Terms of Service

Version 1.0 — effective 9 October 2026. Applies to every customer of the Cravit Gateway (the “Service”) provided by Cravit, Breda, the Netherlands (“Cravit”, “we”). By submitting the onboarding form, signing in to the admin console or using the Service you (“Customer”, “you”) accept these terms.

1. The Service

The Service is a hosted gateway between MCP-compatible AI assistants (such as Claude, ChatGPT and Microsoft Copilot) and the Customer’s Odoo instance. It authenticates each person with their own key, performs requests in Odoo as that person, within that person’s existing Odoo rights, enforces the model, field and write rules the Customer configures, asks for confirmation before changes, and records every request in an audit log.

The Service does not replace Odoo, does not store a copy of the Customer’s Odoo data beyond what is needed to answer a request, and is independent of any AI vendor. The Customer’s subscriptions with Odoo and with AI assistant vendors are separate agreements with those parties.

2. Account and administrators

1. Cravit creates the Customer’s gateway (a “tenant”) after approving the onboarding request. The first administrator receives their admin key by email; administrators can appoint further administrators from the console.
2. Administrators manage users, roles, Odoo connections and settings for the Customer and are responsible for the people and AI agents they give access to. Each user’s gateway key is personal and must not be shared.
3. Two-factor authentication is mandatory for administrators. The Customer keeps keys, authenticator devices and Odoo API keys confidential and informs Cravit without delay of any suspected compromise.
4. The Customer warrants that it is entitled to connect its Odoo instance and that its use of Odoo and of its AI assistants complies with those vendors’ terms.

3. Acceptable use

The Customer will not use the Service to break the law, to access data it is not entitled to, to circumvent the permission model, to overload or test the security of the Service without written agreement, or to process data of persons who have not been informed as required by law. Cravit may suspend a tenant that endangers the Service or other customers, and will inform the Customer as soon as reasonably possible.

4. AI assistants and automated actions

1. The assistant acts for the user. Any request an AI assistant sends through the Service is treated as an action of the person whose key was used. The Customer is responsible for the instructions its people give to their assistants and for the changes that result, exactly as if they had made them in Odoo themselves.
2. Confirmation and limits. The Service asks for confirmation before writing to Odoo and applies the roles, scopes and bulk limits the Customer configures. These controls reduce, but do not eliminate, the risk of unintended changes; the Customer keeps the rules appropriate for its data.
3. AI output is not Cravit’s advice. Cravit does not provide the AI models and does not warrant the accuracy, completeness or suitability of anything an assistant says or proposes. Decisions based on AI output remain the Customer’s.
4. Data sent to assistants. The data an assistant receives from Odoo through the Service is sent to that assistant’s vendor under the Customer’s agreement with that vendor. The Customer chooses which assistants, which users and which data; Cravit does not send Odoo data to any AI vendor on its own initiative and does not use Customer data to train models.
5. Prompt injection and content. The Service screens content coming from Odoo before it reaches the assistant. This is a safeguard, not a guarantee; the Customer remains responsible for the content in its Odoo and for reviewing changes proposed by an assistant.

5. Data protection

1. Roles. For personal data in the Customer’s Odoo that passes through the Service, the Customer is the controller and Cravit is the processor under the General Data Protection Regulation (GDPR). For the administrator and user contact details needed to operate the account, Cravit is the controller.
2. Location. The Service runs on Google Cloud in the European Union (region europe-west). Personal data is stored and processed within the EU/EEA. Cravit does not transfer Customer data outside the EU/EEA except where the Customer itself connects an assistant whose vendor processes data elsewhere.
3. What Cravit stores. Account and user records (names, email addresses, roles, keys in hashed form), each user’s Odoo API key encrypted with customer-managed keys in a secrets vault, configuration, and the audit log (who, which tool, which record, when, outcome). The audit log is kept for 12 months and does not contain the business content of records.
4. Processing agreement. These terms, together with this section, constitute the data processing agreement between the parties. Cravit processes personal data only on the Customer’s documented instructions, binds its staff to confidentiality, assists the Customer with data-subject requests and security incidents, and notifies the Customer of a personal data breach without undue delay after becoming aware of it.
5. Sub-processors. Google Cloud EMEA Limited (hosting, EU regions) and the email provider used for account notifications. Cravit informs the Customer of any intended change at least 30 days in advance; the Customer may object on reasonable grounds.
6. Deletion. On termination Cravit deactivates the tenant and deletes stored Odoo credentials and user records within 30 days; audit records are deleted at the end of their retention period. The Customer can request earlier deletion.
7. Rights. Requests from data subjects concerning data in the Customer’s Odoo are handled by the Customer; Cravit assists where the Service is involved. Questions about Cravit’s own processing go to the contact address below.

6. Security

Cravit applies measures appropriate to the risk, including: encryption in transit and at rest, per-user identity binding, customer-managed encryption keys for stored credentials, mandatory two-factor authentication for administrators, optional IP allow-listing, tamper-evident audit logging, separation between customers, and operation by an ISO 27001-certified organisation. Cravit staff access Customer tenants only to provide support requested by the Customer or to keep the Service running, and such access is logged.

7. Fees and billing

1. Fees are as published on the pricing page at the time of ordering: a monthly platform fee per Odoo instance including five users and one staging connection, and a monthly fee per additional user, billed on the actual number of active users at the end of each month. Onboarding is included.
2. The first month after approval is free. The subscription term is twelve months from the end of the free month, invoiced monthly, and renews for successive twelve-month terms unless either party gives notice at least one month before the end of the current term.
3. Prices exclude VAT and are in euro. Invoices are payable within 14 days. Cravit may adjust prices at the start of a renewal term with at least two months’ notice.
4. If an invoice remains unpaid 30 days after a reminder, Cravit may suspend the tenant until payment is received.

8. Term and termination

1. The agreement starts when Cravit approves the onboarding request and continues as described in section 7.
2. Either party may terminate with immediate effect if the other materially breaches these terms and does not remedy the breach within 14 days of notice, or becomes insolvent.
3. On termination the tenant is switched off, keys stop working and data is deleted as described in section 5. The Customer is responsible for removing the gateway from its assistants.

9. Availability and support

Cravit aims at an availability of 99.5% per month for the Service, excluding announced maintenance and causes outside Cravit’s control (including the Customer’s Odoo instance and the AI vendors). Support is provided on working days during Dutch office hours via support@cravitgateway.com. Cravit maintains the Service for the supported Odoo versions listed on the website and may retire support for a version with at least three months’ notice.

10. Liability

1. Cravit’s total liability under this agreement, per year, is limited to the fees paid by the Customer for the Service in the twelve months preceding the event giving rise to the claim.
2. Cravit is not liable for indirect or consequential loss, loss of profit, loss of data in the Customer’s Odoo caused by actions requested through an assistant, or losses resulting from the Customer’s configuration of roles, scopes and users.
3. These limitations do not apply to damage caused by intent or deliberate recklessness of Cravit’s management, or where limitation is not permitted by law.

11. Intellectual property

The Service, its software, documentation and brand remain the property of Cravit and its licensors; the Customer receives a non-exclusive, non-transferable right to use the Service during the agreement. All data in the Customer’s Odoo and all configuration the Customer enters remain the Customer’s. Cravit may use anonymised usage statistics to operate and improve the Service.

12. Changes

Cravit may update these terms. Material changes are announced by email to the administrators at least 30 days before they take effect; if the Customer does not accept a material change it may terminate at the end of the notice period without penalty. The current version is always available at this address.

13. Governing law

Dutch law applies. Disputes are submitted to the competent court in Breda, the Netherlands, after the parties have made a reasonable attempt to resolve the matter amicably. The Vienna Sales Convention does not apply.

14. Contact

Cravit · Breda, the Netherlands · support@cravitgateway.com · www.cravit.nl

Chamber of Commerce (KvK) and VAT numbers: see cravit.nl.