Terms of
Service

Pilot Cloud by QUANTFLOW DOO. Last updated 14 October 2026.

1. Who and what

These terms are between QUANTFLOW DOO ("we") and the organisation that creates a Pilot Cloud account ("you"). The person who signs up confirms they may bind that organisation.
Pilot Cloud is a hosted service: a dedicated Pilot instance for your organisation, a web console, and connections to your GitHub, Linear or Jira. It takes tickets you label and returns pull requests.
Pilot (terminal) is software you run yourself under the Business Source License 1.1 (see Software licence below). These terms do not cover it beyond that section.

One account per organisation. One person is the owner; the owner may add members (when the invite feature ships; until then the account is single-user). Members act for the organisation.
You keep your credentials secret and tell us at hello@quantflow.studio if they leak.
You must be 18 or older and must not be subject to sanctions that prohibit us from serving you.

A dedicated instance, the console, connectors, upgrades, backups and support by email.
A monthly allowance of model usage on our Anthropic key, described in the pricing section at pilotcloud.dev/#pricing as a number of tickets on the default model, subject to the fair-use ceiling shown there. When the allowance is used up, the instance continues on your own Anthropic key if you have provided one, otherwise work pauses until the next billing period.
Usage on your own key is billed to you by Anthropic directly. We do not mark it up and we do not see that invoice.
No per-seat charges. The price is per organisation.
Rate limits and daily caps as published in the pricing section at pilotcloud.dev/#pricing or in the console, to protect the service from runaway usage.

You own your repositories and decide which ones Pilot may access. You review every pull request before merging it; Pilot's output is a proposal, not a release.
You provide the API keys and tokens Pilot needs (GitHub, tracker, optionally Anthropic) and you may revoke them at any time. Revoking a required key pauses the service.
You do not use the service to build a competing hosted offering, to attack systems you do not own, to process data you have no right to process, or in violation of Anthropic's or GitHub's acceptable-use terms.

Your code, tickets, and the pull requests Pilot opens in your repositories are yours. We claim no rights in them.
The service, the console and Pilot are ours (or our licensors'). The terminal software is licensed under the Software licence section below, not sold.
We do not use your repository contents to train models. Model requests go to Anthropic under Anthropic's commercial terms, which exclude training on API data.

The Privacy Notice at pilotcloud.dev/privacy describes what we store and where. In short: account data, connector identities, repository metadata, execution logs and usage metrics, on AWS in Frankfurt, in an instance dedicated to your organisation.
We encrypt secrets at rest, isolate organisations at the virtual-machine boundary, and keep backups for operational recovery.
We notify you without undue delay of a security incident affecting your data.

Prices are in the pricing section at pilotcloud.dev/#pricing, in USD. Paddle, our merchant of record, charges you, issues the invoice, applies tax and may show the amount in your local currency.
Billing is monthly in advance. The included allowance resets at each billing period and does not roll over.
We may change prices with at least 30 days' notice by email. The change applies from your next billing period after the notice.
If a payment fails, Paddle retries for up to 30 days. During that time the service may be limited; after it, the subscription ends.

The subscription renews monthly until cancelled.
You may cancel at any time from the console or via Paddle's customer portal. Cancellation takes effect at the end of the current billing period; the service stays available until then.
Refunds follow the Refund Policy at pilotcloud.dev/refunds.
We may suspend or end the service for breach of Your responsibilities, for non-payment, or if required by law, with notice where the law allows.
On termination we delete your instance and its data within 30 days, except what we must keep for accounting.

We aim for continuous availability but give no uptime guarantee during the design-partner period. We announce planned maintenance in the console.
Support is by email at hello@quantflow.studio, on business days.

The service is provided "as is". Pilot proposes code changes; you are responsible for reviewing and merging them.
To the extent the law allows, our total liability under these terms is limited to the fees you paid in the 12 months before the claim. We are not liable for indirect or consequential loss, lost profits or lost data caused by merged changes you accepted.
Nothing limits liability for fraud, wilful misconduct, or where the law does not allow limitation.

Pilot (terminal) is licensed under the Business Source License 1.1 in the LICENSE file of github.com/qf-studio/pilot. Each version changes to Apache 2.0 four years after it is published.
Production use is allowed unless you offer Pilot to third parties on a hosted or embedded basis to compete with Pilot Cloud. Internal use inside an organisation, at any size, is never a competitive offering.
Organisations with fewer than 10 employees, affiliates included, may make any production use, a competitive offering too. That grant ends 90 days after the organisation has 10 or more employees.

We may update these terms. Material changes are announced by email at least 30 days ahead. Continued use after that date is acceptance.

These terms are governed by the laws of Montenegro. Before litigation both sides try to settle by discussion for 30 days. After that, disputes go to the Basic Court in Podgorica.