Talebeacon Terms of Service

Version 6.4 · Effective 13 October 2026

Category benchmarks and research — Section 6.5

Eligible company brands you add after expressly accepting these Terms are included in our planned benchmark and research programme unless you exclude them. We may combine their non-personal company metrics into anonymous category comparisons, public research and marketing reports, and paid aggregate reports or data services. You can exclude a covered brand in its settings or by emailing support@talebeacon.com, including while it is archived. Exclusion stops its contribution to new calculations for shared programme results; it does not stop internal operation or method improvement permitted by the Terms. These planned features are not available yet. Section 6.5 sets out the eligibility rules, timing and protections.

1. Parties and acceptance

1.1 Parties

These Terms of Service (the "Terms" or "Agreement") are between Talebeacon Ltd. (the "Provider") and the legal entity identified as the customer in the applicable Order Form or account registration (the "Customer"), with respect to Customer's access to and use of Provider's online platform and related services (the "Platform").

1.2 Acceptance and effective date

These Terms become effective on the earlier of: (a) the date on which an authorized administrator acting on behalf of Customer (the "Admin") clicks "I Agree" or uses a similar acceptance mechanism in connection with creating an account or purchasing a subscription; or (b) the Effective Date set forth in the first Order Form accepted by Customer (the "Effective Date"). Customer accepts these Terms at account creation and at purchase when using the self-serve service. The Admin represents and warrants that they have full authority to enter into these Terms on behalf of Customer and to bind Customer to their terms.

1.3 Contract documents

These Terms, together with any Order Form(s) executed or accepted hereunder and any DPA applicable under Section 8.4, constitute the agreement between the parties with respect to the subject matter hereof. An enterprise Order Form signed by both parties may include negotiated terms and expressly agreed attachments in accordance with Section 3.6. The Privacy Notice is linked for information and is not incorporated into this Agreement.

2. Definitions

2.1 Aggregated Usage Data

"Aggregated Usage Data" means data that is collected, compiled, and analyzed from multiple individual users of the Platform in a manner that is anonymized and aggregated, such that it does not identify any individual user. This data includes, but is not limited to, usage patterns, performance metrics, feature adoption metrics, benchmarking, trend analyses, and other statistical information that the Provider collects, generates, derives, or otherwise processes to understand how the Platform is used, improve its functionality, and enhance the overall user experience. For the avoidance of doubt, Aggregated Usage Data constitutes data sets that have been irreversibly anonymized and aggregated to a degree that prevents re-identification of any individual or Customer, whether directly or indirectly, and shall not be considered Customer Data for any purpose under these Terms. Aggregated Usage Data does not constitute Personal Data and is not subject to deletion, return, or access requests applicable to Customer Data. Provider may use, retain, disclose, publish, commercialize, and otherwise exploit Aggregated Usage Data for any lawful business purpose, including without limitation operating, maintaining, securing, improving, developing, and marketing the Platform and other products or services of Provider, provided that such use does not identify Customer, any User, or any individual.

Creation and use of Shared Outputs, as defined in Section 6.5, and preparation of data for those outputs are subject to Section 6.5, including its eligibility and exclusion rules. Internal operation and method improvement that do not make Shared Outputs available remain governed by the existing permissions and restrictions in these Terms, as explained in Section 6.5(f). Other Aggregated Usage Data, such as product-usage statistics not derived from Customer's brand-specific scan inputs, results or other scan records, remains governed by this Section.

2.2 Applicable Data Protection Laws

"Applicable Data Protection Laws" means all applicable data protection and Privacy laws, regulations and sub-legislation, in each case as amended, replaced, or updated from time to time, including without limitation the Israeli Privacy Protection Law, 5741-1981, the UK/EU General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA"), and other relevant USA privacy laws, rules, or regulations.

2.3 AI Engine

"AI Engine" means any artificial intelligence system, model, or technology, whether software-based or embodied, that is capable of learning, reasoning, problem-solving, decision-making, or performing tasks that would otherwise require human-like abilities, including but not limited to sensing, perception, cognition, planning, learning, communication, or physical action.

2.4 Customer

"Customer" means the legal entity that has registered an account for, or entered into a subscription to, the Platform under these Terms.

2.5 Customer Data

"Customer Data" means any and all data, information, or materials that are provided or made available to the Platform by or on behalf of Customer or its Users, including without limitation: account registration information; workspace configuration data; prompts, instructions, and inputs submitted by Customer; URLs, domain names, and links submitted for analysis; and Customer-generated annotations, notes, and settings within the Platform. For the avoidance of doubt, Customer Data does not include: (a) Aggregated Usage Data; (b) System Data; (c) Platform Information; or (d) Third-Party Public Content (as defined below), even if such content is processed, analyzed, summarized, compared, or otherwise handled by the Platform at Customer's request.

2.6 Data Processing Addendum

"Data Processing Addendum" (the "DPA") means Appendix A, incorporated into these Terms under Section 8.4 and applying to personal data that Provider processes on Customer's behalf within its scope. The DPA may be amended in accordance with its terms.

2.7 Documentation

"Documentation" means any and all manuals, technical specifications, instructional videos, and other written, electronic, or audiovisual materials provided or made available by the Provider in connection with the Platform, whether in printed, digital, or any other form, and as may be updated from time to time.

2.8 Marks

"Marks" means, with respect to each party, such party's names, logos, trademarks, service marks, trade names, and any other proprietary brand elements, whether registered or unregistered, and all goodwill associated therewith.

2.9 Order Form

"Order Form" means any ordering document or online purchase flow (including an in-Platform checkout, subscription selection screen, or similar interface) that is completed, accepted, or otherwise agreed to by Customer (including electronically), and that specifies Subscription details such as fees, payment terms, Subscription Term, quantities, and plan features. For a self-serve card purchase, the plan terms shown to and accepted by Customer in the subscription-selection and purchase flow constitute the Order Form; no separately signed Order Form is required. An enterprise Order Form is signed by both parties, identifies the plan, and may contain a negotiated-terms section identifying the specific sections it overrides.

2.10 Privacy Notice

"Privacy Notice" means Provider's privacy notice linked at talebeacon.com/privacy, which describes the collection, use, storage, and disclosure of information in connection with the Platform. It is a transparency notice, may be updated from time to time, and is not incorporated into this Agreement.

2.11 Platform

"Platform" means the Talebeacon online platform and related services, which are owned and operated by the Provider, and include, without limitation, all related and associated applications, websites, cloud-based services, backend infrastructure and any third-party services or components (including Third-Party AI Services) that are used by Provider to provide the Platform, as well as System Data, Provider Marks, and Documentation, whether now existing or hereafter developed. The Platform provides analysis of brand visibility in AI engines and related recommendations, within the scope of the applicable Order Form.

2.12 Subscription

"Subscription" means the non-exclusive, non-transferable right granted to Customer and its authorized Users to access and use the Platform solely during the term specified in the applicable Order Form, subject to the terms and conditions of these Terms.

2.13 Subscription Term

"Subscription Term" means the subscription term specified in the applicable Order Form (including any renewal term, if applicable). A self-serve Subscription Term is one month, including each monthly renewal term. A price lock stated in an Order Form is a price guarantee for the stated period, not a commitment to subscribe for that entire period.

2.14 System Data

"System Data" means any data, records, or logs generated, collected, or maintained by the Platform in connection with its operation, including, without limitation, access logs, security logs, and other technical or operational logs, but expressly excluding any Customer Data. For the avoidance of doubt, System Data is generated by the Platform for security, operational, compliance, and troubleshooting purposes and is not subject to deletion, return, or access requests applicable to Customer Data.

2.15 User

"User" means any individual (including Customer's employees, contractors, or other personnel) that accesses or uses the Platform pursuant to, or by virtue of, the Customer's Subscription.

2.16 Authorized Users

"Authorized Users" means those Users that are authorized by Customer to access and use the Platform pursuant to Customer's Subscription and within the scope, quantities, limitations, and other restrictions (if any) specified in the applicable Order Form.

2.17 Effective Date

"Effective Date" means, with respect to these Terms, the effective date determined in accordance with Section 1.2.

2.18 Services

"Services" means the Platform and any related services provided or made available by Provider to Customer under these Terms and/or under any applicable Order Form(s), including support and maintenance services (if purchased), and any updates, upgrades, or modifications to the foregoing.

2.19 Platform Information

"Platform Information" means any and all information, materials, data, outputs, results, reports, analytics, documentation, specifications, designs, interfaces, workflows, and other content or materials (in any form) made available by Provider in connection with the Platform or the Services, excluding Customer Data.

2.20 Feedback

"Feedback" means any suggestions, ideas, enhancement requests, recommendations, corrections, or other feedback provided by Customer or any User relating to the Platform or the Services.

2.21 AI Engine Outputs

"AI Engine Outputs" means any outputs, results, or content generated by or through AI engines in connection with the Platform or the Services.

2.22 Third-Party Public Content

"Third-Party Public Content" means any content, materials, data, or information that is (i) publicly available on the internet or otherwise made available by third parties (including, without limitation, websites, third-party databases, forums, social networks, blogs, and other public sources), and/or (ii) retrieved, accessed, or processed by the Platform from, through, or in connection with Customer-provided URLs, domains, links, or other identifiers. Third-Party Public Content may include content that contains personal data that has been published by third parties. Third-Party Public Content is not Customer Data.

2.23 Third-Party AI Services

"Third-Party AI Services" means third-party artificial intelligence models, tools, APIs, platforms, or services that may be accessed, integrated, or used by Provider in order to provide certain Platform features, including generating, retrieving, analyzing, or transforming AI engine outputs.

2.24 Affiliate

"Affiliate" means an entity that directly or indirectly controls, is controlled by, or is under common control with a party. "Control" means the power to direct the management and policies of an entity, through ownership of voting interests, contract, or otherwise.

3. License

3.1 Access and report exports

Subject to the terms and conditions of this Agreement, including Customer's payment of all applicable fees, Provider hereby grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the applicable Subscription Term to permit its Authorized Users to access and use the Platform solely for Customer's internal business purposes. Such permitted use includes generating and viewing reports and deliverables made available by the Platform and exporting reports and the sources list in the formats the Platform makes available from time to time, for Customer's internal business use (at the date of these Terms: Markdown report download, the browser's print-to-PDF function, and CSV export of the sources list). Notwithstanding expiration or termination of the Subscription or these Terms, Customer retains a non-exclusive, non-transferable, non-sublicensable licence to retain and use reports and deliverables lawfully exported during a paid Subscription, or during read-only access under this Section that followed a paid Subscription, for its internal business purposes, subject to continued compliance with Sections 3.3 and 3.4 and the applicable confidentiality obligations. Expiration, non-renewal or cancellation alone does not revoke that licence. This continuing licence does not grant access to the Platform or future reports, require Provider to retain or host a copy, or modify the deletion and export provisions of Section 8.

Separately from the continuing report-use licence, while a lapsed account is retained under Section 8.5, Customer has a limited, non-exclusive, non-transferable, non-sublicensable right to permit its Authorized Users to access the existing account and its existing materials on a read-only basis for Customer's internal business purposes. This read-only access is not a Subscription, includes no new scans or other paid Services, and does not extend the paid Subscription Term. It remains subject to these Terms, including the use, sharing, confidentiality and security restrictions, and ends on account closure under Section 8.5, subject also to lawful suspension or termination under Section 11.

3.2 Platform Information

Customer acknowledges and agrees that all Platform Information, including, without limitation, all data, outputs, results, analytics, and any enhancements, modifications, or improvements derived from or relating to the Platform, are and shall remain the exclusive property of Provider and/or its licensors. For the avoidance of doubt, Platform Information excludes Customer Data.

3.3 Use restrictions

Except as expressly permitted under this Agreement or with Provider's prior written consent, Customer shall not, directly or indirectly: (a) disclose, release, distribute, communicate, or otherwise make available any Platform Information to any third party; (b) permit any third party to access or use the Platform Information; (c) use, exploit, or apply the Platform Information for any purpose other than as expressly authorized for Customer's permitted access and use of the Platform in accordance with these Terms, including to develop, train, or improve any competing product or service; (d) copy, duplicate, decompile, disassemble, reverse engineer, recreate, reproduce, or otherwise attempt to derive the source code, structure, or underlying ideas or algorithms of any Platform Information; or (e) remove, alter, obscure, or deface any proprietary notices, trademarks, service marks, serial numbers, logos, copyrights, or other proprietary indicia affixed to or contained within the Platform Information.

3.4 Sharing reports

Notwithstanding the foregoing, Customer may disclose and share reports and deliverables exported from the Platform in accordance with Section 3.1 solely for Customer's internal business purposes, including with Customer's Affiliates and with Customer's contractors and professional advisors (such as marketing agencies, consultants, PR firms, and legal counsel), provided that such recipients are bound by written confidentiality obligations at least as protective as those set forth herein and Customer remains responsible for their compliance.

3.5 Customer accounts and Users

Customer shall ensure that its Authorized Users comply fully with the terms of this Agreement and shall be liable for any breach of this Agreement by its Users. Customer is responsible for all access to and use of the Platform under Customer's accounts and by its Authorized Users, whether or not authorized by Customer.

3.6 Order precedence and attachments

Subject to the DPA priority rule in Section 8.4, in the event of any conflict or inconsistency between an applicable appendix and these Terms, these Terms shall govern and control, unless an enterprise Order Form signed by both parties expressly provides otherwise. An Order Form controls the commercial and subscription-specific terms expressly set forth in it, including fees, payment terms, Subscription Term, quantities, and plan features. In addition, the negotiated-terms section of an enterprise Order Form signed by both parties may override any specific section of these Terms that it expressly identifies. No Privacy Notice, Security Addendum or Service Level Agreement is incorporated into a self-serve Order Form or these Terms; the DPA is governed by Section 8.4. A Security Addendum or Service Level Agreement applies to an enterprise order only if expressly included in an Order Form signed by both parties.

3.7 Free evaluation access and Founding Program

(a) General evaluation access. Except for Founding Program access governed by paragraphs (b)–(j), Provider may grant free evaluation access, including an invited pilot, on the terms stated at invitation; such access is expressly agreed free evaluation access for Section 14.4(d), confers no Subscription, and may be ended by Provider on notice.

(b) Approval, acceptance and activation. A company whose Founding Program application Provider approves may activate its place by expressly accepting a version of these Terms containing this Section and completing its first authenticated sign-in for that approved programme access within thirty (30) days after the approval email is sent. This requirement also applies to a company with an existing account; earlier account creation, acceptance of an earlier version or an earlier sign-in does not activate the programme. The approval email identifies the approved company, brand, contact address and activation deadline, with its time zone, and draws attention to the approval conditions in this paragraph. Those identifying details administer this Section; the email does not vary the programme terms or constitute an Order Form for a paid Subscription. If the place is not activated within that period, the invitation expires. Before activation, Provider may withdraw the approval only if it materially relied on false or misleading application information, providing the approved access would be unlawful, a specific material security risk cannot reasonably be mitigated, or Provider ends the programme on the fundamental delivery-cost ground in paragraph (f). Provider shall notify the applicant of the reason before withdrawal takes effect, with reasonable advance notice where practicable. A change of mind alone does not permit withdrawal. Any condition on the approval must be disclosed with the approval; it cannot be introduced retrospectively. Where these Terms have already taken effect under Section 1.2, the same limited withdrawal grounds apply until activation. A different contractual arrangement requires the applicable agreement mechanism in Sections 1.3 and 3.6.

(c) Programme access. Subject to paragraphs (d)–(f), the Founding Program provides three (3) calendar months of access from the first authenticated sign-in that activates the approved place under paragraph (b), for one approved brand, without a monetary subscription fee or a required payment card (the “Free Period”). Programme access includes up to ten (10) customer-initiated full scans per account per calendar month across ChatGPT, Gemini and Perplexity. The allowance is shared across all brands in the account; it is not a separate allowance for each brand. Use of that shared allowance for another brand does not give that brand a separate Founding Program place or the promotional price benefit in paragraph (h). The allowance resets at 00:00 UTC on the first day of each calendar month; it is not a scan scheduled every three days or a separate allowance for each month measured from activation. The Platform displays the same allowance and reset time, including UTC as the time zone. Any scans already counted against the applicable allowance in the same calendar month remain counted; activation does not grant an additional allowance. Unused allowance does not carry into the next calendar month. Scans may be started only while programme access is active, so access for part of a calendar month does not extend beyond the Free Period or override a pause. Programme access also includes an intervention plan following each scan, before-and-after comparison across scans, and access to Provider's team for programme support. This paragraph does not create an uptime, response-time or Service Level Agreement. Founding Program access is not a paid Subscription. For Section 14.4(d), the Free Period is expressly agreed free trial or evaluation access and its US$50 per-Customer sublimit applies to losses arising solely from events during that access, subject to Section 14.4(a) and (e). The reasonable good-faith participation obligations in paragraph (d) do not change that contractual allocation or create service fees. During the Free Period, the access right and Customer Data licence in Sections 3.1 and 6.3 apply to the extent necessary to provide the programme, subject to their existing purpose, use, confidentiality and data-protection restrictions. References to Users and Authorized Users include persons Customer authorises to use its Founding Program account within the programme's limits.

(d) Good-faith participation. Customer shall make reasonable, good-faith efforts to use the programme actively, run scans, consider and implement appropriate actions within its control, and provide candid feedback in response to reasonable programme requests. If results improve, Customer shall cooperate in good faith in discussing a truthful account of those results and a potential testimonial in its own words. Customer is not required to achieve particular results, implement an action it reasonably considers unsuitable, or provide a favourable endorsement. Provider shall obtain separate permission for the particular testimonial and proposed attribution before publication; neither these Terms nor a participation indicator supplies that permission. Refusal or withdrawal of permission to publish personal information, or of marketing consent, is not by itself a participation breach. The separate customer-name and logo provision in Section 16.2 remains unchanged.

(e) Material non-participation. If Customer materially fails to meet paragraph (d), Provider may end the remaining free access after giving written notice identifying the failure and at least fourteen (14) days to remedy it or agree a reasonable participation plan. Critical feedback, disappointing results or a pause agreed with Provider is not by itself a failure to participate. No retroactive subscription fee or automatic paid conversion results from ending free access. For a failure consisting solely of non-participation under paragraph (d), this notice-and-remedy process governs notwithstanding Sections 11.3 and 11.4; describing it as a breach of Section 3 does not permit immediate suspension or termination. Other lawful suspension or termination rights for independent grounds, including an actual security risk, unlawful use or another material breach, remain available under their applicable conditions. Provider shall not use its general evaluation notice right in paragraph (a) or its termination-for-convenience right under Section 11.2 merely to avoid the commitments in this Section.

(f) Fundamental delivery-cost change and pauses. Provider may pause or end the programme where a material external change affecting essential services or inputs, including their availability, supplier terms or pricing, substantially increases the reasonable cost of providing the programme so that continued provision becomes commercially unreasonable despite reasonable mitigation. Ordinary cost fluctuations, a preference for a higher margin, or an unnecessary increase in cost caused by Provider's own discretionary choices do not alone satisfy this condition. Provider shall give Customer a written explanation and reasonable advance notice where practicable. A pause notice shall state its effective date and an expected resumption or review date. At that date Provider shall resume access, end the programme on notice, or agree an extension of the pause with Customer. Unused free time is preserved during a Provider-imposed pause and the Free Period's end date is adjusted on resumption; a pause does not by itself end the Free Period or start the paid-promotion take-up window. A temporary pause is not read-only lapse for the inactivity-closure clock in Section 8.5. If Provider ends the programme, its notice shall state the effective end date and resulting promotional deadline. Neither a pause nor termination under this paragraph creates a charge for the free access already provided. For the sole purpose of applying Section 14.4(d), a Provider-imposed pause under this paragraph remains part of the free evaluation access described in paragraph (c), even when active use is unavailable; the pause does not create or replenish any liability allowance.

(g) End of free access, read-only access and exports. When the Free Period ends or free programme access ends earlier under these Terms, unless Customer has separately purchased a paid Subscription, new scans stop and the account becomes read-only, subject to any lawful suspension or termination of the account itself. For Sections 3.1, 6.3 and 8.5, that account is treated as a lapsed account even if it has never had a paid Subscription. The end of free access does not itself close the account or start the forty-five (45) day deletion period. The existing inactivity-notice, sign-in, earlier-deletion and lawful suspension or termination provisions continue to apply, and no fees accrue merely for retaining the read-only account. For the continuing report-use licence in the first paragraph of Section 3.1, eligible exports also include exports made during the Founding Program and its following read-only access, with all other licence limitations remaining applicable. The failed-payment recovery period in Section 4.3 does not arise merely because free access ends.

(h) Optional paid continuation and promotion. Customer may take up the Founding Program Launch Plan promotion by completing its first paid Launch Plan purchase no later than thirty (30) days after its free programme access ends. The price for the approved brand is US$299 per month, locked for twelve (12) months from the successful payment that starts that paid Subscription. The price lock is a benefit, not a commitment to subscribe for twelve months, and its original twelve-month window does not restart on a later repurchase. Monthly renewal and cancellation remain governed by the applicable Order Form and Section 4.3. Customer may instead choose another plan if offered, on that plan's stated terms; this Launch Plan price lock does not transfer to a different plan. Notwithstanding Section 3.6, for an eligible Customer taking up this promotion, this paragraph controls over inconsistent self-serve Order Form terms concerning the US$299 monthly price, the twelve-month lock, its start and non-restart, and the absence of a twelve-month purchase commitment. The Order Form must reflect those terms and otherwise controls the features and commercial details of the paid Subscription. A negotiated-terms section of an enterprise Order Form signed by both parties may vary this paragraph only by expressly identifying Section 3.7(h) and the agreed variation. Expiry of this promotion does not represent that Provider's ordinarily available price will necessarily be higher. No paid Subscription starts automatically; a later general price change does not withdraw the lock once validly taken up. An earlier pause does not restart or extend an already-running paid price-lock window. This paragraph does not override an otherwise lawful refusal, suspension or termination of paid service under these Terms.

(i) Programme administration record. Once linked to Customer's account, the Founding Program administration record follows the account-closure and deletion timetable in Section 8.5, including its applicable-law, backup and earlier-deletion provisions, even if the record is not otherwise included in the definition of Customer Data.

(j) Other terms. Except as expressly provided in this Section, these Terms remain applicable, including Section 14.4 and any DPA applicable under Section 8.4. Paragraph (c) expressly applies the existing free-evaluation sublimit; this Section creates no different cap amount or additional aggregate allowance. Acceptance of these Terms is not consent to email marketing.

4. Payments, Subscription Plan, and Other Subscription Details

4.1 Fees and payment

The payment terms, subscription plan, and other subscription details shall be as set forth in the applicable Order Form. For self-serve subscriptions, fees are payable monthly in advance by card, and a Subscription commences or renews only upon successful payment for the applicable month. A failed self-serve renewal payment is subject to the seven-day recovery period in Section 4.3; it does not create a renewal debt, and unsuccessful recovery results in expiry and read-only lapse as specified there. Customer may cancel at any time, effective at the end of the current month of the Subscription Term, as set out in Section 4.3; there is no refund for a month that has started. For enterprise subscriptions, unless otherwise expressly specified in the applicable signed Order Form: (a) fees are due annually in advance for an annual Subscription Term or monthly in advance for a monthly Subscription Term, in each case no later than the start of the relevant service period, including each renewal; (b) Provider may issue invoices electronically, but issuing an invoice does not extend that due date or create a credit period; credit terms apply only if expressly stated, together with their due date, in the signed Order Form; and (c) amounts are non-cancellable and non-refundable except as expressly set forth in this Agreement or the applicable signed Order Form. All amounts shall be paid without setoff, counterclaim, or deduction. Fees are exclusive of applicable taxes, levies, duties, or similar governmental assessments, including value-added, sales, use, or withholding taxes, and Customer is responsible for all such taxes, excluding taxes based on Provider's net income. Overdue undisputed invoiced enterprise amounts may accrue interest at 1.5% per month or the maximum rate permitted by applicable law, whichever is lower. For nonpayment of an undisputed invoiced enterprise amount, Provider may suspend access to the Platform or terminate these Terms or an applicable Order Form only after giving Customer at least ten (10) days' prior written notice of nonpayment and only if the failure remains uncured after that period. This notice and cure rule applies only to invoiced enterprise amounts and governs notwithstanding Section 11.3 or Section 11.4; self-serve payment recovery, continued access during recovery and the absence of renewal debt are governed exclusively by Section 4.3.

4.2 Payment processing

Provider may use a third-party payment processor to process payments and manage billing. Customer acknowledges and agrees that payment processing services are provided by such third-party payment processor pursuant to its separate terms and privacy practices. Provider does not store Customer's full payment card details; payment card data is processed and stored by the applicable third-party payment processor, and Provider may retain limited billing-related information (such as transaction identifiers, the card brand and last four digits, and billing contact details) for invoicing, reconciliation, fraud prevention, and recordkeeping purposes.

4.3 Renewal and cancellation

A self-serve Subscription automatically renews monthly at the end of the then-current monthly Subscription Term, subject to successful advance card payment for the renewal month, unless Customer cancels under this Section or Provider gives notice of non-renewal under Section 11.2. If that renewal payment fails, Provider allows a recovery period of seven (7) days measured from the scheduled renewal date and time, during which Customer's normal plan access continues within its existing usage limits, subject to cancellation, non-renewal, account closure and the lawful termination and suspension provisions of these Terms. The access rights and Customer Data licence under Sections 3.1 and 6.3 continue to the extent necessary to provide that recovery-period access. A renewal payment that succeeds by the end of that recovery period renews the Subscription from the original scheduled renewal date, preserving its billing anniversary and any applicable price lock, and is not a restart. A failed payment attempt does not create a renewal debt; a successful recovery payment covers that original renewal month without an additional charge for the recovery period. If no renewal payment succeeds by the end of the recovery period, the Subscription is treated as having expired at the end of the last month paid for, recovery-period access ends, and the account becomes read-only under Section 8.5. Provider will then stop retrying that renewal payment and cancel any unpaid charge or invoice for it, so no renewal or recovery-period amount remains owed. A subsequent purchase after that recovery period starts a new paid Subscription period from successful payment and is not recovery of the expired renewal. Customer may stop recovery attempts and recovery-period access before payment succeeds by written notice under Section 17.3; no renewal or recovery-period amount is then owed, and the account becomes read-only unless Customer requests closure under Section 8.5. Transmission of that notice before payment succeeds controls, provided that no automated delivery failure notice is received. The renewal price is the applicable plan rate, subject to any price lock stated in the Order Form. Customer may cancel renewal at any time by written notice to Provider under Section 17.3, or through a cancellation control in the Platform if one is provided. For self-serve cancellation by email, transmission before the end of the current monthly Subscription Term determines the cancellation month, provided that no automated delivery failure notice is received; the next-business-day deemed-receipt rule in Section 17.3 does not delay cancellation. Cancellation takes effect at the end of the current month of the Subscription Term, and Customer will continue to have access to the Platform through that date, except for a request to stop recovery-period access under this Section or to close the account under Section 8.5. There is no refund for a month that has started. For enterprise subscriptions, unless otherwise specified in the applicable signed Order Form, the Subscription automatically renews for successive terms of the same length at Provider's then-current rates, subject to any agreed price lock, unless Customer gives written notice of cancellation before the end of the current Subscription Term or Provider gives notice of non-renewal under Section 11.2. Enterprise cancellation takes effect at the end of that term, and Customer will continue to have access through its end. Enterprise fees are non-refundable except as expressly set forth in this Agreement or the applicable signed Order Form.

5. Support and Maintenance

5.1 Support and maintenance

Provider will provide support to Customer's designated Authorized Users or technical contacts for their use of the Platform. Support requests may be sent to support@talebeacon.com. Provider may carry out maintenance, updates, upgrades, or other changes to the Platform, including scheduled or emergency work that may temporarily interrupt availability. Any additional support or maintenance terms for an enterprise customer must be expressly agreed in its signed Order Form. These Terms do not promise an uptime percentage or a fixed support response time.

6. Ownership and Intellectual Property

6.1 Provider rights

Provider and its licensors shall retain and reserve all rights, title, and interest, including, without limitation, all intellectual property rights, in and to: (i) the Platform and the Services; (ii) the Documentation, Platform Information, and Provider Marks; (iii) any and all Feedback; (iv) Aggregated Usage Data and System Data; (v) all statistical analyses, methodologies, models, know-how, workflows, formats, and techniques used to provide the Platform; and (vi) any and all derivative works, enhancements, improvements, or modifications to any of the foregoing. For the avoidance of doubt, nothing herein transfers to Customer any ownership in the Platform or Provider's underlying technology. Subject to the rights granted to Customer under Section 3.1, Customer may use reports and deliverables generated by the Platform for Customer's internal business purposes.

6.2 Customer rights

Customer and its licensors shall retain and reserve all right, title, and interest, including all intellectual property rights, in and to the Customer Data.

6.3 Customer Data licence

Customer hereby grants to Provider a non-exclusive, worldwide, royalty-free license during the Subscription Term (and for a limited period thereafter as reasonably necessary for backup retention, security, compliance, and dispute resolution) to use, host, copy, store, process, transmit, analyze, and otherwise handle Customer Data solely to the extent necessary to operate, provide, support, maintain, and secure the Platform and the Services for the benefit of Customer and its Authorized Users, and strictly in accordance with these Terms (including the DPA, if applicable).

For an account retained under Section 8.5 after the Subscription Term ends, Customer also grants Provider a non-exclusive, worldwide, royalty-free licence to host, store and process Customer Data only to the extent necessary to retain the account, make its existing materials available read-only to Customer and its Authorized Users, and keep it secure for as long as that account is retained in accordance with Section 8.5. This limited licence remains subject to these Terms, including their confidentiality and data-protection obligations and any applicable DPA, and does not authorize new scans or other paid Services. Account closure and subsequent retention or deletion remain governed by Section 8.5 and applicable law.

Section 6.5 separately governs the limited use of Eligible Company Metrics to prepare, create and use Shared Outputs and does not expand the Customer Data licence for internal operation or method improvement.

6.4 Feedback

To the extent Customer provides Feedback, Customer grants Provider a perpetual, irrevocable, worldwide, royalty-free license to use and incorporate such Feedback into the Platform and other Provider products and services without restriction or obligation.

6.5 Category benchmarks and research

(a) Eligible information and shared outputs. “Eligible Company Metrics” means company-level numeric scan scores, rates and counts; category, market, content-language and business-model classifications assigned by Provider from fixed lists; and scan periods, engines and scan configuration needed to compare results. Information is eligible only if it does not relate to an identified or identifiable individual. Eligible Company Metrics exclude raw engine answers, page text, customer-written descriptions, prompts, plan-card text and other narrative content. A data-category or ownership label elsewhere in these Terms does not make otherwise ineligible information eligible. “Shared Outputs” means statistics, comparisons, research or other aggregate results derived directly or indirectly from Customer's brand-specific scan inputs, scan results or other scan records and made available to other customers, published, sold or otherwise supplied to external recipients for their own use. Providing Customer's own results to Customer as part of the Services, or providing information to service providers acting only on Provider's instructions under paragraph (c), is not a Shared Output. Confidential disclosure of statistics to Provider's professional advisers, investors or prospective acquirers under written confidentiality obligations is not a Shared Output.

(b) Permission, covered brands and purposes. Subject to the brand-level exclusion described below, Customer grants Provider a non-exclusive, worldwide, royalty-free licence to use Eligible Company Metrics to prepare, create and use Shared Outputs for category comparisons, public research and marketing reports, and paid aggregate reports or data services. A brand is covered only if Customer adds it through its owner account after Customer expressly accepts a version of the Terms containing this Section, through the Platform's acceptance mechanism or a signed Order Form identifying that version. Application of revised Terms under Section 17.8 without that express acceptance does not constitute acceptance for this Section. Brands added before that acceptance, and brands created by Provider through its internal administration tools, are not brought into this programme merely by acceptance or renewal. Eligible covered brands are included unless Customer excludes them. The permission applies during agreed free evaluation access under Section 3.7(a), the Founding Program Free Period under Section 3.7(c), or an active Subscription, including onboarding within those forms of access and temporary recovery-period access under Section 4.3. Founding Program approval or activation does not by itself include a brand that does not meet the covered-brand requirements above. Only metrics generated for a covered brand after the acceptance described above fall within this permission. This Section does not make any planned feature available or promise a release date.

(c) Protection of results. Provider shall keep brand-level source metrics confidential and shall not disclose them to other customers or data-product recipients. Disclosure to service providers acting on Provider's instructions to operate this programme remains subject to the applicable confidentiality and security obligations. Shared Outputs must qualify as Aggregated Usage Data and must not identify or enable re-identification of a Customer, brand or individual. Provider shall maintain such results in that form and shall not attempt to re-identify them. Customer's own results may continue to be provided to Customer as part of the Services.

(d) Exclusion and reinstatement. Customer, through a person authorised to act for it using the account that owns the brand, may exclude or reinstate a covered brand in the Platform's settings for that brand. Exclusion does not affect the brand's own scans and reports or internal uses permitted under paragraph (f). A saved exclusion applies to every calculation to prepare or create Shared Outputs started after it is saved, including calculations using previously stored source metrics, without a separate email notice under Section 17.3. Such a calculation already started may finish, but any later calculation to prepare or create Shared Outputs must respect the exclusion. Customer may also request exclusion or reinstatement by emailing support@talebeacon.com, including while a brand is archived or its settings are inaccessible. For an exclusion requested by email, the exclusion applies to those calculations started after Provider receives the request identifying the brand, notwithstanding Section 17.3's deemed-receipt rule. Provider shall record and confirm the exclusion without undue delay and, if authority needs verification, shall withhold the brand from new calculations for Shared Outputs pending that verification. Email reinstatement takes effect only after authority is verified where necessary and the reinstatement is saved and confirmed. Reinstatement permits future calculations for Shared Outputs to use eligible metrics generated under this Section, including metrics generated while the brand was excluded, but does not make an otherwise uncovered brand eligible. Anonymous Shared Outputs already lawfully created under this Section, including results of calculations permitted to finish under this paragraph, may continue to be retained and used after exclusion; exclusion does not recall previously disclosed anonymous results.

(e) Archiving and end of programme source use. Archiving a brand does not exclude it from the programme or withdraw the permission in this Section. An archived covered brand may continue contributing, subject to the same eligibility, exclusion and access conditions as any other covered brand. Customer may exclude an archived brand through the support route in paragraph (d) without restoring it. New source-data use to prepare or create Shared Outputs stops when the brand is deleted, the account closes or access becomes solely read-only. Resumption of evaluation, Founding Program or paid access, or restoration of an archived brand, does not override an exclusion. Retention and deletion of source records remain governed by Section 8 and any applicable DPA; keeping a record does not itself authorise further programme use. Anonymous Shared Outputs already lawfully created under this Section may continue to be retained and used within this Section.

(f) Internal uses, boundaries and priority. Exclusion from this programme does not stop internal operation or method improvement already permitted under these Terms, including calibration, testing, quality checks and maintenance of reference information used to operate the Services, provided that those activities do not make Shared Outputs available. This preserves existing rights, including improvement from Aggregated Usage Data under Sections 2.1 and 9.4; it does not grant additional rights to use Customer Data or override confidentiality, retention limits, applicable personal-data law or an applicable DPA. Providing a service improved through such internal work does not, by itself, make the underlying internal information a Shared Output, provided that the service does not disclose or reproduce that information as a statistic, comparison, research result or other aggregate result for another customer or external recipient. Preparing, creating or using Shared Outputs must satisfy this Section regardless of the information's label or the name given to the activity. An internal result may not later be used as a Shared Output unless the contributions used to prepare or create that output satisfy this Section; internal processing is not a means of bypassing an exclusion or enrolling an uncovered brand. That assessment must be made when the result is first prepared for sharing, applying the eligibility and participation rules then in force. This Section does not authorise processing personal data to create programme aggregates, disclosure of individual brand results to other customers or data-product recipients, or training models on Customer Data. Separate permitted uses of lawfully available Third-Party Public Content under Section 9.4 remain, but do not permit circumvention of this Section's restrictions on Shared Outputs. For Shared Outputs and preparation of data for them, this Section governs over broader permissions in Sections 2.1, 3.2, 6.1 or 9.4 and supplements Section 6.3. This Section applies independently of whether a DPA has been agreed and does not reduce any confidentiality obligation, applicable personal-data law or protection under an applicable DPA. An enterprise variation remains subject to Section 3.6 and applicable law.

7. Warranty and Disclaimer

7.1 Express warranty and disclaimers

Provider represents and warrants that it shall use commercially reasonable efforts to provide the Platform in a secure, professional, and workmanlike manner, in accordance with generally accepted industry standards. Except for express warranties stated in these Terms or an applicable signed Order Form, the Platform and all related services are provided on an "as is" and "as available" basis, and Provider expressly disclaims all other warranties of any kind, whether express, implied, statutory, or otherwise, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. Provider does not warrant that the Platform will be error-free, uninterrupted, or that all defects or deficiencies will be corrected, nor does Provider make any warranty as to the results that may be obtained from use of the Platform. Customer acknowledges that the Platform (including any AI Engine Outputs) is not intended to provide legal, regulatory, or financial advice, and Customer is solely responsible for all decisions, actions, and compliance obligations arising from its use of the Platform.

8. Protection of Customer Data

8.1 Confidentiality and use

The Provider shall maintain the confidentiality of the Customer Data and shall use such data solely as expressly permitted under this Agreement (including as set forth in Section 9 (AI Engines)). Without limiting the foregoing, Customer acknowledges and agrees that, in order to provide certain features of the Platform, Provider may transmit Customer-provided inputs that may include Customer's name/brand identifiers and Customer-provided URLs and links to Third-Party AI Services for processing, analysis, summarization, comparison, and generation of outputs on Customer's behalf. Provider shall ensure that all individuals authorized by the Provider to access or process Customer Data are bound by written obligations of confidentiality.

8.2 Security measures

The Provider shall implement and maintain commercially reasonable technical and organizational measures designed to secure the Platform and protect Customer Data, as such measures may be updated from time to time to reflect evolving security practices and risk assessments. Where a DPA applies under Section 8.4, Provider shall also implement and maintain the measures described in that DPA. The first sentence of this Section applies whether or not a DPA applies.

8.3 Compliance and Customer instructions

The Provider shall comply with all Applicable Data Protection Laws in connection with the provision of the Platform and the processing of Customer Data. The Customer shall comply with all Applicable Data Protection Laws in connection with its use of the Platform and its instructions regarding the processing of Customer Data. Without limiting the foregoing, Customer represents and warrants that it has all rights and permissions necessary to provide to the Platform any URLs, links, domain names, instructions, and other inputs it submits for analysis, and that it will not submit to the Platform any personal data or sensitive information unless strictly necessary for its permitted use of the Platform.

8.4 DPA and linked Privacy Notice

Appendix A forms part of this version of the Terms and applies only to personal data that Provider processes on Customer's behalf within the activities described in the DPA. Customer's acceptance of this version includes Appendix A and its service-standard schedules; no separate DPA signature is required. Publication alone does not establish Customer's agreement. The DPA takes effect for Customer upon that agreement, or on the effective date of an Order Form expressly incorporating it, and governs covered processing from that date, including processing of covered data already held. It does not represent prior acceptance. For a new account entering the Services under these Terms, Provider shall obtain agreement before beginning covered processing, including website retrieval during onboarding.

For matters concerning Processed Personal Data as defined in the DPA, the DPA prevails over conflicting provisions of these Terms or an Order Form. This includes personal data in public material, generated outputs and operational records where processed on Customer's behalf: the category exclusions, retention exceptions, third-party limitations and independent-use permissions in Sections 8.5, 8.6, 9.3 and 9.4 do not reduce the applicable DPA protections. The remaining commercial provisions continue to apply subject to the DPA's liability provisions, mandatory law and any applicable transfer instrument.

The Privacy Notice linked in the Definitions describes Provider's information practices; it is not incorporated into these Terms and does not amend them or the DPA.

8.5 Data deletion

Provider retains stored scan records, including raw engine answers and derived results, for the life of the relevant brand within Customer's account, without a fixed age-based deletion period. Those records are subject to deletion when that brand is deleted or Customer's account is closed; deletion of one brand does not require closure of the account. Account-wide deletion presently requires individual handling rather than a single automated workflow, as Schedule 2 to the DPA discloses. This rule applies to stored scan records notwithstanding the data-category exclusions in this Section or Section 8.6. The forty-five (45) day Customer Data deadline and lawful-retention provisions continue within their stated scope; for Processed Personal Data, the DPA controls, including earlier lawful deletion requirements. Temporary source-page text and temporary processing copies may be removed earlier without ending retention of the scan record itself.

Upon the Customer's written instruction to delete Customer Data or closure of the Customer's account, the Provider shall permanently and irretrievably delete Customer Data within forty-five (45) days, except to the extent that retention of certain Customer Data is required by Applicable Law or is retained in routine backup or disaster recovery systems in accordance with Provider's backup retention policies (and deleted in the ordinary course).

Expiration, non-renewal or cancellation of a Subscription, including a self-serve Subscription ending after a failed renewal payment under Section 4.3, does not by itself close the Customer's account or trigger the forty-five (45) day deletion period. The lapsed account remains available read-only under Section 3.1 until closure under this Section, subject to the temporary continued-access recovery period in Section 4.3, lawful suspension or termination under Section 11 and applicable data-protection requirements. No fees accrue merely for retaining that read-only account. For an enterprise Subscription, nonpayment and any resulting suspension or termination remain subject to Sections 4.1 and 11; this paragraph does not cancel amounts otherwise owed.

A Customer's written request to close its account also terminates any active Subscription for that account; closure and that termination take effect upon Provider's receipt of the request unless it specifies a later date not beyond the end of the current paid Subscription Term. Such a closure request overrides continued-access provisions in Sections 4.3 and 11.2; no refund is due for a started self-serve month, and enterprise fees and any express refund rights remain governed by the applicable signed Order Form and these Terms. The account also closes when either party's termination of these Terms under Section 11 takes effect for that account, subject to the following sentence. A termination for convenience under Section 11.2 does not close the account while a Subscription continues under that Section; closure then takes effect when the last such Subscription ends. Termination of an individual Subscription or non-renewal alone is not account closure.

If a lapsed account has had no sign-in by any of its Authorized Users for twelve (12) consecutive months measured from the later of the date the account entered read-only lapse and its most recent sign-in by any Authorized User (using registration instead of the most recent sign-in for an account that has never had a sign-in), Provider may close it by giving Customer at least thirty (30) days' prior written notice under Section 17.3 specifying the closure date. Closure under that notice takes effect on the stated date if the account remains lapsed and no Authorized User has signed in before that date. That closure starts the forty-five (45) day deletion period in the first paragraph of this Section. The inactivity provision does not authorize keeping personal data longer than necessary under Applicable Data Protection Laws, or postpone an earlier deletion obligation arising from the Customer's written instruction or applicable law.

For the avoidance of doubt: (a) Third-Party Public Content is not Customer Data and is not subject to deletion, return, or access requests applicable to Customer Data; and (b) where Customer Data has been transmitted to Third-Party AI Services as part of providing the Platform, deletion and retention practices with respect to such data by the applicable Third-Party AI Services are governed by such third parties' terms and policies, and Provider will use commercially reasonable efforts to support deletion requests to the extent technically feasible and commercially reasonable.

8.6 Certification and export

Upon the Customer's written request, the Provider shall provide written certification of its compliance with the deletion requirements of this Section with respect to Customer Data under Provider's control. Customer may request an export of Customer Data prior to deletion, in a commercially reasonable format. Notwithstanding the foregoing, Aggregated Usage Data and System Data shall not be subject to deletion.

9. AI Engines

9.1 Use of AI engines

The Platform incorporates and relies on artificial intelligence technologies, including Third-Party AI Services, to generate analyses, summaries, comparisons, and other outputs in connection with the Services. Customer acknowledges and agrees that, in order to provide the Services, Provider may submit to Third-Party AI Services certain Customer-provided inputs (which may include Customer's name/brand identifiers and Customer-provided URLs and links) and receive outputs generated by such Third-Party AI Services.

9.2 Output limitations

Customer expressly acknowledges and agrees that any outputs, results, or content generated by or through AI engines ("AI Engine Outputs") are subject to inherent limitations, may contain inaccuracies, errors, or omissions, and are not warranted to be complete, accurate, reliable, or unique. Provider disclaims all representations and warranties, whether express, implied, statutory, or otherwise, with respect to any AI Engine Outputs, including without limitation any warranties of accuracy, completeness, merchantability, fitness for a particular purpose, or non-infringement. Customer is solely responsible for independently evaluating and verifying the suitability, accuracy, and legality of any AI Engine Outputs prior to their use or reliance, and assumes all risk associated therewith.

9.3 Third-party services

Provider does not control and shall have no responsibility for the performance, availability, security, or policies of Third-Party AI Services, and Third-Party AI Services may change, discontinue, or limit functionality at any time.

9.4 Permitted data uses

Provider may use Customer Data (including prompts, URLs, and AI engine inputs and outputs processed through the Platform to the extent they are Customer Data) to operate, maintain, and support the Platform and the Services. Provider may use Aggregated Usage Data to improve and develop the Platform and the Services. Provider may use Third-Party Public Content (including prompts, URLs, and AI engine inputs and outputs processed through the Platform to the extent they are Third-Party Public Content) to operate, maintain, support, improve, and develop the Platform and the Services, including for training, tuning, and improving Provider's models, algorithms, and AI engine capabilities. Customer further acknowledges that, where the Platform utilizes Third-Party AI Services, Customer-provided inputs may be processed by such Third-Party AI Services and may be used by such third parties in accordance with their applicable terms and policies. Where commercially reasonable, Provider will use reasonable measures intended to minimize the inclusion of unnecessary identifiers in data used for Provider's internal training and improvement purposes.

The permission to improve or train with Third-Party Public Content does not authorise use of identifiable people appearing incidentally in public AI-engine answers for model training or unrelated purposes without a separate lawful basis and applicable notice.

Shared Outputs and preparation of data for them are subject to Section 6.5. Internal operation and method improvement remain subject to the existing permissions and restrictions in these Terms, as explained in Section 6.5(f). Describing information as an AI Engine Output, Platform Information or Third-Party Public Content, or giving the activity another name, does not override those limits, applicable law or an applicable DPA.

10. Compliance Documentation

10.1 Compliance documentation

Upon Customer's written request, Provider shall use commercially reasonable efforts to provide Customer with documentation or information reasonably necessary to assist Customer in complying with applicable laws and regulations related to AI engines and/or data protection. Provider expressly disclaims any representation or warranty that such documentation or information is comprehensive, complete, accurate, or free from errors. Any such documentation or information provided by Provider is confidential business information subject to Section 16.1 and is provided for informational purposes only and not as legal advice.

11. Term and Termination

11.1 Term

These Terms shall commence on the Effective Date and shall remain in full force and effect until terminated in accordance with the terms and conditions set forth herein.

11.2 Termination for convenience

Either Party may terminate these Terms for any reason or no reason upon thirty (30) days' prior written notice to the other Party. Such termination does not by itself terminate an active Subscription or Order Form; these Terms continue to govern each such Subscription or Order Form until its expiration or earlier termination under its terms. Provider may decline renewal of a Subscription by written notice identifying that Subscription and its effective non-renewal date, received by Customer under Section 17.3 at least thirty (30) days before the end of the applicable Subscription Term. If fewer than thirty (30) days remain in the then-current Subscription Term when that notice is received, Provider's non-renewal takes effect at the first later Subscription Term end occurring at least thirty (30) days after receipt. A notice from Provider terminating these Terms shall identify the Subscriptions whose renewal Provider is declining and comply with the preceding non-renewal requirements for each of them; termination of these Terms alone does not cancel renewal. For self-serve subscriptions, cancellation by Customer under Section 4.3 does not require thirty (30) days' notice, and a notice by Customer terminating these Terms also cancels renewal of the self-serve Subscription at the end of its current month under Section 4.3. Non-renewal and termination for convenience do not shorten service through the applicable paid Subscription Term, subject to the existing payment, termination-for-cause and suspension provisions. Termination of these Terms does not relieve Customer of fees owed under an active Order Form, and fees paid remain non-refundable except as expressly stated in these Terms or the applicable Order Form.

11.3 Termination for cause

In addition, either Party may terminate these Terms or any applicable Order Form, or suspend its performance hereunder, effective immediately upon written notice and without further liability, in the event the other Party materially breaches these Terms or any applicable Order Form and fails to cure such breach within thirty (30) days after receipt of written notice specifying the nature of the breach in reasonable detail. Notwithstanding the foregoing, Provider may terminate these Terms and/or any applicable Order Form, or suspend access to the Platform, effective immediately upon written notice, if Customer: (a) breaches Section 3 (License) or Section 16.1 (Business Information) or otherwise misuses the Platform in a manner that may compromise the security or integrity of the Platform; or (b) breaches its confidentiality or intellectual property obligations and such breach is not capable of cure. Nonpayment of an undisputed invoiced enterprise amount is governed exclusively by the ten (10) days' written notice and cure rule in Section 4.1, including for termination and suspension. A failed self-serve renewal payment instead follows the recovery and, if unsuccessful, non-renewal rules in Section 4.3 and does not, by itself, constitute a breach or close the account.

11.4 Suspension and restoration

Without limiting any other rights or remedies available under applicable law or these Terms, Provider shall be excused from performance of its obligations under these Terms or any applicable Order Form, to the extent such performance is prevented or delayed as a result of Customer's failure to perform its responsibilities, provide required information, or otherwise fulfill its obligations under these Terms. In addition, Provider may suspend Customer's and/or any User's access to the Platform, in whole or in part, upon written notice (or, if necessary due to the circumstances, without prior notice) if: (a) Provider reasonably believes that Customer's or any User's use of the Platform poses a security risk to the Platform or any third party, may adversely impact the Platform, or may subject Provider to liability; (b) required by applicable law or a governmental authority; or (c) Customer is in material breach of this Agreement. Provider will use commercially reasonable efforts to narrow the scope and duration of any suspension and restore access promptly following resolution of the underlying issue. Where the asserted breach is nonpayment of an undisputed invoiced enterprise amount, the notice and cure rule in Section 4.1 applies; this Section does not permit an earlier suspension for that nonpayment. A failed self-serve renewal payment is governed by Section 4.3, rather than the enterprise notice and cure rule; normal plan access continues during its recovery period and, if recovery is unsuccessful, the account becomes read-only under Section 8.5 rather than being suspended for nonpayment.

12. Survival

12.1 Surviving obligations

Notwithstanding anything to the contrary herein, any obligations, rights, or provisions of these Terms which by their express terms or by their nature are intended to survive the termination or expiration of these Terms, including but not limited to those relating to confidentiality, ownership and intellectual property, indemnification, limitation of liability, and dispute resolution, shall survive such termination or expiration and shall remain in full force and effect. The continuing report-use licence in Section 3.1 and its applicable use, sharing and confidentiality restrictions survive expiration or termination of the Subscription and these Terms.

13. Indemnification

13.1 Provider intellectual-property indemnification

Subject to Sections 13.3, 13.4 and 14, Provider shall defend Customer against a claim brought by a third party alleging that Provider Technology, when used by Customer as authorised under these Terms, infringes or misappropriates that third party's intellectual property rights, and shall indemnify Customer for damages and costs finally awarded against Customer or payable under a settlement approved by Provider in writing. For this Section, "Provider Technology" means software and other technology developed by or on behalf of Provider and supplied as part of the Platform, excluding Customer Data, Third-Party Public Content and Third-Party AI Services and their outputs. Provider's obligations include the reasonable costs of the defence it controls under Section 13.4, within the aggregate limit in Section 14.4. This Section does not create an indemnity for every breach of these Terms; a direct claim between the parties for breach remains governed by the applicable substantive obligations and limitations of this Agreement.

13.2 Customer indemnification

In addition, Customer shall indemnify, defend, and hold harmless Provider from and against any and all claims arising out of or relating to: (a) Customer Data; (b) Customer's selection, submission, or use of URLs, links, domains, or other sources for analysis, including any allegation that such access, retrieval, analysis, or processing violates applicable law or third-party rights; (c) Customer's or any User's use of the Platform or any AI Engine Outputs in violation of this Agreement or applicable law; or (d) Customer's use of the Platform in combination with any software, data, content, or services not provided by Provider.

13.3 Provider exclusions

Provider has no indemnification obligation under Section 13.1 to the extent the infringement or misappropriation claim is caused by: (a) Customer Data; (b) Third-Party Public Content; (c) Third-Party AI Services or their outputs; (d) Customer's or any User's use of the Platform in violation of this Agreement or applicable law; (e) a combination with software, data, content or services not provided by Provider, where the claim would not arise without that combination; or (f) a modification not made by or on behalf of Provider. The mere presence of third-party services or materials in the Platform does not exclude a claim of infringement by Provider Technology that is not caused by those services or materials.

13.4 Claims procedure

For purposes of this Section 13, the "Indemnifying Party" is the party owing the applicable indemnity, and the "Indemnified Party" is the party entitled to that indemnity. The Indemnified Party shall provide the Indemnifying Party with prompt written notice of any claim and shall grant the Indemnifying Party sole control over the defense and settlement of such claim; provided that the Indemnifying Party shall not enter into any settlement that admits liability on behalf of, or otherwise adversely affects the rights of, the Indemnified Party without the Indemnified Party's prior written consent. The Indemnified Party shall provide reasonable cooperation at the Indemnifying Party's request and expense.

14. Limitation of Liability

14.1 Disclaimer

Except for express warranties stated in these Terms or an applicable signed Order Form, and to the fullest extent permitted by applicable law, Provider expressly disclaims all other warranties, whether express, implied, statutory, or otherwise, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, non-infringement of third-party rights, and any warranties as to the accuracy, completeness, correctness, or reliability of the Services.

14.2 Customer responsibility

Under no circumstances shall Provider be liable or responsible for any acts, omissions, or practices of Customer or for any acts, omissions, or practices relating to Customer's assets, systems, or Customer Data. Without limiting the foregoing, Provider shall have no liability arising from or relating to Third-Party Public Content or Third-Party AI Services (including their outputs, performance, availability, security, or policies). Nothing in this Section or Section 9.3 excludes liability for Provider's breach of its own express obligations under this Agreement, including its obligations under Sections 8 and 13; that liability remains subject to the other applicable limitations in this Agreement.

14.3 Excluded damages

To the maximum extent permitted by applicable law, in no event shall Provider be liable for any special, incidental, consequential, exemplary, punitive, or indirect damages of any kind (including, without limitation, loss of profits, loss of business, loss of data, or business interruption), arising out of or in connection with the provision of the Services or these Terms, whether based on contract, tort (including negligence), strict liability, or any other legal or equitable theory, even if Provider has been advised of the possibility of such damages.

14.4 Liability cap

(a) Scope and calculation date. To the extent permitted by applicable law, and subject to any express override in a signed enterprise Order Form under Section 3.6, Provider's liability arising out of or relating to these Terms, regardless of legal theory, is subject to the limits below. Calculate the limit for an event when that event occurs, irrespective of when a claim is asserted. All claims arising from the same event share that event's limit; a separate later breach is not treated as an earlier event merely because it concerns the same Customer or obligation.

(b) Paid-service measure. The paid-service limit is the service fees paid or payable by Customer under these Terms attributable to the current commenced service month and up to two immediately preceding service months in the relevant uninterrupted paid-service period. Service months follow the applicable Subscription's commencement anniversary, not calendar months. The first paid-service month therefore includes one month's fees, the second two, and subsequent months three. Include the full agreed recurring fee for the commenced month, without daily reduction merely because that month has not finished; where an Order Form expressly provides for usage charges, include those charges only as incurred by the calculation date. Allocate annual and other advance fees over the service months they cover, irrespective of payment date. Use, for each service month counted, the fees contractually agreed for that month as of the calculation date, after contractual discounts, and exclude separately charged taxes and genuine third-party expense reimbursements. Allocate a contractual mid-month rate change to the service days it covers. Where expressly agreed in an Order Form, include service add-ons and one-time service work in the period to which that work relates, without counting the same fee more than once. Calculate concurrent Subscriptions separately on their respective service-month schedules and combine the resulting fees into one Customer measure.

(c) Continuity and ending service. For this Section, paid service ends when the relevant Subscription expires without renewal or is earlier terminated under these Terms, including, for a failed self-serve renewal payment not recovered within the seven-day period in Section 4.3, at the end of the last month paid for; a payment recovered within that period is a renewal from the original scheduled renewal date under Section 4.3, not a restart. Read-only retention of a lapsed account under Section 8.5 is not paid service and does not extend it. An uninterrupted renewal does not restart the calculation or replenish a limit. A genuine end and subsequent restart of paid service begins a new commenced-month calculation period but does not create an additional aggregate allowance. Suspension while fees remain payable is not a restart. For a new event after the relevant service has ended, arising from an obligation that survives its end, use the limit applicable immediately before that service ended. This paragraph does not create a new surviving obligation or alter a claim deadline. Ending service does not reduce the limit for an earlier event.

(d) Expressly free evaluation. Provider's aggregate liability for all losses arising solely from events during expressly agreed, genuinely free trial or evaluation access shall not exceed US$50 per Customer. An unpaid invoice for paid service, or a paid customer's use of a beta feature, does not make that service free. Later conversion to paid service does not change the treatment of solely free-period losses. For a single event causing loss across free and paid service, calculate the paid-service measure when loss first arises during paid service; the solely free-period losses remain within the US$50 sublimit. Separate later breaches retain their own dates under paragraph (a).

(e) Shared aggregate. Each event remains subject to its own limit. Provider's total capped liability across all events under these Terms shall not exceed the highest applicable individual event limit; the limits are not added together. The US$50 free-evaluation sublimit forms part of that total and is not an additional allowance. All damages, indemnity payments, approved settlements and reasonable defence costs paid or incurred by Provider under Section 13.1 count toward the applicable event limit and that shared aggregate and are not a separate allowance. Provider's payment and defence obligations under Section 13.1 are subject to, and do not require expenditure beyond, those applicable limits. Prior capped amounts continue to consume the aggregate; there is no separate or replenished allowance per claim, User, legal theory, Order Form, renewal, restart or termination. A lower limit for a later event does not retroactively reduce an earlier event's limit or require repayment of an earlier payment. No double recovery is permitted.

14.5 Time limit for claims

No action, suit, or proceeding arising out of or relating to these Terms may be brought against Provider more than one (1) year after the termination or expiration of these Terms.

15. Governing Law, Jurisdiction and Informal Negotiations

15.1 Governing law and dispute procedure

These Terms shall be governed by, and construed in accordance with, the laws of the State of Israel, without giving effect to any principles of conflicts of law that would require the application of the laws of any other jurisdiction. The parties hereby irrevocably agree that any claim, controversy, or dispute arising out of or relating to these Terms or the Platform, whether in whole or in part, shall be submitted exclusively to the competent courts located in Tel Aviv, Israel, and each party hereby irrevocably submits to the exclusive jurisdiction of such courts. Notwithstanding the foregoing, prior to the initiation of any legal proceedings, the party asserting a claim ("Claimant") shall deliver to the other party a written Notice of Dispute, which shall include the name and contact information of the Claimant, a detailed description of the facts giving rise to the dispute, and the specific relief sought. The parties shall engage in good faith efforts to resolve the dispute through informal negotiations for a period of thirty (30) days following the date on which the Notice of Dispute is delivered. If the parties are unable to resolve the dispute within such thirty (30) day period, the Claimant may initiate legal proceedings. Notwithstanding the foregoing, either party may seek immediate injunctive or other equitable relief in any court of competent jurisdiction to prevent or curtail any actual or threatened breach of its confidentiality or intellectual property rights, without first complying with the Notice of Dispute or informal negotiation requirements above.

16. Confidentiality of Business Relationship

16.1 Business information

Each party may retain information pertaining to the other party as reasonably necessary for its legitimate business purposes, including, but not limited to, legal, support, technical, security, commercial, and financial communications and records (including for billing, collections, enforcement, and audit purposes), and for the period required to satisfy legal, regulatory, or internal compliance requirements. All such retained information shall be maintained in strict confidence, utilizing confidentiality measures that are at least as protective as those employed by the retaining party for its own confidential information of a similar nature. Such information may be used solely for the purpose of fulfilling the retaining party's obligations or exercising its rights under these Terms, and for no other purpose. This Section concerns business communications and records and does not itself authorize continued hosting of a lapsed Customer account or workspace; that hosting and its limits are governed by Sections 6.3 and 8.5.

16.2 Publicity

Customer may disclose the existence of the business relationship established pursuant to these Terms, including by publishing such information on its website or in other marketing materials; provided, however, that Customer shall not disclose any specific terms, conditions, or payment details of these Terms. Provider may identify Customer as a customer of Provider (including by displaying Customer's name and logo) on Provider's website and in Provider's marketing and promotional materials, subject to Customer's trademark usage guidelines provided to Provider in writing. Customer may revoke such permission at any time upon written notice, in which case Provider will remove such use within a commercially reasonable period. Except as expressly permitted in this Section 16.2, neither party will issue any press release or public announcement that names the other party without the other party's prior written consent.

17. General

17.1 Force majeure

Neither Party shall be liable to the other for any failure or delay in the performance of its obligations under these Terms to the extent such failure or delay is caused by or results from a Force Majeure Event, defined as any event or circumstance beyond the reasonable control of the affected Party, including, without limitation, acts of God, natural disasters, war, acts of terrorism, civil unrest, pandemics, epidemics, widespread and material power outages, or any action or order of any governmental authority that restricts or prohibits operations. The Party claiming the benefit of a Force Majeure Event shall provide prompt written notice to the other Party, specifying the nature and anticipated duration of the Force Majeure Event. If the Force Majeure Event continues for a period of more than thirty (30) consecutive days, either Party may terminate these Terms immediately upon written notice to the other Party, effective as of the date specified in such notice. For the avoidance of doubt, Customer's payment obligations shall not be excused or suspended due to a Force Majeure Event affecting Customer.

17.2 Waiver

No waiver of any right, power, or remedy arising under or in connection with these Terms shall be valid or effective unless it is expressly set forth in a written instrument duly executed by the party against whom the waiver is to be enforced. Any failure or delay by either party in exercising any right, power, or remedy under these Terms shall not constitute a waiver thereof, nor shall any single or partial exercise of any right, power, or remedy preclude any other or further exercise thereof or the exercise of any other right, power, or remedy.

17.3 Notices

All notices, requests, consents, claims, demands, waivers, and other communications required or permitted under this Agreement shall be in writing and sent by email with confirmation of transmission. Provider's designated email address for contractual notices and cancellations is support@talebeacon.com. For self-serve Customers, Customer's notice email address is the email address used to register its account, as updated by written notice under this Section. For an enterprise Customer, notices shall be sent to its notice email address specified in the signed Order Form or, if none is specified, its account-registration email address. Either party may designate a different notice email address by written notice to the other party in accordance with this Section. Notices sent by email shall be deemed received on the first business day following transmission, provided that no automated delivery failure notice is received by the sending party. The self-serve cancellation timing rule in Section 4.3 applies notwithstanding that deemed-receipt rule. For enterprise Customers only, a signed Order Form may expressly specify a postal notice address and alternative delivery methods and receipt rules; hand delivery, courier and registered-mail methods do not apply to self-serve Customers.

17.4 Assignment

Neither party may assign or otherwise transfer any of its rights or obligations under these Terms, in whole or in part, without the prior written consent of the other party, which consent shall not be unreasonably withheld, conditioned, or delayed. Notwithstanding the foregoing, either party may assign these Terms, without the consent of the other party, to (a) any of its affiliates, or (b) any successor entity in connection with a merger, consolidation, reorganization, or the sale of all or substantially all of the assigning party's assets, provided that the assignee agrees in writing to be bound by all terms and conditions of these Terms. Any attempted assignment in violation of this Section shall be null and void.

17.5 Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court or other authority of competent jurisdiction, such provision shall be deemed modified to the minimum extent necessary to render it valid, legal, and enforceable, or, if such modification is not possible, shall be replaced with a valid, legal, and enforceable provision that most closely reflects the original intent of the Parties. The validity, legality, and enforceability of the remaining provisions of these Terms shall not in any way be affected or impaired thereby, and such provisions shall remain in full force and effect.

17.6 Entire agreement

The parties acknowledge that they have had the opportunity to consult with their respective legal counsel regarding these Terms, and hereby agree to be legally bound by them. These Terms, together with any applicable Order Form(s) and any applicable DPA under Section 8.4 and attachments expressly included in an enterprise Order Form signed by both parties, constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all prior and contemporaneous agreements, understandings, negotiations, representations, and communications, whether oral or written, relating to such subject matter, except as expressly set forth herein. The linked Privacy Notice is not incorporated into this Agreement.

17.7 Electronic signatures and counterparts

These Terms and any Order Form may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Signatures transmitted electronically (including by PDF, scanned copy, e-signature platform, or other electronic means) shall be deemed original signatures and shall be binding on the parties.

17.8 Amendments

Provider may publish a revised version of these Terms. A revised version applies to a self-serve Customer from the earlier of its acceptance in the Platform and the first renewal falling at least thirty (30) days after Provider gives notice of the revised version under Section 17.3. For an enterprise Customer, amendments are governed by its signed Order Form.

Appendix A — Data Processing Addendum

Version 10.3 · Effective with Terms version 6.4

1. Parties, application and scope

1.1 Parties

This Data Processing Addendum (the “DPA”) is between Talebeacon Ltd. (“Provider”) and the Customer identified in the Order Form or other acceptance record that expressly incorporates this DPA into their Terms of Service (the “Terms”).

1.2 When this DPA applies

This DPA applies only to the processing activities identified in Schedule 1 for which Provider processes personal data on Customer's behalf in providing the contracted Services.

The parties' roles follow their actual activities and applicable law, and are not determined solely by a contractual label.

This DPA and its service-standard schedules form part of the version of the Terms that Customer accepts and that incorporates this DPA; no separate signature or individually negotiated schedule is required for the standard service.

This DPA takes effect for Customer upon that agreement, or on the effective date of an Order Form expressly incorporating it. Publication alone does not establish Customer's agreement. From its effective date, this DPA governs covered processing of Processed Personal Data then held and subsequently received; it does not represent that Customer previously agreed to it.

Customer is the legal person for whom the accepting account holder acts, as identified in an applicable Order Form or other agreed customer record. The individual accepting on Customer's behalf represents that they have authority to bind Customer. Where Customer acts for another controller, Section 1.4 applies. Provider will record any customer-specific variation agreed by the parties.

Provider shall make these schedules available when Customer agrees. For a new account entering the Services under these Terms, Provider shall obtain Customer's agreement before beginning covered processing, including website retrieval during onboarding.

1.3 Defined processing

“Processed Personal Data” means personal data processed by Provider on Customer's behalf in the activities covered by Schedule 1, including personal data in inputs, retrieved material, outputs, copies and operational records to the extent those records form part of that processing.

The collection and analysis of publicly available AI-engine answers, including incidental names of public professionals appearing only in those answers and answer-derived brand findings, is a separate activity for which Provider determines the purpose and essential means and acts as controller. Such incidental answer content is not Processed Personal Data solely because Customer initiated a brand scan or can view the result. Customer-supplied personal data, personal data retrieved from Customer-selected sites on Customer's behalf, and their copies or derivatives remain Processed Personal Data where Provider handles them on Customer's behalf, including when they appear in a mixed scan record or output. The source and purpose of each item, not its label as an “answer,” determine the applicable duties.

An exclusion from “Customer Data” in the Terms does not, by itself, exclude information from Processed Personal Data.

Ordinary corporate information, wholly fictional personas and genuinely anonymous information are outside this definition insofar as they do not relate to an identifiable individual; information is not personal data merely because it was derived from material containing personal data.

“Subprocessor” means another entity engaged by Provider to process Processed Personal Data on Customer's behalf for those activities.

“Personal Data Breach” means a security breach resulting in accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to, Processed Personal Data.

Other capitalised terms have the meanings given in the Terms, interpreted consistently with the applicable data protection law.

1.4 Customer acting for another controller

Where Customer itself acts as a processor, Customer must have the relevant controller's authority to appoint Provider and give the instructions contemplated by this DPA.

In that case Provider acts as a further processor, and Customer is responsible for passing on the controller's lawful instructions and the assistance and information provided under this DPA.

This provision does not reduce Provider's obligations for the processing it undertakes.

1.5 Separate activities

Provider separately controls its collection, analysis, storage and handling of public AI-engine answers insofar as they contain incidental information about identifiable people. Provider describes that activity, its legal basis, recipients and rights channel in its Privacy Notice. This allocation does not permit Provider to reclassify customer-supplied or customer-directed personal data as independent public-answer content, or to use identifiable public-answer names for model training or unrelated reuse without a separate lawful basis and notice.

Provider may not reclassify Processed Personal Data as independently controlled data merely to continue using it outside Customer's instructions.

This DPA does not grant permission to train models on Customer Data.

Provider shall not use Processed Personal Data, including personal data in public source material and generated outputs, for its own training, improvement or other independent purposes under a general data-use permission in the Terms.

The Terms' permitted use of genuinely anonymised Aggregated Usage Data remains, subject to applicable law; any operation on personal data to produce such anonymous data requires its own appropriate instruction or legal basis and role assessment.

2. Relationship with the Terms

2.1 Priority for processing obligations

If this DPA conflicts with the Terms or an Order Form concerning the processing of Processed Personal Data, this DPA controls that issue.

The remaining commercial provisions of the Terms and the applicable Order Form continue to apply, subject to Section 12 and rights that cannot lawfully be excluded.

An applicable mandatory transfer instrument controls over both documents to the extent required by that instrument.

2.2 No incorporation of the privacy notice

The Privacy Notice remains a separate transparency notice and is not incorporated into this DPA or used to amend its obligations.

3. Instructions and Customer responsibilities

3.1 Documented instructions

Provider shall process Processed Personal Data only on Customer's documented instructions, including instructions concerning access from or transfers to other countries.

The agreed instructions comprise this DPA, its schedules, the contracted service scope and subsequent written instructions issued by Customer's authorised contacts.

Ordinary use of an agreed service feature may constitute an instruction within that documented scope, but does not authorise undisclosed new purposes or recipients.

3.2 Further instructions

Provider shall maintain a record of material instructions and any agreed changes to them.

If an instruction requires work beyond the contracted service, the parties shall discuss the practical requirements and any reasonable additional charges before that work begins, without delaying an obligation already owed under this DPA or applicable law.

No additional charge applies to the Customer Data export already required by the Terms.

3.3 Instructions that may be unlawful

Provider shall immediately inform Customer if, in Provider's opinion, an instruction infringes applicable data protection law and shall not implement the disputed instruction while the parties resolve its lawfulness.

Any suspension must be limited to the affected processing where reasonably possible and must not remove the protections applicable to retained data.

3.4 Processing required by law

Where Union or Member State law applicable to Provider requires processing beyond Customer's instructions, Provider shall inform Customer of that requirement before processing unless that law prohibits disclosure on important public-interest grounds.

Provider shall notify Customer, to the extent legally permitted, of any other binding legal demand affecting Processed Personal Data and assess whether it can comply consistently with this DPA and any applicable transfer instrument.

A demand under another country's law does not by itself expand the contractual permissions in this DPA or replace any applicable transfer requirements.

3.5 Customer responsibilities

Customer is responsible for the lawfulness of its instructions and for the information, rights and permissions it must provide or obtain for the processing it directs.

Customer shall identify its authorised instruction and incident contacts and keep their details current.

The standard service is business and brand analysis. Customer shall not use it to compile dossiers about individuals, assess individuals for employment, credit or similarly consequential decisions, or submit personal-data databases for analysis, unless separately agreed within a supported service scope.

Customer shall not intentionally submit special-category data, criminal-offence data or children's personal data unless the parties first agree the specific processing and safeguards in Schedule 1 and Schedule 2.

Incidental presence of such information does not remove it from this DPA or permit Provider to ignore the applicable protections.

4. Personnel and confidentiality

4.1 Authorised access

Provider shall restrict access to Processed Personal Data to persons who need that access for the agreed processing, support, security or lawful assistance.

Provider shall ensure those persons are subject to enforceable confidentiality duties and receive instructions appropriate to their access and responsibilities.

Provider shall maintain an access authorisation and removal process, including for operator tools that can receive or access Processed Personal Data.

5. Security

5.1 Required measures

Provider shall implement and maintain the technical and organisational measures specified in Schedule 2, appropriate to the nature, scope, context, purposes and risks of the processing.

Those measures supplement, and do not replace, Provider's independent security undertaking in the Terms.

5.2 Changes to measures

Provider may update the implementation of its security measures provided the change does not materially reduce the overall protection of the covered processing or breach an agreed essential instruction.

Provider shall keep the description in Schedule 2 accurate and provide Customer with material information reasonably needed to assess the continued protection of Processed Personal Data.

5.3 Verification and remediation

Provider shall assess the effectiveness of the relevant measures and address material deficiencies affecting its compliance with this DPA.

No certification, independent audit, particular encryption implementation or complete tenant isolation is represented by this DPA unless expressly identified in the completed Schedule 2 with its applicable scope.

6. Subprocessors

6.1 Initial authorisation

For Processed Personal Data, Customer grants general written authorisation for the Subprocessors identified in the agreed Schedule 3, for the activities and data described there. The public-answer activity described in Section 1.5 is outside this customer Subprocessor authorisation.

An unidentified recipient is not authorised solely because a service category appears in a privacy notice or because an engine is named in a product description.

6.2 Changes and objections

Provider shall give Customer at least thirty days' written notice before a new or replacement Subprocessor begins processing Processed Personal Data, including its identity, function, relevant countries and the information reasonably needed to assess the change.

Customer may object during that period on reasonable grounds relating to the protection of Processed Personal Data.

The parties shall seek to resolve the objection within thirty days after Provider receives it, for example through additional safeguards or a reasonably available alternative.

Provider shall not send the affected Processed Personal Data to the proposed Subprocessor while a reasonable data-protection objection remains unresolved and may suspend only the affected processing where necessary.

If no lawful solution addressing the objection is agreed within that period, either party may end the affected service by written notice. Where it cannot reasonably be separated, that right extends to the affected Subscription.

Protection, return and deletion duties continue for retained data. Suspension or termination under this section preserves existing remedies and any applicable Order Form rights, but does not create a separate refund formula or permit charges beyond those lawfully due under the Terms.

6.3 Contract and responsibility

Before a Subprocessor receives Processed Personal Data, Provider shall bind it to written obligations that provide the protection required for its delegated activities under this DPA and applicable data protection law.

Provider remains responsible to Customer for the performance of the data protection obligations it delegates to its Subprocessors.

Provider shall maintain the identity and delegated-processing information for the relevant Subprocessor chain and provide Customer with information reasonably needed to verify those arrangements, subject to appropriate confidentiality protections.

6.4 Other recipients

A recipient acting for its own purposes must be assessed and disclosed separately, with the necessary instruction or other lawful basis and transfer arrangements for the disclosure.

Provider may not avoid its Subprocessor obligations by describing a processor as an independent third-party service.

7. International processing and transfers

7.1 Locations and arrangements

For Processed Personal Data, Provider shall use the recipients and routes identified in the agreed Schedule 3, as changed consistently with this DPA. The countries listed there describe only locations actually established; an unverified country is not a representation that processing is confined to any other country. Provider shall supply available location and transfer information on Customer's reasonable request and shall not activate a route identified as off in Schedule 3 until its applicable recipient, contract and transfer arrangements have been assessed.

Before a restricted international transfer occurs, the parties shall put in place and document the applicable transfer mechanism and any required supporting assessment or safeguards.

An EU data-centre location, an adequacy decision covering a particular destination, or a vendor's public terms does not by itself establish the arrangement for every recipient or onward transfer.

7.2 Transfer documentation

Where standard contractual clauses or another transfer instrument are required, the parties shall identify and complete the applicable instrument, parties, roles, modules, annexes and relevant choices before relying on it.

This DPA is not itself a set of European Commission standard contractual clauses and does not establish that any particular transfer instrument is in force.

Provider shall notify Customer if it can no longer comply with an applicable transfer arrangement and shall suspend the affected transfer while an appropriate lawful solution is established.

8. Assistance with privacy obligations

8.1 Individual requests

Provider shall promptly pass to Customer any request it receives from an individual concerning Processed Personal Data, unless applicable law requires Provider to deal with the request itself.

Provider shall assist Customer, through appropriate technical and organisational measures and taking account of the nature of the processing, in responding to requests to exercise applicable privacy rights.

Provider shall not respond on Customer's behalf beyond acknowledging or routing the request without Customer's instruction, unless required by applicable law.

The assistance must cover relevant Processed Personal Data in mixed records and outputs rather than excluding it solely by a Terms data-category label.

8.2 Security, impact assessment and consultation

Taking account of the nature of the processing and the information available to it, Provider shall assist Customer with applicable security, personal-data-breach notification, data protection impact assessment and prior-consultation obligations.

Customer remains responsible for decisions and notifications allocated to it by law; Provider retains its own direct legal and contractual duties.

8.3 Timing and charges

Provider shall provide assistance in time to enable Customer to meet its applicable deadlines, based on timely communication of the relevant request and deadline and without diminishing Provider's own duties.

The parties may agree reasonable charges for exceptional assistance beyond the ordinary contracted service, but charges shall not obstruct a mandatory right, delay a required response or cover remediation of Provider's own breach of this DPA.

9. Personal Data Breaches

9.1 Notice

Provider shall notify Customer's designated incident contact without undue delay after becoming aware of a Personal Data Breach affecting Processed Personal Data, including at a Subprocessor.

Provider shall not delay the initial notice until its investigation is complete or until every detail is available.

9.2 Content and follow-up

The notice shall describe the nature of the breach, affected data and individuals where known, likely consequences, measures taken or proposed, and a contact for further information.

Provider shall provide material information in stages as it becomes available and keep Customer informed of material developments.

Provider shall investigate, take appropriate containment and remediation measures, preserve relevant evidence and document the breach and its response.

9.3 External communications

Provider shall reasonably coordinate with Customer on notifications concerning the affected processing and shall not purport to speak on Customer's behalf without authority, except where applicable law requires otherwise.

A breach notification is not, by itself, an admission of fault or liability.

10. End of processing, return and deletion

10.1 Customer Data deadline

Under Terms Sections 8.5 and 8.6, the forty-five-day Customer Data deletion period starts on Customer's written deletion instruction or account closure, with certification on request and an opportunity to request export before deletion without an export fee.

Expiration, non-renewal or cancellation of the paid Subscription alone does not close the account or start that contractual period.

For Processed Personal Data, Sections 10.2 and 10.3 qualify the Terms' retention exceptions and data-category exclusions and apply to all covered copies; neither those exceptions nor this DPA extend an earlier requirement of applicable law.

10.2 Customer's disposition instruction and continuing hosting

Customer may choose return or deletion when the services relating to the covered processing end and may change its choice before the relevant action is completed.

The covered services include instructed storage and read-only access while an account is retained under Terms Sections 3.1, 6.3 and 8.5; the end of paid scanning alone therefore does not necessarily end those hosting services. Customer-directed personal data in scan records is retained while the relevant brand remains in Customer's account, subject to an earlier lawful instruction and Sections 10.1–10.3. Deletion of one brand does not require closure of the whole account. The separate retention of public AI-engine answers and incidental names under Provider's controller activity is described in the Privacy Notice and applicable Terms; this sentence does not reduce Customer's DPA rights in mixed records.

That continuing instruction is limited to retaining and making the existing materials available to Customer and keeping them secure; it authorises no new scans or independent reuse.

This continuing retention remains subject to Customer's earlier lawful deletion instruction and applicable necessity and retention requirements. It does not authorise keeping covered data after the relevant brand/account deletion trigger or other applicable deletion obligation, except as permitted under Section 10.3.

Provider shall record Customer's disposition choice and coordinate any requested return before deletion.

10.3 Disposition of all covered copies

Provider shall carry out Customer's documented choice of return or deletion without undue delay after the relevant processing services end and shall delete remaining copies of Processed Personal Data, subject only to the lawful retention described below.

The existing Customer Data deadline in Section 10.1 continues to apply within its contractual scope, subject to this DPA and applicable law. This DPA does not impose a separate universal forty-five-day deadline on every other covered record, backup or downstream copy.

Provider shall follow the specific retention and disposition periods in Schedules 1–3, subject to an earlier lawful instruction or legal requirement. If Customer has not chosen return, Provider shall give Customer a reasonable opportunity to do so without delaying required deletion.

A routine backup is not exempt solely because it is a backup. Any delayed expiry of residual copies must have a specific lawful basis and bounded period identified in Schedule 2 or Schedule 3; Provider shall restrict those copies from ordinary use and prevent deleted data from re-entering service after restoration. Technical inconvenience or a supplier's policy alone does not authorise retention contrary to applicable law.

Where the GDPR processor-deletion rule applies, retention in place of deletion is permitted only where Union or Member State law requires storage; a demand under another country's law shall be handled under Section 3.4 and the applicable transfer arrangements, without treating it as that exception.

For other covered processing, any mandatory-law retention must be identified by its actual applicable legal requirement, data, purpose and period; retained data shall remain protected and restricted to that purpose until lawful deletion.

Provider shall cause its Subprocessors to perform the disposition obligations applicable to their delegated processing, including covered inputs, outputs and copies, and obtain sufficient evidence of completion and any lawful residual retention.

Terms exclusions for public content, System Data or other categories, and third-party policies or commercially reasonable efforts language, shall not reduce these obligations for Processed Personal Data.

10.4 Record and certification

Provider shall keep a disposition record sufficient to identify the completed actions, affected stores and recipients, any lawful retained copies and their applicable expiry or release conditions.

Certification under Terms Section 8.6 shall accurately reflect that record and its scope, rather than representing deletion that has not occurred.

11. Information and audit

11.1 Compliance information

Provider shall make available the information necessary to demonstrate compliance with its applicable processor obligations and this DPA.

Where existing documents, current independent reports or a remote review adequately answer a request, the parties shall use those proportionate means first, without substituting an unavailable certification or denying a necessary inspection.

11.2 Audits and inspections

Provider shall permit and assist audits, including inspections where necessary, by Customer or an appropriately qualified independent auditor appointed by Customer.

The parties shall reasonably coordinate scope, timing and security arrangements to minimise unnecessary disruption and protect other customers' information, confidential material and system security, without frustrating the audit's purpose.

Routine audits are limited to one in any twelve-month period on at least thirty days' written notice. Those limits do not apply to an audit reasonably required because of a Personal Data Breach, a substantiated material compliance concern, a supervisory-authority requirement or another mandatory entitlement; the parties shall accommodate such a review promptly as its circumstances require.

These arrangements do not restrict the compliance information required under Section 11.1 or prevent an effective audit under applicable law.

11.3 Confidentiality and costs

Audit participants shall be bound by suitable confidentiality duties, without restricting lawful disclosure to supervisory authorities or the exercise of mandatory rights.

Customer normally bears its auditor's fees, and any charge for exceptional Provider assistance must be agreed, proportionate and non-deterrent, with no charge for remedying Provider's own breach.

Provider shall address material findings for which it is responsible and provide a reasonable remediation plan and evidence of completion.

12. Liability, remedies and continuation

12.1 Inter-party allocation

As between the parties, the Terms govern liability and remedies for this DPA except to the extent this would exclude or restrict a mandatory obligation, an individual's or authority's rights, or an applicable transfer instrument.

This DPA creates no separate indemnity or automatic uncapped inter-party liability category.

Neither sentence prevents the performance of an obligation required by applicable data protection law or an applicable transfer instrument.

12.2 Inability to comply

Provider shall promptly inform Customer if it cannot comply with this DPA, identify the affected processing and cooperate on corrective measures or a lawful suspension or cessation of that processing.

The parties' existing contractual remedies and mandatory rights remain available, and protecting, returning or deleting data is not waived by a commercial dispute.

12.3 Duration and changes

This DPA continues for as long as Provider or a Subprocessor retains Processed Personal Data on Customer's behalf.

Amendments must be recorded and agreed by both parties, except for the expressly authorised Schedule 3 change process, and may not remove a mandatory protection.

The Terms' governing-law and forum provisions apply subject to any overriding applicable law or transfer instrument.

Schedule 1 — Processing description and instructions

This standard schedule applies only where Provider processes personal data on Customer's behalf under Section 1.2. The account's versioned Terms acceptance identifies the account and accepting individual. At signup it does not collect a company name, a separate instruction or incident contact, or Customer's controller/processor capacity. An Order Form may add those details. Provider may request confirmation of identity, authority and capacity before acting on a later instruction; the absence of a signup field does not remove the data protections in this DPA.

Schedule 2 — Security, assistance and disposition measures

The duties in Sections 3–11 apply even where this schedule describes an incomplete process. The statements below disclose present operation; they do not certify that every duty has been performed for a particular request. Provider must promptly tell Customer under Section 12.2 when it cannot perform a duty and arrange a lawful correction or pause of affected processing.

Schedule 3 — Recipients, route status, locations and transfers

How this list works. This schedule covers recipients only to the extent they process Processed Personal Data on Customer's behalf; public-answer-only activity under Section 1.5 is outside it. “Active in production” describes a deployed route, not proof of a completed supplier contract or transfer chain. A listed future or conditional recipient is authorised only for the sufficiently identified activity and data; a row awaiting a material identity, route or location fact discloses a plan and does not authorise an unassessed expansion. No row waives Sections 6.3 or 7. A new or replacement recipient, or a material change of function, data, location or transfer arrangement, is governed by Section 6.2. Activating a route within a sufficiently identified initial row does not by itself add a recipient.

Recipients outside this customer-processing schedule. Lovable's app and site visitor hosting (including its own Cloudflare chain), Airwallex payment/billing, and PostHog's current daily aggregate counts serve Provider's separate purposes on the supplied facts. Wikidata receives a brand name for public lookup; whether that string identifies a person in a particular case needs assessment, but it is not described as a processor engaged for the covered scan service. Cloro, ScrapingBee, scrape.do and Browserbase are present only in deployed test functions, outside the production pipeline; those callable test routes should be removed or disabled before claiming they cannot receive covered data. Direct OpenAI embeddings and direct Google AI Studio code are not active on the supplied configuration; any activation requires a new assessment.

The EEA-to-Israel leg and each outward or onward leg need separate transfer assessment. A public vendor policy, headquarters, adequacy for one leg, or a supplier's suggested retention setting does not establish every contract or transfer. Provider shall supply Customer with available route-specific information and address any inability to meet Sections 6 or 7 under Section 12.2.