Terms of Use

Introduction

Welcome to the XHON platform. This document constitutes a binding legal agreement between you and the operator of the platform (the "Operator", "we" or "XHON"), and sets out the terms of access to, sign-in to and use of the website, the applications, the API, the OAuth/MCP protocols and every other capability of the system (the "Platform" or the "Service").

XHON is an intelligence platform for the Israeli capital market, based on public filings and data from the MAGNA system of the Israel Securities Authority and the MAYA system of the Tel Aviv Stock Exchange, combining capabilities of ingestion, processing, search, monitoring, alerts, data extraction, summarization and smart interaction through artificial intelligence. By reading these terms, accessing the Platform, signing in to it or continuing to use it, you represent that you have read them, understood them and agreed to all of their provisions, including our Privacy Policy, which forms an integral part of this document.

We recommend reading these Terms of Use in full before using the Platform. Failing to read the terms, or relying on a summary or an external interpretation, does not release you from your obligations under this document. If you do not agree to the terms, you must refrain from any use of the Service.

It is important to make clear from the outset: XHON is not an investment house, a portfolio management company, a broker, an investment adviser, a tax adviser, a legal adviser or any other party licensed to provide financial services, professional advice or to execute transactions. The content displayed on the Platform - including insights, summaries, news items, extractions, dashboards, due-diligence packages and AI agent responses - is provided for purposes of information, research, monitoring and professional analysis only, and does not constitute investment advice, a recommendation to act, a professional opinion or an offer of a transaction.

These terms may be updated from time to time. We will publish the updated version on the Platform and state the date of the update. Your continued use after an update constitutes acceptance of the updated terms. For legal inquiries: info@xhon.io.

1. Definitions

In this document, unless the context requires otherwise, the following terms shall have the meanings set out below:

"Platform" - the XHON website, system, applications, API, OAuth/MCP protocols, WebSocket channels, background processes (workers), real-time alert mechanisms, and every module, capability, interface or service provided by the Operator - including: filings (the reports feed), report search, tracking and dashboard, alerts, due diligence, news and the AI agent.

"Operator" - the entity operating the XHON Platform, which controls and/or manages the relevant databases, including its officers, employees, subcontractors and service providers acting on its behalf.

"User" - any person or entity that browses, registers, signs in to or uses the Platform, including a visitor, a registered user, a system administrator (ADMIN), an API user, an OAuth/MCP client, and any party acting through an account or permission granted to it.

"Content" - any information, data, text, image, chart, report, summary, news item, alert, extraction, response, metadata, visual representation or other output displayed on, derived from, exported from or stored on the Platform.

"Public Content" - filings, documents and data received from public sources, including the MAGNA system of the Israel Securities Authority, the MAYA system of the Tel Aviv Stock Exchange, the Tel Aviv Stock Exchange websites, official publications of companies and reporting entities, and other open sources that do not constitute private information or a trade secret of the User.

"AI Content" - content generated, processed, summarized, translated, extracted, analyzed or displayed by means of artificial intelligence - including Google Gemini, Cloudflare Workers AI and other AI providers - including news items, summaries, financial extractions, AI agent responses and generated images.

"Account" - a registered user profile in the system, including identification details, permissions, role, status, activity history and stored data associated with the User.

"MAGNA" - the electronic reporting system of the Israel Securities Authority, which is a primary source of the regulatory filings and public documents displayed on the Platform.

"MAYA" - the information and reporting system of the Tel Aviv Stock Exchange Ltd., which is a primary source of market data, the entity catalog, trading and other public information displayed on the Platform.

"OAuth" / "MCP" - protocols for connecting third-party applications (including AI tools and agents) to the Platform, for controlled access to data and the performance of authorized actions.

2. Acceptance of the Terms

Any access to, sign-in to or use of the Platform - whether in full or in part - constitutes your express, full and unconditional agreement to these Terms of Use and to our Privacy Policy, which forms an integral part of this document.

You represent and undertake that you are acting on your own behalf, and where you act on behalf of a corporation, organization, institution or any other legal entity, that you have been authorized to do so and hold full and valid authority to bind that entity to all the provisions of these terms.

If you do not agree to these terms, to any part of them or to their interpretation, you must refrain entirely from any access to, sign-in to or use of the Platform and its related services.

This agreement also applies to the use of the API, OAuth/MCP and WebSocket, to receiving alerts, to exporting data and to any other interaction with the system - including indirect use through a third-party application that you have authorized.

3. Eligibility and Account Management

The Platform is intended solely for professional and organizational use, and for users aged eighteen (18) or over who have the legal capacity to enter into a binding agreement.

You may register for the Platform independently (with email and password, or through Sign in with Google / Google Sign-In), or receive an invitation from a system administrator or an organization administrator to an organizational account. Independent registration creates a personal account; joining an organization is performed by an authorized administrator.

Google Sign-In: by choosing to sign in or register with Google, you confirm that XHON will request and receive Google user data to the minimum extent required for authentication - email, name/profile and the OpenID identifier (scopes: openid, email, profile) - solely for the purposes of creating an account, verifying identity and signing in, as detailed in the Privacy Policy. The use of Google Sign-In is also subject to Google’s terms.

You undertake to provide accurate, complete and up-to-date details, and to update them promptly and in the manner the change requires - including identification details, contact details and permission details.

You bear sole responsibility for maintaining the confidentiality and security of your sign-in details, API keys, OAuth permissions and any other means of access provided to you - and for any activity carried out through your Account, whether performed by you or by a third party that obtained access, with or without your knowledge.

In the event of suspected unauthorized access, leaked credentials, loss of an API key or misuse, you must notify the Operator and your system administrator as soon as possible, and take immediate security measures (changing your password, revoking the key, revoking OAuth permissions).

The Operator reserves the right, at its sole discretion and without prior notice, to refuse to open an account, or to suspend, block, cancel or delete an existing account - including, but not limited to, due to a breach of these terms, suspected misuse, a security risk, failure to meet payment terms (where applicable) or a regulatory or judicial requirement.

Users assigned the role of system administrator (ADMIN) are authorized to manage other users, grant and revoke permissions, reset passwords and manage API keys - and bear full responsibility for every administrative action they perform in that role, including granting permissions beyond what is necessary, exposing API keys and failing to revoke the access of employees who have left.

A deleted account (status DELETED) cannot be used. Certain information may be retained for a grace period for backup, audit and legal compliance purposes - as detailed in the Privacy Policy.

4. Description of the Service

XHON provides tools for intelligence, monitoring, search, organization, analysis, alerts and smart interaction - based on public filings and data from MAGNA and MAYA. The Service is intended to assist analysts, institutional investors, advisers, lawyers, accountants, due-diligence teams, financial journalists and other professionals - but does not replace professional judgment, independent review or licensed advice.

The Platform operates continuously to ingest new filings and data from MAGNA and MAYA, to process and index them, to extract structured data, to generate insights and to present them in a unified interface. Some processes run in real time, and some run in background processes (background workers) that may take minutes or hours.

5. Artificial Intelligence - Disclosure, Limitations and Responsibility

The Platform uses artificial intelligence - including Google Gemini - to extract financial data from reports, generate news items, summarize reports, respond through the AI agent, analyze texts and perform other operations. Images for news items may be generated using Cloudflare Workers AI (the Flux model). The current due-diligence packages compile public filings without AI processing.

AI Content is generated automatically, without systematic human review prior to publication, and may be incorrect, partial, outdated, lacking context, misleading, imprecisely worded or affected by algorithmic biases (hallucinations), OCR errors, model limitations, source quality, language (Hebrew/English) or document format.

The AI agent is not a human agent, is not a professional adviser and is not a representative of the Operator. Your conversations, your questions and your work context are sent to Gemini for processing - including the text of MAGNA reports, MAYA data, tracking data, search results and metadata. Gemini can make mistakes - as stated in the interface. The agent’s responses may involve calling tools that access your data on the Platform - reports, tracking, filings, alerts and more - in accordance with your permissions and your question.

AI news items are based on public MAGNA filings (and, where relevant, data from MAYA) and do not constitute an authorized journalistic publication, official confirmation by the Israel Securities Authority or the Tel Aviv Stock Exchange, a public announcement on behalf of a reporting company, a recommendation to act or a substitute for reading the original report.

Structured financial extractions (for example issuer capital structure, interested parties, report data) are based on dedicated prompts and models - and may err in identifying names, numbers, dates, units of measurement or regulatory context.

You represent that you are aware of the use of AI, that you do not rely on AI Content as proven fact or as a sole source, and that you will perform an independent review against official sources (MAGNA, MAYA, audited financial statements, official publications, corporate documents) before any reliance, publication, regulatory filing, legal document, investment decision or other professional action.

The Operator is not liable for damages arising from reliance on AI Content - including investment decisions, publications, regulatory filings, legal documents, representations to clients, content published on social networks or any other professional action.

The use of AI modules constitutes graduated consent to the processing of the relevant information - including its transfer to external AI providers - as detailed in the Privacy Policy.

6. Permitted Use and Prohibitions

You may use the Platform for legitimate professional purposes: research, monitoring, analysis, organization, documentation, preparation of internal working materials and generation of insights - subject to the law, these terms, your permissions and your organization’s policies.

Use of the Platform is conditional on your being legally authorized to access the content displayed, including public filings, and on your not infringing third-party rights, confidentiality obligations, contractual undertakings or regulatory requirements that apply to you.

7. OAuth, MCP, API and Third-Party Access

The Platform supports OAuth 2.0 and MCP (Model Context Protocol) for connecting AI applications, external tools and authorized automations.

By approving an OAuth connection, you agree to allow a third-party application to access the data and actions defined in the scope you approved - including reading reports, tracking, alerts and filings, performing searches, updating tracking (with the appropriate permission) and other authorized actions. You should review the list of scopes carefully before approving.

You are responsible for reviewing the reliability, security, privacy policy and behavior of any third-party application you approve. Permissions can be revoked through the consent interface or by contacting us. Revoking a permission may limit capabilities that depend on that connection.

API keys are managed by system administrators (ADMIN) only. Each API key is linked to specific permissions and is subject to rate limits and to API documentation published from time to time. The full key is displayed only once, at the time of creation - and is not stored on the server side.

Use of the API must be consistent with these terms. You may not share API keys, embed them in public code (public repositories), or use them outside the scope of their permission.

The Operator may revoke, restrict or change scopes, update protocols or discontinue OAuth/API access at any time - including due to a security risk, a technological change, a breach of the terms or a regulatory requirement.

Actions performed by a third-party application through OAuth (for example updating tracking or marking a message as read) are attributed to your Account - and you bear responsibility for those actions.

WebSocket and pub/sub channels (including Redis) are used for real-time alerts, news updates and system events - and are subject to the same access and permission restrictions.

8. Intellectual Property

All intellectual property rights in the Platform - including design, source code, architecture, user interface, brand, logo, algorithms, models, prompts, templates, documentation, structured databases and original content of the Operator - belong to the Operator or its rights holders, and are protected under Israeli and international intellectual property law.

Public Content (MAGNA filings, MAYA data, official documents, company publications) remains owned by its sources. XHON does not claim ownership of Israel Securities Authority filings, Tel Aviv Stock Exchange data, official documents of reporting companies or content originating from public bodies.

AI Content is generated for your personal/organizational use within the Service, subject to these terms. It may not be copied, distributed, sold, rented, published, translated, re-edited or used commercially without prior written approval from the Operator - including the use of AI Content as part of a product, service, sales report or commercial publication.

You may not create derivative works from the Platform, the code, the interface or the content - including building a competing product, replicating features or using structured information extracted from the Platform for commercial purposes - without approval.

Feedback, suggestions, ideas, bug reports and content that you provide to us may be used by the Operator without consideration, obligation, attribution or restriction, including to improve the Service.

The XHON name, the logo, the trademarks, the module names and any other commercial marking may not be used without prior written approval.

If you believe that content on the Platform infringes your intellectual property rights, contact info@xhon.io with details, proof of ownership and the action requested.

9. Confidentiality

The Platform may expose you to public information, professional information and your own organizational information (tracking, agent conversations, settings). You are responsible for handling the information you accessed through the Platform confidentially - in accordance with your contractual, regulatory and professional obligations.

If you receive access to the Platform under an organizational agreement, additional confidentiality undertakings toward your organization may also apply to you.

The Operator undertakes to take reasonable security measures to protect personal and organizational information - as detailed in the Privacy Policy. However, there is no undertaking of absolute confidentiality for content that you publish, enter or share through OAuth with a third party.

10. Subscription, Pricing and Payment

Access to the Platform may be subject to a subscription, a license or an organizational agreement - according to the pricing policy published on the website or agreed in writing with your organization.

Payment terms, billing cycle, cancellation, refunds, price changes, trial period, usage limits (number of users, modules, API calls) and other commercial terms will be published separately or set out in an agreement with the organization.

A new personal account, as well as an organization in its trial period, receives a trial period of 7 days from the date of the first successful sign-in, subject to the quotas published on the pricing page. At the end of the period, continued access to the advanced capabilities is conditional on a paid subscription or an organizational agreement. The length of the trial and its quotas for new users may change from time to time as published on the Platform.

Non-payment, expiry of a subscription, breach of a subscription agreement or exceeding usage limits may result in suspension, restriction of access, cancellation of modules or blocking of the Account - without liability for lost data.

Taxes, VAT and fees - in accordance with the applicable law and the pricing agreement.

The Operator may offer features, modules or services for a separate fee - to which additional terms will apply.

11. Availability, Changes and Discontinuation of Service

The Service is provided "AS IS" and "AS AVAILABLE". There is no undertaking of continuous or fault-free availability, of particular results, of accuracy, of completeness, of meeting an SLA or of fitness for a particular purpose.

The Operator may change, suspend, restrict, upgrade, replace or discontinue any module, feature, information source, AI provider, model, prompt, pricing, policy, interface or protocol - at any time, with or without prior notice.

Scheduled maintenance, faults, changes to MAGNA or MAYA (formats, availability, structure, API), regulatory changes, failures of third-party providers (Google Gemini, Cloudflare, cloud infrastructure, Apify), system load, force majeure events (war, natural disaster, strike, cyberattack) and technological changes may cause interruptions, delays, temporary loss of data or changes in functionality.

The Operator does not undertake to maintain backward compatibility of the API, OAuth scopes, data formats or interfaces - and may make changes that require integrations to be updated.

The Operator may discontinue the Service for a single account, for an entire organization or for all users - including in the event of a breach of the terms, non-payment, closure of operations, sale of the business or a regulatory requirement.

Upon discontinuation of the Service, a grace period for exporting data may be provided - but there is no undertaking to retain data permanently or to provide a backup after the end of the engagement.

12. Limitation of Liability and Indemnification

To the maximum extent permitted by law, the Operator, its officers, employees, managers, representatives, shareholders, suppliers and sub-processors shall not be liable for any direct, indirect, consequential, special, punitive or incidental damages, including loss of profit, loss of business opportunity, loss of goodwill, loss of data, damage to a third party, legal expenses or damages arising from reliance on Platform content (including AI Content), from discontinuation of the Service, from a technical fault, from a security incident or from unauthorized use of your Account.

In any event, the Operator’s aggregate liability for any claim or series of claims related to the Service shall not exceed the amount you paid for the Service in the 12 months preceding the event giving rise to the damage, or NIS 1,000 (one thousand new shekels) - whichever is higher, unless otherwise provided by a law that cannot be contracted out of.

You undertake to indemnify, compensate and hold harmless the Operator, its officers, employees and suppliers in respect of any claim, demand, damage, fine, expense, or legal or regulatory proceeding arising from a breach of these terms, misuse, a breach of law, an infringement of third-party rights, activity in your Account, the activity of an OAuth application that you approved, or the provision of false information.

These limitations of liability continue to apply after the end of the engagement, the cancellation of an account or the cessation of use.

13. Governing Law and Jurisdiction

These terms, their interpretation, performance and breach, and any dispute arising from them or related to the use of the Platform, are governed exclusively by the laws of the State of Israel, without regard to conflict of laws rules.

Sole and exclusive jurisdiction is vested in the competent courts of the Tel Aviv-Jaffa district, unless otherwise provided by a law that cannot be contracted out of.

Before taking legal proceedings, the parties will consider approaching each other to resolve the matter amicably - but this does not derogate from the Operator’s right to take immediate measures (including blocking an account) in the event of a breach or risk.

14. General Provisions

If any section, sub-section or provision is found to be invalid, unenforceable or contrary to law, the remaining sections shall remain in full force, and the invalid provision shall be replaced by a valid provision that comes closest to its original purpose.

The Operator’s failure to enforce a right, remedy or provision does not constitute a waiver of it, and does not preclude future enforcement.

These terms, together with the Privacy Policy and any subscription/organizational agreement, constitute the entire and exclusive agreement between you and the Operator regarding the use of the Platform, and supersede any prior understanding, representation, correspondence or agreement.

The Operator may assign, transfer or delegate its rights and obligations under these terms - including in the context of a merger, acquisition or transfer of business. You may not assign your rights without prior written approval.

Notices from the Operator may be delivered by email to the address registered in your Account, by a notice on the Platform, or by publication on the website - and shall be deemed validly delivered.

Our Privacy Policy forms an integral part of these terms. In the event of a conflict between these terms and the Privacy Policy on matters of personal information, the Privacy Policy shall prevail.

These terms were originally drafted in Hebrew. This English version is provided for convenience; in the event of any conflict or inconsistency between the versions, the Hebrew version shall prevail.

For legal matters: info@xhon.io