> **DRAFT – do not publish – pending legal review (TAS-793)**
>
> Draft of 2026-10-28 for TAS-792. English translation of [../de/agb.md](../de/agb.md); the German version is the lead text and prevails (§ 1(5)). Product decisions: [docs/decisions.md](../../../docs/decisions.md) up to 2026-10-27. Text in [square brackets] is a placeholder or a proposal that Samir fills in or confirms. Open legal questions: [open-questions.md](../open-questions.md).

# General Terms and Conditions (Terms) for OKConsent

As of: [publication date] · Version [1.0]

## § 1 Scope, provider, language

1. These Terms apply to all contracts for the use of OKConsent between **Dipl.-Ing. Samir Alibabic – Online Marketing** (sole proprietorship), Klugstraße 99, 80637 München, Germany ("**we**", "**OKConsent**"), and our customers ("**Customer**"). Customers may be **consumers** (§ 13 BGB, German Civil Code) or **businesses** (§ 14 BGB).
2. A **consumer** is any natural person who enters into the contract for purposes that cannot be attributed predominantly to their commercial or self-employed professional activity. When ordering, we ask whether the Customer orders as a consumer or as a business. If the answer is missing or unclear, we treat the Customer as a consumer.
3. Provisions that apply only to consumers or only to businesses say so.
4. Conflicting or deviating terms of a **business** apply only if we have expressly agreed to them in text form.
5. The contract languages are German and English. If the versions differ, the German version prevails.
6. The open-source components of OKConsent (runtime, schema, command-line tool, agent skill and integrations) are provided under the MIT licence. These Terms govern the hosted service; the respective licence governs use of the source code.

## § 2 Services

1. OKConsent is a hosted service for managing consent on websites. Depending on the plan it includes: a scanner that checks the Customer's website for services, cookies and requests; configuring and publishing a consent banner with blocking of services and Google Consent Mode; delivery of the script through a content delivery network; optional consent records; regular monitoring (scans and alerts); a generator for legal texts (privacy policy, cookie notice, legal notice); and access through a dashboard, REST API, command-line tool and MCP server.
2. **Plans.** There is a free plan and paid yearly licences. Paid plans include all features and differ only in the number of included sites:

   | Plan | Sites | Price per licence year |
   |---|---|---|
   | Free | 1 | €0 |
   | 1 site | 1 | €39 |
   | 3 sites | 3 | €64 |
   | 5 sites | 5 | €98 |
   | 10 sites | 10 | €169 |
   | 25 sites | 25 | €219 |
   | 99 sites | 99 | €489 |

3. **Site.** A site is **one domain with all its subdomains**, plus its **staging and development addresses**. Staging and development addresses cost nothing extra on any plan, the free plan included. The relevant domain is the registrable domain under the Public Suffix List including its private section; the customers of a platform are therefore different domains (`a.wordpress.com` and `b.wordpress.com` are two sites). Another domain is another site; country domains are separate sites too (`example.de`, `example.at` and `example.ch` are three sites). We recognise a staging or development address by its form alone; nothing is looked up and the Customer need not prove anything: (a) `localhost` and the names under `.localhost`, `.local`, `.test`, `.invalid` and `.example` always are; (b) a host outside the site's own domain is one if a staging word (`staging`, `stage`, `stg`, `dev`, `develop`, `development`, `test`, `testing`, `qa`, `uat`, `preview`, `sandbox`, `local`) stands as a whole word, split at hyphens, in a name part **below its registrable domain** (for example `staging.agency.org` or `shop-uat.agency.org`; a word in the name of the registrable domain itself does not count, so `local-bakery.de` and `qa-systems.com` are other sites); (c) a host on a known preview platform (for example `*.vercel.app`, `*.netlify.app`, `*.pages.dev`, `*.webflow.io`) is one if the site's own name (the name part of its domain, three letters or more) stands as a whole word or a whole sequence of words in the customer part of the host (for `shop.de`, `shop.vercel.app` and `shop-git-main-team.vercel.app` belong to it, `myshop-competitor.vercel.app` and `bestshop.netlify.app` do not). If every host of the site looks like a staging or preview address, the domain of the first host counts as the site's, and the others must belong to it or be preview addresses that carry its name. The rule is strict: a host we do not recognise is added by the Customer as a site of its own, or named with a staging word or the site's name. The full lists are in the documentation.
4. **Free plan.** It includes: one site; the hosted script, banner, blocking and Google Consent Mode; a setup scan and then one manual scan per calendar month, each scan covering at most 5 pages; verification runs of the setup (verifications): the first 10, until a verification has passed for the first time, are free, then one per calendar month; publishing and rollback; one API key; consent records kept for at most 365 days; a small "powered by OKConsent" link in the banner. **Not included** are scheduled scans and alerts, hosted legal texts, team members and invitations. A user can own (as owner) at most one organization on the free plan.
5. **Paid plans** include all features, in particular scheduled scans and alerts, hosted legal texts, team members, several API keys, consent records kept for up to 1095 days, and no "powered by" link in the banner.
6. **Protective limits.** To protect the service there are technical limits (for example on simultaneous scans, publications and previews per day, and requests per minute). They apply to all customers; the current values are in the documentation. The Customer must not circumvent them.
7. **Changes to the service.** We may develop and adapt the service. Changes beyond what is needed to keep the service in conformity with the contract are made towards consumers only under § 327r BGB (valid reason, no extra cost, clear and comprehensible information). [Check: reservation of changes towards businesses and consumers, § 308 no. 4 BGB, § 327r(2) to (4) BGB, see open-questions.md Q5 and Q7]

## § 3 Conclusion of contract and account

1. **Free plan.** By registering (signing in with an emailed link or with GitHub) the Customer makes an offer to enter into a contract for the free plan. We accept it by activating the account. There is no entitlement to a contract. [Incorporation of these Terms and information under Art. 13 GDPR: a notice with links to these Terms and the privacy policy on the sign-in page and in Checkout; built with TAS-924 (texts: notices-sign-up-and-order.md), see open-questions.md Q19]
2. **Paid plans.** The presentation of the plans on our website is not a binding offer. The Customer orders on the payment pages of our payment provider Stripe (Stripe Checkout). The order is placed by clicking the button that completes the purchase (labelled with the obligation to pay, [check wording: § 312j BGB]). The contract is concluded when we accept the order by an email confirmation or by activating the plan.
3. **Technical steps, correcting input errors, storing the contract text, languages:** see [Consumer information](consumer-information.md). After the order we send the contract text (these Terms and the order details) by email.
4. **Account and organization.** Use requires an account. Sign-in is passwordless, with a single-use emailed link (valid for 5 minutes) or with GitHub. All data belongs to an organization. Roles are owner and member. Owners manage members, invitations, API keys and payments. Every organization has at least one owner.
5. The Customer must give correct details when registering and keep their email address up to date. They keep access credentials and API keys secret (API keys are shown only once) and are responsible for actions under their account, as far as they are accountable for them. They tell us without delay if they suspect misuse.
6. The service is intended for persons aged 18 and over.

## § 4 Prices, payment, invoice

1. All prices are prices per licence year in euros and are charged **in advance for the licence year concerned**.
2. **No VAT.** The provider is a small business under § 19 UStG (German VAT Act). No VAT is charged or shown. The prices stated are the total prices; consumers pay no further price components. Invoices carry the note "No VAT is charged under § 19 UStG." [check wording]
3. **Payment** is made through Stripe by **card, PayPal or SEPA direct debit**. The payment provider is Stripe Payments Europe, Ltd., Ireland. Invoices and receipts are provided electronically through Stripe; the Customer manages payment methods and invoices in Stripe's customer portal, which is linked from the dashboard under "Billing".
4. **Failed payment.** If the payment for an upgrade (paragraph 5) fails, the previous plan stays; the licence does not end because of it. If the payment for a renewal fails, Stripe retries it; while that goes on, the plan stays active. If the attempts finally fail, the paid licence ends and the Customer falls back to the free plan at once; § 7 applies. [Open: whether the claim for the unpaid licence year remains, is waived or arises only pro rata, see open-questions.md Q4.] Statutory claims for late payment are unaffected.
5. **A change to a larger plan** (upgrade) is charged at once (a pro-rata invoice for the remaining time of the licence year) and takes effect at once when the payment has been received; the licence year runs on unchanged. **A change to a smaller plan** (downgrade) takes effect at the end of the paid licence year. The Customer declares a change of plan in Stripe's customer portal, which is linked from the dashboard under "Billing"; the customer portal is not used for cancelling (§ 5(5)).
6. Changes to our list prices do not apply to licence years already running or to existing subscriptions.

## § 5 Term, renewal, termination

1. **Free plan.** The contract runs for an indefinite period. The Customer may end it at any time; the organization and its data are deleted on request by email to support@okconsent.com. We may terminate the contract for the free plan with 30 days' notice in text form. Both sides' right to terminate for good cause is unaffected.
2. **Paid licence: term.** The first licence year begins when the paid plan is activated. After each licence year the licence renews for a further year unless terminated under the following paragraphs.
3. **Consumers.**
   1. *In the first licence year* the consumer may terminate at any time; the termination takes effect at the end of the first licence year.
   2. *After the first licence year* the consumer may terminate at any time with **one month's notice**. The licence ends one month after the termination (the period starts when the consumer cancelled), or at the end of the current licence year if that comes sooner. **The unused part of the paid licence year is refunded pro rata**, automatically to the original means of payment after the licence ends. The calculation is in the [cancellation terms for consumers](consumer-cancellation.md).
   3. Consumers may terminate contracts concluded through our website with the button **"Verträge hier kündigen"** ("Cancel contracts here", § 312k BGB). It is in the footer of every dashboard page, the sign-in page included, and on the billing page, and leads to our own cancellation page https://app.okconsent.com/kuendigen, where the consumer does not have to sign in; the website (TAS-791) will carry it too. On the page the consumer names the contract, chooses the type of cancellation (ordinary or extraordinary) and the time at which the contract is to end ("at the earliest possible time" is preselected; otherwise a day), gives their name and the email address of their account and, where we can name it, sees the day on which the contract ends; with the button **"jetzt kündigen"** they make the cancellation. A day on or before the earliest possible end counts as the earliest possible end; for a later day we confirm receipt at once and handle the cancellation by hand. We confirm it at once in text form with the content, the date and time of receipt and the end of the contract. Details are in the cancellation terms for consumers.
4. **Businesses.** The licence has a term of one year and renews for a further year each time. The business may terminate at any time with effect from the end of the current licence year. There is no pro-rata refund.
5. **Form.** Terminations are made through our cancellation page without sign-in or in text form (email to support@okconsent.com). Stripe's customer portal is not used for cancelling. We examine an extraordinary termination (paragraph 7); the contract ends only when we have confirmed it or good cause exists. For consumers § 5(3)(3) applies in addition.
6. **Effect of the end of a paid licence.** When the licence ends, the organization moves to the free plan; § 7 applies. Access and data are not deleted, except under § 7 or at the Customer's request.
7. **Termination for good cause** (§ 314 BGB) is possible for both sides. Good cause for us exists in particular if the Customer seriously breaches § 8, for example by scanning domains they are not entitled to check, or misuses or endangers the service. Before terminating we may restrict the service temporarily as far as needed to avert the danger; we hear the Customer beforehand where that is reasonable.

## § 6 Right of withdrawal for consumers

Consumers have a statutory right of withdrawal for contracts on paid plans. The [withdrawal information](withdrawal-information.md) with the model withdrawal form forms part of these Terms. The consumer can declare the withdrawal on our cancellation page without sign-in (the choice "Vertrag widerrufen") or in text form. We confirm receipt in text form. We carry out the withdrawal three days after its receipt (at once if an owner is signed in) unless an owner of the contract undoes it with the button "Das war ich nicht"; with the carrying out the contract ends, and we repay the payments without undue delay and in any event not later than fourteen days from the day on which we are informed about the decision to withdraw (less the value of the days used until the withdrawal is received, if the consumer expressly asked for the service to start before the withdrawal period ends; see the withdrawal information).

## § 7 Consequences of a change to a smaller plan

This applies when a paid licence ends or the Customer moves to a smaller plan (for example by termination, a finally failed payment or a downgrade). A downgrade is reversible: **nothing is deleted at once**, and an upgrade restores everything, up to date.

1. **Features.** Features that the new plan does not include are switched off. Scheduled scans and alerts stop; on an upgrade they start again, with one scan right away. Team members keep their membership but lose access until the plan includes team members again; owners and API keys are not affected.
2. **Hosted legal texts** go offline. A short notice appears at the same address. The published texts stay stored and can be exported. On an upgrade they are hosted again, with the current texts. **The Customer must make sure their website has no dead links to these pages** if they no longer host them. As long as the legal texts are not hosted, the Customer must publish their privacy policy and legal notice on their website themselves (they can export the texts); the statutory duties to do so remain theirs.
3. **Consent records.** Records older than the new plan keeps (365 days on the free plan) are **hidden** (no longer in statistics and export) and **kept for 30 days**. We warn the owners, and they can export the hidden records during that time. **After 30 days they are deleted.** An upgrade within the 30 days makes them visible again. A configured retention that is longer than the new plan's maximum applies only up to that maximum.
4. **Sites above the limit.** If the new plan includes fewer sites than the organization has:
   1. The **owner chooses** which sites stay active, at most as many as the plan includes. If their choice does not fill all places (for example after an upgrade that creates more places, but not enough for all sites), the oldest sites fill the remaining places; until they have chosen, the oldest sites stay active.
   2. They may **change the choice for 30 days after every plan change**, including after an upgrade that still leaves fewer places than sites. Every such change opens a new 30 days; an upgrade after which every site has a place closes the window and clears the choice.
   3. Sites without a place are **read-only** during that time: they can no longer be changed, published or scanned; reading, previews and deleting remain possible. If the owner deletes a site that was to stay, the next-oldest site takes its place.
   4. **After the 30 days without a further plan change** the choice is final and the other sites are **paused**: their script is no longer delivered, and the banner no longer appears there. **The Customer must remove the script from the pages of a paused site.** Nothing is deleted: configuration, drafts, versions, records and legal texts are kept. A site that is already paused stays paused through a further plan change (its period does not start again) until the owner chooses it in a new selection window (then another site gives up its place) or an upgrade gives it a place; the other sites without a place stay read-only until the window ends; an upgrade unpauses paused sites as far as the plan allows. If the owner deletes the site that stays, the next-oldest paused site can take its place.
5. We inform the owners by email and in the dashboard about the consequences: a downgrade that takes effect at a later time (for example at the end of the licence year) is announced beforehand and confirmed when it takes effect. An immediate downgrade (for example after a finally failed payment) is reported only once it has taken effect.
6. **When changes reach visitors.** Changes to the banner that depend on the plan (for example the "powered by" link appearing or disappearing) reach a site's visitors only with that site's next publication; a change of plan does not change published scripts by itself. Pausing sites (paragraph 4) and taking hosted legal texts offline (paragraph 2) take effect without a publication.

## § 8 Customer's obligations

1. The Customer may only **add and scan domains that they are entitled to control or to check**. Scheduled scans run only for domains where the service found the Customer's script.
2. The Customer remains **responsible for their website and its consent management**. They check the configuration, the scan results and the generated legal texts for accuracy and completeness before publishing, and approve publications.
3. The Customer uses the service lawfully. In particular they refrain from attacks on the service or other customers, circumventing protective limits and access restrictions, forging consent records, scanning third-party systems other than domains under paragraph 1, and use that puts excessive load on the service.
4. The Customer makes sure the script is removed from their pages after the contract ends, for paused sites and for sites they delete.
5. The Customer informs their staff and clients, as far as necessary, about the processing of their data by the service.

## § 9 Data, consent records, data protection

1. The Customer's data remains theirs. They grant us the rights we need to process it to provide the service.
2. **Consent records** are optional per site and off by default. What is stored: consent ID, revision, choices, timestamp, language, path and derived outcome; **no IP address, no user agent and no full URL**. Retention can be set per site (30 to 1095 days; at most 365 days on the free plan). Records are deleted after they expire. A record shows that a browser-like client reported a decision; it is supporting evidence and alone no proof that the visitor made the decision.
3. The Customer may export their records as CSV (up to 100,000 rows per export).
4. If the Customer deletes a site, its data is deleted (configurations, versions, records, legal texts, details for the legal texts). Backup copies expire after that within 35 days at most.
5. As far as we process personal data of visitors to the Customer's websites on the Customer's behalf, the [data processing agreement](dpa.md) (Art. 28 GDPR) applies and forms part of these Terms. Otherwise we process personal data under our [privacy policy](privacy-policy.md).

## § 10 Scans, legal texts, no legal advice

1. Scans, verifications and alerts report what was **observed** under the tested conditions. They are **not a legal assessment**. Legal assessments in the service are non-binding and marked as such.
2. The legal text generator produces drafts from reviewed text blocks and the Customer's details. They are **not legal advice**, do not replace it and do not take the particulars of an individual case into account. The Customer reviews and approves texts before publication; texts do not change by themselves after publication.
3. Whether a website is legally compliant depends on circumstances we do not control. We therefore do not promise that a website is legally compliant with OKConsent; the consumer's statutory rights for defects (§ 12) are unaffected. [Check: relation to §§ 327e(3), 327h BGB, see open-questions.md] We make no claim to IAB TCF or Google certification and no claim to eligibility for personalised ads that requires such certification.

## § 11 Availability and support

1. We aim to operate the service without interruption. We promise no specific availability.
2. Where possible we schedule maintenance that affects the service in advance.
3. The script is delivered through a content delivery network. It serves as a cache in front of our own delivery service.
4. The Customer receives support by email to support@okconsent.com. We promise no specific response time.

## § 12 Defects

1. **Consumers** have the statutory rights for defects of digital products (§§ 327 ff. BGB) or tenancy law, as applicable; these Terms do not restrict them.
2. **Businesses** have the statutory rights for defects, provided that the Customer notifies defects without delay. We remedy defects within a reasonable time.
3. The **free plan** is provided free of charge. [Check: liability and defect rights on the free plan, see § 13(5).]

## § 13 Liability

1. We are liable without limit for intent and gross negligence, for injury to life, body or health, under the Product Liability Act, when we have given a guarantee and for fraudulently concealed defects.
2. For **slight negligence** we are liable only for breach of an essential contractual obligation (an obligation whose fulfilment makes proper performance of the contract possible in the first place and on whose observance the Customer may regularly rely), and then limited to the **foreseeable damage typical for this type of contract**. Liability for slight negligence is otherwise excluded.
3. Towards businesses, liability under paragraph 2 is capped at the fee for the licence year concerned.
4. For loss of data we are liable for slight negligence only for the effort that would have been needed to restore the data had we made regular backups appropriate to the risk.
5. On the free plan we are liable only for intent and gross negligence.
6. Liability under paragraph 1 is unaffected; liability under paragraphs 2 to 5 also applies to our statutory representatives and vicarious agents.

## § 14 Changes to these Terms

1. For new contracts the version published when the contract is concluded applies.
2. Changes for existing contracts require the Customer's consent. We offer them in text form and point out the material changes. If the Customer does not agree, the previous terms continue to apply. We do not provide for consent by silence towards consumers. Changes to the service under § 2(7) are unaffected.

## § 15 Final provisions

1. German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. Towards consumers this choice of law applies only as far as it does not deprive them of the protection of mandatory provisions of the law of their country of habitual residence (Art. 6(2) Rome I Regulation).
2. If the Customer is a merchant, a legal entity under public law or a special fund under public law, the exclusive place of jurisdiction is Munich.
3. **Dispute resolution.** We are not willing and not obliged to take part in dispute resolution before a consumer arbitration board. The former EU online dispute resolution platform has been discontinued. [Have the lawyer check the information required by § 36 VSBG, see open-questions.md.]
4. If individual provisions are invalid, the rest of the contract remains valid; the statutory rules apply (§ 306 BGB).
5. Communication is in text form, usually by email to the address stored in the account.

## Annexes

- [Withdrawal information and model withdrawal form](withdrawal-information.md) (consumers)
- [Cancellation terms for consumers](consumer-cancellation.md)
- [Information for consumers before and after the order](consumer-information.md)
- [Data processing agreement](dpa.md) with [TOMs](dpa-annex-2-toms.md) and [subprocessors](dpa-annex-3-subprocessors.md)