fairyfly

Terms of Service for the fairyfly cloud service

Last updated: 9 November 2026 · Version 1.0

These Terms of Service are a translation. Only the German version ("Nutzungsbedingungen") is legally binding.

§ 1 Provider and scope

  1. The provider of the fairyfly cloud service at fairyfly.io (the "Service") is

    DataZoo GmbH
    Quellenstraße 7, 70376 Stuttgart, Germany
    E-mail: contact@data-zoo.de · for fairyfly: cloud@fairyfly.io
    Phone: +49 177 3073737
    Represented by the managing directors Dr. Simon Müller and Joachim Rosskopf
    Commercial register: Amtsgericht Stuttgart, HRB 769481 · VAT ID: DE323967692

    ("DataZoo", "we").

  2. These Terms apply to all contracts between DataZoo and the customer (the "Customer") for the use of the Service. The Customer is the legal entity (for example the company or the legal entity under public law) for which an organisation is registered in fairyfly. An organisation is a workspace of the Customer in the Service. A Customer can have more than one organisation. These Terms apply to each organisation of the Customer.

  3. The Service is only for businesses (entrepreneurs as defined in § 14 of the German Civil Code, BGB), legal entities under public law and special funds under public law. Consumers (§ 13 BGB) must not use the Service. At registration (§ 2(1)), the person who registers an organisation confirms that they act for a business in its commercial or independent professional activity and that they have the authority to represent the Customer.

  4. General terms and conditions of the Customer do not apply, also when DataZoo does not object to them. Individual agreements in text form have priority over these Terms.

  5. These Terms apply to the Service that DataZoo operates at fairyfly.io. The fairyfly desktop app has its own licence (Business Source License 1.1, https://github.com/DataZooDE/fairyfly/blob/main/LICENSE). These Terms do not apply to local use of the desktop app without the Service (command line, local MCP server) or to a gateway that the Customer operates itself ("self-hosted").

  6. The data processing agreement (DPA) under Art. 28 GDPR (https://fairyfly.io/dpa; German, binding: https://fairyfly.io/avv) is part of the contract, see § 10(2).

§ 2 Conclusion of the contract

  1. When a person registers an organisation on fairyfly.io, they confirm with a checkbox: "I accept the terms of service and the data processing agreement and act as a business (§ 14 BGB)." The words "terms of service" and "data processing agreement" link to the applicable versions. Registration is not possible without this confirmation.

  2. The contract, including the DPA, starts when the registering person gives the confirmation in paragraph 1, completes the registration, and DataZoo activates the organisation. Activation can be automatic. The DPA is thus made in electronic form (Art. 28(9) GDPR).

  3. For organisations that were registered before these Terms took effect, these Terms and the DPA apply when an owner of the organisation confirms them with the same checkbox at their next sign-in. This confirmation is necessary once for each organisation. Until an owner confirms, the organisation is paused: only sign-in, the confirmation, reading and exporting the audit log, closing the organisation, removing people, desktops and connections, and refusing pairing and access requests are possible, and the Service refuses calls of AI assistants.

  4. The Terms and the DPA are available at fairyfly.io at all times. They can be saved and printed.

  5. DataZoo can refuse a registration without giving reasons.

§ 3 Description of the Service

  1. The Service is a cloud gateway that DataZoo operates. It connects AI assistants (for example Claude, ChatGPT, Microsoft Copilot, Gemini Enterprise) through the Model Context Protocol (MCP) to the fairyfly desktop app on a Windows PC of the Customer. On that PC, the desktop app uses SAP GUI Scripting to operate the SAP GUI session that the user signed in to, with the user's own SAP user and authorisations. The Service includes a web app to manage the organisation, users, desktops, AI connections, audit and billing.

  2. The Service sends the calls of the AI assistants to the desktop and sends the results back. The gateway does not store screen contents, field values or results (details: privacy policy and DPA). The Service does not sign in to SAP and does not store SAP credentials.

  3. Safeguards. By default, actions that change data in SAP are blocked ("read only"). When an administrator allows changes for the organisation, the person at the PC where SAP GUI runs must also confirm each change. The detection of changing actions (the "read-only guard") uses the ID and the text of the screen elements. It is a safeguard, not a guarantee. It can classify actions incorrectly, especially in customer-specific transactions or screens.

  4. The Service supports SAP GUI for Windows. It does not support SAP Fiori or browser-based SAP applications. For the Service to work, the desktop app must run on the PC, it must be paired with the organisation, and an SAP GUI session must be signed in.

  5. The Service does not use AI assistants itself and does not send data to providers of AI models. The AI assistant is a client of the Customer that calls the Service (§ 7).

  6. No relation to SAP. fairyfly is a product of DataZoo GmbH. DataZoo is not affiliated with SAP SE. SAP does not authorise, certify or support fairyfly. SAP, SAP GUI and Fiori are trademarks of SAP SE. The same applies to the providers of the AI assistants and their trademarks.

  7. DataZoo develops the Service further. DataZoo can change, add or remove functions if the essential functions in paragraphs 1 to 3 stay available and the change is reasonable for the Customer. DataZoo announces significant restrictions in text form with a reasonable notice period.

§ 4 Organisation, roles and user accounts

  1. The Customer uses the Service through an organisation. The person who registers the organisation becomes an owner. Owners and administrators invite more people as administrators or members and manage users, desktops, AI connections, audit and billing. Only owners can appoint more owners. Members use the Service with their own desktops. Only an owner can close the organisation. The Customer must always have at least one owner who can act for the Customer.

  2. Users sign in with an existing account of a supported sign-in provider (at the moment: Google and Microsoft Entra ID). DataZoo does not receive a password. The terms of the provider and the rules of the Customer apply to these accounts.

  3. The Customer is responsible for:

    • the people it invites and their roles,
    • making sure that only its employees or people it engages get access,
    • the security of its users' sign-in accounts (for example multi-factor sign-in, blocking the account when an employee leaves) and of the paired PCs,
    • removing users who left and desktops that are no longer used, without delay,
    • all actions done with the accounts of its users, to the extent the Customer is responsible for them.

  4. The Customer makes sure that its users obey these Terms. The Customer tells DataZoo immediately at cloud@fairyfly.io if it suspects misuse or unauthorised use.

§ 5 Obligations of the Customer

  1. SAP licences and authorisations. The Customer has the necessary valid SAP licences for all use. The Customer makes sure that the use of SAP through fairyfly and AI assistants agrees with its licence contracts with SAP. This includes SAP rules for indirect or digital access and for automated use of user accounts. DataZoo does not check this.

  2. SAP GUI Scripting. The Customer makes sure that its SAP administration allows SAP GUI Scripting for the systems and users concerned (for example the profile parameter sapgui/user_scripting) and that the use agrees with its internal policies. Only the Customer sets the SAP authorisations of its users. The Service cannot do more than the signed-in SAP user is allowed to do.

  3. Validate workflows. Before the Customer relies on a workflow, it validates the workflow, first without change permission and, if possible, in a test or quality assurance system. AI assistants can read screens incorrectly, enter incorrect values or misunderstand instructions.

  4. Approve changes. The Customer (an administrator) decides if changes in SAP are allowed. The person at the PC checks each change before they confirm it. The Customer decides internally who can approve changes. For critical processes (for example postings, payments, master data) the Customer uses its own controls (for example the four-eyes principle).

  5. No circumvention. The Customer and its users must not bypass, disable or defeat the safeguards of the Service (read-only guard, confirmation at the PC, roles, budget and usage limits, audit log). This applies to technical means and to instructions to the AI assistant. They must not automate the confirmation at the PC.

  6. Lawful use. The Customer uses the Service only in compliance with the applicable law and with its contracts with third parties (especially SAP and the providers of AI assistants). It is not permitted, in particular:

    • to access SAP systems or data that the user is not authorised to access,
    • to attack the Service or third parties, to overload the Service, to do load tests without agreement, or to exploit security vulnerabilities (the Customer reports vulnerabilities it finds to cloud@fairyfly.io),
    • to reverse engineer the Service, except where the law permits it (§ 69e German Copyright Act, UrhG),
    • to resell the Service or make it available to third parties without the consent of DataZoo,
    • to multiply the free allowance (§ 9) with more than one organisation of the same Customer.

  7. Employees and works council. If the Customer switches on the optional audit trail with screenshots, it informs its employees and, where necessary, involves the works council (§ 87(1) no. 6 German Works Constitution Act, BetrVG).

  8. Backups. The Service is not an archive. The Customer exports audit data that it needs for a longer time itself (CSV/JSON, ZIP) or forwards it to its SIEM.

§ 6 Suspension

  1. DataZoo can temporarily suspend, fully or partly, the access of the Customer, of users, desktops or AI connections if there are concrete indications of a significant breach of these Terms or a risk to the security of the Service or of third parties, or a significant payment delay.

  2. DataZoo selects the mildest suitable measure, considers the legitimate interests of the Customer and informs the Customer before, if possible, otherwise without delay. DataZoo ends the suspension when the reason no longer exists.

§ 7 AI assistants and other third-party services

  1. AI assistants (for example Claude by Anthropic, ChatGPT by OpenAI, Microsoft Copilot, Gemini Enterprise by Google) are third-party services. The Customer uses them under its own contracts with their providers. These contracts control which data the AI assistant requests from SAP, how it processes the data and what it suggests to the user. DataZoo has no control over this.

  2. The providers of AI assistants are not agents or sub-processors of DataZoo. DataZoo gives no warranty for the availability, quality, correctness or lawfulness of the output and actions of AI assistants.

  3. If a provider of an AI assistant changes its interfaces or terms so that the connection stops working or works only partly, this is not a defect of the Service. DataZoo makes reasonable efforts to adapt the Service.

  4. The same applies to SAP software, to the sign-in providers and to the payment provider (§ 9).

  5. The Customer uses the AI assistants under its own responsibility. The Customer is responsible for its own obligations under Regulation (EU) 2024/1689 (AI Act) that apply to it as a deployer, for example sufficient AI literacy of the persons who use the AI assistants on its behalf (Art. 4 AI Act).

§ 8 Availability, maintenance, support

  1. DataZoo provides the Service with the care of a prudent businessperson. No specific availability (service level agreement) is agreed, unless the parties agree it separately in text form.

  2. DataZoo can temporarily restrict the Service for maintenance, updates and security measures. If possible, DataZoo does planned maintenance outside normal business hours (Monday to Friday, 8:00 to 18:00 CET/CEST) and announces longer interruptions in advance. Urgent security measures are permitted at all times.

  3. DataZoo is not responsible in particular for: the Customer's internet connection, PCs, SAP systems and networks, the desktop app on computers that the Customer does not keep up to date, and third-party services under § 7.

  4. DataZoo gives support through GitHub Issues (https://github.com/DataZooDE/fairyfly/issues) and by e-mail to cloud@fairyfly.io, without guaranteed response times. GitHub Issues are public, and GitHub, Inc. operates them under its own responsibility. The Customer does not post SAP contents, screenshots, personal data, credentials or other confidential information there. For such matters, the Customer writes an e-mail to cloud@fairyfly.io.

§ 9 Fees and billing

  1. The Service is billed by usage, by the number of operations. An operation is a tool call of an AI assistant that the Service sends to a desktop. Calls that the Service refuses before it sends them to a desktop (for example because of the organisation's settings, a desktop that is not connected, the budget or a missing payment method) do not count. A call that is refused at the PC counts. The prices that are published on fairyfly.io at the time of use apply. At the moment:

    • 1,000 operations per organisation and calendar month (UTC) are free (free allowance). Unused operations expire at the end of the month.
    • After that, €1.00 per started package of 1,000 operations, billed once a month for the previous month.

  2. DataZoo can add up more than one organisation of the same Customer for the free allowance. The free allowance then applies once to all these organisations together. If the Customer breaches § 5(6), DataZoo can also suspend the organisations concerned under § 6, and terminate the contract under § 14(4) for a serious breach or a breach that continues after a warning.

  3. Payment method. Use above the free allowance is possible only after an owner or administrator adds a payment method with Paddle on the billing page of the web app. Without a payment method (also after it is cancelled), the Service refuses calls above the free allowance until the end of the calendar month ("payment method required"). If a payment fails, the Service refuses calls above the free allowance until the payment method is updated. In both cases, the free allowance stays available. The Customer sees the usage, the costs so far and a forecast for the month in the web app.

  4. Payment through Paddle. Paddle.com Market Ltd. (London, United Kingdom) handles the order, payment, invoicing and VAT as reseller and merchant of record. With the payment method, Paddle sets up a subscription without a base fee, through which the started packages are charged once a month. For the payment, Paddle is the contractual partner of the Customer. The Paddle buyer terms also apply (https://www.paddle.com/legal/buyer-terms). Paddle issues the invoices.

  5. Budget. Owners and administrators can set a monthly budget in euros. The budget covers only whole packages, so the costs of a month do not exceed the budget. When the budget is reached, the Service either refuses more billable calls until the end of the month ("pause") or only sends a notification, as the Customer selects. If the Customer wants, it also sends a notification at 80 % of the budget. Notifications go by e-mail to the owners and administrators. The budget helps to control costs. The Customer is responsible for the setting. With the setting "notify only", all usage is billed.

  6. Price changes. DataZoo can change the prices with a notice period of at least six weeks. DataZoo sends the notice to the owners of the organisation in text form (e-mail). The new prices apply to use after the announced date. The Customer can end the contract at any time (§ 14). If the Customer continues to use the Service after that date, the new prices apply.

  7. The Customer must raise objections to a bill in text form to cloud@fairyfly.io within six weeks after it receives the invoice. After that, the bill counts as approved. DataZoo informs about this on the billing page of the web app. The usage counters of the Service are the basis of the bill; the Customer sees them in the web app.

§ 10 Data protection

  1. The privacy policy at https://fairyfly.io/privacy (German, binding: https://fairyfly.io/datenschutz) gives information on the processing of personal data.

  2. Where DataZoo processes personal data on behalf of the Customer (in particular user accounts, invitations, desktops, AI connections, SAP contents passed through, the audit entries that are shown or exported to the Customer or forwarded to its SIEM, and the optional audit trail with screenshots), DataZoo is a processor under Art. 28 GDPR. For this, the data processing agreement (DPA) at https://fairyfly.io/dpa (German, binding: https://fairyfly.io/avv) applies. The DPA is part of this contract. The Customer accepts it together with these Terms (§ 2). For the processing on behalf of the Customer, the DPA has priority if it does not agree with these Terms. Annex 3 of the DPA lists the sub-processors.

  3. DataZoo is itself the controller for the data that it processes for its own purposes (website, contract handling, billing, communication, security and abuse prevention, including the locked audit log of 400 days, legal retention obligations).

  4. The Customer is responsible for the lawfulness of the processing that it starts through the Service, in particular for the data that AI assistants get from SAP and for informing its employees.

§ 11 Confidentiality

  1. Each party keeps confidential all information of the other party that it receives under the contract and that is marked as confidential or is clearly confidential. It uses this information only for the contract and protects it at least as carefully as its own confidential information. This includes in particular the Customer's SAP contents, audit data and screenshots.

  2. This obligation does not apply to information that is or becomes public without a breach, that the receiving party already knew lawfully, that a third party gives to it lawfully, or that it developed independently. Legal or official disclosure obligations are not affected. If permitted, the party informs the other party before the disclosure.

  3. The parties give the same obligation to their employees and subcontractors. The obligation continues for three years after the end of the contract, and without time limit for trade secrets as defined in the German Trade Secrets Act (GeschGehG). Further obligations under the DPA are not affected.

§ 12 Rights to the Service, right of use

  1. All rights to the Service, the web app, the software, the documentation and the trademarks "fairyfly" and "DataZoo" belong to DataZoo or its licensors.

  2. For the term of the contract, DataZoo gives the Customer a simple (non-exclusive), non-transferable right, without the right to sublicense, to use the Service through the internet for its own business purposes by its users. The Service does not include delivery of software to the Customer. For the desktop app, § 1(5) applies.

  3. The data and contents of the Customer (in particular SAP contents, audit data, screenshots) stay with the Customer. DataZoo uses them only as necessary to provide the Service, for billing, for security and to obey legal obligations, and otherwise as the DPA states.

  4. If the Customer gives suggestions or feedback about the Service, DataZoo can use them free of charge and without restriction to improve its products, without disclosing confidential information of the Customer.

§ 13 Liability

  1. DataZoo has unlimited liability for intent and gross negligence, for culpable injury to life, body or health, under the German Product Liability Act (ProdHaftG), for fraudulent concealment of a defect, and where DataZoo gave a guarantee.

  2. For a slightly negligent breach of an essential contractual obligation (cardinal obligation), liability is limited to the foreseeable damage that is typical for this type of contract at the time the contract was made. Essential contractual obligations are obligations that make the proper performance of the contract possible and on which the Customer can regularly rely.

  3. In all other cases, DataZoo's liability for slight negligence is excluded.

  4. Actions of AI assistants in SAP. DataZoo is not liable for the content of actions that the Customer's AI assistant does in SAP, if

    • the Customer allowed changes in SAP for its organisation and the person at the PC confirmed the change, or
    • the Customer or its users caused or allowed the action in a different way (for example by instructions to the AI assistant, by bypassing the safeguards against § 5(5), or by SAP authorisations that permit the action).

    For DataZoo's own breaches of duty, in particular errors of the Service when it sends calls or when it shows a change for confirmation, DataZoo is liable under paragraphs 1 to 3. The read-only guard in § 3(3) is a safeguard, not a guarantee that it detects every changing action; for its errors, paragraphs 1 to 3 also apply. The Customer's obligations to check under § 5(3) and (4) are not affected. A breach of these obligations counts as contributory fault (§ 254 BGB).

  5. Data loss. For loss of data, DataZoo is liable only for the effort that would have been necessary to restore the data if the Customer had made proper backups (§ 5(8)), except in the cases of paragraph 1. The Customer backs up data stored in SAP with its own procedures.

  6. Indemnity. The Customer indemnifies DataZoo against claims of third parties (including SAP and the providers of AI assistants) that result from use of the Service by the Customer or its users against § 5, to the extent the Customer is responsible, including reasonable costs of legal defence.

  7. These limitations of liability also apply to the personal liability of the bodies, employees, representatives and vicarious agents of DataZoo.

  8. Claims of the Customer for damages become time-barred one year after the statutory start of the limitation period, except in the cases of paragraph 1.

  9. Strict liability for defects that existed when the contract was made (§ 536a(1) alt. 1 BGB) is excluded.

  10. Liability to data subjects and supervisory authorities under Art. 82 and 83 GDPR is not affected.

§ 14 Term and termination

  1. The contract has no fixed end date.

  2. The Customer can terminate the contract at any time without notice: an owner closes the organisation in the web app ("Close the organisation"), or the Customer writes to cloud@fairyfly.io in text form. When the organisation is closed, access ends immediately for all users. The usage until then is billed; after that, the Paddle subscription ends.

  3. DataZoo can terminate the contract in text form with one month's notice to the end of a calendar month.

  4. The right of both parties to terminate for good cause is not affected. Good cause for DataZoo exists in particular for a serious breach of § 5 or a breach that continues after a warning, for a payment delay of more than two months, or if the Customer is a consumer.

  5. Data after the end of the contract. Until the end of the contract, the Customer can export its audit data (CSV/JSON, audit trail sessions as ZIP). If DataZoo terminates (paragraph 3 or 4), the Customer can export until the termination takes effect. The contract ends when the Customer closes the organisation (paragraph 2) or when another termination takes effect; DataZoo then closes the organisation. Only from that time does DataZoo delete data: the e-mail addresses, names and provider IDs of all users immediately, the screenshots and field changes of the audit trail without delay; the desktops are blocked and their computer names deleted. DataZoo automatically and permanently deletes the other records of the organisation 90 days after closing. Exceptions are the audit trail step records (no contents) and the usage counters, which are deleted automatically after 400 days, the locked audit log (400 days) and records with a legal retention obligation. Copies in the database backups are removed at the latest 7 days after each deletion. § 11 of the DPA and the privacy policy give the details.

§ 15 Changes to these Terms and the DPA

  1. DataZoo can change these Terms and the DPA for the future if there is an objective reason, in particular a change of law or case law, new or changed functions, requirements of service providers (for example Paddle) or providers of AI assistants, or to close gaps in the rules. For changes of sub-processors, only § 8 of the DPA applies.

  2. DataZoo informs the owners of the organisation about changes in text form (e-mail) at least six weeks before the planned effective date, makes the changed version available on fairyfly.io and highlights the changes.

  3. From the notice on, the web app asks the owners at sign-in to confirm the changed version with the checkbox in § 2(1). When an owner confirms, the changed version applies to the Customer from the announced date, but not before the confirmation.

  4. If no owner confirms the changed version by the announced date, the previous terms continue to apply to the Customer. Both parties can then terminate the contract under § 14. DataZoo tells the Customer about this in the notice.

  5. Changes to the main obligations to the disadvantage of the Customer take effect only with the Customer's explicit consent. The confirmation in paragraph 3 is such consent. For price changes, § 9(6) applies.

§ 16 Final provisions

  1. The law of the Federal Republic of Germany applies. The UN Convention on Contracts for the International Sale of Goods (CISG) and the conflict-of-law rules do not apply.

  2. The exclusive place of jurisdiction for all disputes from or in connection with this contract is the seat of DataZoo (Stuttgart), if the Customer is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany. DataZoo can also sue the Customer at the Customer's general place of jurisdiction.

  3. Declarations under this contract must be at least in text form (for example e-mail). DataZoo can send notices to the e-mail addresses of the owners of the organisation.

  4. The Customer can transfer rights and obligations under this contract to third parties only with the consent of DataZoo. § 354a German Commercial Code (HGB) is not affected.

  5. No party is liable for non-performance caused by circumstances outside its control (force majeure, for example natural events, war, strikes, official orders, large-scale outages of networks or cloud providers for which DataZoo is not responsible).

  6. If a provision of this contract is or becomes invalid or unenforceable, the other provisions stay valid. The statutory rules replace the invalid provision (§ 306(2) BGB).

Annex: Data processing agreement (DPA) under Art. 28 GDPR — https://fairyfly.io/dpa (German, binding: https://fairyfly.io/avv)