Z28 Service Terms

Version 1.3 · November 4, 2026

How this agreement works

This Cover Page contains the Order Form and the Key Terms. Together with the Common Paper Cloud Service Agreement Standard Terms Version 3.0, posted at https://commonpaper.com/standards/cloud-service-agreement/3.0/ ("Standard Terms") and incorporated by reference, the accepted proposal, and Annex A (Data Processing) below, it forms the agreement between Provider and Customer. Capitalized words have the meanings given in this Cover Page or in the Standard Terms.

Order of precedence: (1) for personal data, Annex A and the standard contractual clauses it incorporates control over everything else, as those clauses require; (2) otherwise, this Cover Page controls over the accepted proposal, and both control over the Standard Terms.

Common Paper Cloud Service Agreement (Version 3.0) free to use under CC BY 4.0.

How the agreement is made

1. We send you an email with a link to your proposal. The proposal names your business, the plan (Starter, Growth or Custom), what we will set up and the fees, and has a button to a Stripe payment page.
2. On the payment page you can check and correct your details before you pay. To accept, you tick the box confirming that you agree to these Service Terms, and you pay the first amount.
3. You receive a payment receipt from Stripe and a confirmation email from us.
4. We keep a record of your accepted proposal, the date and the version of these terms. This page stays available at https://z28.tech/service-terms so you can save or print it, and we will email you a copy on request.
5. The agreement is in English. We do not subscribe to any code of conduct.

Parties

Provider: Andreas Papadopoulos (sole proprietorship), doing business as "Z28", Riga Feraiou - Ellispontou 42, 566 25 Sykies, Thessaloniki, Greece. GEMI no. 165306806000 · VAT no. EL150496621. Notice Address: legal@z28.tech.

Customer: the business named in the accepted proposal. Notice Address: the email address given at checkout.

Acceptance: the person who ticks the box and pays confirms that they are authorized to accept this agreement for the Customer's business. The agreement starts on that date.

Order Form

Plan: Starter, Growth or Custom, as stated in the accepted proposal, which lists the lead sources, what is set up, the monthly lead volume and the fees.

Cloud Service: the Z28 lead-response service. For the Customer's new leads from the sources in the accepted proposal, it:

• sends each new lead an automatic written reply by email in the Customer's name, normally within minutes;
• sends follow-up emails for up to 14 days. Follow-ups to a lead stop when the lead replies or unsubscribes, when an email to that lead bounces or is reported as spam, or when Customer asks Provider to stop for that lead (for example after the lead has booked a visit, which the Cloud Service cannot see when it happens outside it);
• logs each lead where the accepted proposal says (Customer's CRM, a Google Sheet or email);
• alerts Customer for each new lead and for each reply from a lead, and sends Customer a weekly report;
• on Growth, if Customer wants it, replies in English and Spanish.

Replies from leads go to Customer's own inbox. Every message the Cloud Service sends says that it was sent automatically.

Monthly lead volume: up to the number of new leads per month in the accepted proposal (Starter 100, Growth 300, Custom as agreed). If Customer gets more new leads in a month, the Cloud Service keeps replying to all of them. Provider tells Customer, and if it happens two months in a row, Provider may suggest the next plan. A change of plan needs Customer's written OK; there is no automatic extra charge.

Order Date: the date the Customer accepts this agreement at checkout.

Subscription Period: one month, starting on the Go-Live Date (the day Provider tells the Customer by email that the Cloud Service is live for them).

Cloud Service Fees: the monthly fee of the plan in the accepted proposal, in U.S. Dollars, exclusive of taxes.

Invoicing & Payment: automatic payment. Provider will automatically charge, and Customer authorizes Provider to bill and charge Customer's payment method on file through Stripe, once per Subscription Period in advance, for immediate payment or deduction without further approval. Customer authorizes all such charges. Provider will make a copy of Customer's bills or transaction history available to Customer.

Auto-renewal and Non-Renewal Notice Date: the Subscription Period renews automatically each month. Customer may give notice of non-renewal at any time before the next monthly renewal, by email to Provider's Notice Address or through the Stripe customer portal; the Cloud Service then stops at the end of the paid month. Provider will give notice of non-renewal at least 30 days before the end of the current Subscription Period.

Business day: in this agreement, Monday to Friday, except public holidays in Greece.

Technical Support: by email (reply to any email from Provider). Provider answers within one business day. Provider runs an automatic check of the Cloud Service every day and starts work on any problem it finds, or that Customer reports, within one business day. Support includes one small change per month of up to 2 hours of work, as described in the accepted proposal.

Professional Services: Provider will set up the Cloud Service for Customer as described in the accepted proposal, normally live within 7-14 days of the Order Date, after testing it with 10 test leads. Setup fee: as stated in the accepted proposal, in U.S. Dollars, exclusive of taxes. Payment process for these services: 50% of the setup fee is charged when Customer accepts this agreement; the remaining 50% and the first monthly fee are charged on the Go-Live Date. Customer will reasonably cooperate with Provider to allow the performance of the services described above, including providing Customer Content as needed. Provider is not responsible for any inability to perform these services if Customer does not cooperate as reasonably requested. Customer may cancel before the Go-Live Date by email; no further fees are then charged. Setup fees already paid are non-refundable, with one exception: if the Cloud Service is not live within 30 business days after the Order Date for reasons on Provider's side, Customer may cancel by email, and Provider will refund the setup fees Customer paid, minus any payment-processing, bank or transfer fees charged on those payments or on the refund that are not returned to Provider. Provider makes the refund without undue delay, to the payment method Customer used. The count starts on the first business day after the Order Date.

Key Terms

Effective Date: the date Customer accepts this agreement at checkout.

Governing Law: the laws of Greece.

Chosen Courts: the courts located in Athens, Greece.

Covered Claims:

• Provider Covered Claims: any action, proceeding, or claim that the Cloud Service, when used by Customer according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights.
• Customer Covered Claims: any action, proceeding, or claim that (1) the Customer Content, when used according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights; or (2) results from Customer's breach or alleged breach of Section 2.1 (Restrictions on Customer).

General Cap Amount: 1x the Fees paid or payable by Customer to Provider in the 12 month period immediately before the claim.

Supercap: notwithstanding Section 8.1, each party's total cumulative liability for all Increased Claims arising out of or relating to this Agreement will not be more than 2x the Fees paid or payable by Customer to Provider in the 12 month period immediately before the claim.

Increased Claims: breach of Section 3 (Privacy & Security); breach of Section 10 (Confidentiality) (however, excluding any data or security breaches).

Uncapped Claims: none, other than those in Section 8.4 (Exceptions) of the Standard Terms.

DPA: Annex A (Data Processing), below on this page.

Security Policy: Provider will use commercially reasonable efforts to secure the Cloud Service from unauthorized access, alteration, or use and other unlawful tampering, including the measures listed in Annex A, section 5.

Other Changes to Standard Terms:

1. No guaranteed results. Provider does not promise any number of leads, replies, booked estimates or sales.
2. Customer's lead sources. Customer is responsible for the notices and consents on its own forms, ads and other lead sources (including telling its leads that it will reply to them by email) and for its own advertising. Provider includes an unsubscribe link and Customer's postal address in every email it sends for Customer, and honors opt-outs.
3. No calls; texts only as an added extra. The Cloud Service does not make phone calls. It sends text messages only if a later written change to this agreement adds them, as a separately priced extra on Growth, after Provider has confirmed the consents and registrations that texting requires. Until then, no text messages are sent.
4. Automated messages. Messages Provider sends for Customer say that they are sent automatically. Customer will not ask Provider to present them as written by a person.
5. Logo Rights. The "Logo Rights" paragraph of Section 12 (General Terms) is replaced by: Provider may name Customer as a client, or use Customer's name or logo, only with Customer's written OK (email is enough), except as agreed under "Founding client pricing".
6. Deletion. In Section 5.5 (Effect of Termination), "within 60 days" is replaced by: within 30 days after the end of the agreement, as set out in Annex A, unless the law requires Provider to keep it.
7. Refund of setup fees. Section 4.1 (Fees) is modified by the refund in "Professional Services" above.
8. Founding client pricing. If the accepted proposal says "Founding client pricing", the section "Founding client pricing" below applies.

Founding client pricing

Applies only if the accepted proposal says "Founding client pricing" (our first two clients).

As one of our first two clients, you get 50% off the setup fee. In return, you agree to: (a) let us publish a short case study about your setup, using real numbers from your own reports, which we will show you first so you can correct any factual error; and (b) give us an honest written or recorded statement about your experience after at least 30 days live. Your statement can be positive, negative or mixed. The discount does not depend on what you say. We publish your words as you give them; we may shorten them without changing their meaning, and you approve the final version. Every time we use it, we say that you received this discount. You can ask us to stop using your name, logo or statement in new materials at any time. If you decide not to give a statement, you keep the discount.

Annex A - Data Processing

ANNEX A - DATA PROCESSING

1. Article 28 terms. For personal data that Provider processes for Customer under this agreement, the parties agree to the standard contractual clauses between controllers and processors in the Annex to Commission Implementing Decision (EU) 2021/915, incorporated by reference, with Customer as controller and Provider as processor, Clause 7.7(a) Option 2 (general written authorisation, with 14 days' prior notice of any intended change to the list of sub-processors), and Annexes I to IV of those clauses completed by sections 3 to 6 below.
2. Transfers to Customer. Because Customer is established outside the European Economic Area, Module Four (transfer processor to controller) of the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 applies to personal data that Provider makes available to Customer, incorporated by reference, with Provider as data exporter and Customer as data importer. Clause 17: the law of Greece. Clause 18: the courts of Greece. Annex I of those clauses is completed by sections 3 and 4 below.
3. Parties (Annex I). Controller and data importer: Customer, as named in the accepted proposal, with the contact email given at checkout. Processor and data exporter: Provider, as named on the Cover Page; contact: legal@z28.tech. Signature and accession date: accepted electronically at checkout on the Effective Date.
4. Description of the processing and of the transfer (Annex II; Annex I.B of the transfer clauses).
   • Data subjects: people who contact Customer (for example homeowners asking for an estimate); Customer's staff who use the service.
   • Personal data: name, email address, phone number and address if the lead gives them, project details and answers, messages, timestamps, delivery and unsubscribe status.
   • Sensitive data: none intended. Customer will not send any (see also "Prohibited Data" in the Standard Terms).
   • Nature and purpose: receive Customer's leads, send replies and follow-up emails in Customer's name, log each lead in the place Customer chooses (Customer's CRM, a Google Sheet or email), notify Customer of new leads and replies, produce Customer's reports, and review leads' replies each month to improve Customer's messages.
   • Frequency: continuous during the subscription.
   • Duration, return and deletion: for the length of the subscription. On request, Customer gets an export of its data. Data is deleted within 30 days after the end of the agreement, unless the law requires Provider to keep it.
   • Location: Customer's lead database is stored in the European Union (Cloudflare D1, EU jurisdiction). Form intake (Make) runs in its EU data region and email delivery (Resend) in its EU region (Ireland); both are US companies, so access from the United States is possible. AI processing (Anthropic) may take place in the United States.
   • Separation: each customer's data is kept separate and is never combined with another customer's data.
5. Technical and organisational measures (Annex III).
   • Encryption of all data in transit (TLS).
   • Access to production data only for named members of Provider's team, each with their own account and two-factor authentication; no shared logins.
   • Per-customer data separation in the database, with automated tests that prove one customer cannot read another's data.
   • Secrets and API keys only in the hosting provider's secret store, never in code or logs.
   • Logs without message content where possible, kept for a limited period.
   • Only the minimum needed goes to each sub-processor; the AI model receives no contact details.
   • Daily automated health check with an alert to Provider's team.
   • Retention and deletion jobs as described in section 4.
   • Personal data breach: notice to Customer without undue delay after Provider becomes aware of it (target within 48 hours), with the information listed in Clause 9.2 of the 2021/915 clauses.
6. Sub-processors (Annex IV, the agreed list for Clause 7.7(a) Option 2).
   • Cloudflare, Inc.: hosting of the service and the database.
   • Resend (Plus Five Five, Inc.): sending and receiving emails, EU region (Ireland).
   • Make (Celonis, Inc.): receiving leads from Meta lead forms, EU data region, only if used for Customer.
   • Anthropic: choosing and drafting message text, only if used for Customer; receives no contact details.
   • Google (Firebase Hosting): hosting of answer and report pages.

   Provider has data processing terms with each sub-processor. Customer's own tools that Customer asks Provider to send leads to (its CRM, its Google Sheet, its inbox) are Customer's choice and are not Provider's sub-processors.

7. Meta leads. Where Provider receives Customer's leads from Meta lead forms, Provider uses them only on Customer's behalf and does not combine them with any other advertiser's data.