Master Services Agreement

In Short: This MSA plus your Order Form is the whole agreement between us. Several other pages are part of it by reference.

Who this is for

This MSA applies to customers who sign an Order Form naming this MSA. Self-serve customers who buy a plan directly on optimaflo.io are governed by the Terms of Service instead.

How it is accepted

This MSA takes effect on the date stated on the first Order Form that references it, or on the date it is countersigned, whichever is earlier. It then covers every later Order Form that refers to it, unless that Order Form says otherwise.

Documents incorporated by reference

The following pages are part of this Agreement:

• Data Processing Agreement: how we process personal data in Customer Data.
• Service Level Agreement: uptime commitment and support response targets, where it applies to your plan.
• Acceptable Use Policy: rules for using the Services.
• Refund and Cancellation Policy: billing, cancellation, and refunds.

Two more pages are referenced for information and are not contractual terms: our Privacy Policy (how we handle Account Data) and our Security overview (how we protect the Services). The security commitments that bind us are in the DPA.

Order of precedence

If these documents conflict, the order is: your Order Form, then the Data Processing Agreement for anything about data protection, then this MSA, then the Service Level Agreement, then the Acceptable Use Policy, then our product documentation ("Documentation").

• "Affiliate" means an entity that controls, is controlled by, or is under common control with a party.
• "Agreement" means this MSA together with each Order Form, the DPA, the SLA, the AUP, and the Refund and Cancellation Policy.
• "Authorized Users" means the individuals the customer allows to access the Services under its account.
• "Customer Data" means the data, pipelines, queries, dashboards, and configurations the customer creates in or connects to the Services, as defined in the Terms of Service and the DPA.
• "Documentation" means our published user and technical documentation for the Services.
• "Order Form" means a document, online order, or similar record that references this MSA and sets out the plan, term, and fees for a subscription.
• "Services" means the OptimaFlo platform and related services described in the applicable Order Form and Documentation.
• "Subscription Term" means the period stated on an Order Form during which the customer may use the Services.
• "Fees" means the amounts stated on an Order Form.
• "Confidential Information" has the meaning in Section 10.
• "AI Features" means the AI-assisted parts of the Services, including the Manager and the specialist AI roles, SQL generation, dashboard generation, and data-quality rule generation.
• "BYOC" means a bring-your-own-cloud deployment, where the data plane runs in the customer's own Google Cloud or AWS account.
• "Beta Features" means features we identify as beta, early access, preview, or similar.

Provision and access

During the Subscription Term we will make the Services available to the customer and its Authorized Users under this Agreement and the applicable Order Form. We will provide support and, where the Order Form and plan qualify, the availability commitment described in the Service Level Agreement.

BYOC and shared responsibility

In a BYOC deployment the data plane runs in the customer's own cloud account. The customer is solely responsible for infrastructure costs its cloud provider charges, as described in the Terms of Service "Cloud Infrastructure Costs (BYOC)" section, which applies to this Agreement too.

Changes to the Services

We may change or update the Services, including to improve them or to comply with the law, provided the change does not materially reduce the core functionality the customer is paying for during its current Subscription Term.

Beta Features

Beta Features are provided as is, may change or be withdrawn at any time, and are not covered by the Service Level Agreement or by the warranty in Section 12.

AI Features

AI Features may produce output that is incomplete or wrong. The customer is responsible for reviewing AI-generated output before relying on it. We do not use Customer Data to train AI models, whether our own or a third party's, as described in the DPA. If the customer configures its own AI provider key, requests made with that key go to that provider under the customer's own agreement with it.

An Order Form typically states:

• the customer's legal name and address;
• the plan or tier purchased;
• the Subscription Term's start date and length;
• the Fees and billing frequency;
• the payment method;
• whether the Service Level Agreement applies; and
• any special terms agreed for that Order Form.

An Affiliate of the customer may sign its own Order Form referencing this MSA; that Affiliate then has the rights and obligations of "customer" under that Order Form. If an Order Form conflicts with this MSA, the Order Form controls for that conflict only.

• Keep Authorized Users' credentials secure and be responsible for activity under its account.
• Comply with the Acceptable Use Policy and applicable law.
• Control and secure its own cloud account and the sources it connects.
• Not submit regulated data, such as protected health information or payment card data, unless the Order Form says the Services support it.
• Be responsible for its Authorized Users' compliance with this Agreement.

We invoice the Fees as stated on the Order Form. Unless the Order Form says payment is by card, invoices are due net 30 days from the invoice date. Amounts not paid when due accrue interest at 1.5% per month or the highest rate the law allows, whichever is lower. Fees do not include taxes; the customer is responsible for any tax other than our income tax.

Fees are based on the plan and any usage limits stated on the Order Form or the pricing page. Fees are non-cancellable and non-refundable once invoiced, except as stated in this MSA, the SLA, or the Refund and Cancellation Policy. If the customer disputes an invoice in good faith, it must tell us in writing within 30 days of the invoice date and pay the undisputed part; we will work together to resolve the dispute.

Each Order Form runs for the Subscription Term it states. Unless either party gives written notice of non-renewal at least 30 days before the end of the then-current term, the Order Form renews for an additional period of the same length, at the same Fees, unless we have given notice of a price change under this section.

We may change our Fees for a renewal term by giving the customer at least 60 days' notice before the renewal date. The new Fees apply starting with that renewal.

Termination for cause

Either party may terminate this Agreement or an Order Form if the other party materially breaches it and does not cure the breach within 30 days of written notice.

Suspension

We may suspend access for non-payment if the customer does not pay an undisputed amount within 10 days of a notice that payment is overdue. We may suspend access immediately, without notice, where needed to protect the security or integrity of the Services, other customers, or to comply with the law.

Effect of termination

On termination or expiration, the customer's right to use the Services ends, and any Fees owed for the period before termination remain due. The customer has 30 days after the end of the Subscription Term to export any remaining Customer Data, after which we delete it as described in the DPA. Sections of this MSA that by their nature should survive termination, including Sections 6, 9, 10, 11, 13, 14, and 16, survive.

In Short: The customer owns Customer Data. Data protection terms live in the DPA, not here.

The customer owns all Customer Data and everything it creates in the Services with it, including pipelines, queries, dashboards, and data-quality results. We claim no ownership in Customer Data. The customer grants us a limited, non-exclusive license to access and process Customer Data only as needed to provide, secure, and support the Services.

The Data Processing Agreement is incorporated into this Agreement and governs our processing of personal data in Customer Data, including security measures, sub-processors, breach notice, and deletion. Our processing of Account Data (the customer's and its users' name, login email, billing details, and how they use the Services) is described in the Privacy Policy and is not Customer Data.

We may collect and use data about the operation of the Services themselves, such as system performance, error rates, and feature usage, to provide, secure, and improve the Services. This operational data does not include Customer Data.

"Confidential Information" means non-public information either party discloses to the other that is marked confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure, including this Agreement's pricing and the Services' non-public technical details. It does not include information that is or becomes public without breach of this Agreement, was already known to the receiving party without an obligation of confidentiality, is received from a third party without breach of any obligation, or is independently developed without use of the disclosing party's Confidential Information.

Each party will use the other's Confidential Information only to perform this Agreement, protect it with at least the care it uses for its own confidential information of similar importance, and disclose it only to people who need it for that purpose and are bound by confidentiality obligations at least as protective as this section. A party may disclose Confidential Information if compelled by law, provided it gives the other party prompt notice where legally permitted so that party may seek protective measures.

These obligations continue for 3 years after this Agreement ends, except for trade secrets, which remain protected for as long as they qualify as trade secrets under applicable law. On request, each party will return or destroy the other's Confidential Information, subject to routine backup retention and legal hold obligations. Either party may seek injunctive relief for a breach of this section, in addition to other remedies.

We own the Services, the Documentation, and all intellectual property rights in them, other than Customer Data. The customer owns Customer Data and the pipelines, queries, dashboards, and configurations it creates in the Services. We grant the customer no rights in the Services beyond the right to use them under this Agreement, and the customer grants us no rights in Customer Data beyond the limited license in Section 9.

Feedback the customer sends us about the Services is handled as described in the Terms of Service "Submissions" section, which applies to this Agreement too. Use restrictions on the Services follow the Acceptable Use Policy.

Each party represents that it has the authority to enter into this Agreement. We warrant that the Services will perform materially in accordance with the Documentation during the Subscription Term. If they do not, our sole obligation is to correct the non-conformity; if we cannot correct it within a reasonable time, the customer may terminate the affected Order Form and receive a prorated refund of prepaid, unused Fees for the remainder of that term.

The customer represents that it has the right to submit the Customer Data it connects to the Services.

Except for the warranty above, the Services and any output of the AI Features are provided as is, and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent the law allows. We do not warrant that AI Feature output is accurate or complete. We are not responsible for the customer's cloud provider, the sources the customer connects, or other third-party services.

By us

We will defend the customer against a third-party claim that the Services, as provided by us and used as authorized, infringe that third party's intellectual property rights, and will pay any damages a court finally awards or that we agree to in settlement. This does not apply to claims arising from Customer Data, a combination of the Services with something we did not provide, the customer's modification of the Services, or use of the Services contrary to the Documentation or this Agreement. If we reasonably believe the Services infringe, we may, at our option, procure the right for the customer to keep using them, modify them to avoid the infringement without materially reducing functionality, or terminate the affected Order Form and refund prepaid, unused Fees for the remainder of the term.

By the customer

The customer will defend us against a third-party claim arising from Customer Data, the customer's misuse of the Services, the customer's violation of applicable law, or the customer's cloud account, and will pay any damages a court finally awards or that the customer agrees to in settlement.

Procedure

The party seeking indemnification will give the indemnifying party prompt written notice of the claim, let the indemnifying party control the defense and settlement, and reasonably cooperate at the indemnifying party's expense. The indemnifying party will not settle a claim in a way that admits fault by the other party without that party's written consent.

Neither party is liable to the other for indirect, incidental, consequential, special, exemplary, or punitive damages, or for lost profits or lost revenue, even if advised of the possibility.

Except for the items listed below, each party's total liability arising out of or related to this Agreement, across all claims combined, is limited to the Fees the customer paid or owed us in the 12 months before the event giving rise to the claim.

For a breach of Section 10 (Confidentiality) or of the data protection obligations in Section 9 and the DPA, each party's total liability is limited to two times the amount in the preceding paragraph.

These limits do not apply to: either party's indemnification obligations under Section 13; either party's gross negligence or willful misconduct; or the customer's payment obligations under Section 6. If an Order Form states a different liability cap, that cap controls for that Order Form.

We may identify the customer as a customer, including its company name and logo, on our website and in marketing materials, unless the customer opts out by emailing evan.rosa@optimaflo.io, as described in the Terms of Service "Customer Reference" section, which applies to this Agreement too. We will not publish a case study, quote, or specific metrics about the customer without its separate written consent under our Case Study Consent process.

This Agreement is governed by the laws of the State of Delaware, without regard to its conflict of law rules. Before starting a formal proceeding, the parties will try to resolve any dispute through informal negotiation for at least 30 days after written notice, then through binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association, seated in New Castle County, Delaware, as described in the Terms of Service "Dispute Resolution" section, which applies to this Agreement too. Claims to enforce or protect intellectual property rights, claims for injunctive relief, and other matters excluded under that section are not subject to arbitration and may be brought in the state and federal courts located in New Castle County, Delaware. Disputes may not be brought as a class action or on behalf of others, and must be brought within one year of the event giving rise to them.

• Assignment. Neither party may assign this Agreement without the other's consent, except to an Affiliate or in connection with a merger, acquisition, or sale of substantially all assets.
• Force majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control.
• Notices. Notices under this Agreement go by email to the addresses on the Order Form, or, for notices to us, to evan.rosa@optimaflo.io.
• Export and sanctions. Each party will comply with applicable export control and economic sanctions laws.
• Independent contractors. The parties are independent contractors; this Agreement does not create a partnership, joint venture, or agency relationship.
• No third-party beneficiaries. This Agreement benefits only the parties, except as the DPA states for Data Subjects.
• Severability. If a provision is unenforceable, the rest of the Agreement remains in effect.
• Waiver. Failure to enforce a provision is not a waiver of it.
• Entire agreement. This Agreement, together with each Order Form and the pages it incorporates by reference, is the entire agreement between the parties on its subject and supersedes prior discussions on that subject.
• Amendments. Changes to this Agreement must be in writing and signed by both parties, except that we may update the DPA, SLA, AUP, and Refund and Cancellation Policy as those pages describe.
• Counterparts and signatures. An Order Form may be signed in counterparts and electronically, each of which is an original.
• Precedence. The order of precedence in Section 1 governs any conflict between these documents.

For questions about this MSA or to request a countersigned copy, email evan.rosa@optimaflo.io or write to OptimaFlo, LLC, 18310 Montgomery Village Ave, Gaithersburg, MD 20879, United States.