UG Labs API & SDK Terms of Service

Last updated: October 12th, 2025

1. Acceptance of Terms

By accessing or using the Services, you agree to be bound by these Terms and our Privacy Policy and SDK Privacy Policy. If you are acting on behalf of an organization, you represent that you have authority to bind that organization. If you do not agree, do not use the Services.

2. License and Usage Rights

2.1 License

UG Labs grants you a limited, revocable, non-exclusive, non-transferable license to integrate and use the SDK and API solely for approved applications ("Apps") in accordance with these Terms.

2.2 Restrictions

You may not:

Reverse engineer, decompile, or modify the SDK or API
Use the Services to build a competing product
Circumvent authentication, usage, or rate limits
Store or transmit malicious code
Use the Services in violation of any applicable law, including COPPA or GDPR-K
Remove proprietary notices or trademarks
Use the Services to process real children's data in non-production environments (see Section 3.3)

2.3 Attribution

If requested, you must display "Powered by UG Labs" or similar attribution in your product documentation or user interface.

3. Developer Responsibilities

3.1 Compliance

You are solely responsible for your App's design, operation, and legal compliance, including obtaining verifiable parental consent where required.

3.2 Privacy Notice

You must maintain a clear privacy notice explaining how your App interacts with UG Labs' SDK and link to UG Labs' SDK Privacy Policy.

3.3 Environment Restriction (Children's Data)

You must NOT run or test the SDK on actual children's data in the staging environment (stg.*.uglabs.app).

All production traffic involving real child users must occur only through the production environment (prd.*.uglabs.app).

4. Data and Privacy

UG Labs processes certain data on your behalf as described in the SDK Privacy Policy.

Controller / Processor Roles: Depending on implementation, UG Labs acts as a data processor or joint controller.
Security & Retention: All personal data is processed under TLS encryption and strict access controls.

Children's Data: Your integration must comply with all child data-protection laws and obtain parental consent where necessary.

5. Account, API Keys & Rate Limits

You must register for a developer account to access the API and SDK. API keys are personal and non-transferable.

5.1 Rate Limit and Overage Fees

The default rate limit is 1,000 requests per minute or per plan period (as specified). If you exceed this limit, you shall pay the applicable overage fees or upgrade to a higher tier as defined in your pricing plan. UG Labs may throttle, suspend, or terminate your access for continued violations.

5.2 Key Security

You are responsible for keeping keys secure. All activity under your credentials is your responsibility.

6. Fees and Payment

If you exceed the free tier or subscribe to a paid plan, you agree to pay applicable fees per your order form or usage plan. UG Labs may update pricing with reasonable advance notice.

7. Intellectual Property

UG Labs and its licensors retain all rights in the SDK, API, and documentation. You own your applications and data, subject to the licenses granted herein.

8. Confidentiality

You may not disclose non-public information about the SDK, API, or UG Labs systems without written permission.

9. Acceptable Use

You must not:

Violate any law or third-party rights
Collect or process data deceptively or unsafely from children
Generate harmful or inappropriate content
Attempt to disrupt or degrade the Services

UG Labs may suspend or terminate access for any breach.

10. Termination

Either party may terminate with notice. UG Labs may suspend immediately if you breach these Terms, exceed limits, or pose security risks. Upon termination, you must cease use and delete all SDK materials.

11. Disclaimer of Warranties

The Services are provided "as is." UG Labs disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

12. Limitation of Liability

Total liability shall not exceed fees paid by you in the preceding twelve (12) months.

13. Indemnification

You shall indemnify and hold harmless UG Labs and its affiliates against any claims arising from your use of the SDK or violation of these Terms.

14. Compliance and Audit

UG Labs may request evidence of your compliance with privacy and child-protection laws. You agree to cooperate in good faith.

15. Governing Law and Dispute Resolution

These Terms are governed by the laws of the State of Israel. Exclusive jurisdiction rests with the courts of Tel Aviv-Yafo.

16. Changes to the Terms

UG Labs may amend these Terms from time to time. Material changes will be notified via email or developer dashboard. Continued use after notice constitutes acceptance.

17. Contact

Universal Grammar Ltd.
8 Ha'Arbaa Street, Tel Aviv-Yafo, Israel
Email: privacy@uglabs.io
Phone: +1 (646) 736-4500

Appendix A — Data Processing Agreement (DPA)

Last updated: October 12th, 2025

This Data Processing Agreement ("Agreement") forms part of the UG Labs API & SDK Terms of Service (the "TOS") between:

(1) Universal Grammar Ltd. ("UG Labs", "Processor", "Service Provider")
(2) the entity or individual that has accepted the TOS ("Developer", "Controller", "Business")

1. Subject Matter and Duration

UG Labs processes certain personal data on behalf of the Developer for the purpose of providing the UG Labs SDK, API and related services (the "Services"). Processing shall continue for as long as the Developer uses the Services or until termination under the TOS.

2. Roles of the Parties

Developer acts as data controller (or "business" under the CCPA).

UG Labs acts as data processor (or "service provider"). Where the parties jointly determine purposes and means of processing, they will execute a separate Joint Controller Arrangement.

3. Nature and Purpose of Processing

UG Labs will process:

Voice recordings and derived transcripts
Child's first name or nickname
Language spoken
Parent/guardian contact details (if provided)

solely to enable voice-based interaction, improve speech-recognition models (with consent), and operate the Services.

4. Types of Data and Data Subjects

Data Subjects: Children users of the Developer's applications and their parents/guardians.

Data Types: Audio data, text transcripts, basic identifiers (e.g., first name), and usage metadata as described in the SDK Privacy Policy.

5. Processor Obligations

UG Labs shall:

Process personal data only on documented instructions from the Developer.
Ensure confidentiality and train authorized personnel.
Implement appropriate technical and organizational security measures per Article 32 GDPR, including TLS encryption and access controls.
Notify the Developer without undue delay of any personal data breach and co-operate in mitigation and notification.
Assist the Developer in fulfilling data-subject rights requests.
Delete or return all personal data at the Developer's choice upon termination, except as required by law.
Make available information necessary to demonstrate compliance and allow reasonable audits not more than once per year.
Not engage sub-processors without notice and a written agreement imposing equivalent obligations.

6. Authorized Sub-Processors

The Developer hereby authorizes UG Labs to use the following sub-processors for the Services:

Sub-Processor	Purpose	Location
Google Cloud Platform	Hosting, storage, LLM runtime	USA / EU
Amazon Web Services	Voice transcription, PII detection	USA / EU
Eleven Labs Inc.	Audio generation	USA
Deep Infra	LLM inference	USA

UG Labs will inform the Developer of any intended changes to this list and give the Developer the opportunity to object on reasonable grounds.

7. International Transfers

UG Labs stores and processes data in Israel, the United States, and the European Union. Transfers from the EEA/UK/Switzerland to Israel rely on adequacy decisions; other transfers use the EU and UK Standard Contractual Clauses (SCCs). Upon request, UG Labs will provide a copy of the executed SCCs.

8. Developer Obligations

The Developer shall:

Ensure a lawful basis for collecting and sharing personal data with UG Labs, including verifiable parental consent where required.
Provide clear and age-appropriate privacy notices to users and parents.
Respond to data-subject requests and inform UG Labs as needed for assistance.
Not instruct UG Labs to process data in violation of applicable law.

9. Confidentiality and Security of Processing

Both parties must protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access using industry-standard security practices. UG Labs is certified under the kidSAFE+ COPPA Seal Program and follows the security controls set out in its SDK Privacy Policy.

10. Audits and Assessments

Upon reasonable notice, UG Labs will make available summaries of third-party security audits or certifications in lieu of onsite inspections. Onsite audits may occur only where required by law and subject to confidentiality and cost allocation.

11. Breach Notification

UG Labs will notify the Developer without undue delay after becoming aware of a personal data breach, providing information to allow the Developer to comply with its own notification obligations.

12. Liability and Indemnity

Each party's aggregate liability under this Agreement is subject to the limitations set out in the TOS. Each party shall indemnify the other for losses arising from its own breach of this Agreement or applicable data-protection law.

13. Governing Law and Jurisdiction

This Agreement is governed by the laws of the State of Israel, and the courts of Tel Aviv-Yafo shall have exclusive jurisdiction, unless mandatory local laws require otherwise.

14. Miscellaneous

If any provision is found invalid, the remaining terms remain in effect. In the event of conflict between this Agreement and the TOS, this Agreement shall prevail with respect to data processing activities.

Signed for and on behalf of UG Labs: