High Level Claw (gohighclaw.app)
Effective date: 2026-09-18
Last updated: 2026-10-05
Operated by: Open Claw Assistance LLC, a Wyoming limited liability company
These terms are part of the Terms of Service and govern every Connected Service and every Customer Key you link to the Service. Capitalized terms have the meanings given in the Terms of Service.
1. The model in one paragraph
High Level Claw is built so that you bring your own keys ("BYOK") for AI generation and for most third-party services. When you connect a Customer Key or your own account, that feature runs on your provider account, under your contract with the provider, at the provider's prices, billed to you by the provider, and it consumes zero Credits. We store your keys encrypted, use them only to do what you ask inside the Service, and never resell access to any provider. A small set of tasks runs on our own provider accounts so that onboarding works before you connect anything; those are listed in Section 6.
2. Your contract is with the provider
2.1 Each Connected Service is a separate product from a separate company. When you connect it, you enter or continue a contract with that provider, and that provider's terms of service, acceptable use or usage policies, privacy policy, and pricing apply to your use of it through the Service. You are responsible for reading and complying with them.
2.2 We are not a party to your contract with a provider. We do not control a provider's availability, pricing, rate limits, model behavior, content policies, data handling, or account decisions. If a provider suspends your account, changes a model, raises a price, or rejects a request, the affected feature stops or changes accordingly, and we are not liable for the consequences.
2.3 Fees a provider charges you are yours, whether they arise from your own use, from Automations and Playbooks you configured, from the AI Receptionist answering calls on your Gemini key, or from a bug in the Service. Set spending limits in each provider's dashboard. The Service's spend governor caps Credits, not your provider accounts, although the Service does enforce per-tenant concurrency limits and daily caps that reduce runaway provider spend.
3. Providers you may connect, and the terms that flow down
The following flow-down obligations apply to your use of each provider through the Service. They summarize the provider's rules; the provider's own documents control.
| Provider | What the Service does with it | Key obligations that pass to you |
|---|---|---|
| Anthropic, OpenAI, Google Gemini (text and, for Gemini, the AI Receptionist brain) | Sends prompts built from your Business Blueprint, Contact messages, call audio, and documents; returns Output | Follow the provider's usage policy: no illegal, harmful, deceptive, or infringing uses; no use to develop competing models where prohibited; disclose AI use to consumers where required; do not submit data you lack rights to; comply with rate limits |
| Google (Gmail send, Calendar, Business Profile) | Sends email from your address; reads availability and writes appointments; reads listing and posts updates | Google Terms of Service and Google API Services User Data Policy; Gmail sending limits (500 per day consumer, 2,000 per day Workspace); no spam; keep your Google account secure |
| KIE (video and image generation) | Renders ad videos, images, and site photography from approved scripts | KIE terms and the terms of the underlying models (Veo, Seedance, and others); content rules; no likeness of real people without permission |
| HeyGen (video clone) | Creates a photo avatar from your photo or uses your existing digital twin; renders spoken video | HeyGen terms; consent for any person whose likeness or voice is used; disclosure of synthetic media where required |
| ElevenLabs (voices) | Generates voiceover for ads | ElevenLabs terms; no cloning of voices without consent; no impersonation |
| Telnyx or Twilio (bring your own carrier) | Provisions numbers, calls, and texts on your carrier account | Carrier terms, 10DLC registration on your own account, TCPA and CTIA compliance; you handle registration and carrier fees directly |
| Resend (custom-domain email) | Sends campaign and automation email from your domain on your Resend account | Resend terms and anti-spam policy; domain authentication (SPF, DKIM, DMARC) |
| Zernio (own account) | Publishes to your connected social accounts | Zernio terms plus each social platform's terms and community guidelines |
| Stripe Connect | Operates invoices, links, and subscriptions in your Stripe account | Stripe Services Agreement, Stripe Connected Account Agreement, prohibited and restricted business list |
| Zoom | Adds meeting links to bookings | Zoom terms |
| GitHub | Exports your website to your repository | GitHub terms |
We may add or remove supported providers. The Integrations page shows the current list.
4. How we store and use your keys
4.1 Encryption. Customer Keys and OAuth tokens are encrypted at the application layer with AES-256-GCM before they are stored. Encryption keys are held only in platform environment secrets, never in the database or source code. Keys are decrypted in memory only for the duration of a request you triggered.
4.2 Use. We use a Customer Key only to call the provider for actions you or your configured Automations, Playbooks, and assistant requests initiate inside your Organization. We do not use your keys for other customers, for our own purposes, for testing, or to train anything.
4.3 Display. After you save a key, the Service shows only its last four characters. Staff cannot view stored keys.
4.4 Health checks. With your connection active, the Service may make minimal, low-cost or free calls (for example listing models or checking token validity) to show the connection's status on the Integrations page.
4.5 Removal. You can remove a key or disconnect an account at any time. We delete the stored credential immediately and stop using it. Features that depend on it fall back to Credits where a Credits path exists, or pause. Revoking a token at the provider has the same effect. Removing a key does not delete Output already generated or records already created.
4.6 Exposure. If we learn that a Customer Key stored with us may have been exposed, we will tell you within the breach notice period in the Data Processing Addendum so you can rotate it. If you learn that a key is exposed, rotate it at the provider and update it in the Service.
4.7 Scope. Connect keys with the narrowest scope the feature needs. For OAuth connections we request only the scopes listed on the connection screen.
5. Zero Credits, and what "zero" does not include
5.1 A feature running on a Customer Key consumes zero Credits for the provider cost. The Service's own compute, storage, and the Plan you subscribe to remain covered by your subscription.
5.2 Some features combine a Customer Key with a platform-provided step. For example, the AI Receptionist runs the conversation on your Gemini key (zero Credits) while the phone minutes run on our carrier account (Telecom Charges, unless you connect your own carrier). The Integrations page shows, per capability, whether the cost carrier is Included, Credits, or BYOK.
5.3 If a Customer Key fails mid-job (invalid, out of quota, rate limited, or the provider is down), the job pauses and you are notified. The Service does not silently switch a BYOK job to Credits unless you have enabled "fall back to Credits" for that capability.
6. Platform-funded tasks
The following run on our provider accounts so that you can start without any key. They are limited and metered.
- The onboarding scan (own fetch, Firecrawl, Google Places) and the Business Blueprint extraction.
- A text-only website draft.
- Your Plan's Included Allowance of short text actions (replies, captions, classification, summaries, campaign builder turns).
- Optional Credits-funded fallbacks for generation when you have no key connected, priced on the credit price list.
For these tasks we choose the model and provider and may route through an aggregator (OpenRouter). Applicable data-use terms depend on the actual API account, settings and downstream model-hosting provider. Google-derived data may be processed only after the separate no-training and consent requirements in Section 4 of the Privacy Policy have been established. We do not resell raw API access: you cannot use platform-funded tasks to call a model directly, extract model weights or system prompts, or run arbitrary workloads. Platform-funded tasks are our service to you, priced as our service, not a resale of the provider's product.
7. No resale, no sharing of keys
You may not: share a Customer Key across Organizations you do not own; connect a key that belongs to someone else without their authorization; use the Service to give third parties access to a provider through your key in violation of that provider's terms; or connect a consumer subscription (for example a personal chat subscription) where the provider requires a commercial API key for third-party applications. Agency Plans may connect a client's own key to that client's Organization with the client's authorization.
8. Provider changes and deprecations
Providers change models, deprecate versions, alter prices, and update policies. When that happens, the Service will map your configuration to the closest supported option and tell you. Output may differ after a model change. We are not liable for changes made by a provider.
9. Data handling by providers
When a feature runs on a Customer Key, the provider receives the prompt or data needed for that call under your contract with them, and you are responsible for the data protection terms with that provider, as the Data Processing Addendum describes. Data-use conditions differ by provider, API tier and account settings. A Customer Key does not exempt Google-derived data from Limited Use requirements. Calendar-derived AI scheduling requires documented no-training eligibility for the actual destination and separate consent; otherwise use manual booking. Neither a paid consumer subscription nor successful key verification proves that an API account meets those requirements.
10. Disclaimer
Connected Services and Customer Key features are provided "as is" and depend on third parties. To the fullest extent permitted by law, we disclaim liability for a provider's acts, omissions, outages, charges, data handling, and account decisions. Our liability for the Service itself is as stated in the Terms of Service.
11. Contact
Questions about a connection or a stored key: support@openclawassistance.com.