Master Services Agreement

This Master Services Agreement (“MSA”) is entered into by and between Internet Financial Company, LLC d/b/a BudgetSimple, a Delaware limited liability company, 2810 N Church St, Ste 56869, Wilmington, DE 19802 USA (“Vendor”), and the entity identified as the customer in a Service Order that expressly incorporates this MSA (“Customer”). Each of Vendor and Customer is a “Party,” and together they are the “Parties.”

By executing a Service Order that references this MSA and the Version Date above, the Parties agree to be bound by this MSA. This MSA becomes effective between the Parties on the Effective Date of the first such Service Order. Customer acknowledges that, before executing the Service Order, it had the opportunity to access, review, download, and retain a copy of this MSA.

2.1 Right to Use. Subject to Customer’s compliance with this MSA and the applicable Service Order, Vendor grants Customer a non-exclusive, non-transferable (except as permitted under Section 14.3), worldwide right during the Subscription Term to access and use the Services and Documentation for Customer’s internal business purposes and, where included in a Service Order, to provide Customer-branded or white-label personal finance, financial wellness, financial education, financial coaching, client engagement, program administration, and related services to Authorized Users. The Services are provided on a business-to-business basis and may be deployed through Customer’s own brand, portals, organizations, mobile applications, APIs, SDKs, embeddable components, or other authorized delivery channels. Where APIs, SDKs, embeds, or similar components are included in a Service Order, Customer may access and use them solely to enable its authorized delivery channels and Customer Applications, subject to the Documentation and Section 2.3.

2.2 Affiliates and Participating Organizations. Customer may permit its Affiliates and participating organizations to use the Services only to the extent included in the applicable Service Order. Customer remains responsible for their acts and omissions and for all use of the Services through Customer’s tenancy.

2.3 Use Restrictions. Customer shall not, and shall ensure its Authorized Users do not:

2.4 Accounts and Authorized Users. Customer is responsible for designating Authorized Users, maintaining the confidentiality of account credentials, promptly disabling access for unauthorized users, and all activity occurring through Customer’s tenancy. Accounts may not be shared except where the Services expressly support shared or role-based access. Customer will promptly notify Vendor of suspected unauthorized access or credential compromise.

2.5 Customer Responsibilities. Customer is responsible for the accuracy, quality, legality, and means of collection of Subscriber Data and Customer Materials; obtaining all rights, consents, disclosures, and authorizations necessary for Vendor to process Subscriber Data and provide the Services; and maintaining end-user terms, privacy notices, policies, and procedures required for Customer’s use of the Services. Customer is also responsible for the services, advice, communications, and representations provided by Customer or its personnel to Authorized Users.

2.6 Third-Party Integrations and Services. The Services may interoperate with Third-Party Services at Customer’s election or as part of a selected Service. Third-Party Services may be subject to separate terms, policies, availability, and fees. Vendor is not responsible for Third-Party Services or for data loss, delay, inaccuracy, unavailability, or other issues caused by a Third-Party Service, except to the extent expressly stated in a Service Order. Vendor may replace or discontinue a Third-Party Service when reasonably necessary because of provider availability, legal requirements, security concerns, or changes imposed by the third party.

2.7 Suspension Rights. Vendor may immediately suspend the Services, or an affected portion, if:

Vendor will use reasonable efforts to provide prior notice when practicable and to limit a suspension to the affected portion of the Services. Suspension does not relieve Customer of its payment obligations.

2.8 Changes to the Services; Beta Features. Vendor may modify, update, add, or remove features and functionality of the Services in the ordinary course of product development, provided the changes do not materially reduce the functionality of the Services purchased under an active Service Order during its then-current Subscription Term. Features identified by Vendor as beta, preview, pilot, early-access, evaluation, or free (“Beta Features”) are provided “AS IS,” are excluded from the performance warranty in Section 6.2 and the uptime commitment in Section 8.1, and may be modified, suspended, or discontinued at any time. New features and functionality first made available after the Effective Date of the applicable Service Order are treated as Beta Features unless and until Vendor makes them generally available and describes them in the Documentation; Beta Features do not include modifications, updates, or improvements to features and functionality included in the Services purchased under that Service Order, which remain subject to Section 6.2. If Vendor discontinues a purchased Service in its entirety during a Subscription Term, Vendor will provide reasonable advance notice, Customer’s obligation to pay Fees for the discontinued Service for periods after the effective date of discontinuation will cease, and Vendor will refund any prepaid, unused Fees for the discontinued Service; the foregoing is Customer’s sole and exclusive remedy for the discontinuation.

3.1 Fees. Customer will pay the fees set forth in each Service Order (“Fees”) in U.S. dollars, plus applicable taxes. Fees may include subscription, Registered User, usage-based, third-party pass-through, implementation, and Professional Services charges.

3.2 Invoicing and Payment Method. Unless a Service Order states otherwise, Fees are invoiced annually in advance and are due net thirty (30) days from the invoice date. If Customer authorizes ACH or credit-card auto-debit, Vendor may charge the invoice amount on or after the invoice date; otherwise payment is due net thirty (30) days. To the extent permitted by applicable law, Customer is responsible for credit-card processing fees and bank, wire, foreign exchange, or similar charges so that Vendor receives the full invoiced amount. Unless a Service Order states otherwise, Fees accrue from the Service Commencement Date stated in the Service Order (or, if none is stated, the Effective Date), and billing periods run from that date and its monthly or annual anniversaries, without partial-period proration.

3.3 Usage Measurement and Billing; No Proration. Unless a Service Order states otherwise: (a) each billable unit — including a Registered User account, connected or enrolled user, transaction, credit or data usage unit, or other measured unit — that exists or occurs at any time during its measurement period is counted for that entire measurement period; the measurement period is one month for a unit priced per month and otherwise the billing period; (b) Fees attributable to units above an included quantity or pricing tier are invoiced on the next invoice following the applicable measurement period, and Vendor may invoice usage-based and per-unit Fees monthly in arrears notwithstanding the billing frequency stated for subscription Fees; (c) a reduction in a measured unit takes effect beginning with the next measurement period; (d) accounts and units used for testing, training, demonstration, or internal purposes are counted unless the Service Order expressly excludes them; (e) tiered rates are graduated, with each tier’s rate applying to the units falling within that tier’s bounds; and (f) no mid-period or partial-period proration applies.

3.4 Taxes. Fees are exclusive of sales, use, value-added, goods and services, withholding, and similar taxes, duties, or assessments, other than taxes based on Vendor’s net income. Customer will pay all applicable amounts and provide exemption documentation when applicable. If applicable law requires Customer to withhold or deduct taxes from a payment, Customer will increase the payment so that Vendor receives the full amount invoiced after the withholding or deduction, will timely remit the withheld amount to the applicable authority, and will provide official receipts on request.

3.5 No Setoff; Non-Refundable Fees. Fees are non-cancelable and non-refundable except as expressly stated in this MSA or a Service Order. Customer may not withhold, reduce, or set off amounts owed against any other amounts.

3.6 Late Payments. Amounts not paid when due (other than amounts disputed in accordance with Section 3.7) accrue interest at one and one-half percent (1.5%) per month, or the maximum lawful rate if lower, from the due date until paid, plus reasonable collection costs and attorneys’ fees. Vendor may suspend Services in accordance with Section 2.7.

3.7 Invoice Disputes. To dispute an invoiced amount in good faith, Customer must notify Vendor in writing within thirty (30) days after the invoice date, describing the disputed amount and the basis for the dispute in reasonable detail, and must timely pay all undisputed amounts. The Parties will work together in good faith to resolve the dispute promptly. Interest under Section 3.6 does not accrue, and Vendor will not suspend Services under Section 2.7(c), with respect to amounts disputed in accordance with this Section 3.7 while the dispute is being resolved in good faith. Any disputed amount determined to be payable is due within ten (10) days after resolution; if not paid by that date, interest accrues on that amount under Section 3.6 from the original due date. Invoiced amounts not disputed in accordance with this Section 3.7 within the thirty (30) day period are deemed accepted, absent fraud or manifest error.

3.8 Third-Party Pass-Through Price Changes. If a Third-Party Service provider increases the amounts it charges Vendor for a Third-Party Service that is passed through or resold to Customer under a Service Order, Vendor may increase the corresponding Fees on at least thirty (30) days’ written notice by no more than the amount of the increase in Vendor’s underlying third-party cost; for a Fee that includes a Vendor-managed service component, the increase may not exceed the dollar amount of the increase in the underlying third-party cost. The increase takes effect for usage and service periods beginning after the notice period. This Section 3.8 does not permit a change to platform subscription Fees during a then-current Subscription Term.

3.9 Renewal Pricing. Unless a Service Order states otherwise, at the start of each renewal term the recurring subscription Fees and the usage-based rates stated in the Service Order increase by five percent (5%) over the rates in effect for the immediately preceding term, without further notice or amendment, and the increased rates carry forward as the base for later renewal increases. This Section 3.9 does not apply to third-party pass-through Fees, which remain subject to the applicable provider’s charges and Section 3.8.

4.1 Ownership of Vendor Technology. Vendor and its licensors retain all right, title, and interest in and to Vendor Technology, including all intellectual property rights. Except for the limited rights expressly granted under this MSA, no rights are granted to Customer by implication, estoppel, or otherwise.

4.2 Customer Materials and Customer Applications. Customer retains all right, title, and interest in and to Customer Materials and Customer Applications. For clarity, a Customer Application that Customer or its contractor independently develops on top of or connects to Vendor’s APIs remains Customer property. Customer does not acquire ownership of the APIs, SDKs, data models, connectors, underlying Services, Vendor code, or reusable components, and Vendor retains ownership of any Vendor Technology used in or accessed by a Customer Application. For further clarity, configurations, customizations, integrations, deliverables, and other items created by or for Vendor remain Vendor Technology under Section 4.5 even where they interoperate with, support, or were requested in connection with a Customer Application; technology qualifies as a Customer Application only to the extent it is independently developed by Customer or by a third party (other than Vendor) on Customer’s behalf.

4.3 Subscriber Data Ownership and Processing License. As between the Parties, Customer owns Subscriber Data. Customer grants Vendor and its subprocessors a non-exclusive, worldwide, limited license (a) during the applicable Subscription Term and any permitted offboarding period, to host, copy, transmit, display, and otherwise process Subscriber Data and Customer Materials solely as necessary to provide, maintain, secure, and support the Services, comply with Customer’s instructions, or comply with law; and (b) thereafter, solely with respect to copies of Subscriber Data and Customer Materials retained under Section 12.6 or Section 12.7 in routine backups or as required by law, to retain, secure, and process such copies as necessary to maintain backup integrity and comply with law, until such copies are deleted through Vendor’s ordinary retention cycle. To the extent applicable, Vendor acts as a processor or service provider with respect to personal data in Subscriber Data. Vendor will not sell Subscriber Data.

4.4 Aggregated and De-Identified Data. Vendor may create and use aggregated or de-identified usage data to operate, analyze, secure, and improve the Services and to develop generalized benchmarks or product insights, provided the data does not identify Customer or an Authorized User. Vendor retains all rights in such aggregated or de-identified data.

4.5 Product Customizations and Professional Services Deliverables. Unless a Service Order (including a Statement of Work incorporated into a Service Order) expressly states otherwise, all configurations, customizations, enhancements, functionality, integrations, documentation, software, code, designs, specifications, and other deliverables created by or for Vendor in connection with the Services, including items requested by Customer, are Vendor Technology. Vendor may use, modify, reproduce, distribute, license, commercialize, and otherwise exploit those items without restriction, provided Vendor does not disclose Customer Confidential Information or use Customer Materials except as authorized under this MSA. Customer retains ownership of its pre-existing Customer Materials and receives only the rights to deliverables expressly stated in this MSA or the applicable Service Order. Vendor retains discretion over whether and how to implement requested features or customizations. Where a Service Order (including an incorporated Statement of Work) expressly identifies a deliverable as Customer-owned and does not state other transfer terms, then effective on Vendor’s receipt of full payment of the fees allocable to that deliverable: (a) Vendor assigns to Customer all right, title, and interest in and to that deliverable, excluding any Vendor Technology; (b) Vendor grants Customer a non-exclusive, royalty-free, worldwide license, transferable only with the deliverable, to use Vendor Technology embedded in or reasonably necessary to use the deliverable, solely as part of and in connection with the deliverable; (c) the deliverable is provided in its delivered form only, and no source code is provided unless expressly stated; (d) Customer’s ownership of the deliverable does not restrict Vendor from using, developing, licensing, or commercializing Vendor Technology or any generalized ideas, concepts, know-how, skills, methods, functionality, or independently developed materials that do not incorporate Customer Confidential Information or Customer Materials; and (e) third-party and open-source components remain subject to their own license terms.

4.6 Feedback. Customer and its Authorized Users may voluntarily provide Vendor with suggestions, enhancement requests, recommendations, corrections, ideas, or other feedback relating to the Services (“Feedback”). Customer grants Vendor and its Affiliates a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, transferable, and sublicensable license under all intellectual property rights Customer owns or controls to use, reproduce, modify, create derivative works from, distribute, commercialize, and otherwise exploit the Feedback for any purpose without restriction, attribution, compensation, or other obligation. The foregoing license is granted to the extent of the rights Customer owns or controls in the Feedback, and Customer will not knowingly provide Feedback that it lacks the right to license. Feedback does not include Subscriber Data, Customer Materials, Customer Applications, Customer Confidential Information, or any deliverable expressly identified in a Service Order or Statement of Work as owned by Customer. Vendor is not obligated to use or implement any Feedback.

5.1 Protection and Use. The Receiving Party will protect the Disclosing Party’s Confidential Information using the same degree of care it uses to protect its own similar information, but no less than reasonable care. The Receiving Party will use Confidential Information only to exercise rights or perform obligations under the Agreement and will not disclose it except as permitted by this Section 5.

5.2 Permitted Recipients. The Receiving Party may disclose Confidential Information to its Affiliates, employees, contractors, professional advisers, financing sources, and service providers that have a need to know the information for purposes of the Agreement and are bound by confidentiality obligations at least as protective as those in this MSA. The Receiving Party remains responsible for their compliance.

5.3 Exclusions. Confidential Information does not include information that the Receiving Party can document: (a) is or becomes publicly available through no breach of the Agreement; (b) was lawfully known to the Receiving Party without restriction before disclosure; (c) is received lawfully from a third party without confidentiality obligation; or (d) is independently developed without use of the Disclosing Party’s Confidential Information.

5.4 Required Disclosure. The Receiving Party may disclose Confidential Information to the extent required by law, subpoena, or court order, provided it gives the Disclosing Party prompt notice when legally permitted and reasonable assistance, at the Disclosing Party’s expense, in seeking confidential treatment or a protective order. The Receiving Party will disclose only the portion legally required.

5.5 Duration. The obligations in this Section 5 continue for five (5) years after each disclosure. Obligations for trade secrets continue for so long as the information remains a trade secret under applicable law, and obligations for Subscriber Data continue for so long as Vendor retains the Subscriber Data.

5.6 Equitable Relief. Unauthorized use or disclosure of Confidential Information may cause irreparable harm for which monetary damages are inadequate. The Disclosing Party may seek injunctive or equitable relief without waiving other remedies and, to the extent permitted by law, without posting bond.

6.1 Authority. Each Party represents that it has the legal power and authority to enter into the Agreement and perform its obligations.

6.2 Performance Warranty. Vendor warrants that (a) the subscription Services (excluding Beta Features under Section 2.8) will materially conform to the Documentation during the applicable Subscription Term, and (b) Professional Services will be performed in a professional and workmanlike manner, and deliverables subject to express acceptance criteria stated in a Service Order or an incorporated Statement of Work will materially conform to those criteria. Customer must notify Vendor of a claimed breach of this Section 6.2 within thirty (30) days after the applicable performance, delivery, or acceptance or, for the subscription Services, within thirty (30) days after discovering the non-conformity. Vendor will use commercially reasonable efforts to correct, re-perform, or redeliver, as applicable, and this Section 6.2 states Customer’s exclusive remedy for breach of the performance warranty.

6.3 No Professional Advice. The Services provide technology, educational tools, administrative functionality, and data access. Vendor does not provide legal, tax, accounting, investment, credit repair, debt settlement, lending, banking, insurance, or other regulated professional advice through the Services. Customer is solely responsible for the advice, coaching, recommendations, programs, communications, and services that Customer or its personnel provide to Authorized Users and for decisions made based on information available through the Services.

7.1 Security Measures. Vendor will maintain administrative, physical, and technical safeguards consistent with reasonable industry practice, including encryption in transit, encryption at rest for Subscriber Data, and multi-factor authentication for privileged accounts. Vendor may update its safeguards over time provided it does not materially reduce the overall protection of Subscriber Data during a Subscription Term.

7.2 Customer Security Responsibilities. Customer is responsible for securely administering its tenancy, assigning appropriate roles and permissions, protecting credentials, configuring Customer-controlled settings, and securing Customer systems and networks. Vendor’s security obligations do not extend to Customer-hosted infrastructure, including any Database On-Premises environment selected in a Service Order. Customer is solely responsible for the security, availability, backup, monitoring, and legal compliance of such Customer-hosted infrastructure.

7.3 Privacy. Vendor will handle personal data in accordance with its public privacy notice and applicable data-protection laws. Vendor does not sell Subscriber Data. Vendor may use subprocessors and Third-Party Services as necessary to provide the Services, subject to applicable contractual and legal requirements.

7.4 Audit-Log Retention. Vendor retains system audit logs for up to twelve (12) months. Longer retention, specialized archival, or custom log delivery may be subject to additional Fees. Vendor may retain particular logs or records for longer periods where reasonably necessary for security, legal compliance, or Third-Party Service requirements; longer retention does not expand Vendor’s obligations under this Section 7.4.

7.5 Data-Recovery Assistance. Vendor will, on Customer’s request, provide reasonable assistance with the restoration of Subscriber Data following accidental deletion or corruption. Restoration assistance is provided on a commercially reasonable efforts basis, without any guarantee of recovery, and is billable as Professional Services at Vendor’s then-current rates, except that assistance is provided at no charge to the extent the deletion or corruption results from Vendor’s breach of the Agreement or Vendor’s negligence. This assistance does not apply to Customer-hosted infrastructure unless expressly included in a Service Order.

7.6 Data Processing Addendum. If the Parties execute a data processing addendum, it is incorporated into the Agreement and controls over this MSA solely with respect to the processing of personal data covered by that addendum.

8.1 Uptime Commitment. Vendor will make the production Services available at least ninety-nine percent (99.0%) of each calendar month. Uptime excludes Planned Downtime; emergency maintenance reasonably required to protect the Services; events described in Section 14.6; suspension permitted under the Agreement; Customer systems, misuse, or connectivity; Third-Party Services outside Vendor’s reasonable control; Beta Features (as described in Section 2.8); and Customer-hosted Database On-Premises environments. Uptime is calculated using Vendor’s production monitoring records, absent manifest error, for the production service components operated and controlled by Vendor.

“Monthly-Equivalent Fee” means the recurring platform subscription Fees (including per-Registered User platform Fees) for the affected production Service for the affected calendar month or, if such Fees are prepaid annually or for another period longer than one month, one-twelfth (or the proportionate monthly amount for the applicable period) of the annual platform subscription Fee, in each case as actually paid or payable and net of recurring discounts. The Monthly-Equivalent Fee excludes one-time Fees, usage-based charges, third-party pass-through charges (including Credit and Data Services charges), implementation and onboarding Fees, App-Store Publishing and App-Store Management Fees, Professional Services Fees, and taxes. Customer must request a credit within fifteen (15) days after the end of the affected month and provide reasonable supporting information. Approved credits are applied to future invoices, are not redeemable for cash, and are Customer’s sole and exclusive remedy for failure to meet the uptime commitment.

8.3 Support Hours. Standard support is available from 8:00 a.m. to 6:00 p.m. U.S. Pacific Time, Monday through Friday, excluding Vendor holidays. Support for critical production issues is available twenty-four (24) hours per day, seven (7) days per week. Professional Services, configuration changes, data remediation, and custom requests are outside standard support unless expressly included in a Service Order. A “critical production issue” means a complete outage of the production Services or a material security incident affecting a substantial portion of Authorized Users, excluding issues caused by Customer systems or configuration, Third-Party Services, or Planned Downtime or emergency maintenance.

9.1 Vendor IP Indemnity. Vendor will defend Customer against a third-party claim that Customer’s authorized use of the Services infringes a United States patent, copyright, or trademark and will pay damages finally awarded by a court or agreed in a settlement approved by Vendor.

9.2 Exclusions and Remedies. Vendor has no obligation under Section 9.1 for a claim arising from Subscriber Data, Customer Materials, a Customer Application, Customer’s breach of the Agreement, modifications not made by Vendor, combination with items not supplied by Vendor, Third-Party Services, use outside the Documentation or Service Order, or continued use after Vendor provides notice of an infringement concern. If a claim is likely, Vendor may, at its option: (a) obtain the right for Customer to continue using the affected Service; (b) modify or replace the affected Service with materially equivalent functionality; or (c) terminate the affected Service and refund any prepaid, unused subscription Fees for the terminated portion. Sections 9.1 and 9.2 state Vendor’s entire obligation and Customer’s exclusive remedy for infringement claims.

9.3 Customer Indemnity. Customer will defend Vendor and its Affiliates against third-party claims arising from or relating to: (a) Subscriber Data, Customer Materials, or a Customer Application; (b) Customer’s or an Authorized User’s misuse of the Services; (c) Customer’s services, advice, communications, marketing claims, or programs offered to Authorized Users; (d) Customer’s breach of law, including privacy, consumer credit, financial services, or export-control laws; (e) Customer’s violation of Third-Party Service requirements; or (f) exports or transfers of data or technology by Customer in violation of export-control or sanctions laws. Customer will pay damages finally awarded by a court or agreed in a settlement approved by Customer. Customer’s indemnification obligations under this Section 9.3 are Excluded Claims under Section 10.3 and are not subject to the caps in Section 10.

9.4 Indemnification Procedure. The indemnified Party must promptly notify the indemnifying Party of a claim, provide reasonable cooperation at the indemnifying Party’s expense, and allow the indemnifying Party to control the defense and settlement. Delay in notice relieves the indemnifying Party only to the extent materially prejudiced. The indemnifying Party may not settle a claim in a manner that admits wrongdoing by, imposes non-monetary obligations on, or fails to fully release the indemnified Party without the indemnified Party’s prior written consent, not to be unreasonably withheld.

10.2 Enhanced Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT AS PROVIDED IN SECTION 10.3, A PARTY’S TOTAL AGGREGATE LIABILITY FOR ALL ENHANCED CLAIMS, TAKEN TOGETHER, WILL NOT EXCEED TWO TIMES THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THE AGREEMENT DURING THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO THE CLAIM (THE “ENHANCED CAP”).“Enhanced Claims” means, collectively: (a) a Party’s indemnification obligations under the Agreement, including any indemnification obligation relating to a Security Incident (defined in Section 10.6), unauthorized disclosure of personal data, or violation of applicable privacy or data-security laws that the Parties expressly agree to in a Service Order or amendment; and (b) a Party’s infringement or misappropriation of the other Party’s intellectual property rights. The Enhanced Cap is a single shared aggregate across all Enhanced Claims of every category; it is not a separate or cumulative cap for each category, claim, theory, or Service Order, and it is not in addition to the General Cap. A PARTY’S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE AGREEMENT, OTHER THAN EXCLUDED CLAIMS (DEFINED IN SECTION 10.3), WILL NOT EXCEED THE ENHANCED CAP.

10.3 Excluded Claims. NOTWITHSTANDING SECTIONS 10.1 AND 10.2, NOTHING IN THIS SECTION 10 LIMITS: (a) Customer’s obligation to pay Fees and other amounts due under the Agreement, including interest and collection costs under Section 3.6; (b) Customer’s indemnification obligations under Section 9.3, Section 11.2, and Section 15.12; or (c) Customer’s breach of Section 2.3 or Customer’s infringement or misappropriation of Vendor Technology or Vendor’s other intellectual property rights (each, an “Excluded Claim”).

10.5 Indemnified Amounts; Fines and Penalties. Amounts an indemnifying Party is obligated to pay in respect of a third-party claim under an indemnification obligation in the Agreement, including damages finally awarded, settlement amounts approved in accordance with Section 9.4, and reasonable costs of defense, are recoverable by the indemnified Party as direct damages and are not excluded by Section 10.4, even where those amounts include or reflect the third party’s lost profits, revenue, business, goodwill, data, or other indirect or consequential losses. All such amounts remain subject to the cap, if any, applicable to the underlying indemnification obligation under this Section 10. A governmental or regulatory fine or penalty is recoverable under an indemnification obligation only to the extent that: (a) indemnification for the fine or penalty is not prohibited by applicable law; and (b) the fine or penalty is directly attributable to the indemnifying Party’s breach of the Agreement, violation of applicable law, or other acts or omissions covered by the applicable indemnity. Any such recovery remains subject to the cap, if any, applicable to that indemnification obligation under this Section 10.

10.6 Security Incidents; Customer-Caused Events. “Security Incident” means confirmed unauthorized access to, or unauthorized acquisition, use, or disclosure of, Subscriber Data resulting from a compromise of systems controlled by Vendor. Vendor has liability in connection with a Security Incident, an unauthorized disclosure of personal data, or a violation of applicable privacy or data-security laws only to the extent the incident, disclosure, violation, or resulting loss is caused by Vendor’s breach of the Agreement, Vendor’s failure to comply with its obligations under Section 7, or Vendor’s violation of applicable privacy or data-security laws. Vendor has no liability, and Vendor’s liability is proportionately reduced, to the extent an incident, disclosure, violation, or loss results from: (a) Subscriber Data, Customer Materials, or a Customer Application as provided or maintained by Customer; (b) Customer systems, networks, or Customer-hosted infrastructure, including any Database On-Premises environment; (c) acts, omissions, configurations, or instructions of Customer or its Authorized Users, including compromised credentials; (d) Customer’s failure to comply with Section 2.4, Section 7.2, or its other security obligations under the Agreement; or (e) Third-Party Services or other systems outside Vendor’s reasonable control. This Section 10.6 applies regardless of the theory of recovery, including under any security or privacy indemnification obligation the Parties expressly agree to in a Service Order or amendment.

11.1 General Compliance. Each Party will comply with laws applicable to its own performance under the Agreement. Customer is responsible for laws applicable to Customer’s business, programs, advice, end-user relationships, communications, collection and use of Subscriber Data, and use of the Services.

11.2 Export Controls and Sanctions. Customer will not export, re-export, release, transfer, or use the Services, Documentation, or related technology in violation of United States export-control or sanctions laws. Customer represents that it and its Authorized Users are not prohibited parties or located in prohibited territories. Customer will indemnify Vendor for losses resulting from Customer’s violation of this Section 11.2.

11.3 Regulated Activities. Customer will not use the Services to conduct a regulated activity unless Customer has all licenses, permissions, policies, and procedures required for that activity. Customer will not represent that Vendor provides or endorses Customer’s financial, legal, tax, credit, investment, or other professional services except as expressly authorized in writing.

11.4 Anti-Corruption. Each Party will comply with applicable anti-corruption and anti-bribery laws, including the U.S. Foreign Corrupt Practices Act, in connection with the Agreement. Each Party represents that it has not made or offered, and covenants that it will not make or offer, any payment or thing of value to improperly influence an act or decision, obtain or retain business, or secure an improper advantage in connection with the Agreement, and each Party will promptly notify the other Party upon becoming aware of a violation of this Section 11.4.

12.1 MSA Term. This MSA begins on the Effective Date and continues until all Service Orders have expired or been terminated and all outstanding obligations have been satisfied.

12.2 Service Order Terms. Each Service Order begins on its Effective Date and continues for its stated Subscription Term. Renewal, non-renewal, and notice periods are governed by the applicable Service Order.

12.3 Termination for Breach. Either Party may terminate an affected Service Order, or the entire Agreement if the breach materially affects the entire relationship, for material breach that is not cured within thirty (30) days after written notice describing the breach. Termination is effective immediately if the breach is incapable of cure. If Customer terminates a Service Order under this Section 12.3 for Vendor’s uncured material breach, Customer’s obligation to pay Fees for the terminated Services for periods after the effective date of termination ceases (other than Fees for Services provided and usage incurred through that date), and Vendor will refund the pro-rata unused portion of any prepaid recurring subscription Fees for the terminated Services. If Vendor terminates a Service Order under this Section 12.3 for Customer’s material breach, the amounts described in Section 12.4 become immediately due and payable as if Customer had terminated that Service Order for convenience on the effective date of termination.

12.4 Termination for Convenience; Fee Acceleration and Claw-Back. Customer may terminate a Service Order for convenience on thirty (30) days’ written notice. Termination for convenience does not relieve Customer of its obligation to pay Fees for the full Subscription Term. Upon the effective date of a termination for convenience, all remaining recurring and committed Fees for the balance of the then-current Subscription Term, calculated at the rates and committed quantities stated in the Service Order, become immediately due and payable, and are due net thirty (30) days from Vendor’s invoice, regardless of the billing frequency stated in the Service Order. Usage-based and third-party pass-through Fees do not accelerate and remain payable as accrued through the effective date of termination. If Customer terminates during the first contract year, any waived one-time fee (including implementation, onboarding, and App-Store Publishing fees), and any other amount expressly identified in the Service Order as subject to claw-back under this Section 12.4, becomes immediately due and payable. Vendor may, in its sole discretion and only in a writing signed by Vendor, agree to alternative payment timing for any amount due under this Section 12.4. Customer acknowledges that the pricing and other commercial terms of each Service Order are based on Customer’s commitment for the full Subscription Term, and that amounts payable under this Section 12.4 are payments of committed Fees and not a penalty.

12.5 Effect of Termination. Upon expiration or termination of a Service Order, Customer will cease using the terminated Services, except during the offboarding period in Section 12.6. All accrued and unpaid Fees become due, and no prepaid Fees are refundable except as expressly stated. Termination of one Service Order does not terminate another Service Order unless the notice expressly states otherwise and a termination right applies.

12.6 Offboarding Grace Period; Data Export and Deletion. For thirty (30) days after expiration or termination of the applicable Service Order, and provided Customer has paid all undisputed amounts due, Vendor will make Subscriber Data available through Vendor’s then-standard export functionality or another format mutually agreed in writing. Customer may access the Services during this period solely as reasonably necessary to retrieve Subscriber Data, unless Vendor determines that continued access presents a security, legal, fraud, or third-party compliance risk. Migration, transformation, custom exports, and other offboarding assistance are Professional Services billable at Vendor’s then-current rates unless otherwise stated in a Service Order. After the thirty-day period, Vendor may delete Subscriber Data in accordance with its standard retention practices, except for copies retained in routine backups or as required by law. Retained copies remain protected under the Agreement and are deleted through Vendor’s ordinary retention cycle.

12.7 Return or Destruction of Confidential Information. Upon written request following expiration or termination, each Party will return or destroy the other Party’s Confidential Information, except for Subscriber Data handled under Section 12.6, copies retained in routine backups, records required by law, and archival copies retained by legal or compliance personnel. Any retained Confidential Information remains subject to Section 5.

12.8 Survival. Sections 3 with respect to outstanding amounts, 4, 5, 6.3, 6.4, 8.2, 9, 10, 11, 12.5 through 12.8, 13, 14, 15.12, 15.13, and 16.9 survive expiration or termination, together with any other provision that by its nature should survive.

Neither Party may use the other Party’s name, trademarks, or logo in publicity, customer lists, press releases, case studies, or marketing materials without the other Party’s prior written consent. Any approved use must comply with the other Party’s brand guidelines and may be revoked prospectively by written notice.

14.1 Entire Agreement; Order of Precedence. The Agreement consists of this MSA, each Service Order, any data processing addendum or other addendum executed by the Parties, and any Statement of Work incorporated into a Service Order. It is the entire agreement between the Parties regarding its subject matter and supersedes prior or contemporaneous proposals, negotiations, and communications. If there is a conflict, the following order of precedence applies: (a) a later amendment signed by both Parties; (b) an addendum executed by both Parties, solely with respect to its subject matter, provided that a data processing addendum controls only with respect to the processing of personal data covered by that addendum; (c) the applicable Service Order, but only where it expressly identifies the provision being modified and states that it overrides that provision; (d) the applicable product-specific provisions in Sections 15 and 16, solely with respect to the corresponding Services; and (e) the remaining provisions of this MSA. Where this MSA expressly permits a Service Order to state or specify otherwise, a Service Order provision addressing that subject is effective without the express identification required by clause (c). No purchase order, vendor portal term, click-through term, or similar Customer-provided term modifies the Agreement unless Vendor expressly accepts it in a writing signed by Vendor.

14.2 MSA Version Control; Amendments. The Version Date identified in Customer’s first Service Order governs the Parties’ relationship and all later Service Orders unless a later Service Order expressly identifies a different Version Date and states whether the later version replaces the prior version for all Service Orders or only for the later Service Order. If a later Service Order identifies a different Version Date but does not state its scope, the later version applies only to that later Service Order. Vendor may publish revised versions for future transactions, but posting a revised MSA does not modify an existing Agreement. Except as expressly permitted in the Agreement, an amendment must be in writing and signed by authorized representatives of both Parties.

14.3 Assignment. Neither Party may assign the Agreement without the other Party’s prior written consent, except to an Affiliate or in connection with a merger, reorganization, change of control, or sale of substantially all assets or the business to which the Agreement relates. Any prohibited assignment is void. The Agreement binds and benefits the Parties and their permitted successors and assigns.

14.4 Informal Dispute Resolution. Before filing a lawsuit arising out of the Agreement, the complaining Party will provide written notice describing the dispute, and authorized business representatives of the Parties will meet and attempt in good faith to resolve it for at least thirty (30) days after notice. This requirement does not restrict a Party from seeking temporary or injunctive relief, protecting intellectual property or Confidential Information, collecting undisputed Fees, responding to governmental action, or filing when necessary to avoid expiration of a limitation period.

14.5 Governing Law; Venue; Jury and Class Waiver. The Agreement is governed by the laws of the State of Delaware, USA, without regard to conflict-of-laws principles. Subject to Section 14.4, the Parties consent to exclusive jurisdiction and venue in the state or federal courts located in Wilmington, Delaware. EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A JURY TRIAL AND ANY RIGHT TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN A CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE ACTION.

14.6 Force Majeure. Neither Party is liable for delay or failure to perform caused by events beyond its reasonable control, including natural disasters, labor disputes, civil unrest, war, terrorism, governmental action, epidemics, failures of utilities or telecommunications, internet outages, cyberattacks not caused by the affected Party’s breach, and failures of Third-Party Services. This Section does not excuse payment obligations for Services already provided or Fees otherwise due.

14.7 Notices. Legal notices under the Agreement must be in writing and delivered by personal delivery, nationally recognized overnight courier, certified mail, or email to the notice contact specified in the applicable Service Order. Notices are effective upon receipt. An email notice is effective on the next business day after transmission if the sender receives no delivery-failure notice. Either Party may update its notice information by written notice. Routine operational communications may be delivered through the Services or ordinary email.

14.8 Waiver. A waiver is effective only if in writing and signed by the waiving Party. A waiver of one breach is not a waiver of another breach or of the same breach on a later occasion. Failure or delay in exercising a right does not waive that right.

14.9 Severability. If any provision is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable and preserve its intent. If modification is not possible, it will be severed, and the remaining provisions will remain in effect.

14.10 Relationship of the Parties. The Parties are independent contractors. The Agreement does not create a partnership, franchise, joint venture, agency, fiduciary, employment, or exclusive relationship. Neither Party may bind the other without written authority.

14.11 No Third-Party Beneficiaries. Except for indemnified parties under Section 9, the Agreement is for the sole benefit of the Parties and their permitted successors and assigns and does not create rights in any other person, including Authorized Users.

14.12 Electronic Records; Counterparts. Service Orders, amendments, and other documents under the Agreement may be executed in counterparts and by electronic signature, each of which is deemed an original and all of which together constitute one instrument. The Parties consent to the use and retention of electronic records and signatures. A copy produced from a reliable electronic system is admissible to the same extent as an original.

14.13 Interpretation. Headings are for convenience only. “Including” means “including without limitation.” References to a Section are to a section of this MSA unless stated otherwise. The Agreement will not be construed against a Party because it drafted or proposed a provision.

15.1 Applicability. This Section 15 applies to credit reports, credit scores, score factors, credit monitoring, identity data, identity verification, account data, financial account connectivity, rental or other data furnishing, credit-education features, and related Third-Party Services (collectively, “Credit and Data Services”) selected or used by Customer.

15.2 Third-Party Providers and Dependencies. Credit and Data Services may be provided through credit bureaus, furnishers, aggregators, financial institutions, identity providers, and other data providers. Availability, accuracy, scoring methodologies, reporting timelines, matching logic, furnishing acceptance criteria, and access requirements are determined by those third parties and may change, be suspended, interrupted, or modified without notice. Vendor’s obligations are contingent on continued access to the applicable Third-Party Services. Vendor is not responsible for interruption, delay, suspension, unavailability, degradation, or modification of Third-Party Services, bureau access, furnishing capabilities, financial connectivity, identity services, or scoring models.

15.3 Consents, Authorizations, and Permissible Purpose. Customer will obtain and maintain all end-user consents, disclosures, authorizations, opt-ins, and permissible-purpose certifications required under the Fair Credit Reporting Act (“FCRA”) and other applicable federal, state, and local laws. Customer is responsible for documenting and retaining those consents and certifications and for providing them to Vendor or a Third-Party Service provider upon reasonable request. Customer is solely responsible for retaining those records for the periods required of it by law, including by exporting them through the Services before the end of the offboarding period under Section 12.6; after that period, Vendor has no obligation to retain them for Customer except as required by applicable law.

15.4 Customer Compliance Program. Customer will maintain compliant workflows, policies, procedures, disclosures, training, and recordkeeping for credit pulls, credit monitoring, data furnishing, dispute handling, adverse action, identity verification, privacy, data retention, consumer communications, and other regulated activities applicable to Customer’s use of Credit and Data Services.

15.5 Authorized Use and Provider Requirements. Customer will access and use Credit and Data Services only pursuant to a valid permissible purpose under applicable law and provider requirements, including, where applicable, the written instructions of the consumer under the FCRA, and only for the specific purposes disclosed to and authorized by the consumer. Financial education (including credit education) and financial wellness uses are permitted only to the extent supported by such a permissible purpose. Customer will comply with bureau, data-provider, financial-institution, and platform requirements, policies, technical standards, and usage restrictions communicated by Vendor from time to time.

15.6 Adverse Action and Consumer Notices. Customer is solely responsible for determining whether adverse action notices, consumer disclosures, opt-ins, dispute notices, or other legally required communications are required and for providing them accurately and on time. Vendor does not determine Customer’s permissible purpose or legal obligations.

15.7 Vendor Role; No Credit Outcome Guarantee. Vendor is not acting as a consumer reporting agency, credit repair organization, debt settlement provider, lender, bank, or financial institution, and no Service Order or other document recharacterizes Vendor’s role by implication; Vendor may assume such a role only by a written amendment signed by both Parties that expressly identifies the role assumed. Vendor does not independently verify the accuracy, completeness, or timeliness of information supplied by Customer, Authorized Users, financial institutions, furnishers, bureaus, or other providers. Vendor does not guarantee any credit score, score increase, furnishing outcome, reporting timeline, account match, deletion outcome, approval decision, financial account connection, identity match, or other result. Scores, reports, furnished tradelines, account data, and related information may vary among bureaus, providers, scoring models, institutions, and reporting periods.

15.8 Customer Data and Legal Responsibilities. Customer is solely responsible for legal obligations relating to consumer credit, privacy, security, data minimization, retention, archival, deletion, and protection that apply to Customer’s use of Credit and Data Services. Customer will not submit data that it is not legally authorized to submit, access, use, or furnish.

15.9 Compliance Cooperation. Customer will reasonably cooperate with compliance reviews, audits, certifications, documentation requests, investigations, and remediation efforts required by Vendor, a bureau, a data provider, a financial institution, or a regulator. Customer will promptly remediate identified non-compliance and provide accurate information requested for provider approval or continued access.

15.10 Suspension and Marketing Restrictions. Vendor may immediately suspend, restrict, modify, or terminate access to Credit and Data Services if Vendor reasonably believes Customer is violating law, provider requirements, or the Agreement, or if a provider requires such action. Customer will not make representations, guarantees, advertisements, or marketing claims regarding credit score improvements, approval likelihood, bureau relationships, account connectivity, furnishing results, or credit outcomes that are inconsistent with the Services, applicable law, or provider requirements.

15.11 No Credit Repair; Educational Terminology. THE SERVICES AND ANY THIRD-PARTY SERVICES ACCESSED THROUGH THE SERVICES MUST NOT BE USED TO PROVIDE CREDIT REPAIR SERVICES OR CREDIT REPAIR ADVICE. VENDOR DOES NOT CLAIM, AND CUSTOMER WILL NOT REPRESENT, THAT VENDOR OR THE SERVICES CAN CLEAN UP OR IMPROVE ANY PERSON’S CREDIT RECORD, CREDIT HISTORY, OR CREDIT RATING. ANY USE OF THE WORDS “IMPROVE” OR “GOAL” OR SIMILAR TERMINOLOGY IN OR IN CONNECTION WITH THE SERVICES IS FOR EDUCATIONAL PURPOSES ONLY AND DOES NOT MEAN, AND MAY NOT BE PRESENTED AS MEANING, CLEANING UP OR IMPROVING ANY PERSON’S CREDIT RECORD, CREDIT HISTORY, OR CREDIT RATING. All credit-related features of the Services are provided for financial and credit education only, and Customer will present them accordingly. Customer will ensure that its programs, marketing, communications, and use of the Services comply with this Section 15.11 and applicable law, including the Credit Repair Organizations Act and similar state laws.

15.12 Credit and Data Services Indemnity. Without limiting Section 9.3, Customer will defend, indemnify, and hold harmless Vendor and its Affiliates from claims, damages, fines, penalties, liabilities, regulatory actions, costs, and expenses arising from Customer’s misuse, non-compliance, unauthorized use, improper disclosures, failure to obtain required consents or authorizations, inaccurate furnishing, failure to handle consumer disputes or notices, or violation of applicable law or provider requirements. These obligations are Excluded Claims under Section 10.3 and are not subject to the caps in Section 10.

15.13 Survival of Credit and Data Obligations. Sections 15.3, 15.8, and 15.9 survive expiration or termination of the applicable Service Order, solely with respect to Credit and Data Services used during the Subscription Term, including Customer’s obligations to retain and produce consents, authorizations, and permissible-purpose certifications and to cooperate with audits, investigations, and remediation relating to that use, for three (3) years following the end of the calendar year in which the applicable Credit and Data Services were used or any longer period required by applicable law or the requirements of the applicable Third-Party Service provider.

16.1 Applicability and Scope. This Section 16 applies when App-Store Publishing or App-Store Management is selected in a Service Order or is otherwise requested by Customer and provided by Vendor. For App-Store Publishing, Vendor will prepare and submit a Customer-branded mobile application to the Apple App Store, Google Play, or other store identified in the Service Order. App-Store Management is the ongoing service described in Section 16.8.

16.2 Updates, Resubmissions, and Publishing Allowance. “Update” means a routine release of the application initiated in the ordinary course, including maintenance releases, content or configuration changes, and releases addressing operating-system or device compatibility. “Resubmission” means a submission of the application to a store for review after the store has rejected, removed, or suspended the application or has required changes as a condition of listing or approval. Unless a Service Order states otherwise, the App-Store Publishing Fee includes up to ten (10) Vendor-initiated Resubmissions per store during the six (6) months following the initial submission. Vendor may, in its discretion and at no additional cost, make further Resubmissions if Vendor believes they will materially increase the likelihood of approval or resolve a store issue.

16.3 No Approval or Continued Availability Guarantee. Initial acceptance and continued availability are solely within the discretion of Apple Inc., Google LLC, and other store operators. Vendor does not guarantee approval, publication by a particular date, continued listing, or perpetual availability.

16.4 Post-Approval Revocation and Additional Fees. A store operator may later reject, remove, suspend, or require changes to an application. If Customer requests assistance after the allowance in Section 16.2, including any discretionary Resubmissions, is exhausted or has expired, the work is billable as Professional Services unless covered by an active App-Store Management service under Section 16.8 or otherwise agreed in writing.

16.5 Customer Responsibilities. Customer will: (a) maintain active developer accounts and pay store fees; (b) provide Vendor timely administrative access; (c) provide accurate metadata, branding, screenshots, privacy notices, legal disclosures, support information, certificates, and other required materials; (d) maintain rights to all Customer Materials included in the application; and (e) respond promptly to Vendor requests needed for submission, review, or Resubmission. Customer is responsible for legal compliance of its application content, business model, data practices, and representations to end users. If Customer fails to respond to a Vendor request for materials, information, approvals, credentials, or access reasonably required under this Section 16 within five (5) business days, Vendor’s obligations that depend on the requested item are suspended until Customer responds, and Vendor is not responsible for any resulting delay, rejection, removal, suspension, or non-compliance.

16.6 Policy and Technical Changes. Vendor is not responsible for delays, rejection, removal, suspension, or additional effort caused by changes to store policies, technical requirements, operating systems, devices, developer accounts, certificates, or Customer Materials after the initial submission. Work reasonably required to address such changes is billable as Professional Services unless covered by an active App-Store Management service under Section 16.8 or otherwise agreed in writing.

16.7 Service Completion. The initial App-Store Publishing service is deemed fully performed upon the earliest of (a) approval of the first version of the application by the applicable store; (b) expiration of six (6) months following the initial submission; or (c) Vendor’s completion of the initial submission and the ten (10) Resubmissions included under Section 16.2. No continuing submission, maintenance, update, or warranty obligation is implied after the initial App-Store Publishing service is performed unless App-Store Management is selected in a Service Order or the obligation is included in a Service Order or Professional Services engagement.

16.8 App-Store Management. Where App-Store Management is selected in a Service Order, Vendor will, during the management term stated in the Service Order (or, if no term is stated, a management term co-terminous with the Subscription Term of that Service Order, beginning on the start date of the App-Store Management service and renewing and ending with that Subscription Term) and for each store identified in the Service Order, use commercially reasonable efforts to keep the published application in compliance with applicable store requirements, including by performing policy-driven changes, Updates, and Resubmissions and by providing reasonable assistance with developer-account and certificate renewals. Customer remains the owner of its developer accounts and is responsible for timely authorizations, accurate account information, acceptance of store terms, and payment of all store fees. Updates are included without limit on quantity. Resubmissions are included up to ten (10) per store during each twelve (12) months of active App-Store Management, unless the Service Order states a different allowance; additional Resubmissions, and work outside the scope described in this Section 16.8, are billable as Professional Services. App-Store Management does not include new feature development, application redesign, marketing, or payment of store fees, and does not guarantee approval, continued listing, or availability (Section 16.3 applies). App-Store Management depends on Customer’s timely cooperation under Section 16.5, and Vendor is not responsible for removal, suspension, or non-compliance resulting from Customer’s failure to cooperate, to maintain its developer accounts, or to pay store fees.

16.9 Limitation of Liability. Vendor’s aggregate liability relating to App-Store Publishing and App-Store Management is subject to Section 10. Vendor is not liable for lost revenue, lost users, delayed launch, business interruption, or other indirect or consequential damages arising from rejection, delayed approval, suspension, removal, or store-policy changes.