Terms of Use

Part 1. Terms of Use

1. Who we are and who these Terms are for

1.1 These Terms of Use ("Terms") govern (a) your use of the MoleQuant website at molequant.com (the "Website") and (b) the MoleQuant AI materials-discovery platform and related services (the "Service"). They are provided by MoleQuant LLC, a company registered in the Qatar Financial Centre ("QFC"), Doha, Qatar ("MoleQuant", "we", "us").

1.2 Business use only. The Service is for companies and professionals acting in the course of business. It is not offered to consumers. By using it you confirm that you act for a business, that you are at least 18 years old, and that you have authority to bind that business.

1.3 Documents that make up the agreement. (a) the signed order form, pilot letter or online subscription ("Order Form"); (b) the Data Processing Terms in Annex D and, where we have signed one, a separate data processing agreement ("DPA"); (c) these Terms, including Annexes A to D. If they conflict, the order above applies, except that Annex C (regional terms) prevails over the rest where it states that mandatory law requires.

1.4 "You" means the business that signs the Order Form or on whose behalf the Service is used, and its Authorised Users.

2. Key terms

3. Accounts and access

3.1 You are responsible for all activity under your accounts. Keep credentials confidential, do not share logins, and use multi-factor sign-in where we make it available or require it.

3.2 Tell us at once, and in any case within 24 hours, if you suspect that a credential, device or account has been compromised or misused.

3.3 You must give access only to Authorised Users who need it, and remove access on the day a person leaves or changes role.

3.4 We may suspend an account without notice where this is reasonably necessary to protect the security of the Service or of any client's data. We will restore access as soon as the risk is resolved.

4. Your data

4.1 Ownership. As between you and us, you own Client Data. These Terms do not transfer ownership of it.

4.2 Our limited right to use it. You give us a limited, non-exclusive right to host, copy, process, analyse and review Client Data only to: (a) provide, secure, support and maintain the Service for you; (b) screen for Restricted Substances and misuse under Clause 6 and Annex B; (c) prevent or investigate fraud, abuse or security threats; and (d) comply with law. We will not use Client Data for any other purpose.

4.3 No sharing between clients. Each client has its own isolated database and its own AI model. We will not use your Client Data to train, improve or test any model or service that is used for another client, and we will not show it to any other client.

4.4 Aggregated or de-identified data. We will use data derived from Client Data to improve the Platform only if you have agreed in writing, and then only in a form that cannot reasonably identify you, your formulations or your people. Public scientific datasets (for example Materials Project, PubChem and NIST) are not Client Data, and we use them under their own licences.

4.5 Your promises. You confirm that: (a) you have all rights and permissions needed to upload Client Data and let us process it as these Terms allow; (b) Client Data does not breach any law or third party's rights; (c) you will not upload Personal Data beyond what is necessary (business contact details are enough); and (d) you will not upload health, financial-account, government-ID, classified or export-controlled technical data unless we have agreed in writing.

4.6 Third parties you connect. If you connect your own systems or give third parties access to the Service, you are responsible for what they do and for the security of those connections.

5. How we protect your data

5.1 We maintain technical and organisational measures at least as protective as those in Annex A to protect Client Data against loss, misuse and unauthorised access.

5.2 We may improve these measures over time. We will not reduce the overall level of protection during the term of your Order Form.

5.3 Hosting location. Client Data is hosted in the country stated in your Order Form. Unless the Order Form says otherwise: data of clients in Saudi Arabia is hosted on Google Cloud in Saudi Arabia, and data of clients in Qatar is hosted in Qatar. We will not move Client Data to another country without your written agreement, except as Clause 6.4 or the law requires.

5.4 Sub-processors. We use the service providers listed in Annex D, including Google Cloud for hosting and for the AI service that reads and structures uploaded files. We stay responsible for them. We will give you at least 30 days' notice of a new sub-processor that will handle Client Data, and you may object on reasonable data-protection grounds. If we cannot resolve the objection, you may end the affected Service and receive a refund of prepaid fees for the unused period.

5.5 Our people. Only people who need access to do their work may access Client Data, and they are bound by confidentiality duties.

5.6 No absolute guarantee. No system is completely secure, and we cannot promise that Client Data will never be accessed without authority. We do promise to do what this Clause 5, Annex A and Clause 7 say. Nothing in this clause limits our liability for failing to do so.

5.7 Assurance. On request, and no more than once a year, we will give you a summary of our latest independent security test and complete a reasonable security questionnaire.

6. Safety screening and review of flagged items

6.1 Automated processing. To provide the Service and to screen for Restricted Substances, our systems decrypt and read Client Data automatically inside your environment. No person is involved in this step.

6.2 Human review of Flagged Items. If screening flags an item, a trained reviewer may open that item to decide whether it is permitted. Reviewers have no standing access to your encryption key. Access to open a Flagged Item must be requested, approved by a second person, limited in time and recorded. The reviewer sees the flagged substance and the reason it was flagged, and sees more of your project only where the decision genuinely needs it.

6.3 Your consent. You agree to the processing and review described in this Clause 6 and Annex B. Access that follows this Clause is authorised access and is not a Security Incident or a breach of confidentiality.

6.4 Disclosure to authorities. We may disclose a Flagged Item, and related account information, to a competent authority where the law requires it or where we reasonably believe it necessary to prevent serious harm, including harm from chemical, explosive or illegal-drug production. Where the law allows, we will tell you first.

6.5 Records. We keep a record of each screening decision and each review: who, what, when and why. We keep the substance identifier and the decision, not the formula, for up to five years or as the law requires. On request we will give you an extract of the records for your own data.

6.6 Suspension. We may suspend the Service, in whole or part, as set out in Annex B.

7. Security incidents

7.1 If we become aware of a Security Incident, we will tell you without undue delay and in any event within 72 hours, by email to your account contact.

7.2 Our notice will say, as far as we then know: what happened; what Client Data was affected; the likely consequences; and what we have done and will do. We will update you as we learn more, help you meet your own notice duties, and take reasonable steps to stop and reduce the harm.

7.3 What is not our Security Incident. We are not responsible for exposure to the extent it is caused by: (a) your or your Authorised Users' credentials, devices or systems; (b) a third-party tool you connected; (c) your failure to follow Clause 3 or our written security instructions; (d) access under Clause 6; or (e) a disclosure that the law required.

7.4 Our notice is not an admission of fault or liability.

8. Keeping, returning and deleting data

8.1 During the term you may export Client Data in a standard format on reasonable request.

8.2 When the Order Form ends, we will, on your request, return Client Data. We will then delete live Client Data within 30 days and backup copies within 90 days, and confirm in writing if you ask.

8.3 We may keep data we must keep by law, and the safety-review records in Clause 6.5. We will keep these confidential and protected.

9. Acceptable use and Restricted Substances

9.1 You must not, and must not let anyone else: (a) use the Service to design, improve, source or make a Restricted Substance or any weapon, explosive or illegal drug; (b) try to get around, disable or test our safety screening, or hide a substance by renaming or splitting it; (c) use the Service for any unlawful purpose or to infringe others' rights; (d) copy, reverse engineer, scrape, or try to extract the models, source code or training data of the Platform; (e) use the Service or Output to build a competing product, or to benchmark it for a competitor without our consent; (f) upload malware or interfere with the Service; (g) resell or give the Service to a third party without our written consent.

9.2 Annex B sets out the Restricted Substances list, our screening, and what happens if an item is flagged. It forms part of these Terms.

9.3 If you break this Clause 9, we may suspend or end the Service immediately without refund, and we may report the matter as Clause 6.4 allows.

10. AI Output: what it is and is not

10.1 The Service uses artificial intelligence and scientific data to propose and rank candidate materials. Output is a decision-support tool. It is predictive and can be incomplete or wrong.

10.2 You must test and verify Output (including by laboratory testing, safety and toxicology review, and regulatory approval) before you make, sell, use or rely on any material or process based on it. We do not give professional engineering, legal, regulatory or safety advice.

10.3 We do not promise that Output is accurate, novel, patentable, free of third-party rights, safe, or fit for a particular purpose. You are responsible for your decisions, for classifying and handling any chemical under applicable law (for example REACH, GHS/CLP, and local chemical regulations), and for the products you make.

10.4 Where we state results from a past project or pilot, they describe that project only and are not a promise of future results.

11. Intellectual property

11.1 We own the Platform. We give you a limited, non-exclusive, non-transferable right to use the Service during the term for your internal business purposes.

11.2 You own Output generated for you from your Client Data, subject to (a) the licence terms of any third-party dataset the Output draws on (for example attribution under CC BY 4.0), and (b) our rights in the Platform and models that produced it. We keep our general know-how, but not your Client Data or Output.

11.3 If you give us feedback or suggestions about the Service, we may use them freely, without naming you and without obligation, as long as they do not include Client Data.

11.4 Neither of us gets any right in the other's names or logos. We will not name you or show your logo as a client without your written consent.

12. Confidentiality

12.1 Each of us must keep the other's confidential information secret, use it only for this agreement, and share it only with people and advisers who need it and are bound to keep it secret. Client Data is your confidential information.

12.2 This does not apply to information that is public through no fault of the receiver, was already known to it, was independently developed, or was received lawfully from a third party. A party may disclose information the law or a court requires, after telling the other where lawful.

12.3 These duties last for five years after the agreement ends, and for trade secrets for as long as they stay secret.

13. Fees, payment and taxes

13.1 You will pay the fees in the Order Form, without set-off, within the stated period. Fees are exclusive of taxes, duties and withholding. If law requires you to withhold, you will increase the payment so that we receive the full amount we would have received.

13.2 If you pay late, we may charge an administrative fee as the Order Form states and as the law allows, and suspend the Service after 10 days' written notice.

13.3 Pilots and trials last for the period in the Order Form. They are provided on the same terms, and you are still bound by Clauses 4 to 12.

14. Term and termination

14.1 The Order Form states how long the agreement runs and how it renews.

14.2 Either of us may end it by written notice if the other materially breaches it and does not fix the breach within 30 days of notice, or if the other becomes insolvent.

14.3 We may end or suspend it immediately under Clause 9.3, if you or any of your owners becomes subject to sanctions (Clause 19), or if the law requires.

14.4 On ending, your right to use the Service stops, Clause 8 applies, and unpaid fees stay payable. Clauses that by nature continue (including 4, 6.3 to 6.5, 7 to 8, 10, 11, 12, 15 to 18 and 23) continue.

15. Our promises and disclaimers

15.1 We will provide the Service with reasonable skill and care and substantially as described in the Order Form and our documentation.

15.2 EXCEPT AS THESE TERMS EXPRESSLY STATE, THE SERVICE, THE WEBSITE AND OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT THE LAW ALLOWS, WE DISCLAIM ALL OTHER WARRANTIES, INCLUDING THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND UNINTERRUPTED OR ERROR-FREE OPERATION.

15.3 We may make planned or urgent changes or take maintenance windows. We will try to give reasonable notice of planned work.

16. Indemnities

16.1 By us. We will defend you against a third-party claim that the Platform, as we provide it, infringes that third party's intellectual property rights, and pay damages and costs a court or settlement finally awards, unless the claim arises from Client Data, Output, your modification, or use in combination with items we did not supply. If a claim is likely, we may modify the Service, obtain a licence, or end it and refund prepaid fees for the unused period. This is our only responsibility for such claims.

16.2 By you. You will defend us against a third-party or regulatory claim arising from: (a) Client Data, or your lack of the rights or lawful basis to upload it; (b) your breach of Clause 9; or (c) the making, sale or use of materials or products based on Output, including product-liability and regulatory claims, except to the extent caused by our breach of these Terms.

16.3 Process. The party seeking protection must notify the other promptly (late notice only reduces the indemnity to the extent of prejudice), let the other control the defence and settlement (no settlement that admits fault or imposes duties without consent), and give reasonable help at the indemnifying party's cost.

17. Limits on liability

17.1 What is never limited. Nothing in these Terms limits or excludes liability for fraud, wilful misconduct or gross negligence, for death or personal injury caused by negligence, or for anything that cannot lawfully be limited.

17.2 Excluded losses. Subject to 17.1, neither of us is liable for indirect or consequential loss, loss of profit, revenue, goodwill or anticipated savings, or loss of opportunity.

17.3 General cap. Subject to 17.1, each party's total liability under or in connection with the agreement in any 12-month period is limited to the fees paid and payable for that period under the Order Form.

17.4 Data protection cap. For liability that arises from our breach of Clause 5, Clause 7, Annex A or the data protection terms (including the cost of legally required notices, forensic investigation, and regulatory fines you are lawfully allowed to recover), our total liability is limited to two times the fees paid and payable in that 12-month period. This replaces, and is not added to, the cap in 17.3.

17.5 Your share of fault. We are not liable for loss to the extent it results from your breach, your Authorised Users' acts, or exposure described in Clause 7.3.

17.6 Time limit. To the extent the law allows, any claim must be brought within 12 months after the claimant became aware of the facts.

17.7 These limits reflect the price and the risks, and each of us has taken them into account.

18. If you think your data has been exposed

18.1 Tell us in writing at the contact in Clause 25, with what you saw, when, and why you think it came from us. Keep the evidence.

18.2 What we will do. We will acknowledge your notice within 2 business days, start an investigation, and within 10 business days give you our findings and the relevant extract of our access and review records for your Client Data.

18.3 Independent check. If you dispute our findings, you may ask for an independent forensic review by a firm both of us accept. We will give it access to the relevant logs under confidentiality. You pay for the review unless it finds that we caused a Security Incident, in which case we do.

18.4 Records. Our access, review and system logs, kept in the ordinary course, are accepted as prima facie evidence of what they record, unless shown to be wrong.

18.5 Audit. You may audit our compliance with this agreement once a year, on 30 days' notice, through our security summary and questionnaire (Clause 5.7), or, if there has been a Security Incident or a regulator requires it, through an independent auditor under confidentiality. This does not allow access to other clients' data or to systems that would expose it.

19. Sanctions, export controls and anti-corruption

19.1 You confirm that neither you nor your owners, directors or Authorised Users is the target of sanctions of the United Nations, United States, European Union, United Kingdom, Qatar or Saudi Arabia, or is owned or controlled by such a person.

19.2 You will not use or export the Service or Output in breach of applicable export-control and sanctions laws (including US export and OFAC rules, the EU Dual-Use Regulation, and UN controls), or for any weapons end use.

19.3 Each of us will comply with applicable anti-bribery and anti-corruption laws. We may refuse or end service where the law forbids us to supply it.

20. Personal data and privacy

20.1 For Personal Data inside Client Data, we act on your instructions as your processor (or "service provider"), and you are the controller (or "business"). The Data Processing Terms in Annex D and the regional terms in Annex C apply.

20.2 For business contact details, website visits and account administration, we act as a controller. Our Privacy Policy explains this.

21. The Website

21.1 You may view the Website for your business's lawful interest in MoleQuant. You must not scrape it, probe it for weaknesses, or copy its content except as the law allows.

21.2 The Website is general information and is not an offer or advice. Case-study results are examples from particular projects. Links to other sites are for convenience, and we are not responsible for them.

21.3 We own the Website content and marks. Third-party datasets and software we mention belong to their owners and are used under their licences.

22. Changes to these Terms

22.1 We may update the Website terms by posting a new version with a new date.

22.2 For the Service, we will give at least 30 days' written notice of a material change. A material change will not apply to you before your Order Form's current term ends or renews, unless the law, a regulator, or a security need requires it sooner.

23. Governing law and disputes

23.1 These Terms and any dispute arising from them are governed by the laws of the Qatar Financial Centre and, to the extent they apply, the laws of the State of Qatar.

23.2 Talk first. Each of us will escalate a dispute to senior managers and try to settle it within 30 days of written notice.

23.3 Arbitration. Any dispute not settled will be finally resolved by arbitration under the rules of [the Qatar International Centre for Conciliation and Arbitration (QICCA) / the ICC], by one arbitrator, seated in Doha, Qatar (QFC), in English. The award is final and may be enforced in any court with jurisdiction.

23.4 Either of us may ask any competent court for urgent relief to protect confidential information or intellectual property.

23.5 Where the mandatory law of your country gives you rights that cannot be waived, those rights are not affected, and Annex C explains how we apply them.

24. General

24.1 Whole agreement. These Terms, the Order Form and the DPA are the whole agreement and replace earlier talks and documents on the same subject. Terms in your purchase order or procurement forms do not apply.

24.2 Assignment. You may not assign the agreement without our written consent. We may assign it to a group company or a buyer of our business, with notice to you.

24.3 Force majeure. Neither of us is liable for delay or failure caused by events beyond reasonable control, other than payment duties. This does not excuse a failure to meet the security duties in Clauses 5 and 7.

24.4 Severability and waiver. If a provision is invalid, the rest stays in force and the provision is adjusted to the minimum extent needed. A delay in enforcing a right is not a waiver.

24.5 No third-party rights, no partnership. Only the parties may enforce the agreement. We are independent contractors.

24.6 Notices. Notices must be in writing and sent to the addresses in the Order Form, or if none, to the contact in Clause 25 (for us) and your account contact (for you). Email is valid notice.

24.7 Language. The English text prevails. An Arabic or other translation is for convenience only.

24.8 Electronic acceptance. You agree that clicking "accept", signing electronically or using the Service is a valid signature. We keep a record of the version, date and user who accepted.

25. Contact

MoleQuant, Tornado Tower, West Bay, Doha, Qatar. Legal and data requests: legal@molequant.com. Security incidents: security@molequant.com. General: moustafa@molequant.com.

Annex A. Security measures

Annex B. Restricted Substances and safety screening

B1 What is restricted. Substances, and the precursors or combinations that make them, that are: (a) chemical-weapons agents and precursors listed in Schedules 1, 2 and 3 of the Chemical Weapons Convention; (b) chemicals on the Australia Group control lists; (c) illegal drugs and their precursors controlled under the UN drug conventions (including INCB Tables I and II); (d) explosives and explosives precursors regulated by law; (e) substances prohibited or controlled by the law of Qatar, Saudi Arabia, the EU, the UK or the United States, as applicable; and (f) items that need an export licence we or you do not hold.

B2 How we screen. We may screen what you upload and what the Service generates. Screening may include matching against these lists, close-relative and combination checks, blocking of listed classes in our own generation, and checking your account against sanctions lists. We update the lists regularly, but we do not promise that screening finds every restricted item.

B3 Results. An item that clearly matches a list may be blocked at once and reported to our compliance officer. An item that is unclear is held for human review under Clause 6, normally within 24 hours of the flag. An item that passes is released.

B4 Suspension. We may suspend an account straight away if an item clearly matches a restricted list or if we reasonably suspect misuse, and we may suspend it after repeated flags in a short period. We will tell you, unless the law forbids it, and review the suspension promptly.

B5 Your help. If we ask, you will tell us within 5 business days the legitimate industrial purpose of a flagged item and give related information. Delay or refusal may lead to continued suspension.

B6 Appeal. You may appeal a suspension or block in writing. A second reviewer, who was not involved in the first decision, decides.

B7 No liability for good-faith action. We are not liable for blocking, delay, suspension or reporting made in good faith under this Annex, including where it later proves to have been unnecessary.

B8 Not legal advice. The lists are a guide. You remain responsible for knowing and following the chemical, trade and safety laws that apply to you.

Annex C. Regional terms

C1. GCC (Qatar, Saudi Arabia, UAE, Kuwait, Bahrain, Oman)

• Qatar: the QFC Data Protection Regulations and Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) apply as relevant to us and to you. Saudi Arabia: the Personal Data Protection Law and its Implementing Regulations apply as relevant, including their rules on transfer of personal data abroad.
• Other GCC states: the data-protection and cloud-hosting rules of your country apply to you. You are responsible for any notices and permissions you must give your own people.
• Hosting: see Clause 5.3. We will keep Client Data of Saudi and Qatari clients in the Kingdom or in Qatar respectively, unless you agree otherwise in writing.
• Regulated clients: if you are a regulated entity, tell us the cloud, outsourcing or localisation rules that bind you, so we can agree how to meet them in the Order Form.
• Payment charges: any administrative charge for late payment is applied only as the law of the applicable country allows.
• Language: an Arabic translation is available on request. The English text prevails (Clause 24.7).

C2. European Union, European Economic Area and United Kingdom

• Roles. For Personal Data in Client Data covered by the EU or UK GDPR, you are the controller and we are your processor. The Data Processing Terms in Annex D are our processing terms under Article 28 of the GDPR. Where you ask, we will sign a full DPA.
• International transfer. Our hosting is outside the EEA and the UK (in Saudi Arabia or Qatar). Where Personal Data covered by the GDPR is transferred to us, the parties agree to the Standard Contractual Clauses (Module 2, controller to processor) and, for UK data, the UK Addendum, which are incorporated by reference, with the details in Annex D and the choices of governing law and courts set out there. We will help you with any transfer impact assessment.
• EU representative. [Where the law requires, we will appoint a representative in the EU or UK and publish their details.]
• Business-only. We do not offer the Service to consumers. Mandatory consumer-protection rules therefore do not apply. Any other mandatory rule of your law that cannot be waived continues to apply.
• Switching. If the EU Data Act applies to the Service for you, you may switch provider or export your data on the notice and terms that Act requires. We will support this using the export and return process in Clause 8.
• AI rules. You, as the business using the Service, are responsible for using Output lawfully, including under the EU Artificial Intelligence Act where it applies. You will not use the Service for any purpose the Act prohibits.

C3. United States

• Service provider. Where US state privacy laws (for example the California Consumer Privacy Act) apply to Personal Data in Client Data, we are your service provider. We process it only for the business purposes in Clause 4.2, we do not sell or share it, we do not use it outside our direct relationship with you, and we do not combine it with other data except as the law allows. We will tell you if we can no longer meet these duties.
• Data you must not upload. Do not upload protected health information, payment-card data, government IDs, or technical data controlled under ITAR or the EAR, or classified information, unless we have agreed in writing.
• Export and sanctions. Clause 19 applies, including US export control and OFAC rules.
• Conspicuous terms. The disclaimers and limits in Clauses 15 and 17 are written in plain terms and, where capitals are used, are meant to be conspicuous. They apply to the fullest extent US state law allows.
• No consumer use. The Service is for business use. US consumer-protection rules for personal use do not apply.

Annex D. Sub-processors and data processing terms

D1. Sub-processors

D2. Data processing particulars

D3. Our processing duties

1. Process Personal Data only on your documented instructions, which these Terms and your use of the Service are, unless the law requires otherwise (we will tell you first where lawful).
2. Make sure everyone who may access it is bound by confidentiality.
3. Apply the security measures in Annex A.
4. Use sub-processors only under Clause 5.4, with duties no less protective than these.
5. Help you answer requests from data subjects and meet your own duties on security, impact assessments and notice, taking account of how the Service works.
6. Tell you without undue delay, and within 72 hours, of a Security Incident (Clause 7).
7. Delete or return Personal Data at the end of the services (Clause 8).
8. Give you the information needed to show our compliance and allow audits as Clause 18.5 states.
9. Tell you if we think an instruction breaches data-protection law.