Terms and Conditions

Direct Customer Terms + End User Payment Terms
United States and Canada

Structure of These Terms

These Master Platform Terms and Conditions (the “Terms”) are organized so that the business-to-business relationship between SimplePin and insurance-industry customers is separated from the consumer/end-user payment experience. The applicable Order Form, Pilot Agreement, Statement of Work, Data Processing Addendum, Security Addendum, Service Level Schedule, payment-partner terms and other incorporated documents form the complete agreement as described below.

• Part I — Common Framework and Definitions
• Part II — Direct Customer Terms (insurance brokers, agencies, carriers, MGAs/MGUs, program administrators, TPAs and other approved insurance-industry organizations)
• Part III — Direct Customer Jurisdiction Addenda: United States and Canada
• Part IV — End User Payment Terms
• Part V — End User Jurisdiction Addenda: United States and Canada
• Part VI — Common Legal Terms
• Schedule 1 — Module and Service-Specific Terms
• Schedule 2 — Production Service Level Schedule
• Schedule 3 — Security, Privacy and Data Processing Terms
• Schedule 4 — Acceptable Use and Restricted Activities

PART I — COMMON FRAMEWORK AND DEFINITIONS

1. Agreement and Acceptance

1.1 These Terms govern access to and use of the SimplePin platform, websites, APIs, payment pages, customer portals, integrations, software, reconciliation and reporting tools, payment functionality and related services (collectively, the “Services”).

1.2 For a Direct Customer, these Terms become binding when the Direct Customer signs or electronically accepts an Order Form, Pilot Agreement, Statement of Work, online acceptance flow, or other document that incorporates these Terms, or otherwise uses Production Services after receiving these Terms.

1.3 For an End User, these Terms become binding when the End User affirmatively accepts them, submits a payment through a SimplePin-enabled experience after receiving notice of them, or otherwise uses an End User-facing Service, in each case to the extent permitted by applicable law.

1.4 If an applicable law requires a specific disclosure, consent, payment mandate or authorization beyond these Terms, that separate disclosure, consent, mandate or authorization also applies and controls with respect to its specific subject matter.

2. Contracting Entity and Jurisdiction

2.1 Unless an Order Form or checkout disclosure expressly states otherwise, the applicable SimplePin contracting entity is determined by the jurisdiction-specific provisions in Parts III and V.

2.2 “SimplePin,” “we,” “us” and “our” mean the applicable SimplePin contracting entity and, where the context requires, its affiliates, processors, service providers and payment partners acting on its behalf. “SimplePin Group” means SimplePin, Inc., 9368-9149 Québec Inc. d/b/a SimplePin, and their controlled affiliates.

2.3 SimplePin is not an insurer, insurance carrier, insurance broker, insurance agent, managing general agent, managing general underwriter, premium finance company or provider of insurance advice. The Direct Customer remains responsible for the insurance products, policies, coverage, premium obligations and insurance-related services it offers.

3. Definitions

“Applicable Law” all laws, regulations, regulatory guidance having binding effect, court orders and legally enforceable governmental requirements applicable to a party or the Services.

“Authorized User” an employee, contractor or other person whom a Direct Customer authorizes to access the Services on its behalf.

“Customer Data” data, documents, files, payment instructions, carrier statements, transaction records, policy/account information and Personal Information submitted to or accessed by SimplePin on behalf of a Direct Customer.

“Direct Customer” an insurance agency, brokerage, carrier, MGA, MGU, program administrator, TPA or other approved insurance-industry organization that contracts directly with SimplePin.

“End User” an insured, policyholder, customer, payor, account holder or other person who uses a SimplePin-enabled interface to make or receive a payment or interact with a Direct Customer.

“Order Form” an order form, proposal, production order, statement of work, pilot agreement or other signed document identifying Services, pricing, scope or commercial terms.

“Payment Partner” a bank, acquirer, gateway, processor, card network, ACH/EFT originator, Interac participant, wallet provider or other third party used to provide payment functionality.

“Personal Information” information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual, and analogous terms under Applicable Law.

“Platform” SimplePin’s hosted software, APIs, portals, interfaces, payment experiences, reconciliation tools, automation, reporting and related technology.

“Production Services” Services made available for live operational use, excluding a Pilot, beta, sandbox or evaluation environment unless expressly stated otherwise.

“Security Incident” a confirmed unauthorized acquisition of, access to, use, disclosure, alteration or destruction of Customer Data in SimplePin’s possession or control, excluding unsuccessful attempts that do not compromise Customer Data.

“Transaction” for billing and service purposes, the unit specified in the applicable Order Form or Schedule 1. If the Order Form does not define the billable unit, the parties must agree in writing before usage-based charges begin.

4. Order of Precedence and Version Control

4.1 If documents conflict, the following order of precedence applies unless a signed document expressly states otherwise: (a) a signed amendment; (b) an Order Form for its expressly stated commercial and service-specific terms; (c) an applicable Data Processing Addendum or Security Addendum for privacy/security matters; (d) an applicable payment-partner or payment-network agreement for rail-specific matters; (e) these Terms; and (f) documentation, policies and help-center materials.

4.2 A Pilot Agreement or POC Order Form controls over these Terms only for pilot-specific scope, fees, timing, success criteria and expressly identified pilot terms.

4.3 For negotiated Direct Customer relationships, the version of these Terms identified in the applicable Order Form is the version incorporated into the agreement. SimplePin will not materially reduce a Direct Customer’s contractual rights during a committed term by unilaterally replacing the incorporated version, except to the extent required by law, a regulator, a payment network or a Payment Partner.

4.4 End User Terms may be updated prospectively as permitted by law. Material changes will be communicated through the Platform, email or another reasonable method before they take effect when advance notice is legally required.

PART II — DIRECT CUSTOMER TERMS

5. Eligibility, Authority and Insurance-Industry Use

5.1 The Direct Customer represents that it is duly organized, validly existing where required, authorized to enter into the agreement, and appropriately licensed or otherwise authorized to conduct the insurance activities for which it uses the Services.

5.2 The Direct Customer will use the Services only for lawful insurance-related business and other use expressly approved by SimplePin. The Direct Customer will not use the Services to process payments or data for unrelated businesses, undisclosed third parties, or prohibited activities.

5.3 Each person accepting an Order Form or administering the account represents that the person has authority to bind the Direct Customer. The Direct Customer is responsible for its Authorized Users and for maintaining appropriate access controls.

6. Orders, Subscription Scope and Changes

6.1 Services, modules, pricing, included volumes, implementation work, carrier connections, integrations, service levels and other commercial terms are described in the applicable Order Form.

6.2 SimplePin may improve, modify or replace features in the ordinary course, provided that during a committed term it will not materially reduce the core functionality expressly purchased by the Direct Customer without providing a commercially reasonable substitute, except where a change is required by law, security, a Payment Partner or a third-party platform.

6.3 Material custom development, new carrier onboarding, new AMS/ERP integrations, new data migrations or other work outside the agreed scope may require a separate Statement of Work and fees.

7. Implementation, Customer Cooperation and Project Dependencies

7.1 The Direct Customer will timely provide personnel, system access, test data, carrier credentials, approvals, configuration decisions, banking details and other information reasonably necessary for implementation and operation.

7.2 Project dates and evaluation periods will be extended for delays caused by the Direct Customer, its vendors, carriers, management systems, financial institutions or other third parties outside SimplePin’s reasonable control. SimplePin is not responsible for delay caused by missing, inaccurate or late dependencies.

7.3 Unless expressly approved in writing, SimplePin will use least-privilege access to a Direct Customer’s production systems and will not post, alter or delete production records during a Pilot solely for evaluation purposes.

7.4 The Direct Customer represents that it has the legal and contractual right to grant SimplePin and its approved service providers the access, credentials and data required to perform the Services, including access to applicable agency management, policy, ERP, CRM, carrier and banking systems.

8. Pilot, Proof-of-Concept, Sandbox and Beta Services

8.1 Pilot, proof-of-concept, sandbox and beta Services are for evaluation, testing and validation. Unless expressly stated in an Order Form, they are not Production Services and are not subject to the Production SLA.

8.2 Pilot reconciliation, matching, OCR, AI, analytics and other outputs must be independently reviewed by the Direct Customer and must not be relied upon for production accounting, carrier settlement, financial reporting, policy binding, cancellation, premium trust accounting or automated posting unless and until the Direct Customer has validated the applicable workflow for production use.

8.3 A pilot success criterion will not be considered unmet to the extent a failure results from incomplete, inaccurate, inconsistent or unavailable source data; a change or limitation in a carrier, Applied Epic, Vertafore or other third-party system; unavailable credentials; or other circumstances outside SimplePin’s reasonable control.

8.4 Unless otherwise stated in a Pilot Agreement, fees incurred for completed implementation work are non-refundable once the applicable work has begun. The parties may suspend or end a pilot by written notice; any payment, confidentiality, data-protection and accrued obligations survive.

9. Integrations, APIs and Third-Party Systems

9.1 The Services may integrate with agency management systems, ERP/CRM systems, insurance carriers, banks, payment networks, gateways, processors, cloud services and other third-party systems. Those systems are not controlled by SimplePin.

9.2 SimplePin will use commercially reasonable efforts to maintain supported integrations, but is not liable for outages, API changes, credential failures, data defects, deprecations or other acts or omissions of a third party, except to the extent directly caused by SimplePin’s failure to perform its agreed integration responsibilities.

9.3 Where feasible, SimplePin will provide reasonable advance notice of a material backwards-incompatible change to a published production API. Emergency, security, regulatory and third-party-driven changes may require shorter notice.

9.4 The Direct Customer must protect API keys, tokens, credentials and integration secrets and promptly notify SimplePin of suspected compromise. Credentials may not be shared outside the Direct Customer’s authorized personnel and approved service providers.

10. Source Data, Reconciliation, AI/OCR and Output Validation

10.1 SimplePin may use rules-based automation, optical character recognition, machine learning, artificial intelligence and human quality-control workflows to capture, normalize, match, reconcile and present data.

10.2 The Direct Customer remains responsible for the accuracy and completeness of Customer Data and source-system records. SimplePin does not warrant that third-party source data, carrier statements or management-system records are accurate or complete.

10.3 Automated matching, extraction, recommendations, classifications, exceptions and reconciliation outputs may contain errors. The Direct Customer is responsible for establishing appropriate review and approval controls before relying on outputs for accounting entries, carrier payments, producer compensation or other material financial activity.

10.4 SimplePin will not use identifiable Customer Data to train a generalized model for unrelated customers unless the Direct Customer expressly agrees. SimplePin may use aggregated or de-identified information that cannot reasonably identify the Direct Customer or an individual to operate, secure, analyze and improve the Services.

11. Insurance Transactions, Premium Handling and Customer Responsibilities

11.1 The Direct Customer is solely responsible for insurance quotations, underwriting decisions, policy issuance, binding, renewal, cancellation, coverage determinations, premium calculations, commission arrangements, producer licensing, disclosures and customer service.

11.2 A payment initiated or completed through the Services does not, by itself, bind, issue, renew, reinstate or modify insurance coverage. Coverage is determined solely by the applicable insurer, broker/agency agreement, policy terms and Applicable Law.

11.3 The Direct Customer is responsible for complying with all Applicable Law governing premiums, premium trust or fiduciary accounts, return premiums, agency fees, broker fees, service/convenience fees, premium finance arrangements, commissions and remittance to carriers.

11.4 The Direct Customer will configure settlement accounts and funds flows consistently with applicable fiduciary, trust and carrier requirements and will promptly correct inaccurate settlement instructions.

12. Payment Services and Payment Partners

12.1 Depending on the jurisdiction, payment method and Order Form, payment functionality may be provided by SimplePin, a SimplePin affiliate, one or more regulated financial institutions, or other Payment Partners. Additional Payment Partner terms may apply and are incorporated for the payment method to which they relate.

12.2 Payment processing is subject to applicable card-network, ACH/EFT, Interac, bank, acquirer, gateway and Payment Partner rules. If a rail-specific requirement conflicts with these Terms, the rail-specific requirement controls only to the extent of that conflict.

12.3 Funds may be received, held, safeguarded, settled or transmitted by SimplePin, an affiliate or a Payment Partner depending on the payment flow. Where SimplePin is legally required to safeguard end-user funds, it will do so in accordance with Applicable Law. Unless expressly stated otherwise by the institution holding the funds, amounts processed through the Services are not deposit accounts of SimplePin and are not represented by SimplePin as government-insured deposits.

12.4 Settlement times are estimates unless expressly guaranteed in an Order Form. Banks, card networks, ACH/EFT systems, Interac and other payment rails may impose cutoffs, holds, reviews, returns or delays outside SimplePin’s control.

13. Payment Instructions, Banking Changes and Security Procedures

13.1 The Direct Customer is responsible for the accuracy of payment and settlement instructions submitted through authorized credentials. SimplePin may apply reasonable security procedures, including dual approval, callback verification, bank-account ownership verification, transaction limits or holds before acting on sensitive instructions.

13.2 A request to change settlement banking information is not effective until SimplePin completes its required verification. SimplePin may delay or reject an instruction that it reasonably believes is unauthorized, fraudulent, inconsistent with expected activity or prohibited by law or Payment Partner requirements.

13.3 To the extent permitted by law, if SimplePin acts in good faith in accordance with an agreed security procedure that is commercially reasonable for the instruction, the Direct Customer bears the risk of an instruction submitted through compromised Customer credentials, except to the extent the loss results from SimplePin’s gross negligence, willful misconduct or breach of its security obligations.

14. Chargebacks, Returns, Refunds, Disputes and Reserves

14.1 The Direct Customer is responsible for valid customer authorizations, accurate transaction descriptions, customer service, refund decisions and evidence needed to respond to payment disputes.

14.2 SimplePin may debit, net, offset or otherwise recover chargebacks, ACH/EFT returns, refunds, reversals, network assessments, fines, fees and other payment liabilities attributable to the Direct Customer, to the extent permitted by Applicable Law and the applicable payment agreement.

14.3 Representment or dispute defense is not guaranteed. The Direct Customer must provide requested evidence within the deadline established by SimplePin, which may be shorter than the underlying network deadline to allow review and submission. SimplePin may decline to represent a matter where evidence is insufficient, contradictory, untimely or does not support an available network remedy.

14.4 If reasonably necessary based on transaction risk, financial condition, chargebacks, fraud, regulatory requirements or Payment Partner requirements, SimplePin may establish or adjust reserves, settlement delays, limits or other risk controls after providing notice when legally and operationally practicable.

15. Fees, Billing and Taxes

15.1 Fees are set out in the applicable Order Form. Unless the Order Form states otherwise, all fees are exclusive of taxes and are denominated in the currency stated on the Order Form.

15.2 Recurring platform fees are billed as stated in the Order Form. Usage, overage, carrier-connection, payment, pass-through and other variable charges may be billed in arrears. Bank, network, acquirer and other third-party pass-through fees may change when the underlying provider changes its fee.

15.3 If an Order Form does not define a usage-based “Transaction,” usage-based billing will not begin until the parties agree in writing on the billable unit and applicable measurement method.

15.4 Unless otherwise stated in an Order Form, invoices are due within fifteen (15) days. Undisputed late amounts may accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower. The Direct Customer must notify SimplePin of a good-faith invoice dispute within fifteen (15) days after receipt and pay undisputed amounts when due.

15.5 The Direct Customer is responsible for applicable sales, use, excise, GST/HST/QST, value-added and similar transaction taxes, excluding taxes measured by SimplePin’s net income. The parties will cooperate regarding valid exemption documentation.

16. Direct Customer KYB, AML, Sanctions and Regulatory Cooperation

16.1 SimplePin may require corporate verification, beneficial-ownership information, director/officer information, licensing information, authorized-signatory verification, sanctions screening, PEP/HIO screening, banking verification and other due-diligence information before or during the relationship.

16.2 The Direct Customer will provide accurate and complete information and promptly notify SimplePin of material changes to legal name, ownership/control, public-company status, directors, insurance licensing, business model, settlement accounts, locations or expected transaction activity.

16.3 SimplePin may conduct ongoing monitoring and request updated information where required by law, regulators, Payment Partners or its risk program. SimplePin may suspend or limit Services while required due diligence is incomplete or if continued processing would create a legal, regulatory, sanctions, fraud or material risk concern.

16.4 Nothing in these Terms requires SimplePin to disclose a suspicious-transaction report, law-enforcement request or other information where disclosure is prohibited by law.

17. Confidentiality

17.1 “Confidential Information” means non-public business, technical, security, pricing, financial, customer, product and operational information disclosed by one party to the other and reasonably understood to be confidential. Customer Data and SimplePin security documentation are Confidential Information.

17.2 The receiving party will use Confidential Information only to perform or receive the Services, protect it using at least reasonable care, and disclose it only to personnel, affiliates, professional advisers and service providers who need to know it and are bound by confidentiality obligations.

17.3 Confidentiality does not apply to information that the receiving party can document was lawfully known without restriction, independently developed without use of the other party’s Confidential Information, lawfully obtained from a third party without duty of confidentiality, or becomes public through no breach of the agreement.

17.4 A party may disclose Confidential Information when required by law, subpoena, regulator, bank, Payment Partner, auditor or court, provided it gives notice where legally permitted and reasonably cooperates in protective measures.

17.5 These confidentiality obligations continue for five (5) years after disclosure; obligations protecting trade secrets, Personal Information and information subject to a longer legal duty continue for so long as the information remains protected by law or qualifies as a trade secret.

18. Privacy and Data Protection

18.1 The Direct Customer is responsible for providing legally required notices and obtaining legally required rights, consents and authorizations for Customer Data submitted to SimplePin.

18.2 As between the parties, the Direct Customer generally acts as the business/controller/organization determining the purposes of processing Customer Data, and SimplePin generally acts as its service provider/processor for the contracted Services. SimplePin may act independently where it processes information for legal compliance, fraud prevention, security, billing, corporate administration or another purpose required or permitted by law.

18.3 SimplePin will process Customer Data in accordance with these Terms, the Privacy Policy, any applicable Data Processing Addendum and documented Direct Customer instructions, unless otherwise required by law.

18.4 The Direct Customer will not intentionally submit protected health information subject to HIPAA unless the parties have first executed any Business Associate Agreement required for that use case. The Direct Customer will not submit data prohibited by an Order Form or security documentation.

18.5 Cross-border data transfers may occur where necessary to provide the Services. The parties will implement legally required transfer mechanisms and safeguards where applicable.

19. Security Program and Security Incidents

19.1 SimplePin will maintain a written information-security program with administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of Customer Data and Production Services, taking into account the nature of the Services and risks presented.

19.2 SimplePin will maintain payment-card security controls appropriate to its role and comply with applicable PCI DSS requirements for cardholder data environments under its control.

19.3 SimplePin will maintain access controls, vulnerability management, logging/monitoring, incident response, backup/recovery and vendor-risk practices appropriate to the Services. Additional details may be provided in security documentation subject to confidentiality restrictions.

19.4 SimplePin will notify the Direct Customer without undue delay and, where feasible, within seventy-two (72) hours after confirming a Security Incident affecting Customer Data. The notice will include information reasonably available regarding the nature of the incident, affected data, remediation and recommended customer actions. Notification is not an admission of fault or liability.

19.5 The Direct Customer will maintain reasonable security for its own systems, credentials, endpoints, users and integrations and promptly notify SimplePin of suspected compromise that could affect the Services.

20. Business Continuity and Disaster Recovery

20.1 SimplePin will maintain business-continuity, disaster-recovery and incident-response plans reasonably appropriate to the Production Services and will test material elements periodically.

20.2 Recovery objectives, if contractually committed, will be stated in an Order Form, security schedule or SLA. Absent an express commitment, recovery times are targets and not guarantees.

21. Service Levels and Support

21.1 Production Services are subject to Schedule 2 only if the applicable Order Form states that the Production SLA applies. Pilot, beta, sandbox, third-party and free Services are excluded unless expressly stated.

21.2 Support channels, business hours and severity definitions are described in Schedule 2 or the applicable Order Form. Service credits, when available, are the Direct Customer’s exclusive monetary remedy for a failure to meet an availability commitment, except for rights that cannot lawfully be limited.

22. Intellectual Property and Licenses

22.1 SimplePin and its licensors own the Platform, software, APIs, workflows, documentation, designs, models, algorithms, improvements, know-how, trademarks and other intellectual property in the Services, excluding Customer Data and Direct Customer marks.

22.2 Subject to payment and compliance with the agreement, SimplePin grants the Direct Customer a limited, non-exclusive, non-transferable (except as permitted by assignment), non-sublicensable right during the term to access and use the Services for its internal insurance-business operations.

22.3 The Direct Customer grants SimplePin a limited license to host, copy, transmit, transform and otherwise process Customer Data and Direct Customer marks solely as necessary to provide, secure, support and improve the contracted Services and as otherwise permitted by the agreement.

22.4 Neither party may use the other party’s name, logo or marks in public marketing without prior written approval, except for factual internal references, legally required disclosures, or an expressly approved customer-list/reference right.

22.5 If the Direct Customer provides suggestions or feedback, SimplePin may use them without restriction or payment, provided SimplePin does not identify the Direct Customer as the source without permission.

22.6 The Direct Customer will not reverse engineer, decompile, disassemble, scrape, circumvent security, benchmark for a competitive purpose, copy material portions of the Platform, or use the Services to develop a competing product, except to the limited extent a restriction is prohibited by law.

23. Representations and Warranties

23.1 Each party represents that it has authority to enter into the agreement and that doing so does not knowingly violate another binding obligation.

23.2 SimplePin warrants that Production Services will be performed in a professional and workmanlike manner consistent with generally accepted industry practices and will materially conform to applicable documentation during the term. The Direct Customer’s exclusive remedy for breach of this warranty is re-performance or, if SimplePin cannot cure a material breach within a reasonable period, termination of the affected Service and a pro rata refund of prepaid unused fees for that Service.

23.3 Except for the express warranties in the agreement and to the maximum extent permitted by law, the Services are provided “as is” and “as available,” and SimplePin disclaims implied warranties of merchantability, fitness for a particular purpose, title and non-infringement, as well as warranties arising from course of dealing or usage of trade.

23.4 SimplePin does not warrant uninterrupted operation, error-free third-party data, a particular reconciliation percentage, a particular payment authorization rate, or that every carrier/source format can be automatically parsed or matched.

24. Indemnification

24.1 Direct Customer Indemnity. The Direct Customer will defend, indemnify and hold harmless SimplePin Group and its officers, directors and employees from third-party claims, regulatory demands, damages, penalties, costs and reasonable legal fees arising from: (a) the Direct Customer’s insurance products, coverage decisions or customer relationships; (b) unlawful or inadequately disclosed premiums, fees, surcharges or payment practices; (c) Customer Data or Direct Customer materials infringing third-party rights; (d) the Direct Customer’s violation of Applicable Law, insurance licensing requirements, payment-network rules or the agreement; or (e) an instruction or transaction submitted by the Direct Customer or its Authorized Users, except to the extent caused by SimplePin’s breach, gross negligence or willful misconduct.

24.2 SimplePin IP Indemnity. SimplePin will defend the Direct Customer against a third-party claim that the unmodified Production Platform, when used as authorized, infringes a U.S. or Canadian patent, copyright or trademark, and will pay finally awarded damages or settlements approved by SimplePin. SimplePin may obtain a right to continue use, modify or replace the affected Service, or terminate it and refund prepaid unused fees.

24.3 SimplePin has no obligation under Section 24.2 to the extent a claim arises from Customer Data, third-party systems, unauthorized modifications, combination with items not provided by SimplePin where the claim would not otherwise arise, use after notice to stop, or use outside the agreement.

24.4 Indemnification is conditioned on prompt notice (except to the extent delay materially prejudices the defense), reasonable cooperation, and the indemnifying party controlling the defense and settlement. No settlement may admit fault or impose non-monetary obligations on the indemnified party without consent, not to be unreasonably withheld.

25. Limitation of Liability

25.1 To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, exemplary, punitive or consequential damages, or for lost profits, revenues, goodwill, anticipated savings or business opportunities, even if advised of the possibility, except to the extent such amounts are payable to a third party under an indemnified claim.

25.2 General Cap. Except for Excluded Claims and Special Claims, each party’s aggregate liability arising out of or relating to the agreement will not exceed the fees paid or payable by the Direct Customer for the affected Services during the twelve (12) months immediately preceding the event giving rise to the claim.

25.3 Special Cap. SimplePin’s aggregate liability for its breach of confidentiality obligations, a Security Incident caused by its failure to comply with Section 19, and its obligations under Section 24.2 will not exceed two (2) times the General Cap.

25.4 Excluded Claims. The caps do not apply to: (a) the Direct Customer’s payment obligations; (b) a party’s fraud or willful misconduct; (c) liability that cannot lawfully be limited; or (d) the Direct Customer’s misuse of the Services or infringement/misappropriation of SimplePin intellectual property.

25.5 The parties agree that the limitations reflect a reasonable allocation of commercial risk and apply regardless of the theory of liability and even if a limited remedy fails of its essential purpose, to the extent enforceable.

26. Insurance

26.1 During the term, each party will maintain insurance reasonably appropriate to its business and contractual obligations. SimplePin will maintain commercially reasonable technology errors and omissions/cyber liability and commercial general liability coverage appropriate to the Services.

26.2 Upon reasonable request, SimplePin will provide evidence of applicable coverage, subject to confidentiality and insurer limitations. Any required minimum limits will be stated in an Order Form or insurance schedule.

27. Term, Renewal, Suspension and Termination

27.1 The term is stated in the applicable Order Form. If the Order Form is silent, the initial Production term is twelve (12) months from the Production Commencement Date and automatically renews for successive twelve-month periods unless either party gives at least sixty (60) days’ notice of non-renewal.

27.2 Either party may terminate the affected agreement for an uncured material breach after thirty (30) days’ written notice, or ten (10) days for a payment breach, unless cure is not reasonably possible. Either party may terminate immediately for insolvency, unlawful use, material fraud, sanctions prohibition or where continued performance is prohibited by law.

27.3 SimplePin may suspend all or part of the Services where reasonably necessary to address a security threat, suspected fraud, overdue undisputed payment, material misuse, regulatory requirement, Payment Partner direction, sanctions issue or risk to the Platform or other customers. Where practicable, SimplePin will give notice and limit the suspension to the affected Service.

27.4 Termination does not relieve either party of accrued obligations, chargebacks, returns, refunds, fees, taxes or liabilities arising from transactions initiated before termination.

28. Exit Assistance, Data Export and Deletion

28.1 Upon termination, and subject to payment of undisputed amounts, SimplePin will make Customer Data reasonably available for export in a standard format supported by the Service for thirty (30) days, unless a different period is stated in an Order Form.

28.2 SimplePin will delete or render inaccessible active copies of Customer Data within ninety (90) days after the export period, except where retention is required by law, fraud/AML obligations, payment-network rules, legitimate dispute preservation, backup rotation or documented legal hold. Retained data remains protected under the agreement.

28.3 Additional transition services, custom exports or migration assistance may be subject to professional-services fees.

29. Audit, Compliance and Assurance Materials

29.1 Subject to confidentiality, SimplePin will provide then-current security and compliance materials reasonably available for customer review, which may include security summaries, PCI materials, penetration-test summaries, business-continuity information, regulatory registration information and independent assurance reports where available.

29.2 Unless required by a regulator, material Security Incident or law, a Direct Customer may not conduct intrusive testing or an on-site audit of SimplePin systems without prior written agreement. SimplePin may satisfy reasonable audit requests through independent reports, questionnaires and documentary evidence.

29.3 Direct Customer penetration testing, vulnerability scanning or security testing of the Platform is prohibited without SimplePin’s prior written authorization and agreed scope.

PART III — DIRECT CUSTOMER JURISDICTION ADDENDA

30. United States Direct Customer Addendum

30.1 Contracting Entity. Unless an Order Form states otherwise, a Direct Customer contracting for Services in the United States contracts with SimplePin, Inc., with notices to SimplePin, Inc., Legal Department, 8954 SE Bridge Road, Hobe Sound, Florida 33455, USA, and legal@simplepin.com.

30.2 U.S. Insurance Compliance. The Direct Customer is responsible for applicable state insurance licensing, premium trust/fiduciary rules, premium finance laws, return-premium requirements, producer compensation requirements, unfair trade practices and rules governing service, convenience or card fees.

30.3 ACH. Where ACH is enabled, the Direct Customer will comply with applicable Nacha Operating Rules and obtain any authorization required for entries it originates or causes to be originated. SimplePin or its Payment Partner may reject, reverse or delay ACH activity as required by applicable rules or risk controls.

30.4 Cards. Card transactions are subject to applicable card-network, acquirer and processor rules. The Direct Customer is responsible for card-brand rules applicable to merchant conduct, prohibited transactions, descriptors, refunds, chargebacks and permitted surcharges or convenience fees.

30.5 Electronic Records. The parties consent to electronic signatures and records to the extent permitted by the U.S. Electronic Signatures in Global and National Commerce Act, applicable state UETA statutes and other Applicable Law.

30.6 Governing Law and B2B Dispute Resolution. These Direct Customer Terms are governed by Delaware law and applicable federal law, without regard to conflicts principles. Before arbitration, senior representatives will attempt in good faith to resolve a dispute for thirty (30) days after written notice. Unresolved disputes will be finally resolved by confidential binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules by one arbitrator. The seat/hearing location will be Palm Beach County, Florida, unless the parties agree otherwise. Either party may seek temporary injunctive relief in a court of competent jurisdiction for misuse of intellectual property, confidentiality or security. EACH PARTY WAIVES A JURY TRIAL TO THE EXTENT PERMITTED BY LAW.

31. Canada Direct Customer Addendum

31.1 Contracting Entity. Unless an Order Form states otherwise, a Direct Customer contracting for Canadian Services contracts with 9368-9149 Québec Inc., doing business as SimplePin, with notices to 1188 Union Avenue, Suite 151, Montréal, Québec H3B 0E5, Canada, and legal@simplepin.com.

31.2 Canadian Regulatory Framework. SimplePin and the Direct Customer will comply with Canadian federal and provincial law applicable to their respective roles. SimplePin may be subject, depending on the activity, to requirements administered by FINTRAC, the Bank of Canada, Payments Canada, Interac, financial institutions and other regulatory/payment bodies. Nothing in these Terms reduces a non-waivable obligation imposed on SimplePin by Applicable Law.

31.3 Canadian Insurance Compliance. The Direct Customer is responsible for provincial/territorial insurance licensing, premium trust/fiduciary account rules, permitted agency/broker fees, premium finance requirements, carrier remittance obligations and other requirements applicable to its insurance activities.

31.4 EFT and PAD. Where EFT or pre-authorized debit functionality is enabled, the applicable mandate/authorization will be presented separately where required. The parties will comply with applicable Payments Canada rules and financial-institution requirements. Cancellation of a PAD payment method does not itself cancel the underlying insurance or payment obligation.

31.5 Interac. Interac functionality is subject to Interac rules and participating financial-institution requirements. A Direct Customer may not use Interac marks, bank marks or other third-party branding except as authorized by the applicable rights holder or program rules.

31.6 Privacy. Each party will comply with privacy law applicable to its role, including PIPEDA and substantially similar provincial privacy laws, and Quebec privacy law where applicable. The Direct Customer is responsible for insurance-sector notices/consents and for determining whether sector-specific or provincial restrictions apply to data it submits.

31.7 Quebec Language. If these Terms or an Order Form constitute a contract of adhesion or are otherwise subject to mandatory French-language requirements in Quebec, SimplePin will make the applicable French version available before the adhering party is asked to agree to an English version. Any language-selection wording and precedence must be implemented consistently with applicable Quebec law.

31.8 Governing Law and Forum. For non-consumer Direct Customers, the agreement is governed by the laws of Quebec and the federal laws of Canada applicable therein, without regard to conflicts principles, and the parties submit to the exclusive jurisdiction of courts located in Montréal, Quebec, except that either party may seek injunctive relief in any court of competent jurisdiction to protect confidential information or intellectual property.

PART IV — END USER PAYMENT TERMS

32. Scope of End User Terms

32.1 These End User Terms apply when an End User uses a SimplePin-enabled checkout, payment link, portal, embedded payment experience, bank-selection experience or other customer-facing payment functionality made available by a Direct Customer.

32.2 The Direct Customer—not SimplePin—is the seller/provider of the insurance product or service and is responsible for the invoice, premium, policy, coverage, refund policy and customer relationship. SimplePin provides technology and payment functionality and is not a party to the insurance contract.

32.3 If a payment method is provided by a bank, card issuer, Interac, wallet or other Payment Partner, that provider’s terms also apply.

33. Eligibility and Accurate Information

33.1 An End User must be legally capable of authorizing the payment and must provide accurate information. If the End User pays on behalf of another person or business, the End User represents that the End User is authorized to use the selected payment method for that purpose.

33.2 SimplePin may request identity, account, contact or transaction information when required for security, fraud prevention, legal compliance or a payment method. Failure to provide required information may result in a declined, delayed or cancelled transaction.

34. Payment Authorization

34.1 By submitting a payment, the End User authorizes the Direct Customer, SimplePin and applicable Payment Partners to initiate and process the payment using the payment method, amount and instructions shown at checkout.

34.2 The End User is responsible for reviewing the merchant/Direct Customer name, amount, currency, invoice/policy reference, service fee and payment method before submission.

34.3 A payment instruction generally cannot be cancelled after it has entered the applicable payment rail, except where cancellation or reversal rights exist under law, network rules, the End User’s financial-institution agreement or the payment method.

34.4 Separate recurring-payment, ACH or PAD authorizations will be presented where required. These Terms do not by themselves create a recurring debit authorization unless the applicable checkout or mandate expressly says so.

35. Payment Status, Timing and Coverage

35.1 A status such as “submitted,” “pending,” “authorized” or similar does not necessarily mean that final settlement has occurred. A payment may later fail, be returned, reversed or charged back.

35.2 The timing of bank, ACH/EFT, Interac, card and wallet transactions depends on third parties and is not guaranteed unless Applicable Law requires otherwise.

35.3 Completing a payment through SimplePin does not itself bind, issue, renew, reinstate or extend insurance coverage. The End User should contact the Direct Customer or insurer regarding coverage effective dates, cancellations, lapses, refunds or policy status.

36. Fees and Amounts

36.1 Any fee charged to an End User in connection with an insurance payment will be disclosed before payment where required by law. The Direct Customer is responsible for determining whether an agency fee, convenience fee, service fee or surcharge is lawful and properly disclosed.

36.2 The End User’s bank, card issuer or other payment provider may impose separate fees, interest, foreign-exchange charges, overdraft/NSF charges or other costs under its own agreement. SimplePin is not responsible for third-party charges it does not impose.

37. Refunds, Credits, Returns and Chargebacks

37.1 Refund eligibility is determined by the Direct Customer, insurer, policy terms and Applicable Law. SimplePin may facilitate a refund or credit when instructed by the Direct Customer or required by a Payment Partner or law.

37.2 A refund may take additional time to appear depending on the payment method and financial institution. Where possible, refunds may be returned to the original payment method or another lawful destination authorized by the Direct Customer and Payment Partner.

37.3 Nothing in these Terms waives a non-waivable right to dispute an unauthorized or erroneous payment with a bank, card issuer or other financial institution. An End User must not knowingly seek duplicate recovery from both a merchant refund and a chargeback/reversal for the same amount.

38. Security and Authentication

38.1 The End User must protect access credentials, device security and one-time codes and should not share authentication information with anyone who is not authorized to act on the End User’s behalf.

38.2 SimplePin and Payment Partners may use authentication, tokenization, device, fraud, risk, identity or bank-verification tools. A transaction may be declined, delayed or routed through additional authentication for security or compliance reasons.

38.3 If the End User believes a payment, account or device has been compromised, the End User should promptly contact the Direct Customer, the financial institution and SimplePin support as appropriate.

39. Privacy

39.1 SimplePin processes End User information as described in its Privacy Policy and, where applicable, on behalf of the Direct Customer. The Direct Customer may separately process the same information under its own privacy notice.

39.2 Payment information may be shared with Payment Partners, financial institutions, fraud/security providers and other service providers as necessary to process the transaction, comply with law, prevent fraud and provide the Services.

39.3 SimplePin may retain records for legal, fraud, dispute, AML, regulatory, accounting and security purposes even after a transaction is completed or an End User stops using the Services.

40. Prohibited Use and Compliance

40.1 End Users may use SimplePin only for lawful insurance-related payments or other uses expressly made available by an approved Direct Customer. End Users may not use the Services for fraud, money laundering, sanctions evasion, unlawful transactions, unauthorized access, testing stolen credentials or any activity listed in Schedule 4.

40.2 SimplePin may decline, delay, investigate, block or reverse a transaction where permitted or required by law, payment-network rules, a Payment Partner or reasonable fraud/security controls.

41. End User Disclaimers and Liability

41.1 To the maximum extent permitted by law, SimplePin is not responsible for the quality, legality, coverage, pricing or performance of insurance products or services provided by a Direct Customer or insurer, or for disputes between an End User and the Direct Customer regarding an insurance policy or underlying obligation.

41.2 Except for non-waivable rights and liability that cannot lawfully be limited, SimplePin is liable only for direct damages actually caused by its breach of these End User Terms. SimplePin’s aggregate liability to an End User for a transaction will not exceed the amount of the affected transaction plus fees, if any, paid directly to SimplePin in connection with that transaction.

41.3 To the maximum extent permitted by law, SimplePin is not liable for indirect, incidental, special, punitive or consequential damages, or for losses caused by the End User’s bank, card issuer, merchant/Direct Customer, insurer, network, inaccurate information, insufficient funds, device compromise or events beyond SimplePin’s reasonable control.

41.4 Nothing in these Terms excludes or limits statutory consumer rights that cannot be waived.

42. End User Suspension and Termination

42.1 SimplePin may restrict an End User’s access to a payment experience where reasonably necessary for security, fraud prevention, sanctions, legal compliance, Payment Partner requirements or protection of the Platform.

42.2 Stopping use of SimplePin does not cancel an insurance policy, invoice, premium obligation, recurring authorization or other agreement with the Direct Customer. The End User must separately address those matters with the Direct Customer and, where applicable, cancel any payment authorization using the process provided for that authorization.

PART V — END USER JURISDICTION ADDENDA

43. United States End User Addendum

43.1 Contracting Entity. Unless checkout states otherwise, U.S. End Users use Services provided by SimplePin, Inc. Notices may be sent to SimplePin, Inc., Legal Department, 8954 SE Bridge Road, Hobe Sound, Florida 33455, USA, and legal@simplepin.com.

43.2 ACH and Electronic Fund Transfers. If the End User authorizes recurring preauthorized electronic fund transfers from a consumer account, the authorization will be obtained in a writing or similarly authenticated form and a copy will be provided as required by applicable law. The End User retains any stop-payment, error-resolution and unauthorized-transfer rights provided by the Electronic Fund Transfer Act and Regulation E, where applicable.

43.3 Cardholder Rights. Credit/debit card transactions remain subject to the End User’s cardholder agreement, card-network rules and applicable federal/state protections. These Terms do not waive legally protected billing-error or unauthorized-use rights.

43.4 Electronic Communications. The End User consents to receive transaction receipts, authorizations, disclosures and notices electronically where permitted by law. If a law requires a specific electronic-consent process, that process will be presented separately.

43.5 U.S. Consumer Dispute Resolution. Except for claims eligible for small claims court, claims for public injunctive relief that cannot lawfully be arbitrated, and matters that Applicable Law requires to remain in court, disputes between a U.S. End User and SimplePin will be resolved by individual binding arbitration administered by the American Arbitration Association under its applicable Consumer Arbitration Rules. The Federal Arbitration Act governs the arbitration provision. The End User may opt out by sending written notice to legal@simplepin.com within thirty (30) days after first accepting these Terms. No class, collective or representative arbitration is permitted to the extent enforceable.

43.6 Governing Law. Subject to non-waivable consumer protections of the End User’s state of residence, these Terms are governed by Delaware law and applicable federal law.

44. Canada End User Addendum

44.1 Contracting Entity. Unless checkout states otherwise, Canadian End Users use Services provided by 9368-9149 Québec Inc., doing business as SimplePin, 1188 Union Avenue, Suite 151, Montréal, Québec H3B 0E5, Canada.

44.2 Pre-Authorized Debits. Where an End User uses a PAD, a separate PAD agreement/mandate will state the required payment terms, frequency or variability, cancellation instructions, contact information and recourse information. Where permitted, a payor may agree to waive or reduce pre-notification/confirmation periods through the applicable mandate. Cancelling a PAD does not cancel the underlying insurance or payment obligation.

44.3 PAD Recourse. Where Payments Canada rules provide recourse, an End User may have rights through the End User’s financial institution for a debit that was not authorized or not processed in accordance with the PAD agreement. The specific PAD mandate and applicable Payments Canada rules control.

44.4 Interac. For Interac transactions, the End User may be redirected to or interact with the End User’s financial institution or an Interac-supported flow. The End User’s financial institution and Interac rules govern the bank interaction and availability of funds. SimplePin does not control the End User’s online-banking service.

44.5 Canadian Regulatory Rights. Nothing in these Terms limits rights or remedies that cannot be waived under applicable federal or provincial law. Where SimplePin is subject to statutory obligations as an MSB or payment service provider, those obligations apply independently of these Terms.

44.6 Quebec End Users — Language. Where required by Quebec law, a French version of the applicable standard-form/consumer terms and related documents will be provided before the End User is asked to expressly choose another language. The parties’ language choice and any discrepancy between versions will be governed by applicable Quebec law.

44.7 Governing Law and Forum. Subject to mandatory consumer-protection, language and jurisdiction rules, these Terms are governed by the law of the province or territory in which the End User resides and applicable federal law. Nothing in these Terms requires a Canadian consumer to arbitrate a claim where mandatory law gives the consumer a right to proceed in court or prohibits the waiver of a class or collective remedy.

PART VI — COMMON LEGAL TERMS

45. Acceptable Use

45.1 All users must comply with Schedule 4 and must not misuse, disrupt, probe, scrape, reverse engineer, interfere with or gain unauthorized access to the Services; introduce malware; impersonate another person; or use the Services to violate intellectual-property, privacy, sanctions, anti-fraud or other laws.

46. Notices and Electronic Communications

46.1 Direct Customer notices will be sent to the contacts in the Order Form or account profile. Legal notices to SimplePin must be sent to legal@simplepin.com and the applicable jurisdictional notice address. Email notice is effective when sent unless the sender receives a delivery failure; formal breach/termination notices should also be sent by recognized courier if required by an Order Form.

46.2 End User transaction notices, receipts and routine communications may be provided electronically through the Platform, email or text where permitted. Carrier, Direct Customer and financial-institution communications are governed by their own terms.

47. Force Majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil disturbance, labor disruption, widespread telecommunications or cloud outages, banking/payment-network failures, cyberattacks not caused by a party’s failure to maintain required security, governmental action or third-party platform failures. This section does not excuse payment obligations for Services already provided or a party’s obligation to implement reasonable business-continuity measures.

48. Assignment and Change of Control

48.1 A Direct Customer may not assign the agreement without SimplePin’s written consent, not to be unreasonably withheld, except to a successor in a merger or sale of substantially all relevant assets that is not a competitor of SimplePin and that assumes the agreement in writing, subject to SimplePin’s regulatory, KYB and credit approval rights.

48.2 SimplePin may assign the agreement to an affiliate or in connection with a merger, reorganization, financing or sale of substantially all relevant assets, provided the successor assumes SimplePin’s material obligations. Any assignment remains subject to Applicable Law and required Payment Partner/regulatory approvals.

49. Independent Contractors; No Third-Party Beneficiaries

The parties are independent contractors. These Terms do not create a partnership, joint venture, fiduciary relationship or employment relationship. Except for indemnified parties and Payment Partners expressly given rights under their own terms, there are no third-party beneficiaries.

50. Amendments and Waiver

No negotiated Direct Customer term may be amended except by a writing or electronic amendment authorized by both parties, except as expressly permitted by Section 4. A waiver must be in writing and applies only to the specific instance. Failure to enforce a provision is not a waiver.

51. Severability and Reformation

If a provision is invalid or unenforceable, it will be enforced to the maximum extent permitted or reformed to reflect the parties’ lawful intent, and the remaining provisions remain effective. Consumer provisions will be interpreted to preserve non-waivable rights.

52. Entire Agreement

For Direct Customers, the agreement consists of the documents identified in Section 4 and supersedes prior or contemporaneous proposals, discussions and representations concerning the same Services, except that a signed prior agreement remains effective to the extent an Order Form expressly preserves it. For End Users, these Terms, the applicable payment authorization, Privacy Policy and checkout disclosures comprise the agreement regarding SimplePin’s End User-facing Services.

53. Interpretation

Headings are for convenience. “Including” means “including without limitation.” Singular includes plural and vice versa where appropriate. References to laws include amendments and successor provisions. If a conflict cannot be resolved under Section 4, the more specific term controls over the general term for the subject it addresses.

54. Survival

Provisions that by their nature should survive do survive termination, including accrued payment obligations, confidentiality, data-retention obligations, intellectual property, indemnification, limitations of liability, dispute provisions, records needed for transaction disputes, and any obligations concerning chargebacks, returns, refunds or regulatory recordkeeping.

SCHEDULE 1 — MODULE AND SERVICE-SPECIFIC TERMS

A. Invoicing, Receivables and Agency-Bill Payments

• The Direct Customer controls invoice amounts, policy/account references, due dates, customer instructions and accounting treatment.
• SimplePin may present invoices, accept payment instructions, return status information and post transaction results to supported management/accounting systems.
• The Direct Customer is responsible for validating that payment and posting rules are consistent with carrier, trust-account and insurance requirements.
• Partial payments, deposits on account, installments and multi-invoice payments are available only where configured and legally permitted.

B. eCommerce, Pay-by-Link and Embedded Payments

• The Direct Customer is responsible for lawful checkout content, policy/product descriptions, customer-facing fee disclosures and merchant/customer-service obligations.
• Payment links and embedded forms may expire, be invalidated or require additional authentication. The Direct Customer must not alter security controls or frame/redirect flows in a misleading manner.
• Use of third-party marks, including financial-institution or payment-network logos, requires rights from the applicable owner or program. SimplePin’s hosting of a mark does not grant the Direct Customer a right to redistribute the asset.

C. Direct Bill Commission Reconciliation

• SimplePin may ingest carrier statements and applicable agency-management-system transaction data, parse and normalize statements, match transactions, identify unmatched items and exceptions, and present reconciliation outputs.
• Carrier statements and management-system records remain authoritative source records. The Direct Customer must review exceptions and validate results before posting or financial reliance.
• A carrier connection is included only if expressly listed or included by quantity in the Order Form. New carriers, materially changed carrier formats and custom transformations may require additional implementation work.
• Unless the Order Form states otherwise, a billable Transaction for Direct Bill must be expressly defined before usage fees apply (recommended definition: one unique carrier statement line processed for matching/reconciliation, counted once per initial processing cycle; reprocessing caused solely by a SimplePin error is not separately billable).

D. Check, Cash, Wire and Statement Capture / SimpleMatch

• SimplePin may capture data from checks, ACH/EFT remittances, wires, deposits and statements and match the captured information to receivable/accounting records.
• Images, OCR and AI-extracted data must be subject to the Direct Customer’s configured review controls before material accounting action.
• The Direct Customer remains responsible for physical check handling, deposit controls, endorsement requirements and bank reconciliation unless an Order Form expressly assigns a function to SimplePin.

E. Producer Commissions

• The Direct Customer is responsible for commission plans, producer licensing, compensation rules and approval of calculated amounts.
• SimplePin may automate calculation, allocation, reporting or posting based on customer-configured rules but does not determine legal entitlement to compensation.

F. Business Intelligence and Reporting

• Dashboards and reports are operational tools based on available source data and are not audited financial statements.
• The Direct Customer should reconcile material reports to authoritative accounting and carrier records before relying on them for financial reporting or regulatory filings.

G. Payment-Rail Terms

• Cards: subject to card-network, acquirer, processor and PCI requirements; authentication and authorization do not guarantee final settlement.
• U.S. ACH: subject to applicable Nacha rules, bank requirements and consumer laws; recurring consumer debits require legally sufficient authorization.
• Canadian EFT/PAD: subject to applicable Payments Canada rules and financial-institution requirements; legally required PAD mandate terms control.
• Interac: subject to Interac and participating financial-institution rules; bank-selection, request-money and send-money flows may vary by participating institution.
• Wallets and alternative payment methods: subject to the provider’s terms and availability.

SCHEDULE 2 — PRODUCTION SERVICE LEVEL SCHEDULE

1. Availability

SimplePin will target 99.9% Monthly Availability for the core Production Platform during each calendar month. “Monthly Availability” means the percentage of total minutes in the month that the core Production Platform is available for authenticated use, excluding Excluded Downtime.

Excluded Downtime includes scheduled maintenance with reasonable notice; emergency security maintenance; force majeure; Direct Customer systems, credentials or connectivity; carrier/AMS/ERP outages; Payment Partner, bank, card network, ACH/EFT or Interac outages; internet backbone failures outside SimplePin’s control; customer misuse; and suspension permitted by the agreement.

2. Support Priorities

3. Service Credits

A Direct Customer must request a service credit within thirty (30) days after the affected month and provide reasonable detail. Credits apply to future invoices, are not cash refunds, and are the exclusive monetary remedy for an SLA miss except where a limitation is prohibited by law or an Order Form expressly provides otherwise.

SCHEDULE 3 — SECURITY, PRIVACY AND DATA PROCESSING TERMS

1. Processing Instructions and Purpose Limitation

SimplePin will process Customer Data to provide, secure, support and improve the contracted Services; prevent fraud; comply with law; and perform documented instructions consistent with the agreement. SimplePin will not sell Customer Data or use it for targeted advertising unrelated to the Services.

2. Personnel and Access

SimplePin will limit Customer Data access to personnel and approved service providers with a business need and appropriate confidentiality obligations. Access will be provisioned and reviewed according to role and risk.

3. Subprocessors

SimplePin may use subprocessors and Payment Partners. Where required by Applicable Law or an executed DPA, SimplePin will maintain a subprocessor list and provide required notice of material new subprocessors, and will remain responsible for subprocessors to the extent required by the applicable DPA/law.

4. Data Subject / Consumer Requests

Where SimplePin acts as processor/service provider and receives a legally valid request from an individual concerning Customer Data controlled by a Direct Customer, SimplePin may direct the individual to the Direct Customer and will provide reasonable assistance as required by Applicable Law and the DPA.

5. Security Incident Cooperation

The parties will cooperate in good faith concerning legally required investigation, containment, notices and regulatory communications arising from a Security Incident. Neither party will identify the other publicly as responsible without factual and legal basis, except as required by law.

6. Retention

SimplePin may retain transaction, compliance, payment and audit records for periods required by Applicable Law, financial institutions, payment networks, fraud prevention, tax/accounting requirements and legitimate dispute defense. Operational Customer Data will otherwise be handled in accordance with Section 28 and applicable retention schedules.

SCHEDULE 4 — ACCEPTABLE USE AND RESTRICTED ACTIVITIES

The Services are designed for approved insurance-industry use. Without SimplePin’s prior written approval, users may not use the Services for unrelated payment processing, aggregation, payment facilitation or funds transmission for third parties.

• Fraud, identity theft, account takeover, money laundering, terrorist financing, sanctions evasion or other unlawful financial activity.
• Transactions involving illegal goods or services, counterfeit goods, controlled substances, unlawful weapons, unlawful gambling or other activity prohibited by Applicable Law or Payment Partner rules.
• Testing, validating or trafficking stolen payment credentials or Personal Information.
• Circumventing transaction limits, security, authentication, geolocation, sanctions, fraud controls or payment-network restrictions.
• Unauthorized scraping, reverse engineering, penetration testing, denial-of-service activity, malware distribution or access to another customer’s data.
• Infringing intellectual property, privacy, publicity or confidentiality rights.
• Using the Platform to misrepresent affiliation with SimplePin, a bank, card network, insurer or another third party.