TERMS AND CONDITIONS OF USE

Last updated: 21 July 2026

These Terms and Conditions of acquisition and use of the deco Platform (the "Terms") are entered into between deco and the Authorized User of the Platform, as defined below.

PRELIMINARY CONSIDERATIONS

DECO PLATAFORMA DIGITAL LTDA., a limited liability company headquartered at Rua Visconde de Inhaúma, No. 134, Suite 2001, Centro, Rio de Janeiro, RJ, ZIP Code 20.091-901, registered with the CNPJ/ME under No. 47.563.279/0001-85 ("deco"), is the owner, creator, holder, maintainer, and provider of the platform commercially known as "deco." deco is an AI-service company: it publishes open-source software and offers a service that operates its customers' digital experiences — sites, apps, and storefronts — with senior engineers, AI agents, and proprietary software. Based on the interest in the products and services it makes available, deco establishes these Terms, which will be governed by the conditions set forth below.

deco operates as part of a corporate group. Customers domiciled in Brazil contract with DECO PLATAFORMA DIGITAL LTDA. Customers domiciled outside Brazil may contract with deco.cx LLC, a Delaware limited liability company (the "US Entity"), under the terms of the applicable order form or master services agreement; where an order form or specific contract designates the US Entity as the contracting party, references to "deco" in these Terms are read as references to that entity, and the governing-law and jurisdiction provisions of that specific contract prevail over the Governing Law section below.

It is essential, before accepting these Terms, that you have read and satisfactorily understood this document. If you have any questions, please contact us at legal@decocms.com.

The Authorized User acknowledges that deco provides its products and services to third parties and maintains commercial partnerships for the joint exploitation of its business, and that these practices do not represent an infringement of these Terms. For clarity, these Terms do not confer any exclusivity in the use of the Platform to the Authorized User or to any User registered by it.

By agreeing to this document, the Authorized User and its Users fully accept the terms described herein and bind themselves to the rules contained herein, including those that may be modified by deco. deco will make commercially reasonable efforts to notify the Authorized User of material changes to these Terms in advance, by email or by notice within the Platform, whenever the modification materially affects the Authorized User's rights; changes take effect on the date indicated in the notice or, absent a date, upon publication, and continued use of the Platform after that date constitutes acceptance.

The Authorized User and its Users declare that they accept the Platform in the technical state and condition it is in at the time of acceptance of this document for the contracted use.

Acceptance of these Terms is indispensable for use of the Platform.

DEFINITIONS

For the purposes of these Terms, the following terms have the meanings below:

"deco" means DECO PLATAFORMA DIGITAL LTDA., CNPJ/ME No. 47.563.279/0001-85, and, where designated in a specific contract as the contracting party, deco.cx LLC (Delaware).

"Authorized User" or "Customer" means the individual or legal entity that adopts deco's software or contracts the Services, and is responsible for managing the Users it designates.

"User(s)" means the registered person(s) who use the Platform under the responsibility of the Authorized User, who may be the same as the Authorized User.

"Party" / "Parties" means, as the case may be, deco, the Authorized User, and/or the User, individually or collectively.

"Registration" or "Account" means the location where the User's information is stored and through which the User accesses the hosted Platform.

"Platform" means deco's software and services made available to the Authorized User, however branded or packaged from time to time (currently including deco's open-source workspace and control plane, its CMS, and its apps), together with any related modules and the hosted instance available at studio.decocms.com. deco's open-source components are governed by their applicable open-source licenses.

"Services" means the operation and professional services deco provides to the Authorized User (such as auditing, implementation, sustaining and evolution, and optimization of digital experiences), as detailed in the applicable order form or contract.

"Agent" means an autonomous or semi-autonomous software agent made available through the Platform that performs tasks and may take actions on the Customer's behalf according to the Customer's configuration and instructions.

"Self-Hosted Deployment" means a deployment in which the Authorized User runs deco's open-source software on its own infrastructure, with its own keys and data. "Managed Service" means a deployment in which deco hosts and/or operates the software and Services on the Customer's behalf.

"Customer Content" means the content, data, code, configurations, applications, and other materials that the Authorized User or its Users submit to, create within, or generate through the Platform.

When these Terms refer to a clause or section, those references are to these Terms unless otherwise specified. Terms defined in the singular have the corresponding meaning in the plural, and vice versa. The terms "includes" and "including" mean "including, without limitation."

OBJECT

deco makes available:

Open-source software — currently its Studio workspace and control plane, its CMS, and its apps — which the Authorized User may adopt as a Self-Hosted Deployment (on its own infrastructure, with its own keys and data) under the applicable open-source license, or use as a Managed Service provided by deco. The workspace is a private AI control plane for building, connecting, governing, and operating digital experiences and the agents that run them.
Services — deco's operation of the Customer's digital experiences with senior engineers, AI agents, and proprietary software, on an outcome-oriented basis, as detailed in the applicable order form or contract.

For the software licensed by deco (as opposed to open-source components governed by their own license), deco grants the Authorized User a temporary, non-exclusive license to use it, except for Customer Content and the applications developed by the Authorized User through the functionalities of the Platform, which are owned by the Authorized User, as set out in the Intellectual Property section.

The licensed technology is the intellectual property of deco and is subject to Brazilian Federal Law No. 9.609/98 (Software Law) and other applicable law. Open-source components of the Platform (including Studio's open-source components) are additionally licensed under their respective open-source licenses, and nothing in these Terms restricts rights granted to the Authorized User under those licenses.

REGISTRATION

Use of the hosted Platform includes cloud-hosted software accessed via URL (for example, studio.decocms.com), through a login generated for each User designated by the Authorized User. In a Self-Hosted Deployment, the Authorized User controls access to its own instance.

The authorization granted by deco for the hosted Platform is personal to the Account. Credentials must not be shared, and the same login must not be used by more than one person.

For login to the hosted Platform, Authorized Users and Users may authenticate through a third-party identity provider, such as Google or GitHub.

Registration must contain only truthful information. deco is not responsible for the suitability or legal capacity of Users; each User must act with caution and discernment and is responsible for all activity carried out through its Account. The Authorized User is solely responsible for the access and activities performed by its Users and must promptly inform deco of any improper use or unauthorized access by third parties.

deco may deny or cancel the Registration of any Authorized User or User of the hosted Platform, regardless of prior notice, in case (i) any information presented is irregular, insufficient, or false; (ii) any indication of fraud or irregularity is identified; (iii) a Registration has been created in duplicate; or (iv) the originating Registration has been cancelled for infringement of these Terms.

Use of any publicly available feature of the Platform that does not require Registration, including the free diagnostic, constitutes acceptance of these Terms by the person or entity using it, to the same extent as if they were an Authorized User.

PRODUCTS, SERVICES, AND PLANS

deco does not charge for its software; it charges for the service and the results it generates. The software is open source and free to self-host. deco offers, without limitation, the following ways of working together, the current details of which are on the pricing page at https://decocms.com/pricing and in the applicable order form or contract:

Self-serve (free). Adopt the open-source software as a Self-Hosted Deployment, with the Customer's own AI keys, infrastructure, and data, plus the free public diagnostic, community, and documentation.
Enterprise. A Managed Service (SaaS) or assisted self-hosting, with SLA-backed support, direct access to engineering, onboarding and training, and sustaining by allocated engineers.
Operation by result. 24/7 agents plus embedded Forward Deployed Engineers operating the digital experience under a plan with goals and a baseline, where deco's remuneration is a fixed component plus a share of the incremental growth it generates, measured by A/B testing in production.

Where a plan meters usage of hosted infrastructure (for example, by requests, bandwidth, pageviews, seats, AI usage, or a share of GMV), the metering basis and prices are those set out in the applicable order form or on the pricing page, and monthly usage for a given calendar month is appraised in the following month. To move from a free or self-serve arrangement to a paid Service, contracting takes place through the formalization of a specific order form or contract with deco.

The Customer may add or remove modules and Services according to its interest and deco's availability. Cancellation of one or more modules occurs as previously established between the Parties and does not necessarily imply cancellation of the other Services and modules. Modifications to the Platform for improvement or correction are carried out by deco and are not considered a contractual renewal.

AI FEATURES AND AUTONOMOUS AGENTS

The Platform includes AI-powered features and autonomous or semi-autonomous Agents. The following terms govern their use, in addition to the rest of these Terms.

Agent actions and human oversight. Agents perform tasks and may take actions on the Customer's behalf according to the Customer's configuration, instructions, connected integrations, and granted permissions (which, by default, may begin as read-only). Where the Platform provides human-in-the-loop review or approval controls — for example, proposing changes as pull requests for the Customer to review before they go live — the Authorized User is responsible for configuring and using them appropriately, and remains responsible for the actions Agents take under its configuration and for the outcomes of those actions.

Nature of AI output. AI features rely on probabilistic models and may produce output that is inaccurate, incomplete, or otherwise unexpected. AI output is provided "as is" and does not constitute professional, legal, financial, or other advice. The Authorized User is responsible for reviewing AI output before relying on it or making it available to third parties.

Models and third-party providers. The Platform can route requests to multiple AI runtimes and model providers (which may include, among others, Anthropic, OpenAI, Google/Gemini, OpenRouter, Ollama, and coding runtimes such as Claude Code and Codex). In a Self-Hosted Deployment, the Customer uses its own keys and provider accounts. In the Managed Service, inputs and relevant context may be transmitted to and processed by these providers on a transient basis solely to provide the Services.

No training of foundation models on Customer Content. deco does not use Customer Content to train third-party or public foundation models, and does not sell Customer Content. deco may use aggregated, de-identified, or anonymized data derived from use of the Platform to operate, secure, and improve the Services. Any other use of Customer Content to improve deco's own models or Services is subject to the applicable order form or contract and to the Privacy Policy.

Acceptable use. The Authorized User must not use AI features or Agents to generate or disseminate unlawful, infringing, deceptive, harmful, or abusive content, to circumvent the security of the Platform or of third parties, or in any manner that violates applicable law or third-party rights. deco may impose reasonable rate, usage, and safety limits.

deco's OBLIGATIONS

deco will make its best efforts, without prejudice to the other obligations set out in these Terms and, if applicable, in the order form or master services agreement entered into between the Parties, to: provide the Managed Service with appropriate technical and operational infrastructure of quality, even if outsourced; maintain the quality standard of the software; provide technical support within the contracted limits; not carry out any acts that violate applicable law or any legal provision governing the treatment, storage, and transmission of data; and promptly inform the Authorized User of any impossibility of providing the Managed Service for operational, commercial, or legal reasons.

For the Managed Service, deco will inform the Authorized User about material updates, periods of unavailability, or other problems affecting the use of the contracted Service, whether arising from preventive or corrective maintenance. Where deco has prior knowledge of planned unavailability, it will inform the Authorized User at least 24 (twenty-four) hours in advance, by email or by notice on its websites. If the notice period cannot be met, deco will inform the Authorized User as soon as it becomes aware, prioritizing transparency.

RESPONSIBILITIES OF THE AUTHORIZED USER

The Authorized User declares and commits, without prejudice to the other obligations set forth in these Terms and in any order form or master services agreement between the Parties, to:

Accept the Services performed by deco whenever they are in accordance with the functionalities and specifications established by the Parties;
Not disclose, sell, lease, license, donate, assign, or transfer, in whole or in part, deco's proprietary software (including its source code, database, and images) or any related information to third parties, except with the prior written consent of deco or as permitted by an applicable open-source license;
Not carry out any acts that violate applicable law or any legal provision governing the treatment, storage, and transmission of data;
Ensure that its directors, employees, agents, and any third parties respect deco's intellectual property rights over the proprietary software and the confidentiality of deco's information to which they have access;
Immediately communicate to deco any violation of deco's intellectual property rights of which it becomes aware and assist deco in the defense of its rights;
Not use the Platform for a purpose other than the one for which it was contracted, nor in breach of these Terms or of applicable law and international treaties to which Brazil is a signatory;
If applicable, timely make all payments due to deco for the contracted Services or for exceeding contracted limits;
Communicate to deco whenever there are problems with the Platform, providing documentation, information, and error reports describing the circumstances;
Provide the current and complete documents and information that deco needs to provide the Services, for which the Authorized User is solely responsible for the truthfulness of form and content;
Configure and supervise Agents and AI features responsibly, including the use of any human-in-the-loop controls, and remain responsible for the actions Agents take under its configuration;
In a Self-Hosted Deployment, be responsible for the security, availability, keys, and data of its own instance;
Keep its registration data updated with deco; and
Ensure each User's agreement with these Terms, including provisions involving deco's intellectual property rights and any customizations made by the User on the Platform.

The Authorized User is responsible for the content, information, documents, and images it makes available or circulates through the Platform, and for complying with the rules of any regulatory bodies and sectors related to its field of activity.

PRICES AND PAYMENT

In return for the Services and, where applicable, the license to use deco's proprietary software, the Authorized User may pay deco a recurring fee, a fixed fee plus a share of the growth generated, and/or usage-based amounts, according to the plan or contract chosen. Further information on prices and payment methods is available on the pricing page at https://decocms.com/pricing and is detailed in any order form or contract entered into between the Parties.

LIMITATION OF WARRANTIES AND LIABILITIES

The technical specifications and functionalities of the Platform are established by deco and disclosed through its product and contracting surfaces. Technical requirements can be accessed at https://docs.decocms.com. It is the Authorized User's responsibility to meet the technical requirements for access and use of the Services.

As long as the Customer's obligations under these Terms are complied with, deco will maintain the Managed Service operational according to a minimum monthly availability of 99% ("SLA"), calculated over the total minutes of the month, subtracting eventual Unavailabilities in the same period. "Unavailability" means situations in which the Managed Service was entirely offline for Users. If there is non-compliance with the contracted percentage, the Customer will be entitled to Service Credits applicable to future payments, under the percentages and conditions set out in the applicable master services agreement. The SLA applies only to the Managed Service; it does not apply to free/self-serve use, and it does not extend to Self-Hosted Deployments, third-party AI model providers, or third-party integrations.

deco is not obligated to provide free technical support and maintenance in the following cases: if defects result from use of the Platform in non-compliance with these Terms or with deco's technical requirements; if defects result from modifications or interventions improperly performed by the Authorized User or a User (including in a Self-Hosted Deployment); if defects result from incompatibility with third-party software, programs, or databases, or from insufficient technical requirements of the Authorized User; if deco finds that the software has been used or modified in an unauthorized way or in violation of these Terms; or if they result from force majeure events beyond the reasonable control of deco, such as natural disasters, acts of war, terrorism, labor strikes, or widespread internet or third-party provider outages.

Requests, questions, or bug reports should be sent by the Authorized User or its Users to deco at support@decocms.com, with the relevant contracting information and a detailed description of the situation.

To the maximum extent permitted by law, deco, its parent, subsidiary, and affiliated companies will not be liable for indirect losses and damages, lost profits, or moral damages suffered by the Authorized User or any third party arising from these Terms, from misuse or use in disagreement with these Terms and/or a specific contract, or from any situation not caused by the exclusive and proven fault of deco. This includes losses arising from reliance on AI output or from actions taken by Agents under the Customer's configuration.

The Authorized User undertakes to maintain the proper functioning of its browser and internet connection for use of the hosted Platform, and cannot hold deco responsible for: (i) connection problems at the Authorized User's or its User's terminal; (ii) viruses, malware, or spyware affecting the Authorized User's or its User's devices; and (iii) incompatibility of the Platform with devices, browsers, and machines running outdated systems.

INTELLECTUAL PROPERTY

The Authorized User and its Users acknowledge that deco is the sole and exclusive holder of all intellectual property rights over the Platform, except for Customer Content and applications developed by the Authorized User through the tools of the Platform, which are owned by the Authorized User, and except for open-source components governed by their respective licenses. All related technical information and its subsequent revisions, modifications, improvements, customizations, and derivative works — including copyrights, patents, trade secrets, trademarks, source code, design, interfaces, know-how, databases, and algorithms — are and will be exclusively owned by deco, except for open-source components governed by their respective licenses.

The Parties acknowledge that the Platform allows the Authorized User to develop its own applications and digital experiences ("Authorized Applications"), and that the code developed by the Authorized User through the Platform, together with other Customer Content, is the intellectual property of the Authorized User.

The Authorized User grants deco a worldwide, royalty-free, non-exclusive license to host, store, reproduce, process, adapt, transmit, and display Customer Content and Authorized Applications solely to the extent necessary to provide, secure, and support the Services to the Authorized User, and to enable the operation of Agents configured by the Authorized User. deco may use aggregated, de-identified, or anonymized data derived from use of the Platform to operate and improve the Services. deco does not use Customer Content to train third-party or public foundation models, and does not sell Customer Content. This license terminates when Customer Content is deleted or when the Services terminate, except for retention required by law or for aggregated/anonymized data that no longer identifies the Customer.

Except with respect to Customer Content, Authorized Applications, and rights granted under an applicable open-source license, the Authorized User may not, in any way: (i) assign, copy, reproduce, adapt, modify, license, rent, or transfer deco's proprietary software or the right to use it, nor apply reverse engineering, disassembly, or decompilation; (ii) modify the features of the proprietary software beyond the parameters allowed by deco, nor allow third parties unauthorized access to it; (iii) modify or invalidate any authorization keys installed in the proprietary software; or (iv) use the proprietary software for a purpose other than what has been expressly authorized.

PRIVACY AND DATA PROTECTION

deco processes personal data in accordance with its Privacy and Data Protection Policy and applicable data-protection law, including the Brazilian General Data Protection Law (Law No. 13.709/2018 – "LGPD"). With respect to personal data that the Authorized User processes through the Managed Service (for example, data of the Customer's own end users), the Customer acts as controller and deco acts as operator/processor, processing such data only per the Customer's instructions and the contracted purposes. In a Self-Hosted Deployment, the Authorized User runs the software on its own infrastructure and is responsible for the personal data it processes; deco does not process that data except where it separately provides the Managed Service or support. The Privacy Policy is an integral part of these Terms and is available at https://decocms.com/privacy-policy.

This includes, without limitation, Google user data accessed when the Authorized User or its Users connect a Google account to the Platform, which is specifically governed by the "Google User Data (Google API Services)" section of the Privacy Policy, including its Limited Use commitments. In case of conflict between these Terms and that section regarding Google user data specifically, the Privacy Policy's Google User Data section prevails.

DURATION AND TERM

These Terms have indefinite duration, taking effect upon acceptance by the Authorized User and until termination, resolution, or expiry under their respective clauses and any contract between the Parties. Clauses that by their nature survive termination remain valid and binding for the periods defined herein or in applicable law.

deco may suspend the Authorized User's or a User's access to the hosted Platform, without the Authorized User being entitled to compensation, in the following cases: delay in payment of more than 15 (fifteen) days from the due date, regardless of prior communication; suspicion of non-compliance with these Terms, especially regarding providing access to unauthorized third parties; suspicion of irregular activities on the Platform, until investigated and resolved; provision of false, untrue, or incomplete information, until regularized; and determination by law.

Without prejudice to other sanctions in these Terms, a contract between the Parties, or applicable civil and criminal law, the Party that breaches any clause of these Terms must indemnify the other Party for the losses and damages caused. Further information on duration and termination of the commercial relationship should be the subject of a specific contract between the Parties.

THIRD-PARTY CONTENT AND INTEGRATIONS

The Platform may provide links to, and integrations with, other websites, services, and resources as a convenience to the User, including integrations the Customer chooses to connect (such as GitHub, Google Analytics, Search Console, VTEX, Shopify, and others). deco has no control over such third-party sites, services, or resources and is not responsible for their availability, content, products, or services. The User should review the terms and privacy policies of third-party services before providing any information or connecting them to the Platform.

GENERAL PROVISIONS

Notifications and authorizations under these Terms are valid only if made through the email indicated in the Authorized User's Registration or the email legal@decocms.com, with proof of receipt.

These Terms do not create any mandate and do not grant the Authorized User or its Users any power to represent deco before third parties.

Partial invalidity of these Terms will not affect the valid portion, provided the obligations are separable. The Parties commit to negotiate, as soon as possible, a valid replacement for any invalidated clause that reflects its original intention. Failure by any Party to enforce any provision is not a waiver of future enforcement.

Where the Authorized User and deco enter into a specific order form, master services agreement, or other contractual instrument, the provisions of that specific instrument shall prevail over these Terms in the event of conflict, but only with respect to the matters it specifically addresses.

The Authorized User may not assign these Terms or any right or obligation without the prior written consent of deco. These Terms constitute a valid and binding legal obligation on the Parties and their successors.

The Parties are independent and autonomous; these Terms do not create any mandate, partnership, association, consortium, joint venture, or commercial representation between them. Each Party is fully responsible for its own acts and obligations.

GOVERNING LAW AND JURISDICTION

For Customers contracting with DECO PLATAFORMA DIGITAL LTDA., these Terms are governed by the laws of the Federative Republic of Brazil, and any controversy arising from or related to these Terms will be submitted to the courts of the Judicial District of Rio de Janeiro/RJ — without prejudice to the Authorized User's or User's right, where applicable consumer-protection legislation so requires, to bring proceedings before the court of their own domicile. For Customers contracting with the US Entity, the governing law and jurisdiction set out in the applicable order form or master services agreement prevail.

For any questions, the User may contact us at legal@decocms.com.