Aspis Terms of Use

Effective date: 1 October 2026

If you had an account with us before 1 October 2026, these terms apply to you from 1 November 2026. Until then, the terms you agreed to before continue to apply.

1. Key points

This section sums up some of the most important points in these terms. It does not replace the rest of the terms, so please read them in full.

• Who we are. Aspis is run by Aspis Protocol Ltd, a company registered in England and Wales. You can contact us at info@aspis.finance.
• We are not regulated by the FCA. Aspis Protocol Ltd is not authorised or regulated by the Financial Conduct Authority. The Financial Services Compensation Scheme (FSCS) does not cover the Services, and the Financial Ombudsman Service cannot deal with complaints about them.
• We do not give advice. Nothing we provide is financial, investment, legal or tax advice or a personal recommendation. This includes reports, alerts and AI answers.
• You can lose everything. Cryptoassets are high risk. You could lose all of the cryptoassets you deposit or trade. Please read our Risk Disclosure.
• Aspis is non-custodial. Your cryptoassets stay in your own wallet or in a vault's smart contract. We never have the keys to your own wallet, or to the wallet that manages any vault created from 1 October 2026. Nobody, including us, can move depositors' cryptoassets out of a vault, except by each depositor's own withdrawal and the fees paid to the vault's manager under the vault's settings. Automated trading is a limited permission that you sign and can revoke. You sign deposits and withdrawals from your own wallet yourself. Copilot-run vaults and Agent-Funds created before 1 October 2026 ("legacy vaults") work differently until 31 December 2026: see section 7.13.
• Automated trading is optional. For a vault you create, you can choose to let our software trade it on your instructions, in Aspis Copilot or as an Agent-Fund in the web app. Your own wallet stays the vault's manager. You sign a permission in your wallet that lets our software swap the vault's assets through its permitted exchanges, and nothing else. It cannot withdraw or transfer cryptoassets, claim fees, or change the vault's settings or manager. The permission expires after 90 days unless you renew it, and you can revoke it at any time from your wallet. This also matters to anyone who deposits into such a vault. See section 7.4.
• Withdrawals from older vaults can be blocked. Vaults created before 1 October 2026 rely on a shared registry of tokens and price feeds when anyone deposits or withdraws. When price feeds in that registry failed, deposits and withdrawals were blocked for every such vault on the network until we fixed the registry. This happened twice in 2026, and the second time it affected every network we support. Vaults created from 1 October 2026 pay out withdrawals without looking up prices, so a failed price feed cannot block them. See section 7.10.
• Paid plans renew automatically. A paid plan renews until you cancel it. You can cancel at any time in your account and keep your plan until the end of the period you have paid for.
• Your 14-day right to cancel. A paid plan starts as soon as you pay, because you ask us to start it straight away. Once it has started, you can no longer cancel it within 14 days for a refund. Our Subscription Terms explain this, and how cancellation and refunds work.
• Your legal rights are protected. Nothing in these terms takes away your legal rights as a consumer.

2. About us and these terms

2.1 Who we are. The Services are provided by Aspis Protocol Ltd ("Aspis", "we", "us" and "our"). We are a private limited company registered in England and Wales with company number 15506799. Our registered office is at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. Our VAT number is GB 513 3001 57. We trade under the names Aspis and AgentCouncil.

2.2 How to contact us. Email us at info@aspis.finance or write to us at our registered office. We deal with messages in English.

2.3 What these terms cover. These terms apply to your use of:

• our website at aspis.finance (the "website");
• the Aspis web app at v3.aspis.finance (the "web app");
• Aspis Copilot, our Telegram bot @aspisprotocol_bot ("Copilot");
• vault API keys, and the Aspis API for organisations (the "organisation API"); and
• any other website, app or service of ours that links to these terms.

Together, we call these the "Services".

2.4 AgentCouncil. We also run AgentCouncil at agentcouncil.org and dashboard.agentcouncil.org. AgentCouncil has its own Terms of Use, which apply when you use AgentCouncil. You use one account and one subscription plan across Aspis and AgentCouncil (section 5.1).

2.5 Other documents.

• Subscription Terms. Our Subscription Terms apply if you buy a paid plan. They form part of our contract with you. If they conflict with these terms on anything to do with paid plans, the Subscription Terms apply.
• Extra terms for an offer or feature. If we offer a particular feature or offer on extra terms, we will show you those terms before you use it. They will then also form part of our contract with you.
• Risk Disclosure. Our Risk Disclosure explains the main risks of using the Services. Please read it before you deposit into a vault, create a vault or trade.
• Privacy Policy and Cookie Policy. Our Privacy Policy and Cookie Policy explain how we use personal data, cookies and similar technologies.

The Risk Disclosure, Privacy Policy and Cookie Policy give you information. They are not terms of our contract with you.

2.6 Consumers and business users. Some parts of these terms depend on who you are:

• You are a "consumer" if you are an individual using the Services wholly or mainly for purposes outside your trade, business, craft or profession.
• You are a "business user" if you use the Services for the purposes of a business. This includes using them as the owner or member of an organisation account (section 8).

Unless a section says otherwise, it applies to everyone.

2.7 Language. These terms, and our contract with you, are in English only.

3. How our contract with you is made

3.1 Using the website without an account. These terms apply if you browse the website or the public pages of the web app without signing in. The parts about accounts, vaults and paid plans will not be relevant to you.

3.2 Creating an account. Our contract with you starts when you accept these terms. We ask you to accept them:

• when you sign up with an email address and password, or with Google, by ticking a box before you submit the form;
• when you sign in with a wallet for the first time, before we create your account;
• when you start Copilot for the first time, by pressing "I agree" before Copilot processes any message from you or creates your account. If you press "Not now", we store nothing; and
• when you first sign in after an organisation owner has added you (section 8.2).

When you accept these terms, you also confirm that you are 18 or over and that you meet the other requirements in section 4.

3.3 Checking and correcting what you enter. Before you submit a form, you can review what you have entered and correct any mistakes. This applies, for example, when you sign up, create a vault or pay for a plan. When you make a blockchain transaction, your wallet shows you its details before you sign it. Once a transaction is confirmed on the blockchain, nobody can reverse or correct it, including us.

3.4 Our record of your acceptance. We keep a record of which version of these terms you accepted and when. We keep a copy of every version of these terms and will send you the version you accepted if you ask. You can also save or print this page.

4. Who can use the Services

4.1 Age. You must be at least 18 years old to use the Services.

4.2 Sanctions. You must not use the Services if any of the following applies:

• you are the subject of sanctions under the laws of the United Kingdom, the United Nations, the European Union or the United States, or you are owned or controlled by, or acting for, someone who is;
• you are located or ordinarily resident in a country or territory that is the subject of comprehensive sanctions under any of those laws. At the date of these terms, this includes Cuba, Iran, North Korea, Crimea and the areas of Ukraine not controlled by the Ukrainian government (including the so-called Donetsk and Luhansk People's Republics); or
• using the Services would break the law of the place where you are.

4.3 Places where we do not offer the Services. We may decide not to offer some or all of the Services in some countries. For example, we may need a licence or registration there that we do not have. If we do, we will say so on the Services.

4.4 Checks. We may ask you for information to confirm that you meet the requirements in this section. If we reasonably believe that you do not meet them, we may suspend or restrict your access as described in section 17.

5. Your account

5.1 One account for Aspis and AgentCouncil. One account gives you access to the web app, Copilot and AgentCouncil. If you have a paid plan, it applies across all of them. You can link wallets, a Telegram account and a Google sign-in to your account.

5.2 How accounts are created. An account can be created in these ways:

• you sign up with an email address and password, or with Google;
• you sign in with a wallet by signing a message in your wallet. If no account is linked to that wallet yet, we create one for you;
• you start Copilot and accept these terms. We create a basic account linked to your Telegram ID, so that Copilot can keep track of your settings and vaults; or
• an organisation owner adds you to their organisation (section 8.2).

An account created from a wallet or from Copilot has no email address or password. You can add them later in the web app, so that you can also sign in without your wallet or Telegram.

5.3 Your details. Please give us accurate information and keep it up to date.

• Google sign-in. If you sign in with Google using the same email address as an existing account, we link your Google sign-in to that account.
• Visible to others. Other users can see your nickname and your profile picture (avatar).
• Uploaded images. Images you upload, such as an avatar or a vault logo, are stored at a web address. Anyone who has that address can open the image.

5.4 Keeping your account secure.

• Keep your password and sign-in methods secure, and do not share your account.
• We will never ask you by email, by Telegram or in any other message for your password, your vault API key, or the private key or recovery phrase of your own wallet. You enter your password only in the sign-in and account pages of the web app or AgentCouncil. Our only official Telegram bot is @aspisprotocol_bot.
• Tell us straight away at info@aspis.finance if you think someone else has used, or can use, your account, wallet, Telegram account or vault API key.
• You are responsible for what you do with your account, and for what anyone you allow to use it does. If you are a consumer, you are not responsible for use of your account by someone you did not allow, unless it happened because you did not keep your sign-in details secure.

5.5 Closing your account.

• Accounts with an email address. Go to Account, then Privacy, then "Close my account" in the web app.
• Accounts without an email address. This covers, for example, accounts created from a wallet or from Copilot. Email us at info@aspis.finance. We may ask you to prove that you control the wallet or Telegram account linked to the account.
• Organisation owners. First pass ownership of the organisation to someone else, or ask us to close the organisation.
• Paid plans. If you close your account while a paid period is running, your plan ends straight away and we will not charge you again. If you have a yearly plan, we refund the whole months left in the period you have paid for, as our Subscription Terms explain. To keep your plan until the end of the period, cancel it first and close your account once the plan has ended.
• Vaults and cryptoassets. Closing your account does not move, withdraw or otherwise affect any cryptoassets in your wallet or in any vault. Before you close it, withdraw from any vault you want to leave, cancel any open orders and claim any manager fees you are owed. If you have given our software a trading permission, revoke it from your wallet: closing your account does not remove it from the blockchain. If you have not done these things, contact us and we will help you.
• Copilot. If you use Copilot again after closing your account, you will be asked to accept these terms again, and a new basic account will be created for you.
• What we keep. Our Privacy Policy explains what information we keep after you close your account, and why.

6. What the Services do, and what they do not do

6.1 The website gives information about Aspis and lets you ask to hear from us.

6.2 The web app lets you:

• browse vaults created by other users, and see their settings, fees and on-chain history;
• deposit into and withdraw from vaults, using your own wallet;
• create a vault that you manage from your own wallet (a self-managed vault);
• create an Agent-Fund, which is a Copilot-run vault (see section 7); and
• manage your account, linked wallets and Telegram account, subscription and organisation.

6.3 Copilot lets you:

• chat with an AI assistant about cryptoasset markets and about your vaults;
• receive market reports and technical analysis generated by software. These describe market indicators. They do not tell you to buy or sell;
• receive alerts about trades made by other wallets, and ask for an analysis of a public wallet address; and
• create a Copilot-run vault, give our software permission to trade it, and instruct trades and price-triggered orders (section 7).

6.4 What we do not do.

• We are not an authorised financial firm. Aspis Protocol Ltd is not authorised or regulated by the Financial Conduct Authority. We do not offer the Services as a regulated financial service, we are not a bank, and you do not have the protections that apply to regulated services.
• We do not give advice. We do not give financial, investment, legal or tax advice, and we do not make personal recommendations. Reports, alerts, AI answers and vault performance figures are general information. They do not take into account your circumstances, objectives or attitude to risk. That is still true when Copilot's answers refer to your vault or wallet. If you need advice, speak to an independent, appropriately qualified adviser.
• We do not decide trades. We do not decide which trades to make for anyone. Our software does not trade your vault, or any vault created by a user, on its own initiative. For Copilot-run vaults and legacy vaults, it only carries out the vault owner's instructions, as described in section 7.
• We do not check vault creators. We do not check their identity, experience, qualifications or honesty, and we do not monitor their strategies. We list vaults in a neutral order, not by performance. A vault appearing on the Services does not mean we recommend it or have checked it.
• We do not promise returns or withdrawals. We do not promise any return. We also do not promise that you will be able to withdraw at any particular time (see sections 7.10 and 7.11).
• We do not do tax. We do not give tax advice or prepare tax reports.

6.5 What you need. To deposit, withdraw or create a vault, you need your own cryptoasset wallet that works on a network we support. You can use a wallet built into your browser, or a wallet you connect through WalletConnect. To create a Copilot-run vault, you can also use an email or social-login wallet from a wallet provider. We never hold the keys to any of these wallets. You pay each network's fees in that network's own token (section 12.4). To use Copilot, you need a Telegram account. Apart from sign-in, API keys and plan limits, the Services do not use any technical protection measures.

7. Vaults, custody and automated trading

7.1 What a vault is. A vault is a smart contract on a public blockchain. At the date of these terms, we support Arbitrum, BNB Chain and Polygon. People who deposit cryptoassets into a vault ("depositors") receive vault tokens representing their share of the vault; the web app calls these "smartcoins". The vault's manager wallet, and anyone the manager gives permission to, can trade the vault's assets, but only through the exchanges and tokens that the vault allows. At the date of these terms, the permitted exchanges are 1inch, Odos and Uniswap.

7.2 Vault settings. The person who creates a vault chooses its settings. The settings are recorded in the vault's smart contract and shown on the vault page. They can include:

• whether the vault is public or private. A private vault accepts deposits only from wallet addresses on its allowlist;
• minimum and maximum deposits, and the tokens the vault accepts;
• a lock-up period, withdrawal windows or a freeze period, which limit when you can withdraw;
• a fundraising period, during which some actions may not be available;
• fees paid to the vault's manager. These can be an entrance fee (a percentage of each deposit), a fund management fee (a yearly percentage of the vault's assets, taken when you withdraw) and a performance fee (a percentage of any profit, taken when you withdraw). Fees are taken in vault tokens; and
• an early exit fee (shown in the web app as a "rage quit fee"). Where a vault has one, it takes a percentage of what you withdraw if you withdraw outside the vault's withdrawal window.

Read a vault's settings and fees before you deposit. Depending on how a vault's smart contract is set up, its fees may be able to change after you deposit. If what we show about a vault is different from what its smart contract does, please tell us.

7.3 Three kinds of vault. There are three kinds of vault on Aspis. The difference matters. In these terms, a "Copilot-run vault" is one created in Copilot or as an Agent-Fund from 1 October 2026, and a "legacy vault" is one created that way before 1 October 2026. Each vault's page shows which kind it is.

Legacy vaults are explained in section 7.13. Some self-managed vaults were also created before 1 October 2026. Section 7.10 explains how withdrawals from every vault created before that date depend on our shared registry.

7.4 Copilot-run vaults: automated trading. A Copilot-run vault is a vault whose owner has chosen to let our software trade it. For a Copilot-run vault:

• it is your choice. You can always create a self-managed vault instead;
• your wallet is the manager. The vault's manager is your own wallet. This is either a wallet you connect (a browser wallet or WalletConnect), or an email or social-login wallet from a wallet provider. We never hold the keys to it;
• you sign a limited permission. To use automated trading, you sign an on-chain permission in your own wallet. It lets our trading software trade the vault and nothing else:
  • it can swap the vault's assets only through the vault's permitted exchanges, including the token approvals those swaps need. Each trade is limited to a maximum slippage of 3%; and
  • it cannot transfer or withdraw assets, claim manager fees, or change the vault's settings or manager;
• the permission expires after 90 days unless you renew it by signing again;
• you can revoke it at any time from your own wallet, without needing us. "Stop automated trading" in the web app and in Copilot prepares the revoke transaction for you to sign;
• when the permission ends, because you revoke it or it expires, our software stops and cancels the vault's open orders. We tell you which orders were cancelled;
• you stay in control. You can also trade the vault yourself from your own wallet, and you can change its manager; and
• your consent is recorded. Signing the permission is your consent to automated trading. We record the transaction, the time, the version of these terms and the permission text we showed you.

Non-custodial. We never have the keys to a Copilot-run vault's manager wallet. Depositors' cryptoassets are held by the vault's smart contract, not in a wallet of ours, and only each depositor can withdraw their share. Automated trading does depend on our systems. In practice, this means:

• if our systems are unavailable, or if we stop providing automated trading, our software will not trade or run orders. You can still trade the vault from your own wallet, and depositors can still withdraw, subject to section 7.11;
• if our systems were compromised, someone could use the permission to make trades you did not ask for, within its limits. Each trade is limited to 3% slippage, but several bad trades could add up, and depositors could lose value. They could not withdraw or transfer the vault's assets, claim its fees or change its settings. You can stop them by revoking the permission; and
• if Aspis stopped operating, our software would stop trading the vault. You would still control it from your own wallet, and depositors could still withdraw.

We take steps to protect the systems that trade Copilot-run vaults, and we are responsible for running them with reasonable care and skill.

7.5 Who can instruct trades on a Copilot-run vault. The owner of a Copilot-run vault is the account that created it. The owner can instruct trades and orders through Copilot, through the web app, or with the vault's API key (section 7.6). Our software carries out those instructions using the permission the owner signed; it does not decide trades itself. The owner can also trade directly from their own wallet. If you deposit into someone else's Copilot-run vault, that vault's owner decides the trades (not you, and not us).

7.6 Vault API keys. When a Copilot-run vault is created, we issue an API key for it. We show you the key once. We store only a hash of it (a scrambled version), so we cannot show it to you again. You can revoke it and create a new one in the web app or in Copilot.

• What it does. Anyone who has the API key can instruct trades and orders for the vault. It cannot claim manager fees, withdraw cryptoassets or change the vault's settings. Trades made with it are still limited by your trading permission.
• Keep it secret. Do not post it anywhere, and do not share it with anyone you do not trust completely. Copilot never asks for your API key. Do not paste it into a chat with Copilot or anyone else.
• Instructions made with your key. We treat any instruction made with your API key as coming from you. That does not apply once you have told us the key may be compromised, or if the key was obtained from our systems because we failed to keep it secure.
• If your key is exposed. If you think someone else has your API key, revoke it and create a new one straight away, and tell us at info@aspis.finance. We will take reasonable steps to stop it being used.

7.7 Price-triggered orders. For a Copilot-run vault, you can set limit, stop-loss and take-profit orders.

• How orders run. Our system checks prices from our own price service about every 30 seconds. When it sees that your price condition has been met, it carries out the order straight away as a market trade, without asking you again. Before each order, it checks that your trading permission is still active.
• Price you get. The trade goes through Odos, or through 1inch if Odos fails. We accept a price up to 3% worse than the quoted price (this is called slippage), so the price you get can be worse than your trigger price.
• No guarantee. An order may be carried out late, at a worse price, or not at all. This can happen if prices move quickly, if there is not enough liquidity, if a network is congested, or if our systems or a third party's systems are unavailable. A stop-loss order does not guarantee that your loss will be limited.
• How long orders last. An order stays active until it is carried out or cancelled, or until your trading permission ends. When the permission ends, we cancel the vault's open orders and tell you which ones. If you want your orders to keep running, renew the permission before it expires. Check your open orders regularly.

7.8 Trading by chat message. If you have a Copilot-run vault, you can ask Copilot in your own words to make a trade, or to set or cancel an order. Copilot uses an AI model to work out what you want.

• Before it makes a trade, Copilot shows you a summary: the tokens, the amount, the route and the maximum slippage. It trades only after you press Confirm.
• If your message does not say which token to use, Copilot asks you.
• Check the summary carefully. If it is not what you want, cancel it.
• If Copilot carries out a trade that is clearly different from what you asked for and confirmed, tell us straight away at info@aspis.finance. If the mistake was ours, we will put it right as described in section 18.

7.9 Manager fees. For a self-managed vault or a Copilot-run vault, the vault pays manager fees to its manager wallet, which is the owner's own wallet. The owner claims them from their own wallet. Aspis never receives or holds them. Neither our software's trading permission nor a vault API key can claim them. Manager fees for legacy vaults are explained in section 7.13.

7.10 The guardian, shared contracts and withdrawals. Every vault on a network relies on shared smart contracts that we deployed and that we maintain through an administrator contract (the "guardian").

• The guardian. The guardian is a multisig controlled by Aspis: any action needs approval from at least two of our authorised signers. It can do two things: maintain each network's shared registry, and put a vault into an emergency stop.
• The registry. A registry lists the tokens that vaults on that network can use, and the price feeds (mostly provided by Chainlink) used to value them.
• Vault code can't be upgraded. The roles that could upgrade vault code have been renounced on all vaults. Nobody, including us, can change a vault's code.

Vaults created from 1 October 2026.

• Withdrawals. You receive your share of the tokens the vault actually holds, in those tokens, with no price lookup. A failed price feed cannot block withdrawals.
• Emergency stop. An emergency stop does not stop withdrawals.
• Deposits. Deposits still use price feeds. If the price feed for a token fails, deposits may fail until we fix the registry.

Vaults created before 1 October 2026. This covers every kind, including legacy vaults and older self-managed vaults.

• How they are valued. When anyone deposits into or withdraws from one of these vaults, the vault values itself using the price of every token in that network's registry. This includes tokens the vault does not hold.
• One failed price feed can block all of them. If one price feed in the registry stops working (for example, because its provider retires it), deposits and withdrawals can fail for every one of these vaults on that network until we update the registry through the guardian. This happened in March 2026. It happened again later in 2026 on Arbitrum, BNB Chain and Polygon: we found the failure on 18 August 2026, and it may have started as early as June 2026. Each time, deposits and withdrawals worked again only after we updated the registry.
• Fixing it can cost depositors. To fix a problem like this, we remove the affected token from the registry. Any balance of that token held by a vault may then no longer be paid out when depositors withdraw, and that value may be lost to them. In March 2026, small balances were lost this way.
• Emergency stop. An emergency stop can pause withdrawals from these vaults.

We check the health of the price feeds every 6 hours, with alerts to our team. Where a provider publishes a date on which it will retire a feed, we remove the feed before that date. We cannot promise that deposits and withdrawals will always be possible. If Aspis stopped operating, the registry might not be updated, and withdrawals from vaults created before 1 October 2026 could stay blocked.

We will use the guardian only to maintain the registry and to protect vaults and depositors, for example after a price feed fails or a security incident. We will not use it to stop you withdrawing because we have suspended or closed your account, unless the law, a court or a regulator requires us to. If we use the emergency stop, or remove a token from a registry, we will tell affected users as soon as we reasonably can.

7.11 Depositing and withdrawing.

• Depositing. You deposit from your own wallet and sign the transaction yourself. Check the vault's address, settings and fees before you do. We cannot reverse a deposit or recover cryptoassets sent to the wrong place. Legacy vaults are closed to new deposits (section 7.13).
• Withdrawing. Your vault tokens are held in your own wallet. To withdraw, you redeem them through the web app or directly with the vault's smart contract. You receive your share of the vault's assets, after any fees the vault charges. You may receive several different tokens rather than a single one.
• Limits. Withdrawals are subject to the vault's settings (section 7.2) and to section 7.10.
• Public record. Deposits and withdrawals are public on the blockchain.

7.12 If you create a vault. If you create a vault of any kind, you are responsible for it. In particular:

• Accuracy. The vault's name, description, links, logo and settings must be accurate and not misleading. This includes anything you say about its strategy or performance.
• Your decisions. You are responsible for your trading decisions and their effect on depositors, including the instructions you give our software. We are not responsible for the decisions of vault creators.
• Laws that apply to you. If you invite other people to deposit, laws may apply to you, for example on financial promotions, regulated investment activities, anti-money-laundering checks, sanctions, consumer protection and tax. You are responsible for finding out what applies and complying. We do not carry out any checks for you.
• Allowlists. Wallet addresses you add to a private vault's allowlist are published permanently on the blockchain. Only add an address if you are entitled to, for example because its owner asked you to.
• Fixed settings. Once you have created a vault, you may not be able to change its settings. You can change a Copilot-run vault's manager from your own wallet (section 7.4). If you created a self-managed vault with manager replacement switched on, its depositors can replace you as manager by a vote, under the voting rules shown on the vault's page. Choose your settings carefully.

7.13 Legacy vaults. A legacy vault is a Copilot-run vault or Agent-Fund created before 1 October 2026. It is labelled "Legacy vault" in the web app, in Copilot and in the API. Legacy vaults work differently from other vaults until 31 December 2026:

• We hold the manager key. Our servers created the vault's manager wallet. We keep its private key encrypted in a key management service, and access to it is logged. The owner never received the key, and the manager can't be changed.
• Closed to new deposits. From 1 October 2026, you cannot deposit into a legacy vault through our apps or API. The vault's smart contract may still accept a deposit sent to it directly. Do not make one.
• Trading until 31 December 2026. We ask each owner to confirm by 31 October 2026 whether they want automated trading to continue until 31 December 2026. If the owner confirms, our software keeps carrying out their instructions until then, as described in sections 7.5 to 7.8. If the owner does not confirm by 31 October 2026, our software stops trading the vault on 1 November 2026, cancels its open orders and we tell the owner. An owner can ask us to stop trading at any time.
• Manager fees. Manager fees are claimed straight to the owner's verified payout address. The owner proves control of that address by signing in with that wallet. Changing it needs re-authentication and a 48-hour wait. Fees that our old software had left in manager wallets have been returned to their owners.
• On 31 December 2026. Trading and orders stop. A final manager-fee claim goes straight to the owner's payout address. We then permanently destroy the keys.
• Depositors can withdraw directly. Depositors can withdraw directly from the vault's smart contract at any time, before and after 31 December 2026, subject to the vault's settings and to section 7.10.
• Moving to a new vault. An owner can create a new Copilot-run vault (section 7.4) and tell their depositors. Each depositor then withdraws from the legacy vault and deposits into the new one themselves. We never move depositors' assets.

8. Organisation accounts and the organisation API

This section applies only to business users that have an organisation account.

8.1 Organisation accounts. Businesses can have an organisation account under a plan agreed with us. The person who sets up or owns the organisation account accepts these terms for the organisation and confirms that they are authorised to do so. If we sign a separate written agreement with your organisation, that agreement applies wherever it conflicts with these terms.

8.2 Members. An organisation owner can add members by email address.

• If the person does not already have an account, we create one and email them a link to choose a password.
• An owner can also add an existing account that does not already belong to an organisation.
• Owners must only add people who have agreed to be added.
• The owner can see each member's name, email address, role, when their account was created and when they last signed in, and can remove members.

8.3 Organisation API keys. Organisation owners can create API keys for use between servers.

• An API key is shown once. Keep it on your servers. Never put it in a browser, a mobile app or public code.
• You are responsible for all use of your organisation's API keys, and for keeping them secure.
• If you think a key has been compromised, revoke it and tell us straight away.
• Use of the organisation API must follow any documentation and usage limits we give you.

8.4 Organisation vaults. Vaults created through an organisation account are not listed on the public pages of the web app. They are still on a public blockchain, so anyone can find and inspect them there. Members of your organisation can see analytics for its vaults, including the wallet addresses of depositors.

8.5 Your responsibilities. You are responsible for:

• having any authorisation, registration or permission you need for anything you offer your own customers using the Services, and complying with the laws that apply to it, including financial promotion, anti-money-laundering, sanctions, consumer protection and tax laws;
• carrying out any checks on your customers that the law requires of you. We do not check your customers for you;
• giving your members and customers any information the law requires about how their personal data is used, including by us; and
• how your members use the Services.

8.6 Personal data. Where we process personal data for your organisation as its processor, our Data Processing Agreement applies and forms part of these terms. It also covers the member details your organisation shares with us. If your organisation has signed a data processing agreement with us, that one applies instead. Otherwise, we process personal data as a controller, as described in our Privacy Policy.

8.7 Fees. Fees for organisation plans are those agreed with you in writing, or shown to you when you buy.

8.8 Liability and indemnity. Sections 19 and 20 apply to business users instead of section 18.

9. AI features

9.1 Where we use AI. Copilot uses AI models to:

• reply to your messages;
• describe images you send;
• work out trade instructions (section 7.8); and
• write market reports.

9.2 Our AI providers. We use AI models provided by third parties (currently OpenAI). To answer you, we send them your message, recent messages from the same chat, and relevant information about your vaults. Our Privacy Policy explains this in more detail.

9.3 Limits of AI. AI output can be wrong, incomplete or out of date, and it can sound confident even when it is wrong. No person checks the output before you see it. This includes market reports, which are created automatically. Check anything important yourself before you rely on it. AI output is not advice (section 6.4).

9.4 What not to send. Do not send Copilot private keys, recovery phrases, vault API keys, passwords, bank or card details, or personal information about other people.

9.5 Using AI output. You may use AI output you receive for your own purposes. Other users may receive similar output.

10. Copilot: messages, alerts and group chats

10.1 Messages we send. Copilot sends you:

• messages about your account and vaults, such as orders that were carried out, failed or were cancelled, deposits into your vault, your trading permission, and security issues; and
• updates, such as market reports and news about Copilot. You can stop these at any time by sending /stop_updates. You will still receive messages about your account and vaults.

You can stop all messages from Copilot by blocking it in Telegram. This also stops messages about your vaults and orders.

10.2 Alerts about other wallets. Copilot can alert you to trades made by wallets it follows ("smart money" alerts) and by wallets you choose to track.

• Copilot does not copy trades automatically. An alert may include a Copy button, which lets you start a similar trade yourself. You decide whether to make it.
• Alerts can be delayed or incomplete, and they are deleted from the chat after a short time.
• If you submit a wallet address for analysis, we may add it to the list of wallets whose trades Copilot reports to other users.

10.3 Group chats. Copilot works only in private chats. If it is added to a group chat or channel, it ignores the messages there.

10.4 Referrals. We do not run any programme that rewards you for inviting other people. If we start one, we will show you its rules before you take part.

11. Third-party services, networks and protocols

11.1 Services we rely on. The Services depend on services we do not control. They include:

• blockchain networks;
• the exchanges and exchange aggregators that vault trades go through (1inch, Odos and Uniswap);
• price feed providers (mainly Chainlink);
• blockchain data providers;
• wallet software, wallet providers and wallet connection services (such as WalletConnect);
• Telegram;
• Google sign-in;
• our payment provider, Revolut; and
• our AI providers.

11.2 Their terms. Your use of a third-party service, such as Telegram or your wallet, is also covered by that provider's own terms. Copilot works only through Telegram, so if you lose access to your Telegram account you may lose access to Copilot. Add an email address to your account so that you can still sign in to the web app. If you lose access to your wallet, we cannot recover it for you.

11.3 Our responsibility. We choose these providers with reasonable care, and we are responsible for how we use them. We are not responsible for their own acts or failures where we could not reasonably have prevented the loss (section 18.4).

11.4 Links. The Services may link to other people's websites and services. A link does not mean we endorse them.

12. Fees and paid plans

12.1 Free use. You can use many features of the Services for free. The pricing page shows the limits of the free plan.

12.2 Paid plans. We sell the paid Pro and Max plans through the pricing and billing pages of the web app and of AgentCouncil, and our Subscription Terms apply to them. One plan covers Aspis, including Copilot's premium features, and AgentCouncil. Copilot has no separate paid plan of its own. The prices we show include any VAT that applies.

12.3 Vault fees. A vault's creator sets its fees (section 7.2), and the vault's smart contract takes them. They are shown on the vault page before you deposit.

12.4 Network fees. You pay the network fees (gas) for transactions you make from your own wallet, including signing, renewing or revoking a trading permission. For Copilot-run vaults and legacy vaults, we currently pay the network fees for the trades our software sends. If we decide to start charging for them, we will tell you at least 30 days before we do.

12.5 Complimentary plans, offers and promotional codes. If we give you a paid plan free of charge, it is a complimentary plan. It never turns into a paid plan, and our Subscription Terms explain how it works. If we offer a promotional code or another offer, we will show you its conditions when we make the offer, and we will honour them. We do not give plans, features or discounts for depositing into a vault or trading.

12.6 Tax. You are responsible for any tax due on your use of the Services, including on gains from cryptoassets and on manager fees you receive.

13. Acceptable use

You must not use the Services to:

• break any law, or commit fraud, launder money, finance terrorism or get around sanctions;
• manipulate any market, for example by wash trading, spoofing, pump-and-dump schemes, or trading ahead of the depositors in your own vault;
• publish false or misleading information about a vault, including about its strategy, its performance or who runs it, or promote a vault in a way that breaks financial promotion rules;
• pretend to be someone else, or use a wallet, Telegram account or account that you are not entitled to use;
• upload or send anything that is unlawful, infringes anyone's rights, is defamatory, hateful, sexually explicit or harmful, or contains malware;
• publish or submit anyone's personal data (including in a vault description or an allowlist) without the right to do so;
• use wallet tracking or analysis to monitor, profile or harass an identifiable person;
• gain or try to gain unauthorised access to the Services, our systems or smart contracts, or test them for weaknesses without our written permission;
• overload or disrupt the Services, or use a smart contract in a way it was not designed for;
• collect data from the Services by automated means, except through API keys we give you and in line with their documentation. Automated trading through a vault API key is allowed;
• copy, change, decompile or reverse engineer any part of the Services, except where the law allows you to;
• create several accounts to get around limits, or misuse free plans, complimentary plans or promotional codes; or
• send spam.

If you find a security weakness, please tell us at info@aspis.finance, and do not use or share it.

14. Content you provide

14.1 What this covers. "Your content" means anything you provide through the Services. Examples are a vault's name, description, links and logo; your nickname, display name and avatar; messages and images you send to Copilot; and feedback.

14.2 Your rights and our licence. You keep ownership of your content. You give us a non-exclusive, worldwide, royalty-free licence to host, store, copy, display, adapt (for example, resize or reformat) and share your content as needed to provide, maintain and improve the Services. For public vault information, this includes showing it publicly on the Services for as long as the vault is listed. The licence ends when you delete the content or close your account, except for:

• content recorded on a blockchain, which we cannot delete;
• copies that other people have already seen or saved;
• copies in backups, which are overwritten over time; and
• content we need to keep to comply with the law or to deal with a legal claim.

14.3 Public content. Anyone can see your nickname and avatar, and the name, description, links, logo and manager wallet address of any public vault you create. For a self-managed or Copilot-run vault, the manager wallet is your own wallet, so its address is public. Anything recorded on a blockchain is public and permanent. This includes deposits, withdrawals, trades, trading permissions and allowlists.

14.4 Your promises about your content. You must have the right to provide your content, and it must comply with section 13.

14.5 Reporting content, and what we do. Anyone can report content on the Services that they believe is illegal or breaks these terms. To do so, email info@aspis.finance with "Content report" in the subject. Say where the content is (for example, the vault address or page link) and why it should be removed.

• We review reports promptly.
• We may unlist a vault; remove or hide its name, description, links or logo; remove other content; or restrict an account.
• We cannot remove anything from a blockchain.
• If we act on your content, we will tell you what we did and why, unless the law prevents us. You can complain about our decision under section 21.

Our contact point for users and for authorities, including under the EU Digital Services Act, is info@aspis.finance. We deal with messages in English.

14.6 Feedback. If you send us ideas or feedback, we may use them without paying you or owing you anything.

15. Intellectual property

15.1 Our rights. We and our licensors own all intellectual property rights in the Services. This includes the software, design, text and reports, and the Aspis, Aspis Copilot and AgentCouncil names and logos. Some parts of the Services use open-source software, which has its own licence.

15.2 Your licence. As long as you comply with these terms, we give you a personal, non-exclusive, non-transferable licence to use the Services:

• if you are a consumer, for your own personal use; and
• if you are a business user, for your internal business purposes and as your plan or agreement with us allows.

15.3 Our names and logos. You must not use our names or logos in a way that suggests we endorse you or your vault, unless we agree in writing.

16. Changes to the Services

16.1 Changes we may make. We change and improve the Services over time. We may add, change or remove features:

• to comply with the law or with a requirement of a regulator or court;
• to protect the security of the Services or of users;
• to fix errors;
• because a third party we rely on changes or stops its service (for example, a blockchain network, a price feed provider, an exchange or Telegram); or
• to improve the Services or change what we offer.

16.2 Paid features. If a change significantly reduces what you get under a paid plan, the Subscription Terms explain the notice we will give you and your right to cancel and get a refund.

16.3 Stopping a Service. If we decide to stop providing a Service, or a significant part of one (for example, Copilot or automated trading for Copilot-run vaults), we will give you at least 60 days' notice by email, in the web app and, if you use Copilot, by a Copilot message. If we have to act sooner for legal, regulatory or security reasons, we will give you as much notice as we can. For Copilot-run vaults, the notice will explain what will happen to automated trading and open orders, so that you and your depositors have time to act. The end of legacy vaults on 31 December 2026 is set out in section 7.13.

16.4 Availability. We aim to keep the Services available, but they may sometimes be interrupted. This can happen for maintenance, because of a technical fault, or because a third party we rely on is unavailable. Where we can, we will tell you about planned interruptions in advance.

17. Suspending or ending your use of the Services

17.1 Ending by you. You can stop using the Services at any time and close your account as described in section 5.5. You can cancel a paid plan as described in the Subscription Terms.

17.2 Suspension by us. We may suspend or restrict your account or your access to all or part of the Services if we reasonably believe that:

• you have seriously or repeatedly broken these terms;
• you do not meet the requirements in section 4;
• we have to, because of the law or a requirement of a court, regulator or law enforcement body;
• it is necessary to protect you, other users or us from fraud, a security threat or significant harm (for example, if your account or API key appears to have been compromised).

This includes stopping our software from acting for a Copilot-run vault or legacy vault you own. If a renewal payment for a paid plan fails, the Subscription Terms apply instead: your account moves to the Free plan, and we do not suspend it for that reason.

17.3 Notice and reasons. We will tell you before we suspend or restrict your access and explain why. If we need to act urgently, we will tell you as soon as possible afterwards. The only exception is where the law, or a security or fraud concern, prevents us from telling you. You can tell us if you think we have made a mistake. We will lift the suspension once the reason for it no longer applies.

17.4 Ending by us. We may end our contract with you:

• if the reason for a suspension under section 17.2 is serious and is not put right within a reasonable time, by telling you; or
• for any other reason, by giving you at least 60 days' notice.

If we end our contract under the second bullet and you have a paid plan, we will refund the part of any payment that covers the period after the contract ends.

17.5 What happens when our contract ends.

• Your right to use the Services ends, and any paid plan ends as described in the Subscription Terms.
• Cryptoassets in your own wallet, and your vault tokens, are not affected.
• For a Copilot-run vault you own, our software will stop acting for it and we will cancel its open orders. You keep control of the vault from your own wallet, and you can revoke the trading permission there.
• For a legacy vault you own, our software will stop acting for it and we will cancel its open orders. We will claim any manager fees due and send them to your verified payout address.
• Depositors can still withdraw, subject to section 7.10.
• Some sections are meant to continue after the contract ends, and they will continue. These include sections 7.9, 7.10, 7.13, 14, 15, 18 to 22 and 24.

18. Our responsibility to you if you are a consumer

18.1 Your legal rights. The law says that:

• we must provide the Services with reasonable care and skill;
• digital content you pay for must be as described, fit for purpose and of satisfactory quality; and
• what we tell you about the Services must be accurate.

Nothing in these terms affects these rights. For free, independent advice about them, contact Citizens Advice (England and Wales), Advice Direct Scotland, Consumerline (Northern Ireland) or, if you live in the European Union, the European Consumer Centre in your country.

18.2 What we are responsible for. We are responsible for loss or damage you suffer that is a foreseeable result of our breaking these terms or failing to use reasonable care and skill. Loss or damage is foreseeable if it is obvious that it will happen, or if both we and you knew it might happen when our contract was made. We are not responsible for loss or damage that is not foreseeable.

18.3 What we do not exclude. We do not exclude or limit our liability for:

• death or personal injury caused by our negligence or the negligence of our employees, agents or subcontractors;
• fraud or fraudulent misrepresentation;
• breach of your legal rights described in section 18.1;
• damage to your device or digital content caused by defective digital content we supplied, where we did not use reasonable care and skill. If this happens, we will either repair the damage or pay you compensation; or
• anything else for which the law does not allow us to exclude or limit our liability.

18.4 What we are not responsible for. Subject to section 18.3, we are not responsible for:

• losses caused by changes in the price of cryptoassets, or by decisions you make (for example, to deposit, withdraw, trade or set an order). This does not apply where the loss was caused by our breaking these terms or failing to use reasonable care and skill; for example, if our software carried out a trade you did not instruct, or did not carry out an order in the way these terms describe;
• the decisions and actions of vault creators and managers (other than us), and of other users;
• the failure of a blockchain network, protocol, exchange, price feed or other third-party service, where we could not reasonably have prevented the loss;
• losses caused by your not keeping your account, wallet or API key secure, or by your not following these terms; and
• events outside our control (section 24.2).

18.5 Business losses. If you are a consumer, we provide the Services for your private use. We are not responsible to you for loss of business, business profit or business opportunity, or for business interruption.

18.6 Your responsibility to us. If you are a consumer, you do not have to indemnify us. You are responsible for loss you cause us by breaking these terms only where the law makes you responsible, for example because the loss was foreseeable.

19. Our responsibility to you if you are a business user

19.1 What we do not exclude. Nothing in these terms limits or excludes our liability for:

• death or personal injury caused by our negligence;
• fraud or fraudulent misrepresentation; or
• anything else that cannot be limited or excluded by law.

19.2 Implied terms. Except as set out in these terms, and to the extent the law allows, all terms implied by statute or common law are excluded.

19.3 Losses we are not responsible for. Subject to section 19.1, we are not liable to you for any of the following losses, whether in contract, tort (including negligence), breach of statutory duty or otherwise:

• loss of profits, revenue, sales, business, contracts or anticipated savings;
• loss of goodwill or reputation;
• loss or corruption of data;
• any indirect or consequential loss;
• losses caused by changes in the price of cryptoassets; or
• losses caused by the acts of vault creators and managers (other than us), other users, or third-party networks, protocols or services.

19.4 Our total liability. Subject to section 19.1, our total liability to you in any 12-month period, for all claims arising under or in connection with these terms or the Services, is limited to the greater of:

• £100; and
• the total fees you paid us in the 12 months before the event that gave rise to the claim.

20. Business users: indemnity

If you are a business user, you will indemnify us against losses, liabilities, costs (including reasonable legal costs), fines and penalties arising from any claim or action by a third party, to the extent it arises from:

• your breach of these terms;
• your breach of any law, including financial promotion, anti-money-laundering, sanctions, consumer protection and data protection laws;
• use of your API keys, unless the misuse happened because we failed to keep them secure; or
• your content.

A third party here includes your members, your customers, depositors in vaults you offer them, and regulators.

If a claim like this is made, we will:

• tell you about it promptly;
• let you take reasonable control of its defence;
• not settle it without your agreement, which you must not unreasonably withhold; and
• take reasonable steps to limit our losses.

21. Complaints

21.1 How to complain. If you are unhappy with the Services or with anything we have done, email info@aspis.finance with "Complaint" in the subject. Please tell us:

• your account email address or Telegram username;
• what happened and when;
• any relevant transaction hashes or vault addresses; and
• what you would like us to do.

21.2 What we will do. We will acknowledge your complaint within 5 working days, and we aim to send you a full response within 4 weeks. If we need longer, we will tell you why and when you can expect our response.

21.3 If we cannot resolve it. If we cannot resolve your complaint, we will email you the name and website of an alternative dispute resolution body that could deal with it, and tell you whether we agree to use it.

21.4 The Financial Ombudsman Service. We are not authorised by the FCA, so the Financial Ombudsman Service cannot consider complaints about the Services.

21.5 Personal data. If your complaint is about how we use your personal data, our Privacy Policy explains how to complain to the Information Commissioner's Office.

21.6 Going to court. You can also take your complaint to court (section 22).

22. Which law applies and where disputes are decided

22.1 Consumers. These terms are governed by the law of England and Wales.

• You can bring legal proceedings about the Services in the courts of England and Wales.
• If you live in Scotland or Northern Ireland, you can also bring proceedings in the courts where you live.
• If you live outside the United Kingdom, you keep the protection of the mandatory consumer laws of the country where you live, and you may also be able to bring proceedings in that country's courts.

22.2 Business users. These terms, and any dispute or claim arising out of or in connection with them or the Services (including non-contractual disputes or claims), are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

23. Changes to these terms

23.1 Why we may change these terms. We may change these terms:

• to reflect changes in the law or in regulatory requirements;
• to reflect changes to the Services (section 16);
• to reflect changes in how we run our business that affect these terms, for example a new provider; or
• to make them clearer or correct mistakes.

23.2 Notice. If a change affects you, we will tell you at least 30 days before it takes effect and explain what is changing. We will tell you by email if we have your email address, in the web app, and by a Copilot message if you use Copilot. We may make some changes without notice: minor changes that do not affect your rights (for example, correcting typing mistakes), and changes that are only to your benefit.

23.3 Your choice. If you do not agree to a change, you can stop using the Services and close your account before the change takes effect. If you have a paid plan and the change is significantly to your disadvantage, you can also cancel the plan and get a refund as described in the Subscription Terms. If you keep using the Services after the change takes effect, the changed terms will apply to you. If a change is significant, we may ask you to accept it before you continue.

23.4 Previous versions. We keep previous versions of these terms and will send you a copy on request.

24. Other important terms

24.1 How we communicate. We contact you by email, in the web app, or by a Copilot message. When these terms say "in writing", this includes email. Please keep your contact details up to date.

24.2 Events outside our control. We are not responsible for delays or failures caused by events outside our reasonable control. Examples are a failure of a blockchain network, an internet or power failure, a cyber attack we could not reasonably have prevented, a natural disaster, war, or action by a government. If this happens, we will tell you and take reasonable steps to limit the effect. If it continues for more than 30 days and you have a paid plan, you can cancel the plan, and we will refund any payment for the time you could not use it.

24.3 Transferring our contract. We may transfer our rights and obligations under these terms to another organisation, for example as part of a reorganisation or a sale of our business. If we do, we will tell you and make sure the transfer does not reduce your rights. If you are unhappy with the transfer, you can end our contract. If you have a paid plan, we will refund you for the period after it ends.

24.4 Transferring your rights. You may transfer your rights or obligations under these terms to someone else only if we agree in writing.

24.5 Nobody else has rights under these terms. Our contract is between you and us. Nobody else has any right to enforce any of its terms under the Contracts (Rights of Third Parties) Act 1999.

24.6 If a court finds part of these terms illegal. Each section of these terms operates separately. If a court or other authority decides that any part is unlawful or unenforceable, the rest stays in full force.

24.7 Delay in enforcing. We may not insist straight away that you do something these terms require, or we may delay taking steps against you. That does not mean you do not have to do it, and it does not stop us taking steps against you later.

24.8 The whole agreement. These terms, together with the documents in section 2.5 that form part of our contract, are the whole agreement between you and us about the Services.

• Consumers. This does not affect anything we told you before you entered into our contract that the law treats as part of it.
• Business users. You confirm that you have not relied on any statement that is not set out in these terms. Nothing in this section limits liability for fraud.