Master Services Agreement v1.0

1. How This Agreement Works

1.1 Contract documents. The agreement between the Parties (the "Agreement") consists of: (a) each Order Form (also called an engagement letter) signed by both Parties; (b) this MSA; (c) the following policies, each posted at its URL (the "Policies"): the Data Processing Addendum ("DPA") at https://gonovus.ai/legal/dpa; the Security Annex at https://gonovus.ai/legal/security; the Service Level Agreement and Support policy ("SLA") at https://gonovus.ai/legal/sla; and the Subprocessor List made available to Customer on request, with request and update information at https://gonovus.ai/legal/subprocessors; and (d) any Scope Confirmations under Section 1.6.

1.2 Incorporation by URL. An Order Form incorporates this MSA and the Policies by reference to their URLs. Customer does not need to sign this MSA or the Policies separately. Signing an Order Form that references this MSA is acceptance of the Agreement.

1.3 Version that applies. For each Order Form, the versions of this MSA and the Policies posted on the date of that Order Form (the "Order Form Date") apply. Northbyte may post new versions. A new version applies to an existing Order Form only: (a) if Customer agrees in writing (email is enough); or (b) from the start of the next renewal term, if Northbyte gives Customer written notice of the new version at least 45 days before that renewal. Changes to the Subprocessor List follow Section 7 of the DPA, and the Security Annex may be updated as stated in it, in each case without reducing Customer's protections. Northbyte will keep prior versions available on request. For the Subprocessor List, the applicable version is the version made available to Customer as of the Order Form Date, subject to changes under Section 7 of the DPA.

1.4 Customer-specific terms. Prices and the Subscription Term are set in the Order Form. Where this MSA gives a default (for example, for payment terms, renewal, hosting region, support plan, acceptance period, or liability amounts), the default applies unless the Order Form states otherwise. Any change to a default must be written in the Order Form.

1.5 Order of precedence. Mandatory provisions of the EU Standard Contractual Clauses and the UK Addendum incorporated by the DPA prevail over conflicting terms of the Agreement, including any Order Form. Subject to those provisions, the DPA controls the processing of Personal Data. For other matters, the following order applies: (a) the Order Form; (b) this MSA; (c) the SLA and the Security Annex; (d) Scope Confirmations (Section 1.6); and (e) the Documentation. The Parties may agree lawful customer-specific data protection terms, but no Order Form or amendment may reduce protection required by applicable Data Protection Laws or contradict mandatory transfer terms. Terms in any Customer purchase order or vendor portal are void.

1.6 Scope confirmations. The specific services, Professional Services, and Deliverables that Northbyte provides to Customer are as the Parties confirm in writing from time to time (each a "Scope Confirmation"). Written confirmation includes email between authorized contacts. An authorized contact is the contact or signatory named in the Order Form, or another person a Party designates in writing. A Scope Confirmation may describe services, Deliverables, Customer-Specific Deliverables, milestones, and Customer responsibilities. A Scope Confirmation cannot change Fees, rates, any Minimum Commitment, the Subscription Term, liability, data protection or data location, or any other term of this MSA, a Policy, or an Order Form. Those terms can be changed only by an Order Form or by an amendment signed by both Parties under Section 16.10.

2. Definitions

2.1 "Affiliate" means an entity that controls, is controlled by, or is under common control with a Party, where "control" means ownership of more than 50% of the voting interests.

2.2 "AI Output" means responses, recommendations, text, audio, and other content generated by the Service.

2.3 "Aggregated Data" means data derived from the operation of the Service that is aggregated and de-identified so that it does not identify Customer, any End User, or any individual.

2.4 "Authorized Users" means Customer's employees and contractors whom Customer permits to use the Service.

2.5 "Customer Content" means product, service, or event information, policies, FAQs, brand guidelines, images, prompts, and other materials Customer provides to configure the Service.

2.6 "Customer Data" means all data, including Personal Data, that Customer, its Authorized Users, or End Users submit to the Service, including Customer Content, chat messages, voice inputs and transcripts, and other End User submissions. Customer Data excludes Aggregated Data and Usage Data.

2.7 "Customer Properties" means the websites, apps, stores, and other channels where Customer deploys the Service. "Customer Property" means any one of them.

2.8 "Customer-Specific Deliverables" means the parts of Deliverables custom-built specifically for Customer, namely customer-specific content and configurations, as identified in a Scope Confirmation. Customer-Specific Deliverables do not include Northbyte Materials.

2.9 "Deliverables" means items Northbyte provides as part of Professional Services, as described in a Scope Confirmation.

2.10 "Documentation" means Northbyte's then-current user guides and technical documentation for the Service.

2.11 "End User" means an individual who visits or uses a Customer Property and interacts with the Service (for example, a shopper, fan, or attendee).

2.12 "Fees" means the fees set out in an Order Form.

2.13 "Northbyte Materials" means the Service, Documentation, software, models, prompts, workflows, templates, components, tools, know-how, and other technology of Northbyte, whether existing before or developed during the Agreement, and all improvements, enhancements, and derivatives of them.

2.14 "Minimum Commitment" means a minimum amount of Fees for a stated period set out in an Order Form.

2.15 "Order Form" means an ordering document or engagement letter signed by both Parties that references this MSA.

2.16 "Personal Data" has the meaning given in the DPA.

2.17 "Platform" means any third-party e-commerce, website, app-store, messaging, or other platform (for example, Shopify) on which a Customer Property runs or with which the Service integrates.

2.18 "Professional Services" means onboarding, configuration, integration, forward-deployed engineering, training, or similar services described in a Scope Confirmation.

2.19 "Scope Confirmation" has the meaning given in Section 1.6.

2.20 "Service" means Northbyte's AI software services offered as hosted software-as-a-service (for example, AI shopping assistants and AI customer or fan engagement apps, with text and voice chat), including related apps, dashboards, consoles, APIs, and Documentation, that Customer subscribes to under an Order Form.

2.21 "Subscription Term" means the period stated in an Order Form, including renewals.

2.22 "Usage Data" means technical and operational data about use and performance of the Service (such as uptime, latency, error logs, feature usage, and token or session counts), excluding the content of Customer Data.

2.23 "Usage Fees" means Fees based on measured use of the Service.

3. Services

3.1 Provision. Subject to the Agreement and payment of Fees, Northbyte will make the Service available to Customer during the Subscription Term, and grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Service for its internal business purposes and to deploy it on Customer Properties.

3.2 Professional Services. Northbyte will perform the Professional Services set out in Scope Confirmations. Professional Services are charged only as expressly priced in a signed Order Form or signed amendment. Services provided at no additional charge must be shown as US$0 or included. A US$0 rate does not become chargeable because the scope or hours change; a new fee or rate requires a signed Order Form or amendment before the chargeable work begins. A blank rate is not authorization to charge. (a) Acceptance. Deliverables are reviewed against the scope agreed in the applicable Scope Confirmation. A Deliverable is accepted on the earlier of its use in production or 10 business days after delivery (or another period stated in the Order Form), unless within that period Customer gives written notice (email is enough) describing how it materially fails to meet that agreed scope. Northbyte will then correct the failure and redeliver, and the review period restarts for the corrected item. (b) Changes. Either Party may request a change to scope or schedule. A change is binding only when both Parties agree in writing; email confirmation from an authorized contact of each Party is enough, and the change then forms part of the Scope Confirmation. Extra work is chargeable only to the extent authorized by the applicable signed pricing terms; an email Scope Confirmation alone cannot create a new charge or change a US$0 rate. A change to Fees or rates requires an Order Form or amendment under Section 1.6. (c) Dependencies. Delivery dates are targets. If Customer's inputs, approvals, or access are late, affected dates move by at least the same period.

3.3 Service levels and support. Northbyte will provide the availability commitment and support described in the SLA, under the support plan stated in the Order Form (Standard if none is stated). Service credits under the SLA are Customer's sole and exclusive remedy for failure to meet the availability commitment.

3.4 Updates. Northbyte may update the Service from time to time. Northbyte will not materially reduce the core functionality or the security of the Service during a paid Subscription Term.

3.5 Affiliates. Customer Affiliates may purchase under this MSA by signing their own Order Form, in which case the Affiliate is "Customer" for that Order Form.

4. Customer Responsibilities and Acceptable Use

4.1 Responsibilities. Customer is responsible for: (a) its Authorized Users' compliance with the Agreement; (b) the accuracy, quality, and legality of Customer Content and Customer Data; (c) keeping its account credentials secure and promptly notifying Northbyte of unauthorized use; (d) providing any notices to, and obtaining any consents from, End Users required by law for Northbyte to process Customer Data, including for chat logging, voice recording, photos, marketing, and cookies; and (e) configuring the Service in line with Customer's own policies.

4.2 Acceptable use. Customer will not, and will not permit anyone to: (a) sell, resell, sublicense, or make the Service available to third parties except End Users through Customer Properties; (b) use the Service to violate law, infringe or misappropriate rights, or send spam, malware, or deceptive content; (c) interfere with or disrupt the Service or attempt unauthorized access to it or related systems; (d) reverse engineer, decompile, or attempt to extract source code, model weights, or prompts of the Service, except as allowed by law; (e) use the Service to build a competing product, or to benchmark it for publication without consent; (f) use the Service to make decisions with legal or similarly significant effects on individuals, or for high-risk uses such as medical, legal, or financial advice; (g) submit payment card data, government ID numbers or images of identity documents, health data, or other sensitive data unless agreed in writing; or (h) circumvent usage limits or security controls.

4.3 End User-facing terms. Customer is responsible for its terms and privacy notice to End Users, which must disclose that End Users are interacting with an AI assistant where required by law.

5. Third-Party Platforms

5.1 Platform. This Section 5 applies only where the Service integrates with a Platform. Customer's use of the Platform is governed solely by Customer's agreement with the Platform provider. Northbyte is not responsible for the Platform, including its availability, changes to its APIs, or its data handling.

5.2 App store billing. If Customer subscribes through a Platform's app store (for example, the Shopify App Store), Fees may be billed through that Platform's billing, and its app store terms apply to that billing. If an Order Form is signed, the Order Form controls the commercial terms between the Parties.

5.3 Permissions. Customer authorizes Northbyte to access, through the Platform's APIs, the Customer Property data and permissions requested during app installation or integration as needed to provide the Service. Customer may revoke access by uninstalling the app or disconnecting the integration, which may end the Service.

5.4 Platform changes. If a Platform change makes it impractical for Northbyte to continue providing all or part of the Service, Northbyte may modify the affected functionality and, if the change materially reduces the Service, either Party may terminate the affected Order Form on 30 days' notice, and Northbyte will refund prepaid Fees for the unused period.

6. Fees, Invoicing, and Payment

6.1 Fees. Customer will pay the Fees in each Order Form. Fees may include subscription fees, Usage Fees (for example, per conversation, session, user, or token), Professional Services fees, and any Minimum Commitment. Except as stated in the Agreement, Fees are non-cancellable and non-refundable, and committed quantities and any Minimum Commitment cannot be decreased during the Subscription Term. Usage above a Minimum Commitment or an included allowance is not a committed quantity.

6.2 Minimum Commitment. If an Order Form sets a Minimum Commitment, Customer will pay at least that amount for each stated period regardless of actual usage. Unless the Order Form states otherwise: (a) Usage Fees for a period count toward the Minimum Commitment for that same period, and Customer pays the greater of the Minimum Commitment or the Usage Fees for that period (the amount above the Minimum Commitment is "Overage"); (b) any unused part of a Minimum Commitment does not roll over, is not credited against any other period, and is not refundable; and (c) the Minimum Commitment for a partial first or last period is prorated by days.

6.3 Invoicing and usage reconciliation. Unless the Order Form states otherwise: (a) billing periods are calendar months; (b) Northbyte will invoice subscription Fees and any Minimum Commitment monthly in advance, and Overage, other Usage Fees, and time-and-materials Professional Services fees monthly in arrears; (c) within 5 business days after the end of each month, Northbyte will send Customer a usage report showing usage, Usage Fees, any Minimum Commitment, and any Overage for that month, with supporting detail on request; (d) Customer may dispute a usage report in good faith, in writing and with reasonable detail, within 10 days after receiving it, and if it does not, the report is final; and (e) Northbyte will then invoice the undisputed amounts. Unless the Order Form states otherwise, invoices are due within 30 days of the invoice date, in US dollars, by wire, ACH, or another method Northbyte designates.

6.4 Third-party payment on behalf of Customer. Customer may have a third party (a "Designated Payor") pay an invoice on Customer's behalf only with Northbyte's prior written confirmation (email is enough) identifying the Designated Payor and the invoice. Payment by a Designated Payor discharges Customer's obligation only to the extent received in cleared funds. Customer remains fully liable for all amounts due, including any shortfall, fees, withholding, or amount reversed or recalled. A Designated Payor obtains no rights under the Agreement. Customer represents that neither Customer nor any Designated Payor is a sanctioned person under applicable sanctions laws and that the funds are lawfully sourced. Northbyte may reject or return any third-party payment and require direct payment from Customer, and may request reasonable know-your-customer information.

6.5 Taxes. Fees exclude taxes. Customer will pay all sales, use, VAT, GST, withholding, and similar taxes on the Fees, except taxes on Northbyte's net income. If withholding is required by law, Customer will gross up the payment so that Northbyte receives the full invoiced amount, and will provide evidence of the withholding.

6.6 Late payment and disputes. Overdue undisputed amounts bear interest at 1.5% per month or the maximum lawful rate, whichever is lower, from the due date until paid. Customer will reimburse reasonable collection costs. Customer must dispute any invoice in good faith in writing within 15 days of receipt and pay undisputed amounts on time. Amounts based on a usage report that became final under Section 6.3(d) cannot be disputed again at the invoice stage, except for calculation errors. The Parties will try to resolve disputes in good faith within 30 days, and any agreed adjustment will appear on the next invoice.

6.7 Suspension. Northbyte may suspend the Service, after at least 10 days' written notice, if any undisputed amount is more than 15 days overdue. Northbyte may also suspend immediately, limited to the extent reasonably needed, if Customer's use (a) violates Section 4.2, (b) poses a security risk to the Service or others, or (c) may create legal liability for Northbyte. Northbyte will restore the Service promptly once the cause is resolved. Suspension does not relieve Customer of payment obligations, and Fees (including any Minimum Commitment) continue to accrue during suspension.

6.8 Price changes. Northbyte may increase Fees for a renewal term by notice at least 45 days before the renewal, by no more than 5% over the prior term, unless the Order Form states otherwise.

7. Term, Renewal, and Termination

7.1 Term. This MSA applies from the Order Form Date of the first Order Form and continues until all Order Forms have expired or been terminated.

7.2 Subscription Term and renewal. Pay-as-you-go and ordinary monthly plans are month-to-month, without an annual commitment, unless Customer expressly agrees to a fixed term in a signed Order Form. A monthly plan renews for successive monthly billing periods unless Customer gives notice through an available cancellation control or in writing before the next period starts; cancellation takes effect at the end of the current period. Pay-as-you-go customers may stop use and cancel at any time, with Fees due for usage already incurred and no minimum unless expressly agreed. An Enterprise Order Form must state its initial term and whether it renews automatically, together with any renewal term and non-renewal notice period. If a fixed term is stated without an express automatic-renewal provision, it expires at the end of that term. If no term is stated, the default is month-to-month. Monthly billing alone does not create an annual commitment.

7.3 Termination for cause. Either Party may terminate the Agreement or an Order Form if the other Party: (a) materially breaches it and does not cure within 30 days after written notice (10 days for non-payment); or (b) becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to bankruptcy or similar proceedings not dismissed within 60 days.

7.4 Effect of termination. On termination or expiration: (a) Customer's right to use the Service ends; (b) Customer will pay all Fees accrued or committed through the end of the then-current Subscription Term (including any Minimum Commitment for the remaining periods), except that if Customer terminates for Northbyte's uncured breach, Northbyte will refund prepaid Fees for the unused period; and (c) each Party will return or destroy the other's Confidential Information, subject to Section 7.5.

7.5 Data return and deletion. On Customer's written request, Northbyte will make Customer Data that remains lawfully retained available for export in a standard format. Export requests do not extend retention deadlines or require recovery of data already deleted. Northbyte will apply the retention schedule and deletion triggers in the Security Annex, aligned with the Product Privacy Policy, including termination, uninstall, data no longer being necessary, and valid deletion requests. Northbyte aims to delete affected online data within 7 days of the applicable trigger and will complete deletion of applicable copies within 30 days. Shorter data-specific limits take priority: order-query snapshots expire within 24 hours, including copies in logs, backups, and other systems. Regular backups use a 14-day rolling cycle; any residual backup copies are isolated from normal use and deleted within 21 days after online deletion, always subject to the shorter applicable limit and overall 30-day deadline. Where law requires retention, only the necessary data is retained for the required period with access and use restricted to that legal purpose. Northbyte will confirm deletion in writing on request.

7.6 Survival. Sections 1, 2, 6 (for amounts owed), 7.4 to 7.6, 8, 10, 11, 12.3, 13, 14, and 16, and any other terms that by their nature should survive, survive termination.

8. Confidentiality

8.1 Definition. "Confidential Information" means non-public information disclosed by one Party to the other that is marked confidential or that a reasonable person would understand to be confidential, including Customer Data, pricing, the Service, security information, and business plans. It excludes information that: (a) is or becomes public through no fault of the recipient; (b) was known to the recipient without restriction before disclosure; (c) is received from a third party without a duty of confidentiality; or (d) is independently developed without use of the discloser's information.

8.2 Obligations. The recipient will use Confidential Information only to perform under the Agreement, protect it with at least reasonable care, and disclose it only to its and its Affiliates' employees, contractors, advisors, and subprocessors who need to know it and are bound by confidentiality obligations at least as protective as these.

8.3 Compelled disclosure. The recipient may disclose Confidential Information if required by law, after giving the discloser prompt notice (where legally allowed) and reasonable help to seek protection.

8.4 Duration. These obligations last during the term and for 3 years after, and for trade secrets and Customer Data, for as long as they remain protected by law or held by the recipient.

8.5 Remedies. Unauthorized disclosure may cause irreparable harm, and the discloser may seek injunctive relief in addition to other remedies.

9. Data Protection and Security

9.1 DPA. The Parties will comply with the DPA (https://gonovus.ai/legal/dpa), which forms part of the Agreement. Northbyte processes Personal Data in Customer Data as Customer's processor (GDPR) and service provider (CCPA), only on Customer's documented instructions.

9.2 Security program. Northbyte will maintain a written information security program with administrative, technical, and physical safeguards aligned with the AICPA SOC 2 Trust Services Criteria, as described in the Security Annex (https://gonovus.ai/legal/security). Northbyte will not materially reduce those safeguards during the Subscription Term.

9.3 Data location. Northbyte stores and hosts Customer Data only in the hosting region stated in the Order Form. If the Order Form does not state a hosting region, Northbyte stores and hosts Customer Data only in Microsoft Azure data centers located in United States regions. Northbyte will not move Customer Data to another hosting region without Customer's written agreement.

9.4 Security incidents. Northbyte will notify Customer without undue delay, and in any event within 72 hours after becoming aware, of a Security Incident (as defined in the DPA) affecting Customer Data, and will provide information and reasonable cooperation as described in the DPA.

9.5 No model training; agent optimization. Northbyte will not use Customer Data to train, fine-tune, or improve any AI or machine learning model, whether Northbyte's own or a third party's, and will contractually require its AI model providers not to use Customer Data for training. Northbyte does not train foundation models. For Customer's deployment and documented instructions, Northbyte may organize knowledge, configure and evaluate prompts, tools, guardrails, retrieval and agent workflows, and improve those deployment-specific configurations. This agent optimization does not train or fine-tune model parameters and does not authorize use of Customer Data to train a shared or third-party model. All such processing remains subject to the DPA, access controls and retention limits.

9.6 Audit. On written request no more than once per year, Northbyte will provide its most recent SOC 2 report (when available) or other third-party audit summary, and reasonable answers to a security questionnaire, under confidentiality. Until a SOC 2 report is issued, Northbyte will provide its current security documentation and audit status.

10. AI Output

10.1 Nature of AI. Customer acknowledges that the Service uses generative AI, that AI Output is generated automatically, and that AI Output may be inaccurate, incomplete, or inappropriate, and may not be unique.

10.2 Customer review. Customer is responsible for: (a) reviewing and approving the Service's configuration, Customer Content, instructions, and guardrails before launch and when they change; (b) monitoring AI Output through the dashboards and conversation logs provided; (c) keeping product, pricing, inventory, event, promotion, and other business information accurate; and (d) correcting or escalating issues promptly. Northbyte will reasonably assist with configuration and will address reported AI Output issues in line with the SLA.

10.3 No binding offers. AI Output does not constitute an offer, warranty, or commitment by Northbyte. As between the Parties, Customer is responsible for any offer, price, or representation made to End Users through Customer Properties, and Customer's own terms govern its transactions with End Users.

10.4 Ownership of AI Output. As between the Parties, and to the extent permitted by law, Customer owns AI Output generated for Customer, subject to Northbyte's rights in the Northbyte Materials.

11. Intellectual Property and Data Rights

11.1 Northbyte IP. Northbyte and its licensors own all rights, title, and interest, including all intellectual property rights, in the Northbyte Materials, including all improvements, enhancements, and derivatives of them, whether made by Northbyte alone or with Customer, and including any derived from Feedback (Section 11.4) or Usage Data, but excluding Customer Data. Northbyte keeps ownership of, and the right to use, its general tools, know-how, and pre-existing intellectual property, subject to Sections 8 and 9. No rights are granted except as expressly stated.

11.2 Customer Data. Customer owns Customer Data. Customer grants Northbyte a worldwide, non-exclusive, royalty-free license during the term to host, process, transmit, and display Customer Data as needed to provide, secure, and support the Service and as stated in the Agreement and the DPA.

11.3 Aggregated and Usage Data. Northbyte may collect and use Usage Data and create and use Aggregated Data to operate, secure, support, and improve the Service and for analytics and benchmarking, provided that Northbyte does not disclose any Customer Data or Confidential Information, does not identify Customer or any individual, and does not use Customer Data to train AI models as stated in Section 9.5.

11.4 Feedback. If Customer provides suggestions, comments, or other input about the Service ("Feedback"), Northbyte may use it without restriction or payment. Feedback does not include Customer Data or Customer Confidential Information.

11.5 Customer marks. Customer grants Northbyte a limited license to use Customer's names and logos within the Service as needed to display the Service on Customer Properties and to perform each Order Form.

11.6 Customer-Specific Deliverables. When Customer has paid in full the Fees for a Customer-Specific Deliverable, Customer owns it, and Northbyte assigns to Customer its rights in that Customer-Specific Deliverable at that time.

11.7 Northbyte Materials in Deliverables. If Northbyte Materials are embedded in or needed to use a Deliverable, Northbyte keeps ownership of them and grants Customer a non-exclusive, non-transferable, non-sublicensable license to use them with the Service, and only as needed to use the Deliverable, for as long as Customer is permitted to use the Service.

12. Warranties and Disclaimers

12.1 Mutual. Each Party warrants that it has the authority to enter into the Agreement and will comply with laws applicable to its performance.

12.2 Northbyte. Northbyte warrants that: (a) the Service will perform materially in accordance with the Documentation; (b) Professional Services will be performed in a professional and workmanlike manner; and (c) Northbyte will use industry-standard measures to avoid introducing malware into the Service. For breach of this Section 12.2, Customer's exclusive remedy, if notified within 30 days, is for Northbyte to use reasonable efforts to correct the issue, and if Northbyte cannot do so within 30 days, either Party may terminate the affected Order Form and Northbyte will refund prepaid Fees for the unused period.

12.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THE AGREEMENT, THE SERVICE, AI OUTPUT, AND PROFESSIONAL SERVICES ARE PROVIDED "AS IS." NORTHBYTE DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. NORTHBYTE DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE, THAT AI OUTPUT WILL BE ACCURATE, OR THAT THE SERVICE WILL ACHIEVE ANY PARTICULAR SALES, CONVERSION, OR ENGAGEMENT RESULTS. NORTHBYTE IS NOT RESPONSIBLE FOR THE PLATFORM, THIRD-PARTY SERVICES, OR INTERNET DELAYS OUTSIDE ITS CONTROL.

13. Indemnification

13.1 By Northbyte. Northbyte will defend Customer against any third-party claim alleging that the Service, as provided by Northbyte, infringes or misappropriates a third party's patent, copyright, trademark, or trade secret, and will pay damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, Northbyte may (a) obtain the right for Customer to keep using the Service, (b) modify it to be non-infringing, or (c) if neither is commercially reasonable, terminate the affected Order Form and refund prepaid Fees for the unused period. Northbyte has no obligation for claims arising from: Customer Data or Customer Content; AI Output modified by Customer or used in breach of the Agreement; combination with items not provided by Northbyte; the Platform; or use not in line with the Agreement or the Documentation.

13.2 By Customer. Customer will defend Northbyte against any third-party claim arising from: (a) Customer Data or Customer Content, including a claim that it infringes rights or was collected or provided in violation of law (including lack of required End User notice or consent); (b) Customer's products, services, events, Customer Properties, offers, promotions, prize draws, or transactions with End Users; or (c) Customer's breach of Section 4.2, and will pay damages and costs finally awarded or agreed in settlement.

13.3 Procedure. The indemnified Party must give prompt written notice of the claim (delay relieves the indemnitor only to the extent prejudiced), give the indemnitor sole control of the defense and settlement (no settlement may impose liability or admission on the indemnified Party without consent), and provide reasonable cooperation at the indemnitor's expense.

13.4 Exclusive remedy. This Section 13 states each Party's sole liability and exclusive remedy for third-party claims described in it.

14. Limitation of Liability

14.1 Exclusion of damages. EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, OR COST OF SUBSTITUTE SERVICES, EVEN IF ADVISED OF THEIR POSSIBILITY.

14.2 Cap. EXCEPT FOR EXCLUDED CLAIMS AND SUBJECT TO SECTION 14.3, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE AGREEMENT WILL NOT EXCEED THE GREATER OF (A) THE FEES PAID AND PAYABLE BY CUSTOMER UNDER THE AGREEMENT IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE LIABILITY, OR (B) THE LIABILITY CAP FLOOR STATED IN THE ORDER FORM (IF ANY).

14.3 Data Protection Cap. If the Order Form states a data protection multiple, Northbyte's total liability for breach of Section 9 (Data Protection and Security) or the DPA will not exceed that multiple times the amount in Section 14.2 (the "Data Protection Cap"). The Data Protection Cap replaces, and is not in addition to, the cap in Section 14.2 for those claims. If the Order Form does not state a multiple, Section 14.2 applies to those claims.

14.4 Excluded Claims. "Excluded Claims" means: (a) Customer's obligation to pay Fees; (b) a Party's indemnification obligations under Section 13; (c) a Party's gross negligence, fraud, or willful misconduct; and (d) Customer's breach of Section 4.2.

14.5 Application. These limits apply to all theories of liability, including contract, tort (including negligence), and strict liability, and apply even if a limited remedy fails of its essential purpose.

15. Insurance

During the term, Northbyte will maintain insurance as reasonably appropriate for its business. On request, Northbyte will provide a certificate of insurance.

16. General

16.1 Publicity. Northbyte may identify Customer by name and logo as a customer on its website and in marketing materials, unless Customer opts out by email. Any press release or case study requires Customer's prior written consent.

16.2 Compliance and export. Each Party will comply with anti-corruption, export control, and sanctions laws applicable to it. Customer will not use or permit access to the Service in a country or region subject to comprehensive U.S. sanctions, or by a person on a U.S. restricted-party list.

16.3 Force majeure. Neither Party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, such as natural disasters, war, terrorism, labor actions, government action, internet or utility failures, or failures of cloud or Platform providers, provided it uses reasonable efforts to resume performance. If the event lasts more than 30 days, either Party may terminate the affected Order Form by notice.

16.4 Assignment. Neither Party may assign the Agreement without the other's prior written consent, except that either Party may assign it without consent to an Affiliate or to a successor in a merger, acquisition, or sale of all or substantially all of its assets or business to which the Agreement relates, provided the assignee is not a direct competitor of the other Party. Any other assignment is void. The Agreement binds permitted successors and assigns.

16.5 Subcontractors. Northbyte may use employees, contractors, and subprocessors to perform the Service and remains responsible for their performance under the Agreement.

16.6 Independent contractors. The Parties are independent contractors. Nothing in the Agreement creates a partnership, joint venture, agency, or employment relationship.

16.7 Notices. Notices must be in writing and sent to the addresses in the Order Form (for Northbyte: Northbyte Inc., 2880 Zanker Rd., Suite 203, San Jose, CA 95134, Attn: Legal, with a copy by email to support@gonovus.ai). Notices are effective on receipt if delivered by hand or courier, or on the next business day if sent by email without a bounce-back. Routine operational notices (including invoices, service notices, and notices of new versions under Section 1.3) may be sent by email or through the Service.

16.8 Governing law and venue. The Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply. Each Party submits to the exclusive jurisdiction of the state and federal courts located in the State of Delaware, except that either Party may seek injunctive relief in any court of competent jurisdiction. The prevailing Party in any action to enforce the Agreement is entitled to its reasonable attorneys' fees. This Section does not override the governing law, forum or data subject rights required by the transfer terms in the DPA.

16.9 Entire agreement. The Agreement is the entire agreement of the Parties on its subject matter and supersedes all prior agreements and understandings on that subject matter.

16.10 Amendment; waiver. Except as stated in Section 1.3, the Agreement may be amended only in a writing signed by both Parties. A failure to enforce a provision is not a waiver.

16.11 Severability. If a provision is held unenforceable, it will be modified to the minimum extent necessary and the rest of the Agreement remains in effect.

16.12 Third-party beneficiaries. Except for rights granted under the EU Standard Contractual Clauses, the UK Addendum, or applicable Data Protection Laws, there are no third-party beneficiaries to the Agreement.

16.13 Counterparts; electronic signatures. Order Forms may be signed in counterparts and by electronic signature (including DocuSign or similar services), each of which is an original and together one instrument. Electronic signatures and records have the same effect as handwritten signatures under the U.S. ESIGN Act and the Delaware Uniform Electronic Transactions Act.