# Komashi Docs > Documentation for the Komashi service and subscription platform: provider setup, customer workflows, developer integrations, and legal policies. English is the default and authoritative language. Hungarian documentation is available at /docs/hu/. For current prices, see the pricing page at https://komashi.com/pricing; for legal obligations, use the current legal documents rather than calculators or short helper answers. --- # Komashi documentation > Set up Komashi, manage services and subscriptions, integrate your tools, and find guides for providers, customers, and developers. Canonical: https://komashi.com/docs/ Language: en ## Explore the documentation - [Getting started](https://komashi.com/docs/provider/get-started/get-started-with-komashi/index.md): Create your provider account and publish your first service. - [Provider guides](https://komashi.com/docs/provider/who-is-a-provider/index.md): Manage your services, customers, subscriptions, and business settings. - [Developers](https://komashi.com/docs/provider/Developers/who-is-a-developer/index.md): Connect Komashi with widgets, the REST API, and MCP. - [End users](https://komashi.com/docs/end-user/who-is-an-end-user/index.md): Find your services and manage your account, billing, and subscriptions. - [Legal](https://komashi.com/docs/legal/index.md): Terms, privacy information, and policies for using Komashi. --- # Billing Profiles > A billing profile is a billing identity you keep in your Komashi account — a name, country, VAT number, and address that appears on the invoices for your… Canonical: https://komashi.com/docs/end-user/billing-profiles/ Language: en A **billing profile** is a billing identity you keep in your Komashi account — a name, country, VAT number, and address that appears on the invoices for your subscriptions. You can keep several (for example a personal one and a company one) and choose which profile each subscription is billed to. Video (English narration): [Billing profiles](https://www.youtube.com/watch?v=oeoHz-Juyb4) Open **Billing Profiles** from the user menu in the storefront. ## Create a billing profile 1. Open the user menu and choose **Billing Profiles**. 2. Click **New billing profile**. 3. Fill in the billing details: name, country, VAT number, address, and any note. 4. Pick a **Preferred language** for the profile. 5. Save it. The preferred language sets the language of the emails about this profile. Komashi falls back to your account language, then to the provider's country, then to English. See [What languages does Komashi support?](https://komashi.com/docs/general/what-languages-does-komashi-support/index.md). Each profile keeps its own subscriptions and invoices, so they stay organized separately. ## Choose a profile when subscribing When you subscribe to a service, you pick which billing profile the subscription is billed to. Your subscriptions and invoices are attached to that profile — a customer can hold subscriptions across different providers, grouped by the billing profile used. ## Share a billing profile You can **share a billing profile** with other users so they can use or manage it. Shared users get access rights depending on the **role** you assign them. This is how a subscription can effectively be shared between people — see [Can I share my subscription with someone else?](https://komashi.com/docs/end-user/your-account/index.md). | Role | What it can do | |---|---| | **Admin** | Full control of the billing profile: edit it, delete it, manage contacts, invite members, change roles, revoke invites, and remove other users. | | **User** | Read-only: can view the billing profile, contacts, subscriptions, and invoices, but cannot edit or delete the profile, manage contacts, invite members, change roles, revoke invites, or remove other users. | When you invite someone, pick the role next to their email address. The sharing table lists every member with their role, and an Admin can change a member's role or remove their access. A billing profile always needs at least one Admin, so the last Admin cannot be removed or demoted. :::note[A billing profile is a **customer-side** identity — it is not the same as a **provider**. Providers are the businesses that sell services; a billing profile is how you, as a customer, are billed. Providers manage their own legal billing details separately.] ::: --- # Browse Services > You reach a provider's services through the provider's own storefront, not through a central directory. A provider shares their store with you in one of… Canonical: https://komashi.com/docs/end-user/browse-services/ Language: en You reach a provider's services through the **provider's own storefront**, not through a central directory. A provider shares their store with you in one of these ways: Video (English narration): [Browse a storefront](https://www.youtube.com/watch?v=YCToq1f96IM) - **A storefront link** — each provider has its own address, such as `yourbrand.komashi.com`. Open the link the provider gave you to see their services and plans. - **An embedded widget** — the provider may embed the Komashi subscribe widget directly on their own website, so you can subscribe without leaving their page. ## On a provider's storefront Once you open a provider's storefront you can: - **View services and plans** — see what the provider offers, with pricing and plan comparison. - **Subscribe** — pick a plan and check out. - **Manage subscriptions** — under **My subscriptions**, view plan, status, and price, and upgrade, downgrade, or cancel where the provider allows it. - **Manage billing profiles** — under **Billing Profiles**, keep one or more billing identities and choose which one a subscription is billed to. :::note[There is no central "Marketplace" directory on this instance — you always start from a specific provider's storefront link or embedded widget.] ::: --- # Report an Issue > Report an Issue: Where you report a problem depends on what the problem is. Contact the provider — the business you bought from. They are responsible for… Canonical: https://komashi.com/docs/end-user/report-issue/ Language: en Where you report a problem depends on what the problem is. Video (English narration): [Report an issue](https://www.youtube.com/watch?v=Om_Qq9vPYvI) --- ## Problems with the service you bought Contact the **provider** — the business you bought from. They are responsible for their own services and for resolving complaints about them: what was delivered, quality, cancellations, and refunds. Their contact details are on their storefront page. See [How do I contact the provider directly?](https://komashi.com/docs/end-user/browse-services/index.md). --- ## Problems with the platform itself Contact Komashi for technical issues, your account, your data, or Komashi's own conduct — for example a page that won't load or a login that won't work. 1. Click the **?** icon to open the support panel. 2. Open the **Chat** tab. (The **Help** tab searches the documentation, if you would rather look for the answer yourself.) 3. Describe the issue you are experiencing as **clearly and precisely** as possible. 4. If available, **attach a screenshot** or any relevant information that helps illustrate the problem — with the caution below in mind. The chat starts with an AI assistant. It does not pull in your account records: only what you type or attach is sent to it. You can ask for a member of the Komashi team at any point in the conversation. :::caution[What you send to the chat leaves the EU] The text and files you send to the assistant are passed to Komashi's AI routing sub-processor, which is established in the **United States**, and on to the model provider it routes to. The transfer is made under the EU Standard Contractual Clauses, and the recipients may not use it for their own purposes, including model training. **Do not include personal data or anything confidential that the problem does not require** — and check a screenshot before attaching it. See [Section 6.2 of the Privacy Policy](https://komashi.com/docs/legal/privacy/index.md) and the [Sub-processors list](https://komashi.com/docs/legal/subprocessors/index.md). ::: You can also write to [info@komashi.com](mailto:info@komashi.com). Komashi acknowledges complaints without undue delay and responds substantively within a reasonable period, depending on the nature and complexity of the complaint. --- :::note[Using this process never limits your legal rights. You can always go to the consumer protection authorities or the courts available to you where you live.] ::: --- # Who is an End User? > An end user is a person who uses the services offered by providers on the Komashi platform. Canonical: https://komashi.com/docs/end-user/who-is-an-end-user/ Language: en ## Who is an End User? An **end user** is a person who uses the services offered by providers on the Komashi platform. If you **buy or subscribe to a service** through Komashi — through a provider's storefront or their own product — you are an end user. --- ## Who you are actually buying from Komashi is the software. The **provider** is the business you are buying from. When you book, order, or buy a service, **your contract is with the provider, not with Komashi**. The provider is responsible for the service itself — its description, price, quality, delivery, and legality — and for its own cancellation and refund policy. The provider's identity and contact details are shown on its storefront. :::note[Money flow] ``` End User → Payment Provider → Provider ``` Your payment goes straight from you, through an independent licensed payment company, to the provider. Komashi never holds or receives your money and is not the merchant you are paying — the name on your card statement identifies the provider, not Komashi. Komashi does not charge you anything for using the Platform as a customer. ::: --- ## What End Users Can Do End users can: - **Browse a provider's services** on the provider's storefront - **Subscribe to plans** on a monthly or yearly basis - **Manage their subscriptions** — upgrade, downgrade, or cancel - **View and download invoices** for their purchases - **Manage billing profiles** — keep one or more billing identities for their subscriptions --- ## How End Users Access the Platform End users can reach Komashi-powered services in two ways: - **Through a provider's storefront** — open the provider's store link (for example `yourbrand.komashi.com`) to browse and subscribe - **Through a provider's own product** — if the provider has integrated the Komashi Widget or API into their platform An end user does not need to know they are using Komashi. They interact with the provider's service, and Komashi works in the background. --- ## End Users vs. Providers The difference is simple: **providers create and sell services; end users buy and use them.** An end user can also be a provider — for example, a freelancer who buys tools from one provider while selling their own services to other customers. In short, **end users are at the heart of the platform** — everything providers build and partners refer ultimately serves them. --- # Your storefront account > When you open a provider's storefront (for example yourbrand.komashi.com) and sign in, you get an account area for managing everything you have with that… Canonical: https://komashi.com/docs/end-user/your-account/ Language: en When you open a provider's storefront (for example `yourbrand.komashi.com`) and sign in, you get an account area for managing everything you have with that provider — and across providers you use. ## Home The **Home** page is the provider's landing page, built in their Layout editor. It shows the provider's hero section, plan comparison, add-ons, and one-time services, so you can browse and subscribe. ## My subscriptions **My subscriptions** lists your subscriptions with their **plan**, **status**, and **price**. From here you can upgrade, downgrade, or cancel where the provider allows it, and open the related invoices. Your subscriptions are grouped by the [billing profile](https://komashi.com/docs/end-user/billing-profiles/index.md) they are billed to. ## Billing Profiles Manage your billing identities — see [Billing Profiles](https://komashi.com/docs/end-user/billing-profiles/index.md) for creating, choosing, and sharing them. ## Settings The **Settings** area (in the user menu) is where you manage your account preferences. **Basic** holds your profile information: profile image, name, and **Preferred language**. The preferred language sets the interface language and the language of the emails Komashi sends you, including your login link. See [What languages does Komashi support?](https://komashi.com/docs/general/what-languages-does-komashi-support/index.md). ## Switching providers If you use more than one Komashi-powered provider, a **provider switcher** in the header lets you move between their storefronts without signing in again. ## Notifications A **notification bell** in the header surfaces updates about your subscriptions and invoices. Related: [Browse Services](https://komashi.com/docs/end-user/browse-services/index.md), [Billing Profiles](https://komashi.com/docs/end-user/billing-profiles/index.md) --- # Does Komashi have a mobile app? > There is no mobile app at the moment. Komashi is accessible via any web browser on desktop and mobile devices. Canonical: https://komashi.com/docs/general/does-komashi-have-a-mobile-app/ Language: en There is no mobile app at the moment. Komashi is accessible via any web browser on desktop and mobile devices. --- # How do I contact Komashi support? > Click the ? icon in the dashboard to open the support panel. It has two tabs: Canonical: https://komashi.com/docs/general/how-do-i-contact-komashi-support/ Language: en Click the **?** icon in the dashboard to open the support panel. It has two tabs: - **Help** — search the documentation, plus the articles that are relevant to the page you are on. - **Chat** — an AI assistant that answers your questions. It does not pull in your account records or your customers' records: **only what you type into the chat is sent to it**. If it cannot help, you can ask for a member of the Komashi team from the same conversation. :::caution[What you type into the chat leaves the EU] The text you send to the assistant — including anything you paste into it — is passed to Komashi's AI routing sub-processor, which is established in the **United States**, and on to the model provider it routes to. The transfer is made under the EU Standard Contractual Clauses, and the recipients are contractually barred from using it for their own purposes, including model training. **So do not paste personal data, customer records, or anything confidential into the chat.** Describe the problem instead. See [Section 6.2 of the Privacy Policy](https://komashi.com/docs/legal/privacy/index.md) and the [Sub-processors list](https://komashi.com/docs/legal/subprocessors/index.md). ::: ![Support panel](https://komashi.com/docs/assets/images/help-panel.png) If you cannot reach the dashboard — for example you cannot log in — write to [info@komashi.com](mailto:info@komashi.com) instead. For a bug report or a feature request, see [Where can I report a bug or suggest a feature?](https://komashi.com/docs/general/where-can-i-report-a-bug-or-suggest-a-feature/index.md) --- # How do I log in to my account? > Komashi uses passwordless login. You can sign in with your Google account or via an email verification link. No password is required. Canonical: https://komashi.com/docs/general/how-do-i-log-in-to-my-account/ Language: en Komashi uses passwordless login. You can sign in with your Google account or via an email verification link. No password is required. 1. Go to the Komashi login page. 2. Enter your email address or click **Sign in with Google**. 3. Follow the instructions sent to your inbox. The login link arrives in your **Preferred language**. See [What language will I receive emails in?](https://komashi.com/docs/general/what-language-will-i-receive-emails-in/index.md). --- # I forgot my password – how do I reset it? > Komashi uses passwordless login — no password is required. You can sign in with your Google account or via email verification link. Simply enter your email… Canonical: https://komashi.com/docs/general/i-forgot-my-password-how-do-i-reset-it/ Language: en Komashi uses passwordless login — no password is required. You can sign in with your Google account or via email verification link. Simply enter your email address on the login page and follow the instructions sent to your inbox. --- # In which countries is Komashi available? > Komashi has no country restrictions of its own — you can use it from anywhere. Canonical: https://komashi.com/docs/general/in-which-countries-is-komashi-available/ Language: en Komashi has no country restrictions of its own — you can use it from anywhere. Two practical limits apply: - You need a **payment provider** that operates in your country and accepts your business. See [Which payment providers does Komashi support?](https://komashi.com/docs/provider/Settings/08payment-providers/index.md). - As a provider, you are responsible for complying with the law where you operate — including licensing, tax, consumer protection, and sanctions and export rules. --- # Is Komashi GDPR compliant? > Yes. Komashi's Privacy Policy is built to comply with both the UAE Personal Data Protection Law (PDPL) and the EU GDPR. Canonical: https://komashi.com/docs/general/is-komashi-gdpr-compliant/ Language: en Yes. Komashi's [Privacy Policy](https://komashi.com/docs/legal/privacy/index.md) is built to comply with both the UAE Personal Data Protection Law (PDPL) and the EU GDPR. The key points: - **Roles are split.** For your customers' personal data, the **provider is the controller and Komashi is the processor**. The [Data Processing Agreement](https://komashi.com/docs/legal/data-processing-agreement/index.md) is the Article 28 GDPR agreement and forms part of every Provider Agreement. - **EU/EEA data stays in the EU/EEA.** Personal data that providers process about their EU/EEA customers is stored, backed up, processed, and accessed exclusively within the EU/EEA, on EU/EEA-established hosting and sub-processors. - **Komashi has an EU representative** under GDPR Article 27, who data subjects and supervisory authorities can contact directly. - **No card data.** Komashi does not collect, hold, or process card numbers or payment credentials. - **Sub-processors are published.** See [Sub-processors](https://komashi.com/docs/legal/subprocessors/index.md). Retention and deletion periods are in Section 9 of the [Privacy Policy](https://komashi.com/docs/legal/privacy/index.md), which is the single governing source for them. --- # What is Komashi? > Komashi is subscription management software for businesses. It handles subscriptions, payments, invoices, and access control — so you can start selling… Canonical: https://komashi.com/docs/general/what-is-komashi/ Language: en Komashi is subscription management software for businesses. It handles subscriptions, payments, invoices, and access control — so you can start selling without building your own billing infrastructure. Komashi is the software layer only. Businesses sell their own services to their own customers under their own contracts, and customer payments go directly to them through an independent licensed payment provider. :::note[Money flow] ``` End User → Payment Provider → Provider ``` Komashi is not involved in the money flow. ::: --- # What language will I receive emails in? > Komashi sends emails in your Preferred language, set under Settings → Basic in your profile. Your login link arrives in the same language. Canonical: https://komashi.com/docs/general/what-language-will-i-receive-emails-in/ Language: en Komashi sends emails in your **Preferred language**, set under **Settings → Basic** in your profile. Your login link arrives in the same language. For emails about a billing profile, Komashi checks the profile's own language first, then the account it belongs to, then the provider's billing country. Only English and Hungarian are translated. Any other choice falls back to English. Related: [What languages does Komashi support?](https://komashi.com/docs/general/what-languages-does-komashi-support/index.md), [How do I log in to my account?](https://komashi.com/docs/general/how-do-i-log-in-to-my-account/index.md) --- # What languages does Komashi support? > Komashi runs in English and Hungarian. You can pick a preferred language from a much longer list, but every choice other than Hungarian is shown in English. Canonical: https://komashi.com/docs/general/what-languages-does-komashi-support/ Language: en Komashi runs in **English** and **Hungarian**. You can pick a preferred language from a much longer list, but every choice other than Hungarian is shown in English. ## Where you set it - **Your account** — Set **Preferred language** under **Settings → Basic** in your profile. It covers the interface and the emails Komashi sends you. - **Your billing profile** — Each [billing profile](https://komashi.com/docs/end-user/billing-profiles/index.md) carries its own **Preferred language**, used for the messages tied to that profile. - **Your storefront** — Providers set the **Language** in [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md). The storefront is auto-translated into that language, and the service generator writes in it. - **Your service description** — When you create a service you pick a **Service Language**, which tells the generator which language you wrote the description in. See [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md). ## Which setting wins For messages tied to a billing profile, Komashi takes the first language it finds: 1. The billing profile's preferred language 2. The preferred language on the account linked to it 3. The provider's billing country 4. English :::note[Translation status] Only English and Hungarian are translated. Any other choice is saved as your preference, but the interface and emails stay in English. ::: Related: [What language will I receive emails in?](https://komashi.com/docs/general/what-language-will-i-receive-emails-in/index.md) This documentation is available in English only. --- # What types of businesses use Komashi? > Komashi works for any business that sells subscriptions or recurring services. Common use cases include gyms and studios, SaaS products, online courses,… Canonical: https://komashi.com/docs/general/what-types-of-businesses-use-komashi/ Language: en Komashi works for any business that sells subscriptions or recurring services. Common use cases include gyms and studios, SaaS products, online courses, coworking spaces, clubs, and communities. --- # Where can I find the terms of service and privacy policy? > All Komashi terms, policies and schedules are in the Legal section. Canonical: https://komashi.com/docs/general/where-can-i-find-the-terms-of-service-and-privacy-policy/ Language: en All Komashi terms, policies and schedules are in the [Legal](https://komashi.com/docs/legal/index.md) section. The ones most people need: - [General Terms of Service](https://komashi.com/docs/legal/terms/index.md) — applies to everyone - [Privacy Policy](https://komashi.com/docs/legal/privacy/index.md) and the [Cookie Notice](https://komashi.com/docs/legal/cookie/index.md) - [Acceptable Use Policy](https://komashi.com/docs/legal/acceptable-use-policy/index.md) and the [Platform Guidelines](https://komashi.com/docs/legal/guidelines/index.md) — what you may and may not do, and how to do it well - [Currency Terms](https://komashi.com/docs/legal/currency-terms/index.md) and the [Supported Currencies](https://komashi.com/docs/legal/currencies/index.md) — which currency you are invoiced in, and how amounts are converted - [Provider Terms](https://komashi.com/docs/legal/provider-terms/index.md) and the [Provider Fee Schedule](https://komashi.com/docs/legal/provider-fee-schedule/index.md) — if you sell through Komashi - [End User Terms](https://komashi.com/docs/legal/end-user-terms/index.md) and the [Model Withdrawal Form](https://komashi.com/docs/legal/withdrawal-form/index.md) — if you buy from a provider - [Brand Guidelines](https://komashi.com/docs/legal/brand/index.md) — binding rules for using the Komashi name and logo The Terms are also published in a machine-readable format at [`/legal/terms.json`](https://komashi.com/docs/legal/terms.json), as required by Article 14(1) of the Digital Services Act. :::note[These are Komashi's own terms. The terms your **customers** agree to for the services you sell are yours, not Komashi's — see [Set up legal links](https://komashi.com/docs/provider/get-started/set-up-legal-links/index.md).] ::: --- # Where can I report a bug or suggest a feature? > Click the ? icon in the dashboard and open a support ticket. You can use the same channel to report bugs or suggest new features. Canonical: https://komashi.com/docs/general/where-can-i-report-a-bug-or-suggest-a-feature/ Language: en Click the **?** icon in the dashboard and open a support ticket. You can use the same channel to report bugs or suggest new features. --- # Legal Overview > Index of the Komashi terms, policies and schedules, grouped by who they apply to. Canonical: https://komashi.com/docs/legal/ Language: en The Komashi terms are modular. The **General Terms** apply to everyone; on top of them you are bound by the terms for each role in which you use the Platform — provider or customer. :::note[Document status] All documents are **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: ## Everyone | Document | What it covers | |---|---| | [General Terms of Service](https://komashi.com/docs/legal/terms/index.md) | The common core: definitions, accounts, Komashi's role and non-involvement in payments, IP, liability, governing law, complaints. | | [Acceptable Use Policy](https://komashi.com/docs/legal/acceptable-use-policy/index.md) | What you may and may not do on the Platform, and how Komashi enforces it. | | [Privacy Policy](https://komashi.com/docs/legal/privacy/index.md) | How Komashi handles personal data under the UAE PDPL and the GDPR, including retention periods. | | [Cookie Notice](https://komashi.com/docs/legal/cookie/index.md) | Which cookies are set, what each is for, and how to change your consent. | | [Currency Terms](https://komashi.com/docs/legal/currency-terms/index.md) | Which currency you are invoiced in, how amounts are converted into USD, and who carries the conversion cost. | | [Supported Currencies](https://komashi.com/docs/legal/currencies/index.md) | Schedule 1 to the Currency Terms — the exhaustive list of currencies you may invoice in. **This Schedule governs.** | | [Platform Guidelines](https://komashi.com/docs/legal/guidelines/index.md) | Schedule 1 to the Acceptable Use Policy — how to do things well, and the practical detail behind the AUP's rules. | | [Brand Guidelines](https://komashi.com/docs/legal/brand/index.md) | Binding rules for using the Komashi name and logo. Providers are required to follow them. | ## If you sell through Komashi | Document | What it covers | |---|---| | [Provider Terms](https://komashi.com/docs/legal/provider-terms/index.md) | Your agreement as a provider: your relationship with your customers, fees, billing and blocking, your responsibilities, termination. | | [Provider Fee Schedule](https://komashi.com/docs/legal/provider-fee-schedule/index.md) | How the commission rates, free allowance, and loyalty period are published — the current figures are on the [pricing page](https://komashi.com/pricing). | | [Data Processing Agreement](https://komashi.com/docs/legal/data-processing-agreement/index.md) | You are the controller of your customers' personal data and Komashi is your processor. This is the Article 28 GDPR agreement. | | [DPA Annexes 1–2](https://komashi.com/docs/legal/dpa-annexes/index.md) | Processing details and Komashi's technical and organizational security measures. | | [Sub-processors](https://komashi.com/docs/legal/subprocessors/index.md) | The third parties Komashi uses to process personal data. | ## If you buy from a provider | Document | What it covers | |---|---| | [End User Terms](https://komashi.com/docs/legal/end-user-terms/index.md) | Your contract is with the provider, not with Komashi. Covers payments, cancellations and refunds, complaints, and your consumer rights. | | [Model Withdrawal Form](https://komashi.com/docs/legal/withdrawal-form/index.md) | The form to use if you withdraw from a contract with Komashi within the cooling-off period. | --- ## Two things worth knowing up front **Komashi is not part of the money flow.** ``` End User → Payment Provider → Provider ``` Payments go straight from the customer, through an independent licensed payment provider, to the provider. Komashi never holds, receives, or transmits that money, and is not a merchant of record or a payment service provider. **Your contract for a service is with the provider.** Komashi supplies the software. The provider is responsible for the service itself — its description, price, quality, delivery, and legality — and for refunds and cancellations under its own policy. --- :::note[The help pages elsewhere in this documentation explain how things work in practice. Where a help page and a legal document disagree, the legal document governs.] ::: --- # Acceptable Use Policy > Komashi Acceptable Use Policy (Module E) — what you may and may not do on the Platform. Canonical: https://komashi.com/docs/legal/acceptable-use-policy/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module E — Acceptable Use Policy (AUP)** **Version:** v1.0 · **Effective date:** 2026-08-31 This Acceptable Use Policy applies to **everyone** who uses the Komashi Platform — Providers and End Users. It is incorporated into the Komashi General Terms of Service (Module 0) and the applicable Role Terms. Capitalized terms have the meanings given in Module 0. --- ## 1. Purpose and Scope > **In short:** These are the ground rules for using Komashi, whatever your role. They exist to keep the Platform lawful and safe for everyone. *This summary is for convenience only and is not legally binding; the numbered terms govern.* 1.1. This AUP sets out what you may not do on or through the Platform. It applies to all use of the Platform, including content you upload, services you offer, and your interactions with other users. 1.2. Komashi is a technical platform only. It does not pre-screen Provider Services or User Content, and — as stated throughout the Terms — **Komashi is not part of the money flow**: payments for Provider Services pass directly from End Users, via the Payment Provider, to Providers, and Komashi never holds or controls those funds. Enforcement of this AUP is therefore limited to Platform-level measures (Section 4); Komashi cannot and does not freeze, seize, or redirect any party's funds. 1.3. **How we moderate (Regulation (EU) 2022/2065, Art. 14).** Komashi restricts the use of the Platform as set out in this AUP. Content and conduct are reviewed **on report, not by general pre-screening**: Komashi does not proactively monitor or automatically scan User Content, and applies no automated content-moderation, automated filtering, automated classification, or automated risk scoring to restrict content or accounts. Every enforcement measure under Section 4 is taken by a human reviewer, on the basis of a report received under Section 3.1, a legal or regulatory obligation, or an authority's order. The internal review route against any measure is set out in Section 4.3, and for EU users in Section 4.3a. This AUP and the Terms are published in a clear and accessible form at https://komashi.com/legal/terms and are available in a machine-readable format at https://komashi.com/legal/terms.json. ## 2. Prohibited Content and Activities > **In short:** No illegal services, no stolen content, no fraud, no selling licensed products without the license, and no abusing the Platform or the people on it. *Non-binding summary.* You must not use the Platform to do, offer, promote, or facilitate any of the following: 2.1. **Illegal services and content.** Any service, product, or content that is illegal under the laws of the UAE or of any jurisdiction you target or operate in, including content that violates UAE media and content standards. 2.1a. **Explicitly prohibited categories (zero tolerance).** Without limiting Section 2.1, the following are strictly prohibited on or through the Platform in every case: (a) illegal drugs and controlled substances; (b) weapons, firearms, and their parts, components, or ammunition; (c) human trafficking and any form of exploitation of persons; (d) pornography and any sexually explicit content; and (e) any other adult (18+) goods, services, or content. Komashi applies zero tolerance to these categories and may take immediate action under Section 4.2, including reporting to the competent authorities. 2.2. **Intellectual property infringement.** Uploading, selling, or distributing content or services that infringe copyright, trademarks, trade secrets, or other proprietary rights; using another business's branding to mislead. 2.3. **Fraud and deception.** Fraud, phishing, impersonation, fake reviews or manipulated ratings, misleading service descriptions or prices, pyramid or Ponzi schemes, money laundering, terrorist financing, or evasion of sanctions; self-dealing or fictitious transactions designed to manipulate Fees or the free-invoice allowance. 2.4. **Regulated goods and services without a license.** Offering goods or services that require a license, registration, or authorization (for example medical, legal, financial, insurance, pharmaceutical, gambling, tobacco/alcohol where restricted) without holding the required license in every jurisdiction you serve; offering payment, remittance, or other financial services through the Platform in any form. 2.5. **Harmful and abusive content.** Content that is defamatory, harassing, threatening, hateful, obscene, exploitative of minors (zero tolerance — reported to authorities), or that incites violence. 2.6. **Abuse of the Platform.** Interfering with or disrupting the Platform; probing or breaching its security; introducing malware; scraping or bulk-extracting data without permission; reverse engineering; overloading infrastructure; circumventing access controls, Fees, rate limits, or enforcement measures (including creating new Accounts to evade sanctions under this AUP). 2.7. **Abuse of other users.** Harassing, defrauding, or misusing the personal data of other users; sending spam or unsolicited communications through Platform features. 2.8. **Misrepresentation of Komashi.** Claiming or implying that Komashi endorses, guarantees, sells, or is responsible for your services; using Komashi's name or marks except as permitted. 2.9. **AI-generated content that would breach any rule above.** Producing or editing content with an AI tool is permitted, and this Policy does not require you to label it as such. What is not permitted is treating a tool's output as an exception to the rules: content made with AI must satisfy **every** requirement of this Section, and Section 6.5 of the Provider Terms applies to it in full. **You are responsible for its accuracy, for its lawfulness, and for holding the rights needed to use it, exactly as if you had written or photographed it yourself.** An AI-generated service description that misstates what the End User will receive is a misleading description under Section 2.3; an AI-generated image that infringes a third party's rights falls under Section 2.2. Separately, where an image, audio, or video file you upload was generated or manipulated by AI so that it resembles a real person, object, place, or event and would appear authentic, **you must disclose that it is artificially generated** — that obligation is placed on you as the deployer of the tool by Article 50(4) of Regulation (EU) 2024/1689, not on Komashi, and it applies whatever this Policy says. ## 3. Reporting Violations > **In short:** If you see something that breaks these rules, tell us — we review reports and take action where warranted. *Non-binding summary.* 3.1. **How to report.** Suspected violations can be reported to **info@komashi.com** or through the report form in the Komashi support system. You do not need an account to submit a report. 3.2. **What a report should contain.** So that a report can be acted on, it should include:     (a) **an explanation, sufficiently substantiated, of why you consider the content or conduct to be unlawful or in breach of this AUP**;     (b) **a clear indication of the exact electronic location of the material** — the precise URL or URLs, and any further information needed to locate it (for example the Provider's subdomain, the service or invoice reference, or the date and time of the conduct);     (c) **your name and email address**, except where the report concerns an offence referred to in Articles 3 to 7 of Directive 2011/93/EU (offences against children), for which a report may be submitted anonymously; and     (d) **a statement confirming your good-faith belief that the information in the report is accurate and complete.**     A report containing all four elements and concerning allegedly illegal content is treated as giving Komashi knowledge of that content. A report missing an element is still reviewed; it may simply take longer, and Komashi may come back to you for what is missing. 3.3. **What Komashi does with a report.**     (a) **Confirmation.** Where you have given contact details, Komashi confirms receipt without undue delay.     (b) **Review.** Reports are reviewed in a **timely, diligent, non-arbitrary and objective** manner. **The review is carried out by a person** — no automated content moderation, filtering, classification, or risk scoring is applied to it (Section 1.3).     (c) **Decision and notice.** Komashi notifies you of its decision on your report, without undue delay, and tells you what redress is available against that decision. Where a measure is taken against a user, that user receives a statement of reasons under Section 4.3b.     (d) **Limits.** Komashi does not guarantee any particular outcome and does not disclose enforcement details to reporters beyond what this Section requires or the law compels. 3.4. **Intellectual-property notices.** The owner of an intellectual-property right, or a person authorised to act for them, may submit an infringement notice to the same address. In addition to the elements in Section 3.2, the notice should identify **the right relied on and the basis on which it is held**, and, where the notice is submitted on the owner's behalf, **confirm the authority to act**.     (a) **What happens.** Where a notice is substantiated, Komashi removes or disables access to the material and notifies the Provider concerned with a statement of reasons under Section 4.3b, including a copy of the notice unless disclosure of the notifier's identity is not strictly necessary or is prohibited.     (b) **Counter-notice.** The Provider may contest the removal under Section 4.3 by explaining why the material does not infringe. Where a counter-notice is substantiated, Komashi restores the material and informs the notifier. **Komashi does not adjudicate ownership of an intellectual-property right;** where the parties' accounts genuinely conflict, Komashi may keep the material disabled until the dispute is resolved between them or by a court, and will say so to both.     (c) **Repeat and abusive notices.** Komashi may suspend the processing of notices from a person who repeatedly submits manifestly unfounded notices, after having given a prior warning. 3.5. **Orders from authorities.** An order from a competent judicial or administrative authority to act against specific illegal content, or to provide information, is dealt with under Section 4.1 and Module 0. Komashi informs the issuing authority of the effect given to the order, and informs the affected user of the order and the effect given to it, unless the order or applicable law prohibits or defers that information. 3.6. **Suspicion of a criminal offence threatening life or safety (Regulation (EU) 2022/2065, Art. 18).** Where Komashi becomes aware of any information giving rise to a suspicion that a criminal offence involving a **threat to the life or safety of a person or persons** has taken place, is taking place, or is likely to take place, it **promptly informs the law enforcement or judicial authorities** of the Member State or States concerned and makes all relevant information available to them. Where the Member State cannot be identified with reasonable certainty, Komashi informs the authorities of the Member State in which it has its legal representative (Section 16.4 of Module 0), or Europol, or both. This obligation applies regardless of Komashi's size and is not limited by Section 3.3(d). ## 4. Enforcement — Graduated Measures > **In short:** Our normal path is: warning first, then restricting features, then suspension, then termination. For serious violations — like illegal content or fraud — we can skip steps and act immediately. *Non-binding summary.* 4.1. If Komashi reasonably believes you have violated this AUP or the **Platform Guidelines (Schedule 1 to this AUP)**, it may apply the following measures, normally in escalating order and proportionate to the violation. Komashi may also restrict, suspend, or terminate your Account **unilaterally** upon the request or order of a competent authority:     (a) **Warning** — notice of the violation with an opportunity to remedy it within a stated period;     (b) **Feature restriction** — limiting specific functionality (e.g., publishing new services, API access) or removing or unpublishing specific content;     (c) **Suspension** — temporarily blocking the Account or the public availability of a Provider presence, per Section 12.2 of Module 0;     (d) **Termination** — closing the Account and terminating the applicable agreement, per Section 12.3 of Module 0. 4.2. **Severe violations.** For severe violations — including illegal content or services, fraud, threats to the security of the Platform or its users, content exploitative of minors, or violations creating legal exposure for Komashi — **Komashi may apply any measure immediately, at its discretion, without prior warning or escalation**, and may notify and cooperate with law enforcement and competent authorities. 4.3. **Notice and review.** Where reasonably practicable and legally permitted, Komashi will notify you of the measure taken, the reason, and how to seek review by replying to the notice or writing to info@komashi.com. Komashi will lift measures where a review shows they were not justified. This Section does not apply where notice would compromise an investigation or is prohibited by law. For Providers within the scope of Regulation (EU) 2019/1150, the additional requirements of Module A Section 5.2a apply. 4.3a. **EU users — Digital Services Act (Regulation (EU) 2022/2065).** Where the DSA applies to Komashi in respect of EU users: (a) notices of allegedly illegal content may be submitted through the channel in Section 3.1 and are processed as set out in Sections 3.2 and 3.3 (Art. 16); (b) the **statement of reasons** required by Art. 17 is given as set out in Section 4.3b; and (c) if and when Komashi qualifies as an "online platform" under the DSA and ceases to benefit from the micro/small-enterprise exemption, Komashi will additionally operate the internal complaint-handling system required by Art. 20. Nothing in this Section limits Komashi's rights under Section 4.2 in cases of illegality, fraud, or security threats. 4.3b. **Statement of reasons.** Where Komashi restricts a user because content the user provided is alleged to be illegal or incompatible with the Terms, it gives that user a **clear and specific statement of reasons**. This applies to: restricting the visibility of specific content, including removing it, disabling access to it, or demoting it; suspending, terminating or otherwise restricting monetary payments; suspending or terminating the provision of the Service in whole or in part; and suspending or deleting the Account. The statement of reasons contains at least:     (a) which measure has been taken and, where relevant, its **territorial scope and duration**;     (b) the **facts and circumstances** relied on, including whether the measure follows a report under Section 3 or Komashi's own investigation, and — where strictly necessary — the identity of the person who reported;     (c) whether **automated means** were used to take the decision, and whether the content was detected or identified by automated means (**at present, neither: see Section 1.3**);     (d) where the measure concerns allegedly **illegal** content, the **legal ground** relied on and why the content is considered illegal on that ground;     (e) where the measure is based on **incompatibility with the Terms**, the **contractual provision** relied on and why the content is considered incompatible with it; and     (f) **how to seek review** of the decision (Section 4.3).     A statement of reasons is not given where the content is deceptive high-volume commercial content, or where giving it would be prohibited by law or would compromise an investigation (Section 4.3). 4.4. **Preservation of rights.** Enforcement measures do not affect your accrued payment obligations, Komashi's right to claim damages, or the survival provisions of Module 0. ## 5. No Liability for Enforcement > **In short:** If we sanction an account under these rules, we're not liable for the consequences to that account holder — except where the law says otherwise, and consumers always keep their mandatory rights. *Non-binding summary.* 5.1. To the maximum extent permitted by applicable law, Komashi shall have no liability toward the sanctioned party for damages, losses, or lost business resulting from enforcement measures applied in accordance with this AUP, including removal of content, feature restrictions, suspension, or termination. 5.2. Nothing in this Section 5 excludes liability that cannot be excluded under mandatory applicable law (including Komashi's willful misconduct or gross negligence — Section 10.3 of Module 0), and nothing in this AUP limits the mandatory consumer rights of End Users (Section 14 of Module 0). 5.3. For the avoidance of doubt, enforcement never involves any dealing with funds: because Komashi is not part of the money flow, questions of refunds or payments between Providers and End Users following an enforcement measure remain exclusively between those parties and the Payment Provider, subject to the Provider's obligations under Module A. ## 6. Changes > **In short:** We may update this Policy with advance notice for material changes. If you keep using the Platform after a change takes effect, you accept it. *Non-binding summary.* 6.1. Komashi may update this AUP in accordance with Section 4 of Module 0 (advance notice and grace period for material changes). Continued use after the effective date constitutes acceptance. --- # Brand Guidelines > Binding rules for using the Komashi name and logo — what Providers may and may not say. Canonical: https://komashi.com/docs/legal/brand/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Published at:** https://komashi.com/legal/brand **Version:** v1.0 · **Effective date:** 2026-08-31 **These guidelines are binding.** The Provider Terms require you to follow them: **Module E, Schedule 1, Section 2.3** (Providers). Use of the Komashi name or marks outside what is permitted here is a breach of those terms and of **Acceptable Use Policy Section 2.8**. "**Komashi**" and the Komashi logo are marks of **BMSHI TECHNOLOGY SERVICES - FZCO**. Nothing here transfers ownership or grants a licence beyond the limited permissions below, and permission may be withdrawn. --- ## 1. The one rule everything else follows from > **You use Komashi. You are not Komashi, and Komashi does not stand behind what you sell.** Every rule below is a way of keeping that clear to the person reading your page. It matters because your customers contract with **you**, not with Komashi (**End User Terms Section 1.2**) — and if your marketing suggests otherwise, you have created exactly the confusion the Terms are written to prevent, and the liability lands where the confusion points. ## 2. If you are a Provider ### 2.1 You may - say that you **use**, **run on**, or **are powered by** Komashi; - state that bookings, invoicing, or payments on your site are **handled through the Komashi platform**; - display the Komashi logo as a "powered by" credit, at a size **no larger than your own logo**; - link to `komashi.com`. ### 2.2 You may not - say or imply that Komashi **provides, endorses, guarantees, approves, certifies, vets, or is responsible for** your services; - describe yourself as a **partner, agent, representative, reseller, or affiliate** of Komashi, or as "official", "certified", or "verified" by Komashi — none of those relationships exists; - use Komashi's name or logo in a way that makes Komashi look like **the seller**, or more prominent than your own brand; - put "Komashi" in your **company name, trading name, domain name, app name, or social media handle**, alone or combined with other words; - register or use a mark, logo, or name **confusingly similar** to Komashi's; - use Komashi's marks in a way that suggests **Komashi vouches for the quality, safety, legality, or licensing** of what you sell. Komashi does not verify any of these (**Module E, Schedule 1, Section 2.4**). ### 2.3 Suggested wording > ✅ "Bookings and invoicing powered by Komashi." > ✅ "We use Komashi to manage bookings and send your invoice." > ❌ "Komashi-certified provider." > ❌ "Book securely with Komashi." *(suggests Komashi is the seller)* > ❌ "A Komashi partner." *(you are not)* ## 3. [Reserved] [This Section is intentionally left blank; the numbering of the other Sections is unchanged.] ## 4. Using the marks correctly | | | |---|---| | **Name** | Write it **Komashi** — one word, initial capital. Not KOMASHI, komashi, KomaShi, or Komashi™ unless the mark is registered in the jurisdiction where you publish | | **Never a verb or a noun** | "Komashi" is not "to komashi" and there is no "a Komashi". Write "using Komashi", not "komashi-ing" | | **Logo integrity** | Do not stretch, recolour, rotate, outline, add effects to, or partially crop the logo, and do not place it inside another mark or lock it up with your own | | **Clear space** | Keep clear space around the logo at least equal to the height of the "K" | | **Contrast** | Place the logo only on backgrounds where it stays legible | | **Attribution** | Where a credit line is appropriate: *"Komashi is a trademark of BMSHI TECHNOLOGY SERVICES - FZCO."* | **Logo files.** Use only the files Komashi supplies. Do not recreate, trace, or export the logo from a screenshot. **How to get them.** Request the logo pack at **info@komashi.com**, stating how you intend to use the mark. Komashi supplies the approved files together with the permitted colour values and the minimum permitted size, and those accompany the files rather than being restated here so that they cannot drift out of step with the assets actually issued. **A downloadable pack will be published at https://komashi.com/legal/brand when available; until then the email route is the only approved source.** **Two rules that apply whether or not you have the pack.** Reproduce the logo only in the colours in which Komashi supplied it to you, or in solid black or solid white where the background requires it — no other recolouring. And do not reproduce it so small that the wordmark is not clearly legible; if in doubt, use it larger. ## 5. What Komashi may do Komashi may ask you to **change or stop** any use of its name or marks, and you must comply **without undue delay**. Komashi may also identify you as a Provider in its own materials; if you do not want that, tell us at **info@komashi.com**. ## 6. Questions, and reporting misuse Anything not expressly permitted here needs written permission first. If you are unsure, ask — asking costs nothing and a takedown request costs both of us time. **Contact and misuse reports:** **info@komashi.com** --- *These guidelines may be updated. Material changes are notified under **Module 0, Section 4**. The current version is always the one published at the address above.* --- # Cookie Notice > The cookies and similar technologies used on the Komashi Platform, what each is for, and how to change your consent. Canonical: https://komashi.com/docs/legal/cookie/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Published at:** https://komashi.com/legal/cookies **Version:** v1.0 · **Effective date:** 2026-08-31 This Notice explains the cookies and similar technologies used on the Komashi Platform, what each is for, and how long it lasts. It supplements **Section 8 of the Privacy Policy**, which governs; where the two differ, the Privacy Policy prevails. **Change your choice at any time:** https://komashi.com/legal/cookie-settings --- ## 1. What this covers "Cookies" here means cookies and equivalent technologies — local storage, session storage, pixels, and SDK identifiers. The legal test is the same for all of them: **storing or reading anything on your device needs your consent unless it is strictly necessary** to provide the service you asked for. ## 2. Two categories, and only two **Komashi sets no advertising cookies and no cross-site tracking cookies.** There is no ad network, no retargeting pixel, and no data broker in the Platform. That is a commitment in **Privacy Policy Section 8.2**, not a description of current practice, and it will not change without notice under **Module 0 Section 4**. | | Consent needed? | What it does | |---|---|---| | **Strictly necessary** | **No** | Signing you in, keeping your session, security and anti-fraud, load balancing, and remembering your cookie choice itself. Without these the Platform cannot work | | **Analytics** | **Yes** | Helps us understand how the Platform is used so we can improve it. Nothing here is needed to run the Platform, and refusing costs you no functionality | **No means no.** If you refuse analytics, none is set. Refusing is as easy as accepting, your choice is remembered, and you can change it later at the address above. ## 3. Cookies set by Komashi | What it does | Category | How long it lasts | |---|---|---| | **Keeps you signed in.** Holds your session after you sign in with a login link or code, so you do not have to re-authenticate on every page | Strictly necessary | **Session** — it expires when you sign out or close the browser | | **Remembers your display preferences.** Your interface language and your time zone, so the Platform shows dates, times and text the way you set them. Your time zone also determines time-based calculations under the Terms (Module 0 §2.4a) | Strictly necessary | **Up to 12 months** | | **Remembers your cookie choice.** Records whether you accepted or refused analytics, when, and against which version of this Notice, so that we do not ask again and can show that your choice was respected | Strictly necessary — *the record of a refusal is itself necessary* | **Up to 12 months** | All three are **first-party**: they are set by Komashi on the Komashi domain, and no one else reads them. **Exact names and durations.** The live, per-cookie detail — the exact name of each cookie as it is set on your device, and its exact expiry — is shown in the cookie settings panel at https://komashi.com/legal/cookie-settings, which reflects what is actually running rather than what was true when this Notice was last edited. The categories and the durations stated above are commitments and do not change without notice under **Module 0 Section 4**. ## 4. Cookies set by others ### 4.1 On the Komashi Platform Where you consent to analytics, **Google** may set cookies on Komashi's own account. Google is Komashi's sub-processor for this, is established in the **United States**, and the transfer is made under the Standard Contractual Clauses — see **Privacy Policy Section 6.2(c)** and the sub-processor list at https://komashi.com/legal/subprocessors. If you choose to **sign in with Google**, Google receives the sign-in request and returns your name, email address and account identifier. This happens because you chose that sign-in method; using an email address and password instead avoids it entirely. | Cookie | Set by | What it does | Category | How long it lasts | |---|---|---|---|---| | `_ga` | Google | Distinguishes one visitor from another so that visits can be counted without identifying you by name | Analytics — **consent required** | Up to 2 years | | `_ga_` | Google | Keeps the state of a single analytics session for the specific Komashi property | Analytics — **consent required** | Up to 2 years | Both are **third-party** cookies set on Komashi's own Google Analytics account. **Neither is set unless you accept analytics**, and refusing costs you no functionality. The durations shown are Google's defaults for these cookies; the value in force is shown in the cookie settings panel. ### 4.2 On a Provider's own presence A **Provider** may switch on its own analytics — Google Analytics or Microsoft Clarity — for its own pages, **on the Provider's own account and under the Provider's own legal basis** (Provider Terms Section 6.7). Those are **not Komashi's cookies**: Komashi does not choose them, does not receive the data, and cannot answer for them. **Ask that Provider, not us.** Its identity and contact details are on its page and on your order confirmation. This Notice covers only what Komashi sets. ## 5. Managing cookies - **The Platform:** https://komashi.com/legal/cookie-settings — change or withdraw consent at any time. Withdrawal takes effect immediately and does not affect the lawfulness of what was collected beforehand. - **Your browser:** every major browser lets you block or delete cookies. Blocking strictly necessary cookies will stop the Platform working. ## 6. Your rights, and who to ask Where analytics cookies process personal data, **Privacy Policy Sections 7 and 11** apply — access, erasure, objection, and complaint to a supervisory authority. Questions about this Notice: **info@komashi.com**. --- *This Notice is updated whenever the cookies change. Material changes are notified under **Module 0 Section 4**.* --- # Supported Currencies > Schedule 1 to the Currency Terms — the exhaustive list of currencies you may invoice in through the Platform. Canonical: https://komashi.com/docs/legal/currencies/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Parent agreement.** This Schedule forms part of the **Komashi Currency and Exchange-Rate Terms (Module F)**, which are incorporated into the **Komashi General Terms of Service (Module 0)**. Capitalized terms not defined here have the meanings given in Module F and Module 0. **Schedule version:** v1.0 **Schedule effective date:** 2026-08-31 **Published at:** https://komashi.com/legal/currencies *(this Schedule governs; in case of conflict between any currency list published elsewhere — including any list published by a Payment Provider — this Schedule prevails).* **Maintenance / amendment.** Currencies are **added** under Module F Section 3.3, with effect on publication. Currencies are **removed** under Module F Section 3.4, on at least **30 days'** prior notice (durable medium for Providers within the scope of Regulation (EU) 2019/1150 — Module A Section 5.2a); invoices already issued in a removed currency remain valid and payable in that currency. Each change carries a new version number and effective date, and superseded versions are retained and available on request under **Section 4.5 of Module 0**. --- ## 1. Supported Currencies Invoices may be issued through the Platform only in a currency listed below (Module F Section 3.1). **This list is exhaustive.** The Platform's currency selector offers exactly the currencies below, in this order, and no others. A currency that is not on this list cannot be selected, whether or not a Payment Provider would accept it (Section 2). | # | Currency | Code | Minor units | Notes | |---|---|---|---|---| | 1 | Euro | EUR | 2 | Base currency of the Reference Rate (Module F Section 4.2) | | 2 | US dollar | USD | 2 | **Billing Currency** (Module F Section 2.1) | | 3 | Pound sterling | GBP | 2 | | | 4 | Swiss franc | CHF | 2 | | | 5 | Hungarian forint | HUF | **0 in practice** | **Invoiced in whole forints — no decimals** (Section 3.1). ISO 4217 assigns 2 minor units, but the currency is not used that way and Payment Providers require whole-unit amounts | | 6 | Polish złoty | PLN | 2 | | | 7 | Czech koruna | CZK | 2 | | | 8 | Romanian leu | RON | 2 | | | 9 | Swedish krona | SEK | 2 | | | 10 | Norwegian krone | NOK | 2 | | | 11 | Danish krone | DKK | 2 | | | 12 | Icelandic króna | ISK | **0** | **Invoiced in whole krónur — no decimals** (Section 3.1), on the same basis as HUF | | 13 | Japanese yen | JPY | **0** | **Zero-decimal currency — whole yen only** (Section 3.1) | | 14 | Canadian dollar | CAD | 2 | | | 15 | Australian dollar | AUD | 2 | | | 16 | New Zealand dollar | NZD | 2 | | | 17 | Chinese yuan renminbi | CNY | 2 | | | 18 | UAE dirham | AED | 2 | **The European Central Bank publishes no euro reference rate for AED.** Conversion therefore runs the fallback chain in Module F Section 4.2, and the source used is identified on the invoice or statement. This is the only currency on this list in that position | | 19 | Brazilian real | BRL | 2 | | | 20 | Indonesian rupiah | IDR | 2 | | | 21 | Mexican peso | MXN | 2 | | | 22 | Malaysian ringgit | MYR | 2 | | | 23 | Singapore dollar | SGD | 2 | | | 24 | Hong Kong dollar | HKD | 2 | | | 25 | Thai baht | THB | 2 | | | 26 | Philippine peso | PHP | 2 | | | 27 | South Korean won | KRW | **0** | **Zero-decimal currency — whole won only** (Section 3.1) | | 28 | South African rand | ZAR | 2 | | **Reference-rate coverage.** The European Central Bank publishes a euro reference rate for **every currency on this list except AED**. For the twenty-seven covered currencies, conversion under Module F Section 4 uses the ECB rate directly or cross-rated through the euro. For **AED**, and for any currency later added for which the ECB publishes no rate, conversion follows the fallback chain in **Module F Section 4.2** — the issuing country's central bank, then the International Monetary Fund, then the Payment Provider — and the source used is identified on the invoice or statement. ## 2. Currencies not on this list **A currency that is not listed in Section 1 cannot be selected on the Platform**, whether or not a Payment Provider would accept it for the payment method used. Acceptance by a Payment Provider is a necessary condition for a currency to be supported, not a sufficient one: a currency is supported only once Komashi has also enabled it and added it to Section 1 (Module F Section 3.2). Komashi is under no obligation to support any particular currency, may add one under Module F Section 3.3 with effect on publication, and may remove one under Module F Section 3.4 on notice. ## 3. Format and minimum-amount constraints **3.1. Decimals follow the currency.** The Platform accepts and displays an amount with the number of decimal places that the Invoice Currency actually has. Where a currency has minor units — for example USD or EUR, where USD 0.50 is a valid amount — decimals are accepted. **Where a currency is used without minor units in practice, decimals are not accepted and the amount must be a whole number.** On the list in Section 1 that applies to **four currencies: HUF, ISK, JPY and KRW**. Amounts in those currencies are entered and invoiced in whole units. Every other currency in Section 1 takes two decimal places. **3.2. Validation happens at entry.** The Platform validates the amount against the rule in Section 3.1 when the price or invoice line is entered, and rejects an amount that is not valid in that currency, rather than accepting it and failing later at the Payment Provider. **3.3. Payment Provider constraints.** A Payment Provider may apply further constraints of its own — in particular a **per-currency minimum charge amount**, and for some currencies a requirement that the amount be a whole multiple of the minor unit. These are the Payment Provider's rules, not Komashi's, and they may change. Where the Platform is aware of such a constraint it is noted in the table in Section 1 and applied at entry under Section 3.2. **A Payment Provider's constraint can never widen this Schedule**: if a Payment Provider accepts a currency that Section 1 does not list, that currency remains unavailable on the Platform (Section 2). **3.4. Responsibility.** Subject to Sections 3.1 to 3.3, Providers remain responsible for setting prices that are valid and correct in the Invoice Currency (Module F Section 3.6). ## 4. Conversion All amounts in a currency other than USD are converted to USD for Fee purposes at the Reference Rate for the Conversion Date, in accordance with **Module F Section 4** (European Central Bank reference rate, cross-rated through the euro; last day of the calendar month, UTC; no margin). --- # Currency Terms > Komashi Currency and Exchange-Rate Terms (Module F) — invoice currencies, conversion into USD, and who carries currency cost. Canonical: https://komashi.com/docs/legal/currency-terms/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module F — Currency, Exchange Rates and Payouts** **Version:** v1.0 · **Effective date:** 2026-08-31 These Currency Terms apply to every person and entity that uses the Komashi Platform in any role — as a Provider or an End User. They are incorporated into the **Komashi General Terms of Service (Module 0)** and form part of the Terms. Capitalized terms not defined here have the meanings given in Module 0. --- ## 1. Scope; Relationship to the Other Modules > **In short:** This Module is the single place where currency questions are answered: which currencies you can invoice in, how amounts in other currencies are converted into US dollars for our fees, the currency we invoice and pay in, and who carries the cost when money has to be converted. *This summary is provided for convenience only and is not legally binding; the numbered terms below govern.* 1.1. This Module governs all currency, currency-conversion and exchange-rate matters under the Terms, including: (a) the currencies in which Providers may invoice through the Platform; (b) the conversion of amounts into USD for the purpose of calculating Fees; (c) the currency in which Komashi invoices Fees; and (d) the allocation of currency risk and of currency-conversion costs. 1.2. This Module is incorporated into the Terms under Section 1.2 of Module 0 and applies to Providers and End Users in their respective roles. **On currency and exchange-rate matters, this Module prevails over the Role Terms (Modules A and C) and their Schedules**, provided that Sections 6, 10, 14 and 15 of Module 0 continue to prevail in all cases (Module 0 Section 3.2). 1.3. **No currency service; no regulated activity.** Nothing in this Module makes Komashi a provider of currency exchange, money remittance, hedging, or any other regulated financial service. The conversions described in Sections 4 and 7 are **accounting conversions used to calculate amounts owed under the Terms**. Where money actually changes currency, that conversion is performed by a bank, a card issuer, or a Payment Provider under its own terms and its own licence — never by Komashi (Module 0 Sections 1.3 and 6). ## 2. Definitions > **In short:** These are the currency words used throughout this Module, and what they mean. Everything Komashi bills and pays is in US dollars. *Non-binding summary.* 2.1. "**Billing Currency**" means **US dollars (USD)**: the currency in which Komashi calculates, invoices and collects Fees. 2.2. "**Conversion Date**" has the meaning given in Section 4.3. 2.3. "**Invoice Currency**" means the Supported Currency in which a Provider issues a particular invoice through the Platform. 2.4. "**Reference Rate**" means the exchange rate determined under Section 4.2. 2.5. "**Supported Currency**" means a currency listed in the Supported Currencies List as in force from time to time. 2.6. "**Supported Currencies List**" means the list of Supported Currencies published as **Schedule 1 to this Module** at **https://komashi.com/legal/currencies**, which forms part of this Module and has its own version and effective date. ## 3. Supported Currencies > **In short:** You can invoice only in the currencies on our published list. That list follows what our payment partners can actually process. We can add a currency at any time; if we ever remove one, you get advance notice and the invoices you have already issued stay valid. *Non-binding summary.* 3.1. **Only Supported Currencies.** Invoices may be issued through the Platform **only in a Supported Currency**. The Platform does not permit the selection of a currency that is not on the Supported Currencies List, and Komashi is under no obligation to support any particular currency. 3.2. **How the list is set.** The Supported Currencies List comprises those currencies that (a) are accepted by the Payment Provider(s) integrated with the Platform for the relevant payment method, and (b) Komashi has enabled on the Platform. **The Supported Currencies List — and not any list published by a Payment Provider — is the contractual reference.** A change in a Payment Provider's own currency coverage does not, by itself, change the Supported Currencies List or the Terms. 3.3. **Adding a currency.** Komashi may add a currency to the Supported Currencies List at any time, with effect on publication (Module 0 Section 4.2a(a)). 3.4. **Removing a currency.** Komashi will give at least **30 days'** prior notice before removing a currency from the Supported Currencies List, in accordance with Section 4 of Module 0 and, for Providers within the scope of Regulation (EU) 2019/1150, on a durable medium (Module A Section 5.2a). With effect from the removal date: (a) no new invoice may be issued in that currency; (b) invoices already issued in that currency **remain valid and payable in that currency**, and Commission on them continues to be calculated under Section 4; and (c) you are responsible for selecting a replacement Supported Currency for your future invoices. 3.5. **Your responsibility for the currency you choose.** You are solely responsible for ensuring that the Invoice Currency you select is lawful and appropriate for your business, your customers, and your tax obligations, including any requirement of applicable law to invoice, report, or account for tax in a particular currency. Section 6.4a of Module A (correct configuration) applies to your currency configuration in the same way as it applies to your time-zone and VAT configuration. 3.6. **Currency format.** Amounts must comply with the format requirements of the relevant currency and of the Payment Provider, including minor-unit conventions and any minimum-amount or rounding constraints the Payment Provider applies to a given currency. You are responsible for setting prices that are valid in the Invoice Currency. 3.7. **End User payments.** The currency in which an End User is charged, any conversion applied to that payment, and any charge for that conversion are matters between the End User, the Provider, the End User's card issuer or bank, and the Payment Provider. Consistent with Section 6 of Module 0, **Komashi is not part of that money flow and applies no conversion to it**. ## 4. Conversion into USD for Fee and Commission Purposes > **In short:** Everything we bill or pay is worked out in US dollars. If you invoice in another currency, we convert it using a public reference rate fixed once a month — the same rate for everyone, shown on your invoice and statement. *Non-binding summary.* 4.1. **What is converted.** Where an amount relevant to the Terms is denominated in a currency other than USD, it is converted into USD for the purposes of: (a) determining the annual-revenue band under Section 4.1 of Module A and Schedule 1 to Module A; (b) calculating the Commission; (c) applying the free allowance under Section 4.2 of Module A (the "largest invoices" being determined by reference to their USD-converted gross value); and (d) applying any threshold, cap, or other amount expressed in USD in the Terms. 4.2. **Reference Rate.** The Reference Rate is the **euro foreign-exchange reference rate published by the European Central Bank**, cross-rated through the euro where neither currency is the euro, as published for the Conversion Date. If no rate is published for a currency on the Conversion Date, the most recently published rate for that currency applies. If the European Central Bank publishes no rate for a currency at all, Komashi applies the following sources, **in this order**, and identifies on the invoice or statement which source was used:     (a) the rate published for the Conversion Date by the **central bank of the country issuing that currency**; failing which     (b) the rate published for the Conversion Date by the **International Monetary Fund** (representative exchange rates for selected currencies); failing which     (c) the rate reported to Komashi for that currency by the Payment Provider for the Conversion Date.     Sources (a) and (b) are **publicly published rates that you can verify independently**; source (c) is used only where no public rate exists. Komashi applies no margin to any of them (Section 4.5). 4.3. **Conversion Date.** The Conversion Date is the **last day of the calendar month to which the Fee or the accrual relates**, determined in **UTC** irrespective of any Provider's Local time (Module 0 Section 2.4a). A single Reference Rate per currency therefore applies to every user for that month, irrespective of the date of the individual invoice or payment. Which invoices fall into a given billing month is determined under Section 4.1 of Module A (Local time); the Reference Rate applied to that month is determined under this Section (UTC). 4.4. **No margin.** Komashi applies **no margin, spread, or handling charge** to the Reference Rate for the purposes of this Section 4. 4.5. **Rounding.** The Reference Rate is applied to six (6) decimal places; converted amounts are rounded to two (2) decimal places, half up. 4.6. **Transparency.** Each Fee invoice states the amount in the original currency, the Reference Rate applied, the Conversion Date, and the resulting USD amount. 4.7. **Rate movements are not amendments.** Movements in the Reference Rate are not changes to the Terms or to the Fees and do not require notice under Section 4 of Module 0. A change to the **method** by which the Reference Rate or the Conversion Date is determined, or the introduction of a margin under Section 4.4, **is** a change to the Terms and follows Section 4 of Module 0 (and, for Providers in scope, Module A Section 5.2a). 4.8. **No liability for rate movements.** Komashi is not liable for any loss arising from exchange-rate movements, from the application of the Reference Rate in accordance with this Section, or from any conversion carried out by a bank, card issuer, or Payment Provider. ## 5. Komashi's Fees — Currency, Invoicing and Collection (Providers) > **In short:** We invoice and charge you in US dollars, whatever currency you invoice your own customers in. If your bank or card converts that into your own currency, the rate and any charge for it are your bank's, not ours. *Non-binding summary.* 5.1. **Billing Currency.** Komashi calculates, invoices, and collects all Fees in the **Billing Currency (USD)**, irrespective of the Invoice Currency of the underlying invoices. 5.2. **Your conversion costs.** If your registered payment method or bank account is denominated in another currency, the conversion of your payment into USD, the rate applied to it, and any conversion, cross-border, or transaction charge are applied by your card issuer, bank, or payment service provider **at your cost**. Those charges are not Fees, are neither set nor received by Komashi, and do not reduce the amount you owe: an invoice is settled only when the **full invoiced USD amount** is received by Komashi. 5.3. **Charges to your registered payment method.** Fees charged automatically to your registered payment method under Section 5.1a of Module A are denominated in **USD**. Your card issuer or bank may apply its own conversion and show a corresponding amount in your own currency; that rate and any foreign-transaction charge are set by your issuer or bank, not by Komashi (Section 3.7). **Komashi applies no card validation charge and no validation hold** (Module A Section 5.1a). 5.4. **Taxes.** Section 4.5 of Module A applies. Where applicable tax law requires tax to be calculated, invoiced, or reported in a currency other than the Invoice Currency or the Billing Currency, that conversion is **your responsibility** and is unaffected by the Reference Rate used under Section 4. ## 6. [Reserved] [This Section is intentionally left blank; the numbering of the other Sections is unchanged.] ## 7. Amounts Stated in Other Currencies in the Terms > **In short:** Where the Terms name an amount in another currency — such as the EUR 500 consumer minimum cap — that amount counts as stated, in that currency. If it has to be shown in a different one, we convert it at the same public reference rate used everywhere else. *Non-binding summary.* 7.1. Where the Terms state an amount in a currency other than USD — including the consumer minimum cap in Section 10.5a of Module 0 (EUR 500) — that amount applies as stated in that currency. Where it has to be expressed in another currency, it is converted at the Reference Rate for the date on which the relevant liability is determined. ## 8. Currency Risk > **In short:** Exchange rates move, and **each side carries that risk for itself**. We do not promise you a rate, we do not hedge for you, and we are not responsible if a rate movement makes a fee, a commission or a payout worth more or less than you expected in your own currency. *Non-binding summary.* 8.1. Except as expressly provided in this Module, **each party bears its own currency risk**. Komashi does not guarantee any exchange rate, does not hedge on your behalf, and is not liable for the effect of exchange-rate movements on the value of any Fee, Commission, or payout. ## 9. Changes > **In short:** We can change this Module with advance notice. Adding a currency takes effect when we publish it; removing one takes 30 days' notice. A rate moving is not a change to these terms. *Non-binding summary.* 9.1. This Module may be amended in accordance with Section 4 of Module 0 (advance notice and grace period for material changes). The Supported Currencies List (Schedule 1) has its own version and effective date and is amended under Section 3.3 (additions, effective on publication) and Section 3.4 (removals, on 30 days' notice). --- ## Schedule 1 — Supported Currencies List The Supported Currencies List **forms part of this Module** and is set out in a separate document, **"Module F — Schedule 1 (Supported Currencies List)"** (`module-f-schedule-1-supported-currencies.md`), published at **https://komashi.com/legal/currencies** and available on request. That Schedule has its own version and effective date and is maintained under Sections 3.3 and 3.4 of this Module. In case of any conflict between a currency list published elsewhere (including any list published by a Payment Provider) and that Schedule, **that Schedule governs**. --- # Data Processing Agreement > Komashi Data Processing Agreement (Module D2) — the Article 28 GDPR terms between a provider as controller and Komashi as processor. Canonical: https://komashi.com/docs/legal/data-processing-agreement/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module D(2) — Data Processing Agreement (DPA)** **Version:** v1.0 · **Effective date:** 2026-08-31 This Data Processing Agreement is entered into between the **Provider** (the "**Controller**") and **BMSHI TECHNOLOGY SERVICES - FZCO** ("**Komashi**", the "**Processor**") and is incorporated into the Provider Agreement (Module A). It governs Komashi's processing of End User personal data on the Provider's behalf, in accordance with Article 28 GDPR and the UAE PDPL. Capitalized terms not defined here have the meanings in Module 0 or the GDPR. --- ## 1. Roles; Scope > **In short:** For your customers' data on the Platform, you (the Provider) are the controller and Komashi is your processor, acting only on your instructions. *This summary is for convenience only and is not legally binding.* 1.1. The Controller determines the purposes and means of processing of End User personal data entered into or generated on the Platform in connection with the Provider Services ("**Controller Data**"). Komashi processes Controller Data solely as Processor on the Controller's behalf. 1.2. The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in **Annex 1**. 1.3. This DPA does not apply to personal data Komashi processes as a controller (see the Privacy Policy, Section 2.1), nor to payment data. **Komashi is not part of the money flow**: payments for Provider Services pass directly from End Users, via the Payment Provider, to the Controller; Komashi is not a merchant of record, not a payment service provider, and never holds, receives, controls, or transmits End User funds, card numbers, or payment credentials. Payment processing, and the personal data associated with it, is carried out by the Payment Provider under its own compliance regime. ## 2. Controller Obligations 2.1. The Controller warrants that: (a) it has a valid legal basis for the processing it instructs; (b) it has provided all legally required information to data subjects; (c) its instructions comply with applicable data protection law; and (d) it will not instruct the processing of special categories of personal data without Komashi's prior written agreement. 2.2. The Controller's instructions are, in the first instance, the Provider Agreement, this DPA, and the Controller's configuration and use of the Platform's features. Additional instructions require written agreement, and Komashi may charge reasonable, cost-based fees for work that goes beyond standard Platform functionality, notified to the Controller in advance. **No fee is charged for anything Komashi is required to do under Article 28(3) GDPR**, including the assistance in Sections 3.5 and 3.6. ## 3. Processor Obligations (Art. 28(3) GDPR) > **In short:** Komashi processes your customers' data only on your instructions, keeps it confidential and secure, helps you meet your own legal duties, and tells you promptly if something goes wrong. *Non-binding summary.* Komashi shall: 3.1. **Instructions.** Process Controller Data only on the Controller's documented instructions (Section 2.2), including with regard to international transfers, unless required to do otherwise by applicable law — in which case Komashi shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. Komashi shall inform the Controller immediately if, in its opinion, an instruction infringes applicable data protection law. 3.2. **Confidentiality.** Ensure that persons authorized to process Controller Data are bound by contractual or statutory confidentiality obligations. 3.3. **Security.** Implement and maintain the technical and organizational measures set out in **Annex 2**, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to data subjects (Art. 32 GDPR; PDPL security requirements). Komashi may update Annex 2 provided the level of protection is not materially reduced. 3.4. **Sub-processors.** Not engage a sub-processor without authorization per Section 4. 3.5. **Data subject rights.** Taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling the Controller's obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). If a data subject contacts Komashi directly regarding Controller Data, Komashi will direct the data subject to the Controller (Komashi does not itself forward the request) and will not respond substantively except on the Controller's instruction or where legally required. 3.6. **Assistance.** Assist the Controller in ensuring compliance with its obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments, prior consultation) and equivalent PDPL obligations, taking into account the nature of the processing and the information available to Komashi. **This assistance is provided at no additional charge**; Section 2.2 applies only to work that goes beyond what Article 28(3) requires. 3.7. **Breach notification.** Notify the Controller **without undue delay** after becoming aware of a personal data breach affecting Controller Data. Komashi may provide information in phases as it becomes available, including the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, measures taken or proposed, and a contact point. Komashi's notification is not an acknowledgment of fault or liability. Notification of authorities and data subjects is the Controller's responsibility as controller. 3.8. **Deletion or return.** At the Controller's choice, delete or return all Controller Data after the end of the provision of the Services, and delete existing copies, unless applicable law requires storage. In the absence of an election, Controller Data is soft-deleted and then permanently deleted in accordance with **the retention periods in Section 9.2 of the Privacy Policy (Module D(1)), which govern**. Deletion is **scheduled and automatic**; deletion from backups occurs on the backup rotation cycle stated there (Privacy Policy Section 9.2(c)), which is not searched or edited record-by-record.     (a) **Records retained under a statutory duty.** **Privacy Policy Section 9.2a is an exception to this Section 3.8 and prevails over a deletion or return election.** In particular, invoices the Controller issued through the Platform are the Controller's own accounting records and are retained for the statutory record-keeping period applicable to the Controller (Privacy Policy Section 9.2a(b)); Komashi holds them in a restricted state, uses them for no other purpose, and deletes them at the end of that period. The Controller may instruct Komashi in writing to apply a longer period required by its national law, and may at any time obtain a copy or an export of those records. 3.9. **Audits.** Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or its mandated auditor.     (a) **How an audit request is met.** Komashi does **not currently hold a SOC 2 report or ISO/IEC 27001 certification.** Komashi may first satisfy an audit request by providing, within a reasonable period taking into account the scope and urgency of the request: the current version of Annex 2 (Technical and Organisational Measures) together with a written statement, signed by an authorised representative, confirming that those measures are in place; the current sub-processor list (Annex 3); a description of the hosting and infrastructure arrangements, including the certifications held by Komashi's own hosting and infrastructure providers; the results of the most recent penetration test or security assessment, where one has been carried out; and written answers to the Controller's reasonable, specific security questions. **Where that information does not reasonably enable the Controller to verify compliance, the Controller may proceed to an inspection under paragraph (b), and Komashi shall not refuse it on the ground that paragraph (a) has been complied with.**     (b) **Inspections.** On-site or remote inspections require 30 days' notice, occur at most once per year (absent a personal data breach or a requirement of a competent supervisory authority), must not unreasonably disrupt operations, are subject to confidentiality, and are at the Controller's cost.     (c) **If Komashi later obtains a certification.** If Komashi obtains a SOC 2 report, ISO/IEC 27001 certification, or an equivalent independent audit report, it will make the report or certificate available to the Controller on request under confidentiality, and may satisfy audit requests through it under paragraph (a). Obtaining such a certification does **not** remove the Controller's right to an inspection under paragraph (b). ## 4. Sub-processors > **In short:** You give general approval for the sub-processors and provider pools listed in Annex 3. We may switch among already listed providers without a separate notice; we tell you before adding an unlisted provider and you can object on reasonable data-protection grounds. *Non-binding summary.* 4.1. The Controller grants a **general written authorization** for Komashi to engage the sub-processors, provider groups and downstream-provider pools identified at **https://komashi.com/legal/subprocessors** (**Annex 3**). A listed provider receives Controller Data only when the relevant feature, model, route or integration is used; listing does not mean that every provider is active or receives data at all times. 4.2. Selection, routing or switching among sub-processors or downstream providers already identified in Annex 3 is covered by the authorization in Section 4.1 and is not an addition or replacement requiring a separate notice. Before engaging a sub-processor or provider category not already covered by Annex 3, Komashi shall inform the Controller through the list page, email or the Platform and provide sufficient information and a reasonable opportunity to object on data-protection grounds before the engagement takes effect. Komashi will consider a timely objection in good faith and may address it by using an alternative provider, limiting the affected processing, offering a reasonable workaround, or discontinuing the affected feature or Service. Any termination or refund right is limited to what is stated elsewhere in the Terms or required by applicable law. 4.3. Komashi shall impose on each sub-processor, by written contract, data protection obligations materially equivalent to those in this DPA, and remains fully liable to the Controller for the sub-processor's performance. ## 5. International Transfers > **In short:** Core Controller Data is stored and processed in the EU/EEA, with no access from the UAE. Limited data may reach application-level providers in other countries where a feature requires it, subject to a lawful transfer mechanism and a documented transfer assessment. *Non-binding summary.* 5.1. Komashi and its sub-processors may process Controller Data in the locations listed in Annex 3. Komashi shall not transfer Controller Data to a country lacking adequate protection without a valid transfer mechanism. 5.2. **Where Controller Data is processed.** For Controller Data subject to the GDPR, Komashi: (a) stores and processes such data **within the EU/EEA**, save for the transfers identified in Section 5.2a; (b) keeps **all backups within the EU/EEA**; and (c) provides access to such data **from within the EU/EEA**, maintaining **no technical means of access from the United Arab Emirates**. Komashi's registration as a UAE company does not, by itself, constitute a transfer of Controller Data, and no Controller Data is transferred to or accessible from the UAE. 5.2a. **Transfers to third countries; Standard Contractual Clauses.** Certain sub-processors identified in **Annex 3** are established outside the EU/EEA, and specified categories of Controller Data are therefore transferred to a third country within the meaning of **Chapter V GDPR**. Annex 3 identifies, for each such sub-processor, the categories of Controller Data concerned, the country of establishment, and the transfer mechanism relied on.     (a) **Mechanism.** Each such transfer is made under the **EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914)**, incorporated into this DPA by reference and completed as follows: **Module Two (controller-to-processor)** between the Controller and Komashi and **Module Three (processor-to-processor)** for onward sub-processing; Clause 7 (docking) **applies**; the Clause 11 optional independent-redress mechanism does **not** apply; Clause 17 (governing law) = **Ireland**; Clause 18 (forum) = the courts of **Ireland**; **SCC Annexes I and II are completed from Annexes 1 and 2 of this DPA**; and Annex 3 is the agreed sub-processor list for the general-authorization option in Clause 9(a). If specific authorization or a completed SCC Annex III is required for a particular transfer, the relevant entries in Annex 3 supply the sub-processor information for that purpose. Where a sub-processor has itself adopted the same Standard Contractual Clauses, or is certified under an adequacy decision applicable to it, Komashi may rely on that mechanism instead, and Annex 3 states which applies. In case of conflict, the SCCs prevail over this DPA.     (b) **Transfer impact assessment.** Komashi carries out and documents a **transfer impact assessment** for the transfers identified in Annex 3, covering the law of the destination country, the categories of data concerned, and the supplementary measures applied. The assessment is reviewed periodically and when a material change to a transfer, destination, provider category or applicable legal framework makes review appropriate. Relevant information is made available to the Controller on request under Section 3.9, subject to confidentiality and the protection of security-sensitive information.     (c) **Supplementary measures.** For each transfer, Komashi applies measures appropriate to the selected route and recorded in the transfer impact assessment. These include transmission encryption; **data minimisation, so that only the categories stated in Annex 3 leave the EU/EEA**; contractual terms and available technical settings designed to prevent the recipient from using Controller Data for its own purposes, including model training, unless the Controller has separately instructed or authorized that use; and transparency or notification measures for binding public-authority requests to the extent legally and contractually available.     (d) **New third-country sub-processors.** Komashi shall not engage a new sub-processor or provider category outside the EU/EEA that is not already covered by Annex 3 without first completing the assessment in paragraph (b) and following the notice-and-objection process in Section 4.2. Routing among third-country providers already covered by the authorized pool in Annex 3 does not require a new notice, but remains subject to the safeguards in this Section.     (e) **UK GDPR.** For Controller Data subject to the UK GDPR, the same Standard Contractual Clauses apply as amended by the **UK International Data Transfer Addendum** (version B.1.0 or successor). 5.3. For Controller Data subject to the PDPL, cross-border transfers comply with Articles 22–23 PDPL and applicable Executive Regulations. ## 6. Liability; Order of Precedence 6.1. Liability under this DPA is subject to the limitations in Section 10 of Module 0, except where such limitation is prohibited by applicable data protection law or the SCCs. **That limitation operates between the parties only.** It does not affect, and cannot restrict, a data subject's right to compensation under Article 82 GDPR against either party. 6.2. In case of conflict: (1) the SCCs, (2) this DPA, (3) the Provider Agreement. ## 7. Term 7.1. This DPA applies for as long as Komashi processes Controller Data and survives termination of the Provider Agreement until all Controller Data is deleted or returned under Section 3.8. --- ## Annexes 1–3 **Annex 1** (Description of Processing) and **Annex 2** (Technical and Organizational Measures, Art. 32 GDPR) **form part of this DPA** and are set out in **"Module D(2) — Annexes 1–2"** (`module-d2-annexes.md`). **Annex 3** (Authorized Sub-processors) **forms part of this DPA** and is set out in a further separate document, **"Module D(2) — Annex 3 (Authorized Sub-processors)"** (`module-d2-annex-3-subprocessors.md`), also published at **https://komashi.com/legal/subprocessors**. Each has its own version and effective date. Annex 2 may be updated by Komashi under **Section 3.3** (provided the level of protection is not materially reduced); Annex 3 is maintained under the general authorization in **Section 4.1**, with the notice-and-objection process in **Section 4.2**. Where the SCCs apply under **Section 5.2a**, **SCC Annexes I and II are completed from Annexes 1 and 2**, while Annex 3 operates as the agreed sub-processor list for Clause 9(a)'s general-authorization option and supplies SCC Annex III information where that annex is required for a specific authorization. In case of conflict between any summary elsewhere and these Annexes, the Annexes govern. --- # DPA Annexes 1-2 > Annexes to the Data Processing Agreement — processing details and technical and organizational measures. Canonical: https://komashi.com/docs/legal/dpa-annexes/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Parent agreement.** These Annexes **form part of the Komashi Data Processing Agreement (Module D(2))**, which is incorporated into the Provider Agreement (Module A). Capitalized terms not defined here have the meanings given in the DPA, Module 0, or the GDPR. **Annexes version:** v1.0 **Annexes effective date:** 2026-08-31 **Scope.** This document contains **Annex 1** (Description of Processing) and **Annex 2** (Technical and Organizational Measures). **Annex 3** (Authorized Sub-processors) is maintained in a **separate document, `module-d2-annex-3-subprocessors.md`**, so the sub-processor list can move on its own cadence. **Maintenance / amendment.** - **Annex 1** (Description of Processing) changes only with the scope of processing; update alongside the DPA. - **Annex 2** (Technical and Organizational Measures) may be updated by Komashi under **DPA §3.3**, provided the level of protection is **not materially reduced**. Each change carries a new version number and effective date, and superseded versions are retained and available on request under **Section 4.5 of Module 0**. **SCC linkage.** Where the EU Standard Contractual Clauses apply under **DPA §5.2a**, **SCC Annex I ← Annex 1** and **SCC Annex II ← Annex 2** (below). Annex 3 in `module-d2-annex-3-subprocessors.md` is the agreed sub-processor list for Clause 9(a)'s general-authorization option and supplies the information for SCC Annex III where a specific authorization requires that annex. --- ## Annex 1 — Description of Processing *Populates **SCC Annex I** where DPA Section 5.2a applies.* **Subject matter.** Provision of the Komashi Platform — Provider presence, service catalogue, bookings and orders, subscriptions, invoicing, customer management, and transactional messaging — to the Controller. **Duration.** The term of the Provider Agreement, plus the deletion periods in **Privacy Policy Section 9.2** and the statutory retention in **Section 9.2a** (DPA Section 3.8). **Nature and purpose.** Hosting, storage, transmission, display, backup, and technical processing of Controller Data as needed to operate the Platform on the Controller's instructions. **Frequency of processing.** Continuous, for the duration of the Provider Agreement. **Categories of data subjects.** | Category | Description | |---|---| | **End Users** | The Controller's customers who book, subscribe to, or purchase the Controller's services through the Platform | | **Prospective End Users** | Visitors who begin but do not complete a booking or registration on the Controller's presence | | **The Controller's staff** | Individuals of the Controller appearing in customer-facing records (e.g., the person delivering a booked service, the sender of a message to an End User) | **Categories of personal data.** | Category | Data | |---|---| | **Identity** | First and last name; the name shown on an invoice | | **Contact** | Email address; telephone number; postal or billing address | | **Account** | Account identifier; language and locale; time zone; account status; authentication events (login timestamps, IP address, user agent); password in salted-hash form; where a third-party identity provider is used to sign in, the identifier returned by that provider | | **Booking and order** | Service or product booked; date, time and duration; quantity; location where the Controller records one; booking status and history; cancellation and no-show records; notes the End User or the Controller adds to a booking | | **Subscription** | Subscription plan; start date; renewal and expiry dates; subscription status and history | | **Invoice and billing** | Invoice number, date and currency; line items and descriptions; net, tax and gross amounts; tax identifiers the End User supplies; payment status and payment date | | **Payment metadata** | Payment-status information received from the Provider's payment or invoicing provider — transaction reference, amount, currency, timestamp, success or failure, refund status, and payment-method type (e.g. "card", "transfer"). **No card number, no expiry date, no CVC, no bank credentials, no payment token usable to initiate a payment, and no cardholder authentication data** (DPA Section 1.3; Provider Terms Section 4.1a) | | **Communications** | Messages between the Controller and the End User sent through the Platform; transactional email sent to the End User and its delivery metadata; support correspondence relating to the Controller's End Users | | **Usage and technical** | Page and screen events within the Controller's presence; device and browser information; IP address; timestamps; application and security log entries | **Special categories of personal data (Art. 9 GDPR).** **None.** The Platform is not configured to collect special-category data, and the Controller must not use free-text fields (booking notes, service descriptions, messages) to enter it. Processing special-category data requires separate written agreement and additional safeguards under **DPA Section 2.1(d)**.     *Practical warning for Controllers in health, wellness, and similar sectors:* a service name, a booking note, or an End User's message can turn into health data without anyone deciding that it should. The Controller is responsible for what it and its End Users type into free-text fields. Where a Controller's business necessarily involves such data, it must raise this with Komashi under Section 2.1(d) **before** processing begins. **Data relating to criminal convictions or offences (Art. 10 GDPR).** None. **Children's data.** The Platform is not directed at children. Where the Controller's own services are directed at or used by children, the Controller is responsible for the legal basis and for any parental consent required. **Transfers.** Core Platform storage and processing remain within the EU/EEA, subject to the limited application-level transfers described in DPA Section 5.2a and **Annex 3**. Annex 3 identifies the authorized recipient categories, provider pools, possible locations and the parties that are expressly **not** sub-processors. ## Annex 2 — Technical and Organizational Measures (Art. 32 GDPR) *Populates **SCC Annex II** where DPA Section 5.2a applies. This Annex describes the measures **actually in force**. Komashi may update it under DPA Section 3.3 provided the level of protection is not materially reduced; on each change, bump the version and archive the superseded text.* **Infrastructure baseline.** Komashi **operates its own infrastructure** and does not rent hosting, compute, or database services from a cloud provider (**Annex 3, Section A**). The measures below are therefore Komashi's own, not inherited from a hosting provider's control framework; the physical-security measures are also operated by Komashi at its own premises. | Area | Measures | |---|---| | **Encryption** | TLS 1.2+ for all data in transit, including between internal services; encryption at rest (AES-256 or equivalent) for databases and backups; encryption keys held separately from the data and rotated on compromise or personnel change | | **Access control & least privilege** | Role-based access; access to Controller Data limited to personnel who need it for a defined task; access granted on request, reviewed **quarterly**, and revoked on role change or exit; **all access to EU/EEA Controller Data is from within the EU/EEA only** (DPA Section 5.2) | | **Administrative authentication** | Multi-factor or passwordless authentication for all administrative and production access; no shared administrative credentials; administrative sessions time-limited | | **Logging & monitoring** | Centralized, tamper-resistant logging of access and security events; alerting on anomalous activity; log retention per Privacy Policy Section 9.2(b) — application and security logs 12 months, infrastructure and file-level logs 14 days | | **Network security** | Network segregation between production, staging and development; firewalls and security groups with default-deny; production isolated from development; **no database exposed to the public internet**; administrative interfaces not publicly reachable | | **Vulnerability & patch management** | Dependency and infrastructure patching on a defined cycle, with out-of-cycle patching for critical vulnerabilities; automated dependency scanning in CI; periodic vulnerability scanning of internet-facing services. **No external penetration testing — see the paragraph below this table** | | **Backup & disaster recovery** | Encrypted backups held within the EU/EEA on the rotation in Privacy Policy Section 9.2(c) (daily 2 weeks, weekly 2 months, monthly 6 months); documented restore procedure; restore tested at least **annually**; **RPO 24 hours; RTO 72 hours** | | **Secure development** | Code review before merge; separation of duties between development and production access; secrets held in a secrets manager and never in source control; change control with an audit trail; dependency scanning in CI | | **Personnel** | Written confidentiality obligations for all staff and contractors with access (DPA Section 3.2); security-awareness briefing on onboarding and refreshed annually; access revoked on the last working day | | **Incident response** | Documented incident-response process with named responsibilities; breach notification to Controllers within the window in DPA Section 3.7; post-incident review with corrective actions recorded | | **Physical security** | The equipment is held at **Komashi's own premises** in the EU/EEA, in a **lockable server room separate from general office space**, fitted with **fire detection**. **No third-party facility operator has physical access** (Annex 3, Section A), and there is correspondingly **no external facility certification**: Komashi is solely responsible for these controls. **Physical entry is not separately logged** — access is restricted by the lock and by the small number of people holding a key, and there is no recorded entry trail. Komashi states this expressly rather than leaving it to be inferred | | **Sub-processor assurance** | Written contracts imposing materially equivalent obligations (DPA Section 4.3); sub-processors, and the parties that are expressly not sub-processors, listed in Annex 3 | | **Segregation of Controllers** | Each Controller's data is logically separated and access-controlled; a Provider cannot reach another Provider's data through the application | **Testing the effectiveness of these measures (Art. 32(1)(d)).** Komashi does **not** commission external penetration testing, and does not hold a SOC 2 report or ISO/IEC 27001 certification (**DPA Section 3.9(a)**). Effectiveness is tested through the measures already stated in the table above: **automated dependency scanning in CI**, **periodic vulnerability scanning of internet-facing services**, patching on a defined cycle with out-of-cycle patching for critical vulnerabilities, and an **annual restore test** of backups. This paragraph states the position rather than leaving it to be inferred: a Controller's auditor asking what independent assurance exists should find the answer here, and the answer is that there is none beyond Komashi's own testing. ## Annex 3 — Authorized Sub-processors **Annex 3 is maintained in a separate document, `module-d2-annex-3-subprocessors.md`** (also published at https://komashi.com/legal/subprocessors), with its own version and effective date, under the general authorization in DPA §4.1 and the notice/objection process in DPA §4.2. It is the agreed list for the general-authorization option in SCC Clause 9(a) and supplies SCC Annex III information where specific authorization requires it. --- # End User Terms > Komashi End User Terms (Module C) — the terms that apply when you buy from a provider through Komashi. Canonical: https://komashi.com/docs/legal/end-user-terms/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module C — End User Terms** **Version:** v1.0 · **Effective date:** 2026-08-31 These End User Terms apply when you use the Komashi Platform as a customer of a Provider. They **incorporate the Komashi General Terms of Service (Module 0)**, which also apply to you. Capitalized words not explained here have the meanings given in Module 0. We have written these terms in plain language wherever possible. --- ## 1. Who You Are Dealing With > **In short:** Komashi is the software; your Provider is the business you're actually buying from. Your contract for the service you book or buy is with the Provider, not with Komashi. *This summary is for convenience only and is not legally binding; the numbered terms govern.* 1.1. Komashi provides the technical platform (websites, booking and invoicing tools) that businesses use to offer their own services to their own customers. Throughout these terms we call such a business a **Provider**, as defined in Section 2 of Module 0. 1.2. **When you book, order, or buy a service through the Platform, your contract is with the Provider, not with Komashi.** The Provider is responsible for its services: their description, price, quality, delivery, and legality. Komashi does not provide, sell, or guarantee any Provider's services and is not the Provider's agent. 1.2a. **Descriptions and images come from the Provider, and may have been produced with AI.** Everything you see on a Provider's presence — service descriptions, prices, photographs and other images — is supplied by that Provider, and the Provider may have used AI tools to write or generate it. That changes nothing about Section 1.2: the Provider remains responsible for the accuracy and lawfulness of what it publishes, and Komashi neither writes, reviews, nor pre-screens it. If what you received does not match what was described, your claim is against the Provider (Sections 6 and 8), and you can also tell Komashi at **info@komashi.com** so the listing can be reviewed under the Acceptable Use Policy. 1.3. The Provider's identity and contact details are shown on the Provider's page or subdomain. Questions and complaints about a Provider's services should go to that Provider first (see Section 8). 1.4. Komashi's own identity and contact details are in Section 1 of the General Terms (Module 0): BMSHI TECHNOLOGY SERVICES - FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE — license number 76747, email info@komashi.com, telephone +971 58 600 8455. 1.5. **Whether you are buying from a business or from a private individual.** Providers on the Platform may be businesses or private individuals. **Before you are bound by a purchase, the Provider's page and the checkout tell you which one that Provider is**, and your order confirmation repeats it.     (a) **If the Provider offers its services in the course of a trade, business, craft or profession** — whether as a company, as a registered sole trader, or otherwise — your purchase is a **consumer-to-trader contract**, and the consumer rights that Union and national law give you apply to it in full, against that Provider (Sections 6 and 8).     (b) **If the Provider is a private individual not acting in that course** — for example someone occasionally letting a property they own — your purchase is a **private sale**, and **the consumer rights stemming from Union consumer protection law do not apply to it**, including any right of withdrawal and any statutory guarantee of conformity. What you agree with that Provider, and the general law of your country, governs the purchase instead. **Your rights against Komashi under Sections 7 and 10 are unaffected by this paragraph.**     (c) **Where a Provider has not told Komashi how it acts, Komashi treats and labels that Provider as a private individual**, and paragraph (b) applies.     Note that **"business" here is not about registration.** Someone who offers services regularly, in an organised way, or for profit is a business for this purpose even if they are not registered as one; someone who lets a single property from time to time is generally not. 1.5a. **What this statement is based on.** Komashi states a Provider's status on the basis of that Provider's own declaration to Komashi and the business identification data it has supplied, which Komashi verifies only so far as verification is available to it. Komashi does not otherwise investigate a Provider's status. Nothing in this Section affects Komashi's own obligations to you under Sections 7 and 10. If you think a Provider is described incorrectly, tell us at **info@komashi.com**. 1.5b. **Residential lettings — the labelling is still there, even where the law does not require it.** Where a Provider is letting accommodation for residential purposes, the contract falls outside Directive 2011/83/EU altogether (Section 6.3a), so neither the business/private label in Section 1.5 nor the marketplace information in Sections 1.6 and 1.7 is legally required for it. **Komashi shows it anyway, on the same terms as for every other listing.** One rule applied everywhere is clearer for you and cheaper to run than two, and knowing whether you are dealing with a business or a private landlord is worth having whether or not a Directive says so. 1.6. **How Providers are presented to you.** **Komashi does not rank, order, or compare Providers against one another.** Each Provider has its own presence on the Platform; there are no cross-Provider search results, directory, or category listings, so there is no ordering that could steer you towards one Provider rather than another. Komashi accepts no payment from any Provider in exchange for visibility or position. If you reached a Provider through a general search engine, that engine decided what to show you, not Komashi. If this ever changes, Komashi will publish here, before the feature goes live, the main parameters determining any ranking and their relative importance. 1.7. **Who owes you what.** Section 1.2 sets out the division of responsibility: the Provider owes you the service, its description, its price, its quality and its legality, together with your statutory consumer rights against it, including any right of withdrawal (Section 6). Komashi owes you the Platform itself, on the terms in Section 7 and Section 10. ## 2. Payments — Where Your Money Goes > **In short:** Your payment goes straight from you, through a licensed payment company, to the Provider. Komashi never holds or touches your money. *Non-binding summary.* 2.1. When you pay for a Provider's services, **your payment goes directly from you, via an independent licensed payment company (the "Payment Provider"), to the Provider.** 2.2. **KOMASHI IS NOT PART OF THE MONEY FLOW.** KOMASHI IS NOT A BANK, NOT A PAYMENT SERVICE PROVIDER, AND NOT THE MERCHANT YOU ARE PAYING. KOMASHI NEVER HOLDS, RECEIVES, CONTROLS, OR TRANSMITS YOUR MONEY. THE PAYMENT IS PROCESSED BY THE PAYMENT PROVIDER UNDER ITS OWN TERMS, AND RECEIVED BY THE PROVIDER. 2.3. **The name that appears on your card or bank statement identifies the Provider you paid** — its trading name, or an abbreviation of it where the Payment Provider limits the length — as set by the Payment Provider and the Provider. **It will never read "Komashi"**, because Komashi is not the merchant you are paying and takes no part in the payment. If you do not recognise a charge, the name on the statement is the Provider to contact (Section 8.1). 2.4. Komashi does not charge you anything for using the Platform as an End User. 2.5. **Currency.** The currency you are charged in is the one the Provider has set for its prices. If your card issuer or bank converts that amount into a different currency, **the exchange rate and any conversion or foreign-transaction charge are set by your card issuer or bank** — not by Komashi and not by the Provider. Komashi applies no conversion to your payment and receives none of those charges (Section 6 of Module 0; Section 3.7 of Module F). ## 3. [Reserved] 3.1. [Reserved.] *(This Section, which previously described a USD 1 card-verification hold, has been removed. Komashi does not initiate, perform, or describe any validation on an End User's card; any card checks that may occur are solely the Payment Provider's own matter under its own terms.)* ## 4. Your Account and Login > **In short:** You sign in with a secure link or code sent to you — no password. Keep your email and phone safe, because they are the key to your account. *Non-binding summary.* 4.1. You may need an account to use some features. You sign in without a password, using a one-time link or code sent to your registered email address or other verified channel. 4.2. Please keep your registered email account and devices secure: anyone with access to them may be able to access your Komashi account. Tell us at info@komashi.com if you think someone else has used your account. You are not responsible for activity on your account that is caused by Komashi's breach of these terms or that occurs after you have reported unauthorized access to us. 4.3. You must be at least 18 years old (or the age of majority where you live, if higher) to create an account. ## 5. [Reserved] [This Section is intentionally left blank; the numbering of the other Sections is unchanged.] ## 6. Cancellations and Refunds for Provider Services > **In short:** Cancellations and refunds for what you bought are handled by the Provider under the Provider's own policy — because the Provider has your money, not Komashi. If you're an EU consumer, your 14-day withdrawal right (where it applies) is also the Provider's responsibility. *Non-binding summary.* 6.1. **Cancellations of, and refunds for, Provider services are governed by the Provider's own cancellation and refund policy** and by the laws that apply to your purchase. The Provider's policy is shown on its page or provided before you buy. 6.2. Refund requests must be addressed to the Provider. **Because Komashi never holds your payment (Section 2), Komashi cannot issue, process, or guarantee refunds of amounts you paid to a Provider.** Any refund is paid by the Provider through the Payment Provider. 6.3. **EU/EEA consumers — 14-day withdrawal right.** If you are a consumer in the EU/EEA (or another country with a similar mandatory withdrawal right) and the right of withdrawal applies to your purchase, **that right is exercised against the Provider, and the Provider is responsible for honoring it**, including telling you before purchase whether the right applies, whether exceptions apply (for example, for services performed immediately with your consent, or leisure services on a specific date), and how to withdraw. 6.3a. **Residential letting is outside the EU consumer-contract rules.** If what you are renting is **accommodation for residential purposes** — a home to live in, as opposed to a holiday stay, a hotel room, or short-term accommodation — then **Directive 2011/83/EU does not apply to that contract at all** (Article 3(3)(f) of that Directive excludes "the rental of accommodation for residential purposes"). In practice this means:     (a) **there is no 14-day withdrawal right** in respect of that tenancy, whether against the Provider or against anyone else, and Section 6.3 does not apply to it;     (b) **the pre-contractual information duties of that Directive do not apply either**, which is why Komashi describes the information it does give you in Section 1.5 as something it provides in every case rather than as something it owes you only where the law compels it; and     (c) **your protection comes from elsewhere, and it is substantial.** The unfair-terms rules of Directive 93/13/EEC apply in full to the tenancy agreement, and so does the **national tenancy law of the country where the property is** — which in most countries is mandatory and cannot be contracted out of, covering matters such as the deposit, the notice period, rent increases, the form the agreement must take, and protection against eviction. Those rules operate against the landlord, not against Komashi. 6.3b. **Komashi does not supply tenancy terms.** **Komashi provides no tenancy agreement template, no model clauses, and no suggested wording for a letting, and gives no advice on the law of any tenancy.** The terms of any tenancy are agreed between you and the Provider, and the Provider alone is responsible for their content and for their compliance with the law of the place where the property is. Nothing shown to you on the Platform is a statement by Komashi about what a tenancy agreement should contain. 6.4. [Reserved.] *(Previously addressed the withdrawal right for direct Komashi purchases. Direct Komashi purchases do not exist; Section 7 now addresses Komashi's own free digital service to you instead.)* 6.5. Nothing in this Section reduces any right you have against the Provider under the mandatory consumer laws of your country of residence (Section 14 of Module 0). ## 7. Komashi's Own Service to You (EU/EEA Consumers) > **In short:** The Komashi Platform itself is a digital service we supply to you. Even though you pay us nothing, EU law gives you rights about it: it has to work as described, we have to keep it working, and you can get it fixed or walk away if we don't. *Non-binding summary.* 7.1. **Scope.** This Section applies where you are a consumer in the EU/EEA. It concerns the Komashi Platform itself (your account, booking functionality, and access to your records), which Komashi supplies to you as a digital service. It does not concern Provider Services, which are governed by Sections 1, 6 and 8. *(This Section previously addressed purchases made directly from Komashi; End Users do not purchase services directly from Komashi — every purchase is of Provider Services, for which the Provider is the seller, see Section 1.)* 7.2. **Conformity.** Komashi will supply the Platform in conformity with Directive (EU) 2019/770 and the national law implementing it, including the subjective and objective conformity requirements and the obligation to inform you of, and supply, updates (including security updates) necessary to keep the Platform in conformity for the period you may reasonably expect. 7.2a. **What the Platform is, technically.** So that conformity can be measured against something concrete: the Platform is a **web application** used through a current version of a mainstream web browser, on a desktop or mobile device. It needs an internet connection and a working email address; it needs no separate purchase, no plug-in, and no particular operating system or hardware. It applies **no technical protection measures** to your content. Content you provided or created is exportable in a commonly used, machine-readable format under Section 7.5. If the Platform is later made to depend on anything beyond this, that is a change to the Platform and Section 7.4 applies to it. 7.3. **Remedies.** If the Platform is not in conformity, you are entitled to have it brought into conformity, and, where that is impossible, disproportionate, not done within a reasonable time, or done without success, to terminate this contract. Because you pay no price for the Platform, price reduction does not apply. Nothing in Section 9 of Module 0 ("as is") or Section 10 of Module 0 (limitation of liability) restricts these rights, and any term of the Terms that would do so does not bind you. 7.4. **Changes to the Platform.** Komashi may change the Platform beyond what is necessary to keep it in conformity only where: (a) these Terms allow it, and the change is made for one of the following valid reasons — to comply with law, to maintain or improve security, to adapt to a change in the technical environment, or to add, replace or retire a feature in the ordinary development of the Platform; (b) the change causes you no additional cost; and (c) you are informed of the change in a clear and comprehensible way. Where such a change adversely affects your access to or use of the Platform other than to a minor extent, Komashi will inform you reasonably in advance on a durable medium of the features and timing of the change and of your right to terminate, and **you may terminate this contract free of charge within 30 days** of receiving that information or of the change taking effect, whichever is later. 7.5. **Getting your content back.** On termination of this contract, at your request and free of charge, Komashi will make available to you, within a reasonable time and in a commonly used, machine-readable format, any content other than personal data that you provided or created while using the Platform, except where that content has no utility outside the Platform, relates only to your own activity on the Platform, has been aggregated and cannot reasonably be disaggregated, or was generated jointly with others who can still use it. Your personal data is governed by the Privacy Policy (Module D(1)) and by Regulation (EU) 2016/679. ## 8. Problems and Complaints > **In short:** Problem with a service you bought? Contact the Provider. Problem with the Platform itself? Contact Komashi — we have a complaints process and will respond. *Non-binding summary.* 8.1. **About a Provider's services:** contact the Provider using the contact details on its page. The Provider is responsible for resolving complaints about its own services. 8.2. **About the Platform** (technical issues, your account, your data, or Komashi's conduct): contact Komashi **through the Komashi support system**, reachable from the Platform, or by email to **info@komashi.com**. Both reach the same complaints process. We will acknowledge your complaint without undue delay and will respond substantively within a reasonable period, in line with Section 16 of Module 0. 8.3. Using our complaints process never limits your legal rights, including your right to go to the consumer protection authorities or courts available to you where you live. You are never required to arbitrate: see Section 13.2a of Module 0. ## 9. Fair Use of the Platform > **In short:** Use the Platform honestly and legally. The Acceptable Use Policy applies to you too. *Non-binding summary.* 9.1. The Acceptable Use Policy (Module E) applies to your use of the Platform. In particular, you must not use the Platform for fraud, misuse other people's accounts, or interfere with the Platform's operation. 9.2. If you break these rules, Komashi may restrict, suspend, or close your account following the process in Module 0 and Module E, always subject to your mandatory consumer rights. ## 10. Komashi's Responsibility to You > **In short:** Komashi is responsible for running the Platform with reasonable care and skill — but not for the Provider's services, which are the Provider's responsibility. Nothing here takes away rights your local consumer law gives you. *Non-binding summary.* 10.1. Komashi will provide the Platform with reasonable care and skill. The limitations of liability in Section 10 of Module 0 apply **only to the extent permitted by the mandatory consumer protection laws of your country of residence**; those laws prevail (Section 14 of Module 0). 10.2. Komashi is not responsible for the Provider's services, the Provider's compliance with its own obligations, or the acts of the Payment Provider. This does not limit any claim you may have directly against the Provider or the Payment Provider. 10.3. These End User Terms do not require you to indemnify or reimburse Komashi for anything, and nothing in them excludes or limits rights that the law of your country of residence grants you as a consumer and does not allow to be excluded. --- # Platform Guidelines > Schedule 1 to the Acceptable Use Policy — how to run a listing well, covering descriptions, pricing, content, conduct and enforcement. Canonical: https://komashi.com/docs/legal/guidelines/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Parent agreement.** These Guidelines form part of the **Komashi Acceptable Use Policy (Module E)**, which is incorporated into the **Komashi General Terms of Service (Module 0)** and into each set of Role Terms. Capitalized terms not defined here have the meanings given in Module E and Module 0. **Schedule version:** v1.0 **Schedule effective date:** 2026-08-31 **Published at:** https://komashi.com/legal/guidelines **What these Guidelines are.** The Acceptable Use Policy says **what you must not do**. These Guidelines say **how to do things well**, and give the practical detail behind the AUP's rules. They are written mainly for Providers, but Section 7 applies to End Users. **How they are enforced.** A breach of these Guidelines is treated as a breach of the AUP and is handled through the enforcement ladder in **Section 4 of Module E** — normally a warning first, with immediate measures reserved for the severe cases listed in AUP Section 4.2. **Where these Guidelines and the AUP appear to conflict, the AUP governs**, and nothing in these Guidelines widens the grounds on which Komashi may restrict, suspend, or terminate an Account beyond those already set out in the AUP and in Section 12 of Module 0. **Amendment.** These Guidelines may be amended in accordance with **Section 4 of Module 0** (advance notice and grace period for material changes). The version in force at the time of the conduct governs that conduct. --- ## 1. Your Provider presence **1.1. Describe what you actually sell.** Your service descriptions must match what the End User will receive: what is included, how long it lasts, where it takes place, and anything the End User must bring or do. If a service has a prerequisite (a fitness level, an age limit, a licence, a medical condition to disclose), say so in the description, not after the booking. **1.2. Show the real, total price.** The price shown must be the total the End User pays, including taxes. If something is genuinely optional and priced separately, name it and price it before checkout. **Do not add unavoidable charges late in the flow** — this is one of the fastest ways to generate a consumer complaint and it is a live regulatory target across the EU. **1.3. Use images you have the right to use, and that show the real thing.** Stock images of a different studio, a different apartment, or a different vehicle are misleading even where they are legally licensed. If an image is illustrative rather than the actual item, label it. **1.4. Keep your availability honest.** Do not list availability you cannot honour. Repeated cancellation by a Provider after a booking is confirmed is treated under AUP Section 2.3 as a misleading practice, not as an operational mishap. **1.5. Keep your contact details working.** End Users must be able to reach you. An unmonitored inbox or a dead phone number is a breach of Section 6.3 of the Provider Terms, because your complaint handling is your responsibility, not Komashi's. --- ## 2. Your identity and your status **2.1. Tell us truthfully whether you act as a business.** Section 1.3 of the Provider Terms requires you to say whether you offer your services in the course of a trade, business, craft or profession. **We show this to End Users**, because it determines what consumer rights they have against you. Getting it wrong misleads them. **2.2. Keep it current.** If you start operating as a business, or stop, tell us. Your status is a question of fact and it can change. **2.3. Do not present yourself as Komashi.** You may say you use Komashi. You may not say or imply that Komashi provides, endorses, guarantees, or is responsible for your services (AUP Section 2.8). If you use our name or marks, follow the brand guidance at https://komashi.com/legal/brand. **2.4. Hold the licences your activity needs.** If your service requires a licence, registration, permit, or professional qualification anywhere you operate, hold it before you list. This is your obligation under Section 6.2 of the Provider Terms and we do not verify it for you. --- ## 3. Invoicing, tax, and money **3.1. Configure your invoicing correctly before you sell.** Your time zone, invoicing currency, VAT and tax settings, and invoice templates are yours to set (Provider Terms Section 6.4a). An invoice issued wrongly because of your configuration is your liability, including towards tax authorities. **3.2. Do not issue invoices that do not correspond to a real transaction.** Fictitious, duplicated, or self-dealing invoices are prohibited under AUP Section 2.3, and under Section 4.1c of the Provider Terms Komashi may disregard them when calculating your rate band. This includes invoices issued to reach a lower commission tier or to consume the free allowance. **3.3. Payment is between you and your End User.** Komashi is not in the money flow and cannot issue, process, or guarantee a refund of anything an End User paid you. Your refund and cancellation policy is yours, must be published before purchase, and must comply with the law that applies to your customers (Provider Terms Section 6.3). **3.4. Handle chargebacks yourself.** A chargeback or payment dispute is between you, your End User, and the Payment Provider. Do not direct End Users to Komashi for it. --- ## 4. How to treat your End Users **4.1. Answer them.** Respond to questions and complaints about your services within a reasonable time. If you cannot deliver, say so early rather than at the door. **4.2. Honour the rights they have.** Where your End Users are consumers, they may have withdrawal rights, statutory guarantees, and other protections under their own national law. These are theirs by law, not favours you grant, and they apply regardless of what your own policy says. **4.3. Do not use their data for anything they did not agree to.** You are the controller of your End Users' personal data (Provider Terms Section 7.1). Marketing to them, exporting their details, or passing them to third parties requires your own lawful basis and your own privacy notice. **4.4. If you switch on analytics or AI features, you own that decision.** Where you enable Google Analytics, Microsoft Clarity, or an AI feature on your presence, you are responsible for consent, for telling visitors in your privacy notice, and for the transfer position (Provider Terms Section 6.7). **Do not enter into an AI feature any data you are not entitled to disclose**, including health data and anything covered by professional secrecy. --- ## 5. [Reserved] [This Section is intentionally left blank; the numbering of the other Sections is unchanged.] --- ## 6. [Reserved] [This Section is intentionally left blank; the numbering of the other Sections is unchanged.] --- ## 7. If you are an End User **7.1. Your contract is with the Provider.** Komashi supplies the software; the Provider supplies the service and is responsible for it. **7.2. Do not misuse accounts.** Using someone else's account is prohibited. **7.3. Report problems to the right place.** Problems with a service go to the Provider. Problems with the Platform itself go to Komashi at info@komashi.com. --- ## 8. Reporting a problem with someone else's content or conduct Anyone can report a suspected breach of the AUP or of these Guidelines to **info@komashi.com** or through the report form in the Komashi support system. You do not need an account to do it. **The full procedure is in Sections 3.1 to 3.6 of Module E** — what to put in a report, what we do with it, and how we handle intellectual-property notices and counter-notices. In short, tell us **what** is wrong and **why**, and **exactly where** to find it: the precise link, not just the Provider's name. Give us your name and email so we can come back to you and tell you the outcome — the one exception is a report about offences against children, which you may send anonymously. A person reviews every report; nothing here is decided by an automated filter. We act under **Section 4 of Module E**, and if we take a measure against someone because of your report, they receive a written statement of reasons under **Section 4.3b**. We do not otherwise disclose enforcement details to reporters unless the law requires it. --- # Privacy Policy > Komashi Privacy Policy (Module D1) — how Komashi handles personal data under the UAE PDPL and the GDPR. Canonical: https://komashi.com/docs/legal/privacy/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module D(1) — Privacy Policy** **Version:** v1.0 · **Effective date:** 2026-08-31 This Privacy Policy explains how BMSHI TECHNOLOGY SERVICES - FZCO ("**Komashi**", "**we**", "**us**") handles personal data in connection with the Komashi Platform. It is drafted to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("**PDPL**") and, because we serve users globally including in the EU/EEA, the EU General Data Protection Regulation ("**GDPR**"). --- ## 1. Who We Are; Contact > **In short:** Komashi is a Dubai company. Here's who we are and how to reach us. *This summary is for convenience only and is not legally binding.* 1.1. Controller / establishment: **BMSHI TECHNOLOGY SERVICES - FZCO**, registered in the IFZA free zone (Dubai Silicon Oasis) and licensed by the Dubai Integrated Economic Zones Authority, license number 76747, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE. Email: **info@komashi.com**. 1.2. **EU representative (GDPR Art. 27):** Komashi **has not yet designated** a representative in the Union under Article 27 GDPR. Komashi will designate one **before it offers the Platform to, or monitors the behaviour of, data subjects in the European Union**, and will publish the representative's name, address and contact details in this Section at that time. **Until then, please address all GDPR matters directly to Komashi at info@komashi.com**, and see Section 7 for how to exercise your rights and Section 7.4 for your right to complain to a supervisory authority. 1.2a. **UK representative (UK GDPR Art. 27):** **Komashi has not designated a representative in the United Kingdom, because it does not currently offer the Platform to, or monitor the behaviour of, individuals in the United Kingdom.** If that changes, Komashi will designate a UK representative and publish that representative's name and address here before doing so. A representative designated in the Union under Article 27 of the EU GDPR does **not** serve as a UK representative; the two are separate appointments. Until then, you may contact Komashi directly on all matters relating to the UK GDPR at **info@komashi.com**. 1.3. **Privacy contact:** **info@komashi.com**. Komashi is **not required to appoint a Data Protection Officer** under Article 37 GDPR or under the PDPL, and has not appointed one; all privacy enquiries, data subject requests and complaints should be sent to that address, which reaches the people responsible for them. ## 2. Our Two Roles: Controller and Processor > **In short:** For your data as a Komashi user (Provider or your own account data), Komashi is the controller and this Policy applies in full. For data that Providers hold about their customers on the Platform, the Provider is the controller and Komashi only processes it on the Provider's instructions — check that Provider's own privacy policy. *Non-binding summary.* 2.1. **Komashi as controller.** We act as controller for personal data of: (a) Providers and their staff; (b) visitors to our own websites; and (c) End Users, but **only** for the narrow set of data described in Section 2.1a. 2.1a. **What we control in relation to End Users, and nothing beyond it.** **A Provider's End User data belongs to the Provider.** There is no separate Komashi End User account, and Komashi does not build its own customer relationship with a Provider's End Users. We are controller for End User data only where we decide the purpose ourselves and no Provider instructs us to do so, which is limited to:     (a) **security, abuse prevention and platform integrity** — authentication and access events, IP address, device and browser information, and security log entries, used to keep the Platform available and to detect and stop attacks, fraud and abuse;     (b) **the technical operation of the Platform itself** — error and infrastructure logs generated by our systems; and     (c) **compliance with our own legal obligations** — including responding to authorities, and the records we must keep under Section 9.2a.     **Everything else about an End User — identity, contact details, bookings, subscriptions, invoices, messages, and the customer record as a whole — is processed for the Provider, as the Provider's processor** (Section 2.2). For that data, the Provider's privacy policy applies and requests should go to the Provider (Section 7.3). 2.1b. **Who is controller is a question of fact.** The allocation in Sections 2.1 to 2.2 describes who actually decides the purposes and means of each processing operation. It is not a nomination, and neither Komashi nor a Provider can change it by agreement alone: if either party in practice determines the purpose of a processing operation, it is controller for it whatever the paperwork says. Where a new feature changes who decides, this Policy is updated **before** the feature goes live. 2.2. **Komashi as processor.** For personal data that a Provider collects and manages about its End Users through the Platform (bookings, invoices, customer records), **the Provider is the controller and Komashi is the Provider's processor**. We process that data only on the Provider's documented instructions under the Data Processing Agreement (Module D(2)). For information about how a Provider uses your data, please read that Provider's privacy policy and contact the Provider. 2.3. **Payment data — no involvement in the money flow.** **Komashi is not part of the money flow.** Payments for Provider Services go directly from End Users, via an independent licensed Payment Provider, to Providers. Komashi is not a merchant of record, not a payment service provider, and never holds, receives, controls, or transmits End User funds. Accordingly, **we do not collect, hold, or process card numbers or payment credentials**; payment data is processed by the Payment Provider as described in its own privacy policy. We receive limited payment-related metadata after the fact, and its scope is fixed: **transaction reference, amount, currency, timestamp, success or failure, refund status, and the type of payment method used (for example "card" or "transfer")**. That is the whole of it. We do **not** receive, and the Platform is not built to accept, **card numbers, expiry dates, CVC or other card security codes, bank account credentials, cardholder authentication data, or any payment token capable of initiating a payment**. We use this metadata for one purpose only: to determine whether an invoice was paid, which drives Commission accrual under Section 4.1a of the Provider Terms. ## 3. What Data We Collect > **In short:** Account details, the content you or your Provider put on the Platform, technical and usage data, and support communications. We don't collect card numbers. *Non-binding summary.* 3.1. Depending on your role, we collect: (a) **identification and contact data** — name, email address, phone number, business details; (b) **account and authentication data** — login events, one-time login codes/links metadata, device identifiers, and, where you choose to sign in with a third-party identity provider, the account identifier and the name and email address that provider returns; (c) **platform content** — data you or your Provider enter (bookings, invoices, service details); (d) **technical and usage data** — IP address, browser and device information, logs, approximate location derived from IP; (e) **communications** — support requests, complaints; and (f) **cookie data** (Section 8). 3.2. **Special categories of personal data.** The Platform has **no field designed to hold special-category data** (Article 9 GDPR — health, religion, biometrics, and the rest), and we do not intentionally collect it. Providers **must not** enter it, or invite End Users to enter it, into free-text fields such as booking notes, service descriptions or messages, and must not otherwise instruct us to process it through the Platform without a **separate written agreement** under Section 2.1(d) of the Data Processing Agreement.     This matters most where it is easiest to overlook. A service name, a booking note, or a message can amount to health data without anyone intending it — a Provider in physiotherapy, wellness, or a similar field can generate special-category data simply by describing what was booked. Where a Provider's business necessarily involves such data, it must raise this with us under Section 2.1(d) of the DPA **before** it starts processing, so that the additional safeguards are in place first. **The Provider is the controller of what it and its End Users type into those fields**, and is responsible for having a valid Article 9 condition for it. ## 4. Why We Process Data and on What Legal Basis > **In short:** We use your data to run the Platform, keep it secure, bill Providers, comply with the law, and improve the service — each on a recognized legal basis. *Non-binding summary.* 4.1. Where Komashi acts as controller, we process personal data for the following purposes and legal bases (GDPR Art. 6; PDPL equivalents): | Purpose | Legal basis | |---|---| | Creating and administering accounts; providing the Platform | Performance of a contract (Art. 6(1)(b)) | | Passwordless authentication; fraud prevention; security | Performance of a contract; legitimate interests (Art. 6(1)(f)) in securing the Platform | | Billing Providers | Performance of a contract; legal obligation (tax/accounting) (Art. 6(1)(c)) | | Compliance with UAE and other applicable law, court orders | Legal obligation (Art. 6(1)(c)) | | Service improvement, aggregated analytics | Legitimate interests (Art. 6(1)(f)); consent where required for cookies | | Marketing communications | Consent (Art. 6(1)(a)) or soft opt-in where permitted; opt-out always available | | Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) | 4.2. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights; you may object at any time (Section 7). 4.3. Where we rely on consent, you may withdraw it at any time without affecting prior processing. ## 5. Who We Share Data With > **In short:** The application services we use to run the Platform — invoicing, AI features, sign-in and analytics — plus the Provider you deal with, the payment companies (which process your payment data on their own account, not on ours), and authorities where the law requires it. **We run the Platform on our own equipment, so there is no hosting company in the picture.** We don't sell personal data. *Non-binding summary.* 5.1. We share personal data with: (a) **sub-processors** listed at https://komashi.com/legal/subprocessors. **We run the Platform's application, database, storage and log indexing on equipment we own, at our own premises in the EU/EEA**, and rent no compute, hosting, database, or log-analytics service from anyone. Outbound transactional email is sent from **our own mail servers**. As a result **there is no infrastructure sub-processor at all** — no cloud provider, no data-centre operator, and no email delivery provider — and no third party holds any account over our database, logs, or mail. The sub-processors we do engage are **application-level services only** — invoicing, AI features, sign-in and analytics, and payment-side verification — and each is named at that address, together with **the categories of data it actually receives**. Annex 3 of the DPA also records which third parties are **not** sub-processors and why; (b) **Providers** — data relating to their own End Users and their account; (c) **Payment Providers** — limited data necessary to initiate their own processing. **A Payment Provider is an independent controller, not our sub-processor**: it determines its own purposes and means for that processing under its own licence and regulatory obligations, and it is therefore not listed at the sub-processor URL above and is not subject to the sub-processor objection right in Section 4.2 of the Data Processing Agreement; (d) **professional advisers, auditors, insurers**; (e) **authorities and courts** where legally required; and (f) a **successor entity** in a merger or acquisition, with notice. 5.2. We do not sell personal data and do not share it with third parties for their own advertising. ## 6. International Transfers > **In short:** Core Platform data is held in the EU/EEA, and **none of it goes to the UAE or can be reached from there**. Limited data may reach service providers in other countries for AI features, third-party sign-in, analytics, payment and verification, subject to the transfer mechanisms described below and in the sub-processor list. *Non-binding summary.* 6.1. **Where your data is held.** The Platform's application, database, storage and backups are located **in the EU/EEA**. Although Komashi is registered as a company in the UAE, **no personal data is transferred to, stored in, or accessible from the United Arab Emirates** (DPA Module D(2), Section 5.2). That is true both of data we process as a processor for Providers and of data we process as controller about Providers, Partners, and website visitors. 6.2. **Data that does leave the EU/EEA, and why.** Some service providers and downstream providers may be established in, or process data from, countries outside the EU/EEA. Personal data reaches them only where the relevant function is used and is limited in each case to what that function requires:     (a) **AI features** — the text submitted to an AI feature, which includes support questions and the content of support tickets;     (b) **sign-in with a third-party identity provider** — where you choose it, your name, email address and account identifier with that provider;     (c) **web analytics we operate on our own account** — IP address, device and browser data, and usage and event data; and     (d) **payment and Provider verification** — the identification, billing and verification data described in Section 6.2a.     The recipient categories, authorized model families and provider pools, possible locations and data categories are described in the sub-processor list at https://komashi.com/legal/subprocessors. A request or workflow may use multiple models or providers in parallel or in sequence. Providers listed in an authorized pool do not all receive data; only those participating in the relevant request, route or feature do. **Nothing beyond the categories stated there leaves the EU/EEA** — that limit is itself one of the safeguards described in Section 6.2b. 6.2a. **Payment and payout data.** Our own fee collection from Providers, is carried out through payment service providers, some of which are **not established in the EU/EEA**. The data necessary for those operations — the identification and billing data of the Provider concerned, and the associated payment references — therefore reaches those providers. For the payment transaction itself they act as **independent controllers** under their own regulatory obligations (Section 5.1(c)), and that processing is governed by their own privacy terms. Where such a provider instead acts on our instructions — for example, verification checks we ask it to run during Provider onboarding — it acts as our sub-processor and is listed as such. 6.2b. **Safeguards for those transfers.** Each transfer described in Sections 6.2 and 6.2a is made under the **EU Standard Contractual Clauses** adopted by the European Commission (Implementing Decision (EU) 2021/914), an applicable adequacy decision, or another valid Chapter V GDPR mechanism, as described in **DPA Section 5.2a**. Komashi may use the Clauses as a primary or fallback mechanism where appropriate to the recipient and route.     We carry out and document a **transfer impact assessment** for these transfers, review it periodically and when a material change makes review appropriate, and apply the supplementary measures it records. These include encryption in transit, limitation of the categories that leave the EU/EEA, and contractual and technical controls intended to prevent a recipient from using the data for its own purposes, including model training, unless the relevant controller has separately instructed or authorized that use.     A copy of the relevant safeguards is available on request at **info@komashi.com**. 6.2c. **UK data.** For personal data subject to the UK GDPR, the same Clauses apply as amended by the **UK International Data Transfer Addendum**. 6.3. Transfers of PDPL-covered data outside the UAE are made in accordance with Articles 22–23 PDPL (adequacy, appropriate safeguards, or another permitted basis). ## 7. Your Rights > **In short:** You can ask for access, correction, deletion, restriction, portability, and object to some processing. If we're only the processor for your data, we'll point you to your Provider. You can also complain to a data protection authority. *Non-binding summary.* 7.1. Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase data; restrict processing; data portability; object to processing based on legitimate interests or for direct marketing; withdraw consent; and not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. 7.1a. **One decision on the Platform is fully automated: blocking a Provider Account for non-payment.** We tell you about it here because Article 22 GDPR requires it.     (a) **What the decision is.** If an invoice we have issued to a Provider for our own platform fees is still unpaid after the due date, the Platform blocks that Provider's Account automatically, without a person reviewing the case first.     (b) **The logic involved.** It is a simple payment check. It does not evaluate you, your conduct, or your characteristics, and the whole of it is this: the invoice falls due **ten days after its date**; where the Fee is charged automatically, the charge is retried over **seven days**, and **we email you on each failed attempt** so that you can check your payment method; and if the amount is still outstanding **ten days after the due date**, the Account is blocked (Sections 5.1–5.2 of the Provider Terms).         *To be precise about what you do and do not receive:* the notices are about the **failed payment attempts**, not about the block. **There is no separate warning email immediately before the Account is blocked** — the block follows automatically once the ten days after the due date have run. The failed-charge emails, together with the invoice and this Policy, are the notice you get.     (c) **Significance and consequences.** While the Account is blocked, the Provider presence is switched off and Provider Services are treated as expired towards End Users (Provider Terms Section 5.4). **The block is lifted as soon as the outstanding amount is paid, and no reactivation fee is charged** (Provider Terms Section 5.3).     (d) **Legal basis.** The decision is necessary for the performance of the contract between you and Komashi (Article 22(2)(a) GDPR).     (e) **Your safeguards.** You may **obtain human intervention on our part, express your point of view, and contest the decision** by writing to **info@komashi.com**; a person will review it, and we will lift the block where the review shows it was not justified. Where you are a business user within the scope of Regulation (EU) 2019/1150, we also provide a statement of reasons under Section 5.2a of the Provider Terms, and the review route in Section 4.3 of the Acceptable Use Policy is available to you. 7.1b. **We take no other solely automated decisions with legal or similarly significant effects.** Fee calculations (rate band, free allowance, loyalty rate) are the application of published formulas and do not evaluate personal aspects. Enforcement measures under the Acceptable Use Policy are taken by a human reviewer on the basis of a report, a legal obligation, or an authority's order; **no automated content moderation, filtering, classification, or risk scoring is applied** (Acceptable Use Policy Section 1.3). You may contest any account-level measure and request human reconsideration at **info@komashi.com**. 7.2. To exercise your rights, contact **info@komashi.com** (or, once designated, our EU representative — Section 1.2). We respond within the time limits of the GDPR (generally one month) and the PDPL. We may need to verify your identity. 7.3. **If Komashi processes your data only as a Provider's processor (Section 2.2), we will direct you to the relevant Provider** (Komashi cannot itself forward the request), as the controller responsible for responding. 7.4. You may lodge a complaint with a supervisory authority: in the UAE, the UAE Data Office; in the EU/EEA, the supervisory authority of your residence or workplace. We would appreciate the chance to resolve your concern first via info@komashi.com. ## 8. Cookies and Similar Technologies > **In short:** We use necessary cookies to make the Platform work, and optional ones (like analytics) only with your consent, which you give in the cookie banner and can change or withdraw at any time on our cookie settings page. *Non-binding summary.* 8.1. We use strictly necessary cookies (session, security, load balancing) without consent, as permitted by law. 8.2. Optional cookies (analytics and preferences — **we set no advertising or cross-site tracking cookies**) are set **only with your prior consent**, collected via our cookie banner, where required by applicable law (including the ePrivacy rules of EU member states). You can withdraw or adjust consent at any time via https://komashi.com/legal/cookie-settings. 8.3. Details of individual cookies, their purposes and durations are listed in our Cookie Notice at https://komashi.com/legal/cookies. ## 9. Retention > **In short:** We keep data only as long as needed, and this section states the actual periods — it is the single place where retention is defined for the whole Komashi terms package. *Non-binding summary.* 9.1. We retain personal data only as long as necessary for the purposes above, and thereafter as required for legal obligations or the establishment or defense of legal claims. 9.2. **Retention schedule.** This Section 9.2 is the **single governing source** of retention and deletion periods for the entire Terms package; where any Role Term or the DPA refers to retention or deletion periods, it refers to this Section. Deletion at the end of a period is **scheduled and automatic**, not on request; the only data that outlives its period is data caught by a statutory retention duty in Section 9.2a or by a legal hold under Section 9.2c.     (a) **Account lifecycle.** | Data / stage | Period | |---|---| | Soft-delete (deactivated, non-public) after Account termination | 30 days | | Export window for the former Account holder | 30 days from termination | | Permanent deletion or irreversible anonymization of Account and User Content | 90 days after termination |     (b) **Operational records, while the Account is live.** | Data / stage | Period | |---|---| | Booking, order and customer records | 24 months after the booking or order to which they relate, then deleted or irreversibly anonymized | | Activity log (in-application audit trail) | 12 months | | Technical and security logs (server, application, access) | 12 months | | Infrastructure and file-level logs | 14 days | | Record of outgoing transactional email (delivery metadata) | 90 days | | Support communications | 24 months after the case is closed | | Cookie and consent records | 12 months from collection of the consent, or until withdrawal if earlier |     (c) **Backups.** Backups are retained on a fixed rotation and are **not** searched or edited to remove individual records; data deleted under paragraphs (a), (b) or Section 9.2a disappears from backups as the rotation expires, and is not restored into production. | Backup tier | Period | |---|---| | Daily backups | 2 weeks | | Weekly backups | 2 months | | Monthly backups | 6 months | 9.2a. **Records kept because the law requires it.** The following survive Account termination and the periods in Section 9.2, because a statutory retention duty applies to them. They are held in a **restricted state**: available only for the purpose that justifies keeping them, not used to operate the Platform or to contact anyone, and deleted at the end of the period.     (a) **Komashi's own accounting records** — the invoices Komashi issues to Providers for its Fees, and the supporting records: **5 years** from the end of the tax period to which they relate (UAE Federal Decree-Law No. 8 of 2017 on Value Added Tax and the UAE Commercial Transactions Law).     (b) **Invoices a Provider issues through the Platform** are the Provider's own accounting records, not Komashi's, and Komashi holds them as processor (DPA Section 3.8). They are retained for the statutory record-keeping period that applies to that Provider — **8 years** from the end of the calendar year of issue where the Provider is established in the European Union, and **5 years** otherwise — after which they are deleted. A Provider may instruct Komashi in writing to apply a longer period required by its own national law.     (c) **Platform-operator tax reporting records.** Where Komashi is a reporting platform operator under Council Directive (EU) 2021/514 (DAC7), the records of the due-diligence steps and the information relied on are retained for **5 years** following the end of the reportable period to which they relate. That Directive sets a floor of 5 years and a ceiling of 10; Komashi applies the floor.     (d) **Records kept to establish, exercise or defend legal claims** — where a claim is pending or reasonably anticipated: until the claim is finally resolved and the applicable limitation period has expired. 9.2b. **What "deleted" means.** Deletion means the record is removed from the production systems, or is irreversibly anonymized so that it can no longer be attributed to an identified or identifiable person, without a key or other means of re-identification being retained. Backups follow Section 9.2(c). 9.2c. **Legal hold.** Komashi may suspend a scheduled deletion for specific records where required by law, by an order of a competent authority, or to preserve evidence for a pending or reasonably anticipated claim. A hold is limited to the records concerned and to the period for which the reason subsists, and deletion resumes as soon as it ends. 9.2d. **Erasure requests.** A request to erase personal data is honoured under Section 7 in respect of everything in Section 9.2. It does **not** override Section 9.2a, because that data is retained to comply with a legal obligation or to establish, exercise or defend legal claims (Articles 17(3)(b) and (e) GDPR). Where an erasure request is refused on that basis, we tell you which category applies and when the record will be deleted. 9.3. Terminated accounts follow the soft-delete → permanent-deletion sequence in Section 9.2(a), subject to Section 9.2a. For Provider-controlled End User data, deletion or return on termination is governed by the DPA (Module D(2) Section 3.8), which applies the periods in this Section 9. ## 10. Security > **In short:** We protect data with technical and organizational measures appropriate to the risk — encryption in transit, access controls, logging, and more. *Non-binding summary.* 10.1. We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or loss, including encryption in transit, access controls, least-privilege administration, logging and monitoring, and regular review. A summary of measures is in Annex 2 of the DPA. 10.2. In the event of a personal data breach, we will notify the competent authority and affected individuals where and as required by the PDPL and GDPR, and affected Provider controllers under the DPA. ## 11. Children > **In short:** Komashi is for adults — you must be 18 to have an account. We do not knowingly hold children's data. If you think a child gave us data, tell us. *Non-binding summary.* 11.1. The Platform is not directed at children, and accounts require a minimum age of 18. We do not knowingly process children's personal data as controller; if you believe a child has provided us data, contact info@komashi.com. ## 12. Changes to This Policy > **In short:** We may update this Policy. If a change matters to you, you get advance notice and a grace period, and the current version is always at the address below. *Non-binding summary.* 12.1. We may update this Policy from time to time. Material changes will be notified in accordance with Section 4 of the General Terms (advance notice with a grace period). The current version is always available at https://komashi.com/legal/privacy. --- # Provider Fee Schedule > Schedule 1 to the Provider Terms — commission rates, free allowance, loyalty period and reactivation fee. Canonical: https://komashi.com/docs/legal/provider-fee-schedule/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Parent agreement.** This Schedule forms part of the **Komashi Provider Terms (Module A)**, which incorporate the **Komashi General Terms of Service (Module 0)**. Capitalized terms not defined here have the meanings given in Module A and Module 0. **Schedule version:** v1.0 **Schedule effective date:** 2026-08-31 **Published at:** https://komashi.com/pricing *(the rates and terms published there, in the version in force during a billing period, are those that apply to that period).* **Currency.** All amounts and revenue bands referred to in this Schedule are expressed in **US dollars (USD)**. Invoices issued in another Supported Currency are converted into USD at the Reference Rate determined under **Module F (Currency and Exchange-Rate Terms), Section 4**, and Komashi invoices and collects the Fees in USD (Module F Section 5.1). **Amendment.** This Schedule may be amended in accordance with **Section 4 of Module 0** and **Section 4.6 of Module A** (advance notice and grace period). Changes apply from the next billing period commencing after the change takes effect. The version of this Schedule in force during a billing period governs that period. Where you are within the scope of Regulation (EU) 2019/1150 (P2B), notice of changes is given on a durable medium in accordance with Module A §5.2a. --- **1. Commission rates** (per Module A Section 4.1). The Commission rates for each annual revenue band are published at **https://komashi.com/pricing**. The band is determined by the **total value of invoices issued** through the Platform in the calendar year, in USD, **whether or not those invoices are paid**; Commission itself accrues only on paid, Fee-bearing invoices (Module A Section 4.1a). **2. Free allowance** (per Module A Section 4.2): the number of invoices **issued** per calendar month that is exempt from Commission is published at **https://komashi.com/pricing**, whether or not those invoices are paid. Where invoices are of equal value, the allowance is applied in order of issue, earliest first. **3. Loyalty qualifying period** (per Module A Section 4.3): the qualifying period of continuous active use, and the loyalty rates that apply automatically thereafter, are published at **https://komashi.com/pricing**. **4. Reactivation fee** (per Module A Section 5.3): any reactivation fee is published at **https://komashi.com/pricing**. Reactivation of a blocked Account requires settlement of all outstanding Fees together with any such fee. A reactivation fee may be introduced or changed only by amending this Schedule under Module A Section 4.6, with advance notice; any such fee will be set by reference to the administrative cost of restoring a blocked Account. **5. Registration fee / monthly subscription fee:** if any, published at **https://komashi.com/pricing**. --- # Provider Terms > Komashi Provider Terms (Module A) — the terms for businesses selling their services through Komashi. Canonical: https://komashi.com/docs/legal/provider-terms/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module A — Provider Terms** **Version:** v1.0 · **Effective date:** 2026-08-31 These Provider Terms apply to every Provider using the Komashi Platform. They **incorporate the Komashi General Terms of Service (Module 0)**, which form part of this agreement. Capitalized terms not defined here have the meanings given in Module 0. --- ## 1. Scope; Relationship to the General Terms > **In short:** These terms are for businesses selling their services through Komashi. They apply together with the General Terms; if the two conflict, these Provider Terms win for Provider matters. *This summary is for convenience only and is not legally binding; the numbered terms govern.* 1.1. These Provider Terms, together with Module 0, the Currency Terms (Module F), the Acceptable Use Policy (Module E), the Data Processing Agreement (Module D(2)) and the Privacy Policy (Module D(1)), govern your use of the Platform as a Provider (the "**Provider Agreement**"). 1.2. In case of conflict between these Provider Terms and Module 0, these Provider Terms prevail, subject to Section 3.2 of Module 0. 1.3. **Capacity; what you must tell us.** These Provider Terms apply to you whether you offer your Provider Services as a business or as a private individual. **When you register you must tell Komashi, and keep accurate, whether you offer your Provider Services in the course of a trade, business, craft or profession.** That statement determines two things: how Komashi describes you to End Users under Section 1.5 of the End User Terms (Module C), and which of the following applies to you. 1.3a. **Business Provider.** If you offer your Provider Services **in the course of a trade, business, craft or profession**, you are a "**Business Provider**". This includes a company, a registered sole trader, and an individual who is not registered as a business but nonetheless offers services on a regular, organised, or profit-seeking basis. These Provider Terms apply to you in full. 1.3b. **Private Provider.** If you do not act in that course — for example where you occasionally let a property you own, or occasionally offer a service outside any trade or profession — you are a "**Private Provider**", and the following apply **instead of, or in addition to,** the corresponding provisions:     (a) **Section 9 (Indemnification) does not apply to you.**     (b) Komashi's liability to you is subject to Sections 10.5 and 10.5a of Module 0, including the consumer minimum cap.     (c) Sections 5.2a–5.2c do not apply to you as a matter of law, because Regulation (EU) 2019/1150 covers business users only. **Komashi will nevertheless give you the same statement of reasons and the same notice periods** as it gives a Business Provider.     (d) You may **withdraw from the Provider Agreement within fourteen (14) days** of entering into it, as set out in Section 8.1a.     (e) Section 13.2 of Module 0 (arbitration) does not apply to you; Section 13.2a applies to you instead.     (f) Nothing in the Provider Agreement affects the mandatory consumer rights of the law of your country of residence, which prevail (Section 14 of Module 0). 1.3c. **Status is a matter of fact.** Whether you are a Business Provider or a Private Provider depends on how you actually operate, not on what you declared. If Komashi becomes aware that your declaration does not reflect how you operate, Komashi will correct your status, tell you, and update what End Users are shown. **If you declared business status but do not in fact act as a business, Section 1.3b applies to you regardless of your declaration.** You must tell Komashi without undue delay if your circumstances change. 1.3d. **Your own legal obligations are unaffected.** Whichever category you fall into, you remain solely responsible for your own registration, licensing, tax, and reporting obligations in every jurisdiction where you operate (Sections 6.2 and 6.4), including any registration or permit scheme applicable to the activity you offer. 1.4. **Distribution channels; affiliate programs; your intellectual property (Regulation (EU) 2019/1150, Art. 3(1)(d)–(e)).** Komashi markets Provider Services through the Platform itself. Komashi operates no other distribution channel or affiliate program for your Provider Services. **Your intellectual property remains yours:** Section 7.3 of Module 0 confirms that you retain ownership of your User Content, and the license you grant Komashi under Section 7.4 of Module 0 is limited to what is necessary to operate the Platform and terminates when the content is deleted. Nothing in the Provider Agreement transfers ownership or control of your trademarks, brand, service descriptions, images, or customer data to Komashi. ## 2. The Provider Services Relationship; Komashi's Role > **In short:** Your customers are yours, not ours. You sell your services to your End Users under your own contract with them; Komashi only supplies the software. Payments from your customers go directly to you through the Payment Provider — Komashi never holds your money or your customers' money. *Non-binding summary.* 2.1. The Platform enables you to offer, manage, and sell your Provider Services to your own customers (End Users). **The contract for Provider Services is concluded exclusively between you and the End User.** Komashi is not a party to it, does not act as your agent or commercial representative, and does not sell or resell your Provider Services. 2.2. **NO INVOLVEMENT IN THE MONEY FLOW.** ALL PAYMENTS FOR YOUR PROVIDER SERVICES FLOW DIRECTLY FROM THE END USER, VIA THE PAYMENT PROVIDER, TO YOU. **KOMASHI IS NOT PART OF THE MONEY FLOW**: KOMASHI IS NOT A MERCHANT OF RECORD, NOT A PAYMENT SERVICE PROVIDER, AND NEVER HOLDS, RECEIVES, CONTROLS, OR TRANSMITS FUNDS BELONGING TO YOU OR YOUR END USERS. THE FEES YOU OWE KOMASHI UNDER SECTION 4 ARE INVOICED BY KOMASHI TO YOU SEPARATELY AND ARE NEVER DEDUCTED FROM, OR SETTLED OUT OF, END USER PAYMENTS. 2.3. Your acceptance of payments requires an agreement between you and a Payment Provider under the Payment Provider's own terms. You are responsible for complying with the Payment Provider's terms, and Komashi is not responsible for the Payment Provider's acts, omissions, availability, or fees. 2.4. **Chargebacks and payment disputes.** Any chargeback, reversal, refund, or payment dispute in respect of an End User payment for your Provider Services is a matter between the End User, you, and the Payment Provider, and is **borne by you on your own account with the Payment Provider**. Consistent with Section 2.2, Komashi is not the merchant of record, holds no funds and no reserve against any such chargeback or dispute, is not a party to it, and bears no liability for it. Payment Provider fees, chargeback fees, and reserve requirements, if any, are governed by your agreement with the Payment Provider. ## 3. Your Account; Subdomain; API Keys > **In short:** You get a Provider account, a Komashi subdomain for your business, and API keys if you integrate. Keep your API keys secret — whoever holds them can act as you. *Non-binding summary.* 3.1. Your Provider Account is subject to Section 5 of Module 0 (passwordless login). You may authorize staff members to access your Account as permitted by Platform functionality; you are responsible for their acts and omissions. 3.2. Komashi may make a subdomain available for your Provider presence (e.g., [yourname].komashi.com). The subdomain remains Komashi's property; you receive a revocable right to use it for the duration of the Provider Agreement. You may not use a subdomain that infringes third-party rights or violates the AUP. 3.3. If you use the Komashi API, Komashi will issue you API keys. API keys are confidential; you must protect them, must not share them with third parties (other than service providers acting on your behalf under confidentiality obligations), and must notify Komashi promptly at info@komashi.com if a key is compromised. Komashi may rotate, rate-limit, or revoke API keys for security reasons or breach of the Provider Agreement. All activity performed with your API keys is attributed to you. ## 4. Fees > **In short:** Komashi charges a commission on the invoices you issue through the Platform — the exact rates are in Schedule 1, and a monthly allowance of invoices is free of commission. Long-standing Providers get loyalty rates. Commission is billed by Komashi to you separately; it is never taken out of your customers' payments. *Non-binding summary.* 4.1. **Commission.** In consideration of the Services, you shall pay Komashi a commission calculated by reference to the value of invoices you issue to End Users through the Platform (the "**Commission**"). The Commission and any other amounts payable by you to Komashi are "Fees" as defined in Section 2.4 of Module 0. The applicable Commission rates are set out in **Schedule 1 (Fee Schedule)**, which forms part of these Provider Terms. Rates depend on your annual revenue invoiced through the Platform (in USD, per calendar year running 1 January to 31 December); invoices issued in another Supported Currency are converted into USD in accordance with the **Currency Terms (Module F)**, which also govern the currencies in which you may invoice. **Your rate band is determined by the total value of the invoices you issue through the Platform during the calendar year, whether or not those invoices are subsequently paid.** This is deliberately a different basis from Section 4.1a: **issuance determines which rate applies to you; payment determines which invoices bear Commission at that rate.** **An invoice, once issued, is final for the purpose of the band calculation.** The Platform does not issue cancellation or credit notes, and a cancellation, credit note, or refund arranged outside the Platform does not remove the invoice from the band for the calendar year in which it was issued. Section 4.1c (invoices issued in breach of the Acceptable Use Policy) and Section 4.1d (correction route) are the only routes by which an issued invoice is disregarded. If your annual revenue crosses into a new band during a calendar month, the new band's rate applies to that entire month. Each billing month begins on the 1st day at 00:00 in your local time zone. 4.1a. **Paid invoices only.** Commission accrues only on invoices that have actually been paid by the End User. Invoices that remain unpaid or whose payment failed do not bear Commission. Komashi determines paid/unpaid status from settlement-status information reported to it by the Provider or the Payment Provider after payment has occurred; **Komashi receives no End User funds, card numbers, or payment credentials, and does not participate in the authorization, clearing, or settlement of any End User payment.** Its Commission is a charge for use of the software platform, invoiced to and paid by the Provider independently of, and never conditioned on Komashi's involvement in, any End User payment. Because Commission accrues only on invoices that were actually paid, an invoice that is cancelled before payment, or that is never paid, bears no Commission and nothing needs to be reversed. Where an invoice **was** paid and the Provider subsequently refunds or credits the End User, Section 4.1d applies. 4.1c. **Integrity of the band calculation.** Because the band is measured on invoices issued rather than on invoices paid (Section 4.1), Komashi may **disregard, for the purpose of the band calculation only**, any invoice that was issued in breach of the Acceptable Use Policy, including fictitious, self-dealing, or duplicated invoices and invoices issued to manipulate the rate band or the free allowance (AUP Section 2.3). Komashi will notify you of any invoice it disregards and of the corrected band, and you may contest that decision through the complaints process in Section 16 of Module 0. This Section does not affect Commission already correctly accrued, and does not entitle Komashi to disregard an invoice merely because the End User failed to pay it. 4.1b. [Reserved.] 4.1d. **Refund of a paid invoice — correction of Commission.** If an invoice on which Commission has accrued is afterwards cancelled, credited, or refunded to the End User, in whole or in part, you may ask Komashi to correct the Commission. Because the Platform does not issue cancellation or credit notes, this is a **documented request, not an automatic reversal**:     (a) **How to make it.** Send Komashi, through the support channel in Section 16.1 of Module 0, the invoice reference and evidence that the amount was in fact refunded or credited to the End User (for example the credit note you issued outside the Platform, or the refund confirmation).     (b) **What Komashi does.** Where the evidence shows the refund or credit, Komashi credits the Commission attributable to the refunded amount **against the Fees for the current billing period**, or refunds it if no further Fees are payable. Komashi does not reopen a closed billing month, and the correction is made proportionately where the refund is partial.     (c) **What it does not change.** The correction does not alter the rate band for the calendar year (Section 4.1) or the free allowance for the month in which the invoice was issued (Section 4.2); those run on invoices **issued** and are final once the period has closed. A change of rate band resulting from a correction takes effect **prospectively only**.     (d) **Time limit.** A request under this Section must be made within **twelve (12) months** of the date of the invoice concerned. 4.2. **Free allowance.** In each calendar month, the number of invoices specified in **Schedule 1** is **exempt from Commission**. The exempt invoices are the largest by gross invoice value among the invoices you **issue** through the Platform in that month, converted into USD under the Currency Terms (Module F) where issued in another currency, **whether or not those invoices are paid** — the same basis as the rate band in Section 4.1.     (a) **Equal values.** Where two or more invoices have the same value and the allowance cannot cover all of them, the allowance is applied to those invoices **in the order in which they were issued, earliest first**, until it is used up. **The allowance never exceeds the number specified in Schedule 1**, however many invoices of equal value you issue in that month.     (b) **The allowance is fixed once the month closes.** The allowance is calculated on the invoices issued in that month and is **not recalculated afterwards**. A refund or credit given to an End User after the month has closed does not free up allowance, does not move it to another invoice, and does not carry it into the following month; the Commission consequences of such a refund are dealt with under Section 4.1d instead.     The exemption is applied automatically at the end of the billing period. There is no registration fee and no fixed monthly subscription fee. 4.3. **Loyalty discount.** After the qualifying period of continuous active use specified in **Schedule 1**, the loyalty rates in Schedule 1 apply automatically in place of the standard rates. 4.4. **Nature of the Fees.** The Commission and any other Fees are charges for the use of the Komashi software platform. **They are not a payment-processing charge and are not collected from, deducted from, or settled out of End User payments** (Section 2.2). Payment Provider fees are separate, are charged by the Payment Provider under its own terms, and are your responsibility. 4.5. **Taxes.** Fees are exclusive of VAT and other applicable taxes, which will be added where required by law. Each party is responsible for its own taxes (Section 6.4). 4.6. **Changes to Fees.** Komashi may change Schedule 1 (including the Fees, tier structure, free allowance, and loyalty criteria) in accordance with Section 4 of Module 0 (notice and grace period). Changes apply from the next billing period commencing after the change takes effect. The version of Schedule 1 in force during a billing period governs that period. 4.6a. **Existing Providers keep their rate.** An increase to the Commission rates in Schedule 1 applies only to Providers who register after that increase takes effect. A Provider who was already party to a Provider Agreement when the increase takes effect **retains its existing (pre-increase) Commission rates** for three (3) years from the date the increase takes effect, after which the then-current rates apply. This Section does not prevent Komashi from applying changes that are more favorable to the Provider, or from applying uniform changes to the free allowance or loyalty criteria. ## 5. Billing; Late Payment; Account Blocking > **In short:** We invoice you on the 3rd of each month for the previous month. If you don't pay within 10 days, your account is blocked; to unblock it you need to settle what you owe. EU Providers get the additional protections EU law requires. *Non-binding summary.* 5.1. **Billing cycle.** Komashi issues its invoice for Fees on the **3rd day of each calendar month**, covering the preceding calendar month. Komashi invoices and collects all Fees in **US dollars (USD)**, whatever currency your own invoices to End Users are issued in (Currency Terms (Module F), Section 5). **Invoices are payable within ten (10) days of the invoice date.** Fees are collected by **charging the payment method you have registered with Komashi** through the Payment Provider, in accordance with Section 5.1a; the invoice identifies the payment method charged. Where no registered payment method is available — before your first payment, or where a registered method has expired or been declined — the invoice states the alternative method by which it may be paid. 5.1a. **Automatic charging of Fees; storing your payment method.** Once you have paid Komashi at least once, you authorize Komashi to **charge the Fees automatically** to the payment method you have registered with Komashi. Registering that payment method is carried out by the Payment Provider under its own terms: the Payment Provider verifies and stores the card and returns to Komashi only a reference to the stored payment method. **Komashi does not receive, store, or process your card number, security code, or other payment credentials, and Komashi applies no verification charge and no verification hold to your card.** Registration and the automatic charging of Fees occur **at the Provider level** (between you and Komashi) and are separate from, and never settled out of, the End User payment flow (Section 2.2). **Komashi does not initiate or perform any validation, hold, or charge on an End User's card.** 5.2. **Blocking for non-payment.**     (a) **Retries and failure notices.** Where the Fee is charged automatically to your registered payment method (Section 5.1a) and a charge fails, Komashi retries it over a period of **seven (7) days** and **notifies you of each failed attempt**, so that you can check or update your payment method.     (b) **Blocking.** If any invoiced amount remains unpaid **ten (10) days after the due date** under Section 5.1, your Account is **blocked automatically** — suspending your and your End Users' access to your Provider presence on the Platform — until all outstanding amounts are paid.     (b)(i) **What you are told, and when.** The notices under paragraph (a) are about **failed charge attempts**; **there is no separate reminder immediately before the block itself**, which follows automatically once the ten days have run. Komashi notifies you **when the block takes effect**, stating the amount outstanding and how to clear it. Where Section 5.2a applies to you, that notice is the statement of reasons on a durable medium required by it. The automated nature of this decision, and your right to human review of it, are described in **Section 7.1a of the Privacy Policy**.     (c) **Reactivation** is governed by Section 5.3. 5.2a. **EU business users (Regulation (EU) 2019/1150 — "P2B").** Where you are established in the EU/EEA or offer your Provider Services to consumers in the EU/EEA, Komashi will: (a) notify changes to the Terms on a durable medium for the reasonable and proportionate minimum period required by Article 3 of that Regulation, subject to its waiver and urgent-change exceptions; (b) provide you with a statement of reasons on a durable medium for any restriction, suspension or termination of the Services, at the latest when a suspension takes effect and at least **30 days before** a termination takes effect; (c) disclose the main ranking parameters as set out in Section 5.2b; and (d) provide the complaint-handling and mediation arrangements set out in Section 5.2c. Immediate changes or action remain available where permitted by that Regulation, including where required by law or needed to address an unforeseen and imminent danger relating to fraud, malware, spam, data breaches or other cybersecurity risks. **For Providers within the scope of this Section, the 30-day termination notice in this Section prevails over the shorter cure and notice periods in Section 12.3 of Module 0 and Section 5.5 of these Provider Terms, except where the Regulation permits immediate termination.** 5.2b. **Ranking transparency (P2B Art. 5).** **The Platform does not rank, order, or prioritise Provider presences, listings, or services against one another.** Each Provider has its own presence, and the Platform presents no cross-Provider search results, directory, or category pages through which Providers could be ordered. There is accordingly no ranking mechanism to describe, and **Komashi accepts no direct or indirect remuneration from any Provider in exchange for visibility or position**. Where an End User finds a Provider presence through a general search engine, the position is determined by that search engine, not by Komashi. **If Komashi introduces any ranking or ordering of Providers**, it will set out in this Section the main parameters determining it, in order of importance, and the relative weight of those parameters, and will do so before the feature goes live and with notice under Section 4 of Module 0 to Providers within the scope of this Section. 5.2c. **Complaint handling and mediation (P2B Arts. 11–12).** Komashi accepts complaints from Providers free of charge under Section 16 of Module 0 and will handle them individually, diligently, and within a reasonable time. For as long as Komashi qualifies as a small enterprise within the meaning of the Annex to Recommendation 2003/361/EC, Articles 11 and 12 of the P2B Regulation (internal complaint-handling system and designated mediation) do not apply to Komashi as of right; **if and when Komashi ceases to so qualify**, Komashi will operate the internal complaint-handling system required by Article 11 and **will identify in these Terms two or more mediators** with which it is willing to engage under Article 12, **before those Articles become applicable to it**. Nothing in this Section prevents a Provider from raising a complaint under Section 16 of Module 0 in the meantime, or from pursuing any remedy available to it under the Terms or applicable law. 5.3. **Reactivation.** A blocked Account is reactivated once all outstanding Fees are settled, together with any reactivation fee set out in **Schedule 1**. Komashi may introduce or change a reactivation fee only by amending Schedule 1 in accordance with Section 4.6 (advance notice and grace period), and any such fee will be set by reference to the **administrative cost** of restoring a blocked Account. 5.4. **Effect of blocking.** Blocking under this Section is a suspension under Section 12.2 of Module 0. While the Account is blocked, **all Platform services for the Provider are switched off until the Account is reactivated, and the Provider's Provider Services are treated as expired towards End Users**, and throughout that period **the Provider remains solely responsible for everything relating to its Provider Services and End Users**; Komashi does not process, manage, or handle any invoices, the Payment Provider relationship, or any other aspect of the Provider's operations during the block. To the maximum extent permitted by applicable law, Komashi is not liable for any loss (including loss of business or End User claims) resulting from blocking carried out in accordance with this Section. Your payment obligations continue to accrue for Services provided prior to blocking. 5.5. **Persistent non-payment.** If outstanding amounts remain unpaid 30 days after blocking, Komashi may terminate the Provider Agreement for material breach under Section 12.3 of Module 0. This period replaces, and is more generous than, the cure period in Section 12.3(a) of Module 0 for non-payment breaches. ## 6. Your Responsibilities as Provider > **In short:** Your services, your rules, your responsibility. You alone are responsible for what you sell, for its legality, for your taxes, and for treating your customers in line with consumer law — including refunds and cancellations under your own policy. *Non-binding summary.* 6.1. **Provider Services.** You are solely responsible for your Provider Services, including their quality, safety, legality, description, pricing, performance, and delivery, and for all representations you make to End Users. 6.2. **Legal compliance.** You shall comply with all laws applicable to your business and your Provider Services, including licensing and registration requirements, sector-specific regulation, advertising and marketing law, sanctions and export rules, and anti-money-laundering obligations applicable to you. You shall not offer Provider Services through the Platform that require a license you do not hold. 6.3. **Consumer protection toward your customers.** Where your End Users are consumers, **you are solely responsible for compliance with the consumer protection laws applicable to them**, including mandatory information duties, language requirements, withdrawal and cancellation rights, guarantees, and complaint handling. **Refunds and cancellations of Provider Services are governed exclusively by your own published policy and applicable law, and are solely your responsibility.** Komashi has no obligation to provide, fund, or administer refunds of amounts paid for Provider Services (see also Section 6.2 of Module 0 — Komashi never holds those funds). 6.4. **Taxes.** You are solely responsible for determining, invoicing, collecting, reporting, and remitting all taxes applicable to your Provider Services (including VAT/GST/sales tax) in every relevant jurisdiction. Komashi does not provide tax advice and does not act as your tax agent, even where the Platform provides invoicing functionality that you configure. 6.4a. **Correct configuration; time zone; VAT; invoicing.** You are solely responsible for correctly configuring your Account and the invoicing system, including your **time zone** (Section 2.4a of Module 0), your **invoicing currency** (Section 3.5 of the Currency Terms (Module F)), your tax and **VAT settings**, and your invoice templates, so that each invoice issued through the Platform is correct and shows the applicable VAT. All time-based calculations (including the billing month) are determined by the time zone you configure. If any invoice is issued incorrectly as a result of your configuration, **you must promptly notify Komashi and correct the configuration**, and the resulting liability — including toward End Users and tax authorities — is yours alone. 6.4b. **If you let property.** Where your Provider Services consist of, or include, the letting of immovable property, the following apply in addition to Sections 6.1 to 6.4a.     (a) **The tenancy is yours, and so is its wording.** **Komashi supplies no tenancy agreement template, no model clauses, no suggested wording, and no advice on the law governing any letting.** The Platform is invoicing, booking and payment software; it does not draft your tenancy. You are solely responsible for the terms you agree with your tenant and for their compliance with the law of the place where the property is.     (b) **That law is mandatory and local.** National tenancy law commonly regulates rent levels and increases, the deposit, notice periods, the form the agreement must take, and protection against eviction, and commonly cannot be excluded by agreement. Nothing in the Terms, and nothing the Platform does, displaces it.     (c) **Where the letting is for residential purposes**, the contract between you and your tenant falls **outside Directive 2011/83/EU** (Article 3(3)(f)), so its pre-contractual information duties and its 14-day withdrawal right do not apply to it (Section 6.3a of the End User Terms). **Directive 93/13/EEC on unfair terms still applies in full**, as does national tenancy law under paragraph (b). Komashi nevertheless applies the same marketplace labelling to these listings as to every other listing (Section 1.5b of the End User Terms); that is Komashi's choice, not a legal requirement, and it does not make Komashi responsible for the letting.     (d) **Registration and reporting schemes.** Where the property, the letting, or you are subject to a registration, licensing, or reporting scheme — including any short-term rental registration scheme — obtaining and maintaining that registration, and displaying any required registration number, is **your** responsibility. Section 6.9 applies to the tax information Komashi must collect from you. 6.5. **Your content and data.** You are responsible for the accuracy and lawfulness of all User Content you upload, including service descriptions, prices, images, and invoice data, and for having all rights necessary to grant the license in Section 7.4 of Module 0. **You alone are responsible for any content you upload, including any unsolicited, unlawful, or prohibited content**, which is subject to the Acceptable Use Policy (Module E); Komashi does not pre-screen User Content. 6.6. **Your End Users.** You shall ensure that your End Users' use of your Provider presence complies with the AUP, and you shall present the End User Terms (Module C) to your End Users where the Platform provides for this. 6.7. **Integrations you switch on.** The Platform lets you enable third-party integrations, including web analytics (such as Google Analytics or Microsoft Clarity) and AI features. Where you enable one:     (a) **you decide** that the integration runs on your Provider presence, and **you are the controller** of the personal data it collects there;     (b) **you are responsible for the legal basis**, including obtaining and recording valid consent from your visitors before any non-essential cookie or similar tracking technology is set, and for informing them in your own privacy notice which providers receive their data. **The Platform supports this**: an integration you enable does not run until the visitor has accepted cookies. You remain responsible for the content of your own privacy notice;     (c) you are responsible for the transfer position where that provider is established outside the EU/EEA; and     (d) **you must not enter into an AI feature any data you are not entitled to disclose to the AI provider**, including special-category personal data and anything covered by professional secrecy.     Komashi provides the technical integration point only, does not select these providers for you, and is not the controller of the processing you switch on under this Section. 6.8. **Your checkout, and the consumer's payment obligation (Directive 2011/83/EU, Art. 8).** Where you sell to consumers at a distance, that Directive requires the consumer to be made explicitly aware, when placing the order, that the order carries an obligation to pay, and requires any order button to be labelled **"order with obligation to pay"** or with a corresponding unambiguous formulation. **The sanction is severe and it falls on you: if this is not complied with, the consumer is not bound by the contract or the order.**     (a) **The obligation is yours.** You sell to the End User (Section 2), so the duty to comply is yours, together with the pre-contractual information duties of that Directive and of the law of the consumer's country.     (b) **The Platform supports it.** Where the Platform provides the checkout, Komashi labels the confirming action in accordance with that Article and shows the total price payable before it. Where you configure your own wording, button label, or checkout flow, **keeping it compliant is yours**, and you must not replace the label with a formulation that does not convey the payment obligation.     (c) **Same allocation as Section 6.7(b).** As with consent to cookies, Komashi builds the mechanism and you carry the legal duty; neither substitutes for the other. 6.9. **Tax information Komashi must collect and report (Council Directive (EU) 2021/514 — "DAC7").** Where Komashi is a reporting platform operator under that Directive as implemented in the Member State in which it registers, it must carry out due diligence on Providers and report annually. This Section is what makes that possible.     (a) **You must supply the information.** On request, you shall provide and keep up to date: **if you are an individual** — your first and last name, your primary address, your date of birth, any tax identification number issued to you together with each Member State that issued it (or, if you have none, your place of birth), and your VAT identification number where you have one; **if you are an entity** — your legal name, your primary address, any tax identification number and each Member State of issuance, your VAT identification number where you have one, your business registration number, and the existence and location of any permanent establishment in the Union through which you carry out the activity. Where you let immovable property, you shall in addition provide **the address of each property listed, the land-registration number or its equivalent where available, and the number of days each property was let** in the period.     (b) **Verification.** Komashi verifies the information against the records available to it and against any electronic interface made available free of charge by a Member State or the Union for validating a tax identification number or VAT number. You shall correct information Komashi identifies as unreliable.     (c) **If you do not supply it, Komashi must act, and has no discretion.** If you have not provided the information after **two reminders and at least sixty (60) days** from the initial request, Komashi is required by that Directive to **either close your Account and prevent you from registering again, or withhold payment of consideration to you**, until you provide it. Komashi will tell you which measure it applies and will lift it as soon as the information is provided. This is a legal obligation on Komashi, not an enforcement measure under the Acceptable Use Policy, and Section 4.3 of that Policy does not apply to it — but you may of course correct the position at any time by supplying the information.     (d) **Reporting.** Where you are a reportable seller, Komashi reports the information in paragraph (a), together with the consideration paid or credited to you and any fees, commissions or taxes withheld or charged by Komashi, to the competent authority of its Member State of registration, **by 31 January of the year following the calendar year concerned**. Komashi will make available to you the information reported about you.     (e) **Records.** Komashi retains the records of these steps for the period in **Section 9.2a(c) of the Privacy Policy**.     (f) **This does not make Komashi your tax agent.** Section 6.4 continues to apply: your own tax position, your invoicing, and your filings remain yours alone. Reporting under this Section is Komashi's own obligation to a tax authority and is not advice to you. ## 7. Data Protection; DPA > **In short:** For your customers' personal data, you are the controller and Komashi is your processor. The Data Processing Agreement (Module D(2)) governs this and is part of your contract. *Non-binding summary.* 7.1. In respect of personal data of End Users processed on the Platform in connection with your Provider Services, **you are the controller and Komashi is your processor**. The **Data Processing Agreement (Module D(2))** is incorporated into and forms part of the Provider Agreement. 7.2. You warrant that you have a valid legal basis for the processing of End User personal data you instruct through your use of the Platform, and that you provide End Users with all legally required privacy information. 7.3. Komashi processes personal data relating to you and your staff as a controller, as described in the Privacy Policy. 7.4. **Access to data (Regulation (EU) 2019/1150, Art. 9).** This Section describes the technical and contractual access to data that applies between you and Komashi.     (a) **Komashi's access.** Komashi has access to the data held in the Platform that is necessary to operate it: your account and business identification data, your service catalogue and pricing, your invoice, subscription and transaction records, your End User records, the files and images you upload, and technical data such as logs, error reports, API events and delivery statuses. Komashi accesses personal data of your End Users as your processor under the Data Processing Agreement (Module D(2)), and processes your own account data as controller as described in the Privacy Policy (Module D(1)). **Komashi does not handle card data: card numbers, security codes and other payment credentials are handled by the Payment Provider under its own terms, and Komashi holds only a reference to a stored payment method** (Section 5.1a; Section 6 of Module 0).     (b) **Your access.** You have access, through the Platform interface and the API, to the data relating to your own account and your own business, including the data generated in the course of providing the Services to you and to your End Users, and you may export it in a commonly used format. Under normal Provider permissions **you have no access to the data of any other Provider or of another Provider's End Users**. Access after termination is governed by Section 8.2.     (c) **Platform-level and aggregated data.** The Platform holds administrative and analytical data at platform level, including data derived from your use of it. **That platform-level data is accessible only to Komashi's operators**, and is not made available to you or to any other Provider, whether individually or in aggregate. Komashi may hold, at Provider and service level, view, subscription, revenue, active-customer and trend data.     (d) **Third parties.** Komashi discloses data to the following categories of recipient, in each case limited to what the relevant function requires. Komashi does not transmit all stored data to every recipient; each recipient receives only the data needed for the function you or Komashi have enabled.         (i) **Payment and invoicing providers** — the Provider, customer, invoice, subscription and transaction data needed for payment, invoicing and settlement, disclosed to the provider **you** have enabled. *You control this by choosing your provider.*         (ii) **Hosting, storage, logging and infrastructure providers** — uploaded files and images, technical logs, error reports, API events and operational data. *Necessary for the Platform to function; no opt-out.*         (iii) **Transactional email** — **sent from Komashi's own mail servers.** No third-party delivery provider receives your End Users' names, email addresses, or message content. Where you configure your own external messaging service, that service is yours and not Komashi's sub-processor. *Necessary for the Platform to function; no opt-out.*         (iv) **AI providers** — where an AI feature is enabled, the text submitted to that feature. This may include service names and descriptions, support questions, support-ticket content and other free text, which can contain End User personal data. A request or workflow may pass through an AI routing service and one or more model or inference providers, including multiple providers operating in parallel or in sequence. The authorized model families and provider pool, possible processing regions and transfer mechanisms are described in Annex 3 of the Data Processing Agreement. Providers in that pool do not all receive data: only those participating in the particular request or workflow do. Komashi uses contractual terms and available technical controls to prevent Controller Data from being used for a recipient's own purposes, including model training, unless the Controller has separately instructed or authorized that use. *Controlled by the configuration of the AI feature; see Section 6.7.*         (v) **Exchange-rate data provider** — only the rate data needed for the conversions under the Currency Terms (Module F). *Necessary for the Platform to function; no opt-out.*         (vi) **Web analytics providers you configure** — where **you** configure Google Analytics or Microsoft Clarity on your Provider presence and the visitor consents, those providers receive the usage, device and session data of visitors to your presence. *Entirely your choice; see Section 6.7.*         (vii) **Authentication and analytics providers Komashi engages** — where a user signs in using a third-party identity provider, that provider receives the sign-in request and returns the name, email address and account identifier; and Komashi operates web analytics on its own account for the Platform itself. These providers are Komashi's sub-processors, are listed in Annex 3 of the Data Processing Agreement, and are distinct from the analytics **you** configure under (vi). *Necessary for the sign-in method chosen by the user; analytics subject to consent where required.*     The recipients Komashi engages as its own sub-processors are listed at https://komashi.com/legal/subprocessors, and you may object to a new sub-processor under Section 4.2 of the Data Processing Agreement. Beyond the categories above, Komashi discloses data to third parties only where required by law. Komashi retains internal historical records (account, permission, subscription, invoice, payment, notification, audit, API and technical logs) for the periods set out in Section 9.2 of the Privacy Policy. ## 8. Term; Termination; Data Handling After Termination > **In short:** When your account ends, your data is soft-deleted first, your subdomain is held for 60 days, and API keys are revoked immediately. The exact retention periods are in the Privacy Policy. *Non-binding summary.* 8.1. **Term; your right to terminate.** The Provider Agreement runs for an indefinite term until terminated in accordance with its terms or Module 0. You may terminate at any time by notice through the Platform or to info@komashi.com.     (a) **Effect.** Termination takes effect **immediately** on receipt of your notice. From that moment you may not offer or sell new Provider Services, take new orders, or start new subscriptions through the Platform, and your public Provider presence is removed.     (b) **Run-off for existing subscriptions.** Subscriptions of your End Users that are already active when your notice takes effect **continue to run until the end of their current term, and are not renewed**. For the sole purpose of serving them, the Platform continues to issue the invoices falling due for those subscriptions, and **you remain responsible** for delivering the corresponding Provider Services and for all your obligations to those End Users under Section 6.     (c) **Fees during run-off.** Commission continues to accrue and remains payable on those invoices under Section 4, on the same terms as before termination, until the last subscription has ended.     (d) **After run-off.** When the last subscription has ended, Section 8.2 (soft delete) applies and the retention periods in Section 9.2 of the Privacy Policy begin to run. Accrued Fees remain payable in any event. 8.1a. **Withdrawal (Private Providers only).** If you are a Private Provider (Section 1.3b), you may **withdraw from the Provider Agreement within fourteen (14) days** of entering into it, without giving any reason and at no cost. To withdraw, tell Komashi by a clear statement through the Platform or to **info@komashi.com**; you may use the model withdrawal form at **https://komashi.com/legal/withdrawal-form**, but you are not required to. If you asked Komashi to begin providing the Services during that period and then withdraw, you pay a proportionate amount for what was actually provided up to the moment you told Komashi. Withdrawal does not affect Commission already accrued on invoices your End Users have paid, and does not affect your own obligations to those End Users. 8.2. **Soft delete.** On termination or deletion of your Account, your Account and User Content are first placed in a deactivated, non-public state ("**soft delete**") for the retention periods set out in **Section 9.2 of the Privacy Policy (Module D(1)), which govern**. **During soft delete you retain read-only access to your data (including your invoices and customer records) for reference and export, but you cannot actively use the Platform — you cannot sell, take new orders, or issue new invoices, and your public storefront and Provider presence are removed.** End Users retain their own copies of the invoices issued to them and their own subscription records (including when they subscribed). You may request export of your User Content in a commonly used format within the export window stated there. After the applicable retention period, User Content is permanently deleted or irreversibly anonymized on a scheduled basis. 8.2a. **What survives deletion, and why.** Two categories outlive Section 8.2, both defined in **Section 9.2a of the Privacy Policy**, and neither is available to you as a working copy of your business:     (a) **Records Komashi must keep for itself** — principally the invoices Komashi issued to you for its Fees, kept for the statutory accounting period; and     (b) **The invoices you issued through the Platform**, which are **your** accounting records and which Komashi holds for you as processor for the statutory record-keeping period applicable to you (Privacy Policy Section 9.2a(b)). **Export them within the window in Section 8.2** — after it closes you keep the statutory retention, but not day-to-day access, and Komashi is not obliged to reconstruct or re-open the Account so that you can retrieve them. Komashi will, on a documented request and where it is technically able to do so, provide a copy of a specific record it still holds under Section 9.2a.     Backups are not exempt from deletion but are not edited record-by-record: data disappears from backups as the rotation in Privacy Policy Section 9.2(c) expires. 8.3. **Subdomain.** Your subdomain is deactivated on termination and **retained (not reassigned) for sixty (60) days** after termination. During this period the subdomain does not resolve to your content but is not made available to any other Provider. After 60 days, Komashi may release or reassign it. 8.4. **API keys.** All API keys are revoked with effect from termination. 8.5. **Survival.** Sections 2.2, 2.4, 4 (accrued Fees), 5.4, 6, 9, and 10 of these Provider Terms survive termination, in addition to the provisions listed in Section 17 of Module 0. ## 9. Indemnification > **In short:** If your services, your content, or your breach of these terms gets Komashi sued or fined, you cover the costs. *Non-binding summary.* 9.1. You shall defend, indemnify, and hold harmless Komashi, its officers, directors, employees, and agents from and against any third-party claims, demands, proceedings, fines, penalties, damages, losses, and expenses (including reasonable legal fees) arising out of or relating to: (a) your Provider Services or any contract between you and an End User, including refund, cancellation, warranty, and consumer protection claims; (b) your breach of the Provider Agreement, including the AUP; (c) your violation of applicable law, including tax, licensing, and data protection law in your capacity as controller; or (d) your User Content, including alleged infringement of third-party rights. 9.2. Komashi will notify you promptly of any claim subject to indemnification, and reserves the right to assume, at your expense, the exclusive defense and control of any matter otherwise subject to indemnification by you, in which case you shall cooperate with Komashi's defense. ## 10. Liability > **In short:** The liability rules of the General Terms apply: Komashi's total liability to you is capped at the Fees you paid in the last 12 months, and indirect losses are excluded. *Non-binding summary.* 10.1. Komashi's liability under the Provider Agreement is limited as set out in **Section 10 of Module 0** (12-month Fee cap; exclusion of indirect and consequential damages; carve-out for willful misconduct and gross negligence), which applies in full to these Provider Terms. 10.2. Without limiting Section 10.1, Komashi has no liability for: (a) the acts or omissions of End Users or Payment Providers; (b) your inability to receive payments due to acts or omissions of a Payment Provider; or (c) loss of business during blocking or suspension carried out in accordance with the Provider Agreement. --- ## Schedule 1 — Fee Schedule The Fee Schedule (Commission rates, free allowance, loyalty qualifying period, and reactivation fee) **forms part of these Provider Terms** and is set out in a separate document, **"Module A — Schedule 1 (Fee Schedule)"** (`module-a-schedule-1-fees.md`), which refers to the rates and terms published at **https://komashi.com/pricing** and is available on request. That Schedule has its own version and effective date and may be amended in accordance with **Section 4 of Module 0** and **Section 4.6** of these Provider Terms (notice and grace period). The version of Schedule 1, and of the rates published on the pricing page, in force during a billing period governs that period. --- # Sub-processors > Annex 3 to the Data Processing Agreement — the list of Komashi sub-processors. Canonical: https://komashi.com/docs/legal/subprocessors/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Parent agreement.** This Annex **forms part of the Komashi Data Processing Agreement (Module D(2))** and is maintained separately from Annexes 1–2 (`module-d2-annexes.md`) so the sub-processor list can be re-issued on its own cadence. Capitalized terms not defined here have the meanings given in the DPA, Module 0, or the GDPR. **Annex 3 version:** v1.0 **Annex 3 effective date:** 2026-08-31 **Also published at:** https://komashi.com/legal/subprocessors **Maintenance / amendment.** This Annex is maintained under the **general authorization in DPA §4.1**. The authorization covers the named recipients, provider groups and downstream-provider pools below. Selection or switching within an already listed pool does not require separate notice. Komashi gives notice and a reasonable opportunity to object before engaging a recipient or provider category not already covered by this Annex, as set out in **DPA §4.2**. Each published change carries a new version number and effective date, and superseded versions are retained and available on request under **Section 4.5 of Module 0**. **SCC linkage.** This Annex is the agreed sub-processor list for the general-written-authorization option in SCC Clause 9(a). Where a particular transfer uses specific authorization and requires **SCC Annex III**, the relevant entries below supply the information for that annex. The EU Standard Contractual Clauses under **DPA §5.2a** are **operative**, not contingent: Sections B and C cover recipients that may be established in, owned from, or process data in third countries. A transfer impact assessment and an applicable transfer mechanism are required before Controller Data is routed to such a recipient. A recipient or provider category not already covered by this Annex is subject to the §4.2 notice-and-objection process before engagement. --- ## Annex 3 — Authorized Sub-processors *General authorization under DPA Section 4.1. Current list maintained at https://komashi.com/legal/subprocessors.* ### A. Infrastructure **There is no sub-processor in the infrastructure layer at all.** Komashi runs the Platform's application, database, storage and log indexing on **equipment it owns, at its own premises in the EU/EEA**. It rents no compute, hosting, database, or log-analytics service from any provider, and the equipment is not housed in a third-party data centre, so **no facility operator has physical access to the machines either**. Outbound transactional email is sent from **Komashi's own mail servers**, so no delivery provider receives recipient names or addresses. The practical consequences for the Controller are:     (a) **no third party holds any account over the Platform's database, logs, or mail** — logical or physical;     (b) the **logging layer**, usually the least-controlled place personal data ends up, does not leave Komashi's own systems; and     (c) the security assurance for this layer is **entirely Komashi's own**. There is no facility operator's certification to inherit and no hosting provider's audit report to point at, which is why **Annex 2** carries the physical-security commitments directly and why DPA Section 3.9(a) is drafted around a documented response rather than a certification. **This cuts both ways, and the Controller should read it that way**: the CLOUD Act and third-party-access exposure that a rented facility would carry does not arise, but nor is there an external auditor standing behind the physical controls. Annex 2 therefore states those controls directly — **including the one that is not in place**, so that the position can be assessed rather than assumed. The sub-processors in Section B are therefore **application-level services only** — invoicing, AI, sign-in and analytics, and payment-side verification. None of them holds Controller Data at rest on Komashi's behalf as a matter of infrastructure. ### B. Sub-processors *The "Controller Data" column states what actually leaves Komashi's own systems. Nothing beyond the categories listed reaches the recipient.* | # | Sub-processor (legal name) | Service | Controller Data received | Processing location | Owner / parent jurisdiction | Transfer mechanism | |---|---|---|---|---|---|---| | 1 | **Billingo Technologies Zrt.** (Hungary) | Issuance and delivery of invoices through the Platform | Billing name, address, tax identifier, email address, invoice line items and the other data required to issue the invoice | Hungary | EU | None — EU/EEA-located | | 2 | **KBOSS.hu Kft.** ("Számlázz.hu", Hungary) | Issuance and delivery of invoices through the Platform | Billing name, address, tax identifier, email address, invoice line items and the other data required to issue the invoice | Hungary | EU | None — EU/EEA-located | | 3 | **OpenRouter, Inc.**, its applicable affiliates, and the downstream model and inference providers in Section C | Routing and processing of requests where an AI feature is enabled. A request or workflow may use one or more downstream models and inference providers, including multiple providers in parallel or in sequence | Service names and descriptions, support questions, support-ticket content and other free text submitted to an AI feature; request and response content; model, routing, usage and security metadata. Free text may contain End User personal data | United States, EU/EEA, and other locations identified for the participating providers in Section C or the provider directory referenced there | United States | Varies by route; **SCCs, adequacy decision or another lawful mechanism**, as applicable (Section E) | | 4 | **Google Ireland Limited / Google LLC** | (i) Google Sign-In where a user chooses it; (ii) web analytics operated on Komashi's own account | (i) Name, email address, Google account identifier; (ii) IP address, device and browser data, usage and event data | Ireland; United States | United States | **SCCs** or an applicable adequacy decision (Section E) | | 5 | **Stripe Payments Europe, Limited / Stripe, Inc.** — *only to the extent Stripe acts as processor* | Provider onboarding and verification carried out on Komashi's instruction. **For the payment transaction itself Stripe is an independent controller — see Section D** | Name, email address, billing data and the personal data required for Provider verification / KYC | Ireland; United States | United States | **SCCs** or an applicable adequacy decision (Section E) | *Sections B and C together describe the authorized recipient set. A listed provider does not necessarily receive Controller Data: it receives data only if the relevant integration, model, route or fallback is selected. There is no hosting, data-centre or email-delivery entry because those functions are performed by Komashi on its own equipment (Section A).* ### C. Authorized AI model and inference provider pool Where an AI feature is enabled, Komashi may route a request through the routing service listed below to one or more model operators, cloud AI services or inference providers in the pool below. A feature or workflow is not limited to a single model: it may use multiple models or providers at the same time or in sequence, including for routing, classification, generation, verification, fallback or quality comparison. This may involve two or three providers in the same workflow, but no fixed number is promised or required. **Only providers that participate in the relevant request or workflow receive its data.** Other providers in the pool receive nothing merely because they are listed. The authorization covers the provider group and the affiliate, regional contracting entity, cloud platform or infrastructure operator through which that provider makes the relevant model or endpoint available. Depending on the route, the provider may process the Controller Data categories stated in Section B, row 3, in the EU/EEA, the United States, the United Kingdom, Canada, France, Singapore or another region disclosed for that endpoint, excluding the United Arab Emirates unless this Annex and DPA Section 5.2 are first amended. For a third-country route, Komashi applies the mechanism and assessment described in DPA Section 5.2a. #### Authorized model families The following model families, including their current, renamed, updated and successor versions made available through an authorized provider, may be used. Listing a family authorizes its use but does not mean that every model in it is active. | Model developer | Authorized model families | |---|---| | **OpenAI** | GPT models and related reasoning, multimodal, embedding, transcription and image models | | **Anthropic** | Claude models | | **Google** | Gemini models and related Google embedding or multimodal models | | **Mistral AI** | Mistral, Mixtral, Codestral and related models | | **Cohere** | Command, Embed, Rerank and related models | | **xAI** | Grok models | | **Meta** | Llama models and related Meta AI models | | **DeepSeek** | DeepSeek chat, reasoning, coding, Pro, Flash and related models | | **Alibaba Cloud** | Qwen models and related Alibaba Cloud AI models | | **NVIDIA** | Nemotron and related NVIDIA AI models | | **Other authorized developers in this Section** | Models identified under that developer or provider in the routing service's then-current model directory, provided the route satisfies the controls in DPA Section 5.2a | Komashi may also use automatic routing or equivalent routing logic to select one or several authorized models for a request or workflow. A change between versions within an authorized model family, or the addition of a successor version within that family, is not a new sub-processor addition. #### Authorized routing and inference providers | Authorized provider group or service | Role in the routing chain | |---|---| | **OpenRouter** | Routing service | | **OpenAI** | Model operator or API endpoint provider | | **Anthropic** | Model operator or API endpoint provider | | **Google AI / Google Cloud Vertex AI** | Model operator, cloud AI service or endpoint provider | | **Microsoft Azure AI** | Cloud AI service or endpoint provider | | **Amazon Web Services / Amazon Bedrock** | Cloud AI service or endpoint provider | | **Mistral AI** | Model operator or API endpoint provider | | **Cohere** | Model operator or API endpoint provider | | **xAI** | Model operator or API endpoint provider | | **Meta** | Model operator or first-party model endpoint provider | | **DeepSeek** | Model operator or API endpoint provider | | **Alibaba Cloud** | Cloud AI service or endpoint provider | | **NVIDIA** | Model or inference endpoint provider | | **Together AI** | Model hosting or inference provider | | **Fireworks AI** | Model hosting or inference provider | | **Groq** | Model hosting or inference provider | | **Cloudflare Workers AI** | Model hosting, network or inference provider | | **Baseten, DeepInfra, Nebius AI, Novita AI, Parasail, SambaNova, Venice and other named inference providers made available through the routing service** | Alternative capacity, hosting or inference endpoint for a selected model | The routing service's current [model directory](https://openrouter.ai/models), [provider directory](https://openrouter.ai/providers) and the policy attached to each participating endpoint further identify available models, providers, processing regions and data-handling characteristics. Komashi may use routing controls, provider allowlists, region controls, zero-retention settings and data-collection restrictions where appropriate for the feature. A model developer or provider outside the groups and services covered above is treated as a new provider category under DPA Section 4.2. ### D. Parties that are **not** sub-processors, and why Listing these is deliberate: a Controller's counsel will look for them, and each is excluded for a stated reason rather than by omission. | Party | Why it is not a sub-processor of Controller Data | |---|---| | **Barion Payment Zrt.** · **Mollie B.V.** · **Stripe** *(payment leg)* | Each acts as an **independent controller** for the payment data it processes, determining its own purposes and means under its own licence and regulatory obligations (Privacy Policy Section 5.1(c)). They are not engaged by Komashi to process Controller Data on its instructions, are not subject to the Section 4.2 objection right, and Komashi receives no End User funds, card numbers, or payment credentials (Provider Terms Section 4.1a). **Stripe additionally appears in Section B** for the separate onboarding and verification processing it carries out **on Komashi's instruction** — the two roles are distinct and are not interchangeable | | **Web analytics a Provider configures on its own account** | Where the **Provider** switches on Google Analytics or Microsoft Clarity for its own presence, on its own account and under its own legal basis and consent collection (Provider Terms Section 6.7), that processing is the Provider's, not Komashi's. **This is separate from the analytics Komashi operates on its own account, which is in Section B, row 4(ii)** | | **Exchange-rate data source** | Provides reference rates only. No personal data is transmitted to it (Module F Section 4.2) | ### E. Third-country transfers Some recipients in Sections B and C are established in, owned from, or may process data in a third country. Where Controller Data is routed to such a recipient, the transfer is made under the **EU Standard Contractual Clauses**, an applicable adequacy decision or another lawful mechanism stated for the route, on the terms set out in **DPA Section 5.2a**, and is covered by the transfer impact assessment required by **DPA Section 5.2a(b)**.     (a) **Why the SCCs and not an adequacy decision.** Some of these recipients are, or may become, certified under the **EU–US Data Privacy Framework**. Komashi nevertheless relies on the **SCCs as the primary mechanism** for every US transfer. The reason is resilience rather than caution: an adequacy decision can be annulled or suspended, and a package that depended on one would lose its transfer basis overnight. Where a recipient is DPF-certified, that certification operates as an **additional** safeguard, not as the basis relied on.     (b) **Data minimisation as a supplementary measure.** The "Controller Data received" column in Section B is a **limit**. Only the categories stated there may leave the EU/EEA, and only where the relevant integration, model, route or fallback is used.     (c) **Adding a sub-processor.** A recipient or provider category not already covered by Sections B and C requires the transfer impact assessment in **DPA Section 5.2a(b)** where applicable and the notice-and-objection process in **DPA Section 4.2** before the addition takes effect. Selection or switching within the authorized pool does not require a separate notice.     (d) **Onward transfer in the AI routing chain.** The routing service may pass a request to one or more providers in the authorized pool in Section C, and those providers may use identified cloud or inference endpoints to process it. Komashi may change or combine models, providers, regions and fallbacks within that pool without separate notice. Each provider participating in the workflow may receive the Controller Data needed for its assigned processing step. Komashi uses the contractual terms and technical controls reasonably available for the participating routes to limit retention and prevent use of Controller Data for a recipient's own purposes, including model training, unless the Controller has separately instructed or authorized that use. Retention and routing characteristics may vary by endpoint and are assessed for the participating routes.     (e) **No UAE transfer.** No Controller Data is transferred to, stored in, or accessible from the United Arab Emirates, notwithstanding Komashi's registration there (DPA Section 5.2). --- # General Terms of Service > Komashi General Terms of Service (Module 0) — the common core that applies to everyone using the Platform. Canonical: https://komashi.com/docs/legal/terms/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: **Module 0 — General Terms (Common Core)** **Version:** v1.0 · **Effective date:** 2026-08-31 These General Terms apply to every person and entity that uses the Komashi Platform in any role — as a Provider or an End User. Role-specific terms (Modules A and C) incorporate these General Terms and apply in addition to them. --- ## 1. Who We Are; About These Terms > **In short:** Komashi is operated by BMSHI TECHNOLOGY SERVICES - FZCO, a Dubai free-zone company. These are the basic rules that apply to everyone who uses the Platform, in any role. *This summary is provided for convenience only and is not legally binding; the numbered terms below govern.* 1.1. The Komashi platform (the "**Platform**") is owned and operated by **BMSHI TECHNOLOGY SERVICES - FZCO**, a free zone company (FZCO) incorporated in the United Arab Emirates, registered in the IFZA free zone (Dubai Silicon Oasis) and licensed by the Dubai Integrated Economic Zones Authority, with license number **76747**, having its registered address at **Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates** ("**Komashi**", "**we**", "**us**" or "**our**"). You may contact us by email at **info@komashi.com** or by telephone at **+971 58 600 8455**. 1.2. These General Terms of Service (the "**General Terms**"), together with the Role Terms applicable to you (Section 3.2), the Currency Terms (Module F), the Acceptable Use Policy, the Privacy Policy and, for Providers, the Data Processing Agreement, form the agreement between you and Komashi governing your access to and use of the Platform (collectively, the "**Terms**"). 1.3. Komashi's licensed activities are the provision of software and information-technology services (including Computer Systems & Communication Equipment Software Design and Information Technology Network Services). Komashi does not carry on, and nothing in these Terms shall be construed as Komashi carrying on, any regulated activity, including without limitation payment services, money transmission, or the holding of client money (see Section 6). ## 2. Definitions > **In short:** These are the capitalized words we use throughout all Komashi terms, and what they mean. *Non-binding summary.* In the Terms, unless the context requires otherwise: 2.1. "**Account**" means the account registered with Komashi that enables a person to access the Platform in a given role. 2.2. "**Acceptable Use Policy**" or "**AUP**" means Komashi's Acceptable Use Policy (Module E), as amended from time to time. 2.2a. "**Currency Terms**" means Komashi's Currency and Exchange-Rate Terms (Module F), including the Supported Currencies List (Schedule 1 to that Module), as amended from time to time. The Currency Terms govern the currencies in which Providers may invoice, the conversion of amounts for the purpose of calculating Fees, and the currency in which Komashi invoices and pays. 2.3. "**End User**" means a customer of a Provider who uses, books, purchases or accesses Provider Services through the Platform. The End User's contract for Provider Services is with the Provider alone, not with Komashi. 2.4. "**Fees**" means the amounts payable to Komashi for the use of the Platform, as set out in the applicable Role Terms. Fees do not include any amounts payable by an End User to a Provider for Provider Services. 2.4a. "**Local time**" means, in relation to a Provider, **the time zone that Provider has configured in its Account settings**. Where no time zone has been configured, Local time means **UTC**. Billing months, cut-off times, and other time-based calculations under the Terms are determined by reference to the relevant Provider's Local time. 2.5. [Reserved.] 2.6. "**Payment Provider**" means an independent third-party payment service provider, licensed to provide payment services, through which End Users pay Providers for Provider Services. Komashi is not a Payment Provider and is not a party to any payment transaction (Section 6). 2.7. "**Platform**" means the Komashi software, websites, subdomains, applications, APIs, and related technical services operated by Komashi. 2.8. "**Provider**" means a business that uses the Platform under the Provider Terms (Module A) to offer and sell its own services to its own customers. 2.9. "**Provider Services**" means the services that a Provider offers or sells to End Users. Provider Services are provided by the Provider alone; Komashi does not provide, resell, or assume any responsibility for Provider Services. 2.10. "**Role Terms**" means the terms applicable to a specific role on the Platform: the Provider Terms (Module A) and the End User Terms (Module C). 2.11. "**Services**" means the technical platform services provided by Komashi under the Terms, consisting of access to and use of the Platform. For the avoidance of doubt, Services do not include Provider Services or payment services. 2.12. "**you**" or "**your**" means the person or entity using the Platform, in whatever role. ## 3. Acceptance of the Terms > **In short:** By creating an account or using Komashi, you agree to these General Terms plus the terms for your specific role (Provider or End User). *Non-binding summary.* 3.1. By creating an Account, clicking to accept, or accessing or using the Platform, you accept and agree to be bound by the Terms. If you do not agree, you must not use the Platform. 3.2. In addition to these General Terms, you are bound by the Role Terms for each role in which you use the Platform. If there is a conflict between these General Terms and the applicable Role Terms, the Role Terms prevail for that role, except that Sections 6 (Komashi's Role; Payments), 10 (Limitation of Liability), 14 (Consumers) and 15 (Language) of these General Terms prevail in all cases — **provided that** a Role Term prevails over Section 10 to the extent it grants you greater protection or a higher liability cap than Section 10 would give. On currency and exchange-rate matters, the Currency Terms (Module F) prevail over the Role Terms and their Schedules, subject to the same exceptions. 3.3. If you accept the Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity, and "you" refers to that entity. 3.4. You must be at least 18 years of age (or the age of majority in your jurisdiction, if higher) to use the Platform. 3.5. **How the contract is concluded (Directive 2000/31/EC, Arts. 10 and 11).** The contract between you and Komashi is concluded by electronic means, and the following applies to that process.     (a) **The technical steps.** You open the registration page, enter the details requested, choose the role in which you will use the Platform, are shown these Terms and the Privacy Policy, and confirm by an affirmative act that you accept them. No box is pre-ticked. The contract is concluded when Komashi creates your Account, and not before.     (b) **Correcting mistakes before you commit.** Before you confirm, the details you have entered remain visible and editable, so that you can identify and correct any input error. After registration you can correct your Account details at any time in your Account settings.     (c) **Confirmation.** Komashi confirms the conclusion of the contract without undue delay by electronic means, to the email address associated with your Account.     (d) **Whether the contract is filed.** **Komashi does not file the concluded contract as a separate document, and it is not retrievable as such.** What Komashi records is which version of the Terms you accepted and when. The Terms themselves are published at https://komashi.com/legal/terms in a form you can store and reproduce, superseded versions are available under Section 4.5, and Komashi will on request confirm the version and date you accepted.     (e) **Languages.** The Platform interface may be available in more than one language, but **the contract can be concluded in English only**. Komashi intends to make Arabic available as a contracting language for consumers in the United Arab Emirates; until it does, Section 15 governs.     (f) **Codes of conduct.** Komashi does not subscribe to any code of conduct within the meaning of Article 10(2) of that Directive. 3.6. **No discrimination by nationality or residence.** Komashi does not apply different general conditions of access to the Platform on grounds of your nationality, place of residence, or place of establishment, except where a difference is objectively justified or required by law (including the sanctions and payment-rail limitations described in Section 6.7 of the Currency Terms (Module F)). 3.7. **Marketing consent is a separate decision.** Accepting these Terms is not consent to receive marketing communications from Komashi, and the two are not asked for as a single act. Where Komashi asks for your consent to send you marketing communications, that request is presented separately from these Terms and from any other matter, in an intelligible and easily accessible form, and the following apply.     (a) **It is voluntary.** Giving that consent is not a condition of registering an Account, of concluding the contract under Section 3.5, or of using any part of the Platform. Komashi does not withhold, limit, or price any Service differently because you have not given it, or because you have withdrawn it.     (b) **You can withdraw it at any time, and withdrawing is as easy as giving it.** Withdrawal takes effect for the future: it does not affect the lawfulness of processing carried out on the basis of your consent before you withdrew it, and it has no effect on the Services provided to you.     (c) **Where your rights are set out.** Section 7.1 of the Privacy Policy (Module D(1)) lists withdrawal of consent and objection to direct marketing among your rights, and Section 7.2 of that Policy states how to exercise them.     (d) **This Section is not a statement that Komashi sends marketing.** It fixes the conditions that apply if and when it does. This Section reflects Article 7(2), (3) and (4) of Regulation (EU) 2016/679. ## 4. Changes to the Terms > **In short:** We may update these Terms as the Platform, the law, security risks, and the services we rely on change. We give advance notice where required, but urgent protective changes may take effect immediately. *Non-binding summary.* 4.1. Komashi may amend the Terms from time to time where reasonably necessary for the Platform or the Services. Reasons may include changes in applicable law, regulatory guidance or authority requirements; court or regulator decisions; changes to features, technology, operations, commercial arrangements or the way the Platform is supplied; security, fraud-prevention, abuse-prevention or service-continuity needs; changes in the availability, terms, cost or functionality of a third-party service; and the correction of an error, inconsistency or ambiguity. This list is illustrative and not exhaustive. 4.2. If we make a material change, we will give advance notice by email to the address associated with your Account, by notice on the Platform, or both. The notice period will be reasonable and proportionate in the circumstances and will not be shorter than any minimum period required by applicable law. A longer period may be used where a change requires significant technical or commercial adaptation. Non-material changes, including editorial corrections and changes that do not adversely affect your rights, may take effect on publication. 4.2a. **Immediate changes.** Notwithstanding Section 4.2, Komashi may make a change with immediate effect where advance notice is not required by applicable law or is not reasonably practicable. This includes a change that is exclusively to your benefit; is required by law or by a competent authority; responds to an actual, suspected, unforeseen or imminent security vulnerability, incident or threat; protects the Platform, users or third parties from fraud, malware, spam, abuse, data breaches or other cybersecurity risks; or is needed to maintain, restore or continue the Services or to respond to an urgent change, failure or withdrawal of a third-party service. Komashi will provide notice as soon as reasonably practicable where notice is legally required. 4.3. If you do not agree to an amended version of the Terms, you may terminate your use of the Platform and close your Account, free of charge, at any time before the amendment takes effect. **If you are a consumer,** Komashi will tell you in the notice under Section 4.2 what is changing, when it takes effect, and that you may close your Account free of charge before then; your continued use of the Platform after that date constitutes acceptance of the amended Terms. If you are not a consumer, continued use after the effective date constitutes acceptance. 4.4. Nothing in this Section 4 permits Komashi to make amendments that deprive a consumer of mandatory rights under applicable law (see Section 14). 4.5. **Previous versions.** The version of the Terms in force at any time is published on the Platform. **Superseded versions are retained and are available on request at info@komashi.com**, together with the dates between which each was in force. Where a Schedule or Annex carries its own version and effective date, the same applies to it. ## 5. Account; Passwordless Login > **In short:** You sign in without a password, using secure login links or codes. Keep your email account and devices safe — anyone with access to them can access your Komashi account. *Non-binding summary.* 5.1. Access to the Platform requires an Account. You agree to provide accurate, current and complete registration information and to keep it updated. 5.2. The Platform uses passwordless authentication (such as one-time login links or codes sent to your registered email address or other verified channel). You acknowledge that anyone with access to your registered email account or verified device may be able to access your Account, and you are responsible for maintaining the security of that email account and those devices. 5.3. You are responsible for all activity that occurs under your Account, except to the extent caused by Komashi's breach of the Terms. You must notify us promptly at info@komashi.com if you suspect unauthorized access to your Account. 5.4. You may not sell, transfer or share your Account except as expressly permitted by the applicable Role Terms. ## 6. Komashi's Role; No Involvement in Payments > **In short:** Komashi is only the technical platform. When an End User pays a Provider, the money goes directly from the End User, through an independent licensed Payment Provider, to the Provider. Komashi never touches, holds, or controls that money and is not a party to the contract between Provider and End User. *Non-binding summary.* 6.1. **Technical platform only.** Komashi provides a technical software platform that enables Providers to offer and manage their own services and enables End Users to access those services. The contract for Provider Services is concluded exclusively between the Provider and the End User. **Komashi is not a party to that contract** and does not act as agent, representative, broker, or intermediary of either party in respect of Provider Services. 6.2. **NO INVOLVEMENT IN THE MONEY FLOW.** ALL PAYMENTS FOR PROVIDER SERVICES FLOW DIRECTLY FROM THE END USER, VIA THE PAYMENT PROVIDER, TO THE PROVIDER. **KOMASHI IS NOT PART OF THE MONEY FLOW.** KOMASHI IS NOT A MERCHANT OF RECORD, NOT A PAYMENT SERVICE PROVIDER, NOT A MONEY TRANSMITTER, AND DOES NOT AT ANY TIME HOLD, RECEIVE, CONTROL, OR TRANSMIT END USER FUNDS. KOMASHI DOES NOT PROVIDE ANY REGULATED PAYMENT, BANKING, OR FINANCIAL SERVICE. 6.3. **Payment Provider.** Payment processing is performed by one or more independent Payment Providers under their own terms and their own regulatory licenses. Your relationship with the Payment Provider is governed by the Payment Provider's terms. Komashi is not responsible for the acts or omissions of any Payment Provider. 6.4. **Fees distinguished.** The only amounts payable to Komashi are the Fees for the use of the Platform under the applicable Role Terms. Fees are invoiced and collected by Komashi separately and are unrelated to, and do not pass through, the End User payment flow described in Section 6.2. 6.5. **No endorsement.** Komashi does not vet, endorse, or guarantee any Provider, End User, or Provider Service, and makes no representation as to their quality, legality, safety, or fitness for purpose. 6.6. **Currency.** The currencies in which Providers may invoice, the conversion of amounts for the purpose of calculating Fees, and the currency in which Komashi invoices and pays are governed by the **Currency Terms (Module F)**. Consistent with Section 1.3 and with this Section 6, Komashi provides no currency-exchange, remittance, or hedging service: where money actually changes currency, that conversion is performed by a bank, card issuer, or Payment Provider under its own terms and its own licence, never by Komashi (Module F Section 1.3). 6.7. **AI features; when you are dealing with an AI system.** Parts of the Platform use artificial-intelligence systems, including an assistant that replies to messages sent through the Platform's support channels.     (a) **You are told when you are talking to one.** Where you interact directly with such a system, you are informed that you are interacting with an AI system and not with a person. That information is given in a clear and distinguishable manner, at the latest at the time of your first interaction with the system. Article 50(1) and (5) of Regulation (EU) 2024/1689 (the AI Act) require this, and have applied since 2 August 2026.     (b) **No AI decides anything about your Account.** Enforcement measures under the Acceptable Use Policy are taken by a human reviewer on report; the Platform applies no automated content moderation, filtering, classification, or risk scoring (Module E Section 1.3), and does not rank or compare Providers. The single fully automated decision the Platform makes — blocking a Provider Account for unpaid Fees — is described, with its safeguards, in Section 7.1a of the Privacy Policy.     (c) **What happens to what you type into an AI feature.** Section 7.4(d) of the Provider Terms (Module A) and Annex 3 to the Data Processing Agreement govern the processing of content sent to an AI feature, including the position on training. ## 7. Intellectual Property > **In short:** Komashi owns the Platform and its software. You own your own content and data — we only get the limited rights we need to run the service for you. We don't own your content. *Non-binding summary.* 7.1. **Komashi property.** The Platform, including all software, source code, databases, designs, interfaces, documentation, trademarks, logos, and all related intellectual property rights, is and remains the exclusive property of Komashi and its licensors. Except for the limited right to use the Platform in accordance with the Terms, no right, title or interest in the Platform is transferred to you. 7.2. **Restrictions.** You may not copy, modify, adapt, translate, reverse engineer, decompile, disassemble, or create derivative works of the Platform, except to the extent such restriction is prohibited by mandatory applicable law; nor may you remove or alter any proprietary notices. 7.3. **Your content.** All data, content, and materials that you upload to or generate on the Platform ("**User Content**") remain your property (or that of your licensors). Komashi does not claim ownership of User Content. 7.4. **License to Komashi.** You grant Komashi a non-exclusive, worldwide, royalty-free license to host, store, reproduce, process, transmit, display, and create technical adaptations of your User Content **solely to the extent necessary** to operate, secure, maintain, and improve the Platform and to provide the Services, and to comply with law. This license terminates when the User Content is deleted from the Platform, subject to the retention periods stated in the applicable Role Terms and Privacy Policy. 7.5. **Feedback.** If you provide suggestions or feedback about the Platform, Komashi may use them without restriction or obligation to you. ## 8. Acceptable Use > **In short:** Don't use Komashi for anything illegal or abusive. The full rules are in our Acceptable Use Policy, which is part of these Terms. *Non-binding summary.* 8.1. Your use of the Platform is subject to the **Acceptable Use Policy (Module E)**, which is incorporated into and forms part of the Terms. 8.2. Violation of the AUP may lead to the enforcement measures described in the AUP and in Section 12, up to suspension or termination of your Account. ## 9. Service Provided "As Is"; No Warranties > **In short:** We work hard to keep Komashi running well, but we provide it "as is" — we can't promise it will always be available or error-free. *Non-binding summary.* 9.1. THE PLATFORM AND SERVICES ARE PROVIDED **"AS IS" AND "AS AVAILABLE"**, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, UNINTERRUPTED OR ERROR-FREE OPERATION, OR THAT DEFECTS WILL BE CORRECTED, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. 9.2. Komashi does not warrant any particular level of availability or uptime. Any service level commitments, if offered, will be set out in a separate written agreement or module and apply only as stated there. 9.3. Descriptions of features, integrations, APIs, endpoints, MCP tools, models, providers and technical capabilities are illustrative unless expressly stated otherwise in a separate written commitment. Their names, number, scope, availability, limits, schemas and operation may change, and Komashi may add, modify, replace, restrict or withdraw them as the Platform develops or as third-party services change. Runtime discovery, the Platform interface and the then-current technical documentation describe what is available at a given time. Nothing in this Section limits any notice or remedy that cannot lawfully be excluded. 9.4. Nothing in this Section 9 limits or excludes warranties or rights that cannot be limited or excluded under mandatory applicable law, including mandatory consumer rights (Section 14). **In particular, this Section 9 does not apply to a consumer in the EU/EEA in respect of the Platform itself:** the conformity obligations and remedies that Directive (EU) 2019/770 gives that consumer are set out in Section 7 of the End User Terms (Module C) and prevail over this Section. ## 10. Limitation of Liability > **In short:** Our financial responsibility to you is capped at what you paid Komashi in the last 12 months, and we're not liable for indirect losses like lost profits. **If you are a consumer, that cap is never lower than EUR 500 — even if you have paid us nothing.** No cap applies at all to death or personal injury caused by our negligence, to our willful misconduct or gross negligence, or to fraud, and none of this removes rights that consumer law guarantees you. *Non-binding summary.* 10.1. **TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, KOMASHI'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THE TERMS, THE PLATFORM OR THE SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), BREACH OF STATUTORY DUTY OR OTHERWISE, SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY YOU TO KOMASHI IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE LIABILITY.** 10.2. **TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, KOMASHI SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, DATA OR ANTICIPATED SAVINGS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.** 10.3. **Carve-out.** Nothing in the Terms excludes or limits Komashi's liability for **death or personal injury caused by Komashi's negligence**, for its own willful misconduct or gross negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited under mandatory applicable law. 10.4. **Provider Services.** Without limiting Section 6, Komashi has no liability whatsoever for Provider Services, for the conduct of any Provider or End User, or for any payment transaction between an End User and a Provider processed by a Payment Provider. 10.5. **Consumers.** If you are a consumer, Sections 10.1 and 10.2 apply only to the extent permitted by the mandatory consumer protection laws of your country of residence (Section 14). 10.5a. **Consumer minimum cap.** If you are a consumer and the cap in Section 10.1 would otherwise amount to less than **EUR 500** (because you have paid no or minimal Fees to Komashi), Komashi's total aggregate liability to you under Section 10.1 shall instead be capped at **EUR 500** (or the equivalent in your currency, converted in accordance with Section 7.1 of the Currency Terms (Module F)). This Section grants consumers greater protection than Section 10.1 alone and does not limit Section 10.3 or any mandatory consumer right (Section 14). ## 11. Force Majeure > **In short:** Neither of us is responsible for failures caused by events outside our reasonable control, like natural disasters, war, or internet outages. *Non-binding summary.* 11.1. Neither party shall be liable for any failure or delay in performing its obligations under the Terms (other than payment obligations) to the extent caused by events beyond its reasonable control, including acts of God, natural disasters, epidemics, war, terrorism, civil unrest, governmental action, embargoes, labor disputes, power or telecommunications failures, or failures of third-party infrastructure ("**Force Majeure**"). 11.2. The affected party shall notify the other party without undue delay and use reasonable efforts to mitigate the effects. If a Force Majeure event continues for more than 60 days, either party may terminate the affected Services on written notice. ## 12. Suspension and Termination > **In short:** You can stop using Komashi at any time. We can suspend or close accounts that break the rules or the law, with notice where feasible. Some sections of these Terms continue to apply even after your account is closed. *Non-binding summary.* 12.1. **By you.** You may stop using the Platform and close your Account at any time, subject to any notice periods and accrued payment obligations in the applicable Role Terms. 12.2. **Suspension by Komashi.** Komashi may suspend or restrict your Account or your access to some or all of the Platform, with notice where reasonably practicable, if: (a) you materially breach the Terms, including the AUP; (b) required by law, court order or a competent authority; (c) suspension is reasonably necessary to protect the security or integrity of the Platform or other users; or (d) Fees due from you remain unpaid as set out in the applicable Role Terms. For Providers within the scope of Regulation (EU) 2019/1150, the additional protections in Module A Section 5.2a apply. 12.3. **Termination by Komashi.** Komashi may terminate the Terms and close your Account: (a) for material breach not cured within 14 days of notice (or immediately for breaches incapable of cure, including serious AUP violations); (b) with at least 30 days' prior notice if Komashi discontinues the Platform or the relevant Service; or (c) as otherwise permitted in the applicable Role Terms. 12.4. **No liability for lawful termination.** To the maximum extent permitted by applicable law, Komashi shall have no liability for damages resulting from suspension or termination carried out in accordance with the Terms. 12.5. **Effect.** On termination, your right to use the Platform ceases. Data retention and deletion following termination are governed by the applicable Role Terms and the Privacy Policy (Section 9.2 of which sets the governing retention periods). ## 13. Governing Law and Dispute Resolution > **In short:** These Terms are governed by UAE law. Business disputes go to DIAC arbitration in Dubai, in English. If you're a consumer, arbitration does NOT apply to you — you can always use the courts of your home country. *Non-binding summary.* 13.1. **Governing law.** The Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes) are governed by the federal laws of the United Arab Emirates as applicable in the Emirate of Dubai, without regard to conflict-of-laws rules. 13.2. **Arbitration.** Subject to Sections 13.2a, 13.3 and 14, any dispute arising out of or in connection with the Terms, including any question regarding their existence, validity or termination, shall be referred to and finally resolved by arbitration under the Arbitration Rules of the **Dubai International Arbitration Centre (DIAC)**, which Rules are deemed incorporated by reference into this clause. The **seat of arbitration shall be the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates**; the number of arbitrators shall be **one**; and the language of the arbitration shall be English. 13.2a. **Consumers.** Section 13.2 does not apply to any dispute with a consumer End User. A consumer may bring proceedings in the courts of the consumer's country of residence or the competent courts of Dubai, at the consumer's option, and Komashi may bring proceedings against a consumer only in the courts of the consumer's country of residence. Nothing in the Terms requires a consumer to arbitrate. 13.3. **Interim relief.** Nothing in this Section prevents either party from seeking urgent interim or injunctive relief from a court of competent jurisdiction. 13.4. **Consumers — mandatory protections.** If you are a consumer, this Section 13 applies only to the extent it does not deprive you of the protection of mandatory provisions of the law of your country of residence. ## 14. Consumers > **In short:** If you're a consumer, nothing in these Terms takes away rights that the law of your home country guarantees you. *Non-binding summary.* 14.1. **If you are a consumer, nothing in the Terms affects, limits or excludes the mandatory consumer rights you have under the laws of your country of residence**, and in case of conflict those mandatory rights prevail over the Terms. 14.2. Any provision of the Terms that would be void or unenforceable against a consumer under applicable consumer protection law (including UAE Federal Law No. 15 of 2020 on Consumer Protection) shall not apply to that consumer, without affecting the remainder of the Terms. ## 15. Language > **In short:** English is the official version of these Terms. Translations are provided for convenience, unless your local law requires otherwise. *Non-binding summary.* 15.1. The Terms are drafted in English, and the English version is the authoritative and governing version. Translations, if provided, are for convenience only and have no legal effect, **except** where mandatory applicable law gives priority to a version in another language (including, where applicable, an Arabic version for consumers under UAE law), in which case that version prevails to the extent required by such law. ## 16. Complaints > **In short:** If something goes wrong, contact us — we have a complaints process and will respond within a stated time. *Non-binding summary.* 16.1. You may submit complaints regarding the Platform or the Services **through the Komashi support system**, which is reachable from your Account and from the Platform's public pages, or by email to **info@komashi.com**. Both routes reach the same complaints process and are treated identically; you do not need an Account to use the email route. 16.2. Komashi will acknowledge complaints **without undue delay** and will provide a substantive response **within a reasonable period**, taking into account the nature and complexity of the complaint. This complaints mechanism is provided in accordance with UAE Federal Decree-Law No. 14 of 2023 and does not limit your right to pursue any other remedy available under the Terms or applicable law. 16.2a. **EU/EEA consumers — alternative dispute resolution.** If you are a consumer in the EU/EEA, you may refer a dispute to the consumer alternative dispute resolution (ADR) body having competence for it, and **Komashi will cooperate in those proceedings wherever mandatory law requires it to do so** — including, for consumers in Hungary, with the competent conciliation board (*békéltető testület*), before which a business carries a statutory duty of cooperation that applies whether or not it has submitted itself to the board's decision. **Komashi has not made a declaration submitting itself in advance to a binding decision of any ADR body**, and this Section does not create one; that is a separate question from the duty to cooperate. This statement is made for the purposes of Directive 2013/11/EU and the national laws implementing it, and it does **not** limit your right to complain to Komashi under Section 16.1, to approach a consumer protection authority, or to bring proceedings in the courts of your country of residence under Section 13.2a. 16.3. Complaints concerning Provider Services should be addressed to the relevant Provider, who is solely responsible for them; Komashi may, at its discretion, forward such complaints to the Provider but assumes no responsibility for their resolution. 16.4. **EU users — points of contact (Regulation (EU) 2022/2065, Arts. 11–12).** Where the Digital Services Act applies to Komashi: (a) Komashi's single point of contact for Member State authorities, the Commission and the European Board for Digital Services is **info@komashi.com**, and the language for communication is **English**; (b) Komashi's point of contact for recipients of the Service is **info@komashi.com**, which allows direct and rapid communication by electronic means and is **not operated solely by automated tools**; and (c) **Komashi has not yet designated a legal representative in the Union for the purposes of Article 13, and will designate one — publishing that representative's name and address here — before the Platform offers services in the Union.** This Section is separate from, and additional to, the representative designated under Article 27 of Regulation (EU) 2016/679 (Section 1.2 of the Privacy Policy): **they are two different appointments under two different instruments**, and neither substitutes for the other. ## 17. Survival > **In short:** Some sections naturally continue after your account closes — like payment obligations, IP ownership, liability limits, and how disputes are resolved. *Non-binding summary.* 17.1. Termination of the Terms or closure of your Account does not affect accrued rights and obligations. The following survive termination: accrued payment obligations (together with the Currency Terms (Module F) to the extent they govern the calculation, currency, and payment of those amounts); Section 6 (Komashi's Role; Payments); Section 7 (Intellectual Property); Section 9 (No Warranties); Section 10 (Limitation of Liability); Section 12.4 (No liability for lawful termination); Section 13 (Governing Law and Dispute Resolution); Section 14 (Consumers); Section 15 (Language); this Section 17; Section 18 (General); and any indemnification obligations under the applicable Role Terms. ## 18. General Provisions > **In short:** Standard legal housekeeping: if one clause fails, the rest stand; these Terms are the whole agreement; you can't transfer your account without permission; and here's how we send each other formal notices. *Non-binding summary.* 18.1. **Severability.** If any provision of the Terms is held invalid or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall remain in full force and effect. 18.2. **Entire agreement.** The Terms (including the applicable Role Terms, the AUP, the Privacy Policy and, where applicable, the DPA) constitute the entire agreement between you and Komashi regarding the Platform and supersede all prior agreements and understandings on that subject. Nothing in this clause excludes liability for fraud. 18.3. **Assignment.** You may not assign or transfer the Terms or your Account without Komashi's prior written consent. Komashi may assign the Terms to an affiliate or in connection with a merger, acquisition, or sale of assets, with notice to you. 18.4. **No waiver.** A failure or delay in exercising any right under the Terms is not a waiver of that right. 18.5. **Notices.** Komashi may give notices to you by email to your registered address or through the Platform; such notices are **presumed** received on the business day after sending, and you may show that a notice did not in fact reach you. You may give notices to Komashi by email to **info@komashi.com**, through the Komashi support system, or by post to the registered address in Section 1.1. **Where the Terms require you to give notice in writing, any of these routes satisfies that requirement.** 18.6. **No partnership.** Nothing in the Terms creates any partnership, joint venture, employment or agency relationship between you and Komashi, except as expressly stated. --- # Model Withdrawal Form > The model form for withdrawing from a contract with Komashi within the cooling-off period. Canonical: https://komashi.com/docs/legal/withdrawal-form/ Language: en :::note[Document status] Version **v1.0**, effective **2026-08-31**. The official language of the Terms is English; any translation is provided for convenience only. ::: *Complete and return this form only if you wish to withdraw from the contract.* **Published at:** https://komashi.com/legal/withdrawal-form **Version:** v1.0 · **Effective date:** 2026-08-31 --- **To:** BMSHI TECHNOLOGY SERVICES - FZCO ("Komashi") Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates Email: **info@komashi.com** --- I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the supply of the following service: **Service:** ______________________________________________ **Ordered on (*) / received on (*):** ______________________ **Name of consumer(s):** ___________________________________ **Address of consumer(s):** ________________________________ _________________________________________________________ **Signature of consumer(s)** *(only if this form is notified on paper)* _________________________________________________________ **Date:** ______________________ *(*) Delete as appropriate.* --- ## Notes — please read **1. You do not have to use this form.** You may withdraw by any clear statement — an email to **info@komashi.com** or a message through the Platform is enough. This form exists so that you have a ready-made option, not because it is required. **2. Who this form is for.** Under **Provider Terms Section 8.1a**, a **Private Provider** — a Provider who is not acting in the course of a trade, business, craft or profession — may withdraw from the Provider Agreement **within fourteen (14) days** of entering into it, without giving any reason and at no cost.     A **Business Provider** does not have this right; the position is set out in **Provider Terms Sections 1.3–1.3d**, and whether you are one or the other is a **question of fact**, not of what either of us calls it (Section 1.3c). **3. If you are an End User.** Your purchase is from the **Provider**, not from Komashi (**End User Terms Section 1.2**), so any withdrawal right in respect of that purchase is exercised **against that Provider** and on that Provider's terms — this form will not reach them. The Provider's identity and contact details are shown on its page and on your order confirmation. Your separate rights in respect of the Komashi Platform itself are in **End User Terms Section 7**. **4. Effect of withdrawal.** Komashi will acknowledge receipt without undue delay. Withdrawal ends the Provider Agreement; **it does not by itself end your obligations to your own End Users** for services already sold through the Platform (Provider Terms Section 8.1(b)). Data handling after termination follows **Privacy Policy Section 9.2**. **5. Timing.** The fourteen days run from the day the Provider Agreement was entered into. Sending your statement **before the period expires** is enough — it does not have to reach us before then. --- # Customers > This guide explains where and how you can view and manage your customers as a provider. Canonical: https://komashi.com/docs/provider/customers/ Language: en This guide explains where and how you can view and manage your customers as a provider. Video (English narration): [Customers](https://www.youtube.com/watch?v=6gblue_Xot8) --- ## Accessing Customers 1. Log in to the **Komashi Control Center**. 2. Select the **provider** whose customers you want to view. 3. From the left-side navigation, click **Customers**. Here you will see a list of **all customers** associated with the selected provider. --- ## Viewing Customer Details If you want to view a specific customer: 1. Select the customer from the list. You will then be able to see detailed information, including: - Basic customer data - Active and past subscriptions - Issued invoices - External or custom data associated with the customer This section gives you a complete overview of each customer’s activity and relationship with your provider. ## Customer sections Use the customer's **Details**, **Subscriptions**, **Invoices**, **External data**, and **Notifications** sections to inspect the corresponding records. These views are scoped to the selected customer; use the provider-wide Subscriptions and Invoices pages when you need to review everyone. For subscription changes, open the individual subscription from the customer's list. ## Delete or archive a customer A customer's **Details** section has a **Delete customer** button. The dialog warns that the action cannot be reversed, that active subscriptions end at the end of the billing period, and that invoices and history stay available. Komashi keeps the customer's subscriptions and invoices, so a deleted customer may be **archived** rather than removed. An archived customer still opens from the Customers area and from subscription and invoice links, but the page is read-only: it shows the notice *This customer is archived. Subscriptions and invoices remain accessible, but customer actions are disabled.* The new-subscription button, bulk subscription selection, and the other write actions are hidden or disabled. Deleting a customer on your side only affects your provider's record of them. It does not remove the customer's own Komashi account or billing profile. --- # Dashboard > The dashboard is the home screen of your provider Control Center. It shows how your business is doing over a period you choose. Canonical: https://komashi.com/docs/provider/dashboard/ Language: en The dashboard is the home screen of your provider Control Center. It shows how your business is doing over a period you choose. Video (English narration): [Dashboard](https://www.youtube.com/watch?v=0Gagsl_HgAM) ![Provider dashboard](https://komashi.com/docs/assets/images/komashi-dashboard-overview.jpg) ## Greeting and period At the top you see a greeting and a one-line summary, for example *Your customer retention looks solid with no upcoming expirations.* The period filter in the top-right corner (for example **Year to Date**) sets the range for every number and chart on the page. ## Overview Four key figures for the selected period, each with its change against the previous period: - **Total revenue** - **Total transactions** - **Total customers** - **Average order value** **Last updated** under the heading shows when the figures were last refreshed. ## Charts | Chart | What it shows | |---|---| | **Revenue trend** | Revenue over time, one line per service. | | **Payment methods** | How your revenue splits across payment methods. | | **Revenue composition** | What your revenue is made up of. | | **Subscriber growth** | **Active subscribers** and **New subscribers** over time. | | **Churn risk** | How many subscriptions are at risk of ending. | | **Transaction volume** | The number of transactions over time. | Hover the **?** icon next to a chart title for its definition. ## Sidebar cards Below the main menu, the left sidebar shows: - **Setup guide** — your setup steps and progress. See [Get started](https://komashi.com/docs/provider/get-started/get-started-with-komashi/index.md). - **Storefront** — a green dot when your storefront is live, and an icon that opens it in a new tab. - **Komashi subscription** — your current rank (for example **Starter**), your progress to the next rank, and **View details**. Ranks tie into the fees you pay — see [Komashi subscription](https://komashi.com/docs/provider/komashi-subscription/index.md) and the [pricing page](https://komashi.com/pricing). Related: [Subscriptions](https://komashi.com/docs/provider/subscriptions/index.md), [Customers](https://komashi.com/docs/provider/customers/index.md) ## Notifications and account activity Open the **bell icon** in the top bar to see notifications about your account and provider. Open a notification to follow its link to the affected item. The profile menu gives access to your notification settings and activity history. For team access and roles, see [Users and Permissions](https://komashi.com/docs/provider/Settings/06user-and-permissions/index.md). --- # REST API integration > Authenticate REST requests, discover your catalog, create subscription checkout flows, track usage and handle Komashi API responses. Canonical: https://komashi.com/docs/provider/Developers/api-integration/ Language: en Use the REST API to connect your backend to Komashi. The API supports catalog discovery, customer and contact management, subscriptions, checkout links, usage and invoice lookups. ## Find the endpoint and reference Open **Control Center → Integration → API**. The page displays **Documentation** and **API endpoint**. Copy the endpoint shown there; it already includes the version prefix. [![API Keys page showing the documentation link and API endpoint](https://komashi.com/docs/assets/images/integrations-api-keys.png)](/assets/images/integrations-api-keys.png) For the public service, the versioned endpoint is: ```text https://api.komashi.com/v1 ``` A local development environment can use a different host and path, such as `https://komashi-app.test/api/v1`. Use the value displayed in your environment instead of adding `/api` or `/v1` by guesswork. The **Documentation** link opens the interactive OpenAPI reference. Use it for each operation's exact request fields, response schema and validation rules. ## Authenticate a request Create a provider key under [Integration → API](https://komashi.com/docs/provider/Settings/10api/index.md). Send it in the `Authorization` header, and request JSON responses: ```bash export KOMASHI_API_BASE='https://api.komashi.com/v1' export KOMASHI_API_KEY='YOUR_PROVIDER_API_KEY' curl "$KOMASHI_API_BASE/services" \ -H "Authorization: Bearer $KOMASHI_API_KEY" \ -H 'Accept: application/json' ``` Use a backend environment variable or secret store for the real key. It identifies the provider, so ordinary provider-key requests do not need a separate provider ID header. The key must have the ability required by the operation. Read access is sufficient for this first request. Checkout creation requires **Create**; usage updates and subscription cancellation require **Update**. Do not infer the permission solely from the HTTP method. ## Read JSON responses Responses include these common fields: ```json { "succeeded": true, "status_code": 200, "data": [] } ``` `data` contains the result. Depending on the operation, it can be a resource, an array, a checkout result or `null`. Additional fields such as `message`, validation `errors`, `links` and `meta` can appear alongside the common fields. Endpoint-specific errors can also contain an `error` or `code` field; do not assume one universal error shape. A successful operation that internally produces `204 No Content` is returned as HTTP `200` with `data: null`. Check the HTTP status and the response fields rather than expecting a 204 for every deletion. ### Pagination Paginated list operations accept `page` and `per_page`. The default page size is 25, and the maximum is 100. Preserve pagination information such as `links` and `meta` when it is present. ```bash curl "$KOMASHI_API_BASE/customers?page=1&per_page=25" \ -H "Authorization: Bearer $KOMASHI_API_KEY" \ -H 'Accept: application/json' ``` ## Discover the catalog Paths below are relative to the versioned API endpoint. | Request | Purpose | | --- | --- | | `GET /services` | List services. | | `GET /services/{service}` | Get one service. | | `GET /services/{service}/plans` | List its plans. | | `GET /services/{service}/plans/{plan_id}/periods` | List a plan's periods. | | `GET /services/{service}/addons` | List add-ons. | | `GET /services/{service}/addons/{addon_id}/options` | List add-on options. | | `GET /services/{service}/service-prices/discounts` | Read available discounts. | Fetch the service, then its plans, periods, add-ons and options. Use identifiers from these results. Configure the catalog and coupon discounts in the Control Center; do not assume there are public REST write endpoints for every catalog item. ## Connect customers and subscriptions The API supports customer list, detail, create, update and delete operations under `/customers`, and contact operations under `/customers/{customer_id}/contacts`. Creating a customer requires billing details, including `billing_name`, `billing_address`, `billing_zip`, `billing_city` and `billing_country`. Depending on the country, a billing state is also required. Provider-defined required customer fields still apply. See the OpenAPI reference before assembling the request. To create a subscription checkout, send `POST /services/{service}/subscriptions`. The following is an illustrative request body; replace every identifier with a real value from your provider: ```json { "customer_id": "CUSTOMER_UUID", "plan_id": "PLAN_UUID", "period_id": "PERIOD_UUID", "quantity": 1, "external_reference": "your-internal-order-reference", "return_url": "https://your-app.example/subscription/return", "cancel_url": "https://your-app.example/subscription/cancel" } ``` Send JSON with `Content-Type: application/json`. The response's `data` includes `checkout_url`, `subscription_id`, `group_id` and the created subscription items. Direct the customer to `checkout_url` to continue the checkout. The return URL tells you where the browser returned; confirm the current subscription state before granting paid access. | Request | Purpose | | --- | --- | | `GET /services/{service}/subscriptions` | List subscriptions for a service. | | `GET /subscriptions/{subscription_id}` | Read one subscription. | | `GET /subscriptions/groups/{group_id}` | Read a subscription group. | | `POST /subscriptions/{subscription_id}/payment-link` | Generate an available payment link for an existing subscription. | | `POST /subscriptions/{subscription_id}/change-plan` | Request a plan change using the target configuration. | | `PATCH /subscriptions/{subscription_id}/dates` | Update supported lifecycle dates. | | `PATCH /subscriptions/{subscription_id}/status` | Update the status and optional renewal setting. | | `DELETE /subscriptions/{subscription_id}/cancel` | Cancel a subscription or a pending plan change. | | `GET /invoices` and `GET /invoices/{invoice_id}` | Read invoice records. | Cancellation follows the provider's cancellation settings. A group ID cannot replace the individual subscription ID required by these operations. Plan-change and payment-link operations have their own business-state requirements; inspect the reference and returned errors. ## Record usage Read `GET /subscriptions/{subscription_id}/usage` before relying on an allowance. Group usage is available through `GET /subscriptions/groups/{group_id}/usage`. For `POST /subscriptions/{subscription_id}/sync-usage`, send the **new absolute total**: ```json { "usage": 125 } ``` For `POST /subscriptions/{subscription_id}/adjust-usage`, send an increment or decrement: ```json { "action": "increase", "value": 1 } ``` Supported actions are `increase` and `decrease`; omitting `value` uses 1. Repeating an adjustment applies it again, so do not blindly retry a write after a network timeout. Read the current state first when the result is uncertain. ## Errors and rate limiting | Status | What to check | | --- | --- | | `401` | Missing, invalid or deleted key. | | `403` | Wrong token type or insufficient ability. | | `404` | Unknown record or a record outside the current provider. | | `409` | A business-state conflict, such as a draft or an incompatible pending operation. | | `422` | Invalid fields, unsupported values or a business validation failure. | | `429` | Request limit reached; wait and retry with backoff. | | `5xx` | Server-side failure; preserve enough context to investigate before repeating a write. | The configured REST limit is 100 requests per minute. Handle `429` responses even if you believe your own integration is below the limit. Related: [API keys](https://komashi.com/docs/provider/Settings/10api/index.md), [webhooks](https://komashi.com/docs/provider/Settings/11webhooks/index.md), [MCP integration](https://komashi.com/docs/provider/Developers/mcp-integration/index.md). --- # MCP integration > Connect an OAuth 2.1 MCP client to the general Komashi endpoint, select your provider and work with services, customers, subscriptions and usage. Canonical: https://komashi.com/docs/provider/Developers/mcp-integration/ Language: en Komashi's Model Context Protocol (MCP) server lets a compatible AI assistant discover tools and work with your connected businesses. It supports catalog discovery, provider and service setup workflows, customer and contact management, subscriptions, invoices and usage. ## General MCP endpoint Use the general Komashi MCP endpoint: ```text https://mcp.komashi.com/ ``` This guide uses that root endpoint throughout. For a private or local deployment, use its configured MCP host with the same root path. Do not derive the MCP URL from the REST API endpoint or add a versioned REST path. ## Authentication: OAuth 2.1 MCP authenticates **your user account through OAuth 2.1**, with the `mcp:use` scope. A provider REST API key from **Integration → API** is a different credential and is not the authentication method for this MCP connection. 1. Add a remote MCP server in a client that supports HTTP transport and OAuth. 2. Enter `https://mcp.komashi.com/` as its URL. 3. Start the client's connection or authorization flow. 4. Sign in to Komashi using the account whose providers you want to access. 5. Review the authorization request and approve the connection if the application is the one you intended to connect. 6. Return to the client and allow it to discover the available tools. The client manages the OAuth access and refresh tokens. Do not paste a provider API key into a configuration that expects OAuth authorization. Some clients express a remote server configuration like this: ```json { "mcpServers": { "komashi": { "type": "http", "url": "https://mcp.komashi.com/" } } } ``` The configuration shape varies by client. This example supplies the endpoint; authorization still takes place through the client's OAuth flow. A client that only accepts a static Bearer key is not sufficient for this setup. ## Select the business The connection can access providers linked to the signed-in account. If you have more than one provider: 1. Ask the assistant to list your accessible Komashi providers. 2. Choose the business you want to work with. 3. Have the assistant select that provider before performing provider-specific operations. The server can return `PROVIDER_SELECTION_REQUIRED` with provider choices. This is a normal request to choose context, not a broken connection. Selecting a provider never grants access to a business outside your account's active memberships. A single accessible provider can be selected automatically by the server. For custom client implementations, the selected provider can also be supplied through `X-Komashi-Provider`. Use a provider ID returned for the authorized account, not a display name or subdomain. ## What you can do | Area | Typical operations | | --- | --- | | Provider and service setup | Prepare setup drafts and open continuation links for browser review. | | Catalog | Read services, plans, billing periods, add-ons, options and discounts. | | Customers | List, create, read, update and delete customers and contacts; generate supported customer access links. | | Subscriptions | Read and create subscriptions, obtain available checkout/payment links, request plan changes, update supported dates and status, and cancel subscriptions or pending changes. | | Usage | Check subscription or group usage, set absolute consumption totals, or increase/decrease usage. | | Invoices | List and read invoice records. | | Legal drafts | Prepare the supported draft documents for review. | Available operations remain subject to your provider access, role, the tool's validation and the business state. Inspect the server's discovered tool schemas for required fields; do not assume every operation is read-only. Setup tools can prepare a draft and return a continuation link. Open the returned Komashi link to review and finish the setup; a generated draft or link does not by itself mean the final provider or service has been created. ### Example requests for your assistant - “List my Komashi businesses and let me choose one.” - “Show the selected business's services, plans and billing periods.” - “Find this customer's subscriptions and explain their current status.” - “Check the remaining usage for this subscription.” - “Prepare a new service draft and show me the summary before continuing.” For usage synchronization, supply an absolute total. Use the adjustment tool when the intent is to add or subtract consumption. Check the current state before repeating an action whose previous result is uncertain. ## Integration resources The general endpoint exposes these MCP resources: | URI | Content | | --- | --- | | `komashi://resources/openapi-docs` | The available OpenAPI document. | | `komashi://resources/integration-guide` | The integration workflow guide. | It also exposes the `guide-app-integration-prompt` workflow prompt. Resource and prompt support depends on your client; tool discovery is the starting point for clients that only surface tools. ## Manage and disconnect connections In Komashi, open your account **Settings → MCP**. **Active MCP connections** lists the connected application, client name, connection date, expiry where applicable, and destination hosts. Use **Disconnect** on the intended connection and confirm it. This revokes its access and refresh tokens. To reconnect, complete OAuth authorization again. Deleting a provider REST API key does not disconnect an account-level OAuth MCP connection. ## Troubleshooting | Symptom | What to do | | --- | --- | | `401` or repeated sign-in | Reconnect through the client's OAuth flow. Check that the URL is `https://mcp.komashi.com/`. | | Missing `mcp:use` scope / `403` | Reauthorize the client with MCP access and verify your provider membership and role. | | `PROVIDER_SELECTION_REQUIRED` | Choose one of the returned providers and retry the original task. | | Record not found / `404` | Check the selected provider and use an identifier returned from that provider. | | `409` or `422` | Inspect the tool's error and correct the conflicting state or fields. | | Connection succeeds but tools do not load | Verify HTTP remote MCP and OAuth support in the client. Do not configure the server as a local stdio command. | Related: [Developer overview](https://komashi.com/docs/provider/Developers/who-is-a-developer/index.md), [REST API integration](https://komashi.com/docs/provider/Developers/api-integration/index.md), [API keys](https://komashi.com/docs/provider/Settings/10api/index.md). --- # Developer overview > Choose REST API, MCP, widgets, webhooks or analytics, and build a Komashi integration using the correct authentication and provider context. Canonical: https://komashi.com/docs/provider/Developers/who-is-a-developer/ Language: en Connect Komashi to your application, website or AI assistant. You can use the integration methods together: for example, embed a subscription widget, receive subscription changes through webhooks, and read usage from the REST API. ## Choose an integration | You want to… | Use | Start here | | --- | --- | --- | | Read and manage customers, subscriptions, invoices and usage from your backend | REST API with a provider API key | [REST API integration](https://komashi.com/docs/provider/Developers/api-integration/index.md) | | Let an AI assistant work with your connected businesses | MCP with an OAuth 2.1 user connection | [MCP integration](https://komashi.com/docs/provider/Developers/mcp-integration/index.md) | | Add a ready-made service selection or subscription interface to your website | Embeddable widgets | [Embed widgets](https://komashi.com/docs/provider/Developers/widget-integration/index.md) | | Receive notifications when selected records change | Outgoing webhooks | [Webhooks](https://komashi.com/docs/provider/Settings/11webhooks/index.md) | | Measure visits and customer journeys | Google Analytics, Microsoft Clarity or PostHog | [Analytics & tracking](https://komashi.com/docs/provider/Settings/13analytics/index.md) | ## Use Komashi documentation through Context7 Komashi is also available in Context7. If your coding assistant has Context7 connected, add the relevant source to your task so it can retrieve Komashi documentation while helping you build an integration: - [Komashi documentation on Context7](https://context7.com/llmstxt/komashi_llms-full_txt) — guides covering setup, integrations and platform features. - [Komashi OpenAPI reference on Context7](https://context7.com/openapi/komashi_api-docs_spec) — REST API operations and request/response schemas. For example, give your assistant this instruction: ```text Use Context7 to read the Komashi documentation and OpenAPI reference: https://context7.com/llmstxt/komashi_llms-full_txt https://context7.com/openapi/komashi_api-docs_spec Use these sources to help me integrate Komashi into my application. Check the documented endpoints and required fields before writing code. ``` Context7 supplies documentation context. To read or change your account's actual data, connect through the [REST API](https://komashi.com/docs/provider/Developers/api-integration/index.md) or [MCP](https://komashi.com/docs/provider/Developers/mcp-integration/index.md) with the appropriate authentication. ## Where to configure integrations Open the provider's **Control Center**. The sidebar's **Integration** group contains **API**, **Webhooks**, **Widgets** and **Analytics**. [![Control Center with the Integration navigation and API Keys page](https://komashi.com/docs/assets/images/integrations-api-keys.png)](/assets/images/integrations-api-keys.png) The provider you have selected determines which keys, webhooks, widget examples and analytics settings you see. Switch to the correct business before configuring an integration. MCP is an account connection: open your account **Settings → MCP** to review active connections. It authenticates you as a user and lets you select one of your linked providers. It does not use the provider API keys shown on the API page. ## Understand the data model | Concept | What it represents | | --- | --- | | Provider | The business whose data you manage. | | Service | A product or service sold by that business. | | Plan | A package within a service. | | Period | The billing interval or fixed term associated with a plan. | | Add-on and option | An extra feature, variant or usage allowance. | | Customer and contact | The billing customer and its contact people. | | Subscription | An individual subscribed item with its own status and dates. | | Subscription group | Related subscription items created through the same checkout. A group ID and subscription ID are different identifiers. | | Usage | The consumption recorded against an individual subscription. | Discover IDs through API responses or MCP tools. Names, storefront slugs and identifiers are not interchangeable. ## Build your first integration 1. Configure the service, plans, billing periods and prices in Komashi. 2. Choose how the customer will interact with it: your own frontend, a widget or the Komashi storefront. 3. For a backend integration, create a separate [API key](https://komashi.com/docs/provider/Settings/10api/index.md) and make a read-only request first. For an AI assistant, complete the [MCP connection](https://komashi.com/docs/provider/Developers/mcp-integration/index.md) instead. 4. Read the existing catalog before creating customer or subscription records. Use the returned IDs. 5. For a payable subscription flow, send the customer to the returned checkout URL. Determine subscription access from Komashi's subscription state rather than a browser return URL alone. 6. Add webhooks for the events your system needs, and reconcile important records through the API. 7. Configure analytics if you need visitor measurement; it serves a different purpose from operational webhooks. Keep provider API keys on your backend. A widget embed contains public configuration such as a service ID and does not require an API key in the browser. ## Common integration patterns **A subscription website:** embed the Service Picker and let Komashi display the configured plans. Handle any business-specific access rules in your application and use API lookups or webhooks to keep them current. **An existing SaaS application:** use the REST API to connect your customer records, create subscription checkout flows and record usage. `sync-usage` sets an absolute total; `adjust-usage` applies an increase or decrease. **An AI-assisted workflow:** connect through `https://mcp.komashi.com/`, choose the business, and ask the assistant to inspect the catalog, manage records or prepare setup drafts. Review the proposed changes before approving actions. Continue with [REST API](https://komashi.com/docs/provider/Developers/api-integration/index.md), [MCP](https://komashi.com/docs/provider/Developers/mcp-integration/index.md), [widgets](https://komashi.com/docs/provider/Developers/widget-integration/index.md) or [webhooks](https://komashi.com/docs/provider/Settings/11webhooks/index.md). --- # Embed widgets > Embed Komashi's Service Picker and Subscription Details with the generated script, real resource IDs and optional redirect settings. Canonical: https://komashi.com/docs/provider/Developers/widget-integration/ Language: en Komashi widgets add a ready-made service selection or subscription interface to your website. Their content comes from your Komashi configuration, and the loader creates an iframe in the page where you place the script. ## Choose the widget | Widget | Use it for | Required resource ID | | --- | --- | --- | | **Service Picker** | Display a service's plans and let a customer start a subscription flow. | `data-service-id` | | **Subscription Details** | Display and manage a specific existing subscription. | `data-subscription-id` | Open **Control Center → Integration → Widgets** to preview both views and copy their generated embed code. The [Widget settings](https://komashi.com/docs/provider/Settings/12widgets/index.md) guide explains the page and its empty states. [![Service Picker example and generated embed code](https://komashi.com/docs/assets/images/integrations-service-picker.png)](/assets/images/integrations-service-picker.png) ## Embed a Service Picker Copy the script into the HTML at the position where the widget should appear: ```html ``` Replace `YOUR_SERVICE_ID` with an actual service ID from the [REST API](https://komashi.com/docs/provider/Developers/api-integration/index.md) or another trusted Komashi resource. The generated example contains a placeholder; copying it without replacing the ID does not connect your service. Use the script host generated by your own environment. Do not publish the local `komashi-app.test` address on a public website. ## Embed Subscription Details Render the subscription ID for the customer who is entitled to see that subscription: ```html ``` [![Subscription Details example with an existing subscription and embed code](https://komashi.com/docs/assets/images/integrations-subscription-details.png)](/assets/images/integrations-subscription-details.png) Use an individual subscription ID, not its group ID. The widget derives the service and provider from that subscription. A customer ID is not a substitute for the required subscription ID. The browser receives the IDs placed in the HTML. Decide on your backend which customer and subscription the signed-in visitor is allowed to access; an arbitrary ID copied from a URL is not proof of that authorization. ## Embed attributes | Attribute | Meaning | | --- | --- | | `src` | The generated `/widget/embed.js` URL. | | `data-komashi-widget` | Marks the script for initialization by the Komashi loader. | | `data-view` | Set `service-picker` or `subscription-details` explicitly. | | `data-service-id` | The service ID required for Service Picker. | | `data-subscription-id` | The subscription ID required for Subscription Details. | | `data-customer-id` | Optional existing customer context. Only supply an appropriate customer for the integration. | | `data-redirect-url` | Optional return destination for supported completed flows. Use an absolute URL that you control. | | `data-is-preview` | Preview mode used by the Control Center example. Omit it for the live customer embed. | No provider API key belongs in this script. Keep REST keys on your server. For example, a Service Picker with a return destination adds: ```html ``` The return destination does not prove that payment succeeded. Read the subscription state when your application needs to grant access. ## Page layout and loading The iframe fills its container's width. The loader and widget communicate its height so it can resize as the content changes. The widget language follows the provider's configured language. Allow the widget host in any Content Security Policy that restricts external scripts or frames. Payment flows may also open a separate page; retain normal browser navigation and popup behavior. For multiple widgets, place all their marked script elements in the HTML before the loader's first execution. The current loader initializes the script elements it discovers on that first run; there is no documented automatic rescan for embeds inserted later by a single-page application. ## Troubleshooting | Problem | Check | | --- | --- | | Blank or unavailable widget | Replace placeholder IDs, verify the `data-view`, and check that the configured resource still exists. | | Works locally but not on the public site | Use the public embed host rather than the local `.test` domain. | | Missing iframe or script load | Check your CMS's script restrictions and your site's Content Security Policy. | | Wrong customer or subscription | Check the backend mapping and the individual subscription ID. | | Stale or unresponsive tab | Reload the page. Widget interaction sessions are temporary. | | `429` response | Reduce reloads or requests and retry later. The embed and render endpoints are throttled. | Related: [Widget settings](https://komashi.com/docs/provider/Settings/12widgets/index.md), [REST API integration](https://komashi.com/docs/provider/Developers/api-integration/index.md), [webhooks](https://komashi.com/docs/provider/Settings/11webhooks/index.md). --- # Create your first service > You do not build your first service by hand. Komashi generates it from your business description when you create your provider, and ticks Create your first… Canonical: https://komashi.com/docs/provider/get-started/create-your-first-service/ Language: en You do not build your first service by hand. Komashi generates it from your business description when you [create your provider](https://komashi.com/docs/provider/get-started/create-your-provider/index.md), and ticks **Create your first service** in the **Setup guide**. Video (English narration): [Review your first service](https://www.youtube.com/watch?v=ZyHYkEoiwbQ) ![Services list with the generated service](https://komashi.com/docs/assets/images/services-list-ai-generations.jpg) The service appears under **Services** in the Control Center. While it is being generated, the row shows a progress label. When it is ready, it shows a green dot: the service is live. ## Review it before you share your storefront :::caution[Your service is live with starter prices] The generated service is published on your storefront straight away. Its prices are fixed starter amounts — they do not come from your description. Either fix the prices first, or open the service and turn **Storefront settings → Status** off until they are right. ::: Open the service and check: 1. **Prices.** The generator creates three plans — **Entry**, **Growth**, and **Premium** — with starter prices (for example 10 000, 20 000, and 40 000 HUF). Set your real prices in the [Pricing tab](https://komashi.com/docs/provider/Settings/03service-editor/index.md#pricing). 2. **Plan names and descriptions.** They are generic. Rewrite them for what you sell. 3. **Features.** Each plan starts with an empty **Add feature** list. 4. **Storefront page.** Check the hero text and badges in the [Layout editor](https://komashi.com/docs/provider/Settings/03service-editor/index.md#layout-editor). Remove anything that does not apply to your business. See [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md#what-the-generator-produces) for everything the generator produces. ## Add more services Click **New service** on the **Services** page. See [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md#create-a-new-service). Next: [Verify payment method](https://komashi.com/docs/provider/get-started/verify-payment-method/index.md) --- # Create your provider > Create your provider: Your provider is your branded workspace on Komashi. You describe your business, and Komashi creates the provider and your first… Canonical: https://komashi.com/docs/provider/get-started/create-your-provider/ Language: en Your provider is your branded workspace on Komashi. You describe your business, and Komashi creates the provider **and your first service** in one go. Video (English narration): [Create your provider](https://www.youtube.com/watch?v=I8hkQhwz-N8) ## Start After you sign in for the first time, Komashi asks **How do you want to get started?** Choose **Become a provider**. ![Welcome to Komashi: Become a provider or Find a service](https://komashi.com/docs/assets/images/get-started-onboarding-choice.jpg) You can also start from the Komashi homepage: type the subdomain you want into the **yourbrand.komashi.com** field and press **Enter**. This opens the same setup. If you already have a provider, use the provider switcher in the top-left of the Control Center and choose **Create new provider**. :::note[Looking for a service instead?] **Find a service** opens the provider search. Enter a provider's subdomain to see their services. See [Who is an end user?](https://komashi.com/docs/end-user/who-is-an-end-user/index.md) ::: ## Step 1 · Describe your business ![Describe your business](https://komashi.com/docs/assets/images/get-started-describe-business.jpg) 1. In **Describe your business**, write what you sell, who it is for, and how customers pay. You have up to 500 words. 2. Check **Currency** and **Language**: - **Currency** becomes your catalog currency. You cannot change it later in the Control Center, so pick the one you will price in. - **Language** is the language Komashi generates your service and storefront in. 3. Click **Next**. The more concrete the description, the better the result. Komashi uses it to suggest the VAT type on step 3 and to write your first service. ### Or use an AI assistant Under **or continue with** you can hand the setup to an AI assistant instead of filling in the form: - **Continue with ChatGPT** and **Continue with Claude** open the assistant with a ready-made request to use the Komashi provider creation tool. - **Other / Custom LLM** gives you a prompt to copy into any AI assistant. It points the assistant to the Komashi MCP endpoint (`https://mcp.komashi.com`, OAuth 2.1). See [MCP Endpoint](https://komashi.com/docs/provider/Developers/mcp-integration/index.md). ## Step 2 · Name and subdomain 1. Enter your **Business name**. 2. Enter a **Subdomain**. Your storefront will live at `yoursubdomain.komashi.com`. If you leave it empty and click **Next**, Komashi suggests one from the business name. 3. Optionally click **Upload logo**. You can also add a logo later in [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md#logo). 4. Click **Next**. :::caution[Restricted words] Some words are not allowed in provider names, for example **Test**. If you see **This subdomain contains a restricted word**, check the **Business name** as well as the subdomain — the message can refer to either. ::: ## Step 3 · Summary Check what Komashi will create, then click **Create provider**. ![Summary before creating the provider](https://komashi.com/docs/assets/images/get-started-provider-summary.jpg) **Tax rules in your country.** Set your **VAT home country**. The **Service VAT type** is suggested from your description — click **(Change)** if it is wrong. The six types are described in [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md#vat-type). ![Service VAT type options](https://komashi.com/docs/assets/images/get-started-service-vat-type.jpg) **Your first service.** Three choices decide how the service works: | Setting | Options | When to use which | |---|---|---| | **Storefront** | **Self-service storefront** (default) · **Manual customer setup** | Self-service: customers choose a plan and subscribe themselves, for example an online course. Manual: you create the subscription yourself, for example after a one-to-one consultation. | | **Renewal** | **Recurring billing** (default) · **One-time payment** | Recurring for a monthly membership or software subscription. One-time for a single consultation or a workshop ticket. | | **Subscriptions per customer** | **Multiple subscriptions** · **One subscription only** (default) | Multiple if a customer can subscribe to several plans. One only when each customer should have a single active subscription, such as a membership. | ![Storefront, Renewal and Subscriptions per customer](https://komashi.com/docs/assets/images/get-started-provider-summary-options.jpg) ## What happens next Komashi creates the provider and opens **Services** in the Control Center. Your first service is generated in the background — it takes a few seconds — and **Create your first service** in the **Setup guide** is ticked automatically. :::caution[Your first service is live immediately] The generated service is published with prices the generator proposed, or fixed starter prices if the AI could not produce a valid result. Review them before you share your storefront. See [Create your first service](https://komashi.com/docs/provider/get-started/create-your-first-service/index.md). ::: Next: [Create your first service](https://komashi.com/docs/provider/get-started/create-your-first-service/index.md) --- # Get started > First create your provider. You describe your business once, and Komashi creates your branded workspace together with your first service. Canonical: https://komashi.com/docs/provider/get-started/get-started-with-komashi/ Language: en First [create your provider](https://komashi.com/docs/provider/get-started/create-your-provider/index.md). You describe your business once, and Komashi creates your branded workspace together with your first service. Video (English narration): [Get started with Komashi](https://www.youtube.com/watch?v=8ydjOOL-dJ4) Then work through the **Setup guide** in the left sidebar of the Control Center. Its **Account setup** list has five steps, and the first one is already done when your provider is created. ![Setup guide in the Control Center sidebar](https://komashi.com/docs/assets/images/services-list-ai-generations.jpg) ## Account setup 1. **Create your first service** — done for you during provider creation. Review the generated prices and plans. [Full guide](https://komashi.com/docs/provider/get-started/create-your-first-service/index.md) 2. **Verify payment method** — add a billing card for your Komashi fees. [Full guide](https://komashi.com/docs/provider/get-started/verify-payment-method/index.md) 3. **Set up billing profile** — add your legal billing details. [Full guide](https://komashi.com/docs/provider/get-started/set-up-billing/index.md) 4. **Set up legal links** — add your privacy policy and terms links. [Full guide](https://komashi.com/docs/provider/get-started/set-up-legal-links/index.md) 5. **Set up payment** — enable payment methods so customers can pay you. [Full guide](https://komashi.com/docs/provider/get-started/set-up-payment/index.md) Each step is ticked automatically when you finish it, and the progress bar fills up. Collapse the guide with the icon in its top-right corner. **Complete all five steps to start selling on Komashi.** --- # Set up billing profile > Add your legal billing details. They appear on the invoices issued to your customers. This is the third step in the Setup guide. Canonical: https://komashi.com/docs/provider/get-started/set-up-billing/ Language: en Add your legal billing details. They appear on the invoices issued to your customers. This is the third step in the **Setup guide**. Video (English narration): [Set up your billing profile](https://www.youtube.com/watch?v=e4jYhzIQIPI) ![Set up billing profile step](https://komashi.com/docs/assets/images/get-started-billing-profile.png) ## Steps 1. In the **Setup guide**, click the step, or go to **Settings → Billing details**. 2. Click the **pencil icon** next to **Billing Information**. 3. Fill in **Billing Name**, **Country**, **ZIP Code**, **City**, and **Address**. **State**, **Address Line 2**, and **VAT Number** are optional. 4. Click **Save changes**. Your **Catalog currency** is the currency you picked when you [created your provider](https://komashi.com/docs/provider/get-started/create-your-provider/index.md). It is shown here but cannot be changed. See [Billing Details](https://komashi.com/docs/provider/Settings/07billing-details/index.md) for the full field reference. Next: [Set up legal links](https://komashi.com/docs/provider/get-started/set-up-legal-links/index.md) --- # Set up legal links > Add links to your privacy policy and terms so customers can access these documents. This is the fourth step in the Setup guide. Canonical: https://komashi.com/docs/provider/get-started/set-up-legal-links/ Language: en Add links to your privacy policy and terms so customers can access these documents. This is the fourth step in the **Setup guide**. Video (English narration): [Set up your legal links](https://www.youtube.com/watch?v=zVUXNkT5tTo) :::caution[These must be your own documents] You sell to your customers under **your own** contract — Komashi is not a party to it. You are responsible for your own terms, your own privacy policy, and your own cancellation and refund policy, and for meeting the consumer protection rules that apply to your customers. Do not link to Komashi's terms here. You are also the **controller** of your customers' personal data; Komashi is your processor under the [Data Processing Agreement](https://komashi.com/docs/legal/data-processing-agreement/index.md). Your privacy policy must tell your customers what you do with their data. ::: ![Set up legal links step](https://komashi.com/docs/assets/images/get-started-legal-links.png) ## Steps 1. In the **Setup guide**, click the step, or go to **Settings → Basic**. 2. Click the pencil icon next to **Privacy policy**, paste the full URL of your privacy policy page, and click **Save changes**. 3. Repeat for **Terms**. No documents yet? Click **Create your own Privacy Policy** or **Create your own Terms of Service** under the field. Komashi gives you a ready-made request for ChatGPT, Claude, or another AI assistant to draft one. Have the draft checked before you publish it — it is your contract with your customers. See [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md) for the full settings reference. Next: [Set up payment](https://komashi.com/docs/provider/get-started/set-up-payment/index.md) --- # Set up payment > Enable payment methods so customers can pay for your service. This is the fifth and final step in the Setup guide. Canonical: https://komashi.com/docs/provider/get-started/set-up-payment/ Language: en Enable payment methods so customers can pay for your service. This is the fifth and final step in the **Setup guide**. Video (English narration): [Set up payment](https://www.youtube.com/watch?v=tXI6vIRXDE4) ![Set up payment step](https://komashi.com/docs/assets/images/get-started-payment-wizard.png) :::note[Money flow] ``` End User → Payment Provider → Provider ``` Komashi is not involved in the money flow. ::: ## Steps 1. In the **Setup guide**, click the step, or go to **Settings → Payment providers**. 2. Find a method with the search field, or filter by country. 3. Click **Settings** on the method card and enter the required credentials. 4. Turn on the toggle to enable it. See [Payment Providers](https://komashi.com/docs/provider/Settings/08payment-providers/index.md) for the full settings reference. You've completed all required steps — you're ready to start selling. --- # Verify payment method > Add a billing card so Komashi can charge its own fees. This is the second step in the Setup guide. Canonical: https://komashi.com/docs/provider/get-started/verify-payment-method/ Language: en Add a billing card so Komashi can charge its own fees. This is the second step in the **Setup guide**. Video (English narration): [Verify your payment method](https://www.youtube.com/watch?v=tUEijU2fqaE) This card pays **Komashi**. It has nothing to do with how your customers pay you — that is [Set up payment](https://komashi.com/docs/provider/get-started/set-up-payment/index.md). ![Add a billing card to get started selling](https://komashi.com/docs/assets/images/get-started-billing-card.jpg) ## Steps 1. In the **Setup guide**, click **Verify payment method**. This opens your **Komashi subscription** page. 2. Click **Add payment method** and enter your card. Your card is saved for future amounts you owe under your service agreement. **You are not charged when you add it.** For current pricing, see the [pricing page](https://komashi.com/pricing). :::note[Deadline] You have **30 days** from creating your provider to add a billing card. The page shows the exact deadline and how many days are left. ::: Next: [Set up billing profile](https://komashi.com/docs/provider/get-started/set-up-billing/index.md) --- # Komashi subscription > The Komashi subscription page shows your standing on the platform, your Komashi fees, and your billing status. Open Komashi subscription from the Control… Canonical: https://komashi.com/docs/provider/komashi-subscription/ Language: en The Komashi subscription page shows your standing on the platform, your Komashi fees, and your billing status. Open **Komashi subscription** from the Control Center. ## Rank and targets Your account has a **rank** that reflects your activity (for example **Starter**, progressing toward **Bronze**). The page shows your current **Revenue** against the **Target** for the next rank. ## Free subscriptions Every provider gets a monthly free allowance that is free of Komashi fees. The remaining allowance for the month is shown here under **Free subscriptions**. For the current allowance, see the [pricing page](https://komashi.com/pricing). ## Billing status and Financial Performance - **Billing status** — whether your Komashi fees are up to date, and your **next payment** date. - **Financial Performance** — a summary of the revenue your Komashi fee is calculated from. ## Billing history Review past Komashi invoices under **Billing history**, and open the **Billing Portal** to manage your payment details. ## View ranks Click **View ranks** to open the [pricing page](https://komashi.com/pricing), where the current rates for each rank are listed. :::note[Currency] The pricing page shows the rates in the currency you select. The fee terms that apply to your account are in the [Provider Fee Schedule](https://komashi.com/docs/legal/provider-fee-schedule/index.md). ::: Related: [Dashboard](https://komashi.com/docs/provider/dashboard/index.md), [Billing Details](https://komashi.com/docs/provider/Settings/07billing-details/index.md) --- # Basic > Configure your provider identity: name, subdomain, language, legal links, logo, and brand colors. Open Settings → Basic in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/01basic/ Language: en Configure your provider identity: name, subdomain, language, legal links, logo, and brand colors. Open **Settings → Basic** in the Control Center. Video (English narration): [Basic settings](https://www.youtube.com/watch?v=Zm5LnYb5KFQ) ![Basic settings overview](https://komashi.com/docs/assets/images/settings-basic-overview.png) ## What you can configure - **Provider name** — The name users see when they search for your provider. - **Provider subdomain** — A short, unique identifier used in your public URL (for example `yourbrand.komashi.com`) and in provider searches. - **Language** — The language used by the service generator. Google Auto Translate translates your site into this language. - **Timezone** — The time zone used for Komashi billing cycles and partner payouts. - **Privacy policy** — Link to your privacy policy page. - **Terms** — Link to your terms page. - **Logo** — Upload your own logo. - **Color palette** — Your provider brand colors. AI generations use these colors. - **Delete Provider** — Permanently remove this provider and all associated data. ## How to set it up Each setting has an **edit (pencil) icon**. Click it, change the value in the dialog, then click **Save changes**. ### Provider name 1. Click the pencil icon next to **Provider name**. 2. Enter the new name. 3. Click **Save changes**. ### Provider subdomain 1. Click the pencil icon next to **Provider subdomain**. 2. Enter a short, unique identifier. Only letters, numbers, and hyphens. Minimum 3 characters. 3. Click **Change subdomain**. ![Change provider subdomain](https://komashi.com/docs/assets/images/settings-basic-subdomain.png) :::caution[Changing the subdomain changes your public URL. Links to the old subdomain stop working.] ::: ### Language 1. Click the pencil icon next to **Language**. 2. Select a language from the list. 3. Click **Save changes**. :::note[This is your storefront language. It is not the same as the **Preferred language** in your own profile settings, which sets your interface language and the language of the emails Komashi sends you. See [What languages does Komashi support?](https://komashi.com/docs/general/what-languages-does-komashi-support/index.md).] ::: ### Timezone Your provider time zone determines when a billing month starts and ends. All Komashi billing cycles and partner payout calculations use it. 1. Click the pencil icon next to **Timezone**. 2. Select a time zone from the list (the full IANA list, for example `Europe/Budapest`). 3. Tick **I understand that this changes future billing and payout calculations**. 4. Click **Save changes**. ![Provider timezone dialog](https://komashi.com/docs/assets/images/settings-basic-timezone.png) :::note[Changing the time zone applies to **new** Komashi billing and payout calculations only. Calculations that already ran keep the time zone recorded at the time — your past invoices and payout statements do not change retroactively.] ::: Your billing month begins on the 1st day at 00:00 in this time zone. Your billing month is used when your Komashi fee is calculated; for current pricing see the [pricing page](https://komashi.com/pricing). ### Privacy policy and Terms 1. Click the pencil icon next to **Privacy policy** or **Terms**. 2. Paste the full URL of the page (for example `https://yourbrand.com/terms`). 3. Click **Save changes**. No documents yet? Click **Create your own Privacy Policy** or **Create your own Terms of Service**. The dialog offers **Continue with ChatGPT**, or a prompt under **Other / custom LLM** to paste into Claude or another AI assistant. The assistant drafts the text; publish it on your own site and paste its URL here. ![Create Privacy Policy dialog](https://komashi.com/docs/assets/images/settings-basic-create-privacy-policy.jpg) ### Logo Click your current logo (or the **Edit logo** pencil) to upload a PNG, JPG, or WebP image. Adjust the crop area, then save. :::note[Your logo is served from a public image URL so it can be displayed outside the Control Center — on your storefront, in the widgets, and in the notification emails Komashi sends to your customers. Do not upload an image that contains information you do not want to be publicly accessible.] ::: ### Color palette Pick each color manually from the color dropdowns, or click **Regenerate palette with AI** to generate a matching palette. AI generations use the new colors. ![Color palette and delete provider](https://komashi.com/docs/assets/images/settings-basic-palette-delete.png) ### Delete Provider Click **Delete Provider** to remove your provider account. :::caution[This permanently removes the provider and all associated data. The subdomain becomes available again 60 days after deletion.] ::: --- # Provider Rules > Control how plans, subscriptions, and customer data behave on your storefront. Open Settings → Provider rules in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/02provider-rules/ Language: en Control how plans, subscriptions, and customer data behave on your storefront. Open **Settings → Provider rules** in the Control Center. Video (English narration): [Provider rules](https://www.youtube.com/watch?v=VI5dkYl1Epc) ## Plan Management Configure how customers can modify their subscription plans. ![Plan Management settings](https://komashi.com/docs/assets/images/settings-provider-rules-plan-management.png) ### Allow plan upgrades and downgrades When enabled, customers and admins can change active plans. This allows scaling up or down without interrupting service. ### Allow operators to add discounts When enabled, operators can apply discounts during checkout. :::caution[Operators can set a 0 price or a 100% discount and make checkout free. Enable this only if you trust all operator accounts.] ::: ### Always show service listing When enabled, customers always see the service listing, even if the provider has only one service. When disabled, a single service opens directly. --- ## Subscription lifecycle Manage how subscriptions are started, canceled, and how services behave when deleted. ### Subscription Cancellation Define how canceled subscriptions are handled: - **Continue Until Period End** — Services remain active until the billing period ends. No immediate interruption. - **Immediate Stop** — The subscription ends as soon as the customer cancels. ### Service Deletion Define how subscriptions behave when you delete a service: - **End Subscriptions at Period End** — Subscriptions end at the current billing period. - **Keep Subscriptions Renewing** — Existing subscribers keep renewing until they cancel manually. The service is hidden from new sales. --- ## Customer Control how customer billing profile changes sync with provider data. ![Customer sync and extended data](https://komashi.com/docs/assets/images/settings-provider-rules-customer.jpg) ### Automatic Sync When enabled, edits customers make to their billing profile sync automatically with the provider. No manual review is needed. When disabled, customer changes wait for your approval before they take effect. ### Allow company customers When enabled, customers can subscribe as a company, with a company name and VAT number. Turn it off if you only sell to private individuals. --- ## Customer Extended Data Configure which custom fields customers must fill in during billing profile creation. Use this to collect extra data your business needs (for example a license plate number). To add a field: 1. Click **Add field**. 2. Enter a **Field label**. 3. Select a **Field type** (for example Text). 4. Check **Required** if customers must fill it in. 5. Click **Save**. ![Add custom field](https://komashi.com/docs/assets/images/settings-provider-rules-custom-field.png) Click **Reset to default settings** to restore every rule on this page to its default. Related: [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md), [Coupon Management](https://komashi.com/docs/provider/Settings/04coupon-management/index.md) --- # Manage Services > Create and manage the services you sell. Click Services in the left sidebar of the Control Center. Canonical: https://komashi.com/docs/provider/Settings/03manage-services/ Language: en Create and manage the services you sell. Click **Services** in the left sidebar of the Control Center. Video (English narration): [Generate a new service](https://www.youtube.com/watch?v=s8iz-aOT4lA) ## Service list The list shows every service with its status, short description, and number of subscribers. A green dot means the service is live on your storefront. Labels under the description show **Operators enabled** and **Single subscription** where they apply. Use the **eye icon** to preview the service page and the **copy icon** to copy its link. ![Services list](https://komashi.com/docs/assets/images/services-list-ai-generations.jpg) ## Create a new service Your first service is generated when you [create your provider](https://komashi.com/docs/provider/get-started/create-your-provider/index.md). For every further service, click **New service**. Nothing is created until you click **Generate Service**. ### 1. Create new service ![Create new service](https://komashi.com/docs/assets/images/services-create-new-service.jpg) - **Service Name** — for example `Email Marketing Automation`. - **Describe your business** — what this service includes, who it is for, and how it is billed. Up to 500 words. The generator works from this text, so the more concrete it is, the more usable the result. - **Language** — the language the service is generated in. Click **Next**. Instead of the form you can use **Continue with ChatGPT** or **Other / Custom LLM**, the same way as when you [create your provider](https://komashi.com/docs/provider/get-started/create-your-provider/index.md#or-use-an-ai-assistant). ### 2. Review your service Check what Komashi will create. Click **Edit** to go back to the name and description. ![Review your service](https://komashi.com/docs/assets/images/services-review-your-service.jpg) Under **Service settings**: - **Service VAT type** — suggested from your description. Click **(Change)** to pick another. See [VAT type](#vat-type) below. - **Storefront** — **Self-service storefront** (customers subscribe themselves) or **Manual customer setup** (you create subscriptions). - **Renewal** — **Recurring billing** (billed repeatedly) or **One-time payment** (paid once). - **Subscriptions per customer** — **Multiple subscriptions** (the same customer can subscribe more than once) or **One subscription only**. Click **Generate Service**. With **One-time payment**, customers pay once instead of subscribing. Komashi creates a credit pack with a usage limit — the customer uses the service until the credits run out or the access period ends. When they need more, they buy again with **Add More**, and the purchases are grouped under the same subscription so their usage limit is shared. ### VAT type The **VAT type** is required. You can change it later on the service's [VAT tab](https://komashi.com/docs/provider/Settings/03service-editor/index.md#vat). Two types are shown first; click **Show more** for all six: | VAT type | What it covers | |---|---| | **Digital** | Automated online services with no human involvement — SaaS, streaming, e-books, downloads, hosting, pre-recorded courses. | | **General service** | Human work or expertise, even when delivered online — consulting, accounting, legal, marketing, translation, custom programming, live lessons. | | **Goods — leave the country** | Physical goods shipped out of the seller's country. | | **Goods — stay in the country** | A local physical-goods sale; the seller's VAT applies. | | **On-site at seller** | Location-bound service performed in the seller's country — restaurant, event admission, real-estate work, installation, accommodation. | | **On-site at buyer** | Location-bound service performed in the customer's country. | ## Generation Generation takes a few seconds. While it runs, the service's row shows its progress through four steps: **Creating packages & add-ons**, **Configuring pricing**, **Building your storefront**, and **Service ready**. When it finishes, the row shows a green dot. If a step fails, Komashi still creates the service and fills the missing parts with a basic draft. You can continue from the editor and change everything. ## What the generator produces You get a working draft instead of an empty page: - **A plan structure** — three plans, **Entry**, **Growth**, and **Premium**, each with **month** and **year** period toggles. - **A storefront page** — hero banner with your service name and description, a generated hero image, a call to action, and further sections, styled with your brand colors from [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md). - **The VAT type** you confirmed, applied to the service. :::caution[The generated service is live immediately] Generation publishes the service. Its public URL works and customers can buy it right away — at the generator's starter prices. If you are not ready to sell, open the service and turn **Storefront settings → Status** off before you do anything else. ::: ### What you must fix before selling - **The prices.** The generator proposes prices in the **Configuring pricing** step, but they are only a starting point. If the AI cannot produce a valid result, the plans get fixed starter amounts that do not depend on your description — for example 10 000, 20 000, and 40 000 HUF. Check and set your real prices in the [Pricing tab](https://komashi.com/docs/provider/Settings/03service-editor/index.md#pricing). - **The plan names and descriptions.** They are generic. Rewrite them for what you actually sell. - **The plan features.** No features are generated — each plan starts with an empty **Add feature** list. - **The storefront copy.** The hero keeps your description, but the badges and feature strip are generic, for example "99.9% uptime SLA" or "4.9 rating". Remove anything that is not true for your business in the [Layout editor](https://komashi.com/docs/provider/Settings/03service-editor/index.md#layout-editor). - **Add-ons and one-time items.** The **Recurring Add-on Services** and **One-time services** sections are created empty. :::note[Language] The generator writes in the **Language** you pick when you create the service. Your provider's default is set in [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md). ::: See also plan and cancellation rules in [Provider Rules](https://komashi.com/docs/provider/Settings/02provider-rules/index.md). --- # Service editor > Click a service on the Services page to open its editor. The editor has four tabs — Pricing, Layout editor, VAT, and Storefront settings — with a breadcrumb… Canonical: https://komashi.com/docs/provider/Settings/03service-editor/ Language: en Click a service on the **Services** page to open its editor. The editor has four tabs — **Pricing**, **Layout editor**, **VAT**, and **Storefront settings** — with a breadcrumb back to Manage services on the left and two controls on the right: Video (English narration): [Service editor tour](https://www.youtube.com/watch?v=PiKHb0OSMa4) - **Preview** — open the customer-facing page. - **Copy icon** — copy the direct link to the service. The **Storefront settings** tab shows the service's current state next to its name (for example **● Active**), so you can see at a glance whether the service is public. The editor opens on the **Pricing** tab. The first time you open it, a short guided tour points out the tabs. ## Pricing The Pricing tab is a canvas where you build the service's plans and extras: - **Plans** — each plan is a column with its name, subtitle, period toggles (**month** / **year**), price, and an **Add feature** list. Use **Add new plan** to add another column, or the **gear icon** on a plan for its options. - **Recurring Add-on Services** — extras billed alongside a recurring plan. Use **Add Add-on**. - **One-time services** — single-payment items. Use **Add One-time Service**. - A **zoom control** in the bottom-right corner fits larger pricing layouts on screen. - The **⇄ icon** on a price opens **Transfer Price** — copy that plan's pricing onto another plan instead of retyping it. ![Transfer Price](https://komashi.com/docs/assets/images/service-editor-transfer-price.png) Prices on the canvas are shown **gross**, labelled with your catalog currency — for example `127 HUF (VAT inc)`. ![Pricing tab of a newly generated service](https://komashi.com/docs/assets/images/service-editor-pricing-generated.jpg) ### Edit an existing price You can change pricing at any time after the service has been generated. 1. Open the service and switch to the **Pricing** tab. 2. Click the **price amount** on the plan, add-on, or one-time item you want to change. 3. Configure the price in the **Price Configuration** panel (see below). 4. Click **Save changes**. :::caution[Changing a price does not re-price existing subscriptions. See [What happens to existing subscribers if I change the price?](https://komashi.com/docs/provider/subscriptions/index.md)] ::: ### Price Configuration Choose a pricing type: - **Standard Pricing** — "Set fixed prices with VAT calculation". Enter the **Net Price**; the **Gross Price (calculated)** is derived from it and the tax class. - **Free Service** — "Offer this service at no cost". - **Custom Quote** — "Customers request personalized pricing"; no price is shown. - **Not Available** — "Service is temporarily unavailable"; hides the plan. ![Price Configuration panel](https://komashi.com/docs/assets/images/pricing-tab.png) :::note[Tax class is automatic] You do not normally pick a tax class. The field is **disabled by default** and shows your default class (for example `Standard VAT 27%`). Tick **Choose manually** to override it for that one price. Either way, the VAT actually applied at checkout is selected from the service's **VAT type**, the **seller country**, the **customer country**, and the **customer's tax status** — not from this field. Use the **Open VAT Helper** link in the panel to simulate those rules. See [VAT](#vat) below and [VAT and Tax Profiles](https://komashi.com/docs/provider/Settings/07vat-tax-profiles/index.md). ::: ### Add-on options and quantities An add-on can have **Add-on Options** — purchasable steps such as "100 credits" or "10 GB". Each option has a **Limit amount** (how much one unit grants) and a **Limit label** (the unit, for example *credits*). Use **Remove option** to take one away. Video (English narration): [Add-on options](https://www.youtube.com/watch?v=YHEZo9JOGgM) - **Maximum per customer** — how many units a single customer can buy across all of their subscriptions. For example, with a maximum of 2 and 100 credits per unit, a customer can buy up to 200 credits. Set it to `0` for unlimited purchases. - **Reset usage on renewal** — start each renewal with the full allowance instead of carrying usage over. On the storefront, an add-on that has options shows a quantity selector, so customers can buy several units at once instead of adding the add-on repeatedly. When a customer changes their quantity on an existing subscription, the change preview lists the increase or decrease, and the price is multiplied by the quantity. A customer cannot lower the quantity below what they have already used. :::caution[Lowering a limit affects existing subscriptions] Lowering **Maximum per customer** keeps existing quantities active, but customers over the new maximum cannot buy more units. Lowering the **Limit amount** reduces the usage available per unit on existing subscriptions. Komashi shows how many customers are affected before you save. ::: ### Free trial A recurring plan can start with a free trial. Trials are set per billing period, so a plan can offer one on its monthly price and none on its yearly price. 1. Open the plan's options and choose **Manage periods**. 2. In the billing period you want, switch on **Free trial**. 3. Set the **Trial length** (a number) and the **Trial unit** (year, month, week, or day). 4. Save your changes. The trial covers the whole period bundle — the plan and every add-on, including one-time add-ons — so customers are not charged for any included item until the trial ends. Regular billing starts after that. You cannot set a trial on the plan or on individual add-ons separately. Customers see a trial badge on the price, and you can see the trial end date on the subscription's page. ## Layout editor The Layout editor tab controls how the service's storefront page looks. The page preview is on the left, the controls on the right: - **Brand Styles** — the visual styling of the page, seeded from your provider brand color in [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md). - **Layout Sections** — the six sections of the storefront page. Toggle a section on or off with its switch, or click it to open its editor. ### The sections | Section | What it shows | Editable | Can be turned off | |---|---|---|---| | **Hero Banner** | First impression. Hero section at the top. | Yes | Yes | | **Type Comparison** | Compare service types side by side. | No | Yes | | **Pricing Plans** | Plans, pricing, and subscriptions. | Yes | **No** | | **Extra Data** | More custom fields below pricing for additional service data. | No | Yes | | **Testimonials** | Customer reviews and social proof. | Yes | Yes | | **Footer** | Contact info, links, and branding. | Yes | Yes | **Pricing Plans is always visible** — it has no off switch, because a service page without its plans cannot be purchased. Hero Banner, Type Comparison, Pricing Plans, and Footer also offer a **regenerate** action, which rewrites that section's content with the generator. ![Layout tab of a newly generated service](https://komashi.com/docs/assets/images/service-editor-layout-generated.jpg) ## VAT The service's **VAT type**. It is suggested from your description when the service is created, and you can change it here. The six types are listed in [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md#vat-type). By default Komashi applies its own VAT rules (**Automatic VAT calculation**). At checkout it combines this VAT type with the seller and customer countries and the customer's **B2B/B2C status** to determine the VAT treatment. Every price also needs a base tax class: on the Pricing tab, changing the net or gross amount recalculates the other one using that class. ![VAT tab](https://komashi.com/docs/assets/images/service-editor-vat-tab.jpg) ## Storefront settings Publish or hide the service, get its public URL, and set who can subscribe. ![Storefront settings tab](https://komashi.com/docs/assets/images/service-editor-storefront-settings.jpg) ### General - **Allow multiple subscriptions** — the same customer can subscribe more than once. - **Available for operators** — operators can create and update subscriptions for this service. ### Storefront - **Status** — publish or hide the service. When it is **● Active**, anyone with the link can open the service page and buy it. - **Public URL** — for example `https://yourbrand.komashi.com/services/car-wash-membership`, with buttons to open it, copy it, or **Modify service URL**. :::caution[A newly generated service is **Active**. It can be bought the moment generation finishes, at the generator's starter prices. Turn **Status** off until your pricing is right.] ::: ### Danger zone Click **Delete service** to remove the service. Deleting asks for confirmation and tells you what it affects: - It deletes the service **and all related plans, billing periods, and add-ons**. - **Existing subscriptions stay active until the end of their current billing period**, then stop renewing. - If the service has subscriptions or billing history, **its record is kept** so that existing data is preserved. - **The action cannot be undone.** :::note[This is the service's own behaviour on deletion. What happens to subscribers is also governed by the **Service Deletion** rule in [Provider Rules](https://komashi.com/docs/provider/Settings/02provider-rules/index.md).] ::: Related: [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md), [VAT and Tax Profiles](https://komashi.com/docs/provider/Settings/07vat-tax-profiles/index.md) --- # Coupon Management > Create, edit, and delete discount coupons. Open Settings → Coupon management in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/04coupon-management/ Language: en Create, edit, and delete discount coupons. Open **Settings → Coupon management** in the Control Center. Video (English narration): [Coupon management](https://www.youtube.com/watch?v=S-04_oTBgCQ) ## Coupon list The table shows every coupon with its discount, usage limit, and status (**Active** or disabled). Sort by coupon name or discount with the column headers. Use the **pencil icon** to edit and the **trash icon** to delete. ![Coupon list](https://komashi.com/docs/assets/images/settings-coupon-list.png) ## Create a new coupon 1. Click **Add Coupon**. 2. Fill in the **Create New Coupon** form: - **Coupon Name** — the code customers enter, for example `SUMMER2024`. - **Description (Optional)** — a brief internal note. - **Discount Percentage** — for example `20%`. - **Usage Limit per Customer (Optional)** — a number between 1 and 999. Leave it empty for unlimited usage. - **Disable this coupon** — check it to create the coupon in a disabled state. 3. Click **Create Coupon**. ![Create New Coupon dialog](https://komashi.com/docs/assets/images/settings-coupon-create.png) ## Edit a coupon 1. Click the **pencil icon** next to the coupon. 2. Update the name, description, discount percentage, or usage limit. 3. Check **Disable this coupon** to deactivate it without deleting it. 4. Click **Update Coupon**. ![Edit Coupon dialog](https://komashi.com/docs/assets/images/settings-coupon-edit.png) ## Delete a coupon 1. Click the **trash icon** next to the coupon. 2. Confirm the deletion. :::tip[If you only want to pause a coupon, disable it instead of deleting it. You can re-enable it later.] ::: --- # Users and Permissions > Invite users to your provider account to help you manage your services. Open Settings → Users & Permissions in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/06user-and-permissions/ Language: en Invite users to your provider account to help you manage your services. Open **Settings → Users & Permissions** in the Control Center. Video (English narration): [Users and permissions](https://www.youtube.com/watch?v=DP4p0kQMNVY) ## User list The table shows every user with their email and role. Your own account is marked **(you)**. Use the **pencil icon** to change a role and the **trash icon** to remove a user. ![Users and permissions list](https://komashi.com/docs/assets/images/settings-users-list.png) ## Roles - **admin** — Full access to settings, services, billing, and user management. - **operator** — Day-to-day operations, for example verifying subscriptions and managing customers. Operators cannot change provider settings. ## Invite a new user 1. Click **New user**. 2. Enter the user's **Email** address. 3. Select a **Role** (admin or operator). 4. Click **Send invite**. ![Invite a new user](https://komashi.com/docs/assets/images/settings-users-invite.png) The user receives an invitation to collaborate with this provider. ## Change a user's role 1. Click the **pencil icon** next to the user. 2. Choose the new role in the **Update role** dialog. 3. Click **Save changes**. ![Update role dialog](https://komashi.com/docs/assets/images/settings-users-update-role.png) ## Remove a user Click the **trash icon** next to the user and confirm. The user loses access to this provider immediately. Two rules apply: - Only an admin can remove other users. You can always remove your own access. - You cannot remove the last admin. Every provider needs at least one. ## Review account activity Use **Activity log** in the profile menu to review the recorded actions and identify who made a change. Where a provider filter is available, select the provider you are investigating. The log complements access management; changing a user's role or removing access still happens on **Users & Permissions**. --- # Billing Details > Manage your legal billing information and preferred currency. Open Settings → Billing details in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/07billing-details/ Language: en Manage your legal billing information and preferred currency. Open **Settings → Billing details** in the Control Center. ![Billing details overview](https://komashi.com/docs/assets/images/settings-billing-details.png) ## Billing Information Legal billing details used for invoices and financial records. This is what appears on the invoices issued to your customers. To edit, click the **pencil icon** and fill in the form: - **Billing Name** (required) — your legal company or business name. - **Country** (required) - **State** - **ZIP Code** (required) and **City** (required) - **Address** (required) and **Address Line 2** - **VAT Number** Click **Save changes** when done. ![Edit billing information](https://komashi.com/docs/assets/images/settings-billing-details-edit.png) ### Changing your billing country Your billing country determines which payment and invoice providers you can use, and how your tax profiles are handled. Changing it is not a cosmetic edit: - Payment and invoice providers not supported in the new country may be **deactivated**. Their configuration stays available. - Default settings may be removed. - Tax profiles and related tax data may be created, updated, or migrated. Komashi asks you to confirm before applying the change. Review [VAT and Tax Profiles](https://komashi.com/docs/provider/Settings/07vat-tax-profiles/index.md) and [Payment Providers](https://komashi.com/docs/provider/Settings/08payment-providers/index.md) afterwards. ## Catalog currency The currency your service catalog is priced in. You choose it as **Currency** when you [create your provider](https://komashi.com/docs/provider/get-started/create-your-provider/index.md). Here it is shown read-only, with **Currency change not supported**. Pick the right currency when you create the provider. :::note[Existing **subscriptions** always keep the currency and price they were sold in.] ::: Related: [VAT and Tax Profiles](https://komashi.com/docs/provider/Settings/07vat-tax-profiles/index.md), [Payment Providers](https://komashi.com/docs/provider/Settings/08payment-providers/index.md), [Invoicing Providers](https://komashi.com/docs/provider/Settings/09invoicing-providers/index.md) --- # VAT and Tax Profiles > Configure the tax rules that drive your pricing and invoices. Open Settings → VAT and Tax Profiles (under the BILLING group) in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/07vat-tax-profiles/ Language: en Configure the tax rules that drive your pricing and invoices. Open **Settings → VAT and Tax Profiles** (under the **BILLING** group) in the Control Center. Video (English narration): [VAT and tax profiles](https://www.youtube.com/watch?v=5iUXHlInT-k) This page has two parts: your **Tax profiles** and per-country **Billing country rules**. ![VAT and Tax Profiles](https://komashi.com/docs/assets/images/settings-vat-tax-profiles.png) ## Tax profiles A **tax profile** holds the tax classes available to your prices — for example `Standard VAT 27%`. One profile is the default, and its tax class is captured in invoice snapshots. This is the source of the tax class Komashi applies when you set a price in the [Pricing editor](https://komashi.com/docs/provider/Settings/03service-editor/index.md). You do not normally choose it per price: Komashi selects it from the service's VAT category and the field is disabled unless you enable **Choose manually** on that price. ### Manage profiles - Click **Add tax profile** to create another one. - Click **Set default** to make a profile the default. - The default profile cannot be deleted. ### Tax classes in a profile - Click **Create custom tax class** when none of the supported classes fit your case. Enter a name and a **VAT percentage**. - Click **Request new tax class** to ask the Komashi team for one. - Deleting a class removes it from your active options. It does not change invoices already issued. ### Detached classes A class marked **Detached** is one the platform has retired. Existing subscriptions and billing keep using it, but it is detached from the template, so future template updates do not recreate it. :::caution[Changing your billing country may create, update, or migrate tax profiles and the related tax data. Review this page after a country change.] ::: ## Billing country rules Billing country rules determine how VAT is handled based on the customer's billing country, and therefore which countries a customer can subscribe from. Rules are defined per customer billing country. Each country row shows two rules, one for **Business** customers (with a validated company tax ID) and one for **Personal** customers (without a validated business tax ID). For each you choose: - **Automatic rulebook** — Komashi applies the built-in VAT rules for that country and your provider's home country. This is the default. - **Charge VAT** — always apply VAT. - **No VAT** — apply a zero rate. Next to a Business rule, the **if VIES** (EU countries) or **if Tax ID** (other countries) badge shows what the customer must provide for the Business rule to apply. On your **Home country** row, a valid EU VAT number checked in VIES is what removes VAT for a business customer. A country can also be **Enabled** or **Disabled**. Customers from a disabled billing country cannot buy your services. Use the search field (countries, codes or regions), the filters, and the sort order to find a country quickly. Use the edit button on a row to change its rule, or use **Bulk actions** to apply a rule to many countries at once; Komashi asks you to review the affected settings before applying the bulk action. :::note[Because these rules govern how VAT is applied per country, they also affect which billing countries a customer can complete a subscription from. Review them before going live.] ::: Related: [Billing Details](https://komashi.com/docs/provider/Settings/07billing-details/index.md), [Service editor](https://komashi.com/docs/provider/Settings/03service-editor/index.md) --- # Payment Providers > Manage the payment methods available on your storefront. Open Settings → Payment providers in the Control Center. Canonical: https://komashi.com/docs/provider/Settings/08payment-providers/ Language: en Manage the payment methods available on your storefront. Open **Settings → Payment providers** in the Control Center. Video (English narration): [Payment providers in depth](https://www.youtube.com/watch?v=z0rQXDM2lUY) Use the search field to find a provider, and the country selector to filter methods available in your region. ![Payment providers overview](https://komashi.com/docs/assets/images/settings-payment-providers.png) :::note[Money flow] ``` End User → Payment Provider → Provider ``` Komashi is not involved in the money flow. ::: ## Method categories ### Admin payment methods Methods used for internal or provider-side payment handling. Not shown at checkout: - **Cash** - **POS Terminal** Enable them with the toggle to record payments you collect in person. ### Customer payment methods Methods shown to customers and used during checkout, for example **Barion**, **Mollie**, **PayPal**, **Stripe**, and **Bank transfer**. The list you see depends on your billing country; the country selector shows which methods are supported where. For each method you can: - **Enable or disable** it with the toggle. - Open **More info** to read about the provider. - Click **Settings** to enter your credentials (for example API keys) and configure the integration. - Mark it as the **Default payment method** to preselect it at checkout. ### Coming soon payment methods Requested methods that are not yet available. They appear in the list but cannot be enabled yet. Click **Notify me when available** to be told when one goes live. ## Enable a payment method 1. Find the method with the search field or by browsing the list. 2. Click **Settings** on the method card and enter the required credentials. 3. Turn on the toggle. ## Request a new payment method If the provider you need is missing: 1. Click **Request new**. 2. Describe the provider, region, and anything we should know. Keep it short and operational. 3. Click **Send request**. ![Request payment method dialog](https://komashi.com/docs/assets/images/settings-payment-request.png) Related: [Billing Details](https://komashi.com/docs/provider/Settings/07billing-details/index.md), [Invoicing Providers](https://komashi.com/docs/provider/Settings/09invoicing-providers/index.md) --- # Invoicing Provider > An invoicing provider is the service that generates and sends invoices to your customers after each successful payment. It is separate from the payment… Canonical: https://komashi.com/docs/provider/Settings/09invoicing-providers/ Language: en ## What is an invoicing provider? Video (English narration): [Invoicing providers](https://www.youtube.com/watch?v=6bGHDrMYMCg) An invoicing provider is the service that generates and sends invoices to your customers after each successful payment. It is separate from the payment provider — the payment provider handles the money, the invoicing provider handles the document. You connect your own invoicing provider to Komashi. Invoices are then issued automatically after every successful transaction, without any manual step. :::note[An invoicing provider is **not required** to start selling. You can issue invoices manually outside Komashi if you prefer. The invoicing provider integration is optional.] ::: ## Invoice methods Open **Settings → Invoicing providers** in the Control Center. Use the search field to find a provider, and the country selector to filter methods available in your region. ![Invoicing providers overview](https://komashi.com/docs/assets/images/settings-invoicing-providers.png) Available methods (for example **Billingo** and **Szamlazz**) appear as cards. For each you can: - **Enable or disable** it with the toggle. - Open **More info** to read about the provider. - Click **Settings** to enter your credentials. - Mark it as the **Default invoice method** to use it as your default invoicing provider. Komashi does not call your invoicing provider for checkouts with nothing to pay, such as a free plan or a free trial start. For those, the request is recorded as *skipped by policy* instead of failing, so a missing invoice there is expected and not an error. Methods under **Coming soon invoice methods** are requested but not yet available. Click **Notify me when available** to be told when one goes live. ## How to connect via API key Most invoicing providers connect through an API key: 1. Generate an API key in your invoicing provider's dashboard. 2. In Komashi, go to **Settings → Invoicing providers**. 3. Click **Settings** on the provider's card. 4. Enter the API key and any required details, then save. 5. Turn on the toggle. Once connected, invoices are generated and sent automatically after every successful payment. ## Request a new invoice method If your invoicing provider is missing: 1. Click **Request new**. 2. Describe the provider, region, and anything we should know. Keep it short and operational. 3. Click **Send request**. ![Request invoice method dialog](https://komashi.com/docs/assets/images/settings-invoicing-request.png) ## Manual invoicing If you prefer not to connect an invoicing provider, you can issue invoices manually outside of Komashi. The platform still tracks the transaction and subscription — the invoice document is your responsibility in this case. --- Related: [Payment Providers](https://komashi.com/docs/provider/Settings/08payment-providers/index.md), [Billing Details](https://komashi.com/docs/provider/Settings/07billing-details/index.md) --- # API keys > Create provider REST API keys, select their abilities, copy a new key and manage or revoke existing keys in Integration → API. Canonical: https://komashi.com/docs/provider/Settings/10api/ Language: en Open your provider's **Control Center → Integration → API**. The **API Keys** page manages credentials for REST integrations with that provider. For AI assistants, use the separate [OAuth MCP connection](https://komashi.com/docs/provider/Developers/mcp-integration/index.md). Video (English narration): [API keys](https://www.youtube.com/watch?v=NsTGVXPOLRk) [![API Keys page with the endpoint, reference link and existing key permissions](https://komashi.com/docs/assets/images/integrations-api-keys.png)](/assets/images/integrations-api-keys.png) ## Find the documentation and endpoint At the top of the page: - **Documentation** opens the interactive API reference. - **API endpoint** displays the base URL to use for REST requests, including `/v1`. Use these values from your environment. The local endpoint shown in a screenshot is an example, not the public endpoint to copy into a production integration. ## Create a key 1. Click **New API Key**. 2. Enter a **Key Name** that describes the integration, such as `Billing sync — production`. 3. Select its permissions. 4. Click **Create Key**. 5. Copy the generated value and store it in the integration's backend secret configuration before closing the dialog. The full key is displayed only immediately after creation. The list does not reveal it later. If you lose it, create a replacement and update the integration. ## Choose permissions New keys start with **Read** selected. | Permission | Examples | | --- | --- | | **Read** | List services and customers, read invoices, check usage. | | **Create** | Create customers, contacts or subscription checkout records. | | **Update** | Update records, synchronize or adjust usage, change plans, cancel subscriptions. | | **Delete** | Delete supported resources such as customers or contacts. | Abilities follow the operation's requirements. For example, subscription cancellation uses the Update ability even though its HTTP method is DELETE. :::caution[Keep at least one permission selected] In the current key form, saving an empty permission selection gives the key **Full access**. It does not create a key with no access. Select the exact abilities you need and check the badges in the list afterward. ::: Use a separate key for each backend integration so that replacing or deleting one key does not interrupt unrelated systems. ## Manage an existing key The list shows the key name, permissions, last-used time, creation time and action buttons. **Not used yet** means no use has been recorded for that key; it does not reveal whether the integration is configured correctly. To change abilities, click the **gear** action for the intended key, update the selection, and save. This changes what the existing key can do; check the permissions again after saving. ## Replace or revoke a key To replace a key without an unnecessary outage: 1. Create a replacement with the required abilities. 2. Update the backend integration's secret configuration. 3. Confirm that the integration works with the new key. 4. Click the old key's **trash** action and confirm **Delete key**. Deletion revokes the key permanently. Requests using it will no longer authenticate. This only affects that provider REST key; account-level MCP connections are managed in **Settings → MCP**. ## First request Follow [REST API integration](https://komashi.com/docs/provider/Developers/api-integration/index.md) for a `GET /services` example, response handling and the current endpoint inventory. --- # Webhooks > Configure outgoing event notifications, test delivery, understand signed JSON payloads and handle Komashi webhook retries. Canonical: https://komashi.com/docs/provider/Settings/11webhooks/ Language: en Webhooks send JSON notifications to your server when subscribed Komashi events occur. Open **Control Center → Integration → Webhooks** for the current provider. Video (English narration): [Webhooks](https://www.youtube.com/watch?v=a_2yS5qOMaQ) [![Webhook list showing endpoint, event subscriptions and the Test webhook action](https://komashi.com/docs/assets/images/integrations-webhooks.png)](/assets/images/integrations-webhooks.png) Use the selectable event list below as the supported configuration. Do not assume the existence of a generic payment or invoice event just because a record is visible in the REST API. ## Create an endpoint subscription 1. Prepare a publicly reachable endpoint that accepts JSON `POST` requests. 2. Click **New webhook**. 3. Enter its **Endpoint URL**, for example `https://your-app.example/integrations/komashi`. 4. Select at least one event. **Select All** and **Unselect All** change the selection for the form. 5. Click **Save**. Use a valid HTTP or HTTPS URL that the Komashi server can reach. A localhost address points to the sending machine, not your own development machine. A provider cannot create a duplicate subscription for the same endpoint URL. The list shows the endpoint, selected events, creation time and actions. Use the **pencil** action to change event selections, then save. The edit dialog shows the existing destination; to move to a different destination, create the replacement webhook and retire the old one after checking delivery. Deleting a webhook stops future deliveries for that configuration. It does not reverse changes already made by your receiver. ## Available events | Category | Event names | | --- | --- | | Customers | `customers.create`, `customers.update`, `customers.delete` | | Contacts | `contact.create`, `contact.update`, `contact.delete` | | Services | `services.create`, `services.update`, `services.delete` | | Service plans | `service.plan.create`, `service.plan.update`, `service.plan.delete` | | Service periods | `service.period.create`, `service.period.update`, `service.period.delete` | | Service prices | `service.price.create`, `service.price.update`, `service.price.delete` | | Service add-ons | `service.addon.create`, `service.addon.update`, `service.addon.delete` | | Add-on options | `service.addon.option.create`, `service.addon.option.update`, `service.addon.option.delete` | | Subscription plans | `subscription.plans.create`, `subscription.plans.update`, `subscription.plans.delete`, `subscription.plan.preview.link` | | Subscriptions | `subscription.create`, `subscription.update`, `subscription.delete` | Event names are exact strings, including their singular/plural differences. Only the events selected for an endpoint are delivered to it. ## Send a test webhook The **Test webhook** action is available after at least one webhook has been saved for a non-demo provider. 1. Click **Test webhook**. 2. Enter a **Test URL** that you control. 3. Choose the **Example event** to send. 4. Click **Send test webhook**. 5. Inspect the received request on your server and the success or failure notification in Komashi. The test uses fictional example data and does not create or update Komashi records. It performs one test request; it is separate from the queued retry mechanism for real events. A maximum of 10 test deliveries per minute is allowed. The current test sender uses the first saved webhook's signing secret. With multiple webhook configurations, do not assume the test signature uses the secret belonging to the URL entered in the test dialog. Demo providers do not dispatch outgoing webhooks and do not offer the normal webhook mutation and test actions. A demo screen can show seeded configuration without delivering requests. ## Request format A delivery contains these headers: ```text Content-Type: application/json X-Webhook-Event: customers.update X-Signature: ``` The JSON envelope has three fields: ```json { "event": "customers.update", "timestamp": "2026-10-22T10:00:00+00:00", "data": {} } ``` `data` contains the event-specific resource payload. Its fields vary by event; the example above intentionally omits resource fields. Test payloads are examples and should not be treated as a complete schema for every real event. Reconcile the current resource through the API when your workflow needs authoritative state. ## Verify the signature Komashi signs the JSON body with HMAC-SHA256 using the webhook's own secret. Verify against the **original request bytes**, before parsing or reserializing JSON. The signature is lowercase hexadecimal without a `sha256=` prefix. The current Webhooks page does not expose a copy/reveal control for the generated secret. The verification example below requires that matching secret to have been supplied securely to your receiver; an API key cannot replace it. ```js export function verifyKomashiWebhook(rawBody, signature, secret) { if (!secret || !/^[a-f0-9]{64}$/.test(signature ?? '')) return false; const expected = createHmac('sha256', secret).update(rawBody).digest(); const received = Buffer.from(signature, 'hex'); return received.length === expected.length && timingSafeEqual(received, expected); } ``` Pass your HTTP framework's raw request-body buffer to this function. Reject a failed signature before processing the event. ## Delivery and retries Real event notifications are queued after the database transaction commits. Delivery can therefore follow the business action with a delay. - A delivery has up to **four attempts**, with retry delays of **10, 60 and 300 seconds**. - The sender uses a **3-second connection timeout** and **10-second request timeout**. - Return a successful `2xx` response promptly after accepting the event. Process slower work asynchronously in your receiver. - A connection error, timeout or unsuccessful HTTP response can cause a retry. Retries can produce duplicates, including when your receiver processed a request but its response was lost. The payload does not provide a universal delivery ID or an ordering guarantee. Make processing idempotent using identifiers and state appropriate to your event. The timestamp and signature can change between attempts, so they are not reliable deduplication keys on their own. ## Troubleshooting | Problem | What to check | | --- | --- | | No notification | Correct provider, saved endpoint, exact selected event, and whether the provider is a demo. | | Test button is absent | Save a webhook first and use a non-demo provider. | | URL is rejected | Use a publicly reachable destination accepted by the safe-URL validation. | | Invalid signature | Matching webhook secret, raw bytes, hexadecimal signature and the test sender's secret-selection behavior. | | Repeated delivery | Return promptly and ensure idempotent processing. | | Current state differs from event | Read the resource through the REST API; notifications can arrive later than the original change. | Related: [REST API integration](https://komashi.com/docs/provider/Developers/api-integration/index.md), [API keys](https://komashi.com/docs/provider/Settings/10api/index.md). --- # Widget settings > Find the Service Picker and Subscription Details previews, copy embed code and replace placeholders before publishing a widget. Canonical: https://komashi.com/docs/provider/Settings/12widgets/ Language: en Open **Control Center → Integration → Widgets**. This page shows your provider's example embeds and copyable integration snippets. It does not create a separate saved widget configuration. Video (English narration): [Embed widgets](https://www.youtube.com/watch?v=q68rg-HXup8) ## Before you start Create a service first. If the provider has none, the page displays **Create a service first** with a link to **Manage services**, instead of the widget examples. For an existing service, choose one of the tabs: - **Service Picker** for the customer-facing service selection interface. - **Subscription Details** for an existing subscription's interface. ## Service Picker preview The **Embedded example** renders a service from the provider so you can inspect its content and pricing. It is a preview, not an instruction to create a real customer checkout from this page. [![Widgets page with the Service Picker preview and its copyable embed code](https://komashi.com/docs/assets/images/integrations-service-picker.png)](/assets/images/integrations-service-picker.png) Below the preview, find **Service Picker embed code** and click **Copy**. Paste it into your website, replace `YOUR_SERVICE_ID` with the intended service ID, and retain `data-view="service-picker"`. Changing a service's plans, prices or content is done in the service editor. Those service settings drive the rendered widget; this page is not a second pricing editor. ## Subscription Details preview Switch to **Subscription Details**. If a suitable subscription exists, the example displays its subscription interface. [![Widgets page with the Subscription Details example and its embed code](https://komashi.com/docs/assets/images/integrations-subscription-details.png)](/assets/images/integrations-subscription-details.png) Copy **Subscription Details embed code**, replace `YOUR_SUBSCRIPTION_ID` with the individual subscription's ID, and keep `data-view="subscription-details"`. If no suitable subscription exists for the example, the page asks you to create one before showing the preview. The Subscription Details embed snippet is still available when the provider has a service. A missing example is not an instruction to use a fake subscription ID. ## What to change in the copied code | Value | What to do | | --- | --- | | Script URL | Use the host generated for the environment you are publishing against. A local `.test` URL is only for local development. | | Service/subscription placeholder | Replace it with a real resource ID. | | `data-view` | Keep it aligned with the required ID type. | | `data-redirect-url` | Add it if your integration needs a supported return destination. | | Customer context | Supply `data-customer-id` only when your application knows and authorizes the appropriate customer. | Do not paste an API key into the HTML. The [Embed widgets](https://komashi.com/docs/provider/Developers/widget-integration/index.md) guide contains complete examples, attributes, layout notes and troubleshooting. --- # Analytics & tracking > Configure provider-level Google Analytics 4, Microsoft Clarity and PostHog tracking, including consent behavior and measurement checks. Canonical: https://komashi.com/docs/provider/Settings/13analytics/ Language: en Open **Control Center → Integration → Analytics** to connect visitor measurement for the selected provider. The page supports **Google Analytics**, **Microsoft Clarity** and **PostHog**. Video (English narration): [Analytics and tracking](https://www.youtube.com/watch?v=eSbEa4IUHvo) [![Analytics & Tracking page with Google Analytics, Microsoft Clarity and PostHog](https://komashi.com/docs/assets/images/integrations-analytics.png)](/assets/images/integrations-analytics.png) These settings connect your own analytics projects. View reports in the corresponding analytics service; this page stores the integration configuration. The Control Center's business dashboard and outgoing webhooks serve different purposes. ## Google Analytics 4 1. Open the intended GA4 property's web data stream and find its **Measurement ID**. 2. In Komashi, click **Edit tracking** next to **Google Analytics**. 3. Enter the **Google Analytics ID**, in the `G-XXXXXXXXXX` format. 4. Click **Save changes**. Use the Measurement ID, not a property number or Google Tag Manager container ID. The field accepts up to 12 characters. To disable this provider's GA integration, clear the value and save. ## Microsoft Clarity 1. Find the **Project ID** for your Clarity project. 2. Click **Edit tracking** next to **Microsoft Clarity**. 3. Enter the **Microsoft Clarity Project ID**. 4. Click **Save changes**. Enter the ID itself, not the complete embed script or a dashboard URL. The field accepts up to 10 characters. Clear the value and save to disable this provider's Clarity integration. Clarity supplies its own visitor behavior and session-insight features. Data availability depends on the project configuration, visitor consent and whether the tracking script can load. ## PostHog PostHog configuration requires both a **public project key** and an **ingestion host**. Use the values supplied for the same PostHog project and region. 1. Click **Edit tracking** next to **PostHog**. 2. Enter the **PostHog public project key**, beginning with `phc_`. 3. Enter the **PostHog host**, for example `https://eu.i.posthog.com` when that is your project's host. 4. Click **Save changes**. The host must be an HTTPS origin, optionally with a port. Do not include an ingestion endpoint path, query string or dashboard URL. A personal API key is not the public project key expected here. Both fields must be supplied together. To disable the integration, clear **both** and save. Saving PostHog settings requires a provider administrator. ### What Komashi sends to PostHog The provider integration records page views for storefront, service, checkout and customer page categories. It includes the provider identifier and a normalized page category/path. It does not enable automatic click capture, session recording, heatmaps or person profiles. Actual customer/checkout URLs, query parameters, referrers and page titles are not forwarded as-is; sensitive routes are replaced with generic page-category paths. This configuration is for page measurement, not an automatic full recording of every customer action. ## Consent and measurement Saving an ID does not by itself mean every visit is measured. Provider tracking is initialized when the visitor has accepted the analytics-inclusive cookie preference. Choosing only necessary cookies prevents analytics initialization. Changing preferences updates the tracking consent state. A tracking or ad blocker, an incorrect ID/host, or testing on the wrong provider can also explain missing events. Provider tracking is not a measurement of staff activity in the Control Center. ## Check the integration 1. Save the intended provider's values and reopen the page to check them. 2. Open a customer-facing storefront or service page for that provider. 3. Accept the analytics-inclusive cookie preference for your test visit. 4. Check the matching analytics project's realtime/debug or event view. 5. If nothing arrives, check the project and region, script/network blocking, and the visitor's consent state. Do not use “Not set” as a connection test: it only means the setting has no saved value. Conversely, a visible ID means configuration is saved, not that the external analytics service has confirmed delivery. | Symptom | Likely check | | --- | --- | | GA receives no visits | Correct GA4 Measurement ID, a customer-facing test page, consent and blocking extensions. | | Clarity remains empty | Correct project ID and successful script loading after consent. | | PostHog settings will not save | `phc_` public key, matching HTTPS origin, both fields supplied and administrator access. | | PostHog has page views but no replay | Session recording is disabled in this provider integration. | | Clearing PostHog fails | Clear both the public key and host together. | Related: [Developer overview](https://komashi.com/docs/provider/Developers/who-is-a-developer/index.md), [webhooks](https://komashi.com/docs/provider/Settings/11webhooks/index.md), [Storefront rules](https://komashi.com/docs/provider/Settings/02provider-rules/index.md). --- # Subscriptions > The Subscriptions page lists every subscription across your services. Open Business → Subscriptions in the Control Center. Canonical: https://komashi.com/docs/provider/subscriptions/ Language: en The Subscriptions page lists every subscription across your services. Open **Business → Subscriptions** in the Control Center. Video (English narration): [Subscriptions and plan changes](https://www.youtube.com/watch?v=0xpOQmwUJZU) The list shows the following columns: - **Customer** — who holds the subscription. - **Plan** — the plan they are subscribed to. - **Status** — the current state of the subscription (filterable). - **Price** — the recurring price. Use the **Status** filter to narrow the list — for example to review only active or cancelled subscriptions. Related: [Customers](https://komashi.com/docs/provider/customers/index.md), [Dashboard](https://komashi.com/docs/provider/dashboard/index.md) ## Subscription details and invoices Open a subscription to inspect its current plan, pricing, customer, and pending changes. Available actions depend on its status and your access. Review the confirmation screen before applying a change; editing a catalog price does not change the price of an existing subscription. Use **Subscriptions → Invoices** to review invoices across the provider, or open the customer's **Invoices** section for that customer's records. Invoice generation is configured separately under [Invoicing Providers](https://komashi.com/docs/provider/Settings/09invoicing-providers/index.md). ## Upgrades and downgrades When a plan or add-on change is made, the confirmation screen separates what happens now from what happens at the next renewal: - **Due today** — only the increases, prorated for the rest of the current period. The customer pays this to apply an **Upgrade fee**. - **Next renewal** — the new recurring amount, calculated from the plan and add-ons the subscription will have after the change. - **Decreases are not refunded.** A downgrade, or a lower add-on quantity, is **scheduled** and takes effect at the end of the current billing cycle (shown as *Scheduled downgrade* or *Downgrade pending*). The subscription stays active as it is until then, and the customer can cancel the downgrade request. One change can mix both: a higher plan applies immediately and is charged today, while a lower add-on is scheduled for the renewal. If a change is only a downgrade, nothing is charged today. One-time add-ons a customer already owns are shown as owned and are not selected or bought again when the plan changes; their quantity and usage carry over to the new subscription. The subscription page in the Control Center shows the same pending changes the customer confirmed at checkout. ## Archived providers and exports The **Archive** page is a read-only historical view for an archived provider. It shows subscription and invoice records; normal management actions are disabled there. Use **Export subscriptions CSV** or **Export invoices CSV** to download the corresponding records. --- # Who is a Provider? > A provider is a branded workspace on Komashi — a subdomain managed by one or more users through the Komashi Control Center. Canonical: https://komashi.com/docs/provider/who-is-a-provider/ Language: en A **provider** is a branded workspace on Komashi — a subdomain managed by one or more users through the [Komashi Control Center](https://komashi.com/docs/provider/Settings/01basic/index.md). If you sell any service that customers can buy or subscribe to, you are a provider. --- ## What a provider is in Komashi Each provider has its own: - **Subdomain** — your store lives at `yourbrand.komashi.com`. Set it up in [Basic Settings](https://komashi.com/docs/provider/Settings/01basic/index.md). - **Services and pricing** — what you offer and how customers pay. See [Manage Services](https://komashi.com/docs/provider/Settings/03manage-services/index.md). - **Customers and subscriptions** — everyone who subscribes to your services. See [Customers](https://komashi.com/docs/provider/customers/index.md). - **Billing details** — the single legal billing entity for this provider, used on the invoices you issue. See [Billing Details](https://komashi.com/docs/provider/Settings/07billing-details/index.md). - **Payments and payouts** — connected through your payment provider. See [Payment Provider](https://komashi.com/docs/provider/Settings/08payment-providers/index.md). - **Team members** — users you invite to help manage the provider. See [Users and Permissions](https://komashi.com/docs/provider/Settings/06user-and-permissions/index.md). --- ## Who can be a provider? - A **freelancer** selling a single service - A **company** offering multiple services - A **software provider** selling subscriptions - A **business** managing several products or brands --- ## Team members A provider can have multiple users with different roles. **Admins** have full access to all settings. **Operators** manage day-to-day tasks like customers and subscriptions, but cannot access billing or configuration settings. → [Learn more about Users and Permissions](https://komashi.com/docs/provider/Settings/06user-and-permissions/index.md) --- ## How the provider gets paid The provider is the seller. Customers pay through the provider's own payment provider, and payouts land directly in the provider's account. :::note[Money flow] ``` End User → Payment Provider → Provider ``` Komashi is not involved in the money flow. ::: --- In short, a **provider is the seller in the system** — the one who creates services, manages customers, and receives payouts.