Kaigen Company Terms
Last updated: November 10, 2026
These Company Terms apply when a company or other organization (the "Customer") buys or uses a Company Plan (Studio or Industry) or another per-seat plan from 16456383 Canada Inc., doing business as Kaigen ("Kaigen"). They supplement the Kaigen Terms of Service (the "Terms"), the Kaigen Software Licence Agreement (the "Licence") and the Refund Policy. They also apply to Enterprise customers, except where the Enterprise Agreement says otherwise. Capitalized words not defined here have the meaning given in the Terms. The person accepting these Company Terms confirms they have authority to bind the Customer.
1. Business purchase
1.1 The Customer buys for business purposes. Consumer protection rules, including rights of withdrawal, do not apply to Company Plans, to the extent the law allows.
1.2 The Customer confirms that its Finances and Seat count meet the requirements of its plan (Terms Section 5) and will move to the correct plan, or an Enterprise Agreement, within thirty (30) days of no longer meeting them.
2. Workspace, members and administrators
2.1 The Customer controls its workspace and decides who becomes a member, including through single sign-on and directory sync, and which roles they hold.
2.2 The Customer is responsible for its members, its administrators, its identity provider and directory, its CI Tokens and its AI Agents, and for their compliance with the Terms and the Licence. A breach by any of them is a breach by the Customer.
2.3 Kaigen may act on instructions from the Customer's owners and administrators, and from its identity provider and directory, without further verification.
2.4 The Customer is responsible for having a lawful basis, and giving any notice its members need, for the personal information it and its identity provider send to Kaigen and for the visibility administrators have under Terms Section 7.2.
3. Customer Data
3.1 "Customer Data" means the member and audit information Kaigen processes for the Customer under the Data Processing Addendum below.
3.2 As between Kaigen and the Customer, the Customer controls Customer Data. Kaigen uses Customer Data only to provide, secure and support the Services, as the Data Processing Addendum allows, and as the law requires. Ownership of content members create is governed by the Terms and by the Customer's arrangements with its members.
3.3 Kaigen does not use Customer Data to train or improve models. Kaigen does not use the Kaigen AI sessions of the Customer's members working in the Customer's workspace for that purpose unless a Customer administrator turns that on, and then only as Section 3.3 of the Privacy Policy describes.
4. Fees, Seats and invoices
4.1 Seats, renewals, refunds and plan changes follow the Terms and the Refund Policy. Fees for each term, including for Seats removed during it, are non-cancellable and non-refundable except as those documents state.
4.2 Invoiced amounts (for example under an Enterprise Agreement) are due within thirty (30) days of the invoice date. Late amounts may bear interest at one percent (1%) per month (twelve percent (12%) per year), or the maximum the law allows if lower, and Kaigen may suspend the Services after giving ten (10) days' notice of non-payment.
4.3 Fees exclude taxes. The Customer pays all taxes other than taxes on Kaigen's income. A Customer with a valid VAT or similar number is responsible for self-assessing reverse-charge taxes. If the law requires the Customer to withhold any tax from a payment, the Customer will pay such additional amount that Kaigen receives the full amount invoiced.
5. Mutual confidentiality
5.1 Each party will keep the other's non-public business, technical and pricing information, identified as confidential or which a reasonable person would understand to be confidential, confidential with at least reasonable care, and use it only for the relationship. This does not apply to information that is public through no fault of the receiving party, already known to it, independently developed, or that must be disclosed by law after notice where lawful.
5.2 Section 11.3 of the Licence continues to apply to Kaigen's confidential information.
6. Warranties
6.1 Each party confirms it has authority to enter into these Company Terms.
6.2 Except as stated in a signed agreement, the Services and the Kaigen Software are provided as described in the Terms and the Licence, including their disclaimers.
7. Liability
7.1 Sections 19 and 20 of the Terms apply, except that for a Customer the period in Section 19.2(A) of the Terms is twelve (12) months, so that the limit is the greater of the fees the Customer paid Kaigen in the twelve (12) months before the event giving rise to the claim and one hundred Canadian dollars (CAD $100). That limit also covers the Data Processing Addendum.
7.2 The limits in Section 19 of the Terms do not apply to the Customer's payment obligations, its indemnity obligations, or its breach of the Licence's restrictions.
8. Term and termination
8.1 These Company Terms last as long as the Customer has a Company Plan or Enterprise Agreement. Terms Section 21 applies.
8.2 After termination, Kaigen will delete Customer Data as described in the Data Processing Addendum.
9. Publicity
Kaigen may list the Customer's name and logo as a customer, unless the Customer asks it not to at legal@kaigen3d.com.
10. Disputes
Terms Section 23 applies. For Customers outside the United States, the courts of Vancouver, British Columbia have exclusive jurisdiction.
11. General
11.1 Terms in any purchase order, vendor registration, supplier code or similar document of the Customer do not apply, even if Kaigen signs or accepts it.
11.2 Sections 3.3, 4 (for amounts due), 5, 7, 9 and 10 survive termination, and Section 5 continues for three (3) years after it.
Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Company Terms between Kaigen and the Customer, and applies when Kaigen processes personal information on the Customer's behalf.
1. Definitions
"Data Protection Law" means all privacy and data protection laws that apply to the processing, including, where applicable, Canada's Personal Information Protection and Electronic Documents Act and provincial laws, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and US state privacy laws.
"Customer Personal Data" means personal information in Customer Data that Kaigen processes for the Customer: member identities, roles and seats; data from the Customer's identity provider and directory; and the Customer's audit log.
"Subprocessor" means a third party Kaigen engages to process Customer Personal Data.
"Controller", "processor", "personal data breach" and other terms have the meanings given in Data Protection Law, and under laws using other terms (such as "business" and "service provider"), the closest equivalents apply.
2. Roles and instructions
2.1 The Customer is the controller, and Kaigen is the processor, of Customer Personal Data. For Account, billing, security and product-usage information Kaigen collects to run its own business, Kaigen is an independent controller and its Privacy Policy applies.
2.2 Kaigen will process Customer Personal Data only on the Customer's documented instructions, which are the Company Terms, this DPA and the Customer's use and configuration of the Services, unless the law requires otherwise, in which case Kaigen will tell the Customer first where lawful.
2.3 Kaigen will tell the Customer if, in its opinion, an instruction infringes Data Protection Law.
2.4 Kaigen will not sell or share Customer Personal Data, or use it outside the direct business relationship with the Customer, except as Data Protection Law allows a service provider or processor to.
3. Details of processing
| Subject matter and purpose | Providing company workspaces: membership, roles, seats, sign-in, single sign-on, directory sync, member removal, audit logging and support |
| Duration | The term of the Company Plan, and deletion under Section 9 |
| Data subjects | The Customer's members, administrators and invited users |
| Categories of data | Names, email addresses, identity provider identifiers, group memberships, roles, seats, audit events with country, user agent and IP address (Enterprise) or a keyed hash of it (others) |
| Sensitive data | None intended. The Customer will not send special categories of data |
4. Confidentiality and security
4.1 Kaigen ensures that people authorized to process Customer Personal Data are bound by confidentiality.
4.2 Kaigen maintains the technical and organizational measures in Annex 1, and may update them provided the overall level of protection does not decrease.
5. Subprocessors
5.1 The Customer authorizes Kaigen to use the Subprocessors listed at kaigen3d.com/legal/subprocessors (Annex 2).
5.2 Kaigen will give at least thirty (30) days' notice of a new Subprocessor by updating that list and notifying Customers who subscribe to updates at legal@kaigen3d.com. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer's sole remedy is to terminate the affected Company Plan and receive a pro-rata refund of prepaid fees for the unused period.
5.3 Kaigen imposes data protection obligations on each Subprocessor that are no less protective than this DPA, to the extent applicable to the services it provides, and remains responsible for its Subprocessors' performance.
6. Assistance
Taking into account the nature of the processing, Kaigen will provide reasonable assistance, at the Customer's cost beyond normal support, with data subject requests, security, breach notification, data protection impact assessments and consultations with authorities. Kaigen will forward to the Customer any data subject request it receives about Customer Personal Data and will not respond to it except on the Customer's instructions or as the law requires.
7. Personal data breaches
Kaigen will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to it, and will take reasonable steps to contain it. Kaigen's notification is not an acknowledgement of fault or liability.
8. International transfers
Kaigen may process Customer Personal Data in Canada, the United States and other countries where it or its Subprocessors operate. For transfers of personal data subject to the GDPR to a country without an adequacy decision, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (Module Two, or Module Three where the Customer is itself a processor) are incorporated by reference, with the Customer as data exporter and Kaigen as data importer, the optional docking clause omitted, Option 2 of Clause 9(a) applying with the notice period in Section 5.2, the optional wording in Clause 11 omitted, the governing law and courts of Ireland, and Annexes completed from Section 3 and Annexes 1 and 2. For the UK, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated on the same basis, and for Switzerland the Standard Contractual Clauses apply with the amendments the Swiss Federal Data Protection and Information Commissioner requires. Canada benefits from an EU adequacy decision for commercial organizations subject to its federal privacy law.
9. Deletion
During the Company Plan, audit log entries are kept for a rolling twelve (12) months (or as an Enterprise Agreement states). Within ninety (90) days after the Company Plan ends, Kaigen will delete Customer Personal Data, except where the law requires it to keep it, and except backups, which are deleted in the normal backup cycle and kept confidential until then. On request made before the end of the Company Plan, Kaigen will provide a copy of the member list in a common format.
10. Audits
Kaigen will make available the information reasonably necessary to demonstrate compliance with this DPA, by answering a written security questionnaire no more than once a year. Where Data Protection Law requires more, the Customer may conduct an audit at its own cost, on thirty (30) days' notice, during business hours, no more than once a year, subject to confidentiality and without access to other customers' data.
11. Liability and precedence
11.1 Each party's liability under this DPA is subject to the limits in the Company Terms.
11.2 If this DPA conflicts with the Company Terms on the processing of Customer Personal Data, this DPA prevails. The Standard Contractual Clauses prevail over this DPA where they apply.
Annex 1: Security measures
- Encryption of data in transit (TLS) and at rest in our infrastructure provider's storage.
- Access to production systems limited to authorized personnel with strong authentication.
- Passkeys required for company owners and administrators.
- Device credentials tied to device security hardware where available; each device revocable at any time.
- Sign-in codes and CI Tokens stored only as one-way or keyed hashes, and IP addresses in the audit logs of non-Enterprise Customers stored only as keyed hashes.
- Immediate sign-out on every device when a member is removed.
- Logging of administrative actions in the company audit log.
- Automated protection against bots, credential stuffing and abuse.
- Monitoring of public code for leaked CI Tokens, with automatic revocation.
- Incident response and breach notification procedures.
Annex 2: Subprocessors
Current list (published at kaigen3d.com/legal/subprocessors):
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage, delivery, security, email sending | Global network; United States |
| Stripe, Inc. and affiliates | Payments, billing, tax | United States, Ireland |
| Google LLC (Gmail) | Business email and support | United States |
Identity providers (such as Okta, Microsoft Entra or Google Workspace) are chosen and contracted by the Customer and are not Kaigen's Subprocessors.
Contact: 16456383 Canada Inc., doing business as Kaigen, 329 Howe Street, Unit 233, Vancouver, British Columbia V6C 3N2, Canada. legal@kaigen3d.com, privacy@kaigen3d.com.