StoreGenius

STOREGENIUS TERMS OF SERVICE & END USER LICENSE AGREEMENT

("Terms")

Last updated: July 28, 2026

These Terms of Service & End User License Agreement ("Terms") govern access to and use of the StoreGenius platform, software, APIs, analytics, customer experience tools, communications features, integrations, documentation, professional services, support, and related services provided by StoreGenius, with offices in Boise, Idaho, United States ("StoreGenius," "we," "us," or "our").

By clicking "I Agree," executing an order referencing these Terms, accessing or using the Service, creating an Account, or permitting any Authorized User to access or use the Service, Customer agrees to be bound by these Terms. If Customer does not agree, Customer may not access or use the Service.

If an individual accepts these Terms on behalf of an entity, such individual represents and warrants that they have authority to bind that entity. "Customer," "you," and "your" refer to the entity accepting these Terms, and, where applicable, its Authorized Users.

These Terms incorporate by reference any applicable order form, statement of work, pricing page, online plan, data processing addendum, acceptable use policy, privacy policy, support policy, service-level addendum, marketplace private offer, or other written agreement expressly referencing these Terms.

Order of Precedence

If there is a conflict among documents, the following order of precedence applies:

  1. the body of a signed order form, statement of work, master services agreement, or other written agreement executed by StoreGenius and Customer;
  2. any marketplace-required terms or private offer terms that, by the applicable marketplace operator’s rules, cannot be modified;
  3. any applicable data processing addendum, but only with respect to data processing, privacy, security, and international transfer matters;
  4. these Terms;
  5. StoreGenius’s acceptable use policy, privacy policy, support policy, documentation, pricing page, or other referenced policies.

Any purchase order, vendor onboarding document, procurement terms, click-through terms, security questionnaire terms, or other Customer-issued document containing additional or conflicting terms is rejected and has no effect unless StoreGenius expressly agrees to such terms in a signed writing.

1. Definitions

"Account" means the account, workspace, tenant, instance, or administrative environment created or enabled for Customer to access and use the Service.

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of voting power or equity interests.

"Aggregated Data" or "De-Identified Data" means data derived from Customer Data, Usage Data, or operation of the Service that does not identify Customer, any Authorized User, any individual, or any specific merchant or event.

"Authorized Users" means Customer’s employees, contractors, agents, representatives, merchant personnel, client personnel, consultants, or other users authorized by Customer to access or use the Service.

"StoreGenius IP" means the Service, software, source code, object code, APIs, models, algorithms, workflows, architecture, designs, interfaces, dashboards, documentation, templates, prompts, system prompts, analytics methods, know-how, improvements, modifications, derivative works, Usage Data, Aggregated Data, De-Identified Data, and all related intellectual property rights.

"Confidential Information" has the meaning given in Section 14.

"Customer Data" means data, content, files, records, customer information, event information, CRM data, ticketing data, communications data, operational information, configurations, and other materials submitted to, uploaded to, transmitted through, collected by, or made available to the Service by or on behalf of Customer. Customer Data excludes StoreGenius IP, Usage Data, Aggregated Data, and De-Identified Data.

"Customer Personal Data" means Personal Data contained within Customer Data.

"Customer Systems" means systems, applications, accounts, databases, devices, networks, infrastructure, software, platforms, tools, services, APIs, endpoints, or environments owned, operated, selected, supplied, configured, controlled, or authorized by Customer or its vendors, providers, contractors, or partners.

"Documentation" means StoreGenius’s published technical, product, API, support, and end-user documentation for the Service.

"Downstream Systems" means Customer Systems or third-party systems to which the Service sends, transmits, exports, syncs, posts, delivers, routes, or otherwise makes available Customer Data, Outputs, messages, alerts, reports, events, files, recommendations, analytics, or other Service-related data.

"End Customer" means any customer, client, merchant, team, promoter, agency, concessionaire, sponsor, partner, or other third party for whose benefit Customer uses or operates the Service.

"Customer Data" means Customer Data relating to fans, attendees, customers, patrons, visitors, invitees, ticket holders, account holders, loyalty members, employees, contractors, or other individuals who interact with Customer’s merchants, events, experiences, or services.

"Input" means prompts, instructions, queries, files, data, configurations, requests, workflows, business rules, or other information submitted by Customer or Authorized Users to the Service.

"Legal Process" means a subpoena, warrant, court order, governmental request, regulatory request, legal demand, or other valid legal process.

"Order" means an order form, statement of work, online order, marketplace transaction, private offer, pricing plan, or other ordering document referencing these Terms.

"Output" means responses, recommendations, summaries, analytics, classifications, predictions, insights, messages, generated text, suggested actions, reports, dashboards, scores, alerts, or other results generated by the Service in response to Inputs or Customer Data.

"Personal Data" means information relating to an identified or reasonably identifiable natural person, as defined by applicable data protection laws.

"Professional Services" means implementation, onboarding, configuration, training, consulting, event-day support, data migration, custom integration, or similar services provided by StoreGenius under an Order or statement of work.

"Protected Health Information" or "PHI" has the meaning given under HIPAA.

"Service" means the StoreGenius platform and related software-as-a-service products, customer experience tools, analytics tools, dashboards, communications features, APIs, integrations, documentation, support, Professional Services, and related offerings.

"Source Systems" means Customer Systems or third-party systems from which the Service receives, imports, syncs, ingests, accesses, retrieves, or otherwise obtains Customer Data or other data.

"Subscription" means the right to access and use the Service for a defined term, scope, plan, usage level, event, merchant, location, account, or other commercial arrangement.

"Subprocessor" means a third-party processor engaged by StoreGenius to process Customer Personal Data on behalf of Customer in connection with the Service.

"Third-Party Services" means services, systems, platforms, APIs, applications, databases, networks, devices, data sources, infrastructure, carriers, messaging providers, email providers, cloud providers, ticketing systems, CRM systems, CDPs, POS systems, access control systems, Wi-Fi systems, identity providers, payment providers, data warehouses, analytics platforms, or other products or services not provided and controlled by StoreGenius.

"Usage Data" means technical, diagnostic, performance, security, telemetry, usage, and operational data generated by or relating to the operation, access, performance, availability, security, configuration, or use of the Service.

"Usage Limits" means limits applicable to a Subscription, including limits based on merchants, locations, events, users, devices, messages, contacts, integrations, API calls, data volumes, storage, or other metrics specified in an Order, pricing page, plan, or Documentation.

2. Changes to These Terms

StoreGenius may update these Terms from time to time by posting revised terms, updating the "Last updated" date, or providing notice through the Service, email, marketplace channel, or other reasonable means.

For changes that materially reduce Customer’s rights or materially expand Customer’s obligations, StoreGenius will provide reasonable notice before the changes take effect. Material changes will not apply to a current paid Subscription term without Customer’s consent, except where reasonably necessary to comply with law, address security risks, prevent abuse, reflect changes to Third-Party Services, or preserve the security or integrity of the Service.

Continued use of the Service after updated Terms become effective constitutes acceptance of the updated Terms.

3. Access; License; Account

3.1 SaaS Access License

Subject to Customer’s payment of applicable fees and compliance with these Terms, StoreGenius grants Customer a limited, revocable, non-exclusive, non-transferable, non-sublicensable right during the Subscription term to access and use the Service for Customer’s internal business purposes and permitted customer experience, merchant, event, and operational use cases.

All rights not expressly granted are reserved by StoreGenius.

3.2 Account Information

Customer will provide complete and accurate Account, billing, administrative, security, and contact information and will keep such information current throughout the Subscription term. StoreGenius is not responsible for delays, failures, notices missed, account issues, or losses resulting from inaccurate or outdated Customer information.

3.3 Authorized Users

Customer is responsible for all acts and omissions of Authorized Users and for maintaining the confidentiality of credentials, accounts, access tokens, API keys, and administrative permissions.

Login credentials may be used only by the Authorized User to whom they are issued. Customer will not share credentials or permit unauthorized access.

Customer will promptly notify StoreGenius of any unauthorized access, credential compromise, suspected breach, or security incident involving the Service.

3.4 Customer Security Responsibilities

Customer is responsible for maintaining appropriate security controls for its systems, accounts, devices, networks, integrations, users, credentials, and Customer Data. Customer will use reasonable safeguards, including multi-factor authentication where available, role-based access controls, secure credential storage, and timely removal of access for users who no longer require it.

Customer will access and transmit Customer Data to and from the Service only through encrypted, authenticated, documented, and StoreGenius-approved methods.

3.5 Backups

Customer is responsible for maintaining backups or copies of Customer Data outside the Service as appropriate for Customer’s business, legal, operational, and retention requirements.

4. Scope; Usage Limits; APIs; End-Customer Use

4.1 Scope and Usage Limits

Use of the Service is limited to the Subscription scope and applicable Usage Limits. If Customer exceeds Usage Limits, StoreGenius may, after reasonable notice where practicable, throttle usage, invoice for overages, require an upgrade, or suspend excess usage.

4.2 APIs and Data Export

Where StoreGenius makes APIs or export tools available, Customer may access documented APIs and export Customer Data using available tools, subject to reasonable rate limits, security controls, technical safeguards, and Documentation.

Customer may not use APIs, export tools, or integrations to scrape, replicate, reverse engineer, bulk extract, benchmark, or build a competing product or service.

4.3 End-Customer / Client Use

If Customer operates the Service on behalf of End Customers, Customer may permit such End Customers and their contractors to access the Service solely for Customer’s or such End Customers’ benefit, provided that Customer:

  1. remains responsible for all use of the Service;
  2. ensures such users are bound by written terms no less protective of StoreGenius than these Terms;
  3. obtains all required rights, permissions, notices, and consents;
  4. is responsible for all Customer Data and Customer Data submitted or processed by such users;
  5. ensures such use remains within the applicable Order and Usage Limits.

No End Customer or other third party receives any direct rights against StoreGenius unless expressly agreed by StoreGenius in writing.

5. Restrictions; Acceptable Use

Customer will not, and will not permit any third party to:

  1. use the Service in violation of applicable law, these Terms, Documentation, or third-party rights;
  2. reverse engineer, decompile, disassemble, or attempt to derive source code, algorithms, models, prompts, system prompts, architecture, training data, model weights, trade secrets, or non-public functionality of the Service, except to the extent applicable law prohibits this restriction;
  3. modify, adapt, translate, or create derivative works of the Service except as expressly permitted by StoreGenius;
  4. use the Service to build, train, benchmark, test, evaluate, or improve a competing product, model, system, platform, or service;
  5. publish, disclose, or provide any benchmark, performance, comparison, availability, security, or evaluation results relating to the Service without StoreGenius’s prior written consent;
  6. scrape, crawl, harvest, bulk export, or systematically extract data, Outputs, content, or functionality except as expressly permitted by Documentation;
  7. resell, sublicense, time-share, rent, lease, or otherwise make the Service available to third parties except as expressly permitted in these Terms or an Order;
  8. circumvent, disable, interfere with, or defeat security controls, access controls, rate limits, monitoring tools, safety mechanisms, authentication systems, content filters, or usage restrictions;
  9. probe, scan, penetration test, load test, or vulnerability test the Service without StoreGenius’s prior written approval;
  10. introduce malware, malicious code, exploits, worms, logic bombs, or harmful data;
  11. use the Service to perform malicious activity or violate the security or integrity of any network, computer system, communications system, software application, cloud service, or device;
  12. use the Service to send spam, unlawful messages, deceptive communications, unsolicited mass emails, unlawful promotions, or communications that violate consent, opt-out, marketing, telecommunications, or messaging laws;
  13. submit Customer Data or Customer Data that Customer lacks the right to submit or that violates applicable law or third-party rights;
  14. remove, obscure, or alter proprietary notices, trademarks, copyright notices, attribution, or provenance indicators;
  15. use the Service for unlawful surveillance, unlawful biometric identification, social scoring, discriminatory profiling, or other unlawful treatment of individuals;
  16. use the Service to make fully automated decisions that legally or materially affect individuals without appropriate human review and legal compliance;
  17. use the Service in high-risk, hazardous, or fail-safe environments where failure of the Service could lead to death, personal injury, severe property damage, severe environmental damage, or other severe harm;
  18. use the Service for emergency response, public safety, life-safety, medical, law enforcement, security, or evacuation purposes as the sole or primary system of record or communication unless expressly agreed in a signed Order;
  19. process or store data subject to the International Traffic in Arms Regulations without StoreGenius’s prior written approval;
  20. use the Service in violation of U.S. or other applicable export control, sanctions, anti-boycott, or trade compliance laws.

The above examples are illustrative and not exhaustive. StoreGenius may monitor use of the Service as reasonably necessary to secure the Service, prevent abuse, enforce these Terms, comply with law, operate the Service, and protect StoreGenius, Customer, Authorized Users, customers, and third parties.

6. Merchant, Event, and Customer Experience Responsibilities

Customer acknowledges that the Service is a software, analytics, communications, and customer experience platform. StoreGenius does not operate Customer’s merchants, events, teams, properties, personnel, safety systems, access systems, ticketing systems, transportation systems, parking operations, concessions, merchandise operations, emergency services, medical services, security teams, or customer services departments.

Customer is solely responsible for:

  1. merchant and event operations;
  2. staffing, training, supervision, and human review;
  3. customer safety and security decisions;
  4. crowd control and emergency procedures;
  5. customer communications and legal compliance;
  6. ticketing, admissions, refunds, access control, loyalty, sponsorship, concessions, merchandise, parking, transportation, and other operational decisions;
  7. verifying the accuracy and appropriateness of any Output, recommendation, message, alert, workflow, automation, or analytics before acting on it;
  8. compliance with laws applicable to merchants, events, customers, accessibility, privacy, consumer protection, marketing, telecommunications, public safety, and employment.

The Service is not a substitute for professional judgment, legal advice, emergency response, medical advice, security advice, public safety procedures, accessibility advice, insurance advice, or human decision-making.

6.1 Emergency Communications Limitation

Unless expressly agreed in a signed Order, the Service is not designed or certified as an emergency notification system, public safety system, life-safety system, 911 system, mass evacuation system, medical response system, or sole source of emergency communications. Customer must maintain independent emergency, safety, public-address, security, evacuation, and incident-response procedures appropriate for its merchants and events.

6.2 Customer Configuration Responsibility

Customer is responsible for configuring the Service, permissions, campaigns, automations, integrations, data mappings, segments, business rules, user access, and workflows in accordance with Customer’s intended use, legal obligations, and operational requirements.

StoreGenius is not responsible for errors, omissions, misdirected communications, operational outcomes, or customer-impacting decisions caused by Customer configurations, instructions, data mappings, segments, workflows, permissions, or business rules.

7. Service Availability; Support; Maintenance

7.1 Support

StoreGenius provides support via support@storegenius.ai and/or in-product mechanisms, according to StoreGenius’s applicable support policy and the level of support purchased by Customer.

7.2 Support Hours

Standard support hours are Monday through Friday, 9:00 a.m. to 5:00 p.m. America/Boise, excluding U.S. federal holidays.

Optional event-day, match-day, show-day, festival-day, playoff, peak-season, or on-call support may be offered separately.

7.3 Response Targets

Target initial responses:

SeverityDescriptionTarget Initial Response
Severity 1Critical outage materially affecting production event operationsWithin 15 minutes if event-day/on-call coverage applies; otherwise within 4 hours during support hours
Severity 2Major degradation affecting core functionalityWithin 1 business day
Severity 3Standard issue or non-critical defectWithin 2 business days
Severity 4Questions, configuration requests, or general supportWithin 5 business days

Response targets are goals, not guarantees, unless expressly stated in a signed SLA.

7.4 Service-Level Agreements

Any uptime, availability, service credit, or service-level commitment applies only if expressly stated in a signed Order, SLA, or service-level addendum. Unless expressly stated otherwise, applicable service credits are Customer’s sole and exclusive remedy for StoreGenius’s failure to meet such service-level commitment.

Downtime, degradation, errors, delays, failed transmissions, non-delivery, or failed processing caused by Third-Party Services, Customer Systems, Source Systems, Downstream Systems, Customer Data, Customer configurations, internet or telecommunications failures, messaging providers, carriers, cloud providers, merchant networks, Wi-Fi systems, or other causes outside StoreGenius’s reasonable control are excluded from any uptime, availability, service-level, support-response, or service-credit calculation.

7.5 Maintenance

StoreGenius may perform maintenance and will provide advance notice of planned maintenance expected to materially impact availability when reasonably practicable. StoreGenius may perform emergency maintenance without advance notice when necessary to protect the Service, Customer Data, users, or third parties.

8. Fees; Billing; Taxes

8.1 Fees

Customer will pay fees as stated in the applicable Order, plan, pricing page, statement of work, marketplace private offer, or other ordering document. Fees are non-refundable except as expressly stated in these Terms or an applicable Order.

8.2 Billing Start; Go-Live

If applicable, billing may commence when the Service is enabled in production and capable of receiving, transmitting, analyzing, or processing operational data for Customer’s environment, merchant, event, or Account ("Go-Live").

8.3 Payment Terms

Unless otherwise stated in an Order, invoices are due net 30. Late payments may accrue interest at the lesser of 1.5% per month or the maximum permitted by law.

8.4 Taxes

Fees exclude applicable sales, use, VAT, GST, excise, withholding, and similar taxes. Customer is responsible for such taxes, excluding taxes on StoreGenius’s income.

8.5 Non-Payment

StoreGenius may suspend the Service for delinquent undisputed fees after notice and a reasonable cure period. Customer remains responsible for all amounts due.

8.6 Marketplace Payments

If Customer purchases through a cloud marketplace or reseller, Customer’s payment obligations may be governed by the applicable marketplace or reseller agreement. Customer may not access or use the Service if Customer fails to comply with applicable payment obligations.

9. Customer Data; Customer Data; Privacy

9.1 Ownership

As between the parties, Customer owns Customer Data. StoreGenius does not acquire ownership of Customer Data.

9.2 License to Process

Customer grants StoreGenius a limited, worldwide, non-exclusive, royalty-free license to host, copy, process, transmit, display, analyze, transform, and use Customer Data solely as necessary to:

  1. provide, operate, maintain, secure, and support the Service;
  2. provide analytics, reporting, recommendations, communications, and Outputs to Customer;
  3. prevent or address service, security, fraud, abuse, or technical issues;
  4. comply with Customer’s lawful instructions;
  5. comply with applicable law;
  6. improve the Service using Aggregated Data, De-Identified Data, and Usage Data as permitted below.

9.3 Customer Responsibility for Data

Customer is responsible for Customer Data, including its accuracy, quality, legality, integrity, completeness, formatting, and use. Customer represents and warrants that it owns or has all rights, licenses, permissions, notices, and consents necessary to provide Customer Data to the Service and to authorize StoreGenius’s processing as contemplated by these Terms.

StoreGenius is not responsible for errors, omissions, duplicate records, outdated records, incorrect customer profiles, failed matches, failed segmentation, failed communications, or inaccurate Outputs caused by inaccurate, incomplete, delayed, unlawful, or improperly formatted Customer Data, Customer Systems, Source Systems, Downstream Systems, or Third-Party Services.

9.4 No Sale or Advertising Use

StoreGenius will not sell Customer Data or use Customer Data for third-party advertising purposes.

9.5 Aggregated, De-Identified, and Usage Data

StoreGenius may create and use Aggregated Data, De-Identified Data, and Usage Data for analytics, benchmarking, reporting, security, fraud prevention, billing, capacity planning, performance monitoring, product improvement, research, development, and marketing statistics, provided such data does not identify Customer, Authorized Users, any individual, or any specific merchant or event.

9.6 Customer Data and Communications Compliance

Customer is responsible for providing all required notices and obtaining all required consents for the collection, use, processing, transmission, messaging, and disclosure of Customer Data, including consents required under privacy, consumer protection, marketing, telecommunications, SMS, email, push notification, call recording, biometric, geolocation, accessibility, and merchant/event laws.

Customer is responsible for honoring opt-outs, suppression lists, unsubscribe requests, communication preferences, deletion requests, access requests, correction requests, and legal restrictions applicable to Customer Data and customer communications.

9.7 Messaging and Deliverability

StoreGenius does not guarantee delivery, timing, receipt, open rates, click-through rates, conversions, or engagement for SMS, email, push notification, in-app, chatbot, voice, or other customer communications. Delivery may depend on third-party carriers, messaging providers, app permissions, device settings, spam filters, email providers, network conditions, customer opt-outs, Customer configurations, and applicable law.

9.8 Sensitive and Regulated Data

Unless expressly agreed in writing, the Service is not intended to process payment cardholder data, full payment account numbers, sensitive authentication data, government identification numbers, Protected Health Information, children’s data requiring parental consent, biometric templates, precise geolocation data requiring special consent, or other highly regulated data.

Customer will not submit, store, transmit, or process Protected Health Information through the Service unless Customer and StoreGenius have entered into a Business Associate Agreement expressly covering such processing.

9.9 Personal Data and Data Processing Addendum

Each party will comply with applicable data protection laws. Where required, the parties will enter into StoreGenius’s data processing addendum. Customer is responsible for determining whether a data processing addendum is required and for providing all legally required notices and consents to individuals.

9.10 Data Subject and Consumer Privacy Requests

If StoreGenius receives a request from an individual relating to Customer Data and the request identifies Customer, StoreGenius may direct the individual to Customer. Customer is responsible for responding to data subject, consumer privacy, customer privacy, deletion, access, correction, opt-out, portability, restriction, and similar requests, including by using Service functionality where available. StoreGenius will provide reasonable assistance as required by applicable law.

9.11 Data Security Incident Notice

StoreGenius will notify Customer without undue delay after becoming aware of a confirmed security incident materially affecting Customer Data and will provide information reasonably necessary for Customer to meet legal obligations.

9.12 Data Export and Deletion

Upon written request within 30 days after termination or expiration, StoreGenius will provide a reasonable export of remaining Customer Data then available in the Service. Thereafter, Customer Data may be deleted in accordance with StoreGenius’s retention policies unless legally required to retain it.

Customer is solely responsible for exporting Customer Data before expiration or termination to the extent Customer requires continued access.

10. AI, Analytics, Outputs, and Human Review

10.1 Outputs

Subject to Customer’s compliance with these Terms and payment of applicable fees, Customer may use Outputs generated for Customer through the Service for Customer’s internal business purposes and permitted merchant, event, customer experience, and operational use cases.

StoreGenius does not claim ownership of Customer-specific Outputs, except that StoreGenius retains all rights in StoreGenius IP, Usage Data, Aggregated Data, De-Identified Data, underlying models, algorithms, software, templates, workflows, prompts, system prompts, analytics methods, and Service functionality.

10.2 Similar Outputs

Customer acknowledges that due to the nature of generative, probabilistic, and analytical systems, the same or similar Inputs may produce the same or similar Outputs for Customer or other StoreGenius customers. Outputs may not be unique to Customer.

10.3 Output Limitations

Customer acknowledges that the Service may include machine learning, artificial intelligence, automation, analytics, recommendations, predictions, scoring, summarization, message generation, or other probabilistic technologies.

Outputs may be inaccurate, incomplete, delayed, biased, outdated, duplicative, offensive, unsuitable, or fabricated. StoreGenius does not warrant that Outputs are accurate, complete, reliable, lawful, non-infringing, appropriate for a particular use, or suitable for making operational, legal, safety, financial, employment, access, security, emergency, or customer-impacting decisions without human review.

10.4 Human Review

Customer is solely responsible for evaluating Outputs and for decisions or actions taken in reliance on Outputs. Customer will implement human review, quality control, fact checking, validation, escalation, and oversight processes appropriate for the use case and risk.

Where Outputs may affect customers, employees, contractors, ticket holders, patrons, access rights, refunds, benefits, accommodations, safety, security, law enforcement, medical response, or other material interests, Customer is responsible for human review and compliance with applicable law.

10.5 No Professional or Emergency Advice

The Service and Outputs are not legal, financial, medical, emergency, public safety, security, accessibility, insurance, employment, or professional advice. Customer should consult qualified professionals and responsible personnel before acting on any Output in high-impact or regulated contexts.

10.6 No Training on Customer Data

StoreGenius will not use Customer Data, Inputs, or Customer-specific Outputs to train, fine-tune, or improve generally available artificial intelligence models outside the Service except to the extent:

  1. Customer expressly consents in writing;
  2. the data has been Aggregated or De-Identified so it does not identify Customer, any individual, or any specific merchant or event;
  3. such use is required by applicable law.

Customer-specific configurations, retrieval indexes, embeddings, analytics models, automations, workflows, or customizations created for Customer’s use within the Service do not constitute training of generally available models.

11. Security

11.1 Safeguards

StoreGenius maintains commercially reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of the Service and Customer Data.

11.2 Security Measures

StoreGenius maintains at least the following safeguards:

  1. access controls and authentication controls, including multi-factor authentication for privileged access to production systems;
  2. encryption of Customer Data at rest using AES-256 and in transit using TLS 1.2 or higher;

StoreGenius’s safeguards may also include, as appropriate to the Service:

  1. logical tenant separation;
  2. personnel confidentiality obligations;
  3. security training;
  4. access logging and monitoring;
  5. vendor and subprocessor diligence;
  6. incident response processes;
  7. vulnerability management practices;
  8. business continuity and disaster recovery planning.

StoreGenius may update its security measures from time to time, provided such updates do not materially degrade the overall security of the Service.

11.3 Suspension for Security

StoreGenius may suspend access to the Service, in whole or in part, if StoreGenius reasonably believes that:

  1. an Account has been compromised;
  2. use of the Service creates a security, legal, operational, integrity, or reputational risk;
  3. Customer or an Authorized User is violating these Terms;
  4. suspension is required by law;
  5. continued access may harm StoreGenius, Customer, customers, other customers, the Service, or third parties.

StoreGenius will provide advance notice of suspension where reasonably practicable. If StoreGenius reasonably believes immediate suspension is required, StoreGenius may suspend without advance notice and will provide notice promptly after suspension where legally and practically permitted.

12. Subprocessors

Customer authorizes StoreGenius to engage Subprocessors to provide the Service. StoreGenius will impose written obligations on Subprocessors materially protective of Customer Data and will remain responsible for Subprocessors’ processing of Customer Data to the extent required by applicable data protection law.

StoreGenius may maintain a list of Subprocessors and may update that list from time to time. Where required by applicable data protection law, StoreGenius will provide notice of new Subprocessors. Customer may object to a new Subprocessor on reasonable data-protection grounds by providing written notice within the applicable notice period.

If Customer objects, the parties will discuss the objection in good faith. If the parties cannot resolve the objection, Customer may terminate the affected Service as its sole and exclusive remedy.

13. Third-Party Services; Source Systems; Downstream Systems

The Service may receive data from, transmit data to, or interoperate with Third-Party Services, Customer Systems, Source Systems, Downstream Systems, APIs, data sources, ticketing systems, CRM systems, CDPs, POS systems, access control systems, Wi-Fi systems, messaging providers, payment providers, identity providers, merchant systems, analytics platforms, data warehouses, cloud services, customer systems, and other systems or services not provided and controlled by StoreGenius.

StoreGenius is not responsible for any Third-Party Service, Customer System, Source System, Downstream System, integration endpoint, API, network, infrastructure, device, database, data warehouse, messaging provider, carrier, or other system not provided and controlled by StoreGenius, including its availability, uptime, security, performance, accuracy, latency, throughput, rate limits, data quality, outages, delays, errors, authentication failures, rejected transmissions, failed jobs, API changes, discontinued functionality, pricing changes, access restrictions, or compliance with law.

Without limiting the foregoing, StoreGenius is not responsible for any failure, delay, degradation, loss, corruption, inaccuracy, non-delivery, duplicate delivery, or misdelivery of data, messages, alerts, reports, Outputs, or other materials to the extent caused by:

  1. Customer Data or data supplied by Customer or a third party;
  2. Customer’s systems, networks, devices, credentials, permissions, configurations, data mappings, business rules, or workflows;
  3. Source Systems or Downstream Systems selected, supplied, configured, or authorized by Customer;
  4. Third-Party Services, APIs, rate limits, outages, errors, suspensions, deprecations, or changes;
  5. messaging providers, carriers, email providers, app stores, device settings, spam filters, push notification services, or user opt-outs;
  6. internet, telecommunications, cloud, hosting, merchant network, Wi-Fi, or infrastructure failures outside StoreGenius’s reasonable control;
  7. Customer’s failure to maintain required accounts, licenses, permissions, consents, credentials, API access, or third-party agreements.

Failures, delays, degradation, or unavailability caused by Third-Party Services, Customer Systems, Source Systems, Downstream Systems, or other causes outside StoreGenius’s reasonable control will not be deemed a breach of these Terms, a failure of the Service, a warranty breach, downtime for purposes of any SLA, or grounds for service credits, refunds, termination, or other remedies, except to the extent expressly stated in a signed Order or SLA.

Customer is responsible for obtaining and maintaining all rights, permissions, licenses, credentials, API access, third-party accounts, notices, consents, configurations, and agreements required for StoreGenius to access, receive data from, transmit data to, or interoperate with any Third-Party Service, Customer System, Source System, or Downstream System.

If a Third-Party Service, Customer System, Source System, or Downstream System becomes unavailable, insecure, unreliable, unlawful, unsupported, commercially unreasonable, or incompatible with the Service, StoreGenius may modify, suspend, or discontinue the affected integration without liability.

14. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other that is identified as confidential or should reasonably be understood to be confidential given its nature and circumstances.

Customer Data is Customer’s Confidential Information. Non-public aspects of the Service, including software, models, algorithms, prompts, system prompts, security information, technical information, roadmaps, pricing, and business information, are StoreGenius’s Confidential Information.

Each party will:

  1. protect the other party’s Confidential Information using at least reasonable care;
  2. use Confidential Information only to perform under these Terms;
  3. limit access to personnel, contractors, advisors, and representatives who need to know and are bound by confidentiality obligations at least as protective as these Terms.

Confidential Information does not include information that is public without breach, lawfully known before disclosure, lawfully received from a third party without confidentiality obligations, or independently developed without use of the other party’s Confidential Information.

A party may disclose Confidential Information if required by law, court order, or Legal Process, provided that it gives prompt notice where legally permitted and reasonably cooperates in seeking confidential treatment. Customer is responsible for responding to third-party requests concerning Customer’s use of the Service or Customer Data.

15. Intellectual Property

15.1 StoreGenius IP

StoreGenius retains all right, title, and interest in and to StoreGenius IP.

15.2 Customer Data

Customer retains ownership of Customer Data, subject to the licenses granted in these Terms.

15.3 Feedback

If Customer or any Authorized User provides suggestions, ideas, comments, enhancement requests, recommendations, corrections, or other feedback regarding the Service, Customer grants StoreGenius a non-exclusive, worldwide, perpetual, irrevocable, royalty-free, sublicensable, transferable license to use, modify, commercialize, and incorporate such feedback without restriction or compensation.

15.4 No Implied Rights

No rights are granted except as expressly stated in these Terms.

16. Professional Services

Professional Services are provided only if expressly stated in an Order or statement of work. Unless expressly stated otherwise, Professional Services do not include legal, privacy, security, marketing-compliance, emergency-response, medical, accessibility, insurance, public-safety, or operational advice.

Customer is responsible for reviewing and approving all configurations, deliverables, data mappings, workflows, campaigns, automations, integrations, and implementation outputs before production use.

Any deliverables created by StoreGenius in connection with Professional Services are part of StoreGenius IP, except for Customer Data and Customer’s pre-existing materials. StoreGenius grants Customer a limited right to use such deliverables solely with the Service during the applicable Subscription term.

17. Warranties; Disclaimers

17.1 Mutual Authority

Each party represents and warrants that it has authority to enter into and perform under these Terms.

17.2 Mutual Legal Compliance

Each party will comply with laws applicable to its provision or use of the Service, as applicable.

17.3 Service Warranty

During the Subscription term, the Service will operate materially in accordance with StoreGenius’s published Documentation when used as permitted.

17.4 Support Warranty

If StoreGenius provides Support or Professional Services, StoreGenius will perform such services in a diligent and workmanlike manner consistent with industry standards.

17.5 Remedy

If the Service, Support, or Professional Services materially fail to meet Sections 17.3 or 17.4 and Customer provides prompt written notice, StoreGenius will use commercially reasonable efforts to correct the issue or re-perform the affected services. If StoreGenius does not correct the issue or re-perform the affected services within a reasonable time, Customer may terminate the affected Subscription and receive a pro-rated refund of prepaid fees for the unused portion of the affected Service.

This is Customer’s sole remedy for breach of the service or support warranties.

17.6 Disclaimers

Except as expressly stated in these Terms or an applicable Order, the Service, Documentation, Support, Professional Services, beta features, integrations, analytics, recommendations, and Outputs are provided "as is" and "as available."

To the maximum extent permitted by law, StoreGenius disclaims all implied warranties and conditions, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, uninterrupted operation, error-free operation, and warranties arising from course of dealing, usage, or trade practice.

StoreGenius does not warrant that:

  1. the Service will be uninterrupted, secure, or error-free;
  2. all defects will be corrected;
  3. Outputs will be accurate, complete, reliable, lawful, or suitable for Customer’s use;
  4. the Service will prevent operational failures, security incidents, customer complaints, event disruptions, remerchant loss, safety issues, or third-party system failures;
  5. Third-Party Services, Customer Systems, Source Systems, Downstream Systems, APIs, integrations, messaging providers, carriers, data warehouses, ticketing systems, CRM systems, POS systems, access control systems, Wi-Fi systems, merchant networks, or other external systems will be available, accurate, secure, error-free, compatible, or uninterrupted;
  6. customer communications will be delivered, opened, read, acted upon, or received on time.

18. Indemnification

18.1 StoreGenius IP Indemnity

StoreGenius will defend Customer against any third-party claim alleging that Customer’s authorized use of StoreGenius technology used to provide the Service infringes a U.S. patent, copyright, or trademark, or misappropriates a U.S. trade secret, and will pay damages finally awarded by a court or amounts paid in settlement approved by StoreGenius.

18.2 Exclusions

StoreGenius has no obligation for claims arising from:

  1. Customer Data, Customer Data, Inputs, or Customer-specific Outputs;
  2. Customer’s use of the Service in violation of these Terms, Documentation, law, or third-party rights;
  3. modifications not made by StoreGenius;
  4. combinations with products, services, systems, data, or processes not provided by StoreGenius;
  5. Third-Party Services, Customer Systems, Source Systems, Downstream Systems, or integrations;
  6. Customer’s continued use after StoreGenius provides a non-infringing alternative;
  7. beta, pilot, evaluation, free, or trial features;
  8. Customer’s merchant, event, messaging, safety, security, customer experience, or operational decisions;
  9. use of non-current or unsupported versions of the Service after StoreGenius has made a current version available.

18.3 Infringement Cure

If the Service becomes, or StoreGenius reasonably believes may become, subject to an infringement claim, StoreGenius may:

  1. procure the right for Customer to continue using the Service;
  2. modify the Service so it is non-infringing;
  3. replace the Service with substantially equivalent functionality;
  4. terminate the affected Service and provide a pro-rated refund of prepaid unused fees.

This Section states StoreGenius’s sole liability and Customer’s sole remedy for infringement and misappropriation claims.

18.4 Customer Indemnity

Customer will defend, indemnify, and hold harmless StoreGenius and its Affiliates, officers, directors, employees, contractors, and agents from and against third-party claims, losses, liabilities, damages, costs, and expenses, including reasonable attorneys’ fees, arising from or relating to:

  1. Customer Data, Customer Data, or Inputs;
  2. Customer’s or Authorized Users’ use of the Service;
  3. Customer’s violation of law, including privacy, consumer protection, telecommunications, marketing, accessibility, merchant, event, employment, or data protection laws;
  4. Customer’s failure to obtain required rights, notices, permissions, or consents;
  5. Customer’s customer communications, opt-outs, messaging campaigns, or marketing activities;
  6. Customer’s merchant, event, safety, security, access, refund, employment, or operational decisions;
  7. Customer’s breach of these Terms;
  8. Third-Party Services, Customer Systems, Source Systems, Downstream Systems, data, services, or integrations supplied, configured, connected, or authorized by Customer;
  9. Customer’s use of the Service in violation of the restrictions in Section 5.

18.5 Procedure

The indemnified party will promptly notify the indemnifying party of the claim, provide reasonable cooperation, and allow the indemnifying party to control the defense and settlement, provided that:

  1. the indemnified party may appoint non-controlling counsel at its own expense;
  2. any settlement requiring the indemnified party to admit liability, pay money, or take or refrain from taking action requires the indemnified party’s prior written consent, not to be unreasonably withheld, conditioned, or delayed.

If late notice prejudices the defense, the indemnifying party’s obligations will be reduced to the extent of the prejudice.

19. Limitation of Liability

19.1 No Consequential Damages

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, exemplary, enhanced, or punitive damages, or for lost profits, lost remerchant, lost business, lost savings, lost goodwill, lost data, business interruption, event disruption, reputational harm, or cost of substitute services, even if advised of the possibility of such damages.

19.2 General Liability Cap

Except as stated below, each party’s total cumulative liability arising out of or relating to these Terms or the Service will not exceed the fees paid or payable by Customer to StoreGenius for the affected Service in the twelve months preceding the event giving rise to the claim.

19.3 Enhanced Privacy/Security Cap

For claims arising from StoreGenius’s breach of its confidentiality, data security, or data protection obligations, StoreGenius’s total cumulative liability will not exceed two times the fees paid or payable by Customer to StoreGenius for the affected Service in the twelve months preceding the claim, or such higher amount as may be stated in a signed Order.

19.4 Exclusions from Cap

The liability caps do not apply to:

  1. Customer’s payment obligations;
  2. either party’s fraud, fraudulent misrepresentation, or willful misconduct;
  3. Customer’s breach of StoreGenius’s intellectual property rights;
  4. Customer’s misuse of the Service;
  5. Customer’s indemnification obligations;
  6. liability that cannot legally be limited.

19.5 Free, Trial, Pilot, or Beta Use

For free, trial, pilot, beta, proof-of-concept, or evaluation use, StoreGenius’s total cumulative liability will not exceed $100 unless otherwise stated in a signed Order.

The limitations in this Section apply regardless of legal theory and even if a limited remedy fails of its essential purpose.

20. Term; Termination; Suspension

20.1 Term

These Terms apply for the duration of each Subscription and for as long as Customer or any Authorized User accesses or uses the Service.

20.2 Termination for Cause

Either party may terminate the affected Subscription for the other party’s material breach if the breach is not cured within 30 days after written notice.

20.3 Termination for Insolvency

Either party may terminate the affected Subscription immediately if the other party ceases to operate in the ordinary course, makes an assignment for the benefit of creditors, or becomes subject to bankruptcy, receivership, liquidation, dissolution, or similar proceedings.

20.4 Suspension

StoreGenius may suspend access immediately, in whole or in part, if:

  1. required by law;
  2. necessary to prevent security harm;
  3. necessary to protect the Service’s integrity;
  4. Customer or an Authorized User violates these Terms;
  5. Customer is delinquent on undisputed fees after notice and a reasonable cure period;
  6. continued use may expose StoreGenius, Customer, customers, other customers, or third parties to legal, security, operational, or reputational risk.

StoreGenius will provide advance notice where reasonably practicable. If immediate suspension is required, StoreGenius may suspend without advance notice and will provide notice promptly after suspension where legally and practically permitted.

20.5 Effect of Termination

Upon termination or expiration, Customer’s right to access the Service ceases. StoreGenius may delete Customer Data in accordance with its retention policies after the export period described in Section 9.12.

20.6 Survival

Sections relating to fees, ownership, Customer Data rights, Aggregated Data, De-Identified Data, confidentiality, warranty disclaimers, indemnification, limitation of liability, termination effects, governing law, notices, and miscellaneous provisions survive termination.

21. Beta, Trial, Pilot, and Evaluation Features

StoreGenius may offer beta, pilot, proof-of-concept, trial, early access, experimental, or evaluation features. Such features are provided for evaluation only and may be modified, suspended, discontinued, or made subject to additional fees at any time.

Beta, trial, pilot, and evaluation features are provided "as is," without warranties, service-level commitments, support commitments, or indemnities unless expressly stated in a signed Order.

Customer should not rely on beta, trial, pilot, or evaluation features for production, event-day, safety, security, emergency, legal, or customer-impacting uses unless expressly authorized by StoreGenius in writing.

22. Audit; Security Documentation; Business Continuity

Upon reasonable request, StoreGenius may satisfy security review, audit, or diligence requests by providing current security documentation, questionnaires, summaries, or similar materials, where available. StoreGenius’s Trust Center at app.vanta.com is the primary channel for this documentation.

On-site audits, direct audits, penetration testing, or access to StoreGenius systems are permitted only if required by applicable law or expressly agreed in writing, and are subject to reasonable confidentiality, security, scope, timing, frequency, and operational limits.

StoreGenius maintains a business continuity and disaster recovery plan appropriate for the Service.

23. Export, Sanctions, and Government Use

Customer will not access, use, export, re-export, or transfer the Service in violation of U.S. export control, sanctions, anti-boycott, or trade compliance laws.

Customer represents that it is not located in, organized under the laws of, or ordinarily resident in any country or region subject to comprehensive U.S. sanctions and is not listed on any U.S. government restricted-party list.

The Service and Documentation are commercial computer software and commercial computer software documentation. Government use is governed solely by these Terms unless otherwise agreed in writing.

24. Marketplace, Reseller, and Channel Sales

If Customer obtains access to the Service through a cloud marketplace, reseller, channel partner, referral partner, agency, systems integrator, or other third party:

  1. the applicable marketplace, reseller, or partner may be responsible for order placement, billing, taxes, payment processing, and commercial terms agreed between Customer and that party;
  2. the marketplace operator, reseller, or partner is not a party to these Terms unless expressly stated;
  3. StoreGenius is not responsible for the acts, omissions, products, services, or representations of resellers or partners unless expressly agreed by StoreGenius in writing;
  4. these Terms govern Customer’s access to and use of the Service unless superseded by a signed agreement with StoreGenius;
  5. the marketplace, reseller, or partner is not authorized to modify these Terms unless StoreGenius expressly agrees in writing.

25. Publicity

StoreGenius may identify Customer as a customer and use Customer’s name and logo in StoreGenius’s customer lists, website, pitch materials, investor materials, and marketing materials, subject to Customer’s trademark guidelines. Customer may opt out by providing written notice to StoreGenius.

26. Notices

Notices to StoreGenius must be sent to:

StoreGenius Inc. 999 West Main St. Boise, Idaho 83702 Email: legal@storegenius.ai Attention: Legal

Notices to Customer may be sent to the email address associated with Customer’s Account, Order, administrative contact, primary point of contact, or billing contact.

Notices are effective upon receipt or, for email, upon transmission if no bounce or delivery failure is received.

27. Governing Law; Merchant; Disputes

These Terms are governed by the laws of the State of New York, without regard to conflict-of-law principles.

The parties will first attempt to resolve disputes through good-faith discussion. If the parties cannot resolve a dispute, the parties consent to the exclusive jurisdiction and merchant of the state and federal courts located in New York County, New York, for disputes arising out of or relating to these Terms or the Service.

27.1 Jury Trial Waiver

Each party waives any right to a jury trial to the maximum extent permitted by law.

27.2 Class Action Waiver

To the maximum extent permitted by law, each party agrees that disputes will be conducted only on an individual basis and not in a class, collective, consolidated, mass, private attorney general, or representative action.

27.3 Injunctive Relief

Each party acknowledges that unauthorized use or disclosure of Confidential Information, and Customer’s misuse of the Service or infringement of StoreGenius IP, may cause irreparable harm for which monetary damages may be inadequate. The affected party may seek injunctive or equitable relief without posting bond, in addition to other available remedies.

28. Miscellaneous

The parties are independent contractors. These Terms do not create an agency, partnership, joint venture, fiduciary, franchise, or employment relationship.

28.1 Assignment

Customer may assign these Terms to an Affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of substantially all assets upon written notice, provided the assignee assumes Customer’s obligations. StoreGenius may assign these Terms to an Affiliate or successor.

Any other assignment without required consent is void.

28.2 Change of Control

If either party undergoes a change of control, merger, acquisition, corporate reorganization, or sale of substantially all assets, that party will provide written notice where legally permitted. Assignment in connection with such transaction is permitted as stated in Section 28.1, provided the successor assumes the assigning party’s obligations under these Terms.

28.3 Force Majeure

Neither party will be liable for delay or failure to perform, other than payment obligations, due to causes beyond its reasonable control, including acts of God, labor disputes, internet or telecommunications failures, cloud provider outages, utility failures, war, terrorism, civil unrest, epidemic, pandemic, government action, natural disaster, or widespread service provider failure.

28.4 Severability

If any provision is unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.

28.5 Waiver

No delay or failure to enforce any provision is a waiver.

28.6 No Third-Party Beneficiaries

These Terms do not confer any rights or remedies on any third party unless expressly stated.

28.7 Attorneys’ Fees

In any action to enforce these Terms, the prevailing party is entitled to recover reasonable costs and attorneys’ fees, except where prohibited by law.

28.8 English Version Controls

If these Terms are translated into a language other than English, the English version will control unless expressly stated otherwise in the translation.

28.9 Entire Agreement

These Terms, together with applicable Orders, policies, addenda, and documents incorporated by reference, are the entire agreement between the parties regarding the Service and supersede all prior or contemporaneous agreements, proposals, and communications.

In entering into these Terms, neither party has relied on any statement, representation, warranty, or promise except those expressly stated in these Terms.

Questions about these Terms? Contact legal@storegenius.ai.

StoreGenius Inc. • 999 West Main St., Boise, Idaho 83702

Attachment A: Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms and applies where and only to the extent StoreGenius processes Customer Personal Data on behalf of Customer in the course of providing the Service or Support.

A1. Roles

Where applicable data protection law recognizes controller and processor roles, Customer is the controller or processor of Customer Personal Data, and StoreGenius is a processor or subprocessor acting on Customer’s behalf.

Each party will comply with obligations applicable to it under applicable data protection laws.

If Customer is a processor acting on behalf of a third-party controller, Customer represents and warrants that its instructions and actions with respect to Customer Personal Data, including its appointment of StoreGenius as a subprocessor, have been authorized by the relevant controller.

A2. Processing Instructions

Customer instructs StoreGenius to process Customer Personal Data only:

  1. to provide, secure, maintain, support, and improve the Service as permitted by the Terms;
  2. as further specified by Customer’s use of the Service;
  3. as documented in the Terms, this DPA, and applicable Orders;
  4. as required by applicable law.

StoreGenius will comply with Customer’s documented instructions unless applicable law requires other processing, in which case StoreGenius will notify Customer unless legally prohibited.

A3. Subject Matter and Details of Processing

Subject Matter: StoreGenius’s provision of the Service and Support to Customer.

Duration: The Subscription term plus the period until deletion of Customer Data in accordance with the Terms.

Nature and Purpose: Providing, securing, maintaining, supporting, analyzing, and improving the Service as permitted by the Terms.

Categories of Data: Data relating to individuals provided to StoreGenius by or on behalf of Customer, including Customer Data.

Data Subjects: Customers, fans, attendees, ticket holders, patrons, employees, contractors, Authorized Users, and other individuals about whom Customer provides data through the Service.

A4. Data Security

StoreGenius will implement and maintain commercially reasonable technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

StoreGenius will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations.

A5. Data Incidents

StoreGenius will notify Customer without undue delay after becoming aware of a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data on systems managed or controlled by StoreGenius.

StoreGenius’s notice will describe, to the extent reasonably available, the nature of the incident, measures taken to mitigate risk, and measures StoreGenius recommends Customer take.

A6. Customer Security Responsibilities

Customer is responsible for:

  1. protecting Customer Data outside StoreGenius’s systems;
  2. securing Account credentials and devices;
  3. using encrypted and authenticated transfer methods;
  4. configuring access controls and permissions;
  5. backing up Customer Data as appropriate;
  6. securing Customer Systems, Source Systems, Downstream Systems, and Third-Party Services selected, supplied, configured, or authorized by Customer.

A7. Data Subject Requests

StoreGenius will, taking into account the nature of the processing, provide reasonable assistance to Customer in responding to data subject and consumer privacy requests. StoreGenius may direct individuals to Customer when requests relate to Customer Data.

A8. Deletion and Export

During the Subscription term, StoreGenius will enable Customer to delete or export Customer Data in a manner consistent with Service functionality.

Upon expiration or termination, Customer instructs StoreGenius to delete Customer Data in accordance with StoreGenius’s retention policies, subject to any legal retention obligations and backup/archive retention practices.

A9. International Transfers

StoreGenius may store and process Customer Data in any country where StoreGenius or its Subprocessors maintain operations, subject to applicable data protection laws.

Where Customer Personal Data is transferred from the EEA, UK, Switzerland, or another jurisdiction requiring a transfer mechanism, the parties will use a lawful transfer mechanism, including standard contractual clauses or another approved transfer mechanism where required.

A10. Subprocessors

Customer authorizes StoreGenius to engage Subprocessors. StoreGenius will impose written data protection obligations on Subprocessors materially protective of Customer Personal Data and will remain responsible for Subprocessors’ processing as required by applicable data protection law.

Where required by applicable law, StoreGenius will provide notice of new Subprocessors and allow Customer to object on reasonable data-protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected Service as its sole remedy.

A11. Security Documentation and Audit

StoreGenius may satisfy audit and security review obligations by providing security documentation, summaries, questionnaires, or other evidence of compliance, where available, including through StoreGenius’s Trust Center at app.vanta.com.

Direct audits are permitted only where required by applicable law or expressly agreed in writing, and are subject to reasonable confidentiality, security, scope, timing, frequency, and operational limits.

A12. Conflict

If this DPA conflicts with the Terms, this DPA governs only with respect to data processing and privacy matters. If standard contractual clauses or another mandatory transfer mechanism applies and conflicts with this DPA, the mandatory transfer mechanism governs to the extent of the conflict.

Attachment B: Security Measures Summary

StoreGenius maintains administrative, technical, and organizational safeguards appropriate to the nature of the Service, including:

  1. central authentication or single sign-on support where available;
  2. role-based access controls;
  3. encryption of Customer Data at rest using AES-256 and in transit using TLS 1.2 or higher;
  4. logical tenant separation;
  5. access logging and monitoring;
  6. confidentiality obligations for personnel;
  7. security training for relevant personnel;
  8. vendor and subprocessor diligence;
  9. incident response processes;
  10. business continuity and disaster recovery planning;
  11. commercially reasonable controls designed to prevent unauthorized access to systems used to process Customer Data.

StoreGenius may update these measures from time to time, provided updates do not materially reduce the overall security of the Service.