Terms of Service

Last updated: October 7, 2026

These Terms of Service ("Terms") are an agreement between you and Kalulu Inc, a Missouri limited liability company ("Kalulu", "we", "us"), which operates Antivenom PromptWAF ("Antivenom" or the "Service"). They cover the Antivenom API at https://antivenom-promptwaf.fly.dev, the website at https://antivenomwaf.com, the customer dashboard, and the public playground.

By creating or using an API key, calling the API, or subscribing to a paid plan, you agree to these Terms. If you use the Service on behalf of a company or other organization, you confirm that you are authorized to accept these Terms for it, and "you" means that organization. The Service is intended for business and professional use, and you must be at least 18 years old to use it.

1. The Service

Antivenom is a security API that scans text before or after it is sent to a large language model (prompts, model responses, fine-tuning datasets, and AI-agent tool calls). For each request it returns a risk score, a verdict (allow, flag, or block), and the findings that produced that verdict. Antivenom does not run, host, or have access to your AI model. It is an inspection layer that your application calls.

Antivenom is a security aid, not a guarantee. It detects known and well-documented attack patterns and, where enabled, uses a machine-learning classifier as a second opinion. No detection product can catch every attack, and Antivenom will sometimes miss attacks (false negatives) and sometimes flag harmless content (false positives). You remain responsible for the security of your own systems, for deciding how to act on each verdict, and for using other safeguards appropriate to your risk.

2. Your account and API keys

• You can get a free API key from our website, and you can upgrade to a paid plan through the customer dashboard.
• Each API key is shown to you only once. We store only a hashed version and cannot recover a lost key; you can rotate or revoke it instead.
• You are responsible for keeping your API keys secret and for all activity that uses them, including charges. Do not put keys in client-side code or public repositories.
• Tell us right away at [email protected] if you believe a key has been exposed or misused. We may rotate, suspend, or revoke a key that appears to be compromised or misused.
• An API key is for your own use. Do not share it with, or resell access to, another organization.

3. Acceptable use

You agree not to:

• use the Service to attack, probe, or harm any system, network, model, or person, or to develop or test attacks against systems you do not own or are not authorized to test;
• reverse engineer, extract, or systematically probe the detection rules, scoring, or models in order to evade them for malicious purposes, or publish or sell methods for doing so;
• build or offer a competing product by reselling or repackaging access to the Service's detection results or logic;
• get around rate limits, plan limits, the Free plan's monthly cap, or authentication, including by spreading traffic across multiple keys or accounts;
• try to access another customer's data or API keys, or interfere with or overload the Service;
• use the public playground or demo endpoints as a substitute for an API key, beyond reasonable evaluation;
• submit content that you do not have the right to submit, or use the Service in violation of any law, including privacy, export control, and sanctions laws.

Good-faith security research is welcome if you report findings to [email protected] and do not access other customers' data, degrade the Service, or disclose an issue publicly before we have had a reasonable chance to fix it.

4. Plans and fees

Current plans:

• Free: $0. Up to 5,000 scans per calendar month. This is a hard cap: once it is reached, further scans are rejected until the next month. No overage charges.
• Starter: $29 per month, including 50,000 scans per month. Additional scans cost $0.50 per 1,000.
• Growth: $149 per month, including 500,000 scans per month. Additional scans cost $0.30 per 1,000.

A "scan" is one request to a scanning endpoint (prompt, response, dataset, or tool call). A dataset scan counts as one scan however many records it contains. Generating a canary token is not counted as a scan. Usage is measured per API key over each calendar month in Coordinated Universal Time (UTC). Rate limits apply to all plans. Any custom or enterprise arrangement is governed by a separate written agreement.

5. Billing, payment, and taxes

• Payments are processed by Stripe. By subscribing, you authorize us, through Stripe, to charge your payment method for your plan fee and any overage. We do not receive or store your full card number.
• Billing periods follow calendar months. Your first charge is prorated for the rest of the month in which you subscribe. The monthly plan fee is charged at the start of each billing period, and overage is charged after the period in which it was used.
• If you switch plans, Stripe prorates the change.
• Prices do not include taxes. You are responsible for any sales, use, value-added, or similar taxes, and we may collect them where required.
• If a payment fails and is not resolved, we may suspend paid features or downgrade your key to the Free plan.
• We may change prices or plans. We will give you at least 30 days' notice before a price increase applies to your existing subscription, and the change will take effect at the start of a later billing period.

6. Cancellation and refunds

You can cancel a paid plan at any time through the Stripe customer portal, which you can open from the customer dashboard. Cancellation takes effect at the end of your current billing period; you keep paid-plan access until then, and you will still be charged for any overage used during that period. Fees are non-refundable except where a refund is required by law.

7. Suspension and termination

You may stop using the Service at any time. We may suspend or terminate your access, with or without notice, if you breach these Terms (including the acceptable-use rules), if you do not pay amounts you owe, if your use creates a security risk or could harm the Service or others, or if we are required to by law. Where reasonable, we will tell you why and give you a chance to fix the problem first. We may also discontinue the Service; if we do, we will give paid customers at least 30 days' notice. Sections 8 and 10 through 18 continue to apply after these Terms end.

8. Your data

• You own your content. "Your Content" means the text, datasets, and tool-call data you submit for scanning. You keep all rights to it.
• Our license to process it. You give us permission to process Your Content only as needed to provide, secure, and support the Service, as described in our Privacy Policy.
• What we keep. We do not store Your Content in full. For each scan we store scan metadata, including a hash of the content and short excerpts of the specific text that triggered a detection rule. Our Privacy Policy explains exactly what is stored, where, and for how long.
• Service data. We may use scan metadata, such as verdicts, finding categories, and timings, to operate, secure, and improve the Service, including tuning detection. We do not sell Your Content or scan metadata.
• Your responsibilities. You are responsible for having the rights and notices needed to send Your Content to us, including any personal data in it. Where we process personal data on your behalf, we do so as your processor. If you need a data processing agreement, contact us at [email protected].

9. Feedback

If you send us suggestions or false-positive and false-negative reports, we may use them to improve the Service without any obligation to you.

10. Our intellectual property

We and our licensors own the Service, including its software, detection rules, scoring, models, documentation, and branding. These Terms give you a limited, non-exclusive, non-transferable right to use the Service during your subscription, subject to these Terms. Nothing else is licensed to you. Third-party components remain subject to their own licenses; for example, Antivenom is built with Llama.

11. Third-party services

The Service relies on third-party providers, such as Stripe for payments and hosting and network providers. Your use of Stripe's checkout and customer portal is also subject to Stripe's terms. We are not responsible for third-party services we do not control.

12. Disclaimer of warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE FULLEST EXTENT PERMITTED BY LAW, KALULU DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL DETECT OR BLOCK EVERY ATTACK, THAT ITS VERDICTS WILL BE ACCURATE, OR THAT IT WILL BE UNINTERRUPTED OR ERROR-FREE.

13. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW: (A) KALULU WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, OR FOR DAMAGE CAUSED BY AN ATTACK THE SERVICE DID NOT DETECT OR BLOCK, EVEN IF WE WERE TOLD SUCH DAMAGES WERE POSSIBLE; AND (B) KALULU'S TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE FEES YOU PAID US FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. SOME JURISDICTIONS DO NOT ALLOW CERTAIN OF THESE LIMITATIONS, SO THEY APPLY TO YOU ONLY TO THE EXTENT THE LAW ALLOWS.

14. Indemnity

You will defend, indemnify, and hold harmless Kalulu and its members, officers, and contractors from any third-party claims, losses, and costs (including reasonable attorneys' fees) arising from Your Content, your use of the Service in breach of these Terms, or your violation of any law or third-party right.

15. Export and sanctions

You may not use the Service if you are located in, or are acting on behalf of anyone located in, a country or region subject to comprehensive U.S. sanctions, or if you are on a U.S. government restricted-party list. You will comply with all applicable export control and sanctions laws.

16. Changes to these Terms

We may update these Terms. We will post the new version on this page and change the "Last updated" date. For material changes, we will give at least 30 days' notice on our website and, where we have your email address, by email. If you keep using the Service after the changes take effect, you accept them. If you do not agree, stop using the Service and cancel your plan.

17. Governing law and venue

These Terms are governed by the laws of the State of Missouri, USA, without regard to its conflict-of-laws rules. Any dispute relating to these Terms or the Service will be brought only in the state or federal courts located in Missouri, and you and we consent to their jurisdiction. This does not take away any mandatory consumer protection rights you may have under the law of the country where you live.

18. General

These Terms, together with our Privacy Policy, are the entire agreement between you and us about the Service. If any part of these Terms is found unenforceable, the rest stays in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our written consent; we may assign them in connection with a merger, acquisition, or sale of assets. Neither party is liable for delays caused by events beyond its reasonable control.

19. Contact

Kalulu Inc
7 Country Grove Court
Lake St. Louis, MO 63367
United States

Email: [email protected]