Customer Subscription Agreement

This Customer Subscription Agreement (the “Agreement”) is entered into as of [Effective Date] (the “Effective Date”) between FractalWeb, LLC, a Texas limited liability company, with its principal place of business at [address] (“Fractal”), and [Customer legal name], [a ___ corporation], with its principal place of business at [address] (“Customer”). Fractal and Customer are each a “Party” and together the “Parties”.

Background

Fractal builds market segment applications on the Fractal Computing framework and provides them to customers as a service. Customer wishes to subscribe to one or more of those applications on the terms of this Agreement.

1. Definitions

1.1 “Application” means each Fractal application named in an Order Form, as Fractal provides it as a service, including its Updates.

1.2 “Order Form” means Schedule A and each further order form signed by both Parties (or by Customer and an Authorized Partner and accepted by Fractal) that refers to this Agreement.

1.3 “Customer Data” means the data, records and files that Customer or its Users submit to the Application, and the results the Application produces from them for Customer.

1.4 “Users” means Customer’s and its affiliates’ employees and contractors whom Customer authorizes to use the Application, within the limits in the Order Form.

1.5 “Subscription Term” means the period of Customer’s subscription to an Application stated in its Order Form, including any renewal.

1.6 “Updates” means enhancements, new features, fixes and other changes that Fractal makes generally available for an Application.

1.7 “Authorized Partner” means a reseller, distributor, system integrator or other channel partner authorized by Fractal to sell or support the Application.

1.8 “Documentation” means Fractal’s user guides and technical descriptions of the Application, as updated from time to time.

2. Subscription

2.1 Access. Subject to this Agreement and payment of the Fees, Fractal grants Customer, during each Subscription Term, a non-exclusive, non-transferable right for its Users to access and use the Application named in the Order Form for Customer’s internal business purposes, within the scope stated there.

2.2 Provision of the service. Fractal hosts and operates the Application, and is responsible for the infrastructure, software and personnel needed to provide it. Customer does not receive a copy of the Application software.

2.3 Updates. Fractal continually enhances the Fractal Computing framework and its applications, and provides Updates to Customer as part of the subscription at no additional charge. Fractal will not make an Update that materially reduces the core functionality of the Application during the Subscription Term without Customer’s consent.

2.4 Restrictions. Customer will not, and will not allow others to: (a) sell, resell, sublicense or make the Application available to any third party, except its Users; (b) copy, modify or create derivative works of the Application; (c) reverse engineer, decompile or attempt to derive the Application’s source code or design; (d) use the Application to build a competing product or service; (e) circumvent its security or usage limits; or (f) use it in violation of law.

2.5 Users. Customer is responsible for its Users’ compliance with this Agreement, for keeping their credentials secure, and for promptly notifying Fractal of any unauthorized use of its accounts.

2.6 Onboarding and professional services. Fractal will load Customer’s initial data and configure the Application as described in the Order Form. Any further implementation, integration or engineering services are provided under a statement of work agreed by the Parties, or with an Authorized Partner.

3. Fees and payment

3.1 Fees. Customer will pay the subscription fees and any other fees stated in the Order Form (the “Fees”). Fees are based on the subscription scope purchased, not actual use, and except as this Agreement states, are non-cancellable and non-refundable.

3.2 Invoicing and payment. Fractal invoices Fees as the Order Form states. Unless it states otherwise, invoices are due within 30 days after the invoice date, in U.S. dollars. Overdue amounts bear interest at the lesser of 1% per month or the maximum rate permitted by law.

3.3 Taxes. Fees exclude taxes. Customer pays all sales, use, value-added and similar taxes on the Fees, other than taxes on Fractal’s income.

3.4 Suspension. If an undisputed amount is more than 30 days overdue, Fractal may suspend access to the Application after giving Customer at least 15 days’ written notice, until the amount is paid. Suspension does not affect Customer Data.

3.5 Purchases through an Authorized Partner. If Customer subscribes through an Authorized Partner, the Fees and payment terms are those agreed between Customer and that Authorized Partner, and Customer pays the Authorized Partner. All other terms of Customer’s use of the Application are governed by this Agreement. Fractal may suspend access under Section 3.4 if Fractal is not paid for Customer’s subscription.

3.6 Renewal pricing. Fractal may change the Fees for a renewal term by giving written notice at least 60 days before the end of the current term.

4. Customer Data

4.1 Ownership. As between the Parties, Customer owns all Customer Data. Customer grants Fractal a limited right to host, copy, process and display Customer Data only to provide, secure and support the Application for Customer and as Customer otherwise instructs.

4.2 Use. Fractal will not sell Customer Data, use it to provide services to anyone else, or use it to train any language model or other AI model that is made available to others. Fractal may use aggregated, de-identified usage information about the operation of the Application to maintain and improve it, provided it does not identify Customer, its Users or any individual.

4.3 Security. Fractal will maintain administrative, physical and technical safeguards designed to protect the security, confidentiality and integrity of Customer Data, as described in Schedule B, and will not materially reduce them during the Subscription Term.

4.4 Security incidents. Fractal will notify Customer without undue delay, and in any event within [72 hours], after becoming aware of unauthorized access to or disclosure of Customer Data, and will provide the information Customer reasonably needs to meet its own obligations and take reasonable steps to contain the incident.

4.5 Regulated data. Customer will identify in the Order Form any regulated data that Customer Data will include. If it includes protected health information, Schedule C (Business Associate Addendum) applies. If it includes personal data subject to data protection law, Schedule D (Data Processing Terms) applies. If the law or Customer requires a different form of agreement for any regulated data (for example Customer’s own business associate agreement, or the FBI CJIS Security Addendum for criminal justice information), the Parties will sign it before Customer submits that data, and for that data it replaces Schedule C or D. Customer will not submit any other regulated data until the Parties have agreed in writing the terms that govern it.

4.6 Customer responsibilities. Customer is responsible for the accuracy and legality of Customer Data, and for having the rights and consents needed for Fractal to process it under this Agreement.

4.7 Return and deletion. During the Subscription Term and for 30 days after it ends, Customer may export Customer Data, and Fractal will reasonably assist on request. After that period Fractal will delete Customer Data from the Application, except for copies required by law or held in routine backups, which remain subject to this Agreement until they are overwritten.

5. Service levels and support

Fractal will provide the Application in accordance with the service levels, and provide the support, described in Schedule B. If Fractal does not meet an availability commitment, Customer’s remedy is the service credit stated in Schedule B, together with Customer’s right to terminate under Section 11.3 for repeated failure.

6. Proprietary rights

6.1 Fractal and its licensors, including partners whose capabilities are licensed into the Application, own all rights in the Application, the Fractal Computing framework, the Documentation and all Updates. No rights are granted to Customer other than those expressly stated in this Agreement.

6.2 If Customer gives Fractal suggestions or feedback about the Application, Fractal may use them without restriction or obligation, provided Fractal does not identify Customer as their source without consent.

7. Confidentiality

Each Party will keep the other’s non-public business, technical and financial information, including Customer Data and the terms of this Agreement, confidential, use it only to perform this Agreement, and protect it with at least reasonable care. These obligations do not apply to information that is or becomes public through no fault of the recipient, was already known to it, is lawfully received from a third party without restriction, or is independently developed. A Party may disclose information when required by law, after giving the other Party notice where permitted. If the Parties have signed a mutual non-disclosure agreement, it continues to apply, and this Agreement prevails if they conflict.

8. Warranties

8.1 Each Party warrants that it has the authority to enter into this Agreement.

8.2 Fractal warrants that during the Subscription Term: (a) the Application will perform materially in accordance with its Documentation; (b) Fractal will provide it in a professional and workmanlike manner; and (c) Fractal will use industry-standard measures designed to prevent the Application from introducing viruses or other malicious code into Customer’s systems.

8.3 If the Application does not conform to Section 8.2, Customer will notify Fractal, and Fractal will use reasonable efforts to correct it. If Fractal cannot do so within 30 days of notice, Customer may terminate the affected Order Form and receive a refund of prepaid Fees for the remainder of its Subscription Term. This is Customer’s exclusive remedy for breach of Section 8.2.

8.4 Results produced by the Application, including summaries produced with the help of a language model, are tools to support Customer’s decisions. Customer is responsible for decisions it makes using them.

8.5 Except as this Agreement expressly states, each Party disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement, and Fractal does not warrant that the Application will be uninterrupted or error-free.

9. Indemnification

9.1 By Fractal. Fractal will defend Customer against any third-party claim that the Application, as provided by Fractal, infringes or misappropriates that party’s intellectual property rights, and will pay the damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, Fractal may obtain the right for Customer to keep using the Application, modify it to be non-infringing, or, if neither is reasonably possible, terminate the affected subscription and refund prepaid Fees for the remainder of its term. This obligation does not apply to claims arising from Customer Data, from combinations with items not provided by Fractal, or from use in breach of this Agreement.

9.2 By Customer. Customer will defend Fractal against any third-party claim arising from Customer Data or from Customer’s use of the Application in violation of law or of Section 2.4, and will pay the damages and costs finally awarded or agreed in settlement.

9.3 Procedure. The indemnified Party will promptly notify the indemnifying Party of the claim, give it sole control of the defense and settlement (provided that no settlement may impose an obligation on the indemnified Party without its consent), and reasonably cooperate at the indemnifying Party’s expense.

10. Limitation of liability

10.1 Neither Party is liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, arising from this Agreement, even if advised of their possibility.

10.2 Each Party’s total liability arising from this Agreement is limited to the Fees paid and payable for the Application giving rise to the liability in the 12 months before the event that gave rise to it.

10.3 The limits in Sections 10.1 and 10.2 do not apply to a Party’s indemnification obligations, its breach of Section 7 (Confidentiality), Customer’s obligation to pay Fees, or liability for gross negligence, willful misconduct or fraud.

11. Term and termination

11.1 Term. This Agreement begins on the Effective Date and continues until every Subscription Term under it has ended.

11.2 Renewal. Unless the Order Form states otherwise, each Subscription Term renews automatically for successive periods of one year, unless either Party gives written notice of non-renewal at least 60 days before the end of the current term.

11.3 Termination for cause. Either Party may terminate this Agreement or an Order Form by written notice if the other Party materially breaches it and does not cure the breach within 30 days of written notice, or becomes insolvent or the subject of bankruptcy proceedings. If Customer terminates for Fractal’s breach, Fractal will refund prepaid Fees for the remainder of the Subscription Term.

11.4 Effect. On termination or expiry, Customer’s right to use the Application ends, Section 4.7 applies to Customer Data, and Customer pays any Fees due up to the effective date. Sections 3 (for amounts due), 4, 6, 7, 9, 10, 11.4 and 12 survive.

12. General

12.1 Governing law and venue. This Agreement is governed by the laws of the State of Texas, without regard to its conflict of laws rules. The state and federal courts located in Travis County, Texas have exclusive jurisdiction over any dispute arising from it, except that either Party may seek injunctive relief in any court of competent jurisdiction.

12.2 Assignment. Neither Party may assign this Agreement without the other’s prior written consent, except to a successor to all or substantially all of its business or assets to which this Agreement relates, provided the successor agrees in writing to be bound by it.

12.3 Subcontractors. Fractal may use subcontractors, including hosting providers and Authorized Partners, to provide the Application, and remains responsible for their performance under this Agreement.

12.4 Publicity. Neither Party will issue a press release about this Agreement without the other’s prior written approval. Fractal may name Customer as a customer in its customer lists, with Customer’s consent, which it may withdraw at any time.

12.5 Relationship. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship, and neither Party may bind the other.

12.6 Force majeure. Neither Party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control.

12.7 Export. Each Party will comply with all applicable export control and sanctions laws in performing this Agreement.

12.8 Notices. Notices must be in writing and sent to the addresses above (or as a Party later designates in writing), by hand, by a recognized courier, or by email with confirmation of receipt.

12.9 Entire agreement; order of precedence. This Agreement, its Schedules and its Order Forms are the entire agreement of the Parties on their subject and supersede all prior understandings on it, including any terms on Customer’s purchase orders. If they conflict, Schedules C and D prevail for the data they govern, then an Order Form for that order only, then the body of this Agreement, then the other Schedules. This Agreement may be amended or waived only in a writing signed by both Parties.

12.10 Severability; waiver. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions remain in effect. A failure or delay in enforcing any provision is not a waiver of it.

12.11 Counterparts and electronic signature. This Agreement may be signed in counterparts and by electronic signature, each of which is an original and all of which together are one agreement.

Signed by the Parties’ authorized representatives as of the Effective Date.

Schedule A: Order Form

Schedule B: Service levels, support and security

Schedule C: Business Associate Addendum

This Schedule applies when the Order Form states that Customer Data will include protected health information. In it, Customer is the “Covered Entity” (or, where Customer is itself a business associate of a covered entity, the business associate on whose behalf Fractal acts), and Fractal is the “Business Associate”. It is intended to meet the requirements of 45 C.F.R. §§ 164.308, 164.314, 164.410 and 164.504(e).

C.1 Definitions. Terms used in this Schedule and not defined in it, including “Breach”, “Protected Health Information” (“PHI”), “Electronic PHI”, “Security Incident”, “Subcontractor”, “Unsecured PHI” and “Secretary”, have the meanings given in the Health Insurance Portability and Accountability Act of 1996, the HITECH Act and their implementing regulations at 45 C.F.R. Parts 160 and 164 (together, “HIPAA”). PHI here means only PHI that Fractal creates, receives, maintains or transmits on behalf of Customer.

C.2 Permitted uses and disclosures. Fractal may use and disclose PHI only: (a) to provide the Application and perform this Agreement for Customer; (b) as required by law; (c) for Fractal’s proper management and administration or to carry out its legal responsibilities, provided that any disclosure for those purposes is required by law, or Fractal obtains reasonable assurances from the recipient that it will keep the PHI confidential, use or further disclose it only as required by law or for the purpose for which it was disclosed, and notify Fractal of any breach of its confidentiality; and (d) to provide data aggregation services relating to Customer’s health care operations, if the Order Form permits it. Fractal will limit its uses, disclosures and requests of PHI to the minimum necessary, and will not use or disclose PHI in a manner that would violate HIPAA if done by Customer.

C.3 Safeguards. Fractal will use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) for Electronic PHI, to prevent use or disclosure of PHI other than as this Schedule provides.

C.4 Reporting. Fractal will report to Customer: (a) any use or disclosure of PHI not provided for by this Schedule, of which it becomes aware; (b) any Security Incident of which it becomes aware, provided that this Schedule serves as notice of the ongoing, unsuccessful attempts (such as pings, port scans and blocked log-in attempts) that do not result in unauthorized access, use or disclosure, for which no further notice is required; and (c) any Breach of Unsecured PHI, as 45 C.F.R. § 164.410 requires. Fractal will make each report within the period stated in Section 4.4, and in any event no later than [ten (10)] business days after discovery and within the period HIPAA requires, and will give Customer the information it needs to notify affected individuals and regulators. Fractal will mitigate, to the extent practicable, any harmful effect of a use or disclosure in violation of this Schedule that is known to it.

C.5 Subcontractors. Fractal will ensure, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Fractal under this Schedule.

C.6 Individuals’ rights. To the extent Fractal maintains PHI in a designated record set, Fractal will, within [fifteen (15)] days of Customer’s request: (a) make it available to Customer so Customer can meet its obligations under 45 C.F.R. § 164.524 (access); and (b) make amendments to it that Customer directs under 45 C.F.R. § 164.526. Fractal will document disclosures of PHI, and provide that information to Customer within the same period, as Customer needs to give an accounting of disclosures under 45 C.F.R. § 164.528. Fractal will forward to Customer any such request it receives directly from an individual.

C.7 Customer’s obligations. To the extent Fractal carries out any of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, Fractal will comply with the requirements of Subpart E that apply to Customer in performing them.

C.8 Books and records. Fractal will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for the purpose of determining compliance with HIPAA.

C.9 Customer responsibilities. Customer will: (a) notify Fractal of any limitation in its notice of privacy practices, any change in or revocation of an individual’s permission, and any restriction on the use or disclosure of PHI it has agreed to, to the extent it affects Fractal’s use or disclosure of PHI; (b) not ask Fractal to use or disclose PHI in any manner that would not be permitted under HIPAA if done by Customer; and (c) submit to the Application only the minimum PHI necessary for the purposes of the Order Form.

C.10 Term and termination. This Schedule applies for as long as Fractal holds PHI. If Customer determines that Fractal has violated a material term of this Schedule, Customer may terminate this Agreement and the affected Order Forms if Fractal does not cure the violation within 30 days of written notice, or immediately if cure is not possible.

C.11 Return or destruction. On termination or expiry, Fractal will return or destroy all PHI, as Section 4.7 provides, and will retain no copies. If return or destruction is not feasible (for example, for copies held in routine backups until they are overwritten), Fractal will extend the protections of this Schedule to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it holds it.

C.12 Interpretation and amendment. Any ambiguity in this Schedule will be resolved to permit compliance with HIPAA. The Parties will amend this Schedule as needed to comply with any change in HIPAA. Nothing in this Schedule gives any third party any rights.

Schedule D: Data Processing Terms

This Schedule applies when the Order Form states that Customer Data will include personal data subject to Data Protection Law. For that data, Customer is the controller (or, under U.S. state laws, the business), and Fractal is Customer’s processor (or service provider).

D.1 Definitions. “Data Protection Law” means all laws on the protection of personal data that apply to the processing of Customer Personal Data under this Agreement, which may include the EU and UK General Data Protection Regulations, the California Consumer Privacy Act as amended, the Texas Data Privacy and Security Act, and similar U.S. state laws. “Customer Personal Data” means personal data in Customer Data. “Personal data”, “controller”, “processor”, “data subject”, “processing” and similar terms have the meanings given in the applicable Data Protection Law. Protected health information is governed by Schedule C instead of this Schedule.

D.2 Instructions. Fractal will process Customer Personal Data only on Customer’s documented instructions, which are this Agreement, the Order Form and Customer’s use of the Application’s features, including with regard to international transfers, unless the law requires otherwise, in which case Fractal will inform Customer first unless the law prohibits it. Fractal will promptly tell Customer if, in its opinion, an instruction infringes Data Protection Law. The details of the processing are set out in the table below.

D.3 U.S. state privacy laws. Fractal will not: (a) sell or share Customer Personal Data, as those terms are defined in Data Protection Law; (b) retain, use or disclose it for any purpose other than the business purposes set out in this Agreement, or outside the direct business relationship between Fractal and Customer; or (c) combine it with personal data Fractal receives from or on behalf of anyone else, except as Data Protection Law permits. Fractal will notify Customer if it can no longer meet its obligations under Data Protection Law, and Customer may then take reasonable steps to stop and remediate unauthorized processing. Fractal certifies that it understands and will comply with these restrictions.

D.4 Personnel. Fractal will ensure that persons it authorizes to process Customer Personal Data are bound by obligations of confidentiality.

D.5 Security. Fractal will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including those described in Schedule B, and will notify Customer of a personal data breach as Section 4.4 provides.

D.6 Subprocessors. Customer gives general authorization for Fractal to engage subprocessors, including those listed in the table below. Fractal will give Customer at least 30 days’ notice before adding or replacing a subprocessor. If Customer objects on reasonable data protection grounds within that period and the Parties cannot resolve the objection, Customer may terminate the affected Order Form and receive a refund of prepaid Fees for the remainder of its Subscription Term. Fractal will impose on each subprocessor, by written contract, data protection obligations no less protective than this Schedule, and remains responsible for its performance.

D.7 Assistance. Taking into account the nature of the processing, Fractal will assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects to exercise their rights, and will forward to Customer any such request it receives. Fractal will also reasonably assist Customer in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the information available to Fractal.

D.8 Deletion or return. At the end of the Subscription Term, Fractal will delete or return Customer Personal Data as Section 4.7 provides, unless the law requires it to be kept.

D.9 Audits. Fractal will make available to Customer the information reasonably necessary to demonstrate its compliance with this Schedule, and will allow for and contribute to audits, including inspections, by Customer or an independent auditor Customer appoints, on at least 30 days’ written notice, no more than once a year (unless required by a supervisory authority or following a personal data breach), during business hours and subject to confidentiality obligations. Fractal may first offer its current independent audit reports or certifications, where they reasonably address Customer’s request.

D.10 International transfers. Fractal will not transfer Customer Personal Data out of the country or region stated in Schedule B without Customer’s prior written consent. Where a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland is made under this Agreement, the Parties agree to the standard contractual clauses approved for that transfer by the applicable authority, which are incorporated by reference with the details in the table below.