAT, with a clear, adjacent statement that the reverse-charge mechanism applies and that the customer is responsible for VAT self-assessment in their own member state. (iii) For consumers contracting from Mexico: prices are displayed as the total price including the applicable IVA (see (c)), clearly labelled, before payment is finalized. (iv) The checkout confirmation and the invoice restate the VAT treatment (included, reverse-charged, or otherwise) applied to that customer; a customer whose VAT-ID status changes mid-session sees the price recalculated and re-displayed with the correct treatment before final payment. [OPERATOR NOTE: This clause documents the legally required price display; the live pricing page and checkout must actually implement it (PAngV total-price labelling for consumers; net display plus reverse-charge note only after VAT-ID verification; IVA-inclusive display for MX) BEFORE these Terms go live. Until the display code ships, this text is a misrepresentation (UWG §5). Drafting+code pair — text may only go live with the feature.] (c) VAT regime (Umsatzsteuerbehandlung). Ghost Creative operates under standard German VAT (Regelbesteuerung); USt-IdNr.: [BRACKETED: DE XXX XXX XXX]. The §19 UStG small-business scheme does not apply. Accordingly: consumer prices for Germany include VAT at the statutory rate (currently 19%); supplies to consumers in other EU member states are taxed at the rate of the member state of consumption under the OSS scheme; for EU business customers with a verified VAT-ID the reverse-charge mechanism applies (§13b UStG; Art. 196 of Directive 2006/112/EC) and invoices are issued net with the statutory reverse-charge note; for Mexican consumers, IVA at [BRACKETED: 16% — attorney to confirm the rate actually applicable to digital services supplied to Mexico-resident consumers before publication] is included in the displayed total and stated on the invoice (see also the Mexico Addendum and the ES-MX aviso). Any change to an applicable VAT/IVA rate is passed through with the notice applicable law requires; Mexican consumers retain their LFPC Art. 56 cancellation right if they do not accept a changed rate. (d) Taxes stated net where the law allows. Quoted business prices are exclusive of VAT, sales, use, or similar taxes legally chargeable on the supply. You bear those taxes legally yours to bear; we bear our own statutory VAT obligations. Where you provide a VAT-ID or claim a tax status (e.g. reverse-charge), you warrant the data is accurate and indemnify us for any tax, interest or penalty arising from incorrect data you supplied. If a tax becomes due that was not charged, we may add it to future invoices on reasonable notice; we do not retroactively add VAT to amounts already paid. (e) Edit tool — Credit quotes shown before any charge. The Edit tool (Section 6.1) charges Credits in up to two steps, each displayed to you before it is incurred: (i) an edit quote covering the analysis and assembly of your uploaded material, shown after upload and deducted only when you expressly confirm it; and (ii) where the edit plan you are shown includes AI-generated scenes, a separate generation quote, shown together with that plan and deducted only when you expressly start the generation step. No Edit Credits are deducted without the corresponding quote having been displayed first. Where a paid Edit step terminally fails for reasons on our side, the corresponding Credits are restored to your account automatically; the refund routes in Section 13.8 and the credit-restoration remedy in Section 16 apply.

13.3 Payment processing (Stripe)

(a) Payments are processed by Stripe ([BRACKETED: Stripe Payments Europe, Ltd. / the applicable Stripe entity]) as our payment-services provider. By submitting a payment you authorise us and Stripe to charge your chosen payment method. Card and payment-method data are handled by Stripe under Stripe's terms and privacy policy; we do not store full card data. (b) Strong Customer Authentication. Where required (PSD2 / SCA), your payment may need additional authentication (e.g. 3-D Secure). For subscriptions and Top-Up auto-charges you authorise us, via Stripe, to store your payment method and to initiate recurring/renewal charges as merchant-initiated transactions where the applicable payment rules permit such charges without separate authentication for each transaction. (c) An order placed via a button is binding only where that button is clearly labelled (for consumers: "zahlungspflichtig bestellen" / order with obligation to pay, §312j BGB). We do not pre-tick paid add-ons (§312a(3) BGB).

13.4 Subscriptions, renewal and price changes

Subscriptions, automatic renewal, upgrades, downgrades, cancellation and price changes are governed in detail by Section 14. In summary: a subscription renews automatically until cancelled; for consumers any initial fixed term is ≤24 months (§309 Nr. 9 BGB) and, after the initial term, the contract continues indefinitely and is cancellable monthly — never renewing into a fresh fixed term; consumers receive a pre-renewal reminder before each renewal charge (Section 14.2(d)); consumers cancel via the §312k cancellation button; price changes apply only to future cycles, with advance notice and a free right to exit.

13.5 Payment failure and dunning

(a) If a charge fails (e.g. expired card, insufficient funds, declined authentication), we may retry the charge over a reasonable period via Stripe's standard retry logic. (b) If payment remains unsuccessful after a grace period of [BRACKETED: 7] days, we may suspend access to paid features and pause the subscription. We will notify you of the failure and the grace period. (c) No Credits accrue or refresh while a subscription is suspended for non-payment. (d) If payment is not restored within [BRACKETED: 14] days of suspension, we may terminate the subscription for cause. Amounts already due remain payable. This does not limit any mandatory consumer remedy.

13.6 Reversed payments and chargebacks

(a) Talk to us first. If you believe you were charged in error, contact [BRACKETED: support@ghostcreative.ai] before initiating a chargeback. (b) We may suspend an account only where a payment dispute is abusive or illegitimate (e.g. a chargeback raised in bad faith on Credits already consumed). We will not penalise a legitimate dispute and do not charge punitive chargeback fees. Where a chargeback or reversal is upheld because the charge was genuinely not authorised by you (true third-party fraud), we refund the purchase in full and do not penalise you. Where the payment processor's investigation concludes that you did authorise the charge, Credits already consumed remain consumed and Sections 13.10 and 13.11 apply.

13.7 Credit expiry and balances

(a) Top-Up (paid) Credits are valid for at least 36 months from purchase. We will give reasonable notice before any paid Credits would expire. Unused paid Top-Up Credits do not silently forfeit. If paid Top-Up Credits nevertheless expire unused despite our reminder, you may demand reimbursement of the amount paid for the unconsumed Credits within the statutory limitation period (§195 BGB); alternatively, at your request, we will re-extend their validity. The paid value of Top-Up Credits is never forfeited without this reimbursement route (see also 15.8(a)). (b) Plan Credits and free/bonus/promotional Credits may expire faster — at the end of the billing cycle, on a stated shorter horizon, or when the plan ends — as stated when granted. Free and bonus Credits carry no cash value and are not refundable. (c) Order of use. Where you hold more than one kind of Credit, Credits with the earliest expiry are used first. (d) No retroactive devaluation. We will not reduce the redemption value of Credits you have already purchased.

13.8 No cash value; refunds; mandatory consumer rights

(a) General rule. Except as required by mandatory law or as expressly stated in these Terms (including 13.7(a) and 15.8(a)), fees and Credits are non-refundable, and Credits already consumed in a generation under a valid waiver (Section 15.4(a)) are not refundable. (b) Statutory rights are unaffected. Nothing in this Section limits any mandatory right you have as a consumer, including: (i) the 14-day right of withdrawal (§§312g, 355 BGB) for distance contracts — see 13.9 and Section 15; (ii) statutory conformity/defect rights for digital products and services (§§327d–327r BGB), which we do not exclude or shorten for consumers; (iii) any MX consumer right under the LFPC (incl. the 5-day right, Art. 56), applicable to Mexican consumers regardless of the choice-of-law clause. (c) Goodwill refund (voluntary). As a goodwill gesture, separate from and without prejudice to your statutory rights, we may offer a [BRACKETED: 7]-day refund on a first purchase where no Credits have been used. This is voluntary, may be changed or withdrawn, and is not a substitute for any statutory right. (d) Pro-rata refund on our side. If we discontinue the Service, materially reduce a paid feature you rely on, or fail to deliver a paid generation (and do not restore the Credit), you may cancel and receive a pro-rata refund of prepaid fees and a restoration or refund of affected paid Credits, as your sole remedy for that event (without limiting Section 17 for fault-based claims; §326 BGB). A "material reduction of a paid feature" includes a material, lasting degradation of the quality, variety, or capability of a paid generation feature — for example through a change of the underlying generation model (see Sections 6.3 and 12) — but not minor or temporary fluctuations inherent in probabilistic AI systems.

13.9 Withdrawal and the three purchase types (consumers)

Your statutory 14-day withdrawal right works differently for the three things you can buy here. Full mechanics, including the exact checkbox wording and your protections if a waiver is invalid, are in Section 15.4. (a) Generations (digital content). Generated content is digital content delivered immediately on demand. Before a Credit-consuming generation begins, you are asked — by a separate, un-pre-ticked checkbox at the point of generation — to expressly consent to immediate performance and to acknowledge that you thereby lose your withdrawal right for that generated content (§356(5) BGB; Art. 16(m) Directive 2011/83/EU). The consent is logged and confirmed on a durable medium. Without a valid waiver, you owe nothing for delivered content (§357(9) BGB). (b) Subscriptions (digital service). The subscription itself — platform access and periodic Allowance Credits — is a digital service, not digital content. The generation waiver does not extinguish withdrawal from the subscription. If you ask us, by a separate express request, to begin the subscription during the withdrawal period and then withdraw within 14 days, you receive a refund less pro-rata compensation for the period already provided (§356(4), §357a BGB) — see 15.4(b). (c) Top-Up Credit packs (prepaid value). Crediting your account with a purchased Credit pack is not the supply of digital content, and no withdrawal waiver attaches to the pack purchase itself. If you withdraw within 14 days, the price is refunded, less the value of generations you had already requested under (a) — see 15.4(c). (d) The consents in (a) and (b) are captured by separate, un-pre-ticked checkboxes, never bundled with each other or with general Terms acceptance, logged with timestamp and text version, and confirmed on a durable medium.

13.10 Fraud claims and chargeback defence

(a) A chargeback, payment reversal, or fraud claim filed with your payment processor (Stripe, your bank, or your card issuer) asserts that the transaction was not authorised, was fraudulent, or was processed in error. It is a payment-system dispute — it is not an exercise of your statutory withdrawal right, and your withdrawal right (Section 15) is not needed for, and is not consumed by, a genuine fraud claim. (b) We cooperate fully with every payment-processor investigation. Where the investigation concludes the charge was genuinely not authorised by you, we refund in full (13.6(b)) and no disadvantage attaches to you. (c) Where the investigation concludes that you did authorise the charge: Credits consumed under a valid generation waiver (15.4(a)) remain consumed; we may suspend the account pending resolution of repeated or plainly contradictory disputes; and we may treat a dispute as abusive under 13.6(b) where you simultaneously assert both a valid contract (withdrawal) and no authorisation (fraud) for the same charge. (d) Where your conduct under (c) causes us a documented, actually-incurred chargeback fee or recovery cost, you are responsible for it on the terms, and subject to the carve-outs, consumer limitations, and fault-proportionality, of Section 18 (in particular 18.3 and §254 BGB). We never charge punitive or lump-sum dispute fees.

13.11 Concurrent withdrawal and chargeback (no double recovery)

(a) If you exercise a withdrawal right (Section 15) and also file a chargeback or fraud claim for the same charge, we will honour the withdrawal as the primary route: we refund as the law requires (within 14 days, same payment method, §357 BGB). (b) We will inform the payment processor of the withdrawal and our refund and ask that the parallel chargeback be closed, so the same amount is not reversed twice. You agree to cooperate by withdrawing the duplicate claim once our refund is made. (c) If, after our refund, you nonetheless maintain the duplicate chargeback and the charge is reversed a second time, you must repay the doubly-recovered amount; a documented chargeback fee we incur because you maintained the duplicate claim is recoverable on the terms of 13.10(d). Neither party may recover the same loss twice — in either direction.

SECTION 14 — SUBSCRIPTIONS, RENEWAL & CANCELLATION

In short — Section 14: Your plan renews automatically each billing cycle until you cancel; before each renewal charge we send consumers a reminder with the price, the date, and how to cancel; you can cancel any time from your dashboard or our one-click cancellation button (no login needed); upgrades apply right away and downgrades at your next cycle; plan-included Credits reset or lapse each cycle while separately purchased Credits keep their own longer life; and we only ever change prices going forward, with advance notice and a free exit. These Terms are valid for consumers by default — for genuine business customers a stronger "business ratchet" applies where the law allows.

14.1 Plans, term and who you are. (a) Subscriptions are recurring plans billed in advance for a fixed billing cycle ([monthly] or [annual], as selected at checkout). (b) The minimum initial term equals the billing cycle you select. After the initial term the subscription continues for an indefinite period and is cancellable as set out in 14.5. (c) Consumer-default rule. These Terms are drafted to be valid for consumers (§13 BGB) by default. Where a clause in this Section would, for a consumer, exceed a mandatory limit, the mandatory consumer rule applies and the rest of the clause stays valid (§306 BGB). Stronger terms apply only to the extent you are genuinely a business (§14 BGB) — the business ratchet at 14.9. (d) For consumers, any initial fixed term is ≤24 months (§309 Nr. 9 lit. a BGB; we offer 1 or 12 months). After the initial term the contract continues indefinitely and is cancellable monthly — it never renews into a fresh fixed term. [OPERATOR NOTE: §309 Nr. 9 BGB caps a consumer's initial fixed term at 24 months, the post-term tacit extension at "indefinite, monthly-cancellable," and the cancellation notice at 1 month. Do not configure any consumer plan that exceeds these — an over-broad term is struck in full (§306, no geltungserhaltende Reduktion) and replaced by the statutory default.]

14.2 Automatic renewal (transparency). (a) Unless cancelled before the end of the then-current billing cycle, your subscription renews automatically at the end of each cycle, and the then-applicable fee for the next cycle is charged to your stored payment method. (b) For consumers, renewal after the initial term produces a contract of indefinite duration, terminable monthly (14.5) — never a new fixed term (§309 Nr. 9 lit. b/c BGB). For business customers, renewal is for one further billing cycle of the same length on a rolling basis. (c) Before you commit to a paid subscription, the price, billing cycle, renewal mechanism and how to cancel are presented in clear language directly adjacent to the order button, and you confirm via a button labelled "zahlungspflichtig bestellen" (§312j(3) BGB). There are no pre-ticked add-ons (§312a(3) BGB). Where the law applicable to you requires separate affirmative consent to automatic renewal (e.g. U.S. state auto-renewal statutes such as Cal. Bus. & Prof. Code §17602), that consent is captured as a distinct, clearly labelled step at checkout, separate from general Terms acceptance. (d) Pre-renewal reminder. For consumers, we send a reminder to your account email before each renewal charge, stating the price, the billing cycle, the date of the upcoming charge, and how to cancel, with a direct link to the cancellation mechanism. The reminder is sent at least [BRACKETED: 3] days and at most [BRACKETED: 30] days before the charge, and in any event within any window mandated by the law applicable to you (e.g. Cal. Bus. & Prof. Code §17602(e) and equivalent U.S. state statutes; Canadian provincial rules). For Quebec consumers, the reminder and the entire cancellation path are provided in French (see the Canada Addendum and Section 24.10). Where applicable law makes the reminder or any associated right non-waivable, no term of these Terms waives or limits it. [OPERATOR NOTE: This replaces the earlier permissive "where applicable law requires" formulation — under Cal. ARL §17602 a permissive reminder clause fails outright, waivers are void (§17602(h)) and class waivers do not reach ARL claims. The reminder emails (incl. the French version for Quebec) must actually be implemented and logged BEFORE these Terms go live; retain proof (timestamp, language, content) per consumer. Drafting+code pair — text may only go live with the feature.]

14.3 Upgrades. (a) You may upgrade to a higher plan at any time, effective immediately. (b) On upgrade, the price difference for the remainder of the current cycle is charged pro-rata, and your renewal date and any included Credit allowance adjust to the new plan from that point. (c) Credits included with the higher plan are made available for the remainder of the cycle per Section 13 and 14.6.

14.4 Downgrades. (a) A downgrade takes effect at the start of your next billing cycle, not immediately; you retain your current plan and allowance until the current cycle ends. (b) From the effective date, the lower plan's fee and allowance apply. (c) We do not refund the difference between plans for the current cycle on a downgrade, because you keep the full higher-tier service for the cycle you already paid for. This does not affect statutory withdrawal, conformity-defect, or operator-fault refund routes.

14.5 Cancellation, notice periods, and the cancellation button (§312k BGB). (a) How to cancel. You may cancel: (i) any time from your account dashboard; and (ii) for any subscription entered into electronically, via the cancellation button ("Verträge hier kündigen") that we provide. The button is permanently and easily legible, reachable directly and without logging in, leads to a confirmation page (a second confirming button labelled "jetzt kündigen"), and on submission we send confirmation of the cancellation, its content and effective date in text form (Textform) to your email without undue delay (§312k Abs. 2–4 BGB). For Quebec consumers, the cancellation interface and the confirmation are provided in French, and cancelling is no harder than subscribing (see the Canada Addendum). [OPERATOR NOTE: §312k BGB applies to any contract concluded electronically with a consumer for a continuing obligation; non-compliance lets the consumer terminate at any time without notice (§312k Abs. 6 BGB). The button must be on the website where the contract is concluded and must not require login. This is non-excludable — keep the live UI (including the French path for Quebec) in sync with this clause.] (b) Notice / effect. After the initial term, a consumer may cancel at any time with effect to the end of the current month (§309 Nr. 9 lit. c BGB — max. 1-month notice on the indefinite contract). For a fixed initial term, ordinary cancellation takes effect at the end of the initial term unless you cancel earlier with effect after that term; the subscription does not renew where cancelled in time. (c) Effect of cancellation. On the effective date, recurring billing stops and the subscription does not renew. Unless terminated for cause under Section 22, you keep access to the paid plan (and its included allowance) until the end of the cycle you have already paid for; we do not pro-rate or refund the running cycle on an ordinary user-initiated cancellation. Extraordinary termination for good cause (§314 BGB) by either party remains unaffected.

14.6 Effect of subscription changes on Credits. (a) Allowance Credits (Plan Credits) included as part of a subscription fee refresh each cycle and lapse at the end of the billing cycle in which a cancellation or downgrade takes effect (see (c) and (d)); they never lapse mid-cycle for a period you have already paid for, except where mandatory law requires otherwise. Separately purchased Top-Up Credits are NOT part of the subscription and are governed by Section 13 and 15.8, including their longer validity, reimbursement and refund rules. (b) On upgrade, your allowance refreshes/adjusts to the higher plan from the upgrade date (14.3). (c) On downgrade, the lower plan's allowance applies from the next cycle; Allowance Credits already granted for the current cycle remain usable until cycle end (14.4). (d) On cancellation, Allowance Credits remain usable until the end of the paid cycle and then lapse; Top-Up Credits are unaffected by the subscription ending and remain subject to Section 13 and 15.8. (e) Credit-consuming generations are subject to the separate withdrawal-waiver consent (§356 Abs. 5 BGB) captured before the generation (Section 15.4(a)); nothing in this Section overrides your statutory withdrawal or conformity rights.

14.7 Price changes. (a) We may change subscription fees with effect for future billing cycles only. Paid cycles, already-granted Credits, and generated content are never repriced retroactively. (b) We will notify you at least [30] days in advance (business customers: [6 weeks]) by email and/or in-app, surfacing the change clearly and stating that it takes effect only if you do not cancel. (c) The change takes effect from your next renewal after the notice period. If you do not accept it, you may cancel before it takes effect (via the dashboard or the §312k button), with no fee for any cycle beginning after the effective date; unused Top-Up Credits remain governed by Section 13 and 15.8. For consumers, silence is not deemed consent to a price change (see Section 23; §308 Nr. 5 BGB). [OPERATOR NOTE: A clause that treats a consumer's silence as acceptance of a price/term change is void under §308 Nr. 5 BGB unless the strict notice-and-highlight conditions are met; the safe design is "change applies only if the consumer does not cancel before the effective date," which is what (c) implements.]

14.8 No business-only gate; status is by fact. We serve both consumers and businesses. We do not condition access on a declaration that you are a business, and a self-declared "I am a business / I act for purposes of my trade" checkbox is evidence of your status, not a conversion of it (§309 Nr. 12 BGB bars shifting the burden of proof onto you; a clause designed to circumvent consumer protection is void under §306a BGB). Your legal status is determined by the facts of your use (§§13, 14 BGB), not by the price you pay or a box you ticked.

14.9 Business ratchet (business customers / Unternehmer only). To the extent — and only to the extent — that you genuinely contract as an entrepreneur (§14 BGB), the following stronger terms apply in addition and override the consumer-default settings above where they conflict: (a) no statutory right of withdrawal (Section 15.1); (b) renewal may be for a further fixed cycle of the selected length rather than an indefinite monthly-cancellable term; (c) the §312k cancellation-button mechanism is offered as a convenience but is not a mandatory entitlement; (d) price-change and notice periods are as stated for business customers. None of these business terms applies to a user who is in fact a consumer, regardless of any contrary checkbox.

14.10 Consumer savings clause (severability). If you are legally a consumer (§13 BGB), mandatory consumer-protection rules — including §§312j, 312k, 308 Nr. 5, 309 Nr. 9, 355–357a BGB, applicable EU law, and local mandatory law (e.g. PROFECO/LFPC for Mexico; PIPEDA and Quebec Law 25 / the Quebec Consumer Protection Act and Charter of the French Language for Canada; U.S. state auto-renewal statutes) — override any conflicting term in this Section to the extent legally required; the remainder stays valid (§306 BGB). No term here waives or shortens a statutory withdrawal right, a digital-content conformity right, a mandatory pre-renewal reminder, or the cancellation-button right.

SECTION 15 — WITHDRAWAL (WIDERRUF), CANCELLATION BUTTON & CREDITS

In short — Section 15: If you're a consumer you get the full EU 14-day right to cancel for no reason. You give that right up only piece by piece, with a separate, un-pre-ticked box for each thing: one for a generation (you lose the right only for that generated content), one for starting your subscription early (you can still withdraw, you just pay fairly for the days used), and never for a Credit pack — buying Credits alone never costs you your withdrawal right. We confirm every waiver by email and keep the proof. Goodwill refunds are extra and voluntary. Paid Top-Up Credits last at least 36 months, and if they expire unused you can demand your money back for the unused part; only free, bonus, or plan-included Credits can simply lapse.

15.1 Who has a withdrawal right. (a) The statutory right of withdrawal (gesetzliches Widerrufsrecht) under §§312g, 355 BGB exists for consumers (§13 BGB). We serve consumers — so this right is live for every user who is in fact a consumer, and these Terms are written to give it full effect. (b) (business customers / Unternehmer only) If you genuinely contract as an entrepreneur (§14 BGB), you have no statutory right of withdrawal, and sub-clauses 15.2–15.6 do not apply to you (business ratchet, Section 14.9). The voluntary goodwill policy in 15.7 remains available at our discretion. (c) A self-declared "I am a business" checkbox is evidence of business use but is not legally dispositive (§309 Nr. 12 BGB; circumvention void under §306a BGB). If you are in fact, or a court finds you to be, a consumer, the consumer provisions below govern and the remainder of these Terms stays valid (§306 BGB).

15.2 Your 14-day right of withdrawal (Widerrufsrecht — consumers). As a consumer, you may withdraw from your contract within 14 days without giving any reason. The period is 14 days from the day the contract was concluded (for a pure service/digital-content contract). To exercise it, inform us by a clear statement (e.g. a letter by post or an e-mail) of your decision to withdraw. You may use the model withdrawal form set out in Annex [Y] (Muster-Widerrufsformular), but this is not mandatory. To meet the deadline, it is sufficient to send your communication before the period expires. Contact for withdrawal: [Jan Stoltenberg, Einzelunternehmen Ghost Creative, full ladungsfähige Anschrift], e-mail [widerruf@ghostcreative.ai]. (The legally binding Widerrufsbelehrung under Art. 246a §1 Abs. 2 EGBGB (Anlage 1), in the binding contract language, together with the Muster-Widerrufsformular (Anlage 2), must be inserted here and confirmed on a durable medium per §356 Abs. 3 / Art. 246a EGBGB.) In addition to the statutory minimum, the Belehrung describes in plain language how the withdrawal right can be lost for generations under 15.4(a) — the separate, un-pre-ticked checkbox, its wording, and the durable-medium confirmation — and states expressly that the loss covers only the generated content, never the subscription or unused Credit value (15.4(b)–(c)). [OPERATOR NOTE: A missing or defective Widerrufsbelehrung extends the withdrawal period to 12 months and 14 days (§356 Abs. 3 S. 2 BGB / Art. 246a EGBGB). The Belehrung text and the model form are mandatory fill-ins before launch and must be confirmed on a durable medium (sent with the order-confirmation email, not merely linked). Do NOT publish any version of these Terms with this — or any — [BRACKETED] placeholder unfilled: a live placeholder is itself evidence of a missing Belehrung and hands every consumer the extended withdrawal period. The attorney must select the correct Anlage-1 variants and Gestaltungshinweise for this mixed digital-content / digital-service model (15.4) before launch.]

15.3 Effects of withdrawal. If you withdraw in time, we will reimburse all payments received from you that the withdrawal covers (see 15.4 and 15.5) without undue delay and at the latest within 14 days of receiving your withdrawal notice, using the same means of payment you used originally unless we expressly agree otherwise with you; in no case will you be charged any fees for the reimbursement. No processing fee or percentage deduction is withheld (§357 BGB).

15.4 Early performance and the withdrawal right — three separate tracks (Art. 16(a)/(m) Dir. 2011/83/EU; §§356, 357, 357a BGB). The Service involves three different purchase types, and your withdrawal right works differently for each. The consents below are captured by separate, un-pre-ticked checkboxes — one per track — never bundled with each other or with general Terms acceptance (§312a Abs. 3 BGB). Each consent is logged with timestamp, text version and checkbox state, and each is confirmed to you on a durable medium (email quoting the exact text you accepted) before or immediately upon performance beginning; we retain these logs and confirmations for at least [BRACKETED: 3] years. (a) Generations — digital content (§356 Abs. 5 BGB). Generated content (images, carousels, stories, videos) is digital content not supplied on a tangible medium. Your withdrawal right in respect of a generation expires once we begin to supply it, provided that before that supply you have: (i) expressly consented that we begin performance before the end of the withdrawal period; and (ii) acknowledged that you thereby lose your right of withdrawal for that content as soon as generation begins; and (iii) received our confirmation of (i) and (ii) on a durable medium. This consent is captured at the point of generation, before any Credit-consuming generation begins, by a separate, un-pre-ticked checkbox with wording substantially as follows:

"I expressly request that Ghost Creative begin generating my content immediately. I understand and acknowledge that I lose my 14-day right of withdrawal for the content generated and the Credits consumed for it once generation begins." Without a valid waiver, §357 Abs. 9 BGB applies and you owe nothing for digital content already delivered. This waiver covers only the generated content — it never extends to the subscription (track (b)) or to a Credit-pack purchase (track (c)). (b) Subscriptions — digital service (§356 Abs. 4, §357a BGB). The subscription itself — ongoing platform access and the periodic Allowance Credits — is a digital service supplied over a period, not digital content; the waiver in (a) does not apply to it. If you wish to use the Service during the withdrawal period, we capture a separate express request, by its own un-pre-ticked checkbox, with wording substantially as follows: "I request that Ghost Creative begin providing my subscription (platform access and included Allowance Credits) immediately. I understand that I may still withdraw from the subscription within 14 days; if I do, I owe fair pro-rata compensation for the period already provided at my request, and any content I separately asked to be generated is governed by the generation waiver." If you withdraw from the subscription within 14 days, we refund the subscription fee less pro-rata compensation (Wertersatz) for the part of the billing cycle during which the service was provided at your express request (§357a BGB). Your withdrawal from the subscription never depends on whether you spent Allowance Credits; content already generated under a valid waiver in (a) is not reimbursed. Withdrawal is exercised by a clear declaration (15.2); the §312k cancellation button (Section 14.5) additionally covers ordinary cancellation at any time. (c) Top-Up Credit packs — prepaid value (no waiver). Purchasing a Top-Up Credit pack credits a prepaid balance to your account. Crediting that balance is not the supply of digital content within the meaning of §356 Abs. 5 BGB, and no waiver of your withdrawal right attaches to the pack purchase itself — we do not ask for one. If you withdraw from a Top-Up purchase within 14 days, we refund the purchase price, less the value attributable to generations you had already expressly requested under (a) (calculated pro-rata at the per-Credit price of that pack). Unused Credits from the withdrawn pack are cancelled upon refund. [OPERATOR NOTE: The three tracks are deliberately separate. One bundled checkbox covering subscription + Credits + generations is void (§307(1) S. 2, §305c(2) BGB) and exposes the full fee to refund; the earlier "make my Credits available immediately = loss of withdrawal" theory for credit packs is abandoned as indefensible. All three §356(5) conditions in (a) are cumulative — if any is missing, the waiver fails entirely and §357(9) BGB bars charging for delivered content; there is no partial or reduced version (§306 BGB, no geltungserhaltende Reduktion). The checkbox must never be pre-ticked or appear pre-selected by default. Keep the live checkout and generation UI exactly aligned with this clause; the consent logs and durable-medium confirmation emails are the operator's only proof and must exist BEFORE launch.]

15.5 Partial use — what is reimbursed. Where you withdraw in time: (a) the withdrawal does not undo generations whose withdrawal right validly expired under 15.4(a); their value is not reimbursed; (b) it does cover the subscription service and unspent prepaid value: we reimburse the subscription fee pro-rata for the unused remainder of the cycle (15.4(b)) and the price attributable to unconsumed Top-Up Credits (15.4(c)); (c) "consumed" in this Section always means consumed in a generation under a valid 15.4(a) waiver — never merely "credited to the account" or "falling within a started billing cycle." Any ambiguity in this allocation is resolved in your favour.

15.6 Other markets (consumers). (a) Mexico. Mexican consumers have a separate 5-day cancellation right under Art. 56 LFPC, set out in the dedicated ES-MX clause; this applies regardless of the choice-of-law clause. The EGBGB Widerrufsbelehrung does not satisfy LFPC — a parallel Spanish-language (ES-MX) disclosure is required and is binding for Mexican consumers. (b) Canada. Provincial consumer-protection statutes may grant cancellation/cooling-off rights for certain distance or future-performance contracts; those mandatory rights apply to Canadian consumers regardless of the choice-of-law clause. For Quebec consumers, the consumer-facing disclosures and this withdrawal information must also be provided in French (Charter of the French Language, as amended by Bill 96; Quebec Consumer Protection Act), and the French version governs the consumer relationship in Quebec. Privacy disclosures are additionally governed by Law 25. [OPERATOR NOTE: MX requires a standalone ES-MX aviso/disclosure; Quebec requires a French version of consumer-facing terms and this withdrawal notice. These are mandatory localizations, not translations of convenience — produce them before serving those markets.]

15.7 Voluntary goodwill refunds (NOT a statutory right). Separately from, in addition to, and without prejudice to any mandatory statutory right (withdrawal under this Section, or remedies for non-conformity under Section 16), we may offer — at our sole discretion and purely as a voluntary goodwill gesture — a refund of a Credit or subscription purchase where all of the following apply: (a) the request is made within [7] days of purchase; (b) it is the first purchase on your account; and (c) no Credits from that purchase have been consumed. This voluntary policy creates no legal entitlement, does not limit, replace, shorten or count against your statutory rights, and may be amended or withdrawn for future purchases on notice. Where you hold a statutory right (e.g. valid withdrawal, or an operator-fault refund under 13.8/Section 16), that statutory route always takes precedence and is never displaced by this goodwill policy.

15.8 Validity of Credits (credit expiry — within §307 BGB limits). (a) Top-Up / separately purchased Credits remain valid for at least 36 months from purchase. We send a reminder notice before any such Credits would expire. Unused, paid Top-Up Credits do not silently forfeit. If paid Top-Up Credits expire unused despite our reminder, you may demand reimbursement of the amount paid for the unconsumed Credits within the statutory limitation period (§195 BGB); alternatively, at your request, we will re-extend their validity. The paid value of Top-Up Credits is never forfeited without this reimbursement route. (b) Subscription allowance Credits (Plan Credits) are granted per billing cycle and may expire at the end of the cycle or lapse on termination of the subscription, as clearly stated at purchase, because they are an included periodic benefit rather than a separately paid item. (c) Free, bonus or promotional Credits may carry a shorter, separately stated expiry and may lapse on the stated date or on account termination; they carry no cash value and are not refundable. (d) Credits are a single-purpose prepaid unit redeemable solely for our services; they have no cash value and are not refundable except where this Section, Section 16, Section 6.3 / 13.8, or mandatory law requires. Forfeiture of separately paid Top-Up Credits is enforceable only where we terminate immediately for your serious, non-curable breach (Section 22.5(b)) or for a breach of the absolute prohibitions in Section 11.2 — never on operator convenience, never on a mere suspension, and never on lapse of an unreasonably short period. Where we suspend the account, or terminate other than for such user-fault cause, paid Top-Up Credits remain usable or are reimbursed pro-rata (Section 13.8(d)). [OPERATOR NOTE: An expiry clause on prepaid, separately paid value is measured against §307 BGB (unreasonable disadvantage) — the German Gutschein/Telefonkarten case law lets redeemability end but not the uncompensated forfeiture of paid value; silence on restitution would be filled against the operator. (a) therefore states the restitution route expressly (the chosen path; do not revert to silence). The ≥36-month floor for paid Top-Up Credits is the calibrated safe position; shorter expiries are defensible only for free/bonus/periodic-allowance Credits the consumer did not separately pay for.]

SECTION 16 — WARRANTIES & STATUTORY RIGHTS (GEWÄHRLEISTUNG)

In short — Section 16: We promise the tool works as described and we keep it updated; we do not promise any individual AI result is accurate, unique, non-infringing, or copyrightable — you must check Outputs before you use them. If a paid generation fails we re-grant the credits or refund pro-rata. Businesses get a 12-month, cure-first warranty — plus a real promise that, within your own account, meaningfully different inputs produce meaningfully different outputs. Consumers keep their full, non-waivable statutory digital-product rights under §§327 ff. BGB; and we never exclude liability for injury, intent/gross negligence, fraud, guarantees, or product liability.

16.1 Agreed quality of the Service (Beschaffenheit)

16.1.1 The Service is an AI-assisted content-generation tool. The agreed quality of the Service includes, in particular, that it makes generative AI models available to you and lets you submit inputs and receive machine-generated outputs ("Outputs") through the features described on https://ghostcreative.ai and in your active plan, with availability and updates as set out in 16.4.

16.1.2 You acknowledge and agree that, as an essential characteristic of the Service, Outputs are produced by probabilistic third-party AI models (currently fal.ai / ByteDance Seedance and Seedream, OpenAI, and Anthropic). The agreed quality therefore expressly does not include, and we do not warrant, that any Output will be: (a) accurate, complete, or fit for any particular commercial purpose; (b) unique — other users may receive identical or similar Outputs from identical or similar inputs; (c) free of third-party rights, non-infringing, or protectable by copyright or any other IP right; or (d) reproducible on repetition. Outputs must be independently reviewed and cleared by you before any commercial use or publication. The non-uniqueness characteristic in (b) addresses, in particular, similarity across different accounts; for business customers, substantive variation within your own account is separately governed by the limited warranty in 16.2.2(e). For consumers, this negative deviation from objective conformity binds only where it has been separately disclosed before contract conclusion and expressly and separately agreed at checkout (§327h BGB) — see the separate acknowledgment described in 16.1.4; absent that separate consent, this 16.1.2 binds business customers only.

16.1.3 The characteristics in 16.1.2 describe the agreed nature of the Outputs themselves. They are not a disclaimer of the Service's own conformity (16.3) and shall not be read as one.

16.1.4 Separate consumer acknowledgment. For consumers, the deviations in 16.1.2 are presented as a distinct, separately-ticked acknowledgment at checkout ("I understand AI outputs may not be unique, may resemble others' work, and may not be protectable"), logged with timestamp and text version. This Section 16.1.2 is effective against a consumer only in conjunction with that separate consent.

16.2 Warranties for business customers (business customers / Unternehmer only — §14 BGB)

16.2.1 This Section 16.2 applies only where you are an entrepreneur (§14 BGB) and the contract is part of your trade, business, or profession. Where you are a consumer, Section 16.3 applies instead (see the saving clause in 16.5).

16.2.2 Toward business customers, our statutory warranty obligations (Mängelhaftung) are modified as follows. Where any modification conflicts with mandatory law, it is not applied; in its place the statutory rule applies (§306(2) BGB): (a) Cure first. On a verified defect in the Service, our liability is, at our choice, limited in the first instance to subsequent performance (Nacherfüllung) — re-supply, repair, or, for a failed paid generation, re-grant of the credits consumed. You must grant us a reasonable period and at least two attempts to cure. (b) Notice of defects. Obvious defects must be notified in text form without undue delay after they become apparent; §377 HGB applies only to genuine one-off commercial deliverables (Handelskauf), not to the continuous digital service. (c) Limitation period. Warranty claims of business customers expire twelve (12) months after the relevant performance, save where a longer mandatory period applies. This 12-month period does not apply to claims under Section 16.6 (life/body/health, intent, gross negligence, guarantee, ProdHaftG), for which the statutory limitation periods apply. (d) Quality guarantees. No statement, sample, or marketing material constitutes a guarantee of quality (Beschaffenheitsgarantie) or durability unless we have expressly designated it as such in writing. (e) Within-account variation (limited warranty). We warrant to business customers that the Service is configured to produce substantively different Outputs within the same account where the material inputs differ substantively (different prompts, seeds, source assets, or briefs). Identical or near-identical inputs may legitimately yield identical or near-identical Outputs, and similarity to Outputs generated for other accounts is not a defect (16.1.2(b)) — cross-account non-collision is not feasible in a shared-model environment and is not warranted. You may, however, notify as a defect (Mangel) an Output that is materially identical to an earlier Output in your own account despite substantively different inputs; notify us in text form within [BRACKETED: 10] business days of discovery. The remedy follows (a): first, re-grant of the Credits consumed (Nacherfüllung — with a changed seed or model version where available); where cure fails, is refused, or is unreasonable, price reduction (Minderung) or a pro-rata refund for the affected generations. (f) Separate acknowledgment of probabilistic limits (business customers). The characteristics in 16.1.2(a)–(b) are additionally surfaced to business customers as a visibly distinct acknowledgment at sign-up or plan upgrade ("I understand AI Outputs may resemble each other or existing works; Ghost does not warrant uniqueness across accounts; I remain responsible for clearing Outputs before use"), logged with timestamp and text version. The absence of this acknowledgment does not by itself invalidate 16.1.2 toward a business customer; the acknowledgment is our standard surfacing practice and evidence of it.

16.2.3 Any further warranty liability toward business customers is excluded, subject always to the carve-outs in 16.6. Liability for defects remains governed by, and limited under, Section 17.

16.3 Statutory rights for consumers (Verbraucher) — digital products, §§327 ff. BGB

16.3.1 If you are a consumer (§13 BGB), the statutory conformity regime for digital products under §§327–327u BGB (implementing Directive (EU) 2019/770) applies in full and cannot be excluded, limited, or shortened by these Terms. Nothing in Section 16.1 or 16.2 reduces these rights.

16.3.2 In particular, as a consumer you are entitled to: (a) a Service that meets the subjective requirements agreed in your contract and plan and the objective requirements of §327e — including fitness for its usual purpose, the usual quality you may reasonably expect, and supply in the most recent version available at contract conclusion unless agreed otherwise; (b) updates — including security updates — necessary to keep the Service in conformity, for the period you may reasonably expect (§327f). This update duty cannot be waived; (c) remedies for non-conformity under §§327i–327o, in the statutory order: first subsequent performance (Nacherfüllung) within a reasonable time; and, where that fails, is refused, or is unreasonable, the right to terminate or reduce the price (Minderung), with any refund due; (d) the burden-of-proof reversal under §327k.

16.3.3 Where the Service is supplied continuously over a period, the conformity and update duties apply throughout that period (§327f(1)).

16.3.4 These statutory rights exist alongside — and are not replaced by — any voluntary goodwill we may offer.

16.4 Service availability and the conformity baseline

16.4.1 We provide the Service with commercially reasonable effort. We do not warrant uninterrupted or error-free availability on standard plans; any service-level commitment applies only where expressly agreed in writing for a specific plan.

16.4.2 Where a defect or a verified extended outage means a paid generation is not delivered or is delivered defectively, your remedy is re-grant of the credits consumed or, where credits cannot reasonably be restored, a pro-rata refund of the corresponding fees (§326 BGB). For consumers, this is in addition to and does not limit the statutory remedies in 16.3. This mechanism is coordinated with Sections 6.3, 13.8 and 22.6.

16.5 Consumer-priority saving clause

16.5.1 If you are, or a court classifies you as, a consumer (§13 BGB), the mandatory consumer rules in 16.3 and under applicable law override any conflicting provision of Sections 16.1 and 16.2, but only to the extent legally required; the remaining provisions of this Section stay valid (§306 BGB). A representation that you act as a business is evidence of your status but does not convert you into a business or waive consumer protections.

16.5.2 For consumers resident in Mexico, the mandatory provisions of the Ley Federal de Protección al Consumidor (LFPC / PROFECO) apply additionally and prevail over any conflicting term to the extent required by Mexican law. [BRACKETED: confirm MX-specific defect/garantía wording in the ES-MX version.]

16.6 Non-excludable liability (mandatory carve-outs)

Nothing in this Section limits or excludes any liability that cannot be limited or excluded by law, including liability: (a) for injury to life, body, or health caused by our negligence or that of our legal representatives or agents; (b) for intent or gross negligence, including that of our legal representatives and Erfüllungsgehilfen (§278 BGB); (c) for fraudulently concealed defects or where we have given an express guarantee (§444 BGB); (d) under the Produkthaftungsgesetz and Directive (EU) 2024/2853; and (e) under any other mandatory statutory provision. These carve-outs apply to both business and consumer customers.

SECTION 17 — LIMITATION OF LIABILITY (HAFTUNGSBESCHRÄNKUNG)

In short — Section 17: If we act intentionally or grossly negligently, harm someone's life or health, give a guarantee, or are caught by mandatory product-liability, consumer, or data-protection law, we pay in full — no cap. For ordinary slip-ups we only owe you for breaking the core promises of the contract — keeping the generator running, not destroying your stored content, and protecting your personal data — and, except for data-protection claims the law itself governs, only up to the loss that was foreseeable and typical for a service like this. Beyond that — indirect losses, lost profit, data you didn't back up, outages at third-party AI providers — we are not liable. These rules are written to be valid whether you use Ghost as a consumer or as a business; nothing here cuts into the rights mandatory law gives you.

17.1 These limits apply to everyone, consumer and business alike. This Section is drafted to be valid against a consumer (Verbraucher, §13 BGB) by default. Where you genuinely qualify as a business (Unternehmer, §14 BGB), the additional business-ratchet terms in Section 17.12 apply on top. Nothing in this Section limits or excludes any liability that mandatory law does not permit us to limit or exclude. Any clause that conflicts with mandatory law is not applied; in its place the statutory rule applies (§306(2) BGB).

17.2 Unlimited liability (no exclusion, no cap). We are liable without limitation, against consumers and businesses alike, in each of the following cases: (a) for damage arising from intent (Vorsatz) or gross negligence (grobe Fahrlässigkeit) on our part or on the part of our legal representatives, employees, or other persons we use to perform our obligations (Erfüllungsgehilfen, §278 BGB); (b) for injury to life, body, or health (Leben, Körper, Gesundheit) caused by negligence of any degree on our part or by our legal representatives or Erfüllungsgehilfen (§309 Nr. 7a BGB); (c) under the German Product Liability Act (Produkthaftungsgesetz) and, once applicable to the Service, the EU Product Liability Directive (EU) 2024/2853; (d) to the extent we have given an express guarantee (Garantie) or fraudulently concealed a defect (arglistiges Verschweigen); and (e) wherever else mandatory statutory law — including mandatory consumer-protection law (§§327 ff. BGB), the Produkthaftungsgesetz, and the data-subject's own claim under GDPR Art. 82 — imposes liability that cannot be limited. [OPERATOR NOTE: 17.2(a)–(e) are uncappable as a matter of §309 Nr. 7a/b BGB and the ProdHaftG/PLD. Because the operator is an Einzelunternehmer with personal unlimited liability and no corporate shield (see Section 1.6), any realised liability under 17.2 reaches Jan Stoltenberg personally. Liability insurance sized to the foreseeable exposure of the face/biometric, deepfake, and AI-output features is the operative protection here — not contract drafting. Re-confirm coverage before launch and again before enabling higher-risk features.]

17.3 Liability for simple negligence — limited to essential duties only. For damage caused by simple (ordinary) negligence (einfache Fahrlässigkeit), we are liable only where we breach an essential contractual duty (Kardinalpflicht). An essential contractual duty is one whose fulfilment makes proper performance of the contract possible in the first place, and on whose observance you may regularly rely — for this Service, principally: (i) making the agreed core generation functionality available; (ii) not destroying or corrupting your stored content through our own fault; and (iii) implementing and maintaining appropriate technical and organisational measures to protect the personal data we process for you (Art. 32 GDPR). For simple-negligence breaches of any non-essential duty, our liability is excluded.

17.4 Scope of essential-duty liability — foreseeable, contract-typical damage; no fixed floor as a hard ceiling. Where we are liable under Section 17.3, our liability is limited to the damage that was foreseeable and typical for this type of contract (vorhersehbarer, vertragstypischer Schaden) at the time of contracting. We do not set a fixed monetary cap. The fees you paid in the twelve (12) months before the event are no more than an indication of the typical order of magnitude; they do not function as a maximum where the foreseeable, contract-typical damage is demonstrably higher. Compensation claims of data subjects under GDPR Art. 82 — which cover material and non-material damage — are statutory, cannot be waived or capped by these Terms, and are not subject to the limitation in this 17.4 (see 17.2(e)); for a contract whose subject matter includes the processing of personal data, damage from a culpable failure of the duty in 17.3(iii) is in any event foreseeable and contract-typical. [OPERATOR NOTE: Red-team fix applied per locked decision. Do NOT insert a fixed EUR comfort figure (e.g. "capped at the greater of €X or fees paid"). Under §307 BGB a fixed sum set below the foreseeable contract-typical damage is void with NO geltungserhaltende Reduktion (§306 BGB) — the whole limitation falls away and the personally-liable operator drops to uncapped liability. A numerical cap is only safe if (i) an attorney confirms it genuinely matches typical foreseeable damage and (ii) it is backed by liability insurance at that level. Leave this clause cap-free unless both conditions are met.]

17.5 Excluded categories (within the limits above). Subject always to Sections 17.2, 17.3, 17.4, and 17.6, and without limiting our liability for culpable destruction or corruption of your stored content as an essential duty under 17.3, we are not liable for indirect or consequential damage, lost profits, lost savings, loss of business or goodwill, or business interruption. This exclusion operates only inside the simple-negligence / non-essential-duty space and never reaches into Section 17.2.

17.6 Data loss and backups. The Service is not a backup or archiving service; you are responsible for keeping your own copies of your Inputs and Outputs. Subject to Sections 17.2–17.4, and without limiting our liability for culpable destruction or corruption of your stored content as an essential duty under 17.3, our liability for data loss is limited to the cost of recovery that would have arisen had you maintained appropriate, regular backups.

17.7 Third-party AI models and other dependencies. The Service relies on independent third-party providers (including fal.ai and the underlying ByteDance Seedance / Seedream models, OpenAI, Anthropic, Stripe, and our hosting and infrastructure providers). We are not liable for outages, rate-limiting, deprecation, changes, errors, or unlawful conduct of these providers beyond our own fault as set out in Sections 17.2–17.4, and we may substitute equivalent providers. This does not affect our liability for our own intent or gross negligence in selecting or integrating such providers, or any case in Section 17.2. The credit-restoration / pro-rata-refund remedy for paid-but-undelivered generations (Sections 6.3, 12.3(d), 13.8, 16.4.2) applies regardless of this limitation.

17.8 Nature of AI Outputs (no particular result owed). Liability is further shaped by the agreed nature of the Service: Outputs are generated by probabilistic AI models, are not warranted to be accurate, unique, original, or non-infringing, and a particular generation result is not owed. This is a description of what the Service is (Beschaffenheit), not an exclusion of liability, and it does not limit any liability under Sections 17.2–17.4 or any mandatory consumer conformity right (§§327 ff. BGB).

17.9 Extension to our people. The exclusions and limitations in this Section 17 also apply in favour of our legal representatives, employees, agents, and Erfüllungsgehilfen (including sub-processors), to the same extent and subject to the same carve-outs in Section 17.2 — in particular for their own intent and gross negligence (§278 BGB).

17.10 No reversal of the burden of proof. Nothing in this Section alters the statutory allocation of the burden of proof to your disadvantage (§309 Nr. 12 BGB).

17.11 Consumer-priority saving clause. Because this Section is valid for consumers by default, mandatory consumer-protection law prevails over anything here that conflicts with it, but only to the extent legally required; the remainder stays in force (§306 BGB). No attempt is made, and none should be read, to gate you out of consumer status by contract — your status is determined by fact under §§13/14 BGB, a circumvention of that status is void (§306a BGB), and we do not shift the burden of proving it onto you (§309 Nr. 12 BGB).

17.12 Business ratchet (business customers / Unternehmer only — §14 BGB; applies in addition where you genuinely qualify). If and to the extent you use the Service as an Unternehmer, the following apply on top of 17.1–17.11: (a) No reliance / specific use. We owe no liability for your reliance on Outputs for any particular commercial purpose, for fitness for a specific campaign, channel, or market, or for regulatory clearance of your published content; clearing each Output for your use is your responsibility (Sections 9.6, 10). (b) Tighter limitation window. Within the simple-negligence / essential-duty space of 17.3–17.4, liability remains limited to foreseeable contract-typical damage; for the avoidance of doubt, the carve-outs in 17.2 remain fully uncapped against businesses as well. (c) No widening of uncapped heads. This ratchet only narrows liability against businesses; it never expands our exposure beyond what 17.1–17.11 already provide, and it never touches 17.2. This ratchet does not apply to you to the extent you act as a consumer, and a court's later finding that you are a consumer simply disables this 17.12 without affecting the rest of Section 17.

SECTION 18 — INDEMNIFICATION BY YOU (FREISTELLUNG DURCH DEN NUTZER)

In short — Section 18: If someone comes after us because of what you uploaded, generated, shared, or did wrong — including false or defamatory claims your content makes about a person or business — you stand behind it: consumers repay our actual, necessary costs in proportion to their share of the fault, and businesses defend us fully. Either way, you never have to cover our own serious mistakes, harm to people, fines imposed on us for our own conduct, or our own legal duties as an AI provider or hosting platform — no matter who brings the claim. This is between you and us; it does not take away anyone else's right to sue us directly.

18.1 What you stand behind (covered claims) — applies to consumers and businesses. You shall indemnify Ghost Creative — meaning Jan Stoltenberg, Einzelunternehmer, trading as Ghost Creative — together with its employees, agents, Erfüllungsgehilfen, successors, and its named sub-processors and AI model providers (fal.ai / ByteDance Seedance and Seedream, OpenAI, Anthropic, and any successor providers in the Sub-Processor List), against any third-party claim, demand, action, regulatory proceeding, or proven loss (including reasonable legal fees on the German statutory scale, RVG, and court-awarded costs) to the extent it arises from your culpable conduct, namely: (a) your Inputs — any image, photograph, logo, brand asset, audio or voice recording, text, prompt, or website URL you upload, submit, or instruct us to process, including any material you uploaded as a "Winner" or comparison/reference asset (which must be your own material — see Sections 9 and 11); (b) your breach of your upload warranties (Section 9 — including your warranty that you hold all rights to every upload, the consent of every depicted person, and that no upload infringes a third party's copyright, trademark, or personality right), the Acceptable Use Policy (Section 11), or any other obligation under these Terms; (c) a claim that an Output infringes a third party's copyright, trademark, right of publicity, or personality right (Persönlichkeitsrecht / Recht am eigenen Bild, §22 KUG), to the extent the infringement is caused by an Input you supplied, a prompt you entered, or your particular use — and not by behaviour introduced independently by the AI model; (d) a claim brought by any identifiable person depicted in your Inputs or Outputs (e.g. under §22/§23 KUG, §201a StGB, §823/§1004 BGB, or GDPR Art. 82); (e) your distribution or publication of Outputs — including downloads, your own channels, lead capture, and public gift links (/g/<code>) — including any failure to label AI-generated or deepfake content as required by the EU AI Act, Art. 50(4); (f) your violation of applicable law, including data-protection (GDPR/BDSG; Mexico LFPDPPP; Canada PIPEDA / Québec Law 25), advertising and unfair-competition law (UWG), synthetic-media labelling, biometric-privacy law (e.g. BIPA/CUBI/RCW), and export-control or sanctions rules; (g) any claim arising from false, unsubstantiated, or defamatory statements of fact in your Inputs, your prompts, or in Outputs you publish or distribute — including claims under §824 BGB (Kreditgefährdung — injury to creditworthiness through false statements), §823 BGB, and statutory or common-law defamation, trade-libel, or business-disparagement rules — whether or not the affected person or business is depicted in the Output, to the extent the false statement is caused by your Input, your prompt, or your particular use, and not by behaviour introduced independently by the AI model that contradicts the materials you supplied.

18.2 How much you owe depends on your status — consumer (default) vs. business (ratchet). Sections 18.3 (consumers) and 18.4 (businesses) set out the two regimes. Your status is determined by fact under §§13/14 BGB, never by a checkbox; if a court treats you as a consumer, Section 18.3 governs and 18.4 does not apply.

18.3 Consumer regime — reimbursement, fault-proportionate (Verbraucher, §13 BGB) [default]. If you are a Verbraucher, you are not required to defend us or to take control of any proceeding. Instead, you shall reimburse us for the damages, settlement amounts, and reasonable legal costs we actually and necessarily incur as a result of a covered claim under 18.1, but only to the extent the claim was caused by your culpable (schuldhafte) breach, and in proportion to your share of responsibility (Mitverschulden, §254 BGB). Where the loss is partly attributable to us — including any failure of our own duties as processor, provider, or platform operator (see 18.5) — to the AI model's independent behaviour, or to a third party, your share is reduced accordingly. Settlement amounts are reimbursable only to the extent the settlement was reasonable and necessary in the circumstances (erforderlich); on request, we will substantiate that necessity. We will notify you promptly, give you a genuine opportunity to comment and to help limit the loss, and will not settle a claim attributed to you in a way that binds you without first consulting you. Nothing in this sub-clause shifts onto you the burden of proving your own status or fault (§309 Nr. 12 BGB).

18.4 Business ratchet — duty to defend (business customers / Unternehmer only — §14 BGB) [applies only where you genuinely qualify]. If and to the extent you use the Service as an Unternehmer, then in addition to 18.1 you will, on our written request, defend us against any covered claim under 18.1 and pay any final award, settlement, or reasonable cost. You may control the defence and settlement, provided that (i) you use qualified counsel, (ii) you do not enter any settlement that admits fault by, imposes any non-monetary obligation on, or fails to fully release Ghost Creative, without our prior written consent (not to be unreasonably withheld), and (iii) we may at our own cost participate with our own counsel. This duty-to-defend regime applies to businesses only; the mandatory carve-outs in 18.5 apply to it in full.

18.5 Mandatory carve-outs (what you never have to cover — consumers and businesses alike). Your obligations under 18.1–18.4 do not apply, and are reduced accordingly, to the extent a claim or loss results from: (a) our own intent or gross negligence, or that of our Erfüllungsgehilfen (§278 BGB); (b) injury to life, body, or health (§309 Nr. 7a BGB); (c) our own breach of mandatory law — including our own duties under the EU AI Act (e.g. Art. 50(1)/(2) provenance marking), our own notice-and-action and hosting duties under the DSA (in particular Art. 16) and §10 DDG, and, where we act as processor, our own obligations under Art. 28, 32, 33 and 34 GDPR (or, where we act as a controller or joint controller, our own controller obligations) — and any fine or penalty imposed on us for our own fault, in particular under GDPR Art. 83; (d) infringement introduced by the AI model itself and not traceable to your Input, prompt, or use; (e) liability under the Produkthaftungsgesetz / Product Liability Directive (EU) 2024/2853; (f) our fraudulent concealment (arglistiges Verschweigen) or any express guarantee (Garantie) we gave; (g) our own breach of a statutory or regulatory duty addressed to us as a platform or hosting operator — including any failure on our part to remove or disable manifestly unlawful content without undue delay despite actual knowledge (§823(2) BGB in conjunction with such duties; DSA Art. 16; §10 DDG). Such a breach is our sole responsibility and is never shifted to you through this Section. Where you and we are both at fault, your obligation is reduced pro rata to your share (Mitverschulden, §254 BGB). These carve-outs are mandatory and apply to the consumer regime (18.3) and the business ratchet (18.4) identically — and they apply regardless of who brings the claim: also where a regulator, a social-media platform, or another intermediary proceeds against us, you owe indemnity or reimbursement only for the share of the loss caused by your own culpable conduct under 18.1, and never for the consequences of our own provider-side or operator-side duties.

18.6 Data-protection recourse (GDPR Art. 82(5)). Where a data subject obtains compensation from us under GDPR Art. 82 for processing that you — as controller of third-party personal data in your Inputs/Outputs — caused or instructed, you shall reimburse us for your share of that liability under Art. 82(5). Art. 82 liability toward the data subject is statutory and cannot be waived or shifted by contract; only inter-party recourse for the user's own share is enforceable, and we cannot make you cover our own fault — including our own processor-duty breaches under Art. 32–34 GDPR — or our own Art. 83 fines (see 18.5(c)). [OPERATOR NOTE: This is the honest limit of the upload-warranty strategy (locked decision 1c). The user warranty in Section 9 + this indemnity shift risk as between Ghost and the user, but a third-party rightsholder or depicted person can still sue Ghost — the personally-liable operator — first and directly; §22 KUG, §823 BGB, and GDPR Art. 82 claims are not extinguished by these Terms (see 18.8). The operative front-line protection is the DSA/DMCA takedown process plus removing any UI/marketing copy that invites uploading third-party material ("competitor examples," "any photo from the web," etc.). Pre-upload consent warnings and an attestation step materially strengthen Ghost's §254 position in any Art. 82 recourse dispute — confirm the product and marketing contain no third-party-upload invitation, and that the pre-upload warning/attestation gates exist, before launch.]

18.7 Notice and cooperation. We will notify you in writing without undue delay after we become aware of a covered claim. A delay in notice reduces your obligation only to the extent the delay actually prejudiced your position. Both parties shall cooperate reasonably and take reasonable steps to mitigate the loss (§254 BGB).

18.8 No effect on third parties' direct claims. This Section shifts the consequences of the uploader's own wrongdoing onto the uploader; it does not extinguish, reduce, or waive any direct claim that a depicted person or other rightsholder has against Ghost Creative, who is not a party to these Terms. Such a third party may proceed directly against us under §22 KUG, §823/§1004 BGB, §824 BGB, GDPR Art. 82, or equivalent law regardless of this indemnity; our recourse against you then runs through this Section.

18.9 Third-party beneficiaries (business users only; no double recovery). The sub-processors and AI model providers named in 18.1 may invoke this Section as protected third parties (Vertrag mit Schutzwirkung zugunsten Dritter), solely for claims falling within 18.1 and solely against users who act as Unternehmer (§14 BGB); no protected third party may invoke this Section against a consumer. In aggregate, recovery by Ghost Creative and all protected third parties under this Section may not exceed the loss actually incurred; there is no double recovery.

18.10 Survival. This Section survives termination or expiry of your account and of these Terms.

SECTION 19 — DATA PROTECTION

In short — Section 19: Your data is governed by our Privacy Policy, DPA, Sub-processor List and Biometric Privacy Notice (linked here); we're the controller for our own account/billing data and your processor for the people-data in your uploads — you must have the rights and, for faces, the explicit consent of everyone shown. We detect that a face is present only to route it into safe handling: no faceprints, no recognition, and no AI training on face data by default — training can only ever happen on YOUR OWN face or voice, only if you give the separate, revocable opt-in in Section 8.9, and never on anyone else's. Face uploads are blocked for Illinois, Texas and Washington. Session analytics runs only after you consent through the cookie banner. If you appear in someone else's upload, you have your own rights against us (Section 19.10) even though you never signed anything — and nobody's mandatory data-protection rights or liabilities can be signed away here.

19.1 The governing documents. How we handle personal data is governed by, and you should read together with these Terms: (a) our Privacy Policy (https://ghostcreative.ai/privacy); (b) our Data Processing Addendum (DPA) [LINK]; (c) our Sub-processor List (published within the Privacy Policy, Section 12); and (d) our Biometric Privacy Notice [LINK]. Each is incorporated into these Terms by reference. By accepting these Terms you confirm you have read them.

19.2 Order of precedence. If there is a conflict on the handling of personal data, the order of priority is: (1) the DPA, (2) these Terms, (3) the Privacy Policy. Mandatory data-protection law overrides all of them where it applies.

19.3 Our roles. (a) We act as an independent controller (Art. 4(7) GDPR) for personal data we determine the purposes of ourselves — your account, login, billing, usage and product analytics, lead data, and our own service operation, as described in the Privacy Policy. (b) We act as a processor (Art. 4(8) GDPR) for personal data contained in the content you upload, submit, prompt with, or generate ("Customer Personal Data"), which we process on your documented instructions under the DPA. For that data you are the controller and you are responsible for having a lawful basis.

19.4 Your lawful-basis and consent warranty. You represent, warrant and undertake on an ongoing basis that, for all Customer Personal Data, you have a valid legal basis under Art. 6 GDPR (and, where applicable, Art. 9) and all consents, notices and rights required to have us and our subprocessors process it for the purposes of providing the Service — including AI generation, processing by third-party AI models located outside the EU/EEA, and any public sharing you choose to perform (e.g. gift links under Section 21). A contractual warranty cannot manufacture a GDPR lawful basis and does not extinguish a depicted person's direct claim against us (see Section 19.10).

19.5 Sub-processor authorization (Art. 28(2)/(4) GDPR). You give us your general written authorization to engage the subprocessors listed in the Sub-processor List (Privacy Policy, Section 12) and to add or replace subprocessors. We will: (a) impose data-protection obligations on each subprocessor that are no less protective than those in the DPA (Art. 28(4)); (b) give you at least [14] days' advance notice of any intended addition or replacement, by [updating the list / email / in-product notice]; and (c) where you have a reasonable, data-protection-based objection to a new subprocessor, work with you in good faith to find a reasonable alternative. Where no alternative is reasonably available, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for that part. This does not limit any mandatory data-protection right.

19.6 International transfers. Some subprocessors (including the third-party AI providers that perform generation, and analytics, payment and hosting providers) process personal data outside the EU/EEA, including in the United States and — for generation routed through fal.ai to ByteDance Seedance / Seedream models — via infrastructure with People's Republic of China-linked processing. The recipients, regions and the safeguard relied on for each (e.g. EU Standard Contractual Clauses, Art. 46 GDPR) are set out in the Sub-processor List (published within the Privacy Policy, Section 12, which is linked at the acceptance control) and the DPA [BRACKETED — build dependency: the DPA must be live and linked at the acceptance control before it is treated as incorporated. Note 2026-07-11: the standalone /subprocessors page was retired; the Sub-processor List is now the recipients overview in Privacy Policy §12]. Do not upload Customer Personal Data unless you accept these transfers and have any consent or other basis they require (Art. 44–49 GDPR). For routine, systematic transfers SCCs + transfer-impact assessment are the primary mechanism; Art. 49(1)(a) consent is only a subsidiary route (EDPB 2/2018).

19.7 Biometric and face data — special-category consent (Art. 9 GDPR); no training by default. (a) Consent of every person shown. Where any upload, prompt or output depicts an identifiable person's face, that may involve special-category personal data. Before you upload or generate such content you must hold the prior, express, informed and documented consent of every identifiable person, covering AI synthesis and alteration of their image, processing by our third-party AI models inside and outside the EU/EEA, the specific generated use, any commercial use, and any public sharing you perform. You must retain that consent and produce it on request. The corresponding user warranties and prohibitions are in Sections 9 and 11. (b) What we do — and expressly do not do. We classify face presence only, so that an image containing a face is routed into a face-safe handling pipeline. We do not create, capture or store faceprints, face-geometry templates or other biometric identifiers; we do not perform recognition, matching, identification or one-to-one/one-to-many search; and we do not infer emotion or health. How this works is described in the Biometric Privacy Notice [LINK]. (c) No AI training on face data by default — and never on anyone else's face. We do not use face, voice or likeness data to train, fine-tune or develop AI models unless you have given the separate, un-pre-ticked, freely revocable opt-in described in Section 8.9 — and that opt-in only ever covers your own likeness and your own voice. The face, voice or likeness of any person other than the consenting user is never used for training, with or without an uploader's opt-in. Absent your own valid opt-in, no training on your face data occurs. [OPERATOR NOTE: The Biometric Privacy Notice must be amended in the SAME integration pass to state exactly this rule (default: no training; opt-in under 8.9 limited to the user's own likeness/voice; third-party faces never trainable) — the former blanket "no training" promise and the 8.9 opt-in otherwise contradict each other, which both vitiates the consent (Art. 7 GDPR, not "informed") and reads as an express Garantie whose breach is uncapped (§309 Nr. 7a BGB).] (d) Geo-gate: Illinois, Texas, Washington. Face-upload and face-containing generation features are not available to users located in the U.S. states of Illinois, Texas or Washington (Illinois BIPA, 740 ILCS 14; Texas CUBI, Tex. Bus. & Com. Code §503.001; Washington RCW 19.375 — uncapped and in part unwaivable regimes that these Terms cannot limit). The technical control and the prohibition on circumventing it are set out in Section 11.4(c) and the US Addendum. In addition, you must not upload face content where you know or ought to know that a depicted person is located in Illinois, Texas or Washington; doing so is a breach of the Acceptable Use Policy, and you are responsible for the resulting claims on the terms, and subject to the carve-outs and consumer limitations, of Section 18. [OPERATOR NOTE: This clause documents the control; it is not itself the protection. The feature-level geo-gate (IP-geolocation block on face uploads + self-attestation + immediate-delete-on-detection) must actually be LIVE in the product before this text goes live — a contract clause alone does not defeat BIPA, and an IP gate cannot catch an Illinois RESIDENT photographed and uploaded from elsewhere; that residual exposure stays with the operator and the insurer brief.] (e) Direct claims preserved. A depicted person who is not a party to these Terms keeps their direct KUG §22 / Art. 9 / Art. 82 GDPR claims, and may exercise the rights in Section 19.10. US residents (e.g. Illinois BIPA): see the Biometric Privacy Notice and the US Addendum.

19.8 Data-subject rights, breach and statutory liability — not waivable. Nothing in these Terms limits, delays or waives any right of a data subject under Arts. 12–22 GDPR, our obligations under Arts. 32–34 GDPR, or statutory liability under Arts. 82/83 GDPR; in particular, no limitation in Section 17 applies to a data subject's claim under Art. 82 GDPR. We will support you with data-subject requests and incident notification as set out in the DPA. You are responsible for your own controller obligations and fault; we are responsible for ours — neither party indemnifies the other for that party's own breach, fault or regulatory fines.

19.9 Cookies, tracking and session analytics — prior consent. Use of cookies and similar technologies — including session-analytics and session-replay tools (currently Microsoft Clarity) — is governed by our Cookie Policy (https://ghostcreative.ai/cookies) and the consent banner, under §25 TDDDG and the ePrivacy rules. Session recording and other non-essential tracking are not loaded and do not capture any data until you have given prior, explicit, informed consent through the banner; if you decline, the tool is not loaded on your device and no recording occurs. You can withdraw consent at any time with effect for the future via the cookie settings. Consent for non-essential cookies is collected through the banner, not through your acceptance of these Terms. [OPERATOR NOTE — ENGINEERING TRUTH GATE: This clause asserts a consent architecture. The banner must exist, must block Clarity (and any other non-essential tool) from initializing before consent, and consents must be logged, BEFORE these Terms go live. A session recorded before the banner is shown contradicts this text (TDDDG §25; UWG §5 misrepresentation risk flagged in ANALYSIS_10).]

19.10 Rights of depicted persons and non-user data subjects. If you are a natural person whose face, likeness, voice or other personal data appears in content uploaded to or generated through the Service — even if you are not a registered user and never accepted these Terms — you have your own rights under the GDPR and applicable law, independently of any contract: (a) Access (Art. 15): you may ask whether and how we process your personal data; (b) Rectification and erasure (Arts. 16, 17): you may request correction or deletion of your personal data from our active systems; we will action a valid request within the statutory period (normally one month, Art. 12(3)); (c) Restriction and objection (Arts. 18, 21): you may object to processing of your data on grounds relating to your particular situation; (d) Withdrawal (Art. 7(3)): if any processing of your data is based on consent, you may withdraw it at any time with effect for the future; (e) No proxy consent: an uploader's acceptance of these Terms, warranty or checkbox is not your consent. Where your consent is the relevant lawful basis and it is missing or invalid, the processing it would have covered does not become lawful through the uploader's contract with us. You can exercise these rights by writing to [privacy@ghostcreative.ai] (proof of identity may be required to protect against abusive requests). These rights are not conditional on being a user or customer, we will not refer you to the uploader as a precondition, and we will respond within the statutory deadline. You may also lodge a complaint with a supervisory authority (for us: the Hamburg Commissioner for Data Protection and Freedom of Information, HmbBfDI). Reporting unlawful or non-consensual content (as opposed to exercising data-subject rights) is additionally available to anyone via Section 21.8 and — for intimate imagery — Section 21.8a. [OPERATOR NOTE: This channel must be staffed and wired into support routing before launch — an unanswered Art. 12 request is itself a breach. ANALYSIS_11 (depicted-person) treats the absence of a non-user rights channel as a standalone Art. 12 violation.]

SECTION 20 — AI TRANSPARENCY, SYNTHETIC-CONTENT LABELLING & PROVENANCE

In short — Section 20: We mark everything made here as AI-generated in a machine-readable way — that's our legal job and we keep it; we even apply the mark before a gift link can go public, and our own ads and demo content are labelled as AI too. The moment you publish or share an Output, the disclosure becomes yours: you must label deepfakes, political content and paid promotions (#ad), you must not strip our marking, and if you skip a required disclosure or tamper with the marking, you cover the resulting claims — though a platform that technically strips metadata on upload, outside your control, is not your breach. One more thing: if no real person was used, the AI person in your content is a "synthetic performer" — that's the default when you give us no photos — and some states (like New York) make YOU, as the advertiser, disclose that conspicuously in ads; we tell you which outputs contain one.

20.1 What this Section covers. This Section explains (a) how Ghost Creative marks content created with the Service as AI-generated and which transparency duty stays with Us, and (b) your obligations to disclose, label, and not tamper with that marking when you publish, share, or distribute the content. It implements Article 50 of Regulation (EU) 2024/1689 (the "EU AI Act") and comparable transparency laws. "Outputs" means images, carousels, stories, videos, audio, and other media generated through the Service.

20.2 Outputs are AI-generated; the Service is an AI system. All Outputs are produced wholly or partly by AI systems operated by Us and by third-party model providers (currently fal.ai / ByteDance Seedance and Seedream; OpenAI; and Anthropic). Where the Service interacts through a chatbot or other conversational interface, you are interacting with an AI system, not a human. By using the Service you acknowledge that the content you receive is artificially generated or manipulated, is probabilistic and delivered as-is, and is not a record of real events, real persons' actual statements, or authentic photography unless you supplied authentic source material.

20.3 Provenance marking We apply (Our retained, non-shiftable duty). We apply machine-readable provenance information to Outputs identifying them as artificially generated or manipulated, using industry-standard methods (currently C2PA content credentials and/or IPTC metadata). This marking is intended to satisfy Our obligation under Art. 50(2) EU AI Act, which falls on Ghost Creative as the provider of a generative AI system and cannot be contractually shifted to you. Nothing in these Terms transfers, reduces, or discharges that provider-side duty. Recognised marking standards are still evolving; We keep Our marking method current with applicable supervisory guidance, and We do not represent that any particular technical standard is conclusively sufficient in every jurisdiction — but that uncertainty stays Our problem on the provider side and is no licence for Us, or for you, to skip it. Your own deployer-side disclosure duties under 20.5 apply in addition to, and independently of, Our marking. [OPERATOR NOTE: Art. 50(2) is a public-law duty on the provider; you cannot delegate it to users and must not draft as if you had. Art. 50 applies from 2 August 2026 — keep the date current. The honesty sentence (standards evolving) answers the eu-ai-act attack on over-claiming compliance without shifting the duty. The C2PA/IPTC marking must actually be applied to every Output for 20.3/20.4 to be truthful — code before text.]

20.4 You must not remove or alter Our provenance marking (no-stripping covenant). (a) You must not strip, suppress, obscure, falsify, or otherwise tamper with any provenance metadata, content credential, watermark, label, or other marking We embed in or attach to an Output, and you must not circumvent or defeat a marking applied by an upstream model provider (see 20.8(c)). This covenant applies to every user, business or consumer (see 10.7). Tampering is a breach of these Terms and of the Acceptable Use Policy, may defeat your own legal compliance, and may constitute circumvention prohibited under §95a UrhG and Art. 50 EU AI Act. A visible watermark may be offered as a removable feature on paid plans [BRACKETED — e.g. "visible watermark removed on the [PLAN NAME] plan and above"]; the machine-readable provenance mark may not be removed, even by paying users. (b) Platform-side stripping is not your breach. Where a third-party platform or service to which you lawfully upload an Output technically removes or re-encodes metadata as part of its own automatic processing, outside your control, that removal is not by itself a breach of this covenant by you — provided you did not yourself act to remove, falsify or obscure the marking and did not choose that distribution path for the purpose of shedding it. Such platform-side stripping does not relieve you of your disclosure duties under 20.5, which apply regardless of whether the machine-readable mark survives.

20.5 Your disclosure and labelling duties (deployer obligations — these are yours, not Ours). Where you publish, broadcast, distribute, or otherwise make an Output available to the public or to any third party (including via public Gift Links, social media, marketplaces, advertising channels, or email to recipients beyond your sole personal use), you are the deployer of the AI-generated content and are solely responsible, at your own cost, for any disclosure or labelling the law requires of you, including: (a) Deep fakes (Art. 50(4) sentence 1 EU AI Act): if an Output depicts a real, identifiable person, or real events or places, in a way that would falsely appear to a recipient to be authentic photography or an authentic recording ("deep fake"), you must clearly and distinguishably disclose that it has been artificially generated or manipulated, at the latest at the moment of first exposure. Disclosure by clearly visible caption, label, watermark or accompanying statement placed where the recipient will perceive it is acceptable. Synthesis derived from your own photographs of yourself, presented as your own AI-altered image, is not a "deep fake" of a third person — but the duties in (c)–(e) may still apply; (b) Text on matters of public interest (Art. 50(4) sentence 2 EU AI Act): if you publish AI-generated or AI-manipulated text to inform the public on matters of public interest (for example news, elections, public health or scientific claims), you must disclose that it is artificially generated or manipulated, unless a lawful exception (such as parody, satire or artistic work, where recognised) applies. Routine marketing copy and clearly fictional or creative content directed at your own customers is not "informing the public on matters of public interest" within this sub-clause; (c) Political, election, and referendum content: you must comply with all additional disclosure, labelling, and authorisation rules applicable to synthetic political, campaign, or election-related media in every jurisdiction where you distribute it (this is in addition to the worldwide prohibition in Section 11 on manufacturing synthetic political media through the Service); (d) Any other applicable law: including consumer-protection, advertising, platform, and sector-specific transparency rules in the EU, Germany, Mexico, the United States, Canada (including Quebec), and any other market in which you distribute the Output; (e) Endorsements and paid promotion: where you publish an Output in a context in which disclosure of a material connection (payment, affiliate relationship, sponsorship, free product, or other compensated endorsement) is required, you must make that disclosure clearly and conspicuously at the point of first exposure, using the form the applicable regime requires (e.g. the FTC Endorsement Guides, 16 C.F.R. Part 255, in the United States; "Werbung"/"Anzeige" labelling under UWG §5a in Germany; platform-specific branded-content tools). You must not present an Output as an authentic, uncompensated consumer experience or testimonial where it is not; and (f) Attestation for real-person synthesis. Where the Service presents a consent attestation before generating synthetic media depicting a real, identifiable person's likeness or voice, completing it truthfully is a condition of the generation; the attestation is a warranty under Section 9, and Section 18 governs its breach. [OPERATOR NOTE: The generation-time attestation control ("I hold the documented consent of every person depicted…") must exist in the product before this sub-clause is relied on — until then it documents nothing. ftc-ai attack 2 treats the absence of any generation-point gate as part of the deception case; the clause is written conditionally ("where the Service presents…") so it does not over-claim before the feature ships.] You warrant that you will make these disclosures and apply these labels as and where required (Art. 50(5) requires disclosure in a clear and distinguishable manner at the latest at the time of first exposure) and will not present any Output as authentic where the law requires it to be disclosed as artificial. Against a consumer, this warranty binds as a conduct duty, but its financial consequences are governed exclusively by Section 18.3 (reimbursement only to the extent of the consumer's culpable causation; no duty-to-defend; no burden-shift).

20.5a Synthetic performers in advertising. (a) What a "synthetic performer" is. A "synthetic performer" is an AI-generated human appearance or voice — a face, figure, body part, or spoken performance that looks or sounds like a natural person but corresponds to no identifiable natural person. Outputs containing synthetic performers are a normal and intended result of the Service: where you provide no reference photographs of a real person (for example, a brand-only profile or a persona created from a text description alone), the Service by default generates wholly synthetic humans, and videos may carry wholly synthetic voices. A synthetic performer is not a "deep fake" of a real person under 20.5(a) — no real person's rights are implicated — but it remains artificially generated content subject to this Section and to the endorsement rules in 20.5(e) and Section 6.2 (clause 6a). (b) Your conspicuous-disclosure duty as the advertiser. Where you publish or distribute an Output containing a synthetic performer in an advertisement, you — as the advertiser — are solely responsible for clearly and conspicuously disclosing the use of the synthetic performer wherever applicable law requires it, expressly including New York's synthetic-performer disclosure law (S.8420, N.Y. Gen. Bus. Law, effective June 9, 2026) and any analogous current or future state, federal, or EU rule. That duty falls on the advertiser, not on Us as the generation platform; it applies in addition to your duties under 20.5, and its financial consequences as between you and Us are governed exclusively by Section 18, including its consumer limitations. (c) Our tooling commitment (honest scope). We intend to serve, from one disclosure mechanism, both Our own machine-readable Art. 50(2) EU AI Act marking (20.3) and the visible synthetic-performer disclosures such state laws require of you. We will make such labelling and disclosure tooling available to you as it becomes available, and in any event We will apply the Art. 50(2) machine-readable marking by that provision's application date (20.3, 20.10). Until such tooling is available, making the visible disclosures the law requires of you remains your duty under (b), with or without Our tooling. (d) Actual-knowledge cooperation. Because such disclosure laws apply where the advertiser knew or should have known that a synthetic performer was used, We will inform you — through the product interface or its documentation — which Outputs contain synthetic performers. In any event, you are treated as knowing that an Output contains a synthetic performer where you supplied no real person's reference material for the persons it depicts; you must not rely on the absence of an indication from Us against your own knowledge of your Inputs. [OPERATOR NOTE: (d) is a product commitment — a per-Output "contains AI-generated (synthetic) persons" indicator in the generation surface / media library must exist before these Terms are published; until it ships, the second sentence (input-based knowledge) carries the allocation. (c) is deliberately roadmap-honest: do NOT claim the state-law disclosure tooling exists before it does.]

20.6 Gift links and public sharing. Where you share an Output through a public Gift Link (/g/<code>) or any other public channel, the duties in 20.5 apply to you in full as the publisher (see Section 21), and you must ensure the Recipient is informed that the content is AI-generated. We do not activate a public Gift Link for an Output unless Our machine-readable provenance marking under 20.3 has been applied to it, and Gift-Link viewer pages display an "AI-generated" notice; that marking and notice are Our own Art. 50(2)-side measures and a convenience — they do not discharge, reduce, or replace your own disclosure duties under 20.5. [OPERATOR NOTE: "We do not activate a Gift Link unless the marking has been applied" is a factual product claim — the marking-before-activation check must exist in code before these Terms go live (defamed-third-party attack 5: an unlabeled defamatory output going public via /g/ is pleaded as Ghost's own design negligence).]

20.7 Indemnity for your non-disclosure or tampering. You will indemnify and hold Us harmless against third-party claims and reasonable costs to the extent they arise from (a) your failure to make a required AI-disclosure or labelling as deployer under 20.5, (b) your removal or alteration of Our provenance marking in breach of 20.4 / 10.7, or (c) your presenting an Output as authentic in breach of 20.5 — in each case to the extent the claim results from your own culpable conduct and not from Our breach. This indemnity does not cover: (i) liability arising from Our own intent or gross negligence; (ii) injury to life, body, or health; (iii) Our own breach of Our Art. 50(1)/(2) provider duties (the transparency marking stays Our job); (iv) any fine or penalty imposed on Us for Our own conduct, which is governed exclusively by Section 18.5(c) and is never shifted to you; or (v) any claim that Our own disclosure to you of Our processing or training purposes was inadequate or vitiated a consent under Art. 7 GDPR. Detailed indemnity mechanics are in Section 18 and govern here too. [OPERATOR NOTE: Against a consumer this narrows to reimbursement of loss the consumer actually, culpably caused — no duty-to-defend, no sole-control-of-defence, no burden reversal (§309 Nr. 7 / Nr. 12 BGB). The conduct duty (don't strip the mark; disclose deepfakes) still binds the consumer; only the indemnity MECHANICS soften. "Regulatory penalties, fines" were removed from the covered list per ANALYSIS_10 — a fine on Ghost is by definition for Ghost's own conduct and is not shiftable.]

20.8 Prohibited transparency-related conduct. You must not use the Service to (a) generate non-consensual deep fakes of identifiable real persons, (b) engage in any practice prohibited by Art. 5 EU AI Act, or (c) circumvent, disable, or defeat any provenance, watermarking, or safety marking applied by Us or by an upstream model provider. These prohibitions are also covered by the Acceptable Use Policy (Section 11) and may result in immediate suspension.

20.9 Third-party model providers. The general-purpose AI models underlying the Service are operated by independent providers who bear their own obligations under Arts. 53 and 55 EU AI Act. We pass through, and do not assume on their behalf, any duty those providers owe. We do not warrant the transparency-law compliance of any third-party model beyond the provenance marking We ourselves apply under 20.3.

20.10 Binding version and public-law effect. The binding-language rule in Sections 1.7 and 24.10 applies to this Section. AI Act transparency provisions (Art. 50) are public-law duties enforced regardless of any governing-law choice and apply from 2 August 2026; nothing in these Terms purports to displace them.

20.11 Our own marketing and demonstration content. Where We use Outputs, sample creatives, demonstrative personas, or other AI-generated material in Our own marketing, those materials carry a visible and/or machine-readable AI-generation label and are not presented or captioned in a way that implies human authorship, authentic endorsement, or actual customer results. Where an example shows a recognisable person or persona, its status is stated (e.g. "AI-generated persona — illustrative only", or attribution with consent where a real person is shown). Figures, examples and sample results in Our marketing are illustrative only and are not a promised or guaranteed outcome (see Section 6.2). Where We display customer testimonials or results claims, they are identified as such, any compensation or incentive is disclosed, and we do not attribute testimonials to AI-generated personas presented as real customers. [OPERATOR NOTE: This clause binds GHOST's own marketing (ftc-ai attacks 1/3 — the FTC/UWG case is built on Ghost's marketing, which no user-facing clause cures). It must be paired with the operational marketing-claims checklist from ANALYSIS_11 synthesis fix 8: audit every demo asset, sample, and testimonial for AI-labelling and substantiation BEFORE launch.]

SECTION 21 — PUBLIC GIFT LINKS & SHARING

In short — Section 21: When you create a /g/<code> Gift Link you are publishing the media yourself — anyone with the link can see it, so you must own it, hold the consent of everyone shown, and carry the AI-labelling duties; we are only the host. We can switch any link off, but if we do we owe you a written statement of reasons and a way to object (except for the worst content, where we act immediately). Anyone — customer or not — can report a link; reports from official trusted flaggers get priority; and a person depicted in intimate imagery gets a dedicated channel where we acknowledge within [24] hours and remove confirmed material within 48 hours, notify the person, block re-uploads, and never make them arbitrate or accept our liability caps. People who already saw or saved the media are beyond our reach.

Defined terms: "Gift Link" = a public sharing URL in the form https://ghostcreative.ai/g/<code>; "Shared Media" = any Output (or Input you elect to include) made accessible through a Gift Link; "Recipient" = any person who opens a Gift Link without needing an account; "you" / "Publisher" = the registered account holder who creates the Gift Link.

21.1 What a Gift Link is. The Service lets you create a Gift Link — a publicly reachable URL (/g/<code>) through which anyone holding the link can view, and where enabled download, the Shared Media. Creating a Gift Link is an affirmative act of publication by you: a Gift Link is not protected by a login, password, or access list, and anyone who obtains the link can open it. We use high-entropy, hard-to-guess codes and may apply rate-limiting and expiry, but we do not warrant that a Gift Link will remain private or undiscovered. [OPERATOR NOTE — ANALYSIS_12 F9, 2026-06-11: this entire Section presupposes a USER-INITIATED gift-creation flow ("you create a Gift Link"). Today no such flow exists in the product — web/src/lib/gifts.ts is read-only and the only writer is the operator CLI scripts/upload-gifts.mjs, so every live /g/ link is OPERATOR-published, which makes Ghost (not the user) the publisher/controller and collapses this Section's risk allocation. Before these Terms publish, EITHER (a) ship a real user gift-creation surface that records the user's affirmative act + the 21.2 warranties at creation time, OR (b) reframe Section 21 to cover operator-published links and carry the publisher/controller duties on Ghost. This is a Jan product decision, not a pure drafting fix — surface to Jan + attorney.]

21.2 You are the publisher. When you create a Gift Link you act as the publisher and, for any personal data contained in the Shared Media, the data controller in respect of that act of sharing. You are solely responsible for: (a) the lawfulness of making the Shared Media publicly available, including the making-available right under §19a UrhG; (b) holding, before you create the Gift Link, the documented consent of every identifiable person depicted in the Shared Media for that public disclosure (§22 KUG; and, where applicable, Art. 6 / Art. 9 GDPR); (c) ensuring the Shared Media does not infringe any third-party right and does not violate the Acceptable Use Policy, including the face-upload geo-gate in 11.4(c); (d) applying any AI-disclosure or labelling the law requires of you as publisher (Section 20.5–20.6) and not removing Our provenance marking (Section 20.4); and (e) your communications with your Recipients. You represent and warrant that you satisfy (a)–(d) for every Gift Link, in addition to the per-upload warranties in Section 9.

21.3 Licence for sharing. By creating a Gift Link you grant us a non-exclusive, royalty-free, worldwide licence to host, store, cache, reproduce, and make the Shared Media available to the public solely as necessary to operate the Gift Link you created, for as long as the Gift Link remains active plus a short technical caching window. This licence is limited to the sharing function, terminates when the Gift Link is disabled, expires, or the underlying Shared Media is deleted (subject to 21.7 on caches), and does not grant us ownership or any right to use the Shared Media for other purposes.

21.4 Indemnity for sharing. You will reimburse us for third-party claims, losses, and reasonable costs that arise from your creation or use of a Gift Link — including claims by depicted persons, rights holders, or recipients — to the extent caused by your breach of 21.2 or the Acceptable Use Policy. This obligation does not apply to the extent a claim results from our own intent or gross negligence, and does not extend to injury to life, body, or health. Against consumers this narrows to reimbursement of loss you actually caused (no duty-to-defend / sole-control); it binds you as Publisher only and does not affect direct claims a depicted third party may bring against us (§22 KUG, §823 BGB, Art. 82 GDPR). The general mechanics of Section 18 apply.

21.5 Our right to disable links (revocation) — with a statement of reasons. We may, at Our reasonable discretion and where proportionate, disable, suspend, expire, or remove any Gift Link or Shared Media at any time, including where: (a) we receive a notice or credible complaint that the Shared Media is unlawful, infringing, or non-consensual; (b) we have actual knowledge of unlawful content or an AUP breach (including an attempt to share face content in breach of the 11.4(c) geo-gate); (c) required by law, court, or competent authority; or (d) the underlying account is suspended or terminated (see 21.7 and Section 22). When We disable or remove a Gift Link or Shared Media, We will give you, as Publisher, the statement of reasons and the objection path set out in Section 22.6(a); that duty is unconditional except for the narrow carve-outs stated there (suspected CSAM, non-consensual intimate imagery, or an authority order prohibiting notice — in which cases We act immediately and inform you as soon as lawfully permissible). Where We disable a Gift Link other than for your breach or a legal requirement, your sole remedy is restoration of the link or, where that is not possible, a pro-rata refund of the fees attributable to the affected feature — or, where the disablement deprives you of a material part of a plan or package you have paid for, a pro-rata refund of the prepaid fees for the affected period and scope. [OPERATOR NOTE: Keep the "sole remedy" framing narrow — it survives only because it is paired with a real pro-rata refund and excludes mandatory liability (life/body/health, intent, gross negligence, §309 Nr. 7 BGB) via 10.8 / Section 17. A bare "sole remedy / no liability" line would be struck in full under §306 BGB. The DSA Art. 17 statement-of-reasons duty is unconditional for content-moderation decisions — the former "with or without prior notice / where legally required" discretion was the dsa-regulator blocker and has been removed; the SoR tooling (template + log) must exist operationally.]

21.6 Recipients and viewers (no account required). A Recipient opens a Gift Link without entering into these Terms with Us. The Gift-Link viewer page shows Recipients a clear notice stating: that the Shared Media is AI-generated; that it was shared by the Publisher, a third party — not created or endorsed by Us; that We act only as the hosting provider; and how to report the content to Us (Section 21.8, and Section 21.8a for intimate imagery). That on-page notice is informational only and does not form a contract between Us and the Recipient. (a) The relationship between you and your Recipients is yours alone; we are not a party to it. (b) Recipients may view, and where you enabled it download, the Shared Media for their own lawful, personal reference. We grant Recipients no commercial, ownership, or onward-distribution rights, and a Recipient must not use the Shared Media unlawfully. (c) We act only as a hosting provider of the Shared Media (§10 DDG; Art. 6 DSA) and are not the author or publisher of content you choose to share; Our liability for content stored at your direction is limited accordingly, save where We have actual knowledge of illegality and fail to act expeditiously. [OPERATOR NOTE: The hosting-provider safe harbour (Art. 6 DSA / §10 DDG) protects Ghost as host but collapses on actual knowledge — this is why the takedown process in 21.8/21.8a and the notice-and-action channel in 11.6 are the REAL protection, exactly as Jan's decision 1(c) anticipates. The "user is publisher" framing shifts authorship risk to the user but does NOT extinguish a third-party rightsholder's direct claim against Ghost as host; honest caveat retained. The on-page disclosure text above must actually render on /g/ pages (dsa-regulator attack 4).]

21.7 Effect of deletion, expiry, and account termination. A Gift Link stays live until it expires, you disable or delete it, the Shared Media is deleted, or your account is suspended or terminated — at which point we will disable the Gift Link and remove the Shared Media from public access and purge it from our active systems and caches within a reasonable technical window. You acknowledge, however, that copies a Recipient already viewed, downloaded, cached, screenshotted, or re-shared are outside our control and cannot be recalled by us. You remain responsible for media you have shared. Do not use Gift Links as a backup or storage method; keep your own master copies.

21.8 Reporting and takedown. Each Gift Link page provides a way to report the Shared Media to Us. Anyone — including a depicted person, a rights holder, or a Recipient — may submit a notice via [report@ghostcreative.ai / the in-page "Report this content" function] or through the notice-and-action channel in Section 11. We handle complete notices in line with Art. 16 DSA; notices submitted by trusted flaggers designated under Art. 22 DSA receive priority, expedited handling (target: decision within [24] hours); for copyright matters affecting U.S. users, Our DMCA notice-and-takedown process and registered DMCA agent [BRACKETED — agent name + address as filed with the U.S. Copyright Office; do not publish this clause as operative before the registration exists] apply; and for Mexican users, applicable LFPDPPP/LFPC processes apply. On a credible notice of unlawful, infringing, or non-consensual content — and immediately for suspected CSAM or non-consensual intimate imagery (see 21.8a) — We may disable the Gift Link, preserve evidence, and where required report to the competent authorities, without prior notice to you and without refund. Substantiated notices are logged and feed the repeat-infringement escalation in Section 22.5(c).

21.8a Non-consensual intimate imagery (NCII) — dedicated takedown channel. (a) Dedicated channel. We maintain a dedicated reporting channel for intimate imagery or sexualised depictions shared without the depicted person's consent (including AI-generated or AI-altered "deepfake" imagery) at [ncii@ghostcreative.ai] and via the page [/takedown/ncii], linked from every Gift-Link viewer page. (b) Anyone may report — free, no account, no preconditions. Any person who is, or reasonably believes they are, depicted (or their authorised representative) may report, whether or not they are a customer. Reporting is free, requires no proof that other remedies were exhausted, and is not conditioned on contacting the uploader. (c) Mandatory timeline. We will acknowledge a report within 24 hours with a reference number, and we will remove or disable content we determine to be non-consensual intimate imagery within 48 hours of receiving a sufficiently complete report — or inform the reporter in text form of the grounds on which we decline. This removal duty is mandatory, not discretionary. (d) Re-upload prevention and repeat offenders. On confirmed NCII we preserve evidence, apply hash-based matching to prevent re-upload of the same material as far as technically possible, report to the competent authorities where required (e.g. NCMEC / BKA), and apply the mandatory account-termination rule in Section 22.5(b)–(c). (e) Uploader notice protects the victim. We will not disclose the reporter's identity to the uploader, and the statement-of-reasons duty toward the uploader is subject to the carve-out in Section 22.6(a). (f) No waiver of victims' rights. A depicted person who is not a party to these Terms is not bound by them: nothing in these Terms — including Section 17 (limitation of liability), Section 18 (indemnity), or any arbitration agreement or class-action waiver in a market addendum — limits, waives, or moves to arbitration any direct statutory or tort claim of a person depicted in NCII, including under the U.S. TAKE IT DOWN Act (Pub. L. 119-12) and applicable state NCII statutes [BRACKETED — attorney to verify the precise federal codification and the state-law citations before publication]. (g) Binding commitment. This Section 21.8a is a binding commitment, not marketing. [OPERATOR NOTE — CODE BEFORE TEXT: The dedicated inbox, the /takedown/ncii page, the 24h/48h SLA workflow, and the hash-matching re-upload block must exist and be staffed before these Terms go live; ANALYSIS_11 (ncii-victim, dsa-regulator) treats the gap between an asserted process and a real one as the #1 victim-side attack vector, and the TAKE IT DOWN Act imposes the 48-hour removal duty directly.]

21.8b Notification of the depicted person. Where we become aware — through a report, our own review, or automated detection — that a Gift Link or Output contains non-consensual intimate imagery of an identifiable person, we will, within 48 hours of removal, make reasonable efforts to notify that person (by the contact route they used, or otherwise by reasonable means if they are identifiable): that we became aware of content depicting them; that it has been removed or disabled; the reference number; and a pointer to their rights under Section 19.10 and applicable law. We will not notify the uploader of the depicted person's identity or contact details. Where the depicted person cannot reasonably be identified or reached, we document our efforts. [BRACKETED — attorney to verify which U.S. state statutes impose a victim-notification duty and conform the trigger/wording.]

21.9 Special-category and minors' content. You must not create a Gift Link for any Shared Media depicting a minor in a public or commercial context, or containing special-category personal data (Art. 9 GDPR) of any person, without the specific, documented consent required for that public disclosure. Sharing such content without that consent is a serious, non-curable breach and may result in immediate link removal and account termination under the Acceptable Use Policy.

21.10 No publicity for your sharing. Your use of Gift Links is not advertised by us as a public gallery and is not indexed by us for search engines (we apply noindex to /g/ pages); this is a technical measure, not a warranty of secrecy. Section 21.1 (public-by-nature) continues to apply. /g/ pages carry the Impressum link (§5 DDG).

SECTION 22 — TERM, SUSPENSION & TERMINATION

In short — Section 22: You can cancel anytime (free accounts immediately, subscriptions to the end of the paid month) via the cancellation button; we can suspend or terminate you — with warning and a cure window for fixable problems, immediately for serious/illegal misuse, and always (except where the law forbids tipping you off) with a written statement of reasons and a way to object. Repeat copyright infringers lose their account after documented strikes; confirmed CSAM or intimate-image abuse means immediate, permanent termination. When things end, your already-paid generations stay yours, unused paid credits are refunded pro-rata unless you caused a serious breach (and even expired paid credits keep their money-back path), public gift links are killed, and you can still export your data (typically deleted within 30 days, billing records kept 10 years by law).

22.1 Term (Duration). (a) These Terms take effect when you first accept them (at account creation or first purchase) and remain in force for as long as you hold an account or any unused credits, whichever ends later. (b) Free / no-subscription accounts run for an indefinite period and may be cancelled by either party at any time under this Section. (c) Subscription plans run for the initial term shown at checkout ([e.g. 1 month] or [12 months]). After the initial term, a subscription does not renew for a fresh fixed term; it continues for an indefinite period and can be cancelled by you at any time with effect to the end of the then-current billing month (§309 Nr. 9 BGB; see Section 14).

22.2 How you cancel. (a) You may cancel at any time via your dashboard or via the "Cancel contracts here" cancellation button (https://ghostcreative.ai/[cancel]), reachable without logging in and confirmed in text form (email) without delay (§312k BGB; see Section 14.5). A Stripe customer-portal link alone is not sufficient. (b) Cancelling stops future renewals. Unless a statutory right gives you more, paid access continues until the end of the period you have already paid for.

22.3 Termination by us (ordinary). We may terminate a free account, or an indefinite-term subscription, for convenience on 30 days' notice in text form. If we do, we will refund the pro-rata portion of any prepaid subscription fee for the unused remaining period, and we will refund or extend the redemption window for your unused paid (top-up) credits in accordance with 22.6.

22.4 Suspension and extraordinary termination for cause (§314 BGB). We may suspend your access (in whole or in part) or terminate these Terms for good cause (aus wichtigem Grund) without observing the ordinary notice period. Good cause includes, in particular: (a) a breach of the Acceptable Use Policy or these Terms; (b) non-payment — a failed or reversed payment, a chargeback raised without first contacting support, or fees overdue after our dunning notice; (c) a legal, regulatory, court or competent-authority order, a sanctions/embargo listing, or a credible third-party complaint (e.g. an infringement notice or a lack-of-consent complaint about a depicted person) we reasonably need to act on; (d) conduct that creates a security, integrity, fraud or abuse risk to the Service, to us, or to other users (e.g. credential sharing, scraping, circumventing rate limits, credit metering, safety filters or provenance/watermark marking); (e) facts that make continued performance unreasonable for us, weighing both parties' interests.

22.5 Two enforcement tracks (curable vs. serious) — and the escalation ladder. (a) Curable breaches. For breaches capable of cure, we will first warn you and set a reasonable cure period (normally 7–10 days, §314(2) BGB) before terminating for cause, unless the warning is dispensable by law. During this period we may apply the lighter measure of suspension instead of termination. (b) Serious / non-curable breaches — immediate. For serious breaches we may suspend or terminate immediately, without prior warning, without refund, and with forfeiture of the credits consumed in, and fees paid specifically for, the offending generation(s). This includes, in particular: child sexual abuse material; non-consensual intimate imagery or sexualised deepfakes of identifiable real persons; other manifestly illegal content; fraud or payment fraud; sanctions/export-control breach; or any use exposing us to criminal liability. For confirmed CSAM and confirmed non-consensual intimate imagery (Section 21.8a), termination is mandatory and permanent — no warning, no cure period — and we block associated account identifiers against re-registration as far as technically and legally possible. Where the law requires, we will preserve evidence and report to the competent authorities (e.g. BKA / NCMEC), and may do so without prior notice to you (tipping-off carve-out). (c) Repeat-infringement escalation (documented policy). We keep a log of takedown notices (DMCA §512(c)(3), DSA Art. 16, and equivalent), recording the complainant, the content, the date, and the uploader account. (i) If we receive two substantiated notices within 90 days concerning the same work or the same depicted person and the same account, we will suspend the affected uploads or the account pending investigation and require documentary evidence of ownership, licence, or consent before re-enabling. (ii) An account that accumulates three or more substantiated infringement notices within 12 months will be terminated under 22.5(b); this implements the repeat-infringer policy referenced in the US Addendum (17 U.S.C. §512(i)). (iii) Before re-enabling uploads after a substantiated notice, we cross-reference the account's notice history and apply hash- or similarity-matching against previously removed material where technically feasible. (iv) Confirmed-NCII re-uploads are governed by the stricter mandatory rule in 22.5(b) and Section 21.8a(d). [OPERATOR NOTE: The notice log, strike counter, and re-upload matching must exist operationally — a repeat-infringer policy that exists only on paper does not satisfy §512(i) (copyright-holder attacks 1/5) and is evidence against Ghost in a Störerhaftung claim. CODE/PROCESS BEFORE TEXT.]

22.6 Effect on credits, fees and content. (a) Statement of reasons — mandatory. Where we suspend or restrict your access, remove or disable your content or a Gift Link, or take any other moderation or enforcement action affecting your use of the Service, we will give you a clear and unambiguous statement of reasons in text form within a reasonable time (normally within [48] hours), identifying the provision(s) of these Terms, the Acceptable Use Policy, or applicable law concerned and the essential facts, together with information on how to object (DSA Art. 17). You may object in text form within [14] days; we will review your objection and notify you of the outcome. The only exceptions are where a competent authority lawfully prohibits notification, or where we have reasonable grounds to suspect child sexual abuse material or non-consensual intimate imagery and act immediately under 22.5(b) (tipping-off carve-out) — in those cases we provide the statement of reasons as soon as lawfully permissible. This applies equally to consumers and business users. [OPERATOR NOTE: The former "where legally required" conditionality was the dsa-regulator blocker — Art. 17 DSA makes the statement of reasons unconditional for content-moderation decisions; the conditional version risked being struck in full (§306 BGB). The SoR template + decision log must exist operationally.] (b) Credits. Credits are a single-purpose prepaid unit redeemable only for our Services (see Section 13). On termination: Allowance credits included in a subscription fee lapse at the end of the subscription; paid top-up credits are refunded pro-rata (or their redemption window extended) where we terminate for convenience or where the termination is attributable to us, and are forfeited only where we terminate immediately for a serious, non-curable breach attributable to you under 22.5(b) — a mere suspension, or a termination for an ordinary curable breach, never forfeits paid top-up credits. If paid top-up credits expire unused, the reimbursement right in Section 15.8(a) (residual value of unconsumed paid credits) remains unaffected. Any mandatory consumer refund/remedy (incl. §§327 ff., §357 BGB) is always honoured and overrides any forfeiture. (c) Generated content already delivered to you stays yours. Termination is forward-looking: rights you have already validly acquired in Outputs you generated and paid for are not clawed back (see Section 10.4(b)). (d) Public gift links. On suspension, termination or your deletion of the underlying media, any public gift link (/g/<code>) is revoked, disabled and purged, and cached copies are invalidated as far as within our control. We cannot recall copies recipients already downloaded or that third-party caches retain.

22.7 Data export and deletion windows. (a) Export. Before deletion takes effect, you may export your account data and the Inputs/Outputs in your library using the in-product export tools. Your statutory data-portability right (GDPR Art. 20) and, for Mexican users, your ARCO rights, apply even where we terminated for cause — we will not refuse a lawful export request because your account was suspended or terminated. The rights of depicted non-users under Section 19.10 are likewise unaffected by any suspension or termination. (b) Deletion. On account closure or a valid erasure request, we delete your account data, uploaded Inputs (including photos of people) and generated Outputs from active systems within [30] days, and purge them from backups within our defined backup cycle of [90] days. Face-related classification metadata is deleted together with the underlying Input. (c) Retention exceptions. We retain, for the periods and purposes set out in the Privacy Policy, only what we are legally required or permitted to keep — in particular billing and invoice records for [10] years (§147 AO), data under a documented legal hold (e.g. to establish, exercise or defend legal claims, §§195/199 BGB), evidence preserved under 22.5(b), takedown-notice logs under 22.5(c), and anonymised/aggregated data that no longer identifies you. These exceptions do not extend to uploaded photos of people, which are deleted on the schedule in 22.7(b).

22.8 Survival. Termination or expiry does not affect rights and obligations that by their nature survive, including: accrued payment obligations; the limitation-of-liability provisions; indemnification; user warranties; confidentiality and trade-secret protection; the licences needed to provide already-delivered Outputs; and the governing-law and dispute-resolution provisions.

22.9 No liability for lawful action. We are not liable for any loss arising from a suspension, restriction or termination carried out in accordance with this Section. This does not limit our liability for intent or gross negligence, for injury to life, body or health, under the Produkthaftungsgesetz, or under any other mandatory law (see Section 17 and §309 Nr. 7 BGB).

22.10 Consumer-savings clause. If you are classified as a consumer (§13 BGB), mandatory consumer-protection rules prevail over any conflicting provision of this Section to the extent legally required; the remainder stays valid (§306 BGB).

SECTION 23 — CHANGES TO THESE TERMS

In short — Section 23: We can update these Terms only for a real reason and we'll tell you in advance (30 days, or 6 weeks for businesses); for important changes you can object — businesses are treated as agreeing if they stay silent and keep using the Service, but only for changes that don't raise the price or cut your core paid entitlements, while consumers are never bound by silence and, if you say no, the old terms keep applying or you can cancel and get a pro-rata refund of unused paid credits. Swapping or downgrading the AI models behind a paid feature isn't a silent "technical adjustment" either — a material quality cut gets you notice and a way out with your money back for the rest. We never change retroactively and never use this to grab new data-use consent.

23.1 Right to amend; legitimate grounds. We may amend these Terms, the Acceptable Use Policy, and any policy incorporated by reference, but only where there is a valid reason ("triggering ground"). Triggering grounds are limited to: (a) changes in applicable law or binding case law, or new or amended regulatory requirements (including the GDPR, the EU AI Act, the Digital Services Act, German AGB law, or tax law); (b) decisions or orders of a court or competent authority; (c) closing a genuine gap, ambiguity, or imbalance arising after these Terms take effect; (d) introducing new features, or technically or operationally necessary adjustments, that do not reduce your core paid entitlements; (e) a change in our service providers or sub-processors, or in their terms (for example fal.ai / ByteDance, OpenAI, Anthropic, Stripe); or (f) demonstrable changes in our costs of providing the Service. We will not use this clause to change the essential character of the bargain you paid for. A change under (d) or (e) — including the replacement, deprecation, or version change of an underlying generation model — that would materially reduce the quality, variety, or capability of a paid feature you have already paid for is not a neutral or merely technical adjustment: we will notify you at least [30] days in advance, and if you do not accept it you may terminate the affected contract with effect from the change and receive the pro-rata refund described in 23.5 (see also Section 13.8(d)).

23.2 Carve-outs — what this clause can never change without a fresh, separate agreement. The following can NOT be changed through the notice-and-deemed-acceptance mechanism in 23.3–23.5, and require either your express separate consent or a new contract: (a) the core subject matter and main price of an existing, already-paid order (no retroactive price increase on credits or subscription periods you have already paid for); (b) the governing law and jurisdiction clause, to your detriment; (c) the limitation-of-liability scheme, to your detriment; (d) the scope of the licences you grant or receive over your content and Outputs; (e) the credit-redemption and credit-expiry mechanics for credits you have already purchased; (f) any matter for which the law requires your separate, informed consent — in particular any new or expanded data processing requiring consent under GDPR Art. 6/7 (such as training on your content or adding a materially different category of sub-processor), which we will never bootstrap through a Terms amendment.

23.3 Notice. Before a change takes effect we will notify you in text form (Textform). The notice will: (a) present the changed terms or a clear summary of what is changing and why; (b) highlight material changes specifically; (c) state the intended effective date; and (d) for changes covered by 23.4, inform you of your right to object and the consequence of silence. Notice periods:

• Minor or purely neutral changes (no disadvantage to you) take effect on the date stated in the notice.
• Material changes take effect no earlier than [30] days after notice for consumers, and [six (6) weeks] after notice for business customers. "Material" means any change that is not minor/neutral, including changes to price (for future periods), credit mechanics, feature scope (including the model-change rule in 23.1), dispute resolution, or your obligations.

23.4 Your right to object; deemed acceptance. For material changes notified under 23.3, you may object in text form before the stated effective date.

• Business customers (Unternehmer, §14 BGB): Continued use after the notice period is deemed acceptance only for changes that do not increase the price of, or reduce, your core paid entitlements (Hauptleistungspflichten), and provided our notice expressly drew your attention to this consequence of silence. Changes to the main price or core scope require your express agreement; absent it, the existing terms continue and we may terminate the affected contract on reasonable notice. If you object to any other material change, we may terminate the affected contract or service with effect from the proposed effective date, on reasonable notice; until then the existing terms continue.
• Consumers (Verbraucher, §13 BGB): Silence is NOT acceptance. A material change only binds you if you expressly agree. If you do not expressly agree before the stated effective date, the existing Terms continue to apply to you, and we may instead, at our option, terminate the affected contract for the future on reasonable notice (with the refund consequence in 23.5).

23.5 Termination and refund on objection. If you (as a consumer, or as a business customer in respect of a price/core-scope change) decline a material change, or if we terminate because you objected, you may terminate the affected contract for the future, and we will refund any pre-paid fees for the unused remainder of the current term and refund any purchased (top-up) credits that remain unused, on a pro-rata basis. Allowance credits included as part of a subscription are not separately refundable beyond the pro-rata fee refund. This is your sole remedy for declining a change; it does not affect your statutory rights.

23.6 Continued use. Subject to the limits in 23.4, if you continue to use the Service after a change has lawfully taken effect, the amended Terms govern your continued use. For consumers, continued use does not substitute for the express consent required for material changes under 23.4.

23.7 No retroactivity. Changes apply only going forward. They do not affect Outputs already generated, credits already purchased and their agreed redemption terms, gift links already created, or rights and obligations already accrued before the change took effect, except where a change is required by law to apply to existing data or content.

23.8 Sub-processor and data-processing changes. Changes to our sub-processors or to data processing are governed by the DPA (and Section 19), not by this clause, and follow the separate notice-and-objection process set out there. Where a sub-processor change would require a new legal basis or your consent, 23.2(f) applies.

23.9 Transfer to a successor entity. A transfer of this contract to a successor entity (German or non-German, including a U.S. entity) is governed exclusively by Section 1.6: six (6) weeks' advance notice in text form and your unconditional termination right with pro-rata refund. It is not subject to the change-mechanics of this Section 23 and does not retroactively create a liability shield for incidents before the transfer. (See also Section 24.6.)

23.10 Severability of the two tracks. If the deemed-acceptance mechanism in 23.4 is held invalid as applied to any user, that finding affects only that user / category, and the express-consent mechanism and the remainder of this clause continue in force (see Section 24.5).

SECTION 24 — FINAL PROVISIONS (SCHLUSSBESTIMMUNGEN)

In short — Section 24: German law applies and German courts decide (businesses are pinned to our seat; consumers keep their home court and home-law protections); we don't do consumer arbitration boards; if one clause fails, the rest stand and the statute fills the gap; outages and provider failures pause our duties but never let us keep money for generations you didn't get. English is our master text, but the version that binds you is the one in the language you actually saw and accepted — German for EU consumers, Mexican Spanish in Mexico, French for Québec consumers — and anything unclear is read against us. US, Mexico and Canada users additionally get their market addendum, which never strips an EU consumer's protections and never binds people who never signed. Your contract is with Jan Stoltenberg personally, trading as Ghost Creative.

24.1 Governing law

(a) These Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of the Federal Republic of Germany, excluding (i) its conflict-of-laws rules and (ii) the United Nations Convention on Contracts for the International Sale of Goods (CISG). (b) If you are a consumer (§13 BGB) habitually resident in a country of the EU, the EEA, or another state whose law grants you mandatory consumer protection, the choice of German law in (a) does not deprive you of the protection of the mandatory provisions of the law of your country of habitual residence (Art. 6(2) Regulation (EU) No 593/2008 — Rome I). Those protections apply in addition to, and prevail over, any conflicting term, and only to the extent the law of your residence requires; the remainder stays in force (24.5). (c) Nothing in these Terms displaces overriding mandatory provisions that apply irrespective of the governing law (Art. 9 Rome I), including the GDPR, the EU AI Act (Reg. (EU) 2024/1689), the Digital Services Act, and applicable consumer-protection and competition law.

24.2 Place of jurisdiction (Gerichtsstand)

(a) If you are a merchant (Kaufmann), a legal entity under public law, or a special fund under public law, or if you act as an entrepreneur (§14 BGB) without a general place of jurisdiction within Germany: the exclusive place of jurisdiction for all disputes arising out of or in connection with these Terms is [Sitz des Unternehmers — e.g. Hamburg], Germany (§38 ZPO). (b) We additionally reserve the right, at our sole option, to bring proceedings against such a user at the user's own general place of jurisdiction. (c) If you are a consumer, the place of jurisdiction is determined exclusively by the applicable statutory rules (Art. 17–19 Regulation (EU) No 1215/2012 — Brussels Ia). In particular, we may sue a consumer only in the courts of the consumer's place of residence, and a consumer may sue us either there or at our seat. No term restricts that statutory forum. (d) The above does not apply to gift-link recipients or other persons who merely view shared media and are not contracting parties; 24.2 binds only the registered user.

24.3 Consumer dispute resolution (Verbraucherschlichtung / VSBG)

(a) Hinweis nach §36 VSBG: Der Betreiber ist weder bereit noch verpflichtet, an Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle teilzunehmen. (We are neither willing nor obliged to participate in dispute-resolution proceedings before a consumer arbitration board.) (b) §37 VSBG remains unaffected. The competent general consumer arbitration board is the Universalschlichtungsstelle des Bundes, Zentrum für Schlichtung e. V., Straßburger Straße 8, 77694 Kehl am Rhein, Germany (www.verbraucher-schlichtung.de). (c) No reference to an EU Online Dispute Resolution platform is provided, as that platform no longer exists (the EU ODR platform was repealed effective 20 July 2025 by Reg. (EU) 2024/3228). A live ODR link must not appear anywhere in the product, footer, emails, or legacy docs.

24.4 Force majeure (Höhere Gewalt)

(a) Neither party is liable for any failure or delay in performing its obligations (other than payment obligations already due) to the extent the failure or delay results from an event beyond its reasonable control that it could not have avoided or overcome with reasonable measures ("force majeure"). Such events include, without limitation: natural disasters, fire, flood, epidemics/pandemics, war, terrorism, civil unrest, strikes or labour disputes (other than those involving the affected party's own workforce), governmental or regulatory action, sanctions, embargoes, or geo-blocking; failures of the internet, electricity, or telecommunications; and outages, rate-limiting, suspension, deprecation, or refusal of service by an upstream third-party provider on which the Service depends (including fal.ai / ByteDance Seedance & Seedream, OpenAI, Anthropic, Stripe, Supabase, and our hosting provider). (b) The affected party will notify the other without undue delay and use reasonable efforts to mitigate (including, where feasible, routing generation to an alternative model). For the duration of the event the affected obligations are suspended, not extinguished. A generation that fails to complete because of a force-majeure event does not consume credits, and any credits already debited for it are restored (§326 BGB). (c) If a force-majeure event preventing material performance continues for more than 30 consecutive days, either party may terminate the affected service for the future by notice in text form, and we will refund the pro-rata portion of any prepaid fees for paid services not yet delivered. (d) Force majeure does not cover an upstream-provider failure to the extent it falls within our own procurement risk (Beschaffungsrisiko) and could reasonably have been substituted; in that case 24.4(b)'s credit-integrity protection still applies.

24.5 Severability (§306 BGB)

(a) Should any provision of these Terms be or become wholly or partly invalid, void, or unenforceable, the validity of the remaining provisions shall not be affected (§306(1) BGB). (b) In place of the invalid, void, or unenforceable provision, the applicable statutory provisions apply (§306(2) BGB). The parties expressly do not agree that an invalid provision shall be replaced by the valid provision that comes closest to its economic purpose, nor that it shall be upheld with reduced content. (c) §306(3) BGB remains unaffected. (d) Nothing in this 24.5 is intended to circumvent mandatory consumer-protection rules; any such circumventing construction is excluded (§306a BGB).

24.6 Assignment and transfer (Abtretung / Vertragsübernahme)

(a) You may not assign, transfer, or otherwise dispose of your rights or obligations under these Terms, in whole or in part, without our prior written consent. (b) We may transfer this contract, or assign individual rights and obligations under it, to a third party only as provided in Section 1.6 (successor entity — German or non-German, including a U.S. entity — with six weeks' advance notice in text form and your unconditional termination right with pro-rata refund), or with your consent. Statutory transfers by operation of law remain unaffected.

24.7 Contracting party and contact / Impressum

(a) Your contracting party is: Jan Stoltenberg, sole proprietor (Einzelunternehmer), trading under the business designation "Ghost Creative", Lerchenhöhe 38, 22359 Hamburg, Germany. E-mail: [legal@ghostcreative.ai — interim: jan.stoltenberg@t-online.de] · Telephone: +49 1590 1488445. USt-IdNr. per §27a UStG: DE[XXX XXX XXX — value from file Kuhl_Steuerberater_2025/USt-ID-Nr.pdf]. (b) The full statutory provider identification is set out in our Impressum at https://ghostcreative.ai/impressum, which forms part of these disclosures. (c) Unless a specific clause or mandatory law requires a particular form, notices to us under these Terms must be sent to the e-mail address above; we will send notices to you at the e-mail address on your account or via the Service.

24.8 Written / text form (Schrift- und Textform)

(a) Amendments and supplements to these Terms, and any contractual declarations that these Terms require to be made in a particular form, require at least text form (§126b BGB) unless a stricter form is mandated by law. E-mail satisfies text form. (b) Individually negotiated agreements (Individualabreden) take precedence over these Terms and are valid regardless of form (§305b BGB). The text-form requirement in (a) does not apply to such individual agreements. (c) Any waiver of the text-form requirement must itself be in text form.

24.9 No waiver (Kein Verzicht)

Our failure or delay in exercising any right or remedy is not a waiver of that or any other right or remedy. A single or partial exercise does not preclude any further exercise of it or of any other right. A waiver is effective only if given in text form and only for the specific instance and purpose stated.

24.10 Language and version precedence

(a) Master language. The authoritative master text of these Terms is maintained in English. We produce official translations for the markets we serve; any other language version is provided for convenience only and has no binding effect. (b) Binding version — language actually presented at acceptance (not residence). The version of these Terms in the language actually presented to you at the acceptance control when you concluded the contract is the version that binds you. We determine the binding version by the language you contracted in, not by where you live, so that the terms you agreed to are the terms you were able to read before clicking (§305(2) BGB — opportunity to take note; §305c BGB — no surprising clauses). Where we presented:

• German, the German version binds;
• English, the English version binds;
• Mexican Spanish (es-MX), the Spanish version binds;
• French, the French version binds. (c) Mandatory local-language overrides. Notwithstanding (b), where the mandatory law of your market requires that a specific language version govern or that specific disclosures be made in a specific language, that requirement prevails to the extent legally required, and only to that extent. In particular:

1. Germany / EU consumers. For a consumer (§13 BGB), the German version is binding, and the Impressum, the pre-contract consumer information (Art. 246 / 246a EGBGB), the Widerrufsbelehrung, and the §312j Button-Lösung are binding in their German form, regardless of the interface language otherwise presented.
2. Mexico. For users in Mexico, the Spanish (es-MX) version governs, and the aviso de privacidad and the consumer disclosures required under the Ley Federal de Protección al Consumidor (LFPC) and by PROFECO are binding in Spanish (and, where applicable, registrable with PROFECO in Spanish).
3. Quebec. For a consumer resident in Québec, Canada, the French version is binding where French is required by the Charter of the French Language (CQLR c. C-11, as amended by Bill 96) and the Quebec Consumer Protection Act (CQLR c. P-40.1); privacy-related disclosures are additionally governed by Law 25. We make the French version available, and present it as an option, at or before the acceptance control to such users; for Quebec consumers it is a binding, legally required version, not a convenience translation. [BRACKETED — build/translation dependency: a professional, non-machine-translated French (Québécois) version of the Terms and the key consumer/privacy disclosures must exist and be wired into the acceptance flow before serving Quebec consumers.] (d) No conflict construction; ambiguity against drafter. If a discrepancy appears between language versions, the version binding under (b)–(c) controls for you; no convenience translation may be used to enlarge our rights or reduce yours. Any remaining ambiguity in our standard terms is construed against us as drafter (§305c(2) BGB). (e) Public-law and statutory notices unaffected. Statutorily mandated notices, the Impressum, AI Act transparency duties (Reg. (EU) 2024/1689, Art. 50), and data-protection disclosures are governed by their own mandatory-language and public-law rules and are unaffected by the convenience-translation rule in (a).

24.11 Entire agreement / order of precedence

(a) These Terms, together with the documents they incorporate by reference (Acceptable Use Policy, Privacy Policy, Data Processing Addendum, Sub-processor List, Biometric Privacy Notice, AI Transparency Notice, Cookie Policy, DMCA Policy, and any plan- or order-specific terms accepted at checkout), constitute the entire agreement between you and us regarding the Service and supersede prior understandings on that subject. (b) In case of conflict, the order of precedence is: (1) individually negotiated agreements (24.8(b)); (2) the Data Processing Addendum, on matters of personal-data processing; (3) plan-/order-specific terms accepted at checkout; (4) these Terms; (5) the Privacy Policy and other referenced policies. (c) Nothing in this 24.11 limits any mandatory statutory right you have as a consumer, nor any representation we are liable for under §444 BGB or for fraud.

24.12 Market addenda (US / Mexico / Canada) — order of precedence

(a) The US Addendum, the Mexico Addendum, and the Canada Addendum attach to, and form part of, these Terms unchanged, and apply to you in addition to the base Terms where you are located in (or, where the addendum so states, resident in) the respective market. Each addendum prevails over the base Terms only for the users and subject matter it expressly addresses (e.g. AAA arbitration, class-action waiver and 30-day opt-out, CCPA/CPRA, the DMCA agent, and the IL/TX/WA face-upload gate in the US Addendum; LFPC/PROFECO and the aviso de privacidad in the Mexico Addendum; PIPEDA, Law 25 and Quebec language rules in the Canada Addendum). (b) No addendum applies to, or reduces the protections of, users outside its market: in particular, the US arbitration agreement and class-action waiver apply to US users only and never to an EU consumer, and no addendum displaces a mandatory protection under 24.1(b)–(c) or this Section 24. (c) No addendum, and nothing in these Terms, binds a person who is not a party to them: a depicted person, rightsholder, or other non-party keeps their direct claims in the forum the law gives them (see Sections 18.8, 19.10, 21.8a(f)).

⚠️ NOT LEGAL ADVICE — DRAFT FOR ATTORNEY REVIEW

This document remains a draft. Before any binding use: (1) resolve every [BRACKETED] fill-in (addresses, emails, URLs, notice periods, VAT regime, jurisdiction seat, plan/watermark tiers, DMCA agent registration, NCII statute citations); (2) produce a precise, non-machine-translated binding German version, with the German Widerrufsbelehrung (Anlage 1) + Muster-Widerrufsformular (Anlage 2) inserted at Section 15, a parallel ES-MX consumer/privacy disclosure for Mexico, and the French (Québécois) version required by Section 24.10(c)(3); (3) have an attorney confirm each statutory citation; (4) confirm with an insurer the foreseeable-typical-damage exposure under Section 17.3 and set any numerical cap only to genuinely-covered levels; (5) verify the load-bearing build prerequisites are live before publishing as binding — the un-pre-ticked clickwrap + "Terms accepted at/version" logging (Section 3), the §327h separate AI-output acknowledgment (Section 16.1.4) and the §356(5) immediate-performance withdrawal-waiver checkboxes per purchase type (Section 15.4), the §312k cancellation button (Sections 14.5 / 22.2), the PangV total-price display, the C2PA/IPTC provenance marking by 2 Aug 2026 incl. the marking-before-gift-link-activation check (Sections 20.3 / 20.6), the gift-link deletion/cache-purge (Section 21.7), the TDDDG consent banner gating Clarity (Section 19.9), the NCII channel + 24h/48h SLA + hash re-upload block (Section 21.8a), the statement-of-reasons tooling and takedown-notice/strike log (Sections 21.5 / 22.5(c) / 22.6(a)), the depicted-person rights channel (Section 19.10), the IL/TX/WA face-upload geo-gate (Sections 19.7(d) / 11.4(c)), and the generation-time consent attestation where Section 20.5(f) is relied on — several clauses are a misrepresentation (UWG §5 / §280 BGB) until the corresponding code ships; and (6) confirm the PRC-processing factual assertion (Sections 12.4 / 19.6) against fal.ai/ByteDance's actual infrastructure.