Bookmaker Terms of Service

1.1 Who we are

Bookmaker is provided by Celar Technologies LLC, a Minnesota limited liability company, of 9691 Linden Ln N, Brooklyn Park, MN 55443, United States ("Celar", "we", "us" or "our"). You can reach us at [email protected].

1.2 Accepting these Terms

These Terms of Service (the "Terms") are a binding contract between Celar and the Customer (defined in section 2). You accept them by clicking a button or checking a box where we tell you that doing so means you agree to them, including when you:

• create an account and its first workspace, including by continuing with Google;
• create an account to accept an invitation to join a workspace; or
• buy a plan through Stripe Checkout, where you are asked to accept these Terms before you pay.

A workspace you create later, an invitation you accept while signed in, and a plan change you make later in Settings > Billing are made under the Terms you have already accepted.

If you used the Service before these Terms were published, the Service asks you to agree to them when you next sign in or open the app (Connected Apps keep working until you do). You accept them when you agree to them in the Service or, if earlier, by continuing to use the Service after we have notified you of them.

We record which version of these Terms you accepted and which version of the Privacy Policy you acknowledged, when, and how (for example, at sign-up or in the Service). When you accept these Terms in Stripe Checkout, Stripe records that acceptance. If you do not agree to these Terms, do not use the Service.

1.3 Acting for a business

The Service is made for businesses and self-employed people. It is not offered to consumers for personal, family or household use. By accepting these Terms you confirm that you use the Service for your trade, business, craft or profession.

If you accept these Terms on behalf of a company or other organisation, you confirm that you have authority to bind it, and "Customer" and "you" then mean that organisation. If you do not have that authority, you must not accept these Terms or use the Service for it.

1.4 Minimum age

You must be at least 18 years old, and old enough to make a binding contract where you live, to use the Service.

1.5 Other documents

Our Privacy Policy explains how we handle personal data for which we decide the purposes, such as account, billing and security data. Annex A (Data Processing Terms) forms part of these Terms and governs personal data that we process on your behalf. Section 27.7 explains which document wins if they conflict.

1.6 Users

If you use the Service as a User of a Workspace that belongs to someone else, you agree to follow these Terms as they apply to Users (including sections 4.3, 5, 11, 12, 13, 16, 17, 20, 21 and 25), and the Customer that owns the Workspace is responsible for you. You are not personally responsible for the Customer's Fees.

3.1 What we provide

Subject to these Terms and your plan, we grant you a non-exclusive, non-transferable, non-sublicensable right, while these Terms are in effect for your Workspace, to access and use the Service for your internal business purposes. The features and limits of each plan are those shown on our pricing page and in the Service when you use them, as they may change under section 3.2.

3.2 Changes to the Service

The Service changes over time. We may add, change or remove features, change the third-party providers we use, and change technical limits. If we remove a feature that is a material part of a Paid Plan or AI Calling Plan, we will give you reasonable notice where we can. If we remove such a feature during a period you have paid for, and the removal materially reduces what you paid for, you may cancel that plan within 30 days of our notice, and we will refund the prepaid Fees for the unused part of that period. This refund is your sole remedy for that change.

3.3 Features that depend on configuration

Some features, including paid plans, AI Features, semantic search, Connected Apps and AI Calling, are switched on per installation or per Workspace, or depend on outside providers. They may not be available to you, or may be available only for some Workspaces. A description of a feature in the help centre is not a promise that it is available to you.

3.4 Beta and experimental features

We may offer features marked as beta, preview, pilot, experimental or similar. They are provided as they are, may change or stop at any time, may have extra limits and are excluded from any commitment in these Terms to the extent the law allows.

4.1 Your account

You must give accurate and complete information when you sign up, including your name, email address, organisation name and country, and keep it up to date. The country you declare affects prices, tax and eligibility for some programmes (see section 9). Giving a false country, or false information to obtain a price or programme, is a breach of these Terms.

4.2 Workspaces, roles and Owners

A Workspace can have several Users with roles such as owner, admin, accountant, sales, operations and viewer. Each role has different permissions. Only owners and admins can manage billing. The last Owner of a Workspace cannot be demoted.

The Owners of a Workspace act for the Customer. You are responsible for:

• choosing who you invite and which role you give them;
• everything done in your Workspace by your Users, by anyone using their credentials, and by Connected Apps and integrations they authorise; and
• removing access promptly when someone should no longer have it.

4.3 Security of your credentials

You must keep passwords, recovery codes and other credentials confidential and must not share accounts. Each person needs their own account. We strongly recommend that every User, and in particular every Owner of a Workspace on a Paid Plan, turns on two-factor authentication. Anyone signed in as an Owner can change the plan and the payment card.

Tell us at once at [email protected] if you believe an account or Workspace has been accessed without permission. We are not liable for loss caused by the use of your credentials, except to the extent it is caused by our breach of these Terms.

4.4 Our security measures

We take reasonable technical and organisational measures, appropriate to the risk, to protect the Service and Customer Data. Annex A, section A5 summarises them. No system is completely secure, and we do not promise that the Service will be free from unauthorised access, loss or interruption.

4.5 Account protections

To protect accounts, the Service limits sign-in attempts, temporarily locks accounts after repeated failed attempts, rate-limits sensitive actions and may require you to verify your email address. These measures may sometimes delay your access.

5.1 What you must not do

You must not, and must not allow anyone else to, use the Service to:

1. break any law or regulation, or help anyone else do so;
2. send spam or unsolicited bulk messages, or send email, calls or texts to people who have not agreed to receive them where the law requires their agreement;
3. send or store content that is unlawful, fraudulent, defamatory, harassing, threatening, obscene, discriminatory, or that infringes anyone's intellectual property, privacy or other rights;
4. commit or facilitate fraud, including phishing, issuing fake, misleading or inflated invoices, receipts or quotations, impersonating another person or business, or using another business's name, logo or details without permission;
5. evade, or help anyone evade, tax, or launder money, finance terrorism or breach any sanctions;
6. send malware, or content designed to harm or gain unauthorised access to any system or data;
7. probe, scan or test the vulnerability of the Service, or breach or bypass any security or authentication measure, except under a written agreement with us (see section 5.3);
8. access the Service by automated means, scrape it or harvest data from it, other than through features and interfaces we provide for that purpose and within their limits;
9. copy, modify, translate, decompile, disassemble or reverse engineer the Service, or try to derive its source code, except to the extent the law expressly allows this despite this restriction;
10. sell, resell, rent, lease, sublicense or otherwise make the Service available to third parties as a service bureau or as part of your own product, except as we agree in writing;
11. build a competing product, or copy features or design of the Service, using the Service or our confidential information;
12. avoid, exceed or get around plan limits, usage limits or Fees, including by creating several accounts or Workspaces to obtain more free allowance, or by giving false eligibility information;
13. interfere with or disrupt the Service, its networks or other customers, or place an unreasonable load on our infrastructure;
14. store or process health information protected by HIPAA, payment card numbers (other than on Stripe's own pages), or personal identity numbers such as social security, national identity or passport numbers, other than business tax and registration numbers in fields the Service provides for them, unless you have a lawful basis and it is necessary; or
15. use the Service if you are a person, or acting for a person, described in section 26.

5.2 Your content and your communications

You are responsible for the content you put in the Service and for every message, document, signature request, call and text sent through your Workspace. That includes making sure invoices, quotations, receipts and other documents you issue are accurate, lawful and include any information that tax and consumer laws require where you operate. Bookmaker gives you tools; it does not check your documents for legal or tax compliance.

5.3 Security research

If you believe you have found a security vulnerability, report it to [email protected] and do not access, change or delete data that is not yours. Do not test the Service without our written permission.

5.4 What we may do

We may investigate suspected breaches of this section. We may remove or disable content, limit features, suspend sending or calling, or suspend or close a Workspace as set out in section 19. We may report suspected unlawful activity to the authorities and co-operate with them.

6.1 You own your Customer Data

As between you and Celar, you own all rights in your Customer Data. We claim no ownership of it.

6.2 The licence you give us

You grant Celar and its Sub-processors a worldwide, non-exclusive, royalty-free licence, for the term of these Terms and any period afterwards in which we hold Customer Data under section 7, to host, copy, process, transmit, display and adapt Customer Data only as needed to:

• provide, maintain, secure and support the Service for you, including the features you or your Users choose to use;
• prevent fraud, abuse and breaches of these Terms;
• comply with the law; and
• as you otherwise instruct.

6.3 Service Data and aggregated data

We may collect and use Service Data to run, secure, support, bill for and improve the Service. We may also create aggregated or de-identified information from the use of the Service that does not identify you, your Users or any End Recipient, and use it for any lawful purpose. We will keep such information in de-identified form, will not attempt to re-identify it, and will contractually require anyone we share it with to do the same. It will not include the content of your documents or communications.

6.4 Your responsibilities for Customer Data

You are responsible for the accuracy, quality, legality and content of Customer Data, and for how you obtained it. In particular, you are responsible for:

• having a lawful basis, and any consent the law requires, to put personal data about End Recipients into the Service and to process it through the features you use;
• giving End Recipients any privacy notice the law requires. This includes telling them, where required, that the Service records when they open a document you share, records evidence when they sign (such as their email, the time, their device details and a one-way fingerprint of their network address), and that their calls with your AI agents may be recorded and transcribed;
• responding to requests from End Recipients about their data, with our help as set out in Annex A; and
• not uploading data you are not allowed to share with us or with the Third-Party Services you choose to use.

6.5 Our role for Customer Personal Data

For Customer Personal Data, you are the controller (or, if you process it for your own clients, a processor), and we are your processor (or sub-processor). Under US state privacy laws we act as your "service provider" or "processor". Annex A sets out our processing terms. For Service Data and other personal data we use for our own purposes, we are an independent controller, as described in the Privacy Policy.

7.1 Exporting your data

While your Workspace is active you can export many of your records using the tools in the Service, such as PDF and ZIP downloads of documents, CSV export of customers and products, and report exports. Moving to the Free Plan does not stop you viewing, downloading or exporting your own records, although report exports in XLSX and PDF need Pro or Business (CSV stays available). There is currently no single tool that exports every record in a Workspace. If you need data that the export tools do not cover, contact us and we will help where we reasonably can.

7.2 Keep your own copies

We do not promise to keep backups of Customer Data, and we do not guarantee that lost or deleted data can be recovered. You are responsible for keeping your own copies of any Customer Data you need, including documents for tax and record-keeping purposes. Some data is deleted automatically, including call recordings and transcripts (section 14.10), unsent e-signature drafts (section 12.5) and inactive AI drafting conversations.

7.3 Deleting your Workspace or account

There is currently no self-service button to delete a Workspace or a User account. An Owner can ask us to close and delete a Workspace by emailing [email protected] from an Owner's email address. We will confirm the request and the person's authority before acting. A User can ask us to delete their own account through the same address. For a Workspace, we first disable it, then schedule deletion, and permanently delete its records after a grace period of at least 7 days. Before deletion we will cancel any active Bookmaker plan and AI Calling subscriptions for that Workspace and disconnect its calling integrations. Fees, usage and extras already incurred remain payable.

7.4 What we keep after deletion

When a Workspace is deleted we remove its records from the live Service. We may keep:

• billing and payment records, with the link to the Workspace removed, for accounting, tax and legal purposes;
• a minimal record that the Workspace existed and was deleted;
• security and audit logs, and error and system logs, until their scheduled deletion;
• usage counts used to apply plan limits across Workspaces;
• User sign-in accounts, which can belong to more than one Workspace, until the User asks us to delete them;
• copies held in any backups until they are overwritten in the normal course; and
• anything we must keep by law or to establish, exercise or defend legal claims.

Retained data stays protected by these Terms and is used only for the purpose for which we keep it.

7.5 After termination

Unless you asked us to delete the Workspace under section 7.3 (in which case section 7.3 applies), or we ended these Terms because of a breach of section 5, 14 or 26, or the law prevents it, when these Terms end for a Workspace you may ask us for help exporting your Customer Data for 30 days afterwards, provided you have paid all Fees due. After those 30 days we have no obligation to keep any Customer Data and may delete it at any time.

8.1 Plans and prices

Bookmaker has a Free Plan and Paid Plans (currently Pro and Business), billed monthly or yearly. AI Calling is a separate add-on with its own AI Calling Plans and subscription (see section 14). Current prices and plan contents are shown on our pricing page and in the Service. The price shown in Stripe Checkout when you buy is the price that applies to your purchase, and the amount on your invoice is what you are charged. Prices are in US dollars unless Checkout shows otherwise.

8.2 Who sells to you

Payments are processed by Stripe. Who the seller is depends on the product, as set out below. For Pro and Business, it is also stated on our pricing page and in Settings > Billing.

• Pro and Business plans. Where the Service says that Stripe is the seller of record, Stripe acts as merchant of record for the sale through Stripe Managed Payments. Stripe then calculates, collects and pays any sales tax or VAT due, handles fraud screening and payment disputes, and Stripe's own terms for Managed Payments purchases also apply. In that case the purchase is shown as sold through Link, Stripe's checkout service, and your card statement shows the charge as LINK.COM* followed by our name. Celar remains responsible to you for providing the Service under these Terms. Where the Service instead says that Bookmaker is sold by Celar Technologies LLC, Celar is the seller and Stripe processes the payment.
• AI Calling. Celar Technologies LLC is always the seller. Stripe processes the payment and Stripe Tax calculates any tax due.

8.3 Paying through Stripe

You buy Paid Plans and AI Calling Plans only through Stripe Checkout, and manage your card, cancellations and invoices through the Stripe Customer Portal (and, where Stripe is the seller of record, also through Link). Card details are entered on Stripe's pages, not in Bookmaker, and are handled under Stripe's terms and privacy policy. You authorise the seller (Stripe or Celar, as set out in section 8.2) to charge your chosen payment method for all Fees when due, including renewals, upgrades and usage charges. Only owners and admins can buy or change plans. Plans cannot be bought or changed during a support session or by a Connected App.

8.4 When paid access starts

Paid features start only once Stripe confirms your payment to us. If you leave Checkout without paying, nothing is charged and nothing changes.

8.5 Automatic renewal

Paid Plans and AI Calling Plans renew automatically at the end of each monthly or yearly period for another period of the same length, at the price then in effect for your plan, and your payment method is charged on the renewal date until you cancel. For yearly plans, we or Stripe will email a reminder at least 15 days before the renewal date, with the renewal price and how to cancel. You can cancel online at any time from Settings > Billing (or, for AI Calling, from the AI Calling billing page). Cancellation takes effect at the end of the current period. Settings > Billing shows your next renewal date.

8.6 Upgrades

When you buy a Paid Plan from the Free Plan, or during a founding period, you pay the full price for the first period in Stripe Checkout. When you upgrade an existing Paid Plan (for example from Pro to Business, or from monthly to yearly billing), you are charged straight away for the rest of the current period, less a credit for the unused part of your current plan. A move from monthly to yearly charges a full year, less the unused part of the month, and the new yearly period starts that day. An upgrade takes effect only after the payment succeeds. If your bank requires extra authentication, Stripe's page opens so you can complete it.

8.7 Downgrades

A downgrade (for example from Business to Pro, or from yearly to monthly billing) takes effect at the end of the current paid period, and you can undo it before then. A change that raises one of plan and billing interval while lowering the other must be made as two separate changes. A plan that is set to end, or that has a payment due, cannot be changed until that is resolved.

8.8 Cancellation

You can cancel a Paid Plan at any time through the Stripe Customer Portal, reached from Settings > Billing. Where Stripe is the seller of record, you can also cancel through Link (link.com). Your plan continues until the end of the period you have paid for and then moves to the Free Plan. We do not refund the unused part of a period when you cancel, except as set out in section 8.10. Cancelling does not delete any Customer Data. For AI Calling Plans, section 14.11 applies instead.

8.9 Failed payments

If a Paid Plan renewal payment fails, Stripe retries it for up to 7 days and your plan keeps working during that time. If payment still has not succeeded, the plan is marked unpaid and your Workspace moves to Free Plan features, or back to its founding period if one is still running (section 9.2). Nothing is deleted. A later successful payment restores the plan. You remain liable for any amount due. For AI Calling Plans, section 14.11 applies instead.

8.10 Refunds

Fees are non-refundable except:

• where these Terms say otherwise, including sections 3.2, 8.16, 9.4, 19.5 and A6;
• where we choose to give a refund, which we may do in our discretion, in whole or in part, without creating an obligation to do so again;
• in the cases built into the Service: a duplicate Bookmaker plan subscription is cancelled and its first invoice refunded automatically; a duplicate AI Calling subscription is cancelled and its first invoice refunded by us; a payment flagged by the card network as likely fraudulent is refunded and the subscription cancelled (see section 8.11); and an unused share is refunded when a Workspace is confirmed for Nigeria status (section 9.4);
• where Stripe, as seller of record, gives a refund under its own terms, which it may do within 60 days of a payment; and
• where the law requires a refund.

8.11 Disputes, chargebacks and fraud warnings

Please contact us before disputing a charge with your bank. If a payment is disputed, the paid access that payment covers ends at once. If the dispute is closed in our favour, access is restored once no other dispute is open or lost. If the dispute is lost, access under that subscription ends for good. A full refund ends the paid access for the period that payment covered. Where Stripe is the seller of record, Stripe handles disputes and may accept or contest them. If we or Stripe receive an early fraud warning for a payment, we refund it, cancel the subscription, end the paid access and may block new purchases for that Workspace for 30 days.

8.12 Taxes

Prices do not include taxes unless the Checkout page says they do. Where Stripe is the seller of record, Stripe adds any sales tax or VAT due where you are. Where Celar is the seller, sales tax, VAT or similar taxes are added where they apply, and you must give a correct billing address and any tax ID requested. You are responsible for all taxes on your purchase other than taxes on Celar's net income. If you claim an exemption, you must give valid evidence of it.

8.13 Currency

Paid Plan subscriptions, prices and invoices are in US dollars. Where Stripe is the seller of record, Stripe may let you pay in your local currency at a rate it sets; your subscription and invoice stay in US dollars. AI Calling is charged in US dollars only. Your bank may charge its own conversion or foreign transaction fees.

8.14 Price changes

We may change our prices. For an existing subscription, we will tell the Owners by email or in the Service at least 30 days before a price increase applies. The new price applies from your next renewal after the notice period ends. If you do not agree, you may cancel before then. Promotional prices and discounts last only for the period stated with them.

8.15 Promotion codes

Promotion codes can be used only as stated with them, have no cash value, cannot be transferred or sold, and may be withdrawn at any time before they are used.

8.16 Consumers in the EU, EEA, UK and Switzerland

If, despite section 1.3, you buy as a consumer in the EU, EEA, UK or Switzerland, you have the right to withdraw from a purchase within 14 days without giving a reason, by emailing [email protected]. Because paid access starts immediately, by completing Checkout you expressly ask us to start the Service during the withdrawal period, and if you withdraw you will pay for the part of the period already used. Nothing in sections 8.10, 20 or 21 limits rights you have as a consumer that cannot be excluded.

9.1 Free Plan

The Free Plan has no trial period and no fixed end date, and needs no card. It continues until it is ended under section 19. It includes the features and limits shown on our pricing page. A User may own up to 3 Free Plan Workspaces unless we agree to more. Workspaces with Nigeria status (section 9.4) do not count towards that number. On the Free Plan, e-signature requests, AI messages and AI template imports are counted across all the Free Plan Workspaces a User owns, so creating more Workspaces does not give more allowance. We may change what the Free Plan includes by giving notice under section 24, and we may end or suspend Free Plan access under section 19.

9.2 Founding period

Every Workspace that exists on the day we launch Paid Plans receives a founding period: 6 calendar months of Pro features and limits, plus any Business feature that Workspace had already used. We email Owners when it starts and before it ends. When it ends, the Workspace moves to the Free Plan unless an Owner or admin has chosen a Paid Plan. If you buy a Paid Plan during the founding period, it applies from then, and any extra Business features from the founding period remain until the founding period ends. We may extend a founding period at our discretion, and may shorten it only to correct an error or in response to abuse, with notice to the Owners.

9.3 Complimentary plans

We may, in our discretion, give a Workspace Pro or Business at no charge, either until a stated date or without an end date (a "Complimentary Plan"). A Complimentary Plan is a courtesy. It is not a contract for a fixed term, and we may end it at any time, with immediate effect. When it ends, the Workspace returns to the plan it would otherwise have. Where a Complimentary Plan has an end date, we remind owners and admins 7 days before it ends. You cannot buy a Paid Plan while a Complimentary Plan is running. A Complimentary Plan has no cash value and cannot be transferred.

9.4 Nigeria pricing region

Nigeria status is for businesses based in Nigeria; we may review it and withdraw it with 30 days' notice.

• What it gives. A Workspace with Nigeria status gets every Bookmaker plan feature at no cost, with Business limits. It does not include AI Calling, which is a separate paid add-on charged in US dollars. Anti-abuse limits (section 10.4) still apply.
• How it is decided. Nigeria status belongs to a Workspace, not to a person. We decide eligibility using the country you declare and the country our network provider reports for sign-ins, together with other signals. A Workspace may start as "pending" until those checks are met; while pending, prices are hidden and it receives Free Plan or founding-period features. If a pending Workspace is not confirmed, we email the Owners after 30 days, and if nothing changes within a further 14 days its pending status ends and it moves to the plan it would otherwise have. It never moves to a paid plan by itself. A Workspace's country can be changed to Nigeria at most once in any 12 months; a repeated change opens a review.
• Existing paid plans. While a Workspace is pending, any Paid Plan continues and is billed as usual. When the Workspace is confirmed for Nigeria status, its Bookmaker plan subscription is cancelled at once and the unused part of the current period is refunded, up to the amount the latest payment can return. We refund any remainder by hand.
• Reviews and withdrawal. We may review Nigeria status at any time, for example if the country is changed away from Nigeria, if most of the Workspace's members appear to be outside Nigeria for a sustained period, if the country is changed repeatedly, or if an Owner asks. Reviews are decided by our staff. If we withdraw Nigeria status, we will give the Owners 30 days' notice before the change takes effect, after which the Workspace moves to the plan it would otherwise have, and paid features require a Paid Plan.
• Ending the programme. We may end or change Nigeria pricing for all Workspaces by giving Owners at least 30 days' notice. Nigeria status is not a commitment to provide the Service free of charge for any period.
• Abuse. Giving false information, using tools such as VPNs to appear to be in Nigeria, or otherwise misusing Nigeria status is a breach of these Terms. In that case we may, in addition to withdrawing the status, take action under section 19.

9.5 Our discretion

Free Plans, founding periods, Complimentary Plans and Nigeria status are offered at no charge. To the extent the law allows, our total liability in connection with them is limited to USD 100.

10.1 Plan limits

Each plan has limits, for example on custom templates, e-signature requests, e-signature storage, AI messages, AI template imports and daily email recipients. The current limits are shown on the pricing page, in the help centre and on the usage meters in the Service. Monthly limits reset at the start of each calendar month in UTC. On the Free Plan, the e-signature request allowance is a lifetime total, not monthly.

10.2 Fair use of "included" and "high volume" features

Where the pricing page describes a feature as "Included", "Unlimited", "High volume" or similar, it is provided for normal business use by the Workspace, and technical and fair-use ceilings still apply. We set those ceilings to protect the Service and other customers and may change them. If your use is unusually high we will contact you, and we may ask you to move to a different plan or agree a custom arrangement.

10.3 Reaching a limit

At 80% of some limits the Service shows a warning and may email owners and admins. At 100%, only new actions of the limited kind are refused until the limit resets or you change plan. Everything else keeps working. A signing that has already started can always be completed. Templates over the limit stay usable, but you cannot add new ones.

10.4 Anti-abuse limits

To prevent spam and abuse, all Workspaces, including those on Paid Plans and with Nigeria status, are subject to limits that are not plan features. These currently include daily caps on document email recipients, caps on manual payment reminders and e-signature reminders, a daily cap on team invitations, and short-term rate limits on AI and sending. We may change these limits at any time and may raise them for a Workspace on request.

10.5 Moving to the Free Plan

When a Workspace moves to the Free Plan (for example because a plan is cancelled or unpaid, or a founding or Complimentary Plan ends), nothing is deleted, except that:

• features that are not in the Free Plan pause. For example, recurring invoices, scheduled sends and automatic reminders stop, Connected Apps stop answering (their connections are kept), Signing AI stops, and Bookmaker branding returns to customer emails; and
• the semantic search index is deleted 90 days after the Workspace loses that feature. It can be rebuilt if the feature returns.

11.1 Emails sent for you

When you send a document, reminder, signature request or other message through the Service, it is sent from a Bookmaker sending address with your Workspace's email as the reply-to address. You are the sender of these messages for legal purposes. You must make sure that you are allowed to send each message to each recipient and that the message complies with applicable law, including anti-spam and electronic marketing laws such as the US CAN-SPAM Act, Canada's Anti-Spam Legislation and the UK and EU rules on electronic marketing. The Service is for business documents and related messages. Do not use it for marketing campaigns or newsletters.

11.2 Email reputation and suspension

Messages that bounce or are reported as spam harm delivery for every customer. We may automatically suspend email sending for a Workspace if, over its latest 500 sends, more than 0.3% are reported as spam or more than 5% hard-bounce. We email the Owners when this happens. Sending stays suspended until we review it and reinstate it. You can ask for a review at [email protected]. We may also suspend sending at any time if we reasonably believe it is being used for spam or abuse.

11.3 Public document links

When you share a document by link, anyone who has the link can open it, without signing in, until you revoke the link or set it to expire, or until the Workspace is disabled. Links do not expire unless you set an expiry. The Service records when a recipient first opens a shared document. You are responsible for who you give links to. Revoke a link if it may have reached the wrong person.

11.4 Brand images

Logos and other brand or signature images you upload may be served from a web address that does not require sign-in, so that they can appear in emails and shared documents. Anyone who has that address can view the image. Do not upload confidential material as a brand image.

12.1 What we provide

The Service lets you request, collect and apply electronic signatures on documents, including through the Sign module and on invoices and quotations. Bookmaker provides the technology. We are not a party to any document you or your End Recipients sign, and we do not verify anyone's identity beyond the methods the Service offers (such as a link sent to the signer's email and an optional access code).

12.2 Legal effect is your responsibility

Signatures made with the Service are intended to be simple electronic signatures under laws such as the US ESIGN Act, the Uniform Electronic Transactions Act and the EU eIDAS Regulation. We do not guarantee that an electronic signature made with the Service will be valid, binding or enforceable for any particular document, person or place. Some documents need a higher form of signature, witnesses, notarisation or a handwritten signature, or cannot be signed electronically at all. Examples include wills, many property deeds and some court and family documents. You are solely responsible for deciding whether an electronic signature is suitable and lawful for your document, and for obtaining any consent the law requires to do business electronically. If you are unsure, ask a lawyer.

12.3 Evidence we record

To support a signature, the Service records evidence such as each signer's name and email, the times of each step, the consent and disclosure text they accepted, their device information and a one-way fingerprint of their network address, and adds a certificate of completion to the signed PDF. You are responsible for telling signers about this where the law requires.

12.4 Templates and AI drafts

Ready-made agreement templates and AI-drafted agreements are starting points only. They are not legal advice, may not suit your situation or your jurisdiction, and must be reviewed before use, by a lawyer where appropriate.

12.5 Unsent drafts

An unsent e-signature draft that no one has opened or edited for 30 days may be deleted. We email its creator first, and delete it 7 days after that email unless someone opens or edits it.

12.6 End Recipients

People who view, accept, decline or sign documents through links you send may use the Service only for that purpose. The consent and disclosure text shown to them is presented on your behalf, and you are responsible for whether it is accurate and sufficient for your document and their location.

13.1 How AI Features work

AI Features use machine-learning models. Some run on infrastructure we control, and others are provided by third-party model providers, either directly or through an AI routing service such as OpenRouter. Which provider handles a request depends on the feature and on how it is set up. AI Features may be switched off, may have usage limits and depend on the availability of those providers.

13.2 What is sent to AI providers

When you use an AI Feature, the content needed for that feature is sent to its model provider. Depending on the feature, that can include your messages, the document you are working on, record summaries (if you switch on workspace lookup), document text (for semantic search), template descriptions and samples, and the text of documents you ask Signing AI to draft or summarise. Section 5 of our Privacy Policy describes what each feature sends and where it goes. For paid models, we ask OpenRouter to route the request only to providers that do not keep it or use it for training ("data collection: deny"). Free models may be served by providers that log requests or use them to improve their models.

13.3 Outputs may be wrong

AI output may be inaccurate, incomplete, out of date, biased or unsuitable, and the same request may give different results. You must review all AI output before you rely on it, send it or act on it. The assistant does not change or send anything until you confirm it. Searches and summaries are limited and are not a complete ledger or report. AI template design is not an exact reproduction of your sample. You are responsible for any output you use, and for any action you confirm.

13.4 No professional advice

Nothing in the Service, including AI output, templates, help centre content and reports, is legal, tax, accounting, financial or other professional advice. Get advice from a qualified professional before relying on it.

13.5 Output ownership

As between you and Celar, you own the output that AI Features generate for you, to the extent any rights exist in it. Output may be similar to output generated for others, and we give no assurance that it does not infringe third-party rights.

13.6 Connected Apps

Where available on your plan, you may authorise Connected Apps (for example AI assistants such as Claude, ChatGPT, Cursor or VS Code) to access your Workspace. A Connected App acts as the User who connected it, limited to that User's role and to the permissions the User approves on the consent screen. Data a Connected App reads leaves the Service and is handled by that app's provider under its own terms, and any actions it takes are treated as actions of that User. Connected Apps are Third-Party Services (section 15). We are not responsible for what they do with your data or for their actions. A User can revoke a connection at any time.

14.1 What AI Calling is

AI Calling lets you set up AI voice agents that answer calls, place calls to your leads and customers, transfer calls to people, book appointments, and send text messages, using a US phone number we provide. It is billed separately from Bookmaker plans, works with any Bookmaker plan, and is charged in US dollars everywhere, including for Workspaces with Nigeria status.

14.2 You are the caller

You, not Celar, are the caller, sender and initiator of every call and text made through your AI Calling account, including for the purposes of the Telephone Consumer Protection Act ("TCPA") and the Telemarketing Sales Rule. You decide who is called or texted, when, why and what your agents say. Celar provides the technology only.

14.3 Your compliance responsibilities

You are solely responsible for making sure that every call, text and recording made through your account complies with all applicable laws, regulations, carrier rules and industry standards. These include:

• Consent. The TCPA and the Federal Communications Commission's rules, including the FCC's February 2024 ruling that AI-generated voices are "artificial" voices under the TCPA. As a result, calls made with AI voices generally need the called party's prior express consent, and telemarketing calls generally need prior express written consent.
• Telemarketing rules. The FTC Telemarketing Sales Rule and state telemarketing laws, including state "mini-TCPA" laws, registration and bonding requirements, and rules on call frequency and calling hours.
• Do-Not-Call. The National Do Not Call Registry, state do-not-call lists and your own internal do-not-call list. Bookmaker does not check numbers against the National Do Not Call Registry or any state list. You must do so where the law requires.
• Caller ID. The Truth in Caller ID Act and similar laws. You must not mislead anyone about who is calling.
• AI disclosure. Federal and state laws on disclosing the use of AI and artificial voices.
• Call recording. Federal and state wiretap and call-recording laws, including the laws of states that require the consent of every party to a call. The Service plays a recording notice at the start of calls when recording is on, but you are responsible for making sure that your notice and consent process is enough for every call.
• Text messages. The TCPA, the CTIA Messaging Principles and Best Practices, and carrier requirements, including any brand and campaign registration (such as A2P 10DLC) that we or carriers require, and the message disclosures they require, such as HELP and STOP instructions and "Msg & data rates may apply". You must give accurate information for any such registration.
• Opt-outs. Honouring every opt-out and do-not-contact request, made by text, on a call or in any other reasonable way, promptly and permanently, and within the time the law requires (under current FCC rules, no later than 10 business days).
• Sector rules. Laws on debt collection (including the Fair Debt Collection Practices Act and state equivalents where they apply to you), healthcare, financial services, insurance and any other regulated activity.
• Privacy. Data Protection Laws for the personal data of the people you call and text.

You are responsible for the accuracy and lawfulness of the consent evidence you give us, including the number, the wording the person agreed to, when and how they agreed, and the source. We rely on it and do not verify it.

14.4 Our safeguards do not shift responsibility

The Service includes safeguards. For example, it plays an AI disclosure on every call that cannot be turned off, plays a recording notice when recording is on, calls only numbers that have permission evidence on file (or existing customers in campaigns you have specifically switched on), does not ring outside 8:00 a.m. to 9:00 p.m. in the recipient's local time or during your quiet hours, limits retries, honours STOP replies and lets you keep a do-not-contact list. These safeguards are tools to help you. They are not legal advice, they may not cover every law that applies to you, and they do not make your calls or texts lawful. You remain responsible for compliance even if a safeguard fails or is not enough.

14.5 Prohibited AI Calling uses

Unless we agree in writing, you must not use AI Calling:

• to call or text anyone without the consent the law requires;
• to call emergency numbers, or lines of hospitals, emergency services, or similar facilities;
• for third-party debt collection, political or election campaigning, or fundraising;
• to call or text anyone you know or should know is under 18;
• to impersonate any person, business or authority, or to mislead anyone about the use of AI;
• to collect payment card details, passwords or government identity numbers on a call;
• to send content about sex, hate, alcohol, firearms, tobacco, vaping or cannabis, or about high-risk financial services such as payday loans, debt relief or credit repair, or any other content that carriers or the CTIA prohibit; or
• for any use prohibited by section 5.

14.6 United States only

AI Calling works only with US phone numbers. Calls and texts to Canada, Caribbean countries that use +1 numbers, and US territories (Puerto Rico, the US Virgin Islands, Guam, the Northern Mariana Islands and American Samoa) are refused.

14.7 Phone numbers

Each AI Calling Plan includes the use of one US local number. Numbers are held by Celar or its carrier and are made available to you only while your AI Calling subscription is active. You do not own them. We may change or reclaim a number if required by a carrier or by law, or after your subscription ends. We do not promise that a number can be transferred (ported) to another provider.

14.8 What your agents say

AI agents can make mistakes. They may mishear, misunderstand, say something inaccurate, or fail to complete a task such as a booking or transfer. You are responsible for your agents' configuration, greetings, objectives and knowledge, and for everything your agents say on your behalf. Review transcripts and test your agents before using them with real callers. AI agents cannot issue invoices, record payments, write off or refund. Those actions remain with your team.

14.9 AI Calling providers

AI Calling relies on Third-Party Services, including a telephone carrier for calls and texts, speech recognition and speech synthesis providers, and AI language model providers. Live call audio and transcripts are processed by them to run the call. The Privacy Policy lists these providers.

14.10 Recordings and transcripts

Recording happens only when your agent has recording turned on and recording is available on the Service. Call recordings are kept for the shorter of your agent's retention setting and 30 days. Transcripts are kept for the shorter of your agent's retention setting and 90 days. After that they are deleted automatically. Download anything you need to keep before then. The Service automatically tries to redact payment card numbers, and by default identity numbers, from transcripts, but redaction is automated and may miss some data. The Service is not a record-keeping system for the Telemarketing Sales Rule or any other law. You are responsible for keeping any call records, scripts, consent records and recordings that the law requires you to keep, for as long as it requires.

14.11 AI Calling Plans and Fees

AI Calling Plans include a monthly allowance of AI minutes, a number of concurrent calls and one US local number. AI Calling prices are new and may change. The price shown in Checkout, and the price book in force when the usage occurs, apply.

• How AI time is counted. Each call's AI time is counted in whole seconds, and a fraction of a second is never charged. We add up the month's seconds, take off your plan's included seconds, and charge what is left, within the overage budget you set, at the overage rate in the current price book. The total is rounded once to the nearest cent, with half a cent rounding up. Calls that are not answered, and calls where the AI never connected, use no seconds. Silence, voicemail and calls the other person hangs up are counted as used.
• Overage budget. You set a monthly overage budget, from USD 0 to USD 10,000. It starts at USD 0, which means no overage: calls stop when the plan's minutes are used up. AI time beyond both your allowance and your budget that comes from calls already in progress is not charged.
• Extras. Transfers, the caller's line after a handoff, text messages, verification codes and recording are charged on top of your plan at the prices in the price book, from the same overage budget. When the budget is used up, agents do not transfer, text or record. You must accept each extra's price in the Service before you switch it on.
• Price book. Usage prices are set out in a dated price book shown in the Service. A published price book version is not edited. A price change creates a new version, which applies to usage from its effective date, after notice under section 8.14.
• Billing. The plan fee is charged in advance. Usage beyond the plan and extras are charged in arrears, at your next renewal. Prices are exclusive of tax.
• Plan changes. An upgrade is charged immediately at the prorated amount Stripe shows you, using any account credit first, and is refused if your card needs extra authentication or is declined. A downgrade takes effect at your next renewal and can be undone before then. In-app plan changes may not always be available; contact us if so.
• Cancellation. You can cancel through the Stripe Customer Portal. A cancelled AI Calling subscription keeps working until the end of the paid period. We do not refund the rest of the period.
• Failed payments. If an AI Calling payment fails, calling continues for 3 days from when the subscription became past due and then stops. An unpaid or paused subscription cannot make or answer calls.
• Test time. We may grant test time at our discretion. It can be used only for test calls to numbers an Owner has verified, has no cash value, and is lost if your subscription lapses.

14.12 Credits for platform failures

If a call's AI session fails because of a fault on our side, the Service automatically credits the AI seconds for that call. This automatic credit is your sole and exclusive remedy for calls that fail, drop or perform poorly because of the Service, to the extent the law allows.

14.13 Suspension of AI Calling

We may suspend or limit AI Calling for your Workspace immediately, including by ending calls that are in progress, if:

• we receive complaints, opt-out rates or carrier or regulator notices that suggest unlawful, unwanted or abusive calling or texting;
• a carrier, regulator or provider requires it;
• we reasonably believe you are breaching this section 14; or
• we cannot verify your consent evidence when we ask for it.

You must give us, within 5 business days of our request, evidence of consent for any call or text, and any other information we reasonably need to respond to a complaint, carrier inquiry or legal process.

14.14 Calling indemnity

In addition to section 22, you will defend, indemnify and hold harmless the Celar Parties (defined in section 21.1) from and against all claims, demands, investigations, fines, penalties, statutory damages, losses, liabilities, settlements, costs and expenses (including reasonable legal fees) arising out of or relating to calls, texts or recordings made through your account, including any claim under the TCPA, the Telemarketing Sales Rule, do-not-call laws, call-recording laws, AI disclosure laws or Data Protection Laws, any inaccurate consent evidence, and any carrier fees or penalties caused by your use. This obligation is not subject to the limits in section 21. The procedure in section 22 applies to this section.

14.15 No emergency calls

AI Calling is not a general telephone service and cannot be used to call 911 or any other emergency number. AI agents cannot connect callers to emergency services. You must make sure that callers have other ways to reach emergency services and must not present AI Calling as a way to do so.

15.1 Services we rely on

The Service uses Third-Party Services, such as Stripe for payments, Google for sign-in, email delivery providers, cloud hosting and network providers, telephone carriers and AI model providers. The Privacy Policy lists the main ones. Their availability may affect the Service, and some of their terms apply to you directly, for example:

• Stripe's terms and privacy policy for payments, and Stripe's buyer terms where Stripe is the seller of record; and
• Google's terms and privacy policy if you sign in with Google or connect Google Calendar.

15.2 Services you choose to connect

If you connect a Third-Party Service, such as a Connected App, Google Calendar, HubSpot or a webhook endpoint, you authorise us to exchange data with it as needed for the connection. Your use of it is governed by your agreement with its provider. We do not control it and are not responsible for it, for its handling of your data, or for any change or interruption in its availability. Third-Party Services you choose to connect are not our Sub-processors.

16.1 Our rights

Celar and its licensors own all rights, title and interest in the Service, including its software, design, templates, help centre content, trademarks and the name "Bookmaker", and all improvements to them. These Terms do not transfer any of those rights to you. All rights not expressly granted are reserved.

16.2 Feedback

If you give us suggestions, ideas or feedback about the Service, we may use them for any purpose without restriction or payment to you. Feedback does not include Customer Data.

16.3 Your brand

You allow us to show your Workspace's name and logo inside the Service and on documents and emails you send through it. We will not use your name or logo in our marketing without your permission.

16.4 Copyright complaints

We respond to notices of alleged copyright infringement under the US Digital Millennium Copyright Act. If you believe content in the Service infringes your copyright, send a notice that includes the information listed in 17 U.S.C. § 512(c)(3) to our designated agent:

Copyright Agent, Celar Technologies LLC9691 Linden Ln N, Brooklyn Park, MN 55443, United StatesEmail: [email protected]

We may remove or disable access to content. If we do, we will tell the User who posted it, who may send a counter-notice under 17 U.S.C. § 512(g). We terminate the accounts of repeat infringers in appropriate circumstances.

17.1 What is confidential

"Confidential Information" means non-public information that one party (the "discloser") gives to the other (the "recipient") in connection with the Service that is marked as confidential or that a reasonable person would understand to be confidential. Your Customer Data is your Confidential Information. Non-public details of the Service, our security measures and our pricing offered only to you are our Confidential Information.

It does not include information that is or becomes public without the recipient's fault, that the recipient already knew or independently developed, or that the recipient lawfully received from someone else without a duty of confidence.

17.2 Duties

The recipient will use the discloser's Confidential Information only to perform or exercise its rights under these Terms, protect it with at least reasonable care, and disclose it only to its employees, contractors, advisers and Sub-processors who need to know it and are bound by duties of confidence at least as protective as these. The recipient may disclose Confidential Information when required by law or by a court or authority, after giving the discloser prompt notice where the law allows.

18.1 Support

We provide support through the help centre, and by email at [email protected] for Paid Plans, with priority for Business. We aim to respond within a reasonable time but do not promise any response or resolution time. We do not offer a service level agreement or an uptime commitment unless we sign one with you.

18.2 Our access to your Workspace

Our Operators may access your Workspace and Customer Data only as needed to provide support you ask for, keep the Service and its users secure, investigate suspected breaches of these Terms or fraud, fix faults, or comply with the law. When we provide support inside your Workspace, an Operator may open a time-limited support session acting as one of your members, with that member's permissions. Each support session requires a recorded reason, ends after 30 minutes, is logged by us, and cannot download documents, export data, reset passwords, change billing, use the assistant, or launch calls or campaigns. Changes made in a support session appear in your activity log under the member concerned. A support session cannot accept these Terms or acknowledge the Privacy Policy on the member's behalf.

19.1 Termination by you

You may stop using the Service at any time. To end a Paid Plan or AI Calling Plan, cancel it as described in section 8.8 or 14.11. To close a Workspace and delete its data, follow section 7.3.

19.2 Suspension by us

We may suspend or limit all or part of the Service for a Workspace or User, without notice where reasonably necessary, if:

• you breach these Terms, including section 5, 11 or 14, or we reasonably suspect that you have;
• your use poses a security risk to the Service or others, or may expose Celar or others to liability;
• Fees are overdue;
• a payment is disputed or flagged as fraudulent;
• we are required to do so by law, a court, a regulator, a carrier or a payment provider; or
• an account appears to be compromised.

We will try to give notice and the chance to fix the issue where it is reasonable to do so, and we will lift the suspension when we are reasonably satisfied that the reason for it no longer applies. Fees continue to apply during a suspension caused by your breach or non-payment. Suspension of a Workspace can end sessions, block sign-in, make shared document links stop working, stop email sending and stop AI Calling, including calls in progress.

19.3 Termination by us

We may terminate these Terms for a Workspace or User, or close a Workspace:

• immediately by notice if you materially breach these Terms and the breach cannot be fixed, or you do not fix it within 15 days of our notice;
• immediately if required by law or by a payment or telephone provider, or if you become subject to sanctions (section 26);
• immediately if you become insolvent, enter bankruptcy or a similar process, or stop doing business;
• on 30 days' notice, for a Workspace that has no active paid subscription (including Workspaces on the Free Plan, with Nigeria status, or in a founding period or Complimentary Plan), if we stop offering that plan or programme, if the Workspace has been inactive for 12 months or more, or for any other reason we reasonably consider necessary to protect the Service or to comply with the law; during that notice period you can still export your records; or
• on 30 days' notice, for a Paid Plan or AI Calling Plan, if we stop offering the Service or that plan.

19.4 Effects of termination

When these Terms end for a Workspace:

• your right to use the Service for that Workspace ends;
• all Fees due up to the end date become payable at once;
• section 7.5 applies to your Customer Data; and
• we may disable the Workspace and, after the period in section 7.5, delete its Customer Data.

19.5 Refunds on termination

If we terminate a Paid Plan or AI Calling Plan under the last item in section 19.3, we will refund prepaid Fees for the unused part of the period. If we terminate because of your breach, no refund is due, and you must pay any Fees that remain owed.

20.1 Mutual promises

Each party confirms that it has the power to enter into these Terms. You confirm that you have all rights, consents and notices needed for us to process Customer Data as these Terms describe.

20.2 Disclaimer

To the fullest extent the law allows, the Service, AI Features, AI Calling, templates and all content are provided "as is" and "as available". Celar disclaims all warranties and conditions, whether express, implied or statutory, including warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy and quiet enjoyment, and any warranty arising from course of dealing or usage of trade. We do not promise that the Service will be uninterrupted, error-free, secure or free from harmful components, that data will not be lost, that defects will be corrected, that AI output will be accurate, that emails or texts will be delivered, that calls will connect, or that the Service will meet your requirements or help you comply with any law.

20.3 Your legal and tax compliance

You are responsible for your own compliance with the laws that apply to your business, including tax, invoicing, record-keeping, consumer protection, privacy, e-signature and telemarketing laws. Calculations, tax settings and reports in the Service depend on the settings and data you enter, and you must check them.

20.4 Payments between you and your customers

Bookmaker does not process, hold or transfer payments between you and your customers. Payments recorded in the Service are records you enter. You are responsible for the payment instructions shown on your documents and for checking them, and we are not liable for any payment sent to wrong or fraudulent details, including details changed by someone using a User's credentials.

21.1 Excluded losses

To the fullest extent the law allows, neither Celar nor its affiliates, members, managers, officers, employees, agents, licensors or suppliers (together, the "Celar Parties") will be liable to you, whether in contract, tort (including negligence), strict liability, breach of statutory duty or otherwise, for any:

• loss of profits, revenue, business, contracts, goodwill or anticipated savings;
• loss or corruption of data, or the cost of recovering or recreating it;
• cost of substitute goods or services;
• fines, penalties or statutory damages imposed on you; or
• indirect, incidental, special, consequential, exemplary or punitive loss or damage,

even if we were told it was possible.

21.2 Cap

To the fullest extent the law allows, the Celar Parties' total aggregate liability arising out of or relating to these Terms and the Service is limited to the greater of (a) the Fees paid by you for the Service in the 12 months before the event that gave rise to the most recent claim, including Fees paid to Stripe as seller of record, and (b) USD 100.

21.3 What these limits do not cover

Nothing in these Terms excludes or limits:

• liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited by law;
• your obligation to pay Fees; or
• your liability under sections 5, 14.14 or 22, or for breach of section 16.1.

21.4 Basis of the bargain

These limits are an essential part of the bargain between us and reflect the prices we charge. They apply even if a limited remedy fails of its essential purpose.

21.5 Time limit for claims

To the extent the law allows, any claim by either party arising out of or relating to these Terms or the Service must be brought within one year after the claiming party knew or should have known of it, or it is permanently barred. This does not apply to claims for unpaid Fees, claims under section 14.14 or 22, or claims for breach of section 5, 16 or 17.

25.1 Governing law

These Terms, and any dispute or claim arising out of or relating to them or the Service, including non-contractual disputes, are governed by the laws of the State of Minnesota, United States, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

25.2 Courts

The state and federal courts located in Hennepin County, Minnesota, have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service, and each party submits to their personal jurisdiction and venue. These Terms do not contain an agreement to arbitrate. Either party may, however, ask any competent court for urgent interim relief to protect its intellectual property or Confidential Information.

25.3 Mandatory protections

If a law that applies to you gives you protections that cannot be excluded by agreement, including the right to bring proceedings in the courts of the country where you are based, nothing in these Terms takes those protections away.

25.4 Talk to us first

Before starting proceedings, please contact us at [email protected] so that we can try to resolve the issue informally.

27.1 Assignment

You may not assign or transfer these Terms, or any rights under them, without our prior written consent. We may assign or transfer these Terms to an affiliate, or in connection with a merger, acquisition, reorganisation or sale of all or part of our business, by giving you notice.

27.2 Notices

We may give you notices by email to the email address of an Owner or the User concerned, or in the Service. Email notices are given when sent. You are responsible for keeping Owner email addresses current. You may give us notices by email to [email protected]. Notices of breach, termination or legal claims must also be sent by post or courier to Celar Technologies LLC, 9691 Linden Ln N, Brooklyn Park, MN 55443, United States, and are given when received.

27.3 Entire agreement

These Terms, including Annex A and any document they expressly refer to as part of them, are the entire agreement between you and Celar about the Service. They replace all earlier agreements and understandings on that subject. Any purchase order or other terms you send us do not apply, even if we accept or sign them, unless we expressly agree in a written agreement signed by both parties.

27.4 Severability

If a court finds any part of these Terms unenforceable, that part will be enforced to the maximum extent allowed, and the rest of these Terms will remain in force.

27.5 No waiver

If we do not enforce a right or a provision of these Terms, or delay doing so, that is not a waiver of it.

27.6 Survival

Sections 2, 5.2, 6, 7, 8 and 14.11 (for Fees and usage charges incurred before termination), 9.5, 11.1, 12.2, 12.3, 12.6, 13.3 to 13.5, 14.2, 14.3, 14.13 (last paragraph), 14.14, 16, 17, 19.4, 19.5, 20, 21, 22, 25, 26, 27 and 28, and Annex A for as long as we hold Customer Personal Data, survive the end of these Terms, together with any other provision that by its nature should survive.

27.7 Order of precedence

If there is a conflict, this order applies, with the first taking priority:

1. a written agreement or order form signed by both Celar and you that expressly overrides these Terms;
2. Annex A, for the processing of Customer Personal Data;
3. the rest of these Terms.

The Privacy Policy, the pricing page and the help centre are not part of this contract, except where these Terms expressly incorporate a specific part of them.

27.8 Relationship

The parties are independent contractors. These Terms do not create a partnership, joint venture, agency or employment relationship.

27.9 No third-party beneficiaries

No one other than you and Celar has any right to enforce these Terms, except that the Celar Parties may rely on sections 14.14, 21 and 22.

27.10 Electronic communications and language

You agree to receive communications from us electronically and that our electronic notices and agreements satisfy any legal requirement that they be in writing. These Terms are written in English. Any translation is for convenience only, and the English version prevails.

A1. Roles

You are the controller of Customer Personal Data, or a processor acting for your own clients, in which case you confirm that your instructions and this Annex are authorised by them. We are your processor, or sub-processor. Under the CCPA and other US state privacy laws, we are your "service provider" or "processor".

A2. Details of the processing

A3. Instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits it. Your instructions are these Terms, your and your Users' use and configuration of the Service (including the features, AI Features, integrations and Connected Apps you choose to use), and any other written instructions we agree. You also instruct us to create aggregated or de-identified data from Customer Personal Data as described in section 6.3. We will tell you if we believe an instruction breaks Data Protection Laws, and we may then stop the processing concerned.

A4. Confidentiality of personnel

We ensure that the people we authorise to process Customer Personal Data are bound by duties of confidentiality and access it only as needed for the purposes in A2.

A5. Security

We implement technical and organisational measures appropriate to the risk, taking into account Article 32 GDPR. They currently include:

• encryption of connections to the Service in transit (HTTPS/TLS);
• passwords stored only as salted, slow hashes, and sign-in, reset, invitation, session and access tokens stored only as one-way hashes;
• encryption of selected sensitive secrets, such as two-factor authentication secrets and integration tokens;
• optional two-factor authentication for Users, and mandatory two-factor authentication for Operators;
• role-based permissions within Workspaces;
• sign-in lockouts and rate limits on sensitive actions;
• logical separation of Workspaces' data in the application;
• audit logging of changes and of Operator actions, with network addresses stored as keyed hashes or shortened prefixes in most logs;
• limits on support sessions (section 18.2); and
• filtering of passwords, tokens, keys and fields holding financial account and identity numbers from our error and system logs.

We may change these measures as long as the overall level of protection is not materially reduced.

A6. Sub-processors

You give us general authorisation to engage Sub-processors. The current list is in the Privacy Policy. Before we add or replace a Sub-processor, we will update that list and tell the Owners by email or in the Service at least 14 days in advance, except where an urgent change is needed for security or to keep the Service running, in which case we will tell you as soon as we can. You may object on reasonable data protection grounds by emailing [email protected] within that period. We will discuss the objection with you in good faith. If we cannot resolve it, you may terminate the affected Paid Plan or AI Calling Plan by notice, and we will refund prepaid Fees for the unused part of the period. We will enter into a written agreement with each Sub-processor that imposes data protection obligations which provide at least the same level of protection for Customer Personal Data as this Annex, to the extent applicable to the services it provides. We remain fully liable to you for each Sub-processor's performance of those obligations, as required by Data Protection Laws.

Third-Party Services that you choose to connect, such as Connected Apps, your own Google Calendar or HubSpot account, and webhook endpoints you add, are not our Sub-processors.

A7. Assisting with data subject requests

Taking into account the nature of the processing, we will help you, by appropriate measures where possible, to respond to requests from data subjects to exercise their rights. Many requests can be handled with the Service's own tools, such as editing, archiving and exporting records. If a data subject contacts us directly about Customer Personal Data, we will pass the request to you where we can identify you, and we will not respond ourselves except to direct them to you, unless the law requires otherwise. We may charge a reasonable fee for help that goes beyond the Service's own tools.

A8. Other assistance

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments, prior consultations with supervisory authorities, and your security obligations, in each case to the extent required by Data Protection Laws.

A9. Personal data breaches

We will notify you without undue delay after we become aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own obligations, as it becomes available, and take reasonable steps to contain and remedy the breach. Notice is sent to Owner email addresses. Our notice is not an admission of fault or liability.

A10. Deletion and return

You can export Customer Personal Data with the Service's tools while your Workspace is active and for the period in section 7.5. When the Terms end, or when you ask us in writing to delete a Workspace, we will delete Customer Personal Data from the live Service within a reasonable time, as described in section 7.3. We may keep copies that the law requires us to keep, and copies in logs or backups until they are deleted or overwritten in the normal course (section 7.4). Those copies remain protected by this Annex and are not processed for any other purpose.

A11. Audits

On written request, no more than once in any 12 months (or more often if a supervisory authority requires it or after a personal data breach), we will make available the information reasonably necessary to demonstrate compliance with this Annex. This may include written answers to a reasonable security questionnaire and relevant documentation. If that information is not enough to meet a requirement of Data Protection Laws, you may carry out, or appoint an independent auditor bound by confidentiality to carry out, an audit, with at least 30 days' notice, during normal business hours, without disrupting our operations or accessing other customers' data, and at your cost.

A12. International transfers

Celar is based in the United States, and we and our Sub-processors may process Customer Personal Data in the United States and other countries. Where Data Protection Laws require a transfer mechanism for a transfer of Customer Personal Data to us:

• EEA. The Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this Annex by reference: Module Two where you are a controller and Module Three where you are a processor. Clause 7 (docking clause) does not apply. Under Clause 9, option 2 (general written authorisation) applies, with the notice period in A6. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the SCCs are governed by the law of, and disputes are resolved by the courts of, Ireland. Annex I of the SCCs is completed with the details in A2, with you as data exporter and Celar as data importer, and Annex II with the measures in A5. The competent supervisory authority is the one determined under Clause 13.
• United Kingdom. The International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner applies, and the SCCs are read as amended by it. Table 4 is completed by allowing both parties to end it.
• Switzerland. The SCCs apply with the changes needed for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent authority where it applies.
• Nigeria and other countries. We will co-operate with you to put in place any safeguard reasonably required by the NDPA or other applicable Data Protection Laws for the transfer.

If the SCCs conflict with the Terms, the SCCs prevail for the transfers they cover.

A13. US state privacy laws

Where we act as your service provider or processor under the CCPA or similar US state laws, we will not: sell or share Customer Personal Data (as those words are defined in those laws); retain, use or disclose it for any purpose other than the business purposes set out in these Terms, or outside our direct business relationship with you, except as those laws permit; or combine it with personal data we receive from others, except as those laws permit. We will comply with the obligations that those laws place on service providers and tell you if we can no longer meet them. You may take reasonable steps to stop and remedy any unauthorised use of Customer Personal Data. We certify that we understand and will comply with these restrictions.

A14. Liability

Each party's liability under this Annex is subject to section 21, except where Data Protection Laws or the SCCs do not allow it to be limited.