# Product-Specific Terms

These Product-Specific Terms are a part of the Order Form under which the Customer ordered the Kong Product. The Order Form and these Product-Specific Terms are governed by the Kong Customer Agreement or other master agreement for the purchase of subscriptions to Kong Products entered into by Customer or an Affiliate of Customer (“**Agreement**”). If the Customer and Kong have entered into a Kong Cloud Services Addendum, a reference to the Agreement also includes the Kong Cloud Services Addendum.

All capitalized terms not defined in these Product-Specific Terms will have the meaning given to them in the Agreement, or where no such definition exists, the meaning given in the Kong Customer Agreement set out at https://konghq.com/legal/kong-customer-agreement.

Terms set forth in these Product-Specific Terms as of the effective date of the Customer's applicable Order Form will apply to the Products on that Order Form for the duration of the applicable Subscription Term.

**ARTIFICIAL INTELLIGENCE IN KONG PRODUCTS**

**Definitions:**

“**Customer Input**” means data, content or materials (including prompts or queries) submitted by Customer or its Authorized Users to the Gen AI Features.

 “**Generative AI Features**” or “**Gen AI Features**” means functionality or features of the Products that use generative artificial intelligence, large language models (LLMs) or similar technologies to generate data or content. For clarity, any capabilities or functions of the Products that enable Customer to route, proxy, connect to, manage, monitor, observe, secure, govern, or otherwise control Customer's use of, or communications with, artificial intelligence systems, models, agents, applications, or LLMs, are not Generative AI Features.

“**Generated Output**” means the data or content generated by a Generative AI Feature prompted by Customer Input.

1.      **Ownership**. Customer Input and Generated Output are Customer Content, except that any Kong Technology contained in Customer Input or Generated Output, such as Documentation or other pre-existing Kong Technology, remains Kong Technology. As between Customer and Kong, Kong does not assert any ownership rights in new intellectual property in the Generated Output.

2.     ** Training Restriction**. Kong will not use Customer Content to train or fine-tune any artificial intelligence model, or permit any third party to do so, without Customer’s prior permission or instruction.

3.      **Use Optional**.  If Kong makes a Gen AI Feature available that permits Authorized Users to submit Customer Input to the Gen AI Feature, Kong will provide Customer the ability to decline or disable such functionality through administrative controls in the Product or another reasonable measure made available by Kong at the account, organization or equivalent administrator level.

4.      **Product Operations and Improvement**. Notwithstanding Section 1 (Ownership) and Section 2 (Training Restriction), Kong may during the Subscription Term, use Customer Input and Generated Output to detect, prevent and remediate abuse, misuse, security incidents, malfunctions, or abnormal performance in connection with the Gen AI Features, and to improve the Gen AI Features and develop new features, including new Gen AI Features. Kong will provide Customer the ability to decline or disable such use by Kong through administrative controls in the Product or another reasonable measure made available by Kong at the account, organization or equivalent administrator level.

5.      ** Compliance with Applicable Laws**. Kong will comply with its obligations under applicable laws and regulations related to artificial intelligence in its provision of the Products and Gen AI Features.

6. **No High-Risk AI**. The Gen AI Features, as made available by Kong and when used in accordance with the Documentation and the Agreement, are not designed or intended for use as a High-Risk AI System under the EU Artificial Intelligence Act.
7.     **Acknowledgment**. Customer acknowledges that, due to the probabilistic nature of generative AI, Generated Output and other data or information provided by the Gen AI Features may contain errors or inaccuracies. Customer and its Authorized Users are responsible for reviewing such Generated Output, data, or information for potential inaccuracies, incompleteness, or errors and for independently determining whether and how to use or act upon it.

**PERSONAL DATA**

To the extent Kong processes Customer Content on behalf of Customer that includes personal data, the then-current data processing addendum available at [https://konghq.com/legal/data-processing-addendum](https://konghq.com/legal/data-processing-addendum)https://konghq.com/legal/data-processing-addendum (or such updated URL as Kong may provide from time to time) will apply to such processing, unless Kong and Customer have entered into a separate data processing addendum, in which case that separate data processing addendum will apply.

**KONG API GATEWAY ENTERPRISE, KONG AI GATEWAY (ON-PREM), KONG MESH**

**Verification.** At Kong's request, Customer will promptly provide Kong with (i) a Software-generated report as specified in the Documentation or (ii) provide Kong with data as reasonably requested by Kong, in each case to verify that Customer is using the Software in accordance with this Agreement and any purchased usage limits under an Order Form.

**Disablement of Usage Data Telemetry. **Customer may choose to disable the feature in the Software which permits transmission of Usage Data to Kong, in which case Kong will not collect Usage Data automatically from the Software.

**KONG KONNECT DEDICATED CLOUD GATEWAYS**

**Network Traffic.** Kong may monitor and inspect the traffic on the Cloud Services, including any related logs as necessary to perform the Cloud Services and to derive and compile Usage Data. To the extent Usage Data includes any personal data, Kong will handle it in compliance with applicable data protection laws.

**Customer Content Retrieval and Deletion.** The following will apply to the exclusion of any term in the Agreement related to post-termination or expiration availability of the Cloud Services or Customer Content:

Notwithstanding anything in the Agreement, Customer acknowledges and agrees that Customer Content transmitted through the hosted Kong Gateway instances managed by Kong is proxied and not stored, and that Kong will have no obligation to store, cache or make available through the Cloud Services any Customer Content processed through the hosted Kong Gateway instances on termination or expiration of the Agreement or a Subscription Term; provided, however, that Customer may access the Cloud Services control plane for 30 days following termination or expiration of the Agreement or Subscription Term (if not renewed) for the sole purpose of retrieving Customer Content in the Cloud Services control plane. Kong will delete any Customer Content in the Cloud Services control plane promptly after such period.

**KONG KONNECT DEVELOPER PORTAL**

**Customer Responsible for Content. **The developer portal Product is a hosted service. Customer is responsible for all content, including Customer Content, which it submits to or makes available on or through the Product, and for any content its users submit to or make available through the Product. Except as otherwise provided in the Agreement, Customer is solely responsible for complying with applicable data protection or privacy laws and regulations including any notice, cookie and consent requirements.

**Independently Controlled Data. **Kong and Customer are independent data controllers (or similar terms under applicable law) with respect to technical browsing information related to the Customer’s end users’ visits to any developer portal hosted on the Product. This information includes IP addresses, preferences, web pages visited prior, information about an end user’s browser, network or device and information about how an end user interacts with Customer’s hosted developer portal. Each party will comply with data protection laws applicable to it with respect to such technical browsing information.

**KONG INSOMNIA **

Kong Insomnia is a hybrid SaaS and on-prem API development and testing platform. The software is a desktop application, and the SaaS portion provides for central administration and optional storage of API specifications or projects and related data (“**Project Data**”).

Kong Insomnia also provides local and the Customer’s own Git storage alternatives for Project Data as well as the ability for Customer administrators to centrally control what storage and sharing options Customer teams can use. If local or the Customer’s own Git storage alternatives for Project Data are used by the Customer, Identity management and authentication are still hosted by Kong on the Google Cloud Platform (GCP) in the United States.

**Project Data**. Project Data is Customer Content if Customer uses the Insomnia Cloud Services to store and share Project Data.

**No Payment Cardholder Information or Protected Health Information. **Customer may not store or process any payment cardholder information (PCI) or protected health information (PHI) in Project Data through the Cloud Services.

**Use of Third-Party Hosting Services.** If Customer’s Project Data includes PCI or PHI, the Customer must configure the Product to host the Project Data locally or through the Customer’s own Git storage alternatives.

**Customer Content Retrieval and Deletion.** The following will apply to the exclusion of any term in the Agreement related to post-termination or expiration availability of the Cloud Services or Customer Content:

Notwithstanding anything in the Agreement, Kong will have no obligation to store, cache or make available through the Cloud Services any Customer Content on termination or expiration of the Agreement or a Subscription Term (if not renewed).