Master Services Agreement

PLATFORM SERVICES AGREEMENT

This Platform Services Agreement (this "Agreement") is entered into by and between Glaze AI, Inc., a Delaware corporation doing business as Sandstone, with its principal office in 141 E. Houston Street, Fourth floor, New York, New York 10002 ("Sandstone"), and the entity identified as "Customer" in the applicable Order Form ("Customer," and together with Sandstone, the "Parties" and each, a "Party"). This Agreement, together with all Order Forms and referenced terms, governs Customer's access to and use of the Sandstone platform and related services and sets forth the rights and obligations of the Parties with respect to the Services. This Agreement is effective as of the earlier of (1) the date of the last signature affixed hereto, and (2) the start date of the first Order Form entered into between the Parties ("Effective Date"). By executing an Order Form that references this Agreement, each Party agrees to be bound by the terms and conditions set forth herein.

1. DEFINITIONS

As used in this Agreement, the following terms have the meanings set forth below.

"Applicable Laws" means all applicable statutes, regulations, rules, court orders, binding industry codes, and similar legal requirements.

"Business Hours" means 5:00 AM to 5:00 PM Pacific Standard Time / 8:00 AM to 8:00 PM Eastern Standard Time, Monday through Friday, excluding U.S. federal public holidays.

"Confidential Information" means any information disclosed by or on behalf of a Party that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure. Confidential Information includes business, technical, and financial information, product plans, pricing, security information, source code, algorithms, models, documentation, strategies, and information concerning customers, suppliers, or personnel. Customer Data is Customer's Confidential Information.

"Customer Data" means all (a) data, content, documents, and materials provided by or on behalf of Customer and its Users to the Services (including, communications, prompts, queries, files, contracts, and other inputs), (b) all data and content accessed or retrieved from Third-Party Services through Customer's integrations, and (c) all results, analyses, and other content generated by the Services in response (the items described in (c) collectively, “Output”).

“DPA” means Sandstone's Data Processing Agreement that includes terms required under various Applicable Laws regarding data protection and privacy that is currently available at https://sandstone.ai/data-processing-agreement (or successor URL).

“Fees” means the fees specified in the applicable Order Form.

"Feedback" means suggestions, ideas, enhancement requests, or other feedback regarding the Services.

“Force Majeure Event” means events beyond the affected Party's reasonable control, including acts of God, fire, flood, epidemic or pandemic, war, terrorism, strikes, government action, failures of telecommunications or internet providers, power outages, failures of third-party hosting or cloud infrastructure, and denial-of-service attacks.

"Intellectual Property" means patents, copyrights, trademarks, trade secrets, know-how, moral rights, and all other intellectual property rights worldwide.

"Order Form" means a written ordering document executed by both Parties that references this Agreement and specifies the Services, Fees, Subscription Term, and other commercial terms.

"Sandstone Intellectual Property" means Sandstone's platform, software, APIs, models, algorithms, templates, workflows, documentation, methodologies, tools, and know-how, and all improvements and modifications thereto.

"Services" means the application, platform, plug-ins, and other services described in the applicable Order Form.

"Subscription Term" means the Service subscription period specified in the applicable Order Form, including any Renewal Terms.

"Third-Party Services" means any third-party application, platform, system, or service that Customer connects to or integrates with the Services.

"Users" means Customer's employees, contractors, agents, and representatives who access the Services through Customer's account.

2. SERVICES AND SUPPORT

2.1 Right to Use the Services. During the Subscription Term and subject to this Agreement, Sandstone will make the Services available to Customer as set forth in the applicable Order Form. Sandstone will be responsible for all personnel and resources reasonably necessary to perform the Services.

2.2 Order Forms. In the event of an express and direct conflict between this Agreement and an Order Form, the Order Form will prevail solely with respect to the subject matter of that Order Form. The Parties may amend terms of this Agreement through an Order Form, but any such amendment will apply only to that Order Form unless expressly stated otherwise.

2.3 Support and Availability. Sandstone will provide technical support via email during Business Hours and subject to the Support and Service Level Policy attached at Exhibit A (“SLA Policy”). Sandstone also offers on-demand AI-assisted support twenty-four hours a day, seven days a week.

2.4 Service Updates. Customer understands that Sandstone is continually innovating and improving the Services. As such, Sandstone may modify, update, or improve the Services from time to time. Sandstone will provide reasonable advance notice of any planned maintenance or changes that may result in material interruption subject to the terms of the SLA Policy. Sandstone will not materially reduce the overall functionality of the Services as generally made available to similarly situated customers during the Subscription Term. Sandstone may implement changes required by Applicable Laws without advance notice where compliance or security timelines do not permit delay.

2.5 AI Output Disclaimer. THE SERVICES ARE AI-POWERED TOOLS DESIGNED TO ASSIST LEGAL AND OTHER PROFESSIONALS. OUTPUT IS NOT LEGAL ADVICE AND IS NOT A SUBSTITUTE FOR PROFESSIONAL LEGAL JUDGMENT. OUTPUT IS GENERATED BY ARTIFICIAL INTELLIGENCE AND MAY CONTAIN ERRORS, OMISSIONS, OR INACCURACIES. CUSTOMER IS SOLELY RESPONSIBLE FOR EVALUATING AND VERIFYING ALL OUTPUT BEFORE USE OR RELIANCE.

2.6 Preview Features. Sandstone may make preview, beta, or experimental features available to Customer on an opt-in basis ("Preview Features") where Customer may opt-in to such a Preview Feature via email, chat, or via in-product. Preview Features are provided "AS IS" without warranty of any kind, and all warranties (whether express, implied, or statutory) are disclaimed with respect to Preview Features. Sandstone may process information submitted, transferred, or inputted to Sandstone in connection with a Preview Feature to operate, improve, and develop the Services. By using a Preview Feature, Customer agrees that it may contain errors, may not operate as intended and your use of such may result in data loss or other damages. Sandstone will not be liable for any direct, indirect, incidental, special, consequential or punitive damages arising out of or related to the use of a Preview Feature, and Sandstone’s liability for all claims arising from the use of a Preview Feature will not exceed US$100.00. Sandstone reserves the right to modify, suspend or discontinue a Preview Feature at any time without notice and without liability to you. Given the nature of Preview Features, Preview Features are excluded from any service level commitments set out in the SLA Policy or support commitments under this Agreement or any Order Form.

3. CUSTOMER RIGHTS AND DATA OWNERSHIP

3.1 Customer Data Ownership. Customer retains all right, title, and interest in Customer Data, including all Intellectual Property therein, except that to the extent any Output includes Sandstone Intellectual Property embedded in it, Sandstone grants Customer a non-exclusive, worldwide, royalty-free license to use, copy, and process such embedded Sandstone Intellectual Property and Sandstone retains all rights in and to such Sandstone Intellectual Property. Subject to the foregoing, to the extent Sandstone acquires any rights in Customer Data, Sandstone irrevocably assigns those rights to Customer.

3.2 License to Sandstone. Customer grants Sandstone a non-exclusive, non-transferable, non-sublicensable (except to authorized subprocessors necessary to deliver the Services), royalty-free right and license to use, copy, and process Customer Data, and to access, retrieve, index, and interact with data and content in Third-Party Services that Customer has connected to the Services, solely to provide the Services, diagnose technical problems, and comply with this Agreement and Applicable Laws. When Customer connects Third-Party Services, Customer authorizes Sandstone to perform actions within those Third-Party Services as directed by Customer's configurations and integration settings.

3.3 No AI Model Training. Sandstone will not use Customer Data to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model that is made available to any other customer or third party, or any general-purpose or publicly available model. This prohibition extends to all subprocessors and survives termination of this Agreement. Sandstone may use Customer Data solely in connection with performing the Services for Customer, including, training or fine-tuning models dedicated exclusively to Customer's use, workspace self-learning capabilities, and analytics provided for Customer's benefit.

3.4 De-identified Data. Sandstone may collect, use, and disclose aggregated, anonymized, or de-identified data derived from Customer's use of the Services for product improvement, benchmarking, and analytics, provided that such data does not identify Customer, any User, or any individual. De-identification will follow industry-standard practices. Sandstone retains all rights in de-identified data.

3.5 Feedback. If Customer provides Feedback, Customer grants Sandstone a non-exclusive, royalty-free license to use and incorporate Feedback to improve the Services. Sandstone will not use Feedback in any manner that identifies Customer or Customer's Confidential Information. Feedback does not include Customer Data.

3.6 Sandstone Intellectual Property. Sandstone retains all right, title, and interest in Sandstone Intellectual Property. No ownership rights in Sandstone Intellectual Property are transferred to Customer under this Agreement.

3.7 Privilege Protection. Sandstone acknowledges that Users include licensed attorneys and that Customer Data may include information subject to the attorney-client privilege, the work-product doctrine, and other legal privileges or protections. Sandstone’s access to and other processing of Customer Data is subject to the terms set out in this Section 3 and the confidentiality and security obligations in Sections 6 and 7 of this Agreement. Neither Party intends for Sandstone’s provision of the Services to effect a waiver of any privilege or protection that would otherwise apply to Customer Data.

4. SERVICE ACCESS AND USE

4.1 Customer Right to Access and Use the Services. Subject to the terms of this Agreement, Sandstone grants Customer a limited, non-exclusive, non-transferable, worldwide right during the Subscription Term to access and use the Services for Customer's internal business purposes. Customer is responsible for all access to and use of the Services by Users. Any breach of this Agreement by a User will be deemed a breach by Customer. Customer will promptly notify Sandstone of any actual or suspected unauthorized access to the Services.

4.2 Use Restrictions. Customer will not, and will not permit any User or third party to: (a) reverse engineer, decompile, disassemble, or attempt to derive source code, models, or underlying structure of the Services; (b) copy, modify, or create derivative works of the Services, or remove any proprietary notices; (c) sell, resell, sublicense, or make the Services available to any third party; (d) use the Services to develop, improve, train, or publicly benchmark any competing products; (e) interfere with, circumvent, or compromise the security, integrity, or performance of the Services, including by introducing malicious code, bypassing access controls, scraping data via automated means, or attempting unauthorized access to other accounts or systems; or (f) use the Services in violation of Applicable Laws or to infringe third-party rights. Customer will not store, transmit, or process the following categories of data through the Services unless the Parties have executed an applicable addendum: (a) protected health information (absent a Business Associate Addendum); (b) payment card industry data subject to PCI DSS; (c) classified government information; or (d) data controlled under the International Traffic in Arms Regulations (ITAR).

4.3 Customer Configuration and Authorization. Customer is responsible for: (a) selecting which Third-Party Services to connect to the Services; (b) granting and managing access credentials and permissions for each integration; (c) configuring integration settings, automation rules, and workflows within the Services; and (d) reviewing and testing integrations and automated workflows before deploying them in production environments. When the Services perform actions within Third-Party Services, including sending or responding to communications, creating or modifying records, or updating data, such actions are performed based on the configurations, permissions, and instructions established by Customer. Customer will ensure that all integrations and configurations comply with Customer's own agreements with Third-Party Service providers and with Applicable Laws.

4.4 Integrated Third-Party Services. Customer may connect Third-Party Services to the Services through integrations. Customer understands and agrees that Third-Party Services are not part of the Services and are not covered by Sandstone's warranties, service level commitments, or support obligations under this Agreement. Sandstone does not control and is not responsible for the availability, performance, accuracy, security practices, or data integrity of any Third-Party Service. Customer's use of Third-Party Services is governed solely by Customer's agreements with the applicable third-party providers. Sandstone will not be liable for any act or omission of any Third-Party Service provider or for any loss or disruption arising from the unavailability, modification, or discontinuation of any Third-Party Service or its APIs.

5. FEES AND PAYMENT

5.1 Fees. Fees will be as specified in the applicable Order Form. If Customer's usage exceeds the allowance in the Order Form, Customer will be invoiced for the excess at the rate set in the Order Form (or Sandstone's then-current rate if not specified). Customer may upgrade its service package or add Users at then-current rates, prorated from the upgrade date. Following the end of the applicable subscription period, any recurring overage and upgrade charges will be added to the subscription Fee.

5.2 Payment and Taxes. Invoices will be issued and payment will be made in accordance with the Order Form. All Fees are payable in United States Dollars unless otherwise specified. If no payment terms are specified, amounts are due within 30 days of the invoice date. Fees are exclusive of all taxes, and Customer will pay all applicable sales, use, value-added, and similar taxes (excluding taxes based on Sandstone's net income). Fees are non-refundable except as expressly provided in this Agreement. Overdue undisputed amounts accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law. If Customer fails to cure non-payment within 30 days of written notice, Sandstone may suspend the Services or terminate the applicable Order Form. Sandstone will not suspend access or charge interest on amounts subject to a good-faith dispute. Fees due from Customer under this Agreement may not be withheld or offset by Customer against amounts due to Customer for any reason.

6. MUTUAL CONFIDENTIALITY OBLIGATIONS

6.1 Obligations. The receiving Party will: (a) use the disclosing Party's Confidential Information solely to perform its obligations and exercise its rights under this Agreement; (b) protect Confidential Information using at least the same degree of care it uses for its own confidential information of like kind, but no less than reasonable care; and (c) limit disclosure to employees, contractors, and professional advisors with a need to know who are bound by confidentiality obligations at least as protective as those in this Section 6. The receiving Party is responsible for any breach by its representatives.

6.2 Exclusions. Confidential Information excludes information that: (a) is or becomes publicly available through no fault of the receiving Party; (b) was known to the receiving Party before disclosure; (c) is received from a third party without restriction; or (d) is independently developed without use of the disclosing Party's Confidential Information. If compelled by law to disclose Confidential Information, the receiving Party will provide prompt notice to the disclosing Party (to the extent permitted) and limit disclosure to the minimum required.

6.3 Remedies and Duration. Breach of this section is a material breach. The disclosing Party may seek injunctive relief (without bond, to the extent permitted by law) in addition to other available remedies. Confidentiality obligations survive for five years after termination of this Agreement.

7. DATA SECURITY AND PRIVACY

7.1 Security Standards. Sandstone will maintain industry-standard administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, disclosure, alteration, or destruction, including encryption of Customer Data using AES-256 (or equivalent) at rest and TLS 1.2 or higher in transit. Sandstone's security program is designed in alignment with NIST Cybersecurity Framework (CSF) 2.0. Sandstone will maintain SOC 2 Type II certification (or equivalent or successor attestations or certifications) and will make its then-current SOC 2 report available to Customer upon request, subject to appropriate confidentiality obligations. Sandstone will not materially decrease its security measures during the Subscription Term.

7.2 Security Incident Notification. Sandstone will notify Customer in writing within 48 hours of becoming aware of a confirmed security incident involving unauthorized access to, or disclosure of, Customer Data. The notification will include, to the extent known: (a) the nature and scope of the incident; (b) the categories of Customer Data affected; (c) the remediation steps taken or planned; and (d) a designated point of contact. Sandstone will reasonably cooperate with Customer in responding to any such incident, including by providing timely updates and supporting Customer's own notification obligations. The DPA governs additional details regarding security incident classification, response, and reporting.

7.3 Security Assessments. Sandstone will conduct periodic security assessments of the Services, including penetration testing at reasonable intervals. Sandstone will provide its then-current security certifications, audit reports, and penetration test summaries to Customer upon reasonable request and subject to appropriate confidentiality obligations.

7.4 Data Processing. To the extent Sandstone processes personal data (as defined in the DPA) on behalf of Customer, the terms of the DPA will apply and are incorporated by reference. In the event of a conflict between this Agreement and the DPA, the DPA controls.

7.5 Regulatory Compliance. Sandstone will maintain responsibility for provider-side obligations under applicable AI legislation (including, technical safeguards and documentation). Customer will maintain responsibility for deployer-side obligations (including human oversight and end-user disclosure where required). If new data protection or AI legislation requires material changes to the Services, the Parties will negotiate in good faith to amend this Agreement accordingly to preserve the original intent of the Parties.

8. MUTUAL REPRESENTATIONS AND WARRANTIES

8.1 Representations and Warranties. Each Party represents and warrants to the other Party that it has full power and authority to enter into and perform this Agreement. Sandstone represents and warrants to Customer that: (a) the Services will materially conform to the applicable documentation during the Subscription Term; (b) the Services will be provided in a professional and workmanlike manner consistent with generally accepted industry standards; and (c) the Services will not incorporate open source software in a manner that would require Customer to disclose or make available its own proprietary source code. Customer represents and warrants to Sandstone that it has all rights necessary to provide Customer Data and to grant the licenses set forth in this Agreement.

8.2 Warranty Remedy. Customer's sole and exclusive remedy for a breach of the warranties in Section 8.1 is, at Sandstone's option, reperformance or correction of the non-conforming Services at no additional cost. If Sandstone is unable to cure the non-conformity within 30 days of receiving written notice describing the deficiency in reasonable detail, Customer may terminate the affected Order Form and receive a refund of prepaid Fees attributable to the period following the effective date of termination.

8.3 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICES ARE PROVIDED "AS IS" AND SANDSTONE DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. SANDSTONE DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

9. MUTUAL INDEMNIFICATION OBLIGATIONS

9.1 Sandstone Indemnity. Sandstone will defend Customer and its officers, directors, employees, and agents (collectively, "Customer Indemnitees") from and against any third party claims brought against a Customer Indemnitee based on: (a) an allegation that the Services or Sandstone Intellectual Property infringe or misappropriate any third party's Intellectual Property; (b) Sandstone’s gross negligence, willful misconduct, or fraud; (c) breach of Sandstone’s confidentiality obligations under Section 6 above; or (d) Sandstone’s violation of Applicable Laws. Sandstone will also indemnify and hold harmless a Customer Indemnitee from any judgment that a court of competent jurisdiction grants a third party on any of the foregoing described claims or that’s awarded to a third party under any Sandstone-approved settlement of any such claims.

9.2 Remediation. If a claim is made under Section 9.1(a) or is reasonably likely, Sandstone may, at its option and expense: (a) procure for Customer the right to continue using the Services; (b) modify or replace the infringing aspect of the Services with a functionally equivalent non-infringing alternative; or (c) if neither (a) nor (b) is commercially practicable, terminate the applicable Order Form and refund prepaid Fees for the period following termination. This Section 9 states Sandstone's sole obligation and Customer's exclusive remedy with respect to claims that the Services infringe or misappropriate third-party Intellectual Property.

9.3 Customer Indemnity. Customer will defend Sandstone and its officers, directors, employees, and agents (collectively, "Sandstone Indemnitees") from and against any third party claims brought against a Sandstone Indemnitee based on: (a) Customer Data, including, any allegation of infringement; (b) use of the Services in breach of Section 4 of this Agreement; (c) Customer’s gross negligence, willful misconduct, or fraud; or (d) Customer's violation of Applicable Laws. Customer will also indemnify and hold harmless a Sandstone Indemnitee from any judgment that a court of competent jurisdiction grants a third party on any of the foregoing described claims or that’s awarded to a third party under any Customer-approved settlement of any such claims.

9.4 Carve-outs. Each Party’s indemnity obligations under this Agreement will not apply to the extent a third-party claim arises from the other Party’s: (a) gross negligence, fraud, or willful misconduct; (b) violation of Applicable Laws; or (c) content, data, or Intellectual Property. In addition, Sandstone’s indemnity obligations under this Agreement or the DPA will be comparatively reduced to the extent arising from: (i) any Customer Data; (ii) modification of any Output or the Services by a User or anyone other than Sandstone; (iii) any Third-Party Service; or (iv) use of the Services in breach of this Agreement or violation of any Applicable Laws.

9.5 Procedures. A Party’s defense and indemnification obligations are conditioned on the indemnified Party: (a) providing prompt written notice of the claim (provided that failure to provide prompt notice will not relieve the indemnifying Party of its obligations except to the extent materially prejudiced by such failure); (b) granting the indemnifying Party sole control of the defense and settlement of the claim (provided that the indemnifying Party will not settle any claim in a manner that imposes liability, obligation, or admission of fault on the indemnified Party without the indemnified Party's prior written consent, not to be unreasonably withheld); and (c) providing reasonable cooperation at the indemnifying Party's expense. The indemnified Party may participate in the defense at its own expense with counsel of its choosing.

10. LIMITATION OF LIABILITY

10.1 Exclusion of Consequential Damages. NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING, LOST PROFITS, LOST REVENUE, LOSS OF BUSINESS, LOSS OF GOODWILL, BUSINESS INTERRUPTION, OR LOSS OR CORRUPTION OF DATA, ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.2 Liability Caps. THE FOLLOWING CAPS APPLY TO EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT:

(A) GENERAL CAP: LIABILITY WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER IN THE 12 MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; AND

(B) ELEVATED CAP: FOR CLAIMS ARISING FROM A PARTY’S BREACH OF SECTION 6 (CONFIDENTIALITY) OR SECTION 7 (DATA SECURITY AND PRIVACY), LIABILITY WILL NOT EXCEED THREE TIMES THE FEES PAID OR PAYABLE BY CUSTOMER IN THE 12 MONTHS PRECEDING THE CLAIM.

THE FOREGOING LIABILITY CAPS ARE CUMULATIVE AND APPLY REGARDLESS OF THE NUMBER INDEMNITEES AND CLAIMS ARISING DURING THE TERM. ALL AMOUNTS PAID OR PAYABLE UNDER ANY PROVISION OF THIS AGREEMENT, INCLUDING UNDER SECTION 9, WILL COUNT AGAINST, AND WILL NOT BE IN ADDITION TO, THE OTHER AGGREGATE CAPS SET FORTH IN THIS SECTION 10.2.

10.3 Excluded Amounts. THE PARTIES AGREE THAT THE CAPS IN SECTION 10.2 DO NOT APPLY TO: (A) CLAIMS ARISING FROM EITHER PARTY'S FRAUD OR WILLFUL MISCONDUCT; (B) CUSTOMER'S MISAPPROPRIATION OR INFRINGEMENT OF SANDSTONE’S INTELLECTUAL PROPERTY AND ANY PAYMENT OBLIGATIONS UNDER THIS AGREEMENT AND ALL ORDER FORMS; AND (C) SUBJECT TO THE CONDITIONS AND PROCESS SET OUT IN SECTION 9.5 ABOVE, THE DEFENSE COSTS (INCLUDING, ATTORNEYS’ FEES) INCURRED AND ANY JUDGEMENT OR SETTLEMENT AMOUNTS PAID TO A THIRD PARTY CLAIMANT IN CONNECTION WITH A PARTY’S DEFENSE OBLIGATIONS UNDER SECTION 9 OF THIS AGREEMENT AND THE DPA.

10.4 Essential Basis. THE PARTIES ACKNOWLEDGE THAT THE LIMITATIONS IN THIS SECTION 10 SHALL BE ENFORCED TO THE MAXIMUM EXTENT ALLOWED UNDER APPLICABLE LAWS, REFLECT THE AGREED UPON ALLOCATION OF RISK BETWEEN THE PARTIES, AND FORM AN ESSENTIAL BASIS OF THE BARGAIN.

11. TERM AND TERMINATION

11.1 Term. This Agreement commences on the Effective Date and continues until all Order Forms have expired or been terminated and all post-termination obligations have been fulfilled. Each Order Form will specify an initial Subscription Term. Unless otherwise specified in the Order Form, each Subscription Term will automatically renew for successive periods of one-year periods (each, a "Renewal Term") unless either Party provides written notice of non-renewal at least 60 days before the end of the then-current term.

11.2 Termination for Cause. Either Party may terminate this Agreement or any affected Order Form: (a) on written notice if the other Party materially breaches this Agreement and fails to cure within 30 days of written notice; or (b) on written notice if the other Party files for bankruptcy (or has an involuntary petition filed against it not dismissed within 60 days) or ceases business operations.

11.3 Effect of Termination. On termination: (a) all licenses and rights to the Services granted to Customer will cease (subject to Section 11.4 below); (b) Customer remains responsible for all Fees accrued through the termination date; (c) if Customer terminates for cause, or if Sandstone terminates other than due to Customer's material uncured breach, Sandstone will refund prepaid Fees for the period following termination; and (d) each Party will destroy the other Party's Confidential Information. Sections that by their nature are intended to survive will survive, including, Sections 1, 3, 4, 6, 7, 9, 10, 11.4, and 12.

11.4 Data Retrieval. Following expiration or termination, and on Customer's request made before or within 30 days after the effective date of termination or expiration, Sandstone will make certain types of Customer Data then-stored in the Services available for export in a standard machine-readable format that Sandstone generally makes available to all of its customers and per then-current Sandstone provided documentation. Any custom data formats or export methods must be mutually agreed upon by the Parties in advance for a mutually agreed upon fee. Following such export, Sandstone will delete all remaining Customer Data in accordance with the DPA and Applicable Laws.

12. GENERAL PROVISIONS

12.1 Governing law and Jurisdiction. This Agreement will be governed by and construed in accordance with the laws of the State of New York, without regard to its conflict of laws principles. The Parties consent to the exclusive jurisdiction and venue of the state and federal courts located in the Borough of Manhattan, New York, New York for all disputes arising out of or relating to this Agreement. Each Party waives any objection to jurisdiction or venue in such courts.

12.2 Force Majeure. Neither Party will be liable for any failure or delay in performing its obligations under this Agreement (other than payment obligations) to the extent caused by a Force Majeure Event. The affected Party will provide prompt written notice and use commercially reasonable efforts to mitigate the impact and resume performance. If a Force Majeure Event continues for 30 or more consecutive days, either Party may terminate the affected Order Forms (or this Agreement, if all Services are affected) by providing written notice to the other Party, and Sandstone will promptly refund any prepaid Fees attributable to the period following termination.

12.3 Notices. Customer agrees to receive communications electronically, including, by email and in-product notifications. All legal notices (which includes notices regarding a breach of an obligation under this Agreement) from Customer to Sandstone must be delivered by email to legal@sandstone.com, and all legal notices from Sandstone to Customer will be sent to the email address Customer provides to Sandstone. Notices are deemed given when sent, provided no delivery failure notification is received.

12.4 Assignment. Neither Party may assign this Agreement without the other Party's prior written consent (not unreasonably withheld), except that either Party may assign this Agreement to an affiliate (any entity that controls, is controlled by, or is under common control with the assigning Party) or in connection with a merger, acquisition, or sale of all or substantially all of its assets.

12.5 Miscellaneous Terms. No amendment, modification, or waiver of this Agreement will be valid unless in writing and signed by both Parties. No failure or delay in exercising any right will operate as a waiver. Any waiver must be in writing and applies only in the specific instance given. If any provision is held invalid or unenforceable, the remaining provisions continue in effect. The Parties will negotiate in good faith a lawful replacement provision that most closely reflects the original intent. This Agreement, together with all Order Forms and referenced terms (including the DPA), constitutes the entire agreement between the Parties and supersedes all prior agreements. Sandstone rejects any additional or conflicting terms in purchase orders or other ordering materials. Customer's purchase is not contingent on delivery of future functionality. The term "including" (and its variations) means "including, without limitation," whether or not so stated, and will not be construed to limit any general statement to the specific or enumerated items or matters immediately following it. The Parties are independent contractors. Nothing in this Agreement creates a partnership, agency, joint venture, or employment relationship. This Agreement and all Order Forms may be executed in counterparts, each an original, and all together one agreement. Electronic signatures are binding to the same extent as handwritten signatures. Delivery by email in PDF format is effective.Last updated: September 1, 2026

Exhibit A

Support and Service Level Policy

This Support and Service Level Policy (this “Policy”) describes Sandstone’s support offering for requests regarding bugs, defects, errors, or downtime in the Services that causes the Services to not perform for its intended purpose and as described in the Agreement or any applicable documentation. To the extent that there’s a conflict between this Policy and the Platform Services Agreement between the Parties (“Agreement”), the conflicting terms in the Agreement controls. Capitalized terms used but not otherwise defined herein will have the meanings assigned to them in the Agreement.

1. Service Status. A real-time update on the status of the Services is accessible by Customer at any time at: https://status.sandstone.com/

2. Scheduled Downtime. To continually improve the performance of the Services, Sandstone will schedule downtime for routine maintenance or system upgrades (“Scheduled Downtime”) outside of Business Hours and peak traffic periods (typically the weekend). Sandstone will notify Customer’s designated contact by email or through a banner notice in the Services at least 48 hours prior to the occurrence of the Scheduled Downtime. To the extent possible while prioritizing the security of the Services and Customer Data, Sandstone intends to have no more than one Scheduled Downtime per calendar month and for such Scheduled Downtime to last for less than two hours.

3. Uptime Commitment. The Services will be Available 99.9% of the time as calculated over a calendar month. “Available” or “Availability” means the Services are: (a) available for access and use over the Internet by Customer and its users; and (b) are functioning in accordance with the specifications. Calculation of Availability will not include any downtime that arises from: (i) any Scheduled Downtime; (iii) a failure of communication or telephone access service or other outside service or equipment or software not the fault of Sandstone, including, general network outages; (iv) misuse of the Service by Customer or any User (e.g., use of the Services with a browser that’s not supported); (v) any Customer Data that’s a corrupt file or not intended to be supported by the Services per relevant Sandstone documentation; (vi) a Third-Party Service; or (vii) any Preview Feature.

4. Service Credits and Termination Right.

a. Termination Right. If Sandstone fails to meet its Uptime Commitment described in this Policy, three or more separate instances during a given calendar month, Customer may terminate the applicable Order Form and in such instance Sandstone will issue Customer a pro-rated refund of any prepaid subscription fees for the terminated Service at issue.

b. Service Credits. If Sandstone fails to meet its Uptime Commitment described above in any given calendar month, following Customer’s request, Sandstone will credit Customer’s account with “Service Level Credits,” to be applied against Customer’s next invoice per the below table. The Service Level Credit is based on the subscription Fee paid by Customer for the specific Sandstone subscription-based Service that does not meet the Uptime Commitment (if this Fee is paid annually, then such Fee will be divided by 12 to determine the applicable monthly subscription fee) (“Subscription Fee”). For example, any amounts paid by Customer as one-time fees for custom integrations or other services are excluded from the determination of Service Level Credits. The total amount of Service Level Credits that Customer is entitled to under this Policy will not exceed the annual Subscription Fee paid by Customer for the specific Sandstone subscription-based Service that does not meet the Uptime Commitment. Customer must request a Service Level Credit within 30 days following the given month that the relevant Service failed to meet the Uptime Commitment or it will be deemed that Customer has waived its right to such a Service Level Credit.

c. Customer agrees that the remedies set out in this Section 4 are its sole and exclusive remedy for Sandstone’s failure to meet its Uptime Commitment.

5. Prioritized Response and Resolution. Upon receiving a request, Sandstone will classify, prioritize, and resolve the problem according to the following criteria (it being understood that in the event that Sandstone completes a workaround that relegates the applicable problem to a lower priority level, the service levels applicable to that lower priority level will apply going forward)

Availability — Service Level Credits

• 99.5% ≤ Availability < 99.9% — 5% of monthly subscription fees
• 97.5% ≤ Availability < 99.5% — 10% of monthly subscription fees
• 95.0% ≤ Availability < 97.5% — 25% of monthly subscription fees
• Availability < 95.0% — 100% of monthly subscription fees

Prioritized Response and Resolution

Upon receiving a request, Sandstone will classify, prioritize, and resolve the problem according to the criteria below. If Sandstone completes a workaround that relegates a problem to a lower priority level, the service levels for that lower level apply going forward.

• Priority 1 (Critical) — Inoperable System. The issue renders mission-critical features and functionalities of the Services completely unavailable, unresponsive, or inoperable, and there is no workaround.
  • Initial response time (during Sandstone Business Hours): 8 hours
  • Target resolution (one or more): issue is resolved; satisfactory workaround is provided
• Priority 2 (High) — Major Business Impact. The issue impacts major functionality or causes significant performance degradation and affects many users, but does not interrupt all functions of the Services. The issue impacts time-sensitive business use cases.
  • Initial response time: 1 day
  • Target resolution (one or more): issue is resolved; satisfactory workaround is provided; fix incorporated into a future release
• Priority 3 (Medium) — Bug in Feature or Function. The issue is a minor feature or function problem, a feature is not working as expected, there is some performance degradation, or there is a bug.
  • Initial response time: 2 days
  • Target resolution (one or more): issue is resolved; satisfactory workaround is provided; fix incorporated into a future release
• Priority 4 (Low) — Routine Questions, Minor Issues. The issue is a routine technical problem, enhancement request, minor bug, or inquiry related to system capabilities.
  • Initial response time: 5 days
  • Target resolution (one or more): issue is resolved; satisfactory workaround is provided; fix incorporated into a future release; inquiry is answered; enhancement request is captured