Terms and Conditions

These Terms and Conditions (the “Terms”) form a part of the SaaS Customer Agreement (the “Agreement”) entered into between Pinch AI Corp., a Delaware corporation (“Pinch AI”), and the customer identified in the applicable Order (“Customer”). The Agreement consists of (a) these Terms and (b) each Order executed by the parties, each of which is incorporated into this Agreement by reference. The effective date of this Agreement (the “Effective Date”) is specified on the Order.

1. Definitions

A capitalized term not otherwise defined in this Agreement shall have the following meaning:

1.1 “Affiliate” means any person or entity that controls, is controlled by, or is under common control with the subject person or entity, but only for so long as such control exists, and that is not a competitor of Pinch AI.

1.2 “Authorized User” means a natural person who is an employee or contractor of Customer or its Affiliates, is authorized by Customer to use the Services, and is not a competitor of Pinch AI.

1.3 “Customer Data” means (a) data provided to Pinch AI by or on behalf of Customer in connection with Customer’s use of the Services, (b) data collected by Pinch AI in connection with Customer’s use of the Services, or (c) Output Data.

1.4 “Applicable Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under this Agreement, including the California Consumer Privacy Act of 2018, as amended (the “CCPA”), and other U.S. state consumer privacy laws. “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, including any information defined as “personal data” or “personal information” under Applicable Data Protection Laws. “Customer Personal Data” means Personal Data included in Customer Data. “Process” means any operation performed on Personal Data, including collection, storage, use, disclosure and deletion, and has corresponding meanings in its other forms. “Subprocessor” means any third party engaged by Pinch AI to Process Customer Personal Data on Pinch AI’s behalf.

1.5 “Pinch AI Materials” means the Services, Software, documentation, machine learning and other models (including Customer-Specific Models), model parameters, features and weights, Workflow templates and rule logic, Network Signals, Aggregated Data, and all improvements and derivatives of any of the foregoing.

1.6 “Order” means an order form for the Services that specifies the Services and other services to be provided by Pinch AI, and the term, usage, pricing and payment schedule for such services, which are accepted by the parties subject to this Agreement.

1.7 “Output Data” means data generated by the Services specifically for Customer, including but not limited to, risk scores, risk indicators, recommendations, decisions, reports and logs.

1.8 “Services” means Pinch AI’s websites, mobile, browser, or desktop applications, APIs, or any content, functionality, or resources used to provide Pinch AI’s SaaS-based services provided through its AI-powered, abuse mitigation platform, including any software development kits and application programming interfaces provided by Pinch AI, as set forth in the applicable Order.

1.9 “Term” means the term identified in the Order.

2. Services

2.1 Use. Subject to Customer’s compliance with this Agreement and the applicable Order, Pinch AI agrees to make available the Services to Customer on a non-exclusive basis as set forth in the applicable Order through the internet only for Customer’s internal business use during the Term.

2.2 Support. Pinch AI agrees to provide the support services for the Services as specified in the applicable Order to Customer in accordance with Pinch AI’s then-current published support plan. Pinch AI may modify the Services from time to time, provided that no modification will (a) materially reduce the functionality of the Services during the then-current Term, or (b) reduce the level of protection afforded to Customer Data under this Agreement. Pinch AI will use commercially reasonable efforts to give Customer prior written notice of any such modifications. Customer hereby authorizes Pinch AI to access Customer’s Services in order to provide support.

2.3 Service Levels. Pinch AI will make the Scoring API available in accordance with the service levels set forth in this Section 2.3.

(a) Availability Commitment. Pinch AI will make the Scoring API available at least 99.5% of the time in each calendar month (the “Availability Commitment”). “Scoring API” means the Pinch AI application programming interface that returns risk scores and Decisions to Customer.

(b) Service Credits. If availability in a calendar month is less than the Availability Commitment, Customer will be entitled to a credit against the Fees invoiced for that calendar month (the “Monthly Fees”) equal to (i) five percent (5%) of the Monthly Fees, if availability is less than 99.5% but at least 99.0%; (ii) ten percent (10%) of the Monthly Fees, if availability is less than 99.0% but at least 98.0%; or (iii) twenty-five percent (25%) of the Monthly Fees, if availability is less than 98.0%. Service credits for any calendar month will not exceed twenty-five percent (25%) of the Monthly Fees for that month.

(c) Excluded Downtime. The following are excluded from the availability calculation: (i) scheduled maintenance notified to Customer at least 48 hours in advance and not exceeding four hours in any calendar month; (ii) events described in Section 15.5 (Force Majeure); (iii) unavailability caused by Customer’s or its Authorized Users’ systems, networks, configuration or acts or omissions, or by third-party platforms or services not controlled by Pinch AI, including Shopify; and (iv) suspension under Section 14.1.

(d) Exclusive Remedy. The service credits under Section 2.3(b) are Customer’s sole and exclusive remedy for any failure by Pinch AI to meet the Availability Commitment.

2.4 Professional Services. Pinch AI agrees to provide the integration, onboarding, performance tuning and other professional services in connection with the Services as specified in and in accordance with the applicable Order to Customer. The professional services shall not include any “work made for hire” or similar intellectual property development services.

3. Requirements

3.1 Customer Responsibilities. Customer agrees to cooperate with Pinch AI in connection with the performance of the Services by (i) integrating Pinch AI’s software development kit into Customer’s online ecommerce store and shopping applications, (ii) integrating Pinch AI’s application programming interface into Customer’s online checkout and returns experience, and (iii) providing or making available the Customer Data to Pinch AI and the Services. Customer agrees to be responsible for (i) maintaining the confidentiality of the access keys and other access credentials associated with the accounts of Customer and the Authorized Users, which shall not be shared with any third parties or by or between any Authorized Users, and such accounts, (ii) the Authorized Users’ compliance with this Agreement and the Orders, (iii) the conduct of Customer and the Authorized Users in their use of the Services and the Customer Data, (iv) determining the suitability of the Services and the data, insights and information generated by the Services for its business, and (v) complying with all applicable laws, rules or regulations applicable to Customer and its use of the Services and the Customer Data. Customer agrees to notify Pinch AI promptly if Customer becomes aware of any unauthorized disclosure or use of the access keys or other access credentials, or any activity that is not permitted by this Agreement or any Order.

3.2 Use. Customer agrees to use, and to ensure that the Authorized Users use, the Services in accordance with this Agreement and the applicable Order. Customer agrees not to, and to ensure that the Authorized Users do not (i) use the Services or permit the Services to be used to perform any services for a third party on a service provider, hosted, service bureau, time sharing, outsourcing offering or other basis, (ii) use the Services or permit the Services to be used (1) in violation of any applicable laws, rules or regulations, (2) for any purpose that is illegal, infringing, libelous, tortious, fraudulent or deceptive, or (3) to cause abuse, harm, harassment, distress, torts or violation of any rights of any persons, (iii) upload or permit the Services to be used to upload any viruses or other harmful or deleterious computer code, files or programs such as trojan horses, worms, time bombs or cancelbots, (iv) use or permit the use of any software, hardware, application or process (1) to circumvent mechanisms in the Services intended to limit the scope of use or to try to gain unauthorized access to the Services, (2) that interferes with or disrupts the Services, or any machines or networks connected to the Services, or (3) that violates the regulations, policies or procedures of such machines or networks, (v) intentionally tamper with or breaches the security of the Services or any machines or networks connected to the Services, or (vi) release the results of any evaluation of the Services to any third party, other than Customer’s Affiliates and professional advisers, without prior written approval of Pinch AI.

3.3 Restrictions. Customer and the Authorized Users shall not (i) reverse engineer, decompile, disassemble or otherwise derive or attempt to derive or discover the source code, object code or underlying structure, ideas or algorithms of the Services or any software, software development kit, application programming interface, documentation or data related to the Services (the “Software”), except for any non-waivable right to decompile Software expressly permitted by applicable mandatory law, (ii) modify, port, adapt, translate or create any derivative work based upon, the Services or Software, (iii) copy, distribute, publicly display, sublicense, lease, loan, rent, sell, resell or otherwise transfer the Services or Software to any third party, (iv) remove or modify any trademarks, trade names, service marks, service names, logos or brands, or copyright or other proprietary notices on the Services or Software, or add any other markings or notices to the Services or Software, or (v) access or use the Services to evaluate its functionality or performance for competitive or benchmarking purposes, including for developing or improving any similar application, product or service, or any similar feature or functionality of the Services.

3.4 Fair Credit Reporting Act. Customer agrees that Pinch AI is not a consumer reporting agency as defined by the Fair Credit Reporting Act, 15 U.S.C. §1681 et seq., or any equivalent law, rule or regulation (“FCRA”), and that the Services, including any data, insights and information generated by the Services, provided to Customer do not constitute or include “consumer reports,” as defined in the FCRA. Customer warrants that it shall not use the Services in whole or in part: (i) as a factor in establishing a consumer’s eligibility for any credit, insurance, or product or service to be used by a consumer for personal, family or household purposes, (ii) for employment purposes, (iii) in connection with a determination of an individual’s eligibility for a benefit granted by a government authority, or (iv) in connection with any permissible purpose as defined by the FCRA.

3.5 Compliance with Laws. Customer acknowledges that the Services do not guarantee compliance with any specific law, rule or regulation. Customer acknowledges that the Services may be controlled by the laws of one or more countries governing technology use and transfer, including U.S. Export Administration Regulations, and that diversion contrary to such laws is prohibited. Customer will not use or transfer any technology or data in violation of such laws. Customer represents that it is not, and is not acting on behalf of, (i) any person who is a citizen, national, or resident of, or who is controlled by the government of any country to which the United States has prohibited export transactions, or (ii) any person or entity listed on the U.S. Treasury Department list of Specially Designated Nationals and Blocked Persons, or the U.S. Commerce Department Denied Persons List or Entity List; and Customer will not permit the Services to be used for any purposes prohibited by law.

3.6 Audit. Pinch AI reserves the right to monitor Customer’s use of the Services as required to ensure that such use is in accordance with this Agreement and the Orders, and for providing support services to Customer. During the Term and for one year thereafter, upon at least 10 days’ prior written notice, Pinch AI may audit Customer’s use of the Services to confirm compliance on a confidential basis. Any audit will be conducted during regular business hours, will not unreasonably interfere with the business of Customer, and will be in compliance with Customer’s reasonable written security procedures. Pinch AI may conduct no more than one audit in any 12 month period. Customer agrees to reasonably cooperate with Pinch AI and any auditor of Pinch AI. Customer will promptly reimburse Pinch AI for all reasonable costs of the auditor if the audit reveals underpayment of more than 5% of the Fees payable by Customer for the period audited.

3.7 Automated Decisions and Workflows. The Services generate risk scores, risk indicators, and recommendations to assist Customer in making decisions regarding its end users (“Decisions”). The Services may be configured to take automated actions, including approving, denying, or routing orders, returns, or claims for manual review, pursuant to decision rules (“Workflows”). Customer retains control over Decisions made by the Services and determines how to use the scores and recommendations provided by the Services. As between the parties, Customer, as controller, is responsible for determining whether any Decision involves solely automated decision-making with legal or similarly significant effects under Applicable Data Protection Laws and for providing any required notices and rights to human intervention, express a point of view, and contest decisions. Pinch AI will reasonably assist Customer in meeting these obligations by providing general information about factors contributing to risk scores (excluding Pinch AI Materials and trade secrets), transaction-specific decision logs, and the ability to route categories of decisions for manual review. Pinch AI may recommend, configure, or modify Workflows on Customer’s behalf, but no Decisions will be made without Customer’s prior documented approval, which may be provided by email or through the Services. Customer may modify or disable any Workflow at any time through the Services. Pinch AI will maintain records of Workflow versions and Decision approvals and provide them to Customer upon request.

4. Customer Data

4.1 Use of Customer Data. Customer hereby grants Pinch AI a non-exclusive, worldwide, royalty-free license during the Term, to collect, host, copy, process and use Customer Data solely to (a) provide, maintain, support and secure the Services for Customer, including training, calibrating and tuning models used to provide the Services solely to Customer (“Customer-Specific Models”); (b) perform this Agreement, including billing and support; and (c) to the extent Customer has opted in under Section 4.3 or Section 4.4, the uses described in those Sections. Pinch AI may sublicense these rights only to Subprocessors engaged in accordance with Section 15.4.

4.2 Restrictions. Except as expressly permitted in Sections 4.1, 4.3, 4.4, and 4.5, Pinch AI will not (a) sell Customer Data; (b) use Customer Data to train, fine-tune or improve any model made available to any other customer; (c) disclose Customer Data, including any Personal Data of Customer’s end users, to any other customer of Pinch AI; or (d) combine Customer Personal Data with Personal Data received from other sources.

4.3 Network Intelligence.

(a) If Customer opts in on an Order or by an authorized representative of Customer sending an email to privacy@pinch.ai, Customer thereby authorizes Pinch AI, as of the date of the Order or of Pinch AI’s receipt of such email, as applicable, to: (i) derive pseudonymized identifiers from Customer Data and associated fraud and abuse indicators (“Network Signals”); (ii) use Network Signals derived from Customer Data, together with Network Signals derived from other participating customers, to inform risk scores generated for Customer and for other participating customers; and (iii) use Customer Data in pseudonymized form to develop, train and improve Pinch AI’s general fraud and abuse detection models. Pinch AI will be authorized to perform these actions until Customer opts out on an Order or by an authorized representative of Customer sending an email to privacy@pinch.ai.

(b) Pinch AI will use Network Signals only to detect, prevent and investigate fraud, abuse and security incidents. Pinch AI will not disclose to any other customer the Customer Data or Personal Data from which a Network Signal was derived, the identity of Customer as its source, or any list of individuals or identifiers. Network Signals affect only the risk scores and indicators generated by the Services. Pinch AI will maintain technical and organizational measures designed to prevent an individual being identified or re-identified from Network Signals.

(c) If Customer does not opt in, Pinch AI will not derive Network Signals from Customer Data or use Customer Data for the purposes in Section 4.3(a), and the Services provided to Customer will not use Network Signals from other customers. If Customer opts out after opting in, within thirty (30) days (i) Pinch AI will cease deriving Network Signals from Customer Data and cease using Customer Data for the purposes in Section 4.3(a)(iii), and (ii) the Services provided to Customer will cease using Network Signals from other customers. Customer acknowledges that detection performance may be reduced if it does not opt in or opts out. Opting out does not require Pinch AI to retrain or modify any model trained before the opt-out took effect.

4.4 Known Bad List.

(a) Pinch AI maintains a list of email and shipping addresses that Pinch AI has determined to be associated with confirmed fraud or abuse (the “Known Bad List”). Pinch AI compiles the Known Bad List from (i) Pinch AI’s own investigations; (ii) commercially available and publicly available fraud prevention sources; and (iii) if Customer opts in under Section 4.4(e), Customer Data and data of other participating customers.

(b) Pinch AI will add an entry to the Known Bad List from Customer Data only where the email or shipping address is associated with a transaction, return, or claim that Customer or Pinch AI has confirmed as fraudulent or abusive based on two or more independent criteria of fraud or abuse. Pinch AI will remove any entry in the Known Bad List that no longer meets those criteria.

(c) If Customer opts in under Section 4.4(e), Customer authorizes Pinch AI to add email and shipping addresses that meet the criteria in Section 4.4(b) from Customer Data to the Known Bad List. Pinch AI will not disclose to any other customer that Customer was the source of an entry, any transaction or other Customer Data underlying that entry, or any other Customer Data. Pinch AI may maintain the source of each entry in the Known Bad List for its own internal records and to maintain accuracy, to respond to individual requests, and to give effect to Section 4.4(e).

(d) If Customer opts in under Section 4.4(e), the Services will compare email and shipping addresses in Customer Data against the Known Bad List as part of Workflows. Decisions taken in reliance on the Known Bad List are subject to Section 3.7. Pinch AI will be authorized to perform these actions until Customer opts out on an Order or by an authorized representative of Customer sending an email to privacy@pinch.ai.

(e) Customer may opt in to the Known Bad List on an Order or at any time by an authorized representative of Customer sending an email to privacy@pinch.ai. Opting in to the Known Bad List is independent of opting in to Network Intelligence under Section 4.3. If Customer does not opt in, Pinch AI will not add entries from Customer Data to the Known Bad List or compare Customer Data against the Known Bad List. If Customer opts out after opting in, within thirty (30) days Pinch AI will stop adding entries from Customer Data to the Known Bad List and will stop comparing Customer Data against the Known Bad List. Customer acknowledges that detection performance may be reduced if it does not opt in to, or opts out of, the Known Bad List.

(f) Pinch AI will use the Known Bad List, and any entry derived from Customer Data, only to detect, prevent and investigate fraud, abuse and security incidents through the Services. Pinch AI will not sell, license or otherwise make the Known Bad List available to any third party, and will not use it for marketing, advertising, profiling unrelated to fraud prevention, or any purpose described in Section 3.4. Pinch AI will not disclose the Known Bad List, or any entry in it, to any customer, except that the Services may indicate to a participating customer that an email or shipping address in its Customer Data matches an entry. Pinch AI will maintain technical and organizational measures designed to protect the Known Bad List against unauthorized access, use or disclosure.

4.5 Aggregated Data. Pinch AI may compile statistical and performance information about the Services that is aggregated with data from other customers and that does not identify, and is not reasonably capable of being used to identify, Customer, any Authorized User or any individual (“Aggregated Data”). Pinch AI may use Aggregated Data for any lawful purpose during and after the Term, provided that it does not identify Customer as its source.

4.6 Ownership of Customer Data. As between the parties, Customer retains all right, title and interest, including all intellectual property rights, in and to the Customer Data, including the Output Data. Pinch AI acquires no right, title or interest in or to Customer Data other than the licenses and rights expressly granted in Sections 4.1, 4.3 and 4.4. Customer Data does not include the Pinch AI Materials or the Known Bad List. Pinch AI retains all right, title and interest in and to the Pinch AI Materials and the Known Bad List as a compilation, including where derived in part from Customer Data, provided that Pinch AI’s use of any Customer Data from which they are derived remains subject to this Section 4 and Section 8. Nothing in this Section 4.6 limits Pinch AI’s obligations under Sections 8.5 through 8.7.

5. Ownership

The Services and Software, including any developments, enhancements, improvements and derivative works therein and thereto, are the intellectual property of and are owned by Pinch AI and its Affiliates. As between Pinch AI and Customer, Pinch AI retains title to and ownership of all right, title and interest in and to the Services and Software (including any developments, enhancements, improvements and derivative works therein and thereto), including all intellectual property and other proprietary rights therein and thereto. Subject to the limited rights set forth in Section 2, Customer does not have any right, title or interest in or to the Services and Software. All rights not expressly granted in this Agreement are reserved by Pinch AI. Pinch AI’s name and all related names, logos, product and service names, designs, and slogans are trademarks of Pinch AI or its Affiliates or licensors. Customer must not use such marks without the prior written permission of Pinch AI. All other names, logos, product and service names, designs, and slogans incorporated in the Services are the trademarks of their respective owners.

6. Feedback

Customer grants Pinch AI a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate Feedback into Pinch AI’s products and services without restriction or obligation. “Feedback” means suggestions or recommended changes to the Services, including without limitation, new features or functionality relating thereto, or any comments, questions, suggestions, or the like voluntarily provided to Pinch AI by Customer or its Authorized Users. For clarity, Feedback excludes Customer Data and Customer’s Confidential Information. Neither Customer nor any Authorized User will receive any additional consideration or compensation for the Feedback.

7. Confidentiality

Each party (a “Recipient”) agrees to protect the confidentiality of any Confidential Information (as defined below) of the other party (a “Discloser”) from unauthorized disclosure or use with at least the same degree of care that the Recipient uses for its own Confidential Information, but no less than reasonable care, and not to use or disclose to any person or entity any Confidential Information of the Discloser except in accordance with this Agreement. The Recipient may disclose Confidential Information of the Discloser to the directors, employees and contractors of the Recipient and its Affiliates who are subject to obligations to maintain the confidentiality of the Confidential Information at least as protective of the Confidential Information as those contained in this Section 7 and who have a bona fide need to know the Confidential Information in order to use the Services or to perform this Agreement. “Confidential Information” means any data or information that is disclosed by the Discloser to the Recipient and not generally publicly available in whatever form, whenever and however disclosed, including data, code, algorithms, pricing, financials, trade secrets, proprietary information, personal identifiable data or any other data or information that is either identified as confidential at the time of disclosure, or which by its nature and/or the circumstances of disclosure a reasonable business person would consider to be confidential. Confidential Information shall not include information that: (i) is now or hereafter becomes part of the public domain through no act or failure to act of the Recipient, (ii) is information that the Recipient had rightfully in its possession without restriction as to use or disclosure before receiving such information from the Discloser, (iii) is hereafter rightfully obtained by the Recipient from a third party without restriction as to use or disclosure, provided that such third party is not known by the Recipient to be bound by a confidentiality agreement with respect to such information, or (iv) information independently developed by the Recipient without any reference to, reliance on or use of the Discloser’s Confidential Information. For clarity, the Services, Software and Aggregated Data are the Confidential Information of Pinch AI. In addition, the Recipient may disclose Confidential Information of the Discloser to the extent compelled by law or a court or other judicial or administrative body, provided that the Recipient notifies the Discloser of such compelled disclosure promptly and in writing (to the extent legally permitted) and cooperates with the Discloser, at the Discloser’s reasonable request and expense, in any lawful action to contest or limit the scope of such required disclosure. All Confidential Information remains the sole property of the Discloser. Nothing in this Agreement is intended to grant or does grant, either express, implied or otherwise, to a party any rights in or to the other party’s Confidential Information, except as expressly set forth in this Agreement. All confidentiality obligations created by this Section 7 with respect to Confidential Information that does not constitute a trade secret under applicable law shall survive until the three year anniversary of this Agreement’s termination or expiration, and all confidentiality obligations with respect to Confidential Information that constitutes a trade secret under applicable law shall survive until, if ever, such Confidential Information is no longer a trade secret.

8. Privacy and Security

8.1 Sharing. Customer warrants that it is permitted to provide or make available the Customer Data that it provides or makes available to Pinch AI and for use with the Services in accordance with applicable data protection and privacy laws, and privacy policies, and without violating any third party’s rights. Each party warrants that it shall collect, store, use and process Personal Data in accordance with Applicable Data Protection Laws to the extent that such party engages in such activities. Customer hereby authorizes the exchange, use and processing of Customer Data, which may include Personal Data, for providing and using the Services and for performing this Agreement. Pinch AI will Process Customer Personal Data in accordance with this Agreement and Applicable Data Protection Laws.

8.2 Composition. Customer is responsible for the relevancy, accuracy and quality of the Customer Data that it provides or makes available to Pinch AI. Customer will not provide to Pinch AI any (i) financial account information, including bank account numbers, (ii) payment card data, including credit card or debit card numbers, (iii) “protected health information” as defined under the U.S. Health Insurance Portability and Accountability Act, or (iv) special categories of personal data under Applicable Data Protection Laws. Notwithstanding the foregoing, Customer may provide truncated card numbers in a format permitted by the Payment Card Industry Data Security Standard (PCI DSS), and tokenized or hashed card values for use with the Services.

8.3 Security. Customer agrees to maintain administrative, physical and technical safeguards and procedures to protect the Customer Data and any of Pinch AI’s Confidential Information consistent with generally accepted, published industry standards, and applicable data protection laws. Pinch AI will implement and maintain commercially reasonable administrative, physical and technical measures designed to protect Customer Data against unauthorized access, use, disclosure, alteration and destruction, and will maintain a SOC 2 Type II report, or an equivalent independent assessment, covering the Services. Pinch AI will provide a copy or summary on request, subject to the confidentiality obligations of Section 7. Customer acknowledges that no security measures can eliminate all risk and that Customer Data is transmitted over networks that Pinch AI does not control. Pinch AI is not responsible for unauthorized access to or use of Customer Data to the extent caused by Customer, its Authorized Users, or systems or networks not controlled by Pinch AI or its Subprocessors. Nothing in this Section 8.3 limits Pinch AI’s responsibility for its own breach of this Section 8.3. Pinch AI will notify Customer without undue delay, and in any event within forty eight (48) hours, after becoming aware of any unauthorized access to or acquisition of Customer Personal Data in the possession or control of Pinch AI or its Subprocessors, and will provide information reasonably requested by Customer to meet its obligations under Applicable Data Protection Laws and data breach notification laws.

8.4 End User Notice and Consent. Customer is responsible for providing any notices to, and obtaining any consents from, its end users that are required under applicable law for Customer to provide Customer Data to Pinch AI, including for the storage of, or access to, information on end users’ devices by the Services. Pinch AI will provide Customer with information reasonably necessary for Customer to do so.

8.5 Retention. During the Term, Pinch AI will retain Customer Data for the period specified in the Order or, if none is specified, for no longer than is reasonably necessary to provide the Services, and in any event no longer than five (5) years from the date of the transaction or event to which the data relates. Customer may instruct Pinch AI in writing to delete Customer Data earlier, and acknowledges that earlier deletion may reduce performance of the Services.

8.6 Export. During the Term, and for ninety (90) days after termination or expiration (the “Retrieval Period”), Pinch AI will, on Customer’s written request, make the Exportable Data available to Customer at no charge in a commonly used, machine-readable format, and will provide reasonable assistance with Customer’s transition to another provider. “Exportable Data” means (a) Customer Data provided by or collected from Customer, and (b) Output Data, together with the metadata reasonably necessary to interpret them. Exportable Data excludes Pinch AI Materials.

8.7 Deletion. Within thirty (30) days after termination or expiration or, if Customer has requested Exportable Data under Section 8.6, within thirty (30) days after the end of the Retrieval Period, Pinch AI will delete Customer Data and Customer-Specific Models in its possession or control and will instruct its Subprocessors to do the same, except (a) to the extent retention is required by applicable law, in which case Pinch AI’s confidentiality obligations under Section 7 continue to apply; and (b) copies in backup systems, which will be deleted in the ordinary course within ninety (90) days after deletion from production systems. Customer may instruct Pinch AI in writing to delete Customer Data earlier, including after termination or expiration. Upon request, Pinch AI will certify deletion. Deletion does not require Pinch AI to retrain or modify any model other than Customer-Specific Models.

8.8 Privacy Terms.

(a) Roles and Scope. For purposes of Applicable Data Protection Laws, Customer is the “business” or “controller,” and Pinch AI is the “service provider,” “contractor” or “processor,” with respect to Customer Personal Data. Pinch AI will Process Customer Personal Data only on Customer’s documented instructions, which consist of this Agreement, each Order, Decisions and Workflows approved by Customer under Section 3.7, and any opt-in election made by Customer under Section 4.3 or 4.4.

(b) Processing Details. The nature and purpose of the Processing is the provision of the fraud, abuse and chargeback prevention Services described in the applicable Order, including generating risk scores and recommendations, supporting Customer’s Decisions and, to the extent Customer opts in, the uses described in Sections 4.3 and 4.4 (together, the “Business Purposes”). The types of Customer Personal Data Processed are names and contact information of Customer’s end users; billing and shipping addresses; order, return and claim information; truncated, tokenized or hashed payment card data; IP addresses, device and browser information and derived device identifiers; and account and transaction history. The Processing continues for the Term and the periods described in Sections 8.5 through 8.7.

(c) Restrictions. Pinch AI will not (i) sell or share Customer Personal Data, as those terms are defined under Applicable Data Protection Laws; (ii) retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the Business Purposes, or as otherwise permitted for service providers and processors under Applicable Data Protection Laws; (iii) retain, use or disclose Customer Personal Data outside the direct business relationship between Pinch AI and Customer; or (iv) combine Customer Personal Data with Personal Data that Pinch AI receives from or on behalf of another person, or collects from its own interactions with individuals, except to perform the Business Purposes (including detecting, preventing and investigating fraud, abuse and security incidents under Sections 4.3 and 4.4 to the extent Customer has opted in) or as otherwise permitted under Applicable Data Protection Laws. The parties acknowledge that Customer’s disclosure of Customer Personal Data to Pinch AI is not made for monetary or other valuable consideration. Pinch AI certifies that it understands and will comply with the restrictions in this Section 8.8.

(d) Compliance and Notice. Pinch AI will comply with the obligations that apply to it under Applicable Data Protection Laws and will provide the same level of privacy protection to Customer Personal Data as those laws require of Customer. Pinch AI will promptly notify Customer if it determines that it can no longer meet its obligations under Applicable Data Protection Laws. Customer may take reasonable and appropriate steps to ensure that Pinch AI uses Customer Personal Data consistently with Customer’s obligations under Applicable Data Protection Laws and, upon notice to Pinch AI, to stop and remediate any unauthorized use of Customer Personal Data.

(e) Confidentiality of Personnel. Pinch AI will ensure that each person who Processes Customer Personal Data on its behalf is subject to a duty of confidentiality with respect to that data.

(f) Subprocessors. Pinch AI will engage Subprocessors only under a written contract that requires the Subprocessor to meet the obligations of Pinch AI under this Section 8.8 with respect to Customer Personal Data.

(g) Assistance. Taking into account the nature of the Processing and the information available to Pinch AI, Pinch AI will provide reasonable assistance to Customer in (i) responding to requests from individuals exercising their rights under Applicable Data Protection Laws; (ii) meeting Customer’s obligations relating to the security of Processing and the notification of security breaches; and (iii) conducting data protection assessments. Pinch AI will forward to Customer, within ten (10) business days of receipt, any request that Pinch AI receives directly from an individual concerning Customer Personal Data, and will not respond to such request except to direct the individual to Customer, unless required by law.

(h) Information and Assessments. Upon Customer’s reasonable written request, Pinch AI will make available the information in its possession that is necessary to demonstrate its compliance with this Section 8.8, and will allow and cooperate with reasonable assessments by Customer or an independent assessor designated by Customer, no more than once in any twelve (12) month period, on at least thirty (30) days’ notice, during normal business hours, subject to Section 7 and at Customer’s expense. Alternatively, Pinch AI may, with Customer’s agreement, provide a report of an independent assessment of its policies and technical and organizational measures, such as the SOC 2 Type II report described in Section 8.3, in satisfaction of this obligation.

(i) Deidentified Data. With respect to any deidentified data, including Aggregated Data, derived from Customer Personal Data, Pinch AI will (i) take reasonable measures to ensure that the data cannot be associated with an individual or household; (ii) publicly commit to maintain and use the data only in deidentified form and not attempt to reidentify it, except as permitted by Applicable Data Protection Laws; and (iii) contractually obligate any recipient of the data to comply with these requirements.

(j) Return and Deletion. At the end of the Processing, Pinch AI will delete or return Customer Personal Data as provided in Sections 8.5 through 8.7, unless retention is required by law.

9. Payment Terms

9.1 Fees. Customer agrees to pay Pinch AI the fees for the Services set forth in the applicable Order (the “Fees”); provided, however, that if Customer’s use of any Services exceeds the usage as mutually agreed in the applicable Order for such Services, Customer agrees to pay the additional fees for such excess usage based on the pricing set forth in such Order. Fees are in the currency set forth in the applicable Order. All Fees will be invoiced in accordance with the payment schedule set forth in the applicable Order, provided further that Pinch AI will invoice Customer for any use of the Services that exceeds the usage as mutually agreed in the applicable Order as soon as practicable. All Fees are due and payable within 30 days following Customer’s receipt of Pinch AI’s invoice, unless otherwise set forth in the applicable Order. All Fees are non-refundable except as set forth in this Agreement.

9.2 Taxes. Fees do not include any taxes, duties, fees or other amounts assessed or imposed by any government authority. Customer is solely responsible for paying all such taxes, duties, fees and other amounts, other than taxes imposed on Pinch AI’s income. Customer will pay all such amounts upon demand or provide evidence of payment or exemption. In case of any withholding requirements, Customer agrees to pay any required withholding itself and will not reduce the Fees payable or paid to Pinch AI on account thereof.

9.3 Late Fees. Undisputed amounts not paid when due accrue interest at the lesser of one percent (1.0%) per month or the maximum rate permitted by law. Customer may withhold amounts it disputes in good faith by notifying Pinch AI of the dispute in reasonable detail before the due date, and the parties will work in good faith to resolve such dispute. Pinch AI may suspend the Services for non-payment of undisputed amounts after providing Customer at least ten (10) days’ written notice following the due date.

10. Warranties and Disclaimers

10.1 Limited Warranties. Pinch AI warrants that during the Term (a) the Services will perform materially in accordance with the applicable documentation; (b) Pinch AI will not materially decrease the overall security of the Services; and (c) Pinch AI will comply with laws applicable to its provision of the Services, including Applicable Data Protection Laws in its role as a service provider or processor of Customer Personal Data.

10.2 Disclaimer. Except as expressly set forth in Sections 2.3 and 10.1, the Services, including any data, insights and information generated through the Services, are provided “as is”. Pinch AI disclaims any and all warranties, whether express, implied, statutory or otherwise, including without limitation warranties of non-infringement, merchantability and fitness for a particular purpose. Pinch AI does not warrant that the Services or use thereof will be error free, uninterrupted or virus free. Pinch AI does not warrant that the Services, including any data, insights and information generated through the Services, or use thereof will meet any desired requirements, expectations or outcomes desired by Customer. No data, insights or information generated through the Services will create any warranty regarding the Services.

11. Indemnification

11.1 Intellectual Property. Pinch AI will defend Customer against any third-party claim alleging that the Services, as provided by Pinch AI and used in accordance with this Agreement, infringe or misappropriate any patent, copyright, trademark or trade secret, and will pay damages and costs finally awarded against Customer, or agreed by Pinch AI in settlement, with respect to such claim. If Pinch AI reasonably believes that use of the Services is likely to be enjoined, or if the Services are held to infringe or misappropriate any such right, Pinch AI shall, at its expense and at its sole option, (i) procure for Customer the right to continue using the Services, (ii) replace the Services with other non-infringing services of substantially equivalent functionality or (iii) modify the Services so that there is no infringement, provided that such modified services provide substantially equivalent functionality. If, in Pinch AI’s reasonable opinion, the remedies above are infeasible or commercially impracticable, Pinch AI may, in its sole discretion, terminate this Agreement and refund Customer a pro-rated amount of the applicable Fees for the Services pre-paid by Customer covering the whole months following the effective date of such early termination. Customer shall not settle any matter without the prior written approval of Pinch AI.

11.2 Exceptions. The indemnification obligation in this Section 11 will not apply to the extent the infringement is caused by any of the following: (i) the Services are modified in any unauthorized manner by Customer or any Authorized User, or a third party not authorized by Pinch AI, (ii) the Services are combined by Customer or any Authorized User with other software, hardware, application or process not authorized by Pinch AI, (iii) the Services are used by Customer or any Authorized User in violation of this Agreement or the applicable Order, or (iv) any materials, data or information provided by or on behalf of Customer, to the extent that material, data or information, and not the Services, the Pinch AI Materials or the Output Data, causes the infringement.

11.3 Sole Remedy. This Section 11 provides Customer’s sole remedy with respect to any claim of intellectual property infringement, misappropriation or violation.

11.4 Customer Indemnification. Customer will defend Pinch AI against any third-party claim arising from (a) Customer’s provision of Customer Data to Pinch AI in breach of Section 8; or (b) Customer’s use of the Services in violation of Section 3.2 or applicable law, and will pay damages and costs finally awarded or agreed in settlement.

11.5 Procedure. Each party shall promptly notify the other party in writing of any claim for which it believes it is entitled to be indemnified pursuant to Section 11.1 or Section 11.4. The party seeking indemnification (the “Indemnitee”) shall cooperate with the other party (the “Indemnitor”) at the Indemnitor’s sole cost and expense. The Indemnitor shall promptly assume control of the defense and shall employ counsel of its choice to handle and defend the same, at the Indemnitor’s sole cost and expense. The Indemnitee may participate in and observe the proceedings at its own cost and expense with counsel of its own choosing. The Indemnitor shall not settle any claim without the Indemnitee’s prior written consent, which shall not be unreasonably withheld or delayed. The Indemnitee’s failure to perform any obligations under this Section 11.5 will not relieve the Indemnitor of its obligations under this Section 11, except to the extent that the Indemnitor can demonstrate that it has been materially prejudiced as a result of such failure.

12. Limitation of Liability

12.1 Exclusion of Damages. Except for Excluded Claims, neither party will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits or revenue, arising out of or relating to this Agreement, however caused and under any theory of liability, even if advised of their possibility.

12.2 General Cap. Except for Excluded Claims and as provided in Section 12.3, each party’s total liability arising out of or relating to this Agreement will not exceed the greater of (i) Fees paid and payable by Customer under this Agreement in the twelve (12) months preceding the event giving rise to the claim or (ii) US$10,000 (the “General Cap”).

12.3 Data Protection Cap. Pinch AI’s total liability for breach of Section 4.2 or Section 8 will not exceed two (2) times the General Cap (the “Data Protection Cap”), which is in addition to, and not part of, the General Cap. Regulatory fines and penalties imposed on Customer, the reasonable cost of notifying authorities and affected individuals, and third-party claims, in each case resulting from such a breach, are direct damages for the purposes of Section 12.1.

12.4 Excluded Claims. “Excluded Claims” means (a) a party’s obligations under Section 11; (b) Customer’s obligation to pay Fees; (c) a party’s fraud, gross negligence or willful misconduct; (d) Customer’s breach of Section 3.3; and (e) a party’s breach of Section 7, other than with respect to Customer Data, which is subject to Section 12.3. Customer’s total liability under Section 11.4 and for breach of Sections 3.3 and 7 will not exceed an amount equal to the Data Protection Cap.

13. Marketing

Pinch AI may identify Customer as a customer, including by using Customer’s name and logo in accordance with Customer’s trademark guidelines, only with Customer’s prior written consent (email sufficient). Customer may withdraw consent for future use at any time.

14. Termination

14.1 Suspension. Pinch AI may suspend Customer’s access to the affected Services, in whole or in part, if reasonably necessary to prevent (a) a security threat to the Services or other customers, (b) use in violation of Section 3.2 or applicable law, or (c) non-payment as provided in Section 9.3. Pinch AI will give prior notice where practicable and will restore access promptly once the cause is resolved.

14.2 Termination. This Agreement may be terminated (i) by either party at any time for any or no reason after giving the non-terminating party prior written notice of at least 30 days, (ii) by the non-breaching party if the other party breaches a material term of this Agreement that is uncured within 30 days (or, in the case of non-payment, five days) after delivery of notice of such breach, or (iii) if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors not dismissed within 30 days. In addition, Pinch AI may immediately terminate this Agreement upon any breach by Customer of Section 3, 5 or 7.

14.3 Fees. Upon expiration or termination of this Agreement, Customer will pay Pinch AI any unpaid amounts that are owed to Pinch AI during the Term. Upon termination of this Agreement based on Customer’s breach (following any applicable cure period), or upon termination of this Agreement for Customer’s convenience, Customer will pay Pinch AI any unpaid amounts that would have been owed to Pinch AI for the remainder of the then-current Term if such early termination had not occurred as well as any other amounts owed to Pinch AI under this Agreement, without limiting Pinch AI’s other rights and remedies. Upon termination of this Agreement based on Pinch AI’s breach (following any applicable cure period), Pinch AI will refund Customer any amounts pre-paid for the Services pursuant to this Agreement for the remaining full calendar months in the then-current Term.

14.4 Effect. Upon expiration or termination of this Agreement, (i) Pinch AI will terminate the availability of the Services to Customer, (ii) Customer will cease all use of the Services, and delete or destroy (or, at Pinch AI’s request, return) all Pinch AI Confidential Information in its possession or control, and (iii) Customer Data will be retained, made available and deleted as provided in Sections 8.5 through 8.7.

14.5 Survival. Sections 3 through 12, 14 and 15 will survive any expiration or termination of this Agreement.

15. General

15.1 Parties. Pinch AI and Customer are independent contractors. Nothing in this Agreement shall be deemed to constitute a joint venture or partnership between the parties, nor constitute any party as the agent of the other party for any purpose, or entitle any party to commit or bind the other party in any manner. Except as expressly provided in this Agreement, nothing in this Agreement or under applicable law is intended to confer any rights or obligations upon any person or entity other than the parties hereto, Pinch AI’s licensors and their respective successors and permitted assigns.

15.2 Governing Law; Arbitration. This Agreement shall be governed by the laws of California, United States. This Agreement shall not be governed by the conflict of law rules of any jurisdiction or the United Nations Convention on Contracts for the International Sale of Goods. In the event of a dispute regarding this Agreement (a “Dispute”), a party will provide the other party with written notice of the Dispute as soon as practicable, and the parties agree to exercise commercially reasonable efforts to resolve the Dispute amicably through their designated officers. A Dispute that cannot be resolved within 15 days following the discussions contemplated by the prior sentence will, upon written demand of either party, be resolved exclusively by the Judicial Arbitration and Mediation Service by a single arbitrator pursuant to the arbitrator’s Comprehensive Arbitration Rules and Procedures then in effect in San Jose, California, United States. The arbitration will be conducted and all evidence will be submitted in the English language. Each party shall bear its own costs and expenses, and the two parties will share equally the fees and costs of the arbitrator. The award rendered in the arbitration may be enforced in any court of competent jurisdiction. Notwithstanding anything in this Agreement to the contrary, either party shall have the right, at its election, to seek injunctive or other equitable relief in any court of competent jurisdiction in order to protect its intellectual property rights or Confidential Information, without first submitting such matter to arbitration. THE PARTIES HEREBY WAIVE THEIR RESPECTIVE RIGHTS TO TRIAL BY JURY IN ANY ACTION OR PROCEEDING REGARDING THIS AGREEMENT. CUSTOMER AGREES THAT IT WILL NOT COMMENCE OR PARTICIPATE IN A CLASS ACTION AGAINST PINCH AI. If any action is pursued to enforce this Agreement, the prevailing party shall be entitled to reasonable attorneys’ fees and costs, in addition to any other relief to which such party may be entitled.

15.3 Entire Agreement; Amendments; Waivers; Severability. This Agreement is the parties’ entire agreement with respect to its subject matter, and supersedes any prior communications, discussions, understandings or agreements. Any use of Customer’s pre-printed forms, such as purchase orders, are for convenience only, and any pre-printed terms and conditions set forth in Customer’s pre-printed forms that are in addition to, inconsistent or in conflict with, or different than, this Agreement shall be given no force or effect. Neither commencement of performance, nor failure to object to any additional or different terms and conditions from Customer, by Pinch AI shall constitute an acceptance of any terms and conditions proposed by Customer that are in addition to, inconsistent or in conflict with, or different than, this Agreement. No amendment to or modification of this Agreement is effective unless it is in writing and signed by each party. Elections and consents that this Agreement expressly permits to be given by email, including under Sections 4.3, 4.4 and 13, are not amendments or modifications for purposes of this Section 15.3. No waiver by any party of any of the provisions hereof shall be effective unless explicitly set forth in writing and signed by the party so waiving. Except as otherwise set forth in this Agreement, no failure to exercise, or delay in exercising, any rights, remedy, power, or privilege arising from this Agreement will operate or be construed as a waiver thereof; nor shall any single or partial exercise of any right, remedy, power, or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege. If any provision of this Agreement is held to be unenforceable, the unenforceable provision shall be replaced by an enforceable provision that comes closest to the parties’ intent underlying the unenforceable provision, and the remaining provisions of this Agreement shall remain in full force and effect.

15.4 Subcontracts; Assignment. Pinch AI may use subcontractors to perform the Services, provided that Pinch AI will remain responsible for its subcontractor’s compliance with this Agreement and any subcontractor that Processes Customer Personal Data is bound by written obligations to protect Customer Personal Data that are no less protective than those in this Agreement. Customer may request a current list of Pinch’s Subprocessors. Pinch AI may assign or transfer this Agreement, in whole or in part, in connection with any acquisition, consolidation, merger, reorganization, transfer of all or substantially all of its assets or other business combination, or by operation of law without Customer’s consent. Customer may assign or transfer this Agreement in whole to an Affiliate or by business combination, operation of law or otherwise without Pinch AI’s prior written consent and with written notice to Pinch AI. Subject to the foregoing, this Agreement will bind and benefit the parties and their respective successors and permitted assigns.

15.5 Force Majeure. A party shall not be liable for its inadequate performance (other than its payment obligations) caused by any condition beyond such party’s reasonable control, including accidents, acts of God, government acts, civil unrest, acts of war or terrorism, pandemic or epidemic, strikes or other labor problems, failures in telecommunications, internet, internet service provider or hosting facilities, power shortages and denial of service attacks. If any of such event has occurred, the non-performing party shall (i) immediately notify the other party in writing describing at a reasonable level of detail the circumstances causing such default or delay and (ii) be excused from further performance or observance of its affected obligations (other than its payment obligations) for as long as such circumstances prevail and such party continues to use reasonable commercial efforts to recommence performance or observance as soon as possible and to whatever extent possible without delay.

15.6 Notices. All notices shall be in writing and shall be deemed effectively given upon the earlier of actual receipt or: (i) when sent, if sent by email during normal business hours of the recipient, and if not sent during normal business hours, then on the recipient’s next business day, (ii) three days after having been sent by registered or certified mail, return receipt requested, postage prepaid, or (iii) one business day after deposit with a nationally recognized express courier, freight prepaid, with written verification of receipt. All notices shall be sent to the parties at their respective address in the applicable Order, or to such other address as subsequently notified in accordance with this Section 15.6.

15.7 Order of Precedence. If there is any conflict or inconsistency among the documents comprising the Agreement, the following order of precedence applies: (a) an Order, with respect to the Services, Fees, Term, and other commercial terms specific to that Order; and (b) these Terms. No Order may reduce the protection afforded to Customer Personal Data under Section 8.