Terms of Service

These Terms of Service ("Terms") form a binding legal agreement between you ("you," "Customer," or "Enterprise") and Penusila Digital Solutions LLC ("DAF Connect," "we," "us," or "our"), governing your access to and use of the DAF Connect platform, including our website at daf-connect.com, the reviewer dashboard, the embeddable intake widget, our backend APIs, scheduled automations, and any related documentation, tools, demos, or services (collectively, the "Service").

By creating an account, embedding our intake widget, accessing the reviewer dashboard, invoking our APIs, or otherwise using any part of the Service, you acknowledge that you have read, understood, and agree to be bound by these Terms and by our Privacy Policy. If you do not agree, you must not use the Service.

If you are entering into these Terms on behalf of an organization (such as your employer or a corporate foundation), you represent and warrant that (a) you have full legal authority to bind that organization to these Terms, (b) you have read these Terms, and (c) you agree to these Terms on behalf of the organization. In that case, "you" and "Customer" refer to that organization.

A separate written Master Subscription Agreement or Order Form ("Order"), or Data Processing Addendum, executed between you and DAF Connect may modify or supersede portions of these Terms. An SLA is incorporated only when expressly adopted in your signed Order with its approved service-credit schedule, covered services, and effective date (an "Effective SLA"). The proposed SLA published at /sla is a draft requiring business and legal approval; publication alone does not activate coverage or amend an existing Order. Conflicts are resolved under Section 20. Marketing and in-product copy do not expand the agreed coverage.

DAF Connect is a software-as-a-service platform that helps enterprises (including corporate philanthropy programs, donor-advised fund sponsors, family offices, and grantmakers) intake, verify, and review non-profit organizations applying to receive grants, sponsorships, or other support.

The Service includes, without limitation:

• An embeddable iframe widget that you can place on your own website to collect non-profit intake applications under your brand and domain. • A multi-step onboarding flow that may collect organizational identity (legal name, DBA, EIN, address, website, mission), leadership and board information, financials, programs, custom intake questions, and supporting documents. • Integrations with third-party verification providers, including Stripe Connect (organization / tax-ID verification), Stripe Financial Connections (bank account ownership), Stripe Identity (signer identity), the IRS Publication 78 / Business Master File / Tax Exempt Organization Search, the U.S. Treasury OFAC Specially Designated Nationals list, and ProPublica Nonprofit Explorer. • Additional screening and fraud-intelligence features, including federal debarment / exclusion screening (SAM.gov and the HHS OIG LEIE), federal-award history (USAspending), adverse-media screening, IRS Form 990 financial forensics, continuous drift and behavioral-velocity monitoring, and — for donor-advised-fund workflows — grant-request controls such as disqualified-person testing and privacy-preserving advisor-to-officer matching. • A cross-tenant fraud-detection graph, a shared negative file of verified-fraud identifiers (built, not yet in use), and related ring-detection features that match certain identifiers across applications and across enterprise workspaces using keyed hashes. Whether a confirmed ring match shows your applicants' organization names in the clear to other workspaces — or anonymized — is your workspace's own name-sharing setting (on by default, changeable in your settings); full bank-account numbers and the identity of the other enterprise workspace are never disclosed (see Section 8 and the Privacy Policy). • A human-verification challenge (Cloudflare Turnstile) and anti-abuse controls on public forms, including automatic temporary lock-out of connections that repeatedly fail or evade the challenge and a per-tenant-visible ledger of blocked attempts. • An in-product bug-and-issue reporting section for your Authorized Users. • Automated risk and trust scoring derived from heuristics, the results of third-party verification, drift detection across data sources, and (where enabled) AI-assisted document and submission review. • Document handling, including upload, malware scanning via VirusTotal, signed-URL retrieval, and reviewer-side annotation. • A reviewer dashboard with workflow status, internal notes, email correspondence with applicants, decisioning, granular per-member feature permissions, and an append-only audit log. • Per-tenant AES-256-GCM encryption for designated sensitive fields, role-based access controls, and tenant-scoped row-level security.

The Service is provided on a hosted basis only. We do not ship on-premise software. We may add, modify, or remove features at any time, provided that we will not materially degrade the core functionality of any plan you have paid for during your then-current subscription term without providing notice and, where appropriate, a refund or credit.

What the Service is not. DAF Connect is a workflow and verification tool. We are not your lawyer, accountant, banker, tax advisor, compliance officer, or fiduciary. The Service does not (a) decide who to fund, (b) transfer grant or donation funds or settle charitable disbursements, (c) provide legal, tax, accounting, or investment advice, (d) constitute an opinion on whether any organization meets your due-diligence, OFAC, anti-terrorism financing, anti-money laundering, IRS Section 4945 expenditure responsibility, or other regulatory obligations, or (e) guarantee that any organization is a bona fide 501(c)(3) or that any data we surface is current, complete, or correct. We do collect our own platform service fees through payment-provider integrations. Workflow recommendations or payment-risk decisions do not establish that grant funds have moved. You retain sole responsibility for all decisions made using the Service.

To use the Service as an enterprise customer, you must be at least 18 years old, legally capable of forming a binding contract, and not barred from receiving the Service under U.S. law or the law of any other applicable jurisdiction. The Service is intended for use by organizations and personnel acting in a professional capacity, not for personal or consumer use.

You agree to (a) provide accurate, current, and complete information during registration and keep it current, (b) safeguard your authentication credentials and any API keys, public embed keys, or webhook secrets we issue, (c) not share your account with any other person or allow any unauthorized party to access the Service through your account, (d) be responsible for all activity that occurs under your account, and (e) notify us promptly at information@daf-connect.com if you suspect any unauthorized access or security incident.

You are responsible for the acts and omissions of your "Authorized Users" — employees, contractors, agents, advisors, or other personnel that you invite to your enterprise workspace. You must ensure each Authorized User has accepted and complies with these Terms.

We reserve the right to refuse service, terminate accounts, suspend access, or remove or edit content at our discretion, including without limitation if we believe a user has violated these Terms, has engaged in fraudulent or harmful conduct, or has put the Service or other customers at risk.

Enterprise Customer. You are the entity that has purchased or been provisioned access to a DAF Connect workspace and that operates the intake program. With respect to non-profit applicant data submitted to your workspace through the intake widget, you are the "controller" (under GDPR-style terminology) or "business" (under California law).

Non-Profit Applicant. The non-profit organization completing the intake form is providing data to your enterprise so that you can evaluate it. Although DAF Connect's interface is presented to the applicant, the applicant's relationship is fundamentally with you. You are responsible for displaying any notices, obtaining any consents, and honoring any rights that applicants may have under applicable law in connection with your collection and use of their data.

DAF Connect. We act as a "processor" or "service provider" for the applicant data your workspace collects. We process that data on your documented instructions (including the configuration of your workspace, the verification features you enable, and these Terms) and only for the purposes set out in the Privacy Policy and any Data Processing Addendum.

DAF Connect also operates the underlying platform, including security, hosting, fraud detection, audit logging, and aggregated analytics (without applicant-identifiable data) for service improvement. For that activity, DAF Connect acts as a controller with respect to a limited set of operational and account data (e.g. your Authorized Users' login records).

If you require a signed Data Processing Addendum (including EU Standard Contractual Clauses or UK addendum, where applicable), contact information@daf-connect.com. The Service is hosted in the United States and is not intended for use as a primary processing system for data subject to mandatory non-U.S. residency requirements.

You agree not to, and not to permit any Authorized User or third party to:

(a) use the Service to collect data under false pretenses, including misrepresenting which enterprise an applicant is applying to or what the data will be used for; (b) use the Service to discriminate against any applicant on the basis of any characteristic protected by applicable law, or to facilitate any activity that is unlawful, fraudulent, deceptive, defamatory, harassing, threatening, obscene, or hateful; (c) use the Service to process data for purposes unrelated to non-profit onboarding, verification, due diligence, grants management, or compliance review; (d) use the Service to support transactions with persons or entities on the OFAC SDN, Consolidated Screening List, EU sanctions lists, UK sanctions lists, or any other applicable sanctions list, or in any jurisdiction subject to comprehensive U.S. sanctions; (e) attempt to access, probe, or test the vulnerability of any system or network owned or operated by DAF Connect or any other customer's workspace, or attempt to bypass security, authentication, rate limiting, row-level security, encryption, public-key scoping, or audit-logging mechanisms; (f) reverse engineer, decompile, disassemble, scrape, mirror, or attempt to derive the source code of the Service, except to the extent this restriction is prohibited by law; (g) resell, sublicense, white-label, time-share, or operate a service bureau on top of the Service without our prior written consent; (h) use the Service in violation of any applicable law, including U.S. federal, state, and local laws, export control laws (including the Export Administration Regulations), and laws of the jurisdiction in which any applicant or Authorized User is located; (i) interfere with or disrupt the integrity or performance of the Service, including by transmitting malware, conducting denial-of-service attacks, or sending automated traffic that exceeds documented rate limits; (j) submit, upload, or transmit through the Service any content that (i) you do not have the right to submit, (ii) infringes any intellectual property, privacy, publicity, or other right of any person, or (iii) contains protected health information ("PHI") under HIPAA, payment card data subject to PCI-DSS (other than what is processed through Stripe under Stripe's own contracts), classified information, or special categories of personal data under GDPR Article 9 unless explicitly agreed in writing with us; (k) use the Service to train a competing artificial intelligence or machine learning model, or to benchmark, copy, or replicate the Service's features; (l) impersonate any person, misrepresent your affiliation, or remove or alter any proprietary notices or labels.

We may investigate suspected violations and may, without notice, suspend or terminate access, remove or modify content, and cooperate with law enforcement. You will indemnify us for any losses arising from your violation of this section, as set out in Section 12.

As part of the Service, we provide an iframe-based intake widget that you may embed on your own website using a public embed key issued to your workspace. The widget collects applicant information and delivers it to your workspace.

You are responsible for (a) the websites and domains on which you embed the widget, (b) maintaining an accurate domain allowlist in your workspace settings so the widget is not abused on third-party sites, (c) presenting the widget in a context where the applicant clearly understands they are submitting an application to your organization, (d) displaying your own privacy notice on the embedding page and obtaining any consents required by applicable law for the data you collect and the verification activities you enable (including, where applicable, consent to identity, EIN, and bank ownership verification via Stripe), (e) any branding, copy, intro text, or success message you configure, and (f) not embedding the widget in a manner that materially alters its behavior or attempts to capture, intercept, or modify data flowing through it.

The public embed key is scoped to your enterprise's data and your domain allowlist. It is not a secret in the cryptographic sense, but it is the credential under which applicants' data is associated with your workspace. You must not reuse it across workspaces, share it with parties outside your organization, or publish it in a way that would allow unauthorized embedding (for example, in a public code repository unrelated to your live deployment).

We may, at our discretion and after reasonable notice, rotate, scope, rate-limit, or invalidate embed keys we believe are being misused.

The Service depends on, and where you enable certain features will send applicant data to, the following third-party providers ("Sub-Processors" and "Third-Party Services"):

• Stripe, Inc. — used for organization / tax-ID verification (Stripe Connect), bank ownership verification (Stripe Financial Connections), and signer identity verification (Stripe Identity). • The United States Internal Revenue Service — used to look up Publication 78 / Business Master File / Tax Exempt Organization Search records by EIN. • The U.S. Department of the Treasury, Office of Foreign Assets Control — used to screen against the Specially Designated Nationals list and other sanctions sources. • The U.S. General Services Administration (SAM.gov) and the U.S. Department of Health and Human Services Office of Inspector General (LEIE) — used for federal debarment / exclusion screening; and USAspending.gov — used for federal-award history. • Cloudflare, Inc. — used for the human-verification challenge (Turnstile) on public forms and for network-layer security; and an IP-geolocation provider (ip-api.com) — used to classify the location and VPN / proxy / hosting status of an IP address. • Klaw — used for dark-web, surface-web, breach-exposure, and PEP screening of contact identities. • ProPublica, Inc. — used to enrich organizational data via the Nonprofit Explorer API. • CharityAPI.org — used to corroborate IRS registry data (Publication 78 listing and deductibility) and to search nonprofit names by EIN and organization name. • GIACT (part of LSEG Risk Intelligence) — where enabled for your workspace, an alternative verification rail for bank-account ownership, business identity with an IRS TIN match, signer identity, and sanctions screening. Until production credentials are issued, requests go to GIACT's sandbox environment and its results are labelled as sandbox results and are not authoritative. • VirusTotal (Google LLC) — used to perform malware scanning on uploaded documents. Document hashes and/or files may be submitted to VirusTotal in accordance with their terms. • Resend, Inc. — used to deliver transactional email. • Functional Software, Inc. (Sentry) — used on every page of the Service for error, crash and performance monitoring. When the application crashes or encounters an error, and for a sample of page loads, Sentry receives a technical report (error message, stack trace, page address, browser, operating system and device details, a breadcrumb trail of recent in-app activity and network requests, timing data, and the sending connection's IP address) so we can diagnose and fix defects. No account name, email or ID is attached, and session replay (screen recording) is not used. By using the Service you and your Authorized Users acknowledge this monitoring, which is described in full in the Privacy Policy. • Federated sign-in providers — used for "Sign in with Apple" (Apple Inc.), "Sign in with Facebook" (Meta Platforms, Inc.), "Sign in with Google" (Google LLC), and "Sign in with Microsoft" (Microsoft Corporation / Microsoft Entra ID) OAuth and OpenID Connect authentication where enabled. Your use of any federated sign-in method is also subject to that provider's own terms and privacy policy. • Base44 — the application platform used for hosting, database, file storage, authentication, and function execution. Base44 in turn runs on cloud infrastructure of its own choosing, which is its sub-processor rather than ours. • Such other large-language-model and AI providers as we may use (where AI verification is enabled for your workspace) to assist reviewers with summary and risk-flagging tasks.

We describe certain further verification vendors on our public site as forthcoming (for example, Secretary-of-State registry data, additional TIN / entity matching, document-forgery forensics, and address-type verification). Those vendors are not active and receive no data until we enable them.

Use of these Third-Party Services is governed by those providers' own terms and privacy policies. You agree to comply with any pass-through obligations they impose. To the maximum extent permitted by applicable law, we are not responsible for a third party's independent acts, omissions, data accuracy, or pricing to the extent outside our reasonable control. This does not excuse our own acts or omissions or override an Effective SLA. A third-party outage is not automatically excluded from SLA downtime: only the exclusions expressly stated in the Effective SLA apply, and our hosting or infrastructure dependency alone is not an exclusion. If a Third-Party Service becomes unavailable, modifies its API, changes its data, or terminates a relevant feature, we may suspend, modify, or remove the corresponding feature, subject to Section 2's paid-core-functionality protections, the Effective SLA, and applicable law. We will use commercially reasonable efforts to give advance notice where practicable and mitigate the disruption.

Where you enable AI verification, you acknowledge that AI output may be incomplete, biased, or incorrect; that you remain solely responsible for any decision made by your team that is informed by AI output; and that you will independently verify AI-surfaced conclusions before relying on them for any consequential decision.

"Customer Data" means all data, content, files, configuration, and information you, your Authorized Users, or applicants submit to or generate within your workspace, including organizational records, submissions, documents, internal notes, email correspondence, verification results, audit log entries, and configuration data.

As between you and us, you own all right, title, and interest in and to your Customer Data. You grant us, our Sub-Processors, and our service providers a worldwide, non-exclusive, royalty-free license to host, copy, transmit, display, modify (only as required to render the Service), store, back up, encrypt, and otherwise process Customer Data solely to (a) provide, secure, monitor, and improve the Service for you, (b) prevent or address service, security, technical, or fraud issues, (c) comply with applicable law or valid legal process, and (d) perform the activities described in our Privacy Policy.

You represent and warrant that (i) you have all rights, consents, and authority necessary to submit Customer Data and to grant us the license above, (ii) Customer Data and your use of the Service comply with applicable law, (iii) any applicant whose data you submit has received any notices and given any consents required for the verification activities you enable, and (iv) Customer Data does not include categories of data prohibited under Section 5(j) unless we have agreed in writing.

We will not access Customer Data except (a) as necessary to provide and support the Service, (b) as you direct (including through your workspace configuration), (c) for security, fraud prevention, abuse prevention, debugging, and compliance, or (d) as required by law. Our personnel access to Customer Data is on a least-privilege basis and is logged.

Aggregated, de-identified, and statistical data derived from Customer Data may be used by us to operate, improve, and benchmark the Service, develop new features, and prepare aggregated reports, provided that such data does not identify you, any applicant, or any natural person.

Cross-tenant fraud intelligence. You acknowledge and agree that, to operate the fraud-detection graph, related ring-detection features and — once it is in use — the shared negative file, we compute keyed hashes of certain identifiers within Customer Data (such as officer and board names, addresses, bank-account fingerprints, device and IP fingerprints, and grant-fund-advisor identities) and match those hashes across enterprise workspaces, including yours. Matching is performed on hashed values; when a match is confirmed, what it reveals is governed by each workspace's own name-sharing setting: if your workspace has name sharing enabled (the default), other workspaces' reviewers see your matched applicant organization's name and the shared attribute value in the clear — and you see the same from other sharing workspaces; if a workspace disables name sharing, its organizations appear anonymized (masked) in other workspaces' matches. You can change your workspace's setting at any time in your settings. Full bank-account numbers are never shown (last four digits only), and the identity of the other enterprise workspace involved in a match is never disclosed to you, nor is yours to them. EINs are treated as public identifiers. You represent and warrant that you have the rights and authority, and have provided any notices and obtained any consents, necessary for this fraud-prevention processing and cross-workspace fraud-prevention disclosure of the data you submit. These features exist to protect the shared network against fraud; you may contact information@daf-connect.com to discuss the dispute process for the negative file.

If your access to the Service is subject to a paid plan, the fees, billing frequency, plan tier, included usage limits, and any overage rates are as set out in your Order or, where no separate Order has been executed, as displayed in the in-product billing section of your workspace at the time of subscription.

Unless an Order states otherwise: (a) fees are due in advance, (b) all fees are quoted in U.S. dollars and are exclusive of taxes, withholdings, and duties (other than taxes on our net income), which you are responsible for, (c) fees are non-refundable except as required by law or expressly stated in these Terms, an Order, or an Effective SLA, and this restriction does not prevent agreed service credits, (d) you authorize us and our payment processor to charge your designated payment method on a recurring basis until you cancel, (e) we may suspend the Service if any invoice is more than fifteen (15) days overdue, after notice, and (f) we may revise pricing on at least thirty (30) days' written notice for the next renewal term.

Plans renew automatically for successive terms equal to the initial term unless either party gives notice of non-renewal at least thirty (30) days before the end of the then-current term, or as otherwise stated in your Order.

Free tier, trial, and demo. Where we offer a free, trial, beta, or demo plan, we may modify or discontinue it at any time. The demo environment is provided for evaluation only, may contain synthetic or sandboxed data, and must not be used to process real applicant or grantee data.

The Service, including all software, source code, design, user interfaces, page layouts, copy, embedded fonts, illustrations, scoring methodology, verification orchestration logic, AI prompts, data models, schemas, documentation, and the look and feel of the foregoing, and all related intellectual property rights, are and will remain the exclusive property of DAF Connect and its licensors. Nothing in these Terms grants you any rights in or to the Service except for the limited, revocable, non-exclusive, non-transferable, non-sublicensable license to access and use the Service during your subscription term and in accordance with these Terms.

You may not (a) remove or alter any proprietary notices on or in the Service, (b) use any DAF Connect name, logo, or trademark except as expressly permitted in writing, or (c) claim any ownership of, or use commercially, any feature, methodology, or output of the Service in a manner inconsistent with these Terms.

Feedback. If you provide us with suggestions, ideas, enhancement requests, or other feedback regarding the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free, transferable, sublicensable license to use and exploit that feedback for any purpose without obligation or compensation to you.

Each party (the "Receiving Party") may have access to non-public information of the other party (the "Disclosing Party") that is identified as confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Confidential Information includes the Service's non-public features, security architecture, pricing, and roadmaps, and Customer Data.

The Receiving Party will (a) protect Confidential Information using the same degree of care it uses to protect its own confidential information of similar importance, and in no event less than reasonable care, (b) use Confidential Information only as needed to perform under these Terms, and (c) limit access to Confidential Information to its personnel and contractors who have a need to know and who are bound by confidentiality obligations at least as protective as these Terms.

Confidential Information does not include information that (i) is or becomes generally known through no fault of the Receiving Party, (ii) was rightfully in the Receiving Party's possession before disclosure, (iii) is independently developed without use of or reference to the Confidential Information, or (iv) is rightfully obtained from a third party without restriction.

The Receiving Party may disclose Confidential Information to the extent required by law or valid legal process, provided that (where lawful) it gives the Disclosing Party prompt notice and reasonable cooperation to seek a protective order.

By you. You will defend, indemnify, and hold harmless DAF Connect and its officers, directors, employees, contractors, agents, affiliates, licensors, and Sub-Processors from and against any and all claims, damages, liabilities, losses, judgments, fines, penalties, settlements, costs, and expenses (including reasonable attorneys' fees) arising out of or in connection with (a) your or any Authorized User's breach of these Terms, (b) Customer Data, including any claim that Customer Data infringes any third-party right or violates any law, (c) your use of the Service in violation of applicable law or any third-party right, (d) any decision (including any funding, grant, denial, or compliance decision) you make based on output from the Service, and (e) any claim brought by an applicant or other data subject regarding your collection or use of their data.

By us. We will defend, indemnify, and hold harmless Customer from and against third-party claims that the Service, as provided by us and used by Customer in accordance with these Terms, infringes a U.S. patent, registered copyright, or trademark of that third party, and pay damages and attorneys' fees finally awarded by a court of competent jurisdiction or paid in settlement approved by us. We have no obligation for any claim arising from (i) Customer Data, (ii) use of the Service in combination with anything not provided by us if the claim would have been avoided absent the combination, (iii) modification of the Service by anyone other than us, (iv) use of the Service after we provided a non-infringing alternative or notified Customer to stop, or (v) Customer's use in violation of these Terms or applicable law. If a claim is brought or, in our reasonable judgment, is likely to be brought, we may at our option (A) procure for Customer the right to continue using the Service, (B) modify the Service to make it non-infringing, or (C) terminate the affected portion of the Service and refund any pre-paid, unused fees. This paragraph states our entire liability and Customer's sole remedy for any claim of infringement.

Indemnification procedure. The party seeking indemnification will (1) promptly notify the indemnifying party in writing of the claim, (2) give the indemnifying party sole control of the defense and settlement (provided that the indemnifying party will not settle any claim that admits fault or imposes a non-monetary obligation on the indemnified party without its prior written consent), and (3) provide reasonable cooperation, at the indemnifying party's expense.

EXCEPT FOR EXPRESS COMMITMENTS IN AN ORDER OR EFFECTIVE SLA, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, AND SUBJECT TO THOSE EXPRESS COMMITMENTS, DAF CONNECT AND ITS LICENSORS AND SUB-PROCESSORS DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, WE DO NOT WARRANT THAT (a) THE SERVICE WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS, (b) THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, (c) ANY DATA RETURNED BY THE SERVICE — INCLUDING DATA RETURNED BY THIRD-PARTY VERIFICATION PROVIDERS, AI MODELS, OR PUBLIC DATA SOURCES — IS ACCURATE, COMPLETE, CURRENT, OR FREE FROM ERROR, (d) ANY RISK SCORE, TRUST SCORE, RECOMMENDATION, OR FLAG GENERATED BY THE SERVICE IS DEFINITIVE OR SUFFICIENT TO MEET YOUR COMPLIANCE OBLIGATIONS, OR (e) ANY DEFECT WILL BE CORRECTED.

THESE DISCLAIMERS DO NOT CANCEL AN EFFECTIVE SLA'S MEASUREMENT COMMITMENT OR APPROVED CREDITS. AN UPTIME COMMITMENT DEFINES PERFORMANCE AND REMEDIES; IT DOES NOT MEAN OUTAGES ARE TECHNOLOGICALLY IMPOSSIBLE. SUBJECT TO OUR EXPRESS CONTRACTUAL OBLIGATIONS AND APPLICABLE LAW, YOU ASSUME THE RISKS ASSOCIATED WITH DECISIONS YOU MAKE USING THE SERVICE, INCLUDING WHETHER TO FUND OR REJECT AN ORGANIZATION. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SOME OF THE ABOVE MAY NOT APPLY TO YOU.

TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT WILL DAF CONNECT OR ITS LICENSORS, SUB-PROCESSORS, AFFILIATES, OR PERSONNEL BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY (a) INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, (b) LOSS OF PROFITS, REVENUE, BUSINESS, OPPORTUNITY, GOODWILL, OR ANTICIPATED SAVINGS, (c) LOSS, CORRUPTION, OR INACCURACY OF DATA, (d) COST OF SUBSTITUTE GOODS OR SERVICES, (e) LOSSES ARISING FROM A FUNDING, GRANT, OR COMPLIANCE DECISION YOU MAKE, OR (f) LOSSES ARISING FROM THE ACTS, OMISSIONS, OR AVAILABILITY OF ANY THIRD-PARTY SERVICE, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

OUR AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, WILL NOT EXCEED THE GREATER OF (i) THE FEES YOU ACTUALLY PAID US FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (ii) ONE HUNDRED U.S. DOLLARS ($100).

THE EXCLUSIONS AND LIMITATIONS IN THIS SECTION APPLY EVEN IF ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THE PARTIES AGREE THAT THESE LIMITATIONS ARE A MATERIAL BASIS OF THIS AGREEMENT. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS, SO PORTIONS MAY NOT APPLY TO YOU; IN THAT CASE, OUR LIABILITY IS LIMITED TO THE MAXIMUM EXTENT PERMITTED.

THE EXCLUSIONS AND AGGREGATE LIABILITY CAP IN THIS SECTION DO NOT REDUCE OR ELIMINATE APPROVED SERVICE CREDITS OWED UNDER AN EFFECTIVE SLA. NOTHING IN THIS SECTION EXCLUDES OR LIMITS LIABILITY THAT CANNOT LAWFULLY BE EXCLUDED OR LIMITED. ANY SLA-SPECIFIC EXCLUSIVE REMEDY IS LIMITED TO FAILURE TO MEET THE AGREED UPTIME COMMITMENT; IT DOES NOT BY ITSELF WAIVE A SEPARATE CLAIM FOR BREACH OF DATA-PROTECTION, CONFIDENTIALITY, SECURITY, OR FINANCIAL-PROCESSING OBLIGATIONS. THOSE CLAIMS REMAIN SUBJECT TO THE APPLICABLE CONTRACT AND LAW.

Suspension. We may suspend access to the Service immediately, to the extent reasonably necessary, if (a) we reasonably believe your use of the Service violates these Terms or any applicable law, (b) your use is causing or is likely to cause harm to us, other customers, or any third party, (c) we are required to do so by law or by a Sub-Processor, (d) your account is more than fifteen (15) days delinquent on fees, or (e) we reasonably believe your account credentials or embed key have been compromised. We will give notice where lawful and practicable, limit the scope and duration of suspension, and restore access when its basis is resolved. A suspension is excluded from SLA downtime only if it meets an exclusion in the Effective SLA; this section does not independently remove credit eligibility or nonwaivable rights.

Termination by you. You may terminate your subscription at any time by following the cancellation flow in your billing settings or by contacting information@daf-connect.com. Termination is effective at the end of the then-current billing term unless an Order provides otherwise. You are not entitled to a refund of pre-paid fees on termination by you, except where required by law or provided by an Order or Effective SLA. Termination does not extinguish an accrued right to request credits under the applicable claim procedure.

Termination by us. We may terminate these Terms or any subscription (a) for your material breach not cured within thirty (30) days after written notice, (b) immediately if you become insolvent, file for bankruptcy, or become subject to similar proceedings, or (c) for convenience on ninety (90) days' notice, in which case we will refund any pre-paid, unused fees for the remainder of the then-current term.

Effect of termination. Upon termination: (i) your right to access the Service ends, (ii) we will, on written request received within thirty (30) days after termination, make a copy of Customer Data available to you in a commercially reasonable format, (iii) after that thirty (30)-day period we may delete Customer Data from production systems, subject to retention as described in our Privacy Policy and as required by law, and (iv) sections that by their nature should survive — including Sections 5, 8 (license to Customer Data accrued during the term), 10, 11, 12, 13, 14, 15, 16, 17, and 18 — will survive.

Support. We provide commercially reasonable email support at information@daf-connect.com during U.S. business hours. Premium support and response-time commitments, if any, are as stated in your Order. We do not guarantee a specific resolution time unless expressly agreed.

Proposed service level. The 100% Uptime SLA* is a draft for review. It becomes an Effective SLA only when expressly adopted in a signed Order that identifies the covered services, effective date, and approved service-credit schedule. No standard credit amounts are approved in this draft. Existing negotiated Orders retain their agreed coverage and remedies.

Meaning of the commitment. An Effective SLA defines qualifying downtime, eligible measurement time, monthly availability, evidence, exclusions, and a credit claim process. A 100% commitment under that agreement does not promise that outages cannot occur. DAF Connect depends on its hosted application platform and enabled third-party services; those dependencies do not create a blanket downtime exclusion. We will use commercially reasonable efforts to maintain availability, mitigate disruptions, and give advance notice of planned maintenance. Only an Effective SLA determines whether maintenance or an incident is excluded from its calculation.

Remedies. The proposed service-credit remedy is limited to failure to meet the uptime commitment, subject to the approved schedule, these Terms, and applicable law. Any exclusivity requires express adoption in the signed Order. It does not by itself waive separate data-protection, confidentiality, security, or financial-processing claims or nonwaivable rights. No draft percentage, remedy, or publication creates an automatic billing credit.

Beta features. Features identified as “beta,” “preview,” “experimental,” or “early access” are provided AS IS and excluded from standard SLA coverage unless an Order expressly includes them. They may be modified or removed at any time, subject to applicable law and express contractual commitments.

We may modify these Terms from time to time. If we make material changes, we will provide notice — for example, by email to your enterprise account owner, by a notice within the dashboard, or by posting an updated effective date at the top of this page — at least fourteen (14) days before the change takes effect, except where a shorter period is required for legal, security, or compliance reasons.

Your continued use of the Service after the effective date of the modified Terms constitutes your acceptance of those Terms. If you do not agree to a modification, you may stop using the Service and terminate your subscription as described in Section 15, subject to any additional rights under your Order or applicable law. Publishing a revised SLA does not retroactively reduce accrued credit rights or amend a signed Order; changes to adopted SLA terms follow that Order's amendment and notice requirements.

These Terms are governed by the laws of the State of Delaware, excluding its conflict-of-laws principles, and excluding the United Nations Convention on Contracts for the International Sale of Goods.

Informal resolution. Before filing any claim, the parties agree to attempt in good faith to resolve any dispute informally by giving written notice of the dispute to the other party and engaging in at least thirty (30) days of good-faith negotiation.

Venue. Subject to the informal-resolution requirement above and to any agreement to arbitrate in an Order, the state and federal courts located in New Castle County, Delaware will have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each party consents to the personal jurisdiction of those courts.

Equitable relief. Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

Class action waiver. To the fullest extent permitted by law, any dispute will be resolved on an individual basis. The parties waive any right to participate as a class representative or class member in any class, collective, or representative action.

Statute of limitations. Any claim arising out of or relating to these Terms or the Service must be brought within one (1) year after the cause of action accrues, or be forever barred.

You represent and warrant that you and your Authorized Users (a) are not located in, organized under the laws of, or ordinarily resident in any country or region subject to comprehensive U.S. sanctions, (b) are not identified on any U.S. or other applicable restricted-party list, and (c) will not use, export, re-export, or transfer the Service in violation of any export control or sanctions law. You will not use the Service to facilitate any activity prohibited by those laws.

If you are a U.S. federal, state, local, or other government entity, the Service constitutes "Commercial Computer Software" and "Commercial Computer Software Documentation" as those terms are used in the Federal Acquisition Regulation and the Defense Federal Acquisition Regulation Supplement, and is licensed to you with only those rights provided in these Terms.

Entire agreement. These Terms, together with the Privacy Policy, any executed Order or Data Processing Addendum, and any Effective SLA incorporated by that Order, constitute the entire agreement between the parties with respect to the Service and supersede all prior or contemporaneous agreements, proposals, or representations, written or oral, on the subject matter. The proposed SLA is not incorporated merely by being published or linked.

Order of precedence. Unless your signed agreements expressly provide otherwise, a signed Order controls; a signed Data Processing Addendum controls on data-protection matters. An Effective SLA controls over these Terms only for its covered-service availability measurement, exclusions, claim procedure, and agreed service credits. These Terms control all other matters, followed by the Privacy Policy and then documentation or marketing material. Neither the draft SLA nor these integration provisions replace or diminish an existing negotiated Order.

Assignment. You may not assign or transfer these Terms or any rights or obligations under them, by operation of law or otherwise, without our prior written consent, except to a successor in interest in connection with a merger, acquisition, or sale of all or substantially all of your assets, provided the successor is not a competitor of DAF Connect. We may assign these Terms without notice or consent. Any prohibited assignment is void.

Independent contractors. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, fiduciary, or employment relationship.

No third-party beneficiaries. Except as expressly stated, these Terms do not create third-party beneficiary rights.

Notices. Notices to you may be sent to the email address associated with your account. Notices to us must be sent to information@daf-connect.com and to the address in Section 21. Notices are effective on receipt.

Severability. If any provision is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be enforced to the maximum extent permitted.

No waiver. A failure to enforce any provision is not a waiver of the right to enforce it later.

Force majeure. To the maximum extent permitted by applicable law, neither party will be liable for a delay or failure to perform (other than payment obligations) to the extent caused by an event beyond its reasonable control that it could not reasonably prevent or mitigate, such as a natural disaster, war, terrorism, civil unrest, or binding government action. The affected party must use reasonable efforts to mitigate and resume performance and provide notice where lawful and practicable. Ordinary capacity shortfalls, preventable configuration errors, and a supplier failure by itself are not automatically force majeure. For SLA measurement and credits, only the Effective SLA's express exclusions apply; this provision does not independently eliminate those credits.

Headings. Section headings are for convenience only and do not affect interpretation. "Including" and "include" mean "including without limitation."

General and legal inquiries, notices under Section 20, and security or vulnerability disclosures reach us at information@daf-connect.com. Our mailing address for written notices is available on request at the same address.