Terms of Use & Legal Conditions

(Master Subscription Agreement)

Provider: Innovatix Technology Partners · Effective Date: 09/21/2026

Parties and Acceptance
Definitions
Subscription; Account Administration
Use Restrictions; Acceptable Use
Service; Availability; Changes
Customer Content; Data Rights
AI Features; Outputs; Human Review
Security; Incident Response
Support; Maintenance
Fees; Payment; Taxes
Suspension
Confidentiality
Intellectual Property; Feedback
Third-Party Services; Open Source
Compliance; Export; Sanctions; Marketing & Messaging Laws
Term; Renewal; Termination
Warranties; Disclaimers
Indemnification
Limitation of Liability
Dispute Resolution; Governing Law
Changes to the Agreement
Miscellaneous

Exhibits and Policies

Exhibit A — Order Form Template
Exhibit B — Data Processing Addendum (DPA) — Summary
Exhibit C — Security Measures — Summary
Exhibit D — Acceptable Use Policy (AUP)
Exhibit E — Data Privacy & AI Usage Disclosure

Contact Information

1. Parties and Acceptance

This Agreement is between Provider and Customer. If Customer is accepting on behalf of an organization, Customer represents it has authority to bind that organization and its Authorized Users.

Order of precedence. If there is a conflict among the Order Form, an amendment, this Agreement, and any Documentation or policies, the following order controls: (1) Order Form, (2) signed amendment, (3) this Agreement, (4) Documentation and policies.

Electronic acceptance. Customer agrees that electronic acceptance, including click-through acceptance and electronic signatures, is legally binding.

2. Definitions

“Affiliate” means an entity that controls, is controlled by, or is under common control with a party.
“Authorized Users” means Customer’s employees, contractors, and agents who are authorized by Customer to access and use the Service under Customer’s subscription.
“Campaign” or “Sequence” means an automated outreach workflow configured by Customer in the Service, including prospect lists, message steps, channels, and sending rules.
“Credits” means the usage units Customer purchases that are consumed by certain Service features (e.g., data enrichment). The features that consume Credits and the applicable rates are described in the Order Form or Documentation.
“Customer Content” means prospect and contact lists, contact and company data, campaign and sequence content, message and email templates, uploaded files, CRM data, connected-mailbox data, prompts and inputs, and other materials submitted to or processed through the Service by or for Customer.
“Documentation” means Provider’s then-current user guides, technical documentation, and policies relating to the Service.
“Enrichment Data” means third-party data (e.g., contact, company, and firmographic data) licensed by Provider from data providers and surfaced through the Service to enrich Customer’s records.
“Order Form” means an ordering document or online checkout that references this Agreement and identifies the subscription plan, usage limits (including Credits), fees, and Subscription Term.
“Outputs” means prospect lists, enriched records, campaign and message drafts, personalized content, sequences, recommendations, analytics, and other results generated by the Service (including AI-enabled features) from Customer Content and/or inputs.
“Provider Technology” means the Service, software, models, algorithms, interfaces, configurations, templates, and other technology provided by Provider, excluding Customer Content and Enrichment Data.
“Security Incident” means a confirmed unauthorized access to Customer Content in Provider’s possession or control.
“Subscription Term” means the subscription period stated in the Order Form.
“Usage Data” means telemetry and operational data about use of the Service that does not intentionally include Customer Content (e.g., feature usage, performance, reliability, and security signals).

3. Subscription; Account Administration

Subscription. Subject to Customer’s compliance with this Agreement and the applicable Order Form, Provider grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to access and use the Service solely for Customer’s internal business purposes.

Authorized Users. Customer may permit Authorized Users to access the Service only for Customer’s internal business purposes. Customer is responsible for all activities conducted under its accounts, including acts and omissions of Authorized Users.

Account security. Customer will maintain the confidentiality of its credentials and will promptly notify Provider of any suspected unauthorized access. Provider may assume that all actions taken using Customer credentials are authorized by Customer.

Usage limits. The Service is subject to usage limits (e.g., Authorized Users, Credits, prospects, connected mailboxes, sending domains, and API calls). Provider may enforce limits via technical controls, rate limits, or feature restrictions. Credit consumption is described in the Order Form or Documentation; search and list-building features that do not consume Credits are identified in the Documentation.

List ownership within the workspace. Within Customer’s workspace, prospect lists are shared among Authorized Users and may be used in Campaigns by Authorized Users; however, ownership of a list remains with the Authorized User who first created or imported it, and only that owner (or an account administrator) may edit or delete the list. This workspace-level sharing does not extend across customers.

4. Use Restrictions; Acceptable Use

Customer will not, and will not permit any third party to:

Reverse engineer, decompile, disassemble, or attempt to derive source code, models, weights, prompts, or underlying ideas of the Service, except to the extent prohibited by law;
Copy, modify, translate, or create derivative works of Provider Technology, except as expressly permitted by Documentation;
Circumvent or disable security, usage limits (including Credit metering), access controls, or authentication mechanisms;
Access or use the Service to develop, train, benchmark, or improve a competing product or service, or to extract Outputs or Enrichment Data in a systematic way to create a substitute dataset;
Use the Service to transmit malware, conduct phishing or spoofing, or otherwise interfere with the integrity or performance of the Service;
Scrape, extract, re-license, resell, or redistribute Enrichment Data or Outputs outside the scope permitted by the Order Form and applicable third-party data terms;
Use the Service in a manner that violates applicable law, regulation, or third-party rights (including privacy, publicity, and intellectual property rights).

Acceptable Use Policy. Customer agrees to comply with the Acceptable Use Policy in Exhibit D (or as posted in Documentation), including its email-messaging and LinkedIn provisions. Violation of the AUP is a material breach.

Restricted and regulated data. Unless expressly permitted in an Order Form or written amendment, Customer will not upload or process Restricted Data (defined in Section 6.5).

5. Service; Availability; Changes

Service description. The Service is an AI-powered prospecting, enrichment, and multi-channel sales outreach platform that enables B2B teams to discover prospects, enrich contact and company data, build and personalize campaigns, send email and LinkedIn outreach, manage responses, and measure results.

Multi-tenancy. The Service may be provided on a multi-tenant basis. Customer’s tenant is logically segregated from other tenants using access controls.

Availability. Provider will use commercially reasonable efforts to make the Service available, except for (a) planned maintenance, (b) emergency maintenance, (c) Customer or third-party network issues, and (d) circumstances outside Provider’s reasonable control.

Changes and discontinuation. Provider may update the Service, including adding, modifying, or removing features. Provider will not materially reduce core functionality during a paid Subscription Term without providing a commercially reasonable alternative, workaround, or remedy.

Beta/preview features. Beta or preview features are provided “as is,” may be modified or discontinued, and are excluded from any warranty or SLA unless expressly stated otherwise.

6. Customer Content; Data Rights

Ownership. As between the parties, Customer retains all right, title, and interest in Customer Content. Provider retains all right, title, and interest in Provider Technology. Enrichment Data is licensed to Provider by third-party data providers and is made available to Customer subject to the applicable third-party data terms; Customer receives a limited right to use Enrichment Data within the Service for its internal business purposes, and Customer may not export, redistribute, or retain Enrichment Data beyond the scope permitted by the Order Form and Documentation.

License to process. Customer grants Provider a limited, worldwide license to host, store, copy, transmit, and process Customer Content solely to provide, maintain, secure, support, and improve the Service (including to prevent abuse and ensure reliability), and as otherwise permitted by this Agreement and the Privacy Policy.

Connected mailboxes and integrations. To enable email sending and response tracking, Customer may connect its own mailboxes (e.g., Google Workspace, Microsoft 365) and third-party services (e.g., CRMs such as HubSpot). Customer is solely responsible for ensuring it has the rights and permissions to connect such accounts and to permit Provider to process data through them. Provider processes such data to provide the Service and as described in the Privacy Policy.

Customer responsibilities. Customer represents and warrants that it has obtained, and will maintain, all rights, consents, and permissions necessary for Provider to process Customer Content and personal data contained in Customer Content (including prospect data and connected-mailbox data) in accordance with this Agreement and applicable law.

Data accuracy. Customer is responsible for the completeness, accuracy, quality, and legality of Customer Content, and for how Customer uses Outputs and Enrichment Data.

6.1 Data processing roles

To the extent Customer Content includes personal data subject to data protection laws, Customer is the “controller” or “business” (as applicable) and Provider is the “processor” or “service provider” (as applicable), processing such data only on Customer’s documented instructions as described in this Agreement and any Data Processing Addendum (“DPA”).

6.2 Subprocessors

Provider may use subprocessors (including cloud hosting, analytics, AI model, data enrichment, and email-sending providers) to help deliver the Service. Provider will maintain contractual protections with subprocessors consistent with applicable law and the DPA (where applicable).

6.3 Data export

During the Subscription Term, Customer may export Customer Content using available export features. After termination, Provider will make Customer Content available for export for a limited period described in Section 16.4, after which Provider will delete or de-identify Customer Content in accordance with its retention practices, unless retention is required or permitted by law. Enrichment Data is subject to third-party data terms and may not be exportable in full.

6.4 Usage Data

Provider may collect and use Usage Data to provide, secure, and improve the Service, including capacity planning, feature performance, reliability, and abuse prevention. Usage Data does not grant Provider the right to disclose Customer Content to other customers.

6.5 Restricted Data

“Restricted Data” means any data subject to special regulatory or contractual requirements, including: (a) payment card data subject to PCI DSS; (b) protected health information regulated by HIPAA; (c) classified, controlled unclassified, or export-controlled government information; (d) biometric identifiers/templates; (e) precise geolocation for tracking individuals; (f) Social Security numbers or government-issued IDs at scale; and (g) any other data requiring safeguards beyond those generally provided by the Service.

Unless expressly permitted in an Order Form or written amendment, Customer will not upload Restricted Data. If Customer uploads Restricted Data in violation of this section, Customer does so at its own risk and Provider may delete or quarantine the data and/or suspend access as necessary to protect the Service.

7. AI Features; Outputs; Human Review

AI acknowledgment. Customer acknowledges the Service uses automated and AI/ML techniques (including AI-assisted prospecting, personalization, and campaign drafting) to process inputs and generate Outputs. Outputs may be probabilistic, non-deterministic, inaccurate, incomplete, or unsuitable for Customer’s purposes. Enrichment Data may contain errors, be outdated, or be subject to third-party data-provider terms and limitations.

Human review required. Customer is solely responsible for human review and independent verification of Outputs and Enrichment Data before use, especially for regulated, high-stakes, or external-facing purposes. The Service’s approval controls (including the Triage approval gate) are tools to assist Customer’s review and do not transfer responsibility for final content or recipients to Provider.

Messaging and recipient responsibility. Customer is solely responsible for the content of all messages it sends through the Service, for ensuring recipients are lawfully contacted, and for complying with applicable marketing, anti-spam, and privacy laws (e.g., CAN-SPAM, GDPR, UK GDPR, CASL, and ePrivacy). Provider does not review or approve Customer’s recipients or message content.

No professional advice. Provider does not provide legal, tax, insurance, medical, or other professional advice. Outputs are provided for informational purposes only.

No uniqueness; third-party rights. Provider does not warrant that Outputs are unique or non-infringing. Customer is responsible for ensuring its use of Outputs and Enrichment Data complies with law and third-party rights.

7.1 Training and model improvement

Default: no cross-customer training. By default, Provider does not use Customer Content to train or fine-tune generalized AI models made available to other customers. Any such use will occur only if expressly agreed in a written amendment or Order Form that clearly describes the scope and opt-in terms.

Service improvement. Provider may use Usage Data and may use Customer Content in de-identified and/or aggregated form where reasonably practicable to maintain, secure, and improve the Service (e.g., reliability, latency, abuse prevention, and feature performance), provided such use does not intentionally disclose Customer identity or Customer Content to other customers.

8. Security; Incident Response

Security measures. Provider will maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Content against unauthorized access, disclosure, alteration, or destruction. Example security measures are described in Exhibit C (which may be updated from time to time).

Customer security. Customer is responsible for configuring the Service appropriately, limiting access to Authorized Users, using strong authentication, securing its own systems, mailboxes, and endpoints, and safeguarding credentials for any connected third-party accounts.

Security Incident notice. Upon confirming a Security Incident, Provider will notify Customer without undue delay and provide information reasonably necessary for Customer to meet applicable legal obligations. Provider is not responsible for incidents caused by Customer’s acts or omissions, compromised Customer credentials, or Customer-controlled systems or third-party accounts.

9. Support; Maintenance

Support. Provider will provide support as described in the applicable Order Form or Documentation.

Maintenance. Provider may perform maintenance and updates. Provider will use commercially reasonable efforts to provide advance notice of scheduled maintenance when practicable.

10. Fees; Payment; Taxes

Fees. Customer will pay all fees specified in the applicable Order Form or at the time of subscription sign-up. Except as expressly stated in this Agreement, all fees are non-cancelable and non-refundable.

Credits. Fees may be structured as a subscription plus a purchase of Credits, or on a usage basis, as described in the Order Form. Credits are consumed when the applicable feature is used (e.g., enrichment). Provider will use commercially reasonable efforts to display Credit costs before a Credit-consuming feature runs where technically feasible. Unused Credits are non-refundable except as expressly stated.

Payment terms. Unless otherwise specified in the Order Form, all fees are due and payable in full at the time of subscription sign-up or prior to activation of the services. Provider will not provision or activate access to the services until payment has been received and processed. For any renewal, add-on services, or usage-based charges (if applicable), payment is due in advance unless otherwise agreed in writing. Any amounts not paid when due (where post-billing is expressly approved) may incur a late fee at the lesser of 1.5% per month or the maximum permitted by law, and Provider may recover reasonable collection costs.

Taxes. Fees exclude all applicable taxes. Customer is responsible for all sales, use, VAT, GST, duties, and similar governmental charges, excluding taxes based on Provider’s net income.

Pricing Changes. Provider reserves the right to modify fees, subscription charges, Credit pricing, or pricing structure at any time at its sole discretion. Any changes will apply to new subscriptions and renewal terms, unless otherwise stated in the Order Form.

11. Suspension

Provider may suspend Customer’s access to the Service (in whole or in part): (a) for non-payment of undisputed amounts; (b) if Customer’s use violates this Agreement or the AUP (including unlawful or non-compliant messaging); (c) if Customer’s use poses a security risk or threatens the integrity of the Service; or (d) to comply with law or a governmental request.

Provider will use commercially reasonable efforts to provide notice and to limit suspension to the minimum scope and duration necessary. Suspension does not relieve Customer of payment obligations.

12. Confidentiality

Confidential Information. “Confidential Information” means non-public information disclosed by one party to the other that is designated as confidential or that reasonably should be understood to be confidential. Customer Content is Customer’s Confidential Information. Provider Technology is Provider’s Confidential Information.

Protection. The receiving party will protect the disclosing party’s Confidential Information using at least reasonable care and will not use or disclose it except as permitted under this Agreement.

Permitted disclosures. The receiving party may disclose Confidential Information to its employees, contractors, and advisors with a need to know and who are bound by confidentiality obligations at least as protective as this Agreement.

Exceptions. Confidentiality obligations do not apply to information that (a) is or becomes public through no fault of the receiving party, (b) was independently developed without use of Confidential Information, (c) was rightfully received without restriction, or (d) was approved for release in writing.

Compelled disclosure. If compelled by law, the receiving party may disclose Confidential Information provided it gives notice where legally permitted and cooperates in seeking protective treatment.

13. Intellectual Property; Feedback

Provider IP. Provider retains all right, title, and interest in and to Provider Technology, including all intellectual property rights. No rights are granted except as expressly stated.

Feedback. If Customer provides suggestions or feedback, Provider may use it without restriction or obligation, and without compensation to Customer.

Trademarks. Each party retains ownership of its trademarks. Customer may not use Provider’s marks without prior written consent.

14. Third-Party Services; Open Source

Third-party services. The Service interoperates with third-party services, including data enrichment providers (e.g., ZoomInfo), email-sending providers (e.g., Brevo, Amazon SES), CRMs (e.g., HubSpot), mailbox providers, and social platforms (e.g., LinkedIn). Customer’s use of such third-party services is subject to the third parties’ terms, and Provider is not responsible for their outages, acts, or omissions. Customer is responsible for ensuring its use of third-party services (including any data obtained from them) complies with the third parties’ terms and applicable law.

Open-source software. The Service may include open-source components subject to applicable open-source licenses. To the extent an open-source license grants Customer additional rights, those rights apply only to the open-source components and not the Service as a whole.

15. Compliance; Export; Sanctions; Marketing & Messaging Laws

Compliance with law. Each party will comply with applicable laws and regulations. Customer is responsible for ensuring its use of the Service (including Outputs, Enrichment Data, and all messages sent through the Service) complies with law and industry requirements.

Marketing and messaging laws. Without limiting the foregoing, Customer is solely responsible for complying with all applicable marketing, anti-spam, telemarketing, and electronic-messaging laws, including (as applicable) the U.S. CAN-SPAM Act, TCPA, GDPR/UK GDPR, ePrivacy, Canada’s CASL, and analogous laws. Customer will maintain its own suppression and opt-out lists, honor unsubscribe requests, and provide accurate sender and identification information in all messages. Customer acknowledges that Provider does not verify Customer’s legal basis for contacting recipients.

LinkedIn and platform terms. Customer’s use of any LinkedIn or other social-platform features is subject to that platform’s terms and policies, and Customer is responsible for compliance (including, where applicable, maintaining a human in the loop as configured in the Service).

Export controls and sanctions. Customer will not use the Service in violation of U.S. export control laws or sanctions, and will not permit access by sanctioned persons or prohibited jurisdictions.

16. Term; Renewal; Termination

Term. This Agreement begins on the Effective Date and continues until all Order Forms expire or are terminated.

Renewal. Unless otherwise stated in an Order Form, subscriptions renew automatically for successive terms equal to the prior term, unless either party gives written notice of non-renewal at least [30] days before the end of the then-current term.

Termination for cause. Either party may terminate an Order Form for material breach if the breaching party fails to cure within 30 days after written notice (10 days for non-payment). Provider may terminate immediately for Customer’s unlawful use or repeated AUP violations.

Effect of termination; data export. Upon termination or expiration, Customer’s right to access the Service ends. Upon request, Provider will make Customer Content available for export for a limited period of 30 days, after which Provider will delete or de-identify Customer Content in accordance with Provider’s retention practices unless a longer retention is required or permitted by law. Enrichment Data and third-party data may be deleted immediately and are subject to the applicable third-party data terms.

Survival. Sections that by their nature should survive termination will survive, including Fees owed, Use Restrictions, Confidentiality, IP, Indemnification, Limitation of Liability, and Dispute Resolution.

17. Warranties; Disclaimers

Authority. Each party represents it has the authority to enter into this Agreement.

Limited performance warranty. Provider warrants it will provide the Service in a professional and workmanlike manner. Customer’s exclusive remedy for breach of this warranty is re-performance of the affected Service, and if re-performance is not commercially reasonable, Provider may terminate the affected Order Form.

Disclaimer. EXCEPT AS EXPRESSLY STATED, THE SERVICE AND OUTPUTS ARE PROVIDED “AS IS” AND PROVIDER DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. Provider does not warrant that the Service will be uninterrupted or error-free, that Outputs or Enrichment Data will be accurate, complete, or current, or that any messages sent through the Service will be delivered or placed in recipients’ inboxes rather than spam folders. Provider makes no representation or warranty regarding deliverability or sender reputation, which depend on factors outside Provider’s control, including Customer’s domains, content, and sending practices.

18. Indemnification

18.1 Customer indemnity

Customer will defend, indemnify, and hold harmless Provider, its Affiliates, and their respective officers, directors, employees, and agents from and against any third-party claims, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of or related to: (a) Customer Content; (b) Customer’s or Authorized Users’ misuse of the Service, including any messages sent through the Service; (c) Customer’s violation of marketing, anti-spam, privacy, or telecommunications laws; or (d) Customer’s breach of this Agreement or violation of law.

18.2 Provider IP indemnity

Provider will defend, indemnify, and hold harmless Customer from third-party claims that the Service (excluding Customer Content and third-party services) infringes a U.S. patent, copyright, or trade secret, and will pay covered damages, provided Customer: (a) promptly notifies Provider; (b) cooperates; and (c) allows Provider to control the defense and settlement.

If a claim is likely, Provider may: (i) modify the Service so it becomes non-infringing; (ii) replace the Service with a functionally equivalent service; or (iii) terminate the affected Order Form and refund prepaid, unused fees.

18.3 Exclusions

Provider has no indemnity obligation to the extent a claim arises from: (a) Customer Content; (b) Customer’s instructions, configurations, or combinations with non-Provider products; (c) third-party services (including Enrichment Data); or (d) use not in accordance with this Agreement.

19. Limitation of Liability

EXCLUSION OF DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, OR LOSS OF DATA, EVEN IF ADVISED OF THE POSSIBILITY.

LIABILITY CAP. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY’S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE AMOUNTS PAID OR PAYABLE BY CUSTOMER TO PROVIDER UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY.

Carve-outs. The foregoing limitations do not apply to: (a) Customer’s payment obligations; (b) Customer’s indemnity obligations; or (c) a party’s gross negligence or willful misconduct.

20. Dispute Resolution; Governing Law

Governing law. This Agreement is governed by the laws of the State of New Jersey, excluding its conflict-of-laws rules.

Venue. The parties agree to exclusive jurisdiction and venue in the state or federal courts located in Somerset, NJ, unless the parties agree to arbitration in an Order Form or amendment.

Optional arbitration. If arbitration applies, disputes will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules in Somerset, NJ. Judgment may be entered in any court of competent jurisdiction.

Injunctive relief. Either party may seek injunctive or equitable relief for actual or threatened breach of confidentiality, security, or intellectual property rights.

OPTIONAL: Class action waiver / jury trial waiver. Include if desired and permitted by law: (a) the parties waive any right to a jury trial; and (b) disputes will be brought only in an individual capacity and not as a plaintiff or class member in any purported class action.

21. Changes to the Agreement

Provider may update this Agreement to reflect changes in law, security, or the Service. Provider will provide reasonable notice (e.g., email or in-app). Continued use after the effective date constitutes acceptance, unless Customer terminates the subscription before the effective date (where permitted).

22. Miscellaneous

Assignment. Customer may not assign this Agreement without Provider’s prior written consent, except to an Affiliate or in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee agrees in writing to be bound.
Subcontracting. Provider may subcontract performance of the Service provided Provider remains responsible for its obligations under this Agreement.
Force majeure. Neither party is liable for delays or failures due to circumstances beyond its reasonable control.
Independent contractors. The parties are independent contractors and no partnership, joint venture, or agency relationship is created.
Severability; waiver. If any provision is unenforceable, the remainder will remain in effect. Waivers must be in writing and are limited to the specific instance.
Entire agreement. This Agreement, the Order Form(s), and incorporated policies are the entire agreement and supersede prior discussions.

Exhibits and Policies

The following exhibits are templates or summaries and may be incorporated by reference into an Order Form or made available in Documentation.

Exhibit A — Order Form Template

Customer legal name, address, and billing contact
Subscription plan/tier and permitted use
Usage limits (Authorized Users, Credits, prospects, connected mailboxes, sending domains, channels) and overage terms
Credit pricing and the features that consume Credits (e.g., enrichment)
Channels enabled (Email; LinkedIn) and any channel-specific terms
Fees, billing frequency, payment terms
Subscription Term start and end dates; renewal terms
Support/SLA tier (if any)
Security and compliance addenda (if any)
Data Processing Addendum (if applicable)

Exhibit B — Data Processing Addendum (DPA) — Summary

Applies where Customer Content includes personal data subject to GDPR/UK GDPR or similar laws.
Roles: Customer is Controller and Provider is Processor (or business/service provider under applicable U.S. state privacy laws).
Processing: Provider processes personal data only on documented instructions to provide the Service.
Subprocessors: Provider may use subprocessors (including cloud hosting, AI, enrichment, and email-sending providers) and will maintain appropriate contractual protections; where required, Provider will provide notice of material changes with an objection mechanism.
International transfers: SCCs and the UK Addendum (where applicable).
Assistance: Provider will provide reasonable assistance with security inquiries and data subject requests where required by law.
Deletion: Provider will delete personal data after termination subject to agreed retention and legal requirements.
Audit: Provider will provide reasonable security information (e.g., audit summaries) subject to confidentiality.

Exhibit C — Security Measures — Summary

Logical access controls and role-based access
Workspace separation and tenant isolation controls with tenant-scoped authorization
Encrypted credentials for connected mailboxes and third-party integrations
Audit logging for key security events and security logging
Encryption in transit (TLS) and, where applicable, encryption at rest
Vulnerability management and patching
Backups and disaster recovery (as applicable)
Secure software development lifecycle
Incident response procedures

Exhibit D — Acceptable Use Policy (AUP)

Customer and Authorized Users will not use the Service to:

Violate law or third-party rights, including privacy, publicity, and intellectual property rights;
Send spam, or transmit unsolicited bulk or commercial email in violation of applicable anti-spam laws (e.g., CAN-SPAM, CASL, GDPR/UK GDPR, ePrivacy, or analogous laws);
Send messages to recipients who have opted out, or fail to honor unsubscribe and suppression requests promptly;
Misrepresent the sender’s identity, use misleading subject lines, or use unauthorized or deceptive sending domains or mailboxes;
Use purchased, scraped, or otherwise unlawfully or improperly obtained contact lists without the necessary rights and consents;
Transmit malware, phishing, or abusive traffic, or disrupt the Service or third-party services;
Perform unauthorized penetration testing, security scanning, or benchmarking;
Engage in unlawful surveillance or collect personal data without proper notices/consents;
Violate the terms of third-party platforms (e.g., LinkedIn) or third-party data providers (e.g., ZoomInfo);
Scrape, re-license, resell, or redistribute Enrichment Data or Outputs outside the scope permitted by the Order Form;
Create, improve, or benchmark competing products, or systematically extract Outputs or Enrichment Data to create substitute datasets;
Upload Restricted Data except as expressly permitted in an Order Form or written amendment.

Exhibit E — Data Privacy & AI Usage Disclosure

This Exhibit describes how Provider processes Customer Content and personal data in connection with the Service, including AI-enabled features. This Exhibit is incorporated by reference and, where applicable law requires, the parties will enter into Provider’s Data Processing Addendum (“DPA”), which will control to the extent it conflicts with this Exhibit.

Roles; Scope. Customer determines the purposes and means of processing Customer Content and any personal data contained therein. To the extent Provider processes personal data on behalf of Customer, Provider acts as a “processor” or “service provider” (as applicable) and processes such personal data only to provide, maintain, secure, and support the Service, and as otherwise permitted under this Agreement, the Privacy Policy, and the DPA (if applicable).
Processing Purposes. Customer Content (including prospect lists, contact and company data, campaign content, message templates, connected-mailbox data, prompts/inputs, and associated metadata) may be processed to: (a) provide and operate the Service and its features (including prospecting, enrichment, campaign building, email and LinkedIn outreach, and response management); (b) perform customer-requested configurations, workflows, and support; (c) prevent fraud, abuse, and security incidents; (d) perform debugging, reliability, and performance monitoring; and (e) comply with applicable law and enforce applicable terms.
AI Processing Acknowledgment. Customer expressly acknowledges the Service uses artificial intelligence and machine-learning technologies (including automated systems and probabilistic models) to process Customer Content and generate Outputs (including prospect lists, enriched records, campaign and message drafts, and recommendations). Outputs may be inaccurate, incomplete, non-deterministic, or otherwise unsuitable for Customer’s purposes. Customer is solely responsible for human review and independent verification of Outputs prior to use, particularly for regulated, high-stakes, or external purposes.
Third-Party AI and Data Providers; Subprocessors. To provide the Service, the Company may transmit limited portions of Customer Content and/or prompts/inputs to third-party service providers (including AI model providers, data enrichment providers, email-sending providers, hosting providers, and analytics providers) acting as subprocessors. Customer authorizes such disclosures and processing to the extent necessary to provide the Service. The Company will maintain commercially reasonable contractual protections with subprocessors consistent with the DPA (where applicable), and may update subprocessors from time to time. Where required by law or the DPA, the Company will provide notice of material subprocessor changes and an opportunity to object.
Training; Model Improvement (Default: No Cross-Customer Training). By default, the Company does not use Customer Content to train or fine-tune generalized AI models made available to other customers. Any use of Customer Content for such training will occur only if expressly agreed in a written amendment or Order Form that clearly describes scope and opt-in terms. The Company may, however, use usage data and service telemetry, and may use Customer Content in a de-identified, aggregated, or otherwise non-customer-specific form where reasonably practicable, for purposes of maintaining, securing, and improving the Service (e.g., reliability, latency, abuse prevention, and feature performance), provided that such use does not intentionally disclose Customer identity or Customer Content to other customers.
No Human Review Obligation. The Company does not guarantee human review of Customer Content or Outputs and has no obligation to monitor, validate, correct, or curate Customer Content or Outputs. Customer is responsible for establishing appropriate internal review, approval, and governance controls (including use of the Service’s approval gates) for any use of the Service and Outputs.
Data Security. The Company implements commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Content and personal data against unauthorized access, disclosure, alteration, or destruction. Customer acknowledges that no security measures are infallible and the Company does not guarantee absolute security. Customer is responsible for securely managing credentials, user access, connected accounts, and endpoint security within Customer’s environment.
Security Incidents. In the event the Company confirms a security incident involving unauthorized access to Customer Content or personal data, the Company will notify Customer without undue delay and provide information reasonably necessary for Customer to meet applicable legal obligations.
Data Retention; Deletion. Customer Content is retained for the duration of Customer’s subscription and as otherwise reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, or enforce applicable terms. Following termination or expiration, the Company will make Customer Content available for export for a limited period and will thereafter delete or de-identify Customer Content in accordance with the Company’s retention practices, unless a longer retention period is required or permitted by law.
Restricted and Regulated Data. Unless expressly permitted in an applicable Order Form or written amendment, Customer will not upload to the Service: (a) payment card data subject to PCI DSS; (b) protected health information regulated by HIPAA; (c) classified, controlled unclassified, or export-controlled government information; or (d) other highly sensitive data requiring special safeguards beyond those generally provided by the Service (“Restricted Data”).
Customer Responsibilities. Customer is solely responsible for providing required notices and obtaining necessary consents and authorizations; ensuring Customer Content is lawfully collected, used, and disclosed; ensuring messages sent through the Service comply with applicable marketing, anti-spam, and privacy laws; and complying with applicable privacy, data protection, and sector-specific laws.
International Transfers. Customer acknowledges that the Service may be provided from, and Customer Content may be processed in, the United States and other countries. Where required by applicable law, international transfers will be addressed through the DPA and applicable transfer mechanisms.
Regulatory Transparency. This disclosure is intended to support transparency obligations under applicable U.S. consumer protection and privacy laws. To the extent the Company processes personal information subject to state privacy laws on behalf of Customer, the Company will process such data as a service provider/processor for the business purposes described in this Exhibit and the DPA (if applicable).
No Waiver; Limitation of Liability. Nothing in this Exhibit modifies or limits the AI disclaimers, restricted use provisions, limitation of liability, or indemnification obligations set forth elsewhere in the parties’ agreement.

Contact Information

If you have any questions about these Terms and Conditions, please contact us at [support@10xreach.ai].