Anuxis Terms and Conditions

Version 2 · in force from 15 October 2026

These terms govern your use of Anuxis. They are written to be understood: if anything is not clear, write to us at info@anuxis.com and we will explain it.

1. Who provides the service

Anuxis is a trade name of Surfer Koala, S.L., tax ID (CIF) B22655120, with its registered address at Calle Trébol A, 14 · 14710 Córdoba (Spain).

Whenever these terms say "we", "us" or "Anuxis", they mean Surfer Koala, S.L.: the party that enters into this contract with you, issues your invoices and answers for what is promised here.

You can write to us at any time at info@anuxis.com.

2. What Anuxis is, and what it is not

Anuxis stores encrypted documents and delivers them to the people you designate, when a condition you set is met. That is all it does, and it is a lot: the value lies not in storing things, but in making sure something reaches someone at a time when you may not be able to see to it yourself.

How it works, in four steps:

1. You upload documents, passwords or instructions to your library. Each file lives there for as long as your account exists.
2. You create delivery folders. A folder does not contain files: it is the list of which of your files will go, and to whom.
3. You designate recipients for each folder, in an order, and you choose **the condition under which** it is delivered.
4. When the condition is met, we notify you where applicable, verify the recipient in two steps and deliver those files to them.

What we do is a task you entrust to us

When you designate someone, you instruct us to deliver certain files to them if a condition is met. No more and no less. We do not decide who is entitled to what, we do not judge whether your instruction is appropriate, and we do not get involved in family, inheritance or any other kind of relationship. That is not our business, and we do not want it to be.

That instruction has a legal recognition you should know about. Article 96 of the Ley Orgánica 3/2018 (Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights, LOPDGDD) —"Right to a digital will" (our translation)— provides that "the person or institution whom the deceased has expressly designated for that purpose" (our translation) may request, in accordance with the instructions received, access to the deceased person's content; and Article 3 of the same law says the same about their personal data. The recipient you designate in Anuxis is precisely that person designated by you. We are not inventing a role: we provide the means for one the law already contemplates.

What Anuxis is NOT

This is worth reading slowly, because it sets the limits of what you can expect.

• It is not a will, nor a substitute for one. Nor does it replace a notary, an executor, a lawyer or an adviser of any kind. You should know that, according to the Spanish Government itself, there is no such thing as a "digital will" in the strict sense: that concept "may cause confusion" (our translation), and the way to give legal effect to your digital wishes is still a will made before a notary or a supplementary document, also before a notary. If you want something to have effect on your estate, Anuxis is not the tool for that: **use it in addition to whatever you need to do, never instead of it**.
• The regulation that will implement Article 96 does not exist yet. The law itself leaves it to a royal decree which, as of the date of this text, has not been published. This means that there are no formal legal requirements we could claim to meet: what we do is carry out your instructions, not certify them before anyone.
• It is not advice. We do not review what you upload, and we do not tell you whether it is complete, correct or sufficient, or whether it will serve the purpose you have in mind.
• It is not a custody service with a declared value. We do not know what you store or what it is worth, and we do not price it. Clause 12 comes back to this.
• It is not a zero-knowledge service. There is a technical route by which your files can be opened, and it exists because the service would not work without it. We tell you exactly what it is, what it is for and who can use it in clause 11, because we would rather you knew than assumed.

3. Your account

To sign up we need your name, an email address, a mobile phone number and a password of at least 10 characters. You must accept these terms expressly, and we keep a record of which version you accepted, in which language, when and from which IP address.

We verify your email with a single-use link.

You must be of legal age. By signing up you declare that you are at least 18 years old and have the legal capacity to enter into contracts. This is not a formality: this service delivers documents to third parties in circumstances in which you may be unable to intervene, and that cannot be done on the instructions of a minor without those who represent them. If we find that an account holder is a minor, we will close the account without penalty and refund the unused proportional part.

Three things are your responsibility, and we cannot take them on for you:

• That your details are true and up to date. If your email or your phone stops working and you do not update them, we will no longer be able to notify you — and notification is the piece everything else depends on.
• Your password. Keep it safe and do not share it. If you think someone has got into your account, change it and let us know.
• Whatever happens from your account. Anything done with your credentials is deemed to have been done by you.

You can turn on two-step verification, and we recommend it: it is the difference between a leaked password being a scare or a real problem. You can also mark browsers as trusted, so they stop asking you for the code for 30 days.

If you lose your password, you reset it from your email and your files are still there. There is no recovery phrase you have to keep and nothing you can lose forever. How that is possible is explained in clause 11, and it is important that you read it.

4. The 30-day trial

When you sign up you get a 30-day free trial, with no card required, on the plan you choose when signing up. If you do not choose one, the trial is on the Personal plan. There is no permanent free plan, and there will not be one.

Deliveries work during the trial. This is deliberate: the situation this product covers does not wait until you have paid.

If you do not subscribe when the trial ends, you have 30 more days to log in and download whatever you want. When the trial expires, deliveries are turned off — nobody has paid yet, and triggering an irreversible delivery to a third party on behalf of someone who may only have been trying the service out could do more harm than good. Once those 30 days have passed, your account and your content are deleted.

5. The content you upload

What you upload is yours and remains yours. We acquire no rights over it. The only thing you authorise us to do is store it encrypted and deliver it to whoever you designate, which is what you have asked us to do. That authorisation ends when you delete the content or when your account is deleted.

By uploading anything you declare to us that you have the right to store it and to deliver it to the person you have designated, that it does not infringe third-party rights or the law, and that it is not unlawful content.

We cannot check this, and it is important to understand why. Your content is encrypted before it is stored and we do not look at it: there is no review of any kind, automated or human, of what is inside. That is a guarantee for you and, at the same time, the reason why the declaration above is all we have. What you upload is your responsibility.

Prohibited content

Precisely because we cannot review it, it is prohibited to upload, store or have delivered through Anuxis:

1. Child sexual abuse material, in any form and without exception.
2. Content that constitutes a criminal offence under Spanish law or the law of the account holder's or the recipient's country: terrorism, human trafficking, trafficking in arms, drugs or protected species, non-consensual sexual material, and incitement to hatred or violence.
3. Works protected by copyright over which you hold no rights or authorisation, and content that infringes other people's trademarks, patents or trade secrets.
4. Personal data of third parties that you are not entitled to process or to disclose to the recipient you designate: other people's databases, other people's credentials, or information obtained unlawfully.
5. Classified or defence material, and documents subject to someone else's duty of confidentiality —professional, medical or judicial— without authorisation to hold them.
6. Malicious software: viruses, trojans, ransomware or any code intended to cause damage or to gain unauthorised access.
7. Content whose mere possession is unlawful in the account holder's or the recipient's country.
8. Using the platform as a means of money laundering, of concealing evidence or of evading a legal obligation to keep or to hand over documents.

What we will do if we receive an order. Faced with an order from a court or a competent authority, we will cooperate to the extent the law requires, and we will tell you unless we are prohibited from doing so. Without such an order we open nothing: the technical route in clause 11 exists so that the service works, not so that we can look.

Breach of this clause entitles us to suspend or close your account without a refund, without prejudice to any liability you may have towards third parties.

6. Your recipients

You can designate recipients and assign them to your folders, in order of priority. We need their email address and mobile phone number, because the key with which they will open what you deliver to them is derived from those two pieces of data.

By adding a contact you declare to us that you are authorised to give us their details and to designate them as a recipient, and we ask you to confirm this expressly when you create them. You also declare that their contact details are correct, and that you understand that receiving something does not give them any right over what is delivered beyond receiving it.

We ask your recipient for their consent. When you designate them, they receive a notice to verify their email and their phone, and at that point we explain what Anuxis is and ask them to accept our privacy policy. If they do not accept it, they are not verified — and you will see that in your list: it shows whether they have verified their email and their phone and whether they have accepted. Until they do, nothing can be delivered to them.

Your recipients have rights of their own, independent of yours. Any of them may, at any time and after proving they are who they say they are:

• Withdraw from your folders. If they do, we will tell you, and you will need to designate someone else: a folder with no recipient delivers nothing.
• Ask us to stop processing their data. We will then delete whatever identifies them and stop writing to them in connection with this designation. That distinction is deliberate: if the same person also has their own Anuxis account, they will keep receiving what relates to their account —their invoice, the code to log in— because that arises from their own contract, not from anyone's instruction. You should also know what "delete" means here, because it is not the same as disappearing: we keep the trace of activity on the platform, in a form that no longer identifies them, because there are record-keeping obligations we cannot breach and because a service that delivers documents to third parties must be able to explain afterwards what happened. This retention is based on Article 17.3 of the GDPR (Regulation (EU) 2016/679). And to be able to honour that request we keep a fingerprint of their email and their phone —not the data itself: a value that cannot be reversed— because you cannot stop writing to someone you cannot recognise. Only if they had verified them: what nobody has confirmed does not go on any list.
• And if they are later designated again —by you or by another customer— the process starts over: they will be asked again to verify their email and their phone and to accept whatever they need to accept.

7. Delivery

How it can be triggered

There are four ways, and you choose them, folder by folder:

The activity check (heartbeat), by default, checks in with you every 30 days and gives you 7 days' grace after the reminder. You can set the check-in anywhere between 7 and 365 days and the grace period between 1 and 30. If you do not confirm within the grace period, delivery starts for the folders that have that condition.

You can choose to have logging into your account count as a sign of life, so that you do not have to remember anything. If you do, bear two things in mind: the mechanism becomes only as strong as your password —anyone who could log in would also postpone the delivery— and logging in does not count forever: after a cap, which is the greater of 90 days and twice your interval, you have to confirm by clicking.

With a recipient's request, we notify you and you decide. If you do not reply in time, whatever you have configured applies, and by default it is refused: when your documents are at stake, not delivering is the safe side. If you choose approval by default, the time limit cannot be less than 12 hours, so that a request made at night is not approved before you have had time to look at your phone; if you choose refusal, the minimum is 1 hour. The maximum is 30 days.

And if it is your silence that triggers the delivery, there is a 48-hour window before anything goes out, so that you can stop it. The other three methods do not have one, and that is not an oversight: with manual delivery you have just clicked and typed the folder's name; with a scheduled date you chose the date; and with a recipient's request the window is the reply time you configured.

What we guarantee, stated precisely

We guarantee that we send it: when the condition you set is met, we send the notice to the recipient you designated, using the details you gave us, and we make available to them what you prepared for them.

What we cannot guarantee is what happens on the other side. An email ending up in the spam folder, a number that has changed hands, the person not opening the message or not wanting to receive it: none of that is in our hands. You provide the contact details and it is up to you to keep them up to date; that is why we remind you when a long time has passed without you confirming they are still valid.

Nor can we guarantee when it will arrive, beyond the time limits in this clause: sending depends on email and SMS providers, and clause 12 deals with that.

How the recipient receives what is theirs

1. A link by email, with a single-use token.
2. A 6-digit code by SMS, valid for 15 minutes.
3. The download, as a ZIP file decrypted on the fly.

There are limits on attempts at each step. The key that decrypts their copy is derived from their email and their phone: each recipient opens only what is theirs, and from a phone that is not theirs nothing can be decrypted.

If there are several recipients

You can deliver to all of them at once or in cascade, in order of priority. In cascade, the wait between one recipient and the next is 24 hours by default and you can configure it. You also choose what happens if someone declines: move on to the next one or stop the delivery.

A delivery that has started is completed

You can cancel it as long as nobody has downloaded anything. After that, you cannot: what someone has already taken, they keep.

And a delivery that has started is completed, even if your subscription ends while it is in progress. The reason is simple: your recipient was sent a link with its own expiry, and taking it away halfway would mean breaking a promise to a third party who has done nothing wrong.

8. Price, payment, taxes and renewal

These are final prices, VAT included, for a consumer in Spain: it is what you will pay. Within a folder there is no limit on the number of files; the cap is on the contacts in your address book.

We only bill yearly. There is no monthly billing cycle.

Taxes

The VAT that applies to you depends on where you are and what you are, because this service is supplied electronically:

• Consumer in Spain: Spanish VAT.
• Business in another EU country with a valid EU VAT number: no VAT, under the reverse charge —you account for the tax yourself—. For this **we check your EU VAT number in the EU VIES database**: a number that has been typed in but not checked is not enough, and we will check it again at every renewal.
• Consumer in another EU country: Spanish VAT as long as we do not exceed the EU threshold for cross-border sales; beyond that, your country's VAT.
• Outside the European Union, or in a territory excluded from VAT —the Canary Islands, Ceuta, Melilla and the other territories left out by the EU VAT Directive (Council Directive 2006/112/EC)—: no VAT.

The base price is the same for everyone; what changes is the tax added to it. You will see it broken down on the invoice, with the appropriate statement.

The country and postcode you give us determine the tax, so they should be accurate. If they change, update them. The same goes for your EU VAT number: it counts from the moment you give it to us, and a sale already invoiced does not change its tax because you provide it later.

Payment

Payment is by card through Redsys, the payment gateway shared by Spanish banks. Your card number does not pass through our systems: we keep an identifier the gateway gives us and the last four digits —when the bank provides them— and we use that identifier to charge the renewals.

Renewal is automatic, one year at a time, unless you cancel beforehand. We notify you 30 and 7 days before each renewal, with the amount and the date. We issue an invoice for every charge and you can find it in your account: a full invoice if you have given us your tax ID number (NIF), and a simplified invoice if not. If you add it later, you can ask from your account for the simplified invoices of the last four years to be reissued to you as full invoices, with your tax ID.

If you upgrade or downgrade

Upgrading takes effect immediately. Downgrading is scheduled: you keep the whole period you have paid for and the new plan starts at the next renewal. You can cancel a scheduled downgrade before it takes effect.

You cannot downgrade to a plan that cannot hold what you have stored. We do not delete anything ourselves —you choose what to remove— but the downgrade is not scheduled until your folders, your contacts and your files fit within the limits of the new plan.

And if, between requesting the downgrade and the next renewal, you go over those limits, the downgrade does not take effect: you stay on your current plan and are charged for it. We warn you about this in the renewal reminders, with both figures —what you would pay if you cut down and what you will pay if you do not— because nobody should find that out from their bank statement.

9. Withdrawal and refunds

If you are a consumer, you have 14 calendar days from the date of purchase to exercise your right of withdrawal, without giving any reason. You do it from your account, on the Subscription page, with the “Withdraw from contract here” button: you confirm your name, the contract and the email address where you want the acknowledgement, and you press “Confirm withdrawal”. We immediately send you an acknowledgement of receipt with the date and time. If you prefer, you can also write to us at info@anuxis.com.

We refund the unused proportional part, calculated by days, without you having to ask for it: it goes back automatically to the card you paid with. That is more than the law requires of us, and we do it because the amount is small and we do not want to argue with someone who has just decided they do not trust the service. If you subscribed during the trial, the period you paid for starts when the trial ends: until then you have used nothing and we refund it in full. The period counts from when you subscribed, not from each renewal.

Outside that period, cancelling does not entitle you to a refund: you keep the period you have already paid for until it ends, and the subscription is not renewed.

And in addition, regardless of the above: if something has gone wrong on our side and as a result you are not satisfied with the service, we may agree on a refund —partial, prorated according to the period used, or full— when that is the most reasonable way to resolve it. In any event, and so that it is clear from the outset, the maximum compensation you can obtain from us for any claim is the amount you have paid us in the last twelve months, less anything we have already refunded you in that time. Clause 12 comes back to this.

10. Term, non-payment and the life cycle of your account

Your subscription lasts one year and renews automatically. You can cancel it whenever you want: if you have paid time left, you enjoy all of it and the subscription is not renewed.

If a payment fails, this is exactly what happens:

During the grace period we retry the payment three times, every three days.

Delivery is guaranteed for the 30 days following the end of the last period you paid for. That is the specific promise, and it is counted by date, not by chaining stages. Those are the days of the grace period: during recovery deliveries are turned off, and promising delivery at a stage in which we announce that we do not deliver would be saying two things at once.

Before deleting, we notify you twice: 15 days and 3 days before deletion. Both notices reach you while you can still log in and download. Deletion goes ahead even if you do not reply — an abandoned account is precisely the one that will not reply, and making deletion depend on a reply would force us to keep indefinitely the data of someone who has already left.

If you delete your account yourself, it moves to recovery and you have 30 days to download before the content is deleted.

11. Security, and what Anuxis can see

This is the clause we most want you to read in full.

How it is protected

Each file is encrypted before it is stored, with AES-256-GCM and a key of its own. That key is stored wrapped three times, with three different keys:

• with a key of yours, derived from your password — which we do not know;
• with a key of your recipient's, derived from their email and their phone;
• and with a key of ours, which lives outside the database and outside the backups.

Your password is stored with bcrypt; the names of your folders and your contacts' details are encrypted in the database; backups leave the server encrypted with a key whose private half is not on the server.

That third key: what it is for, and what it is not for

What it is for. The only two things that could not work without it:

1. Delivering. When the condition you set is met, the key of each file has to be opened so it can be wrapped with your recipient's key. If that depended on your password, there would be no delivery on the day you cannot type it — which is precisely the day you signed up for this.
2. Letting you recover your password. If you forget it, you reset it from your email and your files are still yours. What happens underneath is that the keys are wrapped again with your new key. Without that third key, forgetting your password would mean losing everything for ever.

What it is not for, and this is a commitment: no one at Anuxis can read the content of your files. It is not an internal policy you may or may not believe: it is how the system is built. The admin panel has no way of viewing content; and when someone from support enters your account to help you —which requires a justification— we notify you by email at that moment, with their name and the reason, and it is recorded in your activity log. That person sees your screens as you see them, including the names of your folders, your files and your contacts, but they do not have your key, so a download simply does not work. There is also a list of actions a support session cannot perform, and it is checked automatically that this list covers everything that touches your key or the custody copy.

What this means, without embellishment

Anuxis is not a zero-knowledge service. The architecture protects against theft of the database, against access to the disks and against anyone who makes off with the backups; it does not protect against an attacker who took control of our running server. We would rather say so than sell you a word that does not hold up.

What data we see in clear text

Your name, your email, your phone, your billing details, and your recipients' email and phone. We need them to charge you, to notify you and to notify them. And if you came to Anuxis through an ad or a campaign link, which one: it tells us which channels work. What we do not see is what you store.

12. Availability, providers and the extent of our liability

What we do

We run the service on dedicated infrastructure in the European Union, and we make daily backups, encrypted and stored off the server, also in the European Union, with locked retention: nobody, not even us, can delete them before their time.

What we do not guarantee

We do not guarantee uninterrupted availability, and we do not give you a percentage. It would not be honest: the service runs on third-party infrastructure whose commitments we cannot pass on to you, and promising a figure we do not control would be promising something that is not in our hands.

Who we depend on

Anuxis needs these providers in order to work, and we are not liable for failures that originate with them:

We will do what is reasonable to choose reliable providers, to monitor that they perform and to look for alternatives when they do not. What we cannot do is guarantee you someone else's service.

We do not know what what you store is worth

You do not declare a value, we do not appraise it and we do not price it: plans are charged by storage and by number of folders and contacts, not by what the content is worth. Consequently, the loss arising from something not arriving is not something we can foresee or quantify, and that is an intended consequence of how the service is designed, not a hidden clause.

Risks that exist and that you accept when you subscribe

• That a notice does not arrive because email or SMS fails, or because the contact details you gave us are no longer valid.
• That a recipient does not want to, or does not know how to, complete verification.
• That a provider incident leaves the service inaccessible for a while.
• That you lose your password and access to your email, in which case we cannot help you log in.
• That what you stored turns out to be insufficient, incomplete or unsuitable for what you intended: we do not review that.

The limit

The maximum amount you can claim from us on any grounds is the amount you have paid us in the last twelve months, less anything we have already refunded you in that time. Nothing in the above excludes our liability for wilful misconduct, for gross negligence, or any other liability that the law does not allow to be excluded towards a consumer.

And once more, because it is what prevents the most problems

Anuxis is not a substitute for anything. Not for a will, not for a notary, not for telling someone you trust where your things are. It is one more layer, and it is best that it not be the only one.

13. Retention and deletion of your data

What is deleted: your encrypted files, your delivery folders, your recipients, your library, your inactivity settings and your recovery codes.

What is emptied: your personal data and your card identifiers. The row for your account does not disappear, because your invoices hang off it; what is removed is what makes it personal.

What we keep, and why:

• Your invoices and payment records. Because the law requires it: **Article 30.1 of the *Código de Comercio* (Spanish Commercial Code) requires business records to be kept for six years**, and Article 30.2 adds that ceasing business does not release a company from that duty. The invoice keeps its own copy of your details, so emptying your account does not leave it incomplete.
• The record of which terms you accepted and when. It is the proof of your consent (Article 7.1 of the GDPR) and it would disappear precisely when it might be needed.
• The activity log, in a form that does not identify you. It is a chained log that cannot be altered, and there are traceability obligations we cannot breach.

All of this is based on Article 17.3 of the GDPR: the right to erasure does not extend to what there is a legal obligation to keep.

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@anuxis.com. The details are in our privacy policy.

14. Intellectual property

The service, its software, its design, its documentation and the Anuxis brand belong to us or to our licensors. You may not copy them, decompile them or use them outside the service.

Your content remains yours, as clause 5 says. We use it for nothing other than storing it and delivering it according to your instructions. We do not analyse it, we do not use it to train any system and we do not pass it on to anyone.

15. Changes to these terms

We may change these terms, and when we do we record the new version with its fingerprint and its date, so that it is always possible to know exactly which text each customer accepted and when.

How we tell you: by email, 30 days in advance, and in the application itself when you log in.

What happens if you do not accept:

• Your silence does not amount to acceptance. We will not treat a change as accepted because you have not read an email.
• Until you accept, your account keeps working and so do your deliveries. What you will not be able to do is change your settings: turning off your deliveries over a change in the terms would be using what you have already paid for as leverage, and we are not going to do that.
• Accepting the current version is a condition for renewal. If your renewal comes round and you have not accepted, the subscription is not renewed and enters the normal cycle in clause 10, with your files available for download during that time.
• And if the change makes what you were offered worse, you can cancel straight away and we will refund the unused proportional part.

16. If Anuxis stops providing the service

A service that exists to be there on the day it is needed has to say what would happen if it closed. This is what we would do, and we are bound by it:

1. We would give you at least one year's notice.
2. We would stop renewing subscriptions. Since they are yearly, each one would expire on its own and enter the normal cycle in clause 10: 30 days of grace, 30 days of recovery to download, and deletion.
3. Once all of them had expired and been deleted, the platform would be dismantled.
4. Whatever there is a legal obligation to keep —the billing records— would be kept for the required period and no longer.

In other words: nobody would be left without notice, and nobody would lose their content without having had their sixty days to download it. It is not an improvised plan: it is the cycle that already exists.

17. Governing law and dispute resolution

These terms are governed by Spanish law, and by the European Union legislation that applies to it.

For any dispute, the parties submit to the Courts and Tribunals of Córdoba (Spain).

If you are a consumer, the above takes nothing away from you. You keep your right to sue us before the courts of your own place of residence and to have the consumer protection rules of your country of residence applied to you insofar as they are more favourable to you, in accordance with the EU Regulations on jurisdiction and applicable law (Regulation (EU) No 1215/2012, Brussels I bis, and Regulation (EC) No 593/2008, Rome I). Submission to the courts of Córdoba applies without reservation only when you subscribe as a business or professional.

18. Contact

Surfer Koala, S.L. · Tax ID (CIF) B22655120 · Calle Trébol A, 14 · 14710 Córdoba (Spain) · info@anuxis.com