# sv_remote legal document register

Status: production draft for a controlled B2B pilot. Legal set version: `2026-08-25-input-pilot`.

This directory is the source register for the legal and compliance text embedded in the
sv_remote clients and published on `https://st-in.eu/sv-remote`. The documents describe the
implemented pilot, not a future feature set. They must be reviewed by qualified German/EU
counsel before public commercial distribution, consumer use, unattended access, payment
processing, app-store publication, or operation outside the EEA.

## Provider

Service IT, Einzelunternehmen, proprietor Serhii Yanov, Paul-Gossen-Str. 89,
91052 Erlangen, Germany. Email: `s@st-in.eu`. Phone: `+49 9131 9185513`.
Wirtschafts-Identifikationsnummer: `DE462545554-00001`.

The current general website legal notice remains authoritative for provider information:
`https://st-in.eu/legal-notice`.

## Document set

| Document | Purpose | Public route |
|---|---|---|
| `product-privacy-notice.md` | Product-specific GDPR transparency | `/sv-remote/privacy` |
| `b2b-terms-eula.md` | B2B pilot terms and client licence | `/sv-remote/terms` |
| `session-notice.md` | Plain-language local screen-sharing notice | embedded in clients |
| `acceptable-use-policy.md` | Permitted and prohibited use | `/sv-remote/terms#acceptable-use` |
| `data-processing-addendum-template.md` | GDPR Article 28 contract template | provided with customer order |
| `security-subprocessors-retention.md` | Security model, recipients and retention | `/sv-remote/security` |
| `coordinated-vulnerability-disclosure.md` | Safe reporting channel and scope | `/sv-remote/security#vulnerability-disclosure` |
| `cra-readiness.md` | Cyber Resilience Act readiness file | internal/public summary only |
| `legal-review-checklist.md` | Open legal and launch decisions | internal |

## Versioning and acceptance rules

1. A material legal change receives a new immutable version and effective date.
2. Windows and Android store only the accepted legal version locally; no private key or
   password is added to the acceptance record.
3. Registration and remote-session initiation remain blocked until the current version is
   accepted. Acceptance of the B2B terms is not used as the legal basis for screen capture.
4. Every target session separately requires a visible local screen authorization. A Windows
   input request is off by default and requires a second local authorization covering only the
   named controller and current session; refusing it preserves screen-only operation.
5. Archived versions must remain available for the applicable limitation period once the
   product is commercially released.
6. Website translations are convenience translations. Until counsel approves localized
   controlling-language clauses, the German text should be designated as controlling in the
   signed customer order.

## Source hierarchy

If texts conflict, the signed customer order and signed data processing agreement take
precedence, followed by the then-current B2B Terms/EULA, product privacy notice, acceptable use
policy, and technical documentation. Mandatory law always prevails.
