Terms of Service

PLEASE READ THESE TERMS OF SERVICE CAREFULLY BEFORE ACCESSING OR USING THIS SITE OR PURCHASING ANY SERVICES.

These Terms of Service (these "Terms") constitute a legally binding agreement between AI Find My Business, Inc., a corporation ("AIFindMyBusiness," the "Company," "we," "us," or "our"), and the individual or legal entity accessing the website located at https://aifindmybusiness.com (the "Site") or purchasing, receiving, or using the services described herein (collectively, the "Client,""you," or "your").

Capitalized terms used but not otherwise defined where they first appear are defined in Section 1 (Definitions) below.

SECTION 1. DEFINITIONS

As used in these Terms, the following terms have the meanings set forth below:

"Account" means the authenticated customer dashboard made available to Client following purchase of any Service, accessible at the Site.

"AI Sub-Processors" means the third-party artificial intelligence platform and search-data providers engaged by the Company from time to time to assist in the production of Deliverables or to serve as the subject of measurement in connection with the Services. The current list of AI Sub-Processors is set forth in Exhibit A, which may be updated by the Company in accordance with Section 18.4.

"Audit" means the AI Visibility Audit service described in Section 3.1.

"Authorized User" means an employee, officer, contractor, or professional advisor of Client who has been granted access to the Account or Deliverables pursuant to Section 8.3.

"Client Data" means any business information, content, analytics data, access credentials, or other materials provided by Client to the Company in connection with the Services.

"Confidential Information" has the meaning assigned to it in Section 17.

"Data Processing Addendum" or "DPA" means the data processing addendum set forth in Exhibit B.

"Deliverables" means written audit reports, scorecards, improvement plans, roadmaps, slides, monitoring summaries, and any other work product produced and delivered by the Company to Client pursuant to an Order.

"Documentation" means any user guides, help articles, or technical specifications made available by the Company at the Site or by other means.

"Effective Date" means the date Client first accepts these Terms, either by checking the acceptance checkbox at checkout or by otherwise accessing or using the Site or Services.

"Force Majeure Event" has the meaning assigned to it in Section 13.5.

"Improvement Plan" means the written roadmap and recommendations delivered to Client following completion of an Audit.

"Intellectual Property Rights" means all patents, copyrights, trademarks, trade secrets, moral rights, and other proprietary or intellectual property rights recognized in any jurisdiction.

"Law" means any applicable federal, state, local, or foreign law, statute, regulation, rule, ordinance, or governmental order.

"Losses" means any and all claims, damages, losses, liabilities, costs, and expenses, including reasonable attorneys' fees.

"Operational Sub-Processors" means the third-party service providers, other than AI Sub-Processors, that the Company engages to host, store, transmit, or otherwise process Client Data or personal data in operating the Site and the Services, as listed in Exhibit A.

"Order" means a purchase confirmation, order form, invoice, statement of work, or other document through which Client purchases Services, incorporating these Terms by reference.

"Privacy Policy" means the Company's Privacy Policy accessible at https://aifindmybusiness.com/privacy, as updated from time to time.

"Services" means, collectively, the AI Visibility Audit, Improvement Plan, subscription monitoring and optimization engagements, advisory engagements, and any other services offered by the Company under these Terms.

"Site" means the Company's website accessible at https://aifindmybusiness.com and any subdomains or successor URLs.

"Sub-Processors" means, collectively, AI Sub-Processors and Operational Sub-Processors.

"Subscription" means a recurring engagement for ongoing AI visibility monitoring, optimization, or related services.

"Third-Party Services" means third-party platforms, tools, integrations, or services linked to or accessible through the Site.

SECTION 2. ACCEPTANCE OF TERMS

2.1 Agreement by Use

By accessing the Site, submitting an intake form, creating an Account, or purchasing any Service, you represent that you have read, understood, and agree to be bound by these Terms, the Privacy Policy, and any other policies or guidelines incorporated herein by reference. If you do not agree to these Terms in their entirety, you must immediately discontinue use of the Site and the Services.

2.2 Clickwrap and Electronic Acceptance

To purchase any Service, you will be required to affirmatively check a box (or otherwise manifest unambiguous assent) confirming your acceptance of these Terms prior to completing your purchase. Acceptance via clickwrap or purchase-completion checkbox constitutes your legally binding electronic signature for purposes of the Electronic Signatures in Global and National Commerce Act (E-Sign Act), 15 U.S.C. § 7001 et seq., and applicable state electronic signature laws. The Company retains time stamped logs of each acceptance event, including the version of the Terms accepted, the date and time of acceptance, and Client's identifying information, in accordance with Section 2.5.

2.3 Capacity and Authority to Contract

You represent and warrant that: (a) you are at least eighteen (18) years of age; (b) you have the legal capacity to enter into a binding contract; and (c) if you are entering into these Terms on behalf of a legal entity, you have the authority to bind that entity, and all references to "you" or "Client" shall refer to that entity. You further represent that you are not barred from receiving the Services under any applicable Law.

2.4 Business Use Only; Geographic Restrictions

The Services are designed for, marketed to, and intended for business-to-business use only. The Services are not intended for use by consumers for personal, household, or family purposes. The Services are not directed to, and are not intended for use by, residents of the European Union, the European Economic Area, the United Kingdom, or Switzerland ("Restricted Jurisdictions"). If you are located in a Restricted Jurisdiction and nonetheless access the Site or use the Services, you do so on your own initiative and at your own risk; your use is not solicited by the Company. Personal data submitted through the Site is processed in the United States in accordance with the Privacy Policy. Where a Client is nonetheless subject to the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection with respect to personal data the Company processes on the Client's behalf, Exhibit B (Data Processing Addendum) applies.

2.5 Updates and Modifications

The Company reserves the right to modify these Terms at any time. If the Company makes material changes, it will post the revised Terms on the Site with an updated "Last Updated" date and may, at its election, provide additional notice (such as by email to the address on file). Your continued access to or use of the Site or Services following the posting of any changes constitutes your acceptance of the revised Terms. It is your responsibility to review these Terms periodically. If you do not agree to the revised Terms, your sole remedy is to discontinue use of the Services and terminate your Account in accordance with Section 20.

SECTION 3. DESCRIPTION OF SERVICES

3.1 Service Tiers

The Company currently offers the following service tiers. Specific deliverables, scope, and timeline for each Service are described on the Site at the time of purchase and may be further specified in an engagement summary, statement of work, or order confirmation.

AI Visibility Readiness Audit — a one-time diagnostic engagement that evaluates how leading AI search and conversational AI platforms describe, compare, rank, and recommend Client’s business in response to buyer-intent queries, and that produces a written readiness report. Deliverables are made available to Client through the Company’s customer dashboard and/or transmitted via transactional email, in PDF or other electronic format.

Growth Plan — an ongoing retainer Subscription providing recurring reporting, recommendations, and strategy support. Subscriptions are billed automatically at the cadence selected at checkout and renew until cancelled in accordance with Section 7.4.

Done-With-You Plan — an ongoing retainer Subscription providing strategy, drafted content, and coordination with Client’s existing team or vendors. Subscriptions are billed automatically at the cadence selected at checkout and renew until cancelled in accordance with Section 7.4.

Done-For-You Plan — a custom-priced engagement in which the Company directly implements recommended changes on Client’s behalf. This tier is subject to a separate written engagement agreement between the parties in addition to these Terms.

Specific deliverables, scope, and timeline for each Service are described on the Site at the time of purchase and may be further specified in an engagement summary, statement of work, or order confirmation.

3.2 Improvement Plan

Following completion of an Audit, the Company will produce and deliver to Client a written Improvement Plan containing prioritized recommendations designed to improve Client’s visibility and positioning within AI-powered search and recommendation systems. The Improvement Plan is informational in nature and does not constitute a guarantee of results. See Section 11 (Disclaimers).

3.3 Subscription Services

The Company offers recurring Subscription services for ongoing AI visibility monitoring, optimization strategy, content guidance, and related advisory services. Subscription tiers, deliverables, billing cadences, and scope are set forth in the applicable Order. Subscriptions are billed automatically at the cadence selected at checkout and renew until cancelled in accordance with Section 7.4.

3.4 Future and Expanded Services

These Terms are drafted broadly and are intended to govern any and all present and future services offered by the Company, including without limitation: AI audits and assessments; advisory and consulting engagements; reporting and benchmarking services; managed implementation; content strategy; access to proprietary tools, software, APIs, or platforms; customer dashboard or portal access; and any other service that may be offered by the Company in the future. The Company may expand, modify, or discontinue any Service at any time, provided that any material change to Services already purchased will be communicated to affected Clients with reasonable notice.

3.5 Role of Artificial Intelligence in the Services

Artificial intelligence is integral to the Services in two distinct capacities. First, AI-powered platforms (including those listed in Exhibit A) serve as the subject of measurement: the Audit evaluates how such platforms describe and recommend Client's business. Second, AI tools may be used by the Company as instruments to assist in research, analysis, drafting, and production of Deliverables. All Deliverables are subject to human review by Company personnel prior to delivery to Client. AI is not used on the Site to make automated decisions about visitors, to profile visitors, to set prices, to determine eligibility, or to take any action producing legal or similarly significant effects on any visitor or Client. There is no chatbot, AI decision engine, or automated AI-based recommendation system interacting with visitors on the Site.

3.6 AI Sub-Processors

The Company may engage AI Sub-Processors and Operational Sub-Processors to assist in the performance of the Services. The current list of Sub-Processors is set forth in Exhibit A, which is incorporated herein by reference. The Company may add, remove, or change Sub-Processors by updating Exhibit A without re-issuance of these Terms, provided that the Company will maintain a current version of Exhibit A at the URL referenced therein and will give at least fifteen (15) days' advance notice of any new Sub-Processor, with a right to object, as set forth in Section 18.4. Clients who have specific concerns regarding which AI providers may or may not process their information may contact the Company at [email protected] prior to submitting an intake form, and the Company will endeavor to scope the engagement accordingly.

SECTION 4. USER ACCOUNTS AND REGISTRATION

4.1 Account Creation

Following purchase of a Service, Client will be invited to create an Account on the Site. To create an Account, Client must provide accurate, current, and complete information as prompted, including business name, contact information, and such other information as the Company may reasonably request. Client agrees to update Account information promptly to keep it accurate and current.

4.2 Account Security

Client is solely responsible for maintaining the confidentiality of its Account credentials and for all activity occurring under its Account. Client must promptly notify the Company at [email protected] if it becomes aware of any unauthorized access to or use of its Account or any other security breach. The Company shall not be liable for any Losses arising from unauthorized use of Client's Account credentials where such use results from Client's failure to maintain reasonable security.

4.3 One Account Per Client; No Account Sharing

Each Client is entitled to one Account. Client may not create multiple Accounts, impersonate any person or entity, or use another party's Account without authorization. Account credentials may not be shared with individuals who are not Authorized Users of Client.

4.4 Authorized Users (Business Accounts)

Client may designate Authorized Users to access the Account on Client's behalf. Client is responsible for the acts and omissions of all Authorized Users to the same extent as Client's own acts and omissions. Client must revoke the access of any Authorized User whose authorization is terminated promptly upon such termination.

4.5 Account Suspension and Termination

The Company may suspend, restrict, or terminate Client's Account and access to the Services immediately and without prior notice if: (a) Client breaches any provision of these Terms; (b) Client fails to pay any fees when due; (c) Client's use of the Services poses a security risk or legal liability to the Company or third parties; or (d) the Company is required to do so by Law. Upon termination, the provisions of Section 20.4 (Effect of Termination) shall apply.

4.6 Account Inactivity

If Client's Account remains inactive — meaning no login, access, or active Subscription — for a continuous period of twenty-four (24) months, the Company may, upon thirty (30) days' prior written notice to Client's email address on file, archive or delete the Account and any associated data. The Company's data retention obligations following termination are described in the Privacy Policy.

4.7 Information Provided by Client

By submitting information through the Site or intake forms, Client represents that: (a) all information is accurate, current, and complete; (b) Client will promptly update any information that changes during an active engagement; (c) Client has the right and authority to provide such information, including any third-party platform access credentials; and (d) Client will not provide protected health information, payment card data, Social Security numbers, or other categories of sensitive personal data not strictly necessary for the Services. The Company is not responsible for any inaccuracies in Client Data and expressly disclaims any liability arising there from.

SECTION 5. LICENSE AND INTELLECTUAL PROPERTY

5.1 License Grant to Client

Subject to Client's compliance with these Terms and payment of all applicable fees, the Company grants Client a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to: (a) access and use the Site and Account for Client's internal business purposes; and (b) use Deliverables for Client's internal business purposes, in each case subject to the restrictions set forth in Section 5.4.

5.2 Ownership of Company Intellectual Property

The Company retains all right, title, and interest in and to: (a) the Site, including all software, code, design, and content; (b) the Company's methodologies, scoring rubrics, prompt frameworks, audit templates, internal tools, benchmarking databases, and report formats; (c) all Deliverables (subject to the license granted in Section 5.1(b)); and (d) all Intellectual Property Rights in any of the foregoing. No rights are granted to Client except as expressly stated in these Terms.

5.3 Client Data; License to Company

Client retains all right, title, and interest in and to Client Data. Client grants the Company a limited, non-exclusive, worldwide, royalty-free license to access, use, store, and process Client Data solely as necessary to: (a) provide and support the Services for Client; (b) communicate with Client regarding the Services; and (c) comply with applicable Law. The Company may use Client Data to improve its products and services only in aggregated or de-identified form that does not identify Client or any individual, as described in Sections 8.4 and 16.4. Where Client Data includes personal data that the Company processes on Client's behalf, Exhibit B also applies.

5.4 Restrictions on Use

Client may not, and may not permit any Authorized User or third party to:

publish, post, or otherwise make any Deliverable publicly available without the Company's prior written consent;

sell, resell, sublicense, assign, distribute, or otherwise make any Deliverable available to any third party as a stand-alone product or as a component of a competing service;

use any Deliverable to develop or offer a service that competes with the Services;

reverse-engineer, decompile, disassemble, or otherwise attempt to derive the Company's methodology, scoring weights, or prompt sets from any Deliverable or from the Site;

remove, obscure, or alter any copyright, trademark, or proprietary notice on any Deliverable or the Site;

use the Site or Services for any unlawful purpose or in violation of any applicable Law;

use automated scripts, bots, scrapers, crawlers, or other automated tools to access or interact with the Site without the Company's prior written consent; or

interfere with or disrupt the integrity, security, or performance of the Site or any system or network connected thereto.

5.5 Reverse Engineering Prohibition

Client expressly agrees not to decompile, disassemble, or otherwise attempt to reverse-engineer any software, algorithm, or proprietary framework underlying the Services or Deliverables.

5.6 Trademark Usage

The Company name "AIFindMyBusiness," its logos, and associated branding are trademarks or service marks of the Company. Client is granted no rights to use any Company trademark, logo, or branding without the Company's prior written consent. Any permitted use must comply with the Company's brand guidelines as communicated in writing.

SECTION 6. ACCEPTABLE USE AND CONDUCT

6.1 Prohibited Activities

Client agrees not to use the Site or Services for any of the following purposes:

any illegal, fraudulent, deceptive, or tortious activity;

transmitting unsolicited commercial communications (spam);

impersonating any person or entity;

introducing malware, viruses, worms, Trojan horses, or other malicious code;

attempting to gain unauthorized access to the Site, Accounts, or related systems;

conducting or facilitating distributed denial-of-service (DDoS) attacks or similar interference;

collecting or harvesting personal data from the Site without authorization;

using the Services in a manner that disparages, defames, or harms the reputation of the Company or third parties; or

violating any applicable Law, including export control or data protection laws.

6.2 No Automated Access

Client may not use robots, spiders, scrapers, crawlers, or other automated tools to access the Site or extract data without the Company's prior express written consent. Violation of this restriction may result in immediate Account termination.

6.3 No Interference with Services

Client may not take any action that imposes an unreasonable or disproportionately large load on the Company's infrastructure, or that otherwise interferes with or disrupts the normal operation of the Site or Services.

6.4 Reporting Violations

Client may report suspected misuse, abuse, or violations of these Terms by contacting the Company at [email protected] with a description of the suspected violation.

6.5 Enforcement and Consequences

The Company reserves the right to investigate and take appropriate action against any Client who, in the Company's sole discretion, violates this Section 6, including suspending or terminating the Account, removing access to Deliverables, reporting the conduct to law enforcement authorities, and pursuing all available legal remedies.

SECTION 7. PAYMENTS, BILLING, AND SUBSCRIPTIONS

7.1 Pricing and Fees

Fees for the Services are as published on the Site at the time of purchase, or as set forth in an applicable Order. Published pricing applies to active engagements through the end of the then-current billing period. The Company reserves the right to change its pricing at any time; changes will be communicated to Clients with active Subscriptions no less than thirty (30) days before taking effect and will apply at the next renewal.

7.2 Payment Processing

Payments are processed by Stripe, Inc. ("Stripe"), a third-party payment processor. By providing payment information and purchasing any Service, Client: (a) authorizes the Company and Stripe to charge the applicable fees to Client's designated payment method; (b) represents that Client is authorized to use the payment method provided; and (c) acknowledges that Stripe's own terms of service and privacy policy govern Client's payment transactions with Stripe. The Company accepts the payment methods listed on the Site at the time of purchase.

7.3 Subscription and Recurring Billing

Subscriptions are billed automatically at the cadence selected at checkout (monthly, quarterly, or as otherwise specified in the Order) until cancelled. Before completing any Subscription purchase, the Company will clearly disclose: (a) the amount to be charged; (b) the billing cadence and the date on which recurring charges will begin; (c) how to cancel; and (d) any setup fees or non-refundable charges. Client's completion of checkout constitutes affirmative consent to these recurring billing terms. The Company will retain evidence of such consent.

7.4 Cancellation

Client may cancel a Subscription at any time by any of the following methods:

emailing [email protected] with the subject line "Cancel Subscription for [Business Name]";

replying to any billing email from the Company requesting cancellation; or

through any Stripe customer portal link made available in billing communications.

Cancellation takes effect at the end of the then-current billing period; no further charges will be made after that date. Cancellation does not entitle Client to a refund for the current billing period except as expressly provided in Section 7.5. The Company records the cancellation method and timestamp.

7.5 Refund Policy

The Company's refund policy is as follows:

AI Visibility Audit: Refundable in full within twenty-four (24) hours of payment. No refund is available after twenty-four (24) hours, including where the Audit has been delivered.

Subscription Plans: No refund for any billing period already paid, including the first period.

Non-Refundable Setup Fees: Any setup or onboarding fee designated as non-refundable in the Order is non-refundable once onboarding work has commenced.

Custom Engagements: Refund terms for custom-priced engagements are governed by the applicable written engagement agreement.

Notwithstanding the foregoing, the Company will issue a refund where: (a) the Company fails to deliver a Service paid for, where the failure is not attributable to Client; (b) the Company materially breaches these Terms and does not cure within fifteen (15) days of written notice; (c) a duplicate charge or billing error has occurred; (d) a refund is required by applicable Law, including state automatic-renewal laws; or (e) Client is confirmed to be a victim of fraud or unauthorized use of their payment method as documented by Client's payment provider. To request such a refund, Client must email [email protected] with the subject line "Refund Request for [Business Name]" and a brief description of the circumstances; the Company will respond within five (5) business days.

7.6 Failed Payments

If a payment is declined or fails, the Company may retry the charge up to three (3) times within a reasonable period. If the payment cannot be collected after retries, the Company may, without further notice: (a) pause or suspend delivery of the Services; (b) withhold any pending Deliverables; and (c) terminate the engagement for non-payment. Any outstanding balance remains due and the Company reserves all rights at law and equity to collect it.

7.7 Disputed Charges and Chargebacks

Client agrees to contact the Company at [email protected] prior to initiating any chargeback or dispute with Client's payment provider. The Company will cooperate in good faith to resolve legitimate billing disputes. If Client initiates a chargeback in bad faith or for a charge that is valid under these Terms, the Company reserves the right to: (a) terminate Client's Account and access to the Services; and (b) pursue all available remedies, including recovery of chargeback fees and collection costs.

7.8 Taxes

Fees do not include any sales, use, value-added, goods and services, or similar taxes imposed by any governmental authority. Client is solely responsible for all taxes applicable to Client's purchase of the Services, except for taxes assessed on the Company's net income.

7.9 Late Payment

Amounts not paid when due will accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable Law, from the due date until paid in full. The Company may also recover reasonable collection costs, including attorneys' fees, incurred in connection with collecting overdue amounts.

7.10 Right to Suspend Service

The Company reserves the right to suspend delivery of any Service immediately upon: (a) non-payment of fees; (b) Client's material breach of these Terms; or (c) Client's conduct that poses a legal or reputational risk to the Company. Suspension does not waive the Company's right to terminate the engagement or to seek all other remedies available at law or in equity.

7.11 Promotional Codes; Consent to Anonymized Use in Statistics and Case Studies

From time to time, the Company may make promotional, discount, partner, beta, referral, or other coupon codes (each, a "Promotional Code") available for application at checkout. Use of any Promotional Code is voluntary; Client is not required to redeem a Promotional Code in order to purchase any Service at its standard published price.

By entering or applying a Promotional Code at checkout, Client expressly acknowledges and agrees that, as additional consideration for the discount or other benefit conferred by the Promotional Code, the Company is granted the right — in addition to the rights set forth in Section 8.4 (Anonymized Benchmarking) and Section 16.4 — to:

(a) use Client Data, intake responses, Deliverables, audit findings, scores, and engagement outcomes in anonymized and de-identified form for the preparation and publication of statistics, benchmarks, white papers, blog posts, presentations, marketing collateral, and similar materials; and

(b) use such anonymized and de-identified information to prepare and publish case studies, including externally distributed case studies that describe Client's industry, geographic region, business size category, and the nature and magnitude of results achieved, provided that no such case study shall identify Client by name, logo, website URL, or other directly identifying information without Client's separate prior written consent.

The Company's use of information under this Section 7.11 is limited to information from which Client's identity has been removed and that cannot reasonably be used, alone or in combination with other information available to the Company, to re-identify Client. The Company shall not use Client's name, logo, trademarks, or other identifying business information in any publicly distributed material that is attributable to Client by name without obtaining Client's separate prior written consent. The consent granted by Promotional Code redemption is perpetual and survives termination of these Terms and of Client's engagement with the Company; it may not be revoked with respect to anonymized materials already prepared, published, or distributed in good-faith reliance on the consent.

If Client does not wish to grant the rights set forth in this Section 7.11, Client may purchase the applicable Service at its standard published price without redeeming a Promotional Code. Use of a Promotional Code at checkout constitutes Client's affirmative, electronic acceptance of this Section 7.11 in accordance with Section 2.2.

SECTION 8. DELIVERABLES AND PERMITTED USE

8.1 Ownership of Deliverables

All Deliverables are and shall remain the intellectual property of the Company. Client receives a limited license to use Deliverables as provided in Section 5.1(b). No title to or ownership of any Deliverable transfers to Client.

8.2 Restrictions on Deliverables

Without limiting Section 5.4, Client may not: (a) publish, publicly display, or post any Deliverable or substantial portions thereof; (b) resell, sublicense, or otherwise commercially exploit any Deliverable; (c) use any Deliverable to develop a competing product or service; or (d) remove proprietary notices.

8.3 Permitted Internal Sharing

Client may share Deliverables, in whole or in part, with:

Client's employees and contractors who have a legitimate need to review such Deliverables in connection with Client's business;

Client's outside professional advisors — including attorneys, accountants, and marketing or web-development agencies — provided each such recipient is subject to professional, contractual, or legal confidentiality obligations at least as protective as those in Section 17 of these Terms; and

a bona fide potential acquirer of, or investor in, Client's business, under a customary non-disclosure agreement.

8.4 Anonymized Benchmarking

The Company may use Client Data and findings from engagements, only in aggregated or de-identified form, for internal research, benchmarking, product improvement, and reporting purposes, provided that such data does not identify, and is not used to re-identify, Client or any individual. The Privacy Policy provides additional detail on data use. Where Client has redeemed a Promotional Code at checkout, the rights granted in this Section 8.4 are expanded as set forth in Section 7.11 (Promotional Codes; Consent to Anonymized Use in Statistics and Case Studies) to permit external publication of anonymized statistics and case studies.

SECTION 9. USER CONTENT AND SUBMISSIONS

9.1 Content Ownership

Client retains all ownership of content and information that Client submits to the Site, Account, or the Company in connection with the Services ("Client Content").

9.2 License Grant to Company

By submitting Client Content, Client grants the Company a limited, non-exclusive, worldwide, royalty-free license (sublicensable only to the Company's Sub-Processors, solely for the purposes of this Section 9.2) to access, store, use, process, transmit, and display such Client Content solely to the extent necessary to provide and support the Services for Client and to communicate with Client. The Company may use Client Content to improve the Site and the Services only in aggregated or de-identified form that does not identify Client or any individual. This license terminates upon expiration or termination of the engagement, subject to Section 20.4 and, for personal data, Exhibit B.

9.3 Content Standards

Client represents and warrants that Client Content: (a) does not infringe any third-party Intellectual Property Rights; (b) does not contain protected health information, payment card data, Social Security numbers, or other categories of particularly sensitive personal data; (c) is not false, misleading, or deceptive; and (d) does not violate any applicable Law.

9.4 Content Removal

The Company reserves the right, but not the obligation, to remove, edit, or disable access to any Client Content that the Company determines, in its sole discretion, violates these Terms or any applicable Law.

9.5 Responsibility for Content

Client is solely responsible for all Client Content submitted and for all consequences arising from such submission. The Company does not monitor or pre-screen Client Content and expressly disclaims all liability for Client Content.

SECTION 10. THIRD-PARTY SERVICES AND LINKS

10.1 Third-Party Integrations

The Site may contain links to, or enable integration with, Third-Party Services, including but not limited to analytics platforms, AI-powered platforms evaluated as part of the Audit, and payment processors. The Company does not control and is not responsible for the content, functionality, availability, privacy practices, or terms of any Third-Party Service.

10.2 No Endorsement

References to Third-Party Services on the Site or in Deliverables do not constitute an endorsement, sponsorship, or recommendation by the Company of any third-party product, service, or provider.

10.3 Third-Party Terms Govern

When Client accesses or uses any Third-Party Service, including Stripe for payment processing or AI platforms accessed in connection with the Audit, Client is subject to the terms of service, privacy policy, and other policies of that third party. Client's relationship with Third-Party Services is exclusively between Client and the applicable third party, and the Company has no liability for such relationships or for the acts or omissions of any Third-Party Service provider.

10.4 AI Platforms as Subject of Measurement

To the extent the Services involve querying third-party AI platforms (including those listed in Exhibit A) using prompts designed to evaluate how such platforms describe or recommend Client's business, Client acknowledges that: (a) the Company does not control the content of responses generated by any third-party AI platform; (b) such platforms may change their algorithms, training data, or outputs at any time without notice to the Company or Client; and (c) the Company's Deliverables reflect a snapshot in time and may not reflect the current behavior of any AI platform.

SECTION 11. DISCLAIMERS; INFORMATIONAL NATURE OF SERVICES

11.1 Services Are Informational Only

THE SERVICES, INCLUDING ALL DELIVERABLES, ARE PROVIDED SOLELY FOR INFORMATIONAL AND ADVISORY PURPOSES. THE COMPANY'S AUDIT REPORTS, IMPROVEMENT PLANS, MONITORING SUMMARIES, AND RELATED DELIVERABLES REFLECT THE COMPANY'S ANALYSIS AND RECOMMENDATIONS AT THE TIME OF PRODUCTION AND DO NOT CONSTITUTE LEGAL ADVICE, MARKETING GUARANTEES, FINANCIAL ADVICE, SEO GUARANTEES, REGULATORY COMPLIANCE ADVICE, OR ANY OTHER FORM OF PROFESSIONAL ADVICE.

11.2 No Guarantee of Results

THE COMPANY MAKES NO WARRANTY OR GUARANTEE, EXPRESS OR IMPLIED, THAT: (A) THE SERVICES WILL IMPROVE CLIENT'S RANKINGS, CITATIONS, MENTIONS, OR RECOMMENDATIONS BY ANY AI PLATFORM OR SEARCH ENGINE; (B) THE SERVICES WILL INCREASE WEBSITE TRAFFIC, LEAD VOLUME, CUSTOMER ACQUISITIONS, REVENUE, OR ANY BUSINESS METRIC; (C) RECOMMENDATIONS IN ANY DELIVERABLE WILL PRODUCE ANY PARTICULAR OUTCOME; OR (D) IMPLEMENTATION OF ANY IMPROVEMENT PLAN WILL RESULT IN MEASURABLE IMPROVEMENT IN AI VISIBILITY. RESULTS MAY VARY SIGNIFICANTLY AMONG CLIENTS.

11.3 AI Platforms Are Outside Company's Control

THIRD-PARTY AI PLATFORMS, SEARCH ENGINES, DIRECTORIES, AND REVIEW SITES OPERATE INDEPENDENTLY OF THE COMPANY. THEIR ALGORITHMS, RANKING FACTORS, TRAINING DATA, AND OUTPUTS CHANGE CONSTANTLY AND WITHOUT NOTICE. THE COMPANY DOES NOT CONTROL, AND PROVIDES NO WARRANTY REGARDING, THE BEHAVIOR, AVAILABILITY, ACCURACY, OR OUTPUTS OF ANY THIRD-PARTY AI PLATFORM OR SEARCH ENGINE, INCLUDING THOSE LISTED IN EXHIBIT A.

11.4 As-Is Disclaimer

THE SITE AND SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT. THE COMPANY DOES NOT WARRANT THAT THE SITE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.

11.5 No Uptime Guarantee

THE COMPANY DOES NOT GUARANTEE ANY MINIMUM LEVEL OF AVAILABILITY OR UPTIME FOR THE SITE OR ACCOUNT AND IS NOT RESPONSIBLE FOR ANY DOWNTIME, OUTAGE, OR LOSS OF ACCESS TO THE SITE OR SERVICES.

11.6 Accuracy of Information

THE COMPANY MAKES NO WARRANTY THAT ANY CONTENT, DATA, OR INFORMATION ON THE SITE, IN ANY DELIVERABLE, OR IN ANY THIRD-PARTY AI PLATFORM'S RESPONSE IS ACCURATE, COMPLETE, CURRENT, OR SUITABLE FOR ANY PARTICULAR PURPOSE.

11.7 No Professional Advice

Nothing in these Terms, the Site, or any Deliverable constitutes or shall be construed as:

legal advice or the establishment of an attorney-client relationship;

financial advice or investment recommendations;

marketing guarantees of any kind;

search engine optimization (SEO) guarantees;

regulatory compliance advice, including compliance with advertising, FTC, or industry-specific regulations; or

any other form of licensed professional advice.

Client should consult qualified professionals — including attorneys, accountants, and marketing specialists before making business decisions based on any Deliverable.

SECTION 12. CLIENT RESPONSIBILITIES

12.1 Implementation Responsibility

Client is solely responsible for: (a) evaluating the suitability of any recommendation in a Deliverable for Client's specific business situation; (b) all decisions regarding whether and how to implement any recommendation; and (c) all consequences of implementation, including unintended effects on Client's business, website, content, or third-party platform accounts. The Company is not responsible for any harm arising from Client's implementation of, or failure to implement, any recommendation.

12.2 Accuracy of Client Information

Client warrants that all information, content, and Client Data provided to the Company is accurate, complete, and not misleading. Client acknowledges that the quality and accuracy of Deliverables is dependent in part on the accuracy of information provided by Client, and that the Company's liability for inaccuracies attributable to Client Data is excluded pursuant to Section 13.

12.3 Approval of Changes

Where the Services include any element of managed implementation, Client must review and affirmatively approve any proposed change before the Company implements it. The Company will not make changes to Client's website, content, third-party platform accounts, or other systems without Client's prior written approval, which may be provided by email. Changes made by the Company following Client approval are implemented at Client's risk and direction.

12.4 Retention of Ownership and Control

Client retains ownership of and control over all of Client's business accounts, websites, domain names, social media accounts, directory listings, and other digital assets at all times. Nothing in these Terms grants the Company any ownership interest in or permanent control over such assets. Any access granted to the Company is strictly limited to the scope necessary to perform the Services and may be revoked by Client at any time.

12.5 Legal Compliance

Client is responsible for ensuring that its use of the Services and implementation of any recommendations complies with all applicable Laws, including advertising regulations, data protection laws, and industry-specific requirements.

SECTION 13. LIMITATION OF LIABILITY

13.1 Cap on Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE COMPANY'S TOTAL CUMULATIVE LIABILITY TO CLIENT ARISING OUT OF OR RELATING TO THESE TERMS, THE SITE, OR THE SERVICES — REGARDLESS OF THE LEGAL THEORY ON WHICH THE CLAIM IS BASED (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, WARRANTY, OR OTHERWISE) — SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CLIENT TO THE COMPANY IN THE THREE (3) CALENDAR MONTHS IMMEDIATELY PRECEDING THE DATE ON WHICH THE CLAIM ACCRUED.

13.2 Exclusion of Consequential Damages

IN NO EVENT SHALL THE COMPANY, ITS MEMBERS, MANAGERS, OFFICERS, EMPLOYEES, CONTRACTORS, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO: (A) LOST PROFITS OR REVENUE; (B) LOST BUSINESS OPPORTUNITIES; (C) LOSS OF DATA OR GOODWILL; (D) DECREASED WEBSITE TRAFFIC, SEARCH RANKINGS, OR AI VISIBILITY; (E) LOSS OF LEADS OR CUSTOMER ACQUISITIONS; (F) REPUTATIONAL HARM; OR (G) COST OF SUBSTITUTE SERVICES — EVEN IF THE COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY SET FORTH IN THESE TERMS IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.

13.3 No Liability for AI Platform Behavior

THE COMPANY SHALL HAVE NO LIABILITY WHATSOEVER FOR: (A) THE BEHAVIOR, OUTPUTS, RANKINGS, OR RECOMMENDATIONS OF ANY THIRD-PARTY AI PLATFORM, SEARCH ENGINE, OR DIRECTORY; (B) CHANGES IN SUCH PLATFORMS' ALGORITHMS OR POLICIES; OR (C) ANY FAILURE OF SUCH PLATFORMS TO DESCRIBE, RECOMMEND, OR RANK CLIENT'S BUSINESS IN ANY PARTICULAR MANNER.

13.4 Third-Party Claims

THE COMPANY SHALL NOT BE LIABLE FOR ANY CLAIMS, LOSSES, OR DAMAGES ARISING FROM THE ACTS OR OMISSIONS OF ANY THIRD PARTY, INCLUDING AI SUB-PROCESSORS, PAYMENT PROCESSORS, OR OTHER THIRD-PARTY SERVICE PROVIDERS. NOTHING IN THIS SECTION 13.4 LIMITS THE COMPANY'S RESPONSIBILITY FOR ITS SUB-PROCESSORS UNDER SECTION 4.4 OF EXHIBIT B.

13.5 Force Majeure

The Company shall not be liable for any failure or delay in performing its obligations under these Terms to the extent such failure or delay is caused by circumstances beyond the Company's reasonable control, including acts of God, natural disasters, pandemics, government actions, cyberattacks on third-party infrastructure, telecommunications failures, or third-party platform outages or changes (each, a "Force Majeure Event"). In such circumstances, the Company's obligations are suspended for the duration of the Force Majeure Event, and the Company will use commercially reasonable efforts to resume performance as soon as practicable.

13.6 Essential Basis

Client acknowledges that the limitations of liability in this Section 13 reflect a reasonable allocation of risk and are an essential element of the basis of the bargain between the parties, without which the Company would not have entered into these Terms or offered the Services at the fees charged.

SECTION 14. INDEMNIFICATION

14.1 Client Indemnification Obligations

Client agrees to defend, indemnify, and hold harmless the Company and its members, managers, officers, employees, contractors, and agents (collectively, "Company Indemnitees") from and against any and all Losses arising out of or relating to:

Client's breach of any representation, warranty, covenant, or obligation under these Terms;

Client's violation of any applicable Law;

any Client Data or Client Content that infringes, misappropriates, or violates any third-party right or is false, misleading, or unlawful;

Client's use of the Services or Deliverables in a manner not permitted by these Terms; or

Client's implementation of any recommendation in a Deliverable.

14.2 Indemnification Procedure

The Company will: (a) promptly notify Client of any claim for which indemnification is sought; (b) give Client control of the defense and settlement, provided that the Company may participate with counsel of its own choosing at its own expense; and (c) cooperate reasonably with Client's defense. Client may not enter into any settlement that imposes any obligation or restriction on any Company Indemnitee without the Company's prior written consent.

SECTION 15. PRIVACY AND DATA

15.1 Privacy Policy

The Company's collection, use, storage, disclosure, and protection of Client's personal information and Client Data are governed by the Privacy Policy, which is incorporated into these Terms by reference. In the event of any conflict between the Privacy Policy and these Terms regarding data processing, the Privacy Policy shall control, except that where the Company processes personal data as Client's processor, Exhibit B (Data Processing Addendum) controls over both these Terms and the Privacy Policy.

15.2 Data Collection Overview

As described in the Privacy Policy, the Company collects information that Client provides (including business information, contact details, and access credentials), information collected automatically (including usage data, IP addresses, and device information), and information from third-party platforms where authorized by Client.

15.3 Cookies and Tracking

The Site uses cookies and similar tracking technologies for purposes including authentication, security, analytics, and conversion tracking. The Company's use of cookies is described in the Privacy Policy. Non-essential cookies and similar technologies are used in accordance with the consent and opt-out mechanisms described in Section 5.2 of the Privacy Policy, including the consent banner shown to visitors in the EU/EEA, the UK, and Switzerland. The Company does not disclose specific cookie identifiers or conversion identifiers in these Terms, as such identifiers may change from time to time; current information is available in the Privacy Policy and cookie disclosure.

15.4 Third-Party Data Sharing

The Company may share Client Data with: (a) AI Sub-Processors engaged to assist in production of Deliverables (see Exhibit A); (b) Stripe for payment processing; (c) other service providers engaged to operate and maintain the Site and Services; and (d) as required by Law or legal process. The Company does not sell Client personal data. The Company's data-sharing practices are described in the Privacy Policy.

15.5 Data Security; No Absolute Guarantee

The Company implements commercially reasonable administrative, technical, and physical safeguards to protect Client Data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or method of electronic storage is completely secure. The Company cannot and does not guarantee the absolute security of any information stored or transmitted. Client acknowledges this inherent limitation and agrees that the Company is not liable for any breach of security except to the extent attributable to the Company's gross negligence or willful misconduct.

15.6 Data Retention

The Company retains Client Data for the period necessary to provide the Services, comply with applicable Law, resolve disputes, and enforce its agreements. Upon termination of Client's Account, the Company will handle Client Data in accordance with the Privacy Policy and applicable Law.

15.7 GDPR, UK GDPR, and EEA / UK / Swiss Residents

The Services are designed for, marketed to, and intended for use by U.S. businesses. The Company does not actively target or solicit residents of the European Union, European Economic Area, United Kingdom, or Switzerland ("Restricted Jurisdiction Residents"). Any processing of personal data of Restricted Jurisdiction Residents occurs on an incidental basis and is not the result of active targeting by the Company. Restricted Jurisdiction Residents who nonetheless choose to access the Site do so on their own initiative, and by submitting personal data through the Site, such individuals acknowledge and consent to the transfer of such data to and processing in the United States.

To the extent any processing of Restricted Jurisdiction Residents' personal data occurs, the Company relies on the following legal bases: (a) performance of a contract; (b) compliance with legal obligations; (c) legitimate interests; and (d) consent where required. Personal data that Restricted Jurisdiction Residents submit directly to the Company is collected by the Company in the United States. Onward transfers of such personal data to the Company's Sub-Processors rely, as applicable to each Sub-Processor, on the Standard Contractual Clauses adopted by the European Commission, the UK International Data Transfer Addendum or the UK International Data Transfer Agreement, the Standard Contractual Clauses as adapted for Swiss law, in each case as incorporated in that Sub-Processor's data processing terms, and/or the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework where the Sub-Processor is certified, as further described in Section 10.6 of the Privacy Policy. Where the Company processes personal data as a Client's processor, the transfer terms in Exhibit B apply.

The Company does not at this time appoint an EU representative under Article 27 of the GDPR, on the basis that: (a) the Company's processing of EU/EEA residents' personal data is occasional and not systematic; (b) the Company does not engage in large-scale processing of special-category data as defined in Article 9 of the GDPR; and (c) such processing is unlikely to result in a risk to the rights and freedoms of natural persons within the meaning of Article 27(2)(a) of the GDPR.

Restricted Jurisdiction Residents who wish to exercise their rights under the GDPR or UK GDPR — including rights of access, correction, erasure, restriction of processing, data portability, and objection to processing — may submit a request to [email protected]. The Company will respond to such requests within the timeframes required by applicable law, to the extent the Company is subject to such obligations under applicable law.

15.8 CCPA / California Resident Rights

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), applies to the Company's processing of California residents' personal information, the Privacy Policy contains the required disclosures and describes how California residents may exercise their rights, including rights to know, delete, correct, and opt out of the sale or sharing of personal information (as defined under the CCPA).

SECTION 16. DATA ACCESS, USAGE, AND CONFIDENTIALITY SCOPE

16.1 Types of Client Data Accessed

In connection with certain Services, Client may authorize the Company to access data from systems including, without limitation: website analytics platforms; Google Search Console or similar webmaster tools; customer relationship management (CRM) systems; business strategy documents; and directory or listing profiles. The specific types of data accessed for any engagement may be identified in the applicable Order or intake form.

16.2 Company Use of Client Data

The Company uses Client Data solely: (a) to provide and support the Services for Client and produce Deliverables; (b) to communicate with Client regarding the Services; (c) in aggregated or de-identified form as described in Section 8.4 (anonymized benchmarking); and (d) as required by applicable Law. The Company does not use Client Data for any other commercial purpose.

16.3 Internal Retention of Deliverables

The Company may retain copies of Deliverables internally for purposes of: (a) quality assurance and internal record-keeping; (b) defending against or enforcing claims arising from the engagement; and (c) satisfying legal or regulatory obligations. Such retained copies remain subject to the confidentiality obligations of Section 17.

16.4 Anonymized Research and Benchmarking

The Company may use findings from client engagements, only in aggregated or de-identified form from which identifying information has been removed, for internal benchmarking, product development, and industry research. Such use does not constitute a breach of confidentiality, provided that neither Client nor any individual is identifiable from such data.

SECTION 17. CONFIDENTIALITY

17.1 Mutual Confidentiality Obligation

Each party (the "Receiving Party") agrees to keep confidential all non-public information disclosed by the other party (the "Disclosing Party") in connection with the Services that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure ("Confidential Information"). Company Confidential Information includes the Company's methodology, scoring weights, prompt frameworks, internal tooling, unpublished pricing, and business plans. Client Confidential Information includes Client's business plans, financials, customer lists, marketing strategies, internal performance data, and access credentials.

17.2 Obligations of Receiving Party

The Receiving Party shall: (a) use the Disclosing Party's Confidential Information solely to perform or receive the Services; (b) protect it with at least the same degree of care used to protect its own confidential information of similar sensitivity, and in no event less than reasonable care; and (c) not disclose it to any third party except to its employees, contractors, advisors, and affiliates who have a legitimate need to know and who are bound by obligations no less protective than this Section 17.

17.3 Exclusions from Confidentiality

Confidential Information does not include information that: (a) is or becomes publicly available through no breach of these Terms by the Receiving Party; (b) was already known to the Receiving Party before disclosure, as evidenced by contemporaneous written records; (c) is independently developed by the Receiving Party without reference to the Confidential Information; or (d) is rightfully received from a third party without obligation of confidentiality.

17.4 Required Disclosure

If the Receiving Party is required by law, regulation, court order, or governmental authority to disclose Confidential Information, it shall, to the extent legally permitted, provide the Disclosing Party with prompt prior written notice sufficient to allow the Disclosing Party to seek a protective order or other appropriate relief and shall disclose only the minimum amount required.

17.5 Return or Destruction

Upon written request by the Disclosing Party, or upon termination of the engagement, the Receiving Party shall promptly return or certify destruction of tangible and electronic copies of Confidential Information, provided that: (a) the Receiving Party may retain one archival copy for legal compliance purposes, subject to ongoing confidentiality obligations; and (b) the Receiving Party is not required to delete Confidential Information from automated backup systems maintained in the ordinary course of business, provided such backups are not accessed or used except for technical recovery purposes.

17.6 Survival

Confidentiality obligations in this Section 17 survive termination of these Terms for a period of three (3) years, except that: (a) Confidential Information constituting a trade secret remains confidential for so long as it qualifies as a trade secret under applicable Law; and (b) the Company's obligations with respect to personal data contained in Client Data or Confidential Information survive for as long as the Company, or any Sub-Processor on its behalf, retains that personal data.

SECTION 18. AI-SPECIFIC DISCLOSURES AND DISCLAIMERS

18.1 AI as Tool and Subject

As described in Section 3.5, artificial intelligence is used in the Services in two capacities: (a) as the subject of measurement, to evaluate how AI platforms respond to buyer-intent queries about Client's business; and (b) as a tool used by the Company to assist in research, analysis, and production of Deliverables. All Deliverables are subject to human review by Company personnel prior to delivery to Client.

18.2 Limitations of AI-Generated Content

AI-assisted analysis is subject to inherent limitations, including potential errors, outdated training data, and variation in outputs. Deliverables reflect the Company's professional judgment and review, but do not carry any guarantee of accuracy, completeness, or fitness for a particular purpose. AI outputs used in the production of Deliverables subject to review by a human but are not independently verified by an external auditor.

18.3 No Automated Decision-Making Affecting Clients

The Company does not use AI to make automated decisions about visitors to the Site, to profile them, to set prices, to determine eligibility for Services, or to take any action that produces legal or similarly significant effects on any visitor or Client. There is no AI chatbot, AI recommendation widget, or automated AI-based decision system interacting with visitors on the Site.

18.4 AI Sub-Processor List; Updates

The current list of AI Sub-Processors and Operational Sub-Processors is set forth in Exhibit A and is incorporated into these Terms by reference. The Company may add, modify, or remove Sub-Processors by updating Exhibit A, without re-issuance of these Terms. The Company will maintain a current version of Exhibit A at the URL designated therein. The Company will give at least fifteen (15) days' advance notice before any new AI Sub-Processor or Operational Sub-Processor begins processing Client Data, by posting the change on the Exhibit A page (including the date on which the new Sub-Processor will begin processing) and by email to the email address associated with Client's Account. Client may object to a new Sub-Processor on reasonable data-protection grounds by emailing [email protected] before the end of the notice period. The parties will discuss the objection in good faith; if the Company cannot reasonably accommodate it (for example, by not using the new Sub-Processor for Client's data), either party may terminate the affected Services on written notice, and the Company will refund any prepaid fees for the terminated Services covering the period after termination.

SECTION 19. COMPANY METHODOLOGY AND PROPRIETARY RIGHTS

The Company's audit methodology, scoring frameworks, prompt libraries, weighting systems, benchmarking tools, and internal production processes are proprietary to the Company and constitute trade secrets and/or other Intellectual Property Rights of the Company. Nothing in these Terms or any Deliverable grants Client any right to access, use, copy, reverse-engineer, or commercialize any aspect of the Company's methodology or proprietary systems. Client's sole right with respect to the Company's methodology is to receive Deliverables produced by application of such methodology, subject to the license in Section 5.1.

SECTION 20. TERM AND TERMINATION

20.1 Duration of Agreement

These Terms are effective as of the Effective Date and remain in effect for as long as Client has an active Account, an active Subscription, or any outstanding Order, or as otherwise required by applicable Law.

20.2 Termination by Client

Client may terminate these Terms by: (a) cancelling all active Subscriptions in accordance with Section 7.4; and (b) closing Client's Account by providing written notice to [email protected] requesting account deletion. Termination is effective upon the expiration of the then-current billing period for any active Subscription and immediately upon account deletion for non-Subscription Accounts.

20.3 Termination by Company

The Company may terminate these Terms and/or any Order or Subscription: (a) immediately, upon written notice, if Client materially breaches these Terms and fails to cure such breach within fifteen (15) days after written notice specifying the breach; (b) immediately, without notice, for: (i) non-payment of fees; (ii) Client's violation of Section 5.4 (Restrictions) or Section 6 (Acceptable Use); (iii) insolvency, assignment for the benefit of creditors, or bankruptcy of Client; or (iv) any conduct by Client that poses material legal, financial, or reputational risk to the Company; or (c) for convenience, upon thirty (30) days' written notice, in which case the Company will refund any prepaid, unused fees on a pro-rated basis.

20.4 Effect of Termination

Upon termination of these Terms for any reason:

all licenses granted to Client hereunder terminate immediately;

Client's access to the Account and all Services terminates;

all outstanding fees become immediately due and payable;

each party shall return or certify destruction of the other party's Confidential Information; and

Client may, by written request to [email protected] made within thirty (30) days after termination, choose to have the Company return Client Data to Client (in a commonly used electronic format) or delete it. If Client makes no such request, the Company will delete Client Data within ninety (90) days after termination. These obligations do not apply to copies that the Company is required to retain by applicable Law (which remain subject to Section 17) or to copies held in backup systems, which are deleted in the ordinary course of backup rotation. For personal data that the Company processes as Client's processor, Section 7 of Exhibit B governs.

20.5 Survival

The following sections survive termination of these Terms: Section 1 (Definitions); Section 5.2 (Ownership of Company IP); Section 5.4 (Restrictions); Section 7 (Payments — with respect to outstanding obligations); Section 8 (Deliverables); Section 9.5 (Responsibility for Content); Section 11 (Disclaimers); Section 13 (Limitation of Liability); Section 14 (Indemnification); Section 17 (Confidentiality); Section 18 (AI Disclosures); Section 19 (Company Methodology); Section 20.4 (Effect of Termination); Exhibit B (Data Processing Addendum), for so long as the Company or any Sub-Processor retains personal data processed on Client's behalf; Section 20.5 (Survival); Section 21 (Dispute Resolution); and Section 22 (General Provisions).

SECTION 21. DISPUTE RESOLUTION

21.1 Governing Law

These Terms and all claims, disputes, or controversies arising out of or relating to these Terms, the Site, or the Services (including claims based on contract, tort, statute, or any other legal or equitable theory) shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles.

21.2 Informal Resolution

Before initiating any arbitration or legal proceeding, the party seeking to resolve a dispute shall provide the other party with written notice describing the nature and basis of the claim and the specific relief sought (a "Dispute Notice"). The parties shall attempt in good faith to resolve the dispute informally for a period of thirty (30) days after delivery of the Dispute Notice. If the dispute is not resolved within that thirty (30)-day period (or such longer period as the parties may agree), either party may initiate arbitration in accordance with Section 21.3.

21.3 Mandatory Binding Arbitration

EXCEPT AS PROVIDED IN SECTIONS 21.5 AND 21.6, ANY AND ALL DISPUTES, CLAIMS, OR CONTROVERSIES ARISING OUT OF OR RELATING TO THESE TERMS, THE SITE, OR THE SERVICES THAT ARE NOT RESOLVED THROUGH INFORMAL RESOLUTION PURSUANT TO SECTION 21.2 SHALL BE RESOLVED EXCLUSIVELY THROUGH FINAL AND BINDING ARBITRATION, RATHER THAN IN COURT. YOU MAY OPT OUT OF THIS ARBITRATION PROVISION BY SENDING WRITTEN NOTICE TO THE COMPANY WITHIN THIRTY (30) DAYS OF FIRST ACCEPTING THIS AGREEMENT, INCLUDING YOUR FULL NAME, EMAIL, AND A CLEAR STATEMENT OF INTENT TO OPT OUT.

Arbitration shall be conducted by JAMS (https://www.jamsadr.com) pursuant to its Comprehensive Arbitration Rules and Procedures (or, if applicable, its Streamlined Arbitration Rules and Procedures), as in effect at the time of the arbitration. The arbitration shall be conducted by a single neutral arbitrator. If the parties cannot agree on an arbitrator within fifteen (15) days after initiation of arbitration, JAMS shall appoint one pursuant to its rules.

21.4 Arbitration Procedures

Arbitration hearings will be conducted in the State of Delaware, or at such other location as the parties may agree, or by telephone or video conference. The arbitrator shall have authority to award the same remedies, including injunctive and declaratory relief that a court of competent jurisdiction could award. Discovery shall be limited in accordance with JAMS rules, with an emphasis on efficient resolution. The arbitrator's decision shall be in writing and shall be final and binding. Judgment on the award may be entered in any court of competent jurisdiction. The costs of arbitration shall be allocated in accordance with JAMS rules; each party shall bear its own attorneys' fees except as the arbitrator may otherwise award pursuant to applicable law.

21.5 Class Action Waiver

CLIENT WAIVES ANY RIGHT TO BRING OR PARTICIPATE IN ANY CLASS ACTION, COLLECTIVE ACTION, OR REPRESENTATIVE ACTION — WHETHER IN COURT OR IN ARBITRATION — AGAINST THE COMPANY. ALL CLAIMS MUST BE BROUGHT IN CLIENT'S INDIVIDUAL CAPACITY. CLIENT FURTHER WAIVES ANY RIGHT TO A JURY TRIAL. IF THIS CLASS ACTION WAIVER IS FOUND UNENFORCEABLE, THEN THE ARBITRATION PROVISION SHALL NOT APPLY, AND ANY DISPUTE SHALL BE RESOLVED IN A COURT OF COMPETENT JURISDICTION.

21.6 Small Claims Court Exception

Notwithstanding the foregoing, either party may bring a qualifying claim in small claims court in the county or state where the Company's principal place of business is located, provided that the claim remains in small claims court and is not transferred or appealed to a court of general jurisdiction.

21.7 Venue and Jurisdiction

For any disputes not subject to arbitration (including disputes arising from the invalidity of the arbitration clause, challenges to an arbitral award, or actions to enforce an arbitral award), the parties irrevocably consent to the exclusive jurisdiction of the state and federal courts located in the State of Delaware, and each party waives any objection to venue or personal jurisdiction in such courts.

21.8 Injunctive Relief

Notwithstanding the foregoing, either party may seek emergency injunctive or other equitable relief in any court of competent jurisdiction to protect such party's Intellectual Property Rights or Confidential Information pending the outcome of arbitration.

SECTION 22. INDEPENDENT CONTRACTOR

The Company is an independent contractor of Client. Nothing in these Terms shall be construed to create a partnership, joint venture, agency, employment, or fiduciary relationship between the parties.

SECTION 23. ACCESSIBILITY

The Company is committed to making the Site accessible to individuals with disabilities and endeavors to comply with applicable accessibility standards, including the Web Content Accessibility Guidelines (WCAG) published by the World Wide Web Consortium (W3C) and applicable requirements under Title III of the Americans with Disabilities Act ("ADA") and applicable state accessibility laws. If you encounter an accessibility barrier on the Site, please notify the Company at [email protected] and the Company will make commercially reasonable efforts to address the issue.

SECTION 24. GENERAL PROVISIONS

24.1 Entire Agreement

These Terms, together with the Privacy Policy, Exhibit A (Sub-Processor List), Exhibit B (Data Processing Addendum), and any Order, engagement agreement, or statement of work applicable to the engagement, constitute the entire agreement between Client and the Company regarding the Services and supersede all prior and contemporaneous agreements, representations, and understandings, whether oral or written, relating to the subject matter hereof.

24.2 Order of Precedence

In the event of a conflict between documents governing an engagement, the following order of precedence applies (highest precedence first): (a) any signed engagement agreement or statement of work between the parties; (b) the applicable Order, order confirmation, or invoice; (c) these Terms; and (d) the Privacy Policy. A more specific document controls over a more general document on the same subject. Notwithstanding the foregoing, with respect to the processing of personal data that the Company processes as Client's processor, Exhibit B (Data Processing Addendum) prevails over all of the foregoing documents, except for a signed agreement that expressly states it is intended to amend Exhibit B.

24.3 Severability

If any provision of these Terms is held by a court or arbitrator of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, or if modification is not possible, severed from these Terms, and the remaining provisions shall continue in full force and effect.

24.4 Waiver

No failure or delay by either party to exercise any right or remedy under these Terms shall constitute a waiver of that right or remedy. No waiver of any breach shall be construed as a waiver of any subsequent breach or as a modification of these Terms.

24.5 Assignment

Client may not assign or transfer any of its rights or obligations under these Terms without the Company's prior written consent. The Company may assign these Terms, in whole or in part, to any affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, with or without notice to Client. Any purported assignment by Client in violation of this Section is null and void.

24.6 Electronic Consent and Recordkeeping

Client consents to receive communications from the Company electronically, including by email and through the Site. Client agrees that electronic communications satisfy any legal requirement that communications be in writing. The Company retains time stamped logs of Client's acceptance of these Terms, including the version accepted, date and time of acceptance, and relevant identifying information. These logs constitute the authoritative record of acceptance.

24.7 Amendments

No amendment to these Terms is effective unless made in writing and signed by an authorized representative of each party.

24.8 Counterparts; Electronic Signatures

Any Order or engagement agreement under these Terms may be executed in one or more counterparts, each of which shall be an original, and all of which together shall constitute one instrument. Electronic signatures (including DocuSign or similar platforms) shall be deemed original signatures for all purposes.

24.9 Contact Information

Questions, notices, and communications regarding these Terms should be directed to:

AI Find My Business, Inc.

Location: Alachua, FL, United States

Website: https://aifindmybusiness.com

Email: [email protected]

Phone: +1 (386) 266-3983

EXHIBIT A — SUB-PROCESSOR LIST

This Exhibit is incorporated into and forms part of the AI Find My Business Terms of Service. The content of this Exhibit may be updated by the Company without re-issuance of the Terms of Service, provided that the Company posts the updated version at the URL referenced in the body of the Terms and gives advance notice of new Sub-Processors as described below.

This Exhibit A sets forth the AI Sub-Processors and Operational Sub-Processors that the Company currently engages to assist in the production of Deliverables, to serve as the subject of measurement in connection with the Services, or to operate the Site and the Services. This list is a living document and may be updated by the Company from time to time without re-issuance of the Terms of Service. The current, authoritative version of this Exhibit is maintained at: https://aifindmybusiness.com/ai-subprocessors (or such other URL as the Company may designate). It also serves as Annex III (Sub-Processors) to Exhibit B (Data Processing Addendum).

Advance Notice of New Sub-Processors; Right to Object

The Company will give at least fifteen (15) days' advance notice before any new AI Sub-Processor or Operational Sub-Processor begins processing Client Data, by posting the change on this page (including the date on which the new Sub-Processor will begin processing) and by email to the email address associated with each Client's Account. A Client may object to a new Sub-Processor on reasonable data-protection grounds by emailing [email protected] before the end of the notice period, as described in Section 18.4 of the Terms of Service.

Current AI Sub-Processors (as of the Effective Date of these Terms)

The following providers are used as tools in the production of Deliverables and/or as the subject of measurement in the AI Visibility Audit:

Operational Sub-Processors

The following providers support core business operations. They are not used for AI prompt testing and are not the subject of measurement in the AI Visibility Audit. Providers marked "Site visitors only" process data about visitors to the Site for analytics or advertising measurement and do not process Client Data under Exhibit B; they are listed for transparency.

The above lists identify the Sub-Processors engaged as of the date of this Exhibit. The Company may add, modify, or remove Sub-Processors by updating this Exhibit, subject to the advance-notice and objection process described above. Clients with specific concerns regarding Sub-Processor usage may contact the Company at [email protected] prior to engagement commencement.

EXHIBIT B — DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") is incorporated into and forms part of the AI Find My Business Terms of Service (the "Terms") between the Company and Client. Capitalized terms not defined in this DPA have the meanings given in the Terms.

1. Scope, Roles, and Precedence

1.1 Applicability. This DPA applies where Client's use of the Services involves the Company processing personal data on Client's behalf that is subject to the EU General Data Protection Regulation (EU) 2016/679 (the "GDPR"), the GDPR as it forms part of the law of the United Kingdom together with the UK Data Protection Act 2018 (the "UK GDPR"), or the Swiss Federal Act on Data Protection (the "FADP") (together, "Data Protection Laws"). Such personal data is "Client Personal Data."

1.2 Roles. With respect to Client Personal Data, Client is the controller (or a processor acting on behalf of its own controller) and the Company is Client's processor (or sub-processor, as applicable). The terms "controller," "processor," "data subject," "personal data," "personal data breach," "processing," and "supervisory authority" have the meanings given in the applicable Data Protection Laws.

1.3 Company as Controller. This DPA does not apply to personal data that the Company processes as a controller for its own purposes, such as Account administration, billing, security, the Company's own marketing, and analytics on the Site. That processing is described in the Privacy Policy.

1.4 Precedence. With respect to the processing of Client Personal Data, this DPA prevails over any conflicting provision of the Terms, the Privacy Policy, or any Order. Where the Standard Contractual Clauses apply under Section 9, they prevail over this DPA to the extent of any conflict.

2. Processing on Documented Instructions

2.1 The Company will process Client Personal Data only on Client's documented instructions, including with regard to transfers of Client Personal Data to a third country, unless required to do so by applicable law to which the Company is subject; in that case, the Company will inform Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Client's documented instructions are the Terms (including this DPA), any Order, Client's use and configuration of the Services, and any other written instructions that Client gives and the Company accepts.

2.2 The Company will immediately inform Client if, in its opinion, an instruction infringes Data Protection Laws.

2.3 Client is responsible for the lawfulness of the instructions it gives, for having a lawful basis for the processing, and for providing any notices to, and obtaining any consents from, data subjects that Data Protection Laws require.

3. Confidentiality of Personnel

The Company will ensure that persons it authorizes to process Client Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Sub-Processors

4.1 General Authorization. Client gives the Company a general written authorization to engage Sub-Processors to process Client Personal Data. The Sub-Processors engaged as of the effective date of this DPA are listed at https://aifindmybusiness.com/ai-subprocessors, which forms Annex III to this DPA.

4.2 Notice and Objection. The Company will give Client at least fifteen (15) days' advance notice of any intended addition or replacement of a Sub-Processor, and Client may object, in each case as described in Section 18.4 of the Terms and on the Exhibit A page.

4.3 Sub-Processor Terms. The Company will engage each Sub-Processor under a written contract that imposes data protection obligations that provide at least the same level of protection for Client Personal Data as this DPA, to the extent applicable to the nature of the services the Sub-Processor provides.

4.4 Responsibility. The Company remains responsible to Client for the performance of each Sub-Processor's data protection obligations as they relate to Client Personal Data.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk to the rights and freedoms of natural persons, the Company will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR (and the equivalent provisions of the UK GDPR and the FADP). The measures in place as of the effective date of this DPA are described in Annex II. The Company may update those measures, provided that updates do not materially decrease the overall level of protection of Client Personal Data.

6. Assistance to Client

6.1 Data Subject Requests. Taking into account the nature of the processing, the Company will assist Client by appropriate technical and organizational measures, insofar as possible, in fulfilling Client's obligation to respond to requests from data subjects to exercise their rights under Data Protection Laws. If the Company receives such a request directly and the request identifies Client, the Company will promptly forward it to Client and will not respond to it other than to direct the data subject to Client, unless Client instructs otherwise or applicable law requires otherwise.

6.2 Personal Data Breach. The Company will notify Client without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects; where it is not possible to provide all of this information at the same time, the Company will provide it in phases without undue further delay. The Company will take reasonable steps to contain and remediate the breach and will provide Client with reasonable cooperation to enable Client to meet its own notification obligations. Notification of a breach is not an acknowledgment of fault or liability.

6.3 Security, Impact Assessments, and Consultations. Taking into account the nature of the processing and the information available to the Company, the Company will provide Client with reasonable assistance in ensuring compliance with Client's obligations under Articles 32 to 36 of the GDPR (and the equivalent provisions of the UK GDPR and the FADP), including with respect to security, notification of personal data breaches, data protection impact assessments, and prior consultation with supervisory authorities.

7. Deletion or Return at the End of the Services

At the end of the provision of the Services, the Company will, at Client's choice, delete or return Client Personal Data, as follows. Client may make its choice by written request to [email protected] within thirty (30) days after termination or expiration of the Services; if Client does not make a choice within that period, the Company will delete Client Personal Data within ninety (90) days after termination or expiration. Returned data will be provided in a commonly used electronic format. These obligations do not apply to Client Personal Data that the Company is required to retain by applicable law, which the Company will continue to protect in accordance with this DPA and will process only for the purpose of complying with that law, or to copies held in backup systems, which are deleted in the ordinary course of backup rotation and are not otherwise accessed. This Section 7 is consistent with, and for Client Personal Data governs, Section 20.4 of the Terms.

8. Information and Audits

8.1 Information. The Company will make available to Client the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR (and the equivalent provisions of the UK GDPR and the FADP), including by responding to a reasonable written security and privacy questionnaire, providing relevant documentation of its technical and organizational measures and its Sub-Processors, and, where available, summaries of Sub-Processors' third-party security certifications or audit reports. Unless required by a supervisory authority or following a personal data breach affecting Client Personal Data, Client may request this information no more than once in any twelve (12) month period.

8.2 On-Site Audits. The Company will allow for and contribute to an on-site audit or inspection of its processing of Client Personal Data, conducted by Client or by an independent auditor mandated by Client and bound by confidentiality obligations, only where such an audit is required by a supervisory authority or follows a personal data breach affecting Client Personal Data. Client must give at least thirty (30) days' prior written notice (or shorter notice where a supervisory authority requires it), and the audit will be conducted during normal business hours, in a manner that minimizes disruption to the Company's business, and at Client's expense.

8.3 Standard Contractual Clauses. Nothing in this Section 8 limits any audit right that Client has under the Standard Contractual Clauses where they apply.

9. International Transfers

9.1 Location of Processing. The Company processes Client Personal Data in the United States. The Company's Sub-Processors may process Client Personal Data in the locations listed in Annex III.

9.2 EU Standard Contractual Clauses. To the extent that Client's provision of Client Personal Data to the Company is a transfer of personal data subject to the GDPR to a country that has not been found to provide an adequate level of protection, the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 (the "Standard Contractual Clauses" or "SCCs") are incorporated into this DPA by reference and apply as follows: (a) Module Two (controller to processor) applies where Client is a controller, and Module Three (processor to processor) applies where Client is a processor; (b) the optional docking clause in Clause 7 does not apply; (c) for Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in Section 4.2 of this DPA; (d) the optional language in Clause 11(a) does not apply; (e) for Clause 13, the competent supervisory authority is determined in accordance with Clause 13(a); (f) for Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; (g) for Clause 18(b), disputes will be resolved before the courts of Ireland; and (h) Annex I of the SCCs is completed by Annex I of this DPA, Annex II of the SCCs by Annex II of this DPA, and Annex III of the SCCs by Annex III of this DPA.

9.3 United Kingdom. To the extent that Client's provision of Client Personal Data to the Company is a restricted transfer under the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the "UK Addendum") is incorporated into this DPA by reference and applies to that transfer. Tables 1 to 3 of the UK Addendum are completed by the information in Section 9.2 and Annexes I to III of this DPA, and for Table 4, either party may end the UK Addendum as set out in its Section 19.

9.4 Switzerland. To the extent that Client's provision of Client Personal Data to the Company is a transfer subject to the FADP to a country that has not been found to provide an adequate level of protection, the SCCs apply as set out in Section 9.2, with the following amendments: (a) the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority insofar as the transfer is governed by the FADP; (b) references to a "Member State" include Switzerland, so that data subjects in Switzerland may bring claims in their place of habitual residence; and (c) references to the GDPR are understood as references to the FADP insofar as the transfer is governed by the FADP.

9.5 Onward Transfers. Where the Company transfers Client Personal Data to a Sub-Processor in a country that has not been found to provide an adequate level of protection, the Company will rely, as applicable to that Sub-Processor, on the mechanisms described in Section 10.6 of the Privacy Policy.

10. Liability

Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Terms, to the extent permitted by Data Protection Laws. Nothing in this Section 10 limits the rights of data subjects under the Standard Contractual Clauses.

11. Term

This DPA remains in effect for as long as the Company processes Client Personal Data, including after termination of the Terms until the deletion or return of Client Personal Data under Section 7 is complete.

Annex I — Description of the Processing

Parties. Data exporter: Client, as identified in Client's Account or Order, acting as controller (or as processor on behalf of its controller); contact details are those associated with Client's Account. Data importer: AI Find My Business, Inc., Alachua, FL, United States ([email protected]), acting as processor (or sub-processor).

Subject Matter. The provision of the Services to Client under the Terms.

Duration. The term of the Terms, plus the period until deletion or return of Client Personal Data under Section 7 of this DPA.

Nature of the Processing. Collection, recording, organization, storage, retrieval, analysis, consultation, transmission to Sub-Processors, and deletion of Client Personal Data as needed to perform the Services, including accessing Client-authorized systems and producing and delivering Deliverables.

Purpose of the Processing. To provide and support the Services for Client, including AI visibility audits, improvement plans, subscription monitoring and reporting, the Client dashboard, managed implementation where purchased, and related support and communications.

Categories of Data Subjects. (a) Client's owners, employees, contractors, and Authorized Users; (b) individuals named in business information that Client provides or that the Services analyze on Client's behalf (for example, staff or practitioners named on Client's website or business listings); and (c) where Client grants the Company access to its analytics, search console, advertising, customer relationship management, or similar systems, the individuals whose data is held in those systems, such as visitors to Client's websites and Client's customers and leads.

Categories of Personal Data. (a) Contact and professional details, such as name, job title, business email address, and business telephone number; (b) Account and authentication data for Authorized Users; (c) business information that relates to an identifiable individual, such as information about a sole proprietor's business; and (d) data held in Client-authorized systems, which may include online identifiers, website usage and conversion data, approximate location, and customer or lead records (such as names, contact details, and lead status).

Special Categories of Data. None. Client must not provide special categories of personal data, and the Services are not designed to process them (see Sections 4.7 and 9.3 of the Terms).

Frequency of the Transfer. Continuous, for the duration of the Services.

Retention. As set out in Section 7 of this DPA.

Transfers to Sub-Processors. For the subject matter, nature, and duration described above, to the Sub-Processors listed in Annex III.

Competent Supervisory Authority. As determined in accordance with Clause 13 of the Standard Contractual Clauses, Section 9.3 (for the UK Information Commissioner), or Section 9.4 (for the Swiss Federal Data Protection and Information Commissioner).

Annex II — Technical and Organizational Measures

The Company maintains the following measures as of the effective date of this DPA:

Encryption in Transit. The Site and the Client dashboard are served only over HTTPS (TLS) through the Company's hosting provider, and the Company's backend application is configured to require HTTPS.

Encryption at Rest. Client Personal Data stored with the Company's hosting, database, and file-storage providers is encrypted at rest by those providers as part of their services.

Client Authentication and Access Scoping. Client dashboard accounts are authenticated through the Company's authentication provider (Clerk). Requests to dashboard and account endpoints must present a signed session token that is verified on each request, and access to Client records is scoped to the organization associated with the authenticated user.

Internal Access Control. Access to Client Personal Data is limited to Company personnel who need it to provide the Services. Administrative functions (such as reviewing intakes) are restricted to authenticated members of the Company's administrative organization in its authentication provider.

Secrets Management. API keys and other credentials are kept out of source code and are stored in a password manager and in the secret stores of the Company's hosting providers.

Logging. The Company records key application events (such as intake submissions and administrative approvals) in an application event log, and its hosting providers maintain platform logs.

Data Minimization for AI Sub-Processors. The Company limits the information submitted to AI Sub-Processors as described in Section 2.7.2 of the Privacy Policy.

Vendor Due Diligence. The Company reviews the security and data protection terms of its Sub-Processors before engaging them and engages them under written terms as described in Section 4.3 of this DPA.

Breach Response. The Company investigates security incidents and notifies Client of personal data breaches as described in Section 6.2 of this DPA.

Annex III — Sub-Processors

The Sub-Processors authorized under this DPA, including their functions and locations, are those listed in Exhibit A to the Terms, as maintained at https://aifindmybusiness.com/ai-subprocessors, which is incorporated into this Annex III by reference and updated in accordance with Section 4 of this DPA.