Master Services Agreement

1. Introduction

1.1 Agreement Structure

This Master Services Agreement (“Agreement”) governs Customer’s access to and use of the Clasp platform and related services. This Agreement is entered into by and between Clasp Legal Technologies, Inc. (“Clasp”) and the entity identified in the applicable Order Form or, if there is no Order Form, the firm or other entity on whose behalf an account for the Service is created (“Customer”). The Agreement becomes effective on the earlier of the date an Order Form is executed by both parties or the date Customer first accepts this Agreement through the Service (the “Effective Date”). The individual who accepts this Agreement on Customer’s behalf represents that they are authorized to bind Customer.

The Order Form (including any Promotional Rate Amendment), this Agreement, the Data Processing Addendum (“DPA”), and the Appendices listed below form the complete contract between the parties. The Appendices are limited to Appendix A (Service Description), Appendix B (Security Baseline), Appendix E (Support & SLAs), and Appendix H (Subprocessors). No other appendices form part of this Agreement. If there is a conflict, the following order of precedence applies:

(1) the Order Form, including any Promotional Rate Amendment,

(2) the DPA, as to personal data in Customer Data,

(3) this Agreement, and

(4) the Appendices.

This Agreement is designed to provide a clear, scalable legal framework for Customer’s use of the Clasp platform, including payment-based pricing, integrations, AI-assisted features, and data handling.

1.2 Definitions

For purposes of this Agreement, the following terms have the meanings set out below. Additional defined terms may appear in context.

“Account Data” Names, email addresses, authentication information, billing contacts, and other information about Customer and its Users that is needed to create, secure, bill, and maintain accounts.

“Affiliate” Any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

“AI-Assisted Functionality” Internal components that operate on metadata, embeddings, or derived representations of Customer Data to support search relevance, document organization, workflow efficiency, and draft time-entry suggestions, including the optional Time Capture feature. AI-Assisted Functionality does not access document text and does not perform automated decision-making. Except for the optional Time Capture feature described in Section 5.3(d), AI-Assisted Functionality does not transmit Customer Data to external large language models.

“Beta Features” Features identified as beta, early access, preview, or similar designations, which may be incomplete or subject to change.

“Client Payment” A card or ACH payment that a client or other payor makes to Customer through the Service using a Payment Processor. Disbursements and payments recorded in the Service but made outside it (such as by check or cash) are not Client Payments.

“Confidential Information” Non-public information disclosed by one party to the other that is designated as confidential or that reasonably should be understood to be confidential.

“Connector” Has the meaning given in Section 7.7.

“Customer Data” Data, content, documents, or information submitted to or processed by the Service on behalf of Customer.

“Documentation” User guides, technical documentation, and other materials provided by Clasp describing the Service.

“Firm Verification” Clasp’s process for verifying Customer’s identity and eligibility to use the Service, including onboarding with the Payment Processor, as described in Section 16.7.

“Order Form” A document executed by the parties that specifies any custom or promotional pricing or rates and any Customer-specific terms, including a promotional rate amendment signed by the parties (a “Promotional Rate Amendment”). An Order Form is not required to use the Service.

“Payment Fees” Has the meaning given in Section 4.1.

“Payment Processor” Has the meaning given in Section 2.10.

“Security Baseline” Clasp’s technical and organizational security measures, as described in Appendix B.

“Service” Clasp’s cloud-based legal operations and document management platform, including AI-Assisted Functionality, billing and trust accounting tools, messaging, integrations, and related functionality, as described in Appendix A.

“Subprocessor” A third party engaged by Clasp to process Customer Data in connection with the Service.

“Subscription Plan” The plan under which Customer accesses the Service. Unless an Order Form states otherwise, the Subscription Plan is Clasp’s standard plan, under which the Service is provided without subscription or per-User fees and Clasp is compensated through Payment Fees.

“Subscription Term” Each successive one-month period, beginning on the Effective Date, during which Customer’s account is active and Customer is authorized to access and use the Service, unless an Order Form specifies a different period.

“Time Capture” The optional module of the Service that generates draft time-entry descriptions, as further described in Section 5.3(d) and Appendix A.

“Usage Data” Metadata, system logs, timestamps, and information about interactions with the Service.

“User” An individual authorized by Customer to access and use the Service under Customer’s account.

2. Services Provided

2.1 Description of the Service

Clasp provides a cloud-based legal operations and document management platform designed to support workflow automation, document handling, matter organization, and related functionality (the “Service”). The Service includes only the features and functionality made available by Clasp as of the Effective Date or as otherwise expressly stated in an Order Form. The Service does not include any future features, modules, or performance enhancements unless separately purchased or expressly agreed in writing.

2.2 Access Rights

Subject to Customer’s compliance with this Agreement and payment of all applicable fees, Clasp grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Service during the Subscription Term, solely for Customer’s internal business purposes.

2.3 Users

Customer may authorize any number of Users, subject to the Acceptable Use Policy and any limits stated in the Service or an Order Form. Customer is responsible for each User’s compliance with this Agreement and for all activity under its Users’ accounts.

2.4 Usage Restrictions

Customer and its Users may not:

(a) copy, modify, or create derivative works of the Service;

(b) reverse engineer, decompile, or attempt to extract source code;

(c) access the Service to build a competitive product;

(d) interfere with or disrupt the Service;

(e) use the Service in violation of the Acceptable Use Policy; or

(f) use the Service to provide legal advice, create attorney-client relationships, or engage in the unauthorized practice of law.

For clarity, the Service does not perform legal analysis, generate legal advice, or replace professional judgment.

2.5 Service Modifications

Clasp may enhance, update, or modify the Service from time to time. Modifications will not materially reduce the core functionality of the Service during the Subscription Term. Customer acknowledges that any descriptions of future functionality, public statements, presentations, roadmap materials, or discussions regarding potential enhancements to the Service are for informational purposes only and do not constitute a commitment by Clasp to deliver any feature, functionality, integration, performance level, or architectural change.

2.6 Third-Party Integrations

The Service may interoperate with third-party applications, platforms, or services, including cloud storage, email, calendar, accounting, video-meeting, document-editing, payment, and AI services, and any Connected AI Service (“Third-Party Services”). Customer’s use of Third-Party Services is governed solely by those providers’ terms. Clasp is not responsible for the availability, performance, configuration, security, or changes to any Third-Party Services, nor for any interruption, delay, data loss, or failure of the Service caused by Third-Party Services, Customer-managed integrations, or Customer’s configuration of those services.

2.7 Beta Features

Clasp may make certain features available as Beta Features. Beta Features are provided “as is”, without warranties, service levels, or commitments, and may be modified or discontinued at any time. Clasp has no obligation to release any Beta Feature as generally available functionality. Customer grants Clasp a non-exclusive, royalty-free license to use feedback related to Beta Features to improve the Service.

2.8 Encryption Architecture

The Service includes encryption of Customer Data at rest. Additional details regarding encryption controls are described in Section 5 (Data & Security).

2.9 Service Availability

Clasp will use commercially reasonable efforts to make the Service available in accordance with the support and service level commitments described in Appendix E (Support & SLAs). These commitments do not apply to Beta Features or to downtime resulting from Third-Party Services, scheduled maintenance, or circumstances described in Section 17.10 (Force Majeure).

2.10 Billing, Payment, and Trust Accounting Features

(a) Record-keeping tools. The Service includes tools for time and expense tracking, invoicing, payment recording, and the recording and tracking of client trust account activity (together, the “Billing and Trust Features”). The Billing and Trust Features are record-keeping and workflow tools only. They are not legal, accounting, tax, or financial advice.

(b) Customer responsibility. Customer is solely responsible for its compliance with all laws, court rules, and rules of professional conduct governing client funds and trust accounts, including trust account (such as IOLTA) requirements, account reconciliation, recordkeeping, the timing and accuracy of deposits, disbursements, and earned-fee transfers, and the accuracy of all information entered into or imported into the Service. Customer is responsible for reviewing all balances, ledgers, reports, and calculations produced by the Service and for reconciling them with its bank and Payment Processor records. Clasp does not represent or warrant that the Service, any Payment Processor, or Customer’s configuration complies with IOLTA requirements, trust accounting rules, or the rules of any bar, court, or other authority in any jurisdiction. Customer must independently ensure that its accounting and payment practices meet the requirements of each jurisdiction in which it practices.

(c) No fiduciary or financial institution role. Clasp is not a bank, financial institution, trustee, escrow agent, fiduciary, or custodian of Customer’s or Customer’s clients’ funds, and is not Customer’s accountant, tax advisor, or legal advisor.

(d) Payment Processors. Payments may be processed through third-party payment processors, such as Confido (each, a “Payment Processor”). Customer’s use of a Payment Processor is governed by that Payment Processor’s terms. Customer is responsible for Payment Processor onboarding and approval, fees (including Payment Fees under Section 4), chargebacks, refunds, disputes, holds, reserves, payout timing, and tax reporting. Clasp does not store full payment card numbers. Clasp is not liable for any act, omission, delay, or failure of a Payment Processor or financial institution.

(e) Reversals and corrections. Payment reversals, refunds, and corrections are recorded in accordance with the Service’s accounting rules, including the locking of closed accounting periods. Customer is responsible for resolving any resulting differences between Customer’s records and its bank or Payment Processor records.

(f) Accounting integrations. Integrations with third-party accounting platforms, such as QuickBooks Online, are Third-Party Services governed by Section 2.6.

2.11 Messaging

The Service may allow Customer and its Users to send text (SMS) messages through a third-party messaging provider and to exchange messages through in-application and client portal messaging. Customer determines what information it and its Users share through messaging features. Customer is solely responsible for (a) obtaining and maintaining all consents and opt-outs required for messaging under applicable law and carrier rules, including the Telephone Consumer Protection Act; (b) the content of all messages; and (c) completing any carrier, brand, or campaign registration required for messaging. Clasp is not responsible for carrier filtering, blocking, delay, or non-delivery of messages.

2.12 Data Migration

Clasp does not perform, manage, or participate in data migrations. If Customer wishes to migrate data from another system, Customer may engage the independent third-party migration partner that Clasp may make available or refer, or another provider of Customer’s choosing. Any migration is performed under separate terms between Customer and the migration provider. Clasp is not a party to those terms and is not responsible for any migration, including the accuracy, completeness, loss, timing, or compatibility of migrated data, or for any act or omission of a migration provider. Customer is responsible for confirming that it has the right to export and migrate its data and that doing so complies with the terms of the source system.

2.13 Portal Users

Customer’s clients, third parties, and other people Customer invites to use the client portal, payment, or e-signature features (“Portal Users”) use those features under Clasp’s Portal and E-Signature Terms of Use. Users who sign documents through the Service remain governed by this Agreement. Portal Users are not Users or parties to this Agreement. Customer is responsible for its relationship with Portal Users, including its legal services, communications, and payments, and for the instructions it gives Clasp regarding their data.

3. Customer Obligations

3.1 Account Management

Customer is responsible for maintaining the confidentiality of its account credentials and for all activities occurring under its accounts. Customer will ensure that only authorized Users access the Service. Customer will maintain at least one Super Admin with a current, regularly monitored email address and will keep the email addresses of its Super Admins and Admins current.

3.2 Acceptable Use

Customer and its Users must comply with the Acceptable Use Policy (“AUP”). A violation of the AUP constitutes a material breach of this Agreement.

3.3 Cooperation

Customer will provide reasonable cooperation, information, and access necessary for Clasp to provide the Service, including configuration details and permissions required to enable integrations.

3.4 Customer Data Responsibility

Customer is solely responsible for the accuracy, quality, legality, and use of Customer Data, including obtaining all rights and consents necessary for Clasp to process Customer Data in accordance with this Agreement.

3.5 Third-Party Accounts

Customer is responsible for maintaining any accounts required to use Third-Party Services and for complying with the terms governing those services. Clasp is not responsible for any unavailability or modification of Third-Party Services.

3.6 Prohibited and Restricted Data

(a) Prohibited data. Unless expressly agreed in writing and legally permissible, Customer will not submit to the Service (i) protected health information that Customer creates, receives, or maintains as a business associate under HIPAA; (ii) payment card data subject to PCI-DSS, other than card details entered directly into a Payment Processor’s hosted payment fields; or (iii) other data subject to heightened regulatory protections that the Service is not designed to handle, such as biometric identifiers or export-controlled data.

(b) Minors’ data and other sensitive personal information. The Service is not designed to store or process data relating to minors (including data subject to the Children’s Online Privacy Protection Act or similar laws), Social Security numbers, health or medical information, or other sensitive personal information, and Clasp does not represent or warrant that the Service complies with any law that applies to such data. Customer may submit such data where it is contained in, or reasonably incidental to, legitimate legal matter materials, but does so at its sole risk and responsibility. Customer is solely responsible for determining that submission is lawful, for obtaining any required consents, and for any resulting claim, obligation, or liability.

(c) No monitoring. Clasp has no obligation to monitor Customer Data for prohibited or restricted content.

(d) Practice-area labels. Practice-area labels and similar settings in the Service (such as “Personal Injury”) are organizational labels only. They do not change how the Service processes or protects data and do not indicate that the Service is suitable for any regulated data.

3.7 Compliance with Laws

Customer is responsible for ensuring that its use of the Service complies with all applicable laws, regulations, and professional obligations, including those governing legal practice, data privacy, and client confidentiality.

3.8 Customer Representations

Customer represents and warrants that:

(a) it has all rights necessary to submit Customer Data to the Service;

(b) Customer Data does not violate any law or third-party rights;

(c) it will not use the Service to provide legal advice, create attorney-client relationships, or engage in the unauthorized practice of law; and

(d) it will maintain appropriate administrative, physical, and technical safeguards for its own systems and credentials.

3.9 Security Responsibilities

Customer is responsible for securing its own systems, devices, and networks used to access the Service. Customer will promptly notify Clasp of any actual or suspected unauthorized access to its accounts or Customer Data.

3.10 Encryption Credentials

If Customer elects to use features requiring Customer-managed encryption keys or credentials, Customer is solely responsible for managing, storing, and safeguarding such keys. Clasp is not responsible for any inability to access Customer Data resulting from lost, corrupted, or mismanaged encryption credentials.

3.11 Third-Party Services and Connectors

Customer is solely responsible for its selection, configuration, and use of Third-Party Services and Connectors, including the permissions, scopes, and data it makes available to them.

4. Fees & Payment Terms

4.1 Fees

Access to the Service under the standard Subscription Plan is provided without subscription or per-User fees. Clasp is compensated through fees charged on each Client Payment and disbursement processed through the Service (“Payment Fees”), at Clasp’s standard rates presented in the Service, unless promotional or custom rates are agreed in an Order Form, such as a Promotional Rate Amendment. Clasp sets its standard rates in its discretion. Payment Fees include the Payment Processor’s processing fee and a platform fee retained by Clasp. Payment Fees are charges for payment processing and related platform services, calculated per transaction based on payment type and amount. They are not a share of, or contingent on, Customer’s legal fees, and Clasp does not refer clients or matters to Customer.

4.2 Billing & Invoicing

Customer authorizes the Payment Processor to calculate and collect Payment Fees from Customer’s designated operating account and to remit Clasp’s platform fee to Clasp. Client Payments are processed by a Payment Processor designed for law firms, which collects Payment Fees separately rather than deducting them from Client Payments. Payment Fees are not collected from any client trust account. Customer is responsible for designating and maintaining an operating account for this purpose and for confirming that its Payment Processor configuration complies with Section 2.10(b). Clasp does not process refunds. Customer may return funds to its clients through the Payment Processor, but Payment Fees are earned and final when the applicable Client Payment or disbursement is processed, and Clasp does not refund them, including when a Client Payment is later refunded, reversed, or disputed. Any adjustment to processing fees in those cases is made solely by the Payment Processor under its terms. Any other fees are billed as stated in the Service or an Order Form and are due upon receipt.

4.3 Optional Paid Features

Clasp may offer optional paid features, plans, or add-ons. Fees for those features apply only if Customer elects them through the Service or an Order Form, and are billed as stated at the time of election.

4.4 Usage-Based Billing (Future Features)

Certain AI-assisted features may be subject to usage-based billing once made generally available. Usage-based fees will apply only if expressly stated in the Order Form or in an updated pricing schedule provided to Customer with advance notice.

4.5 Taxes

Fees do not include taxes. Customer is responsible for all applicable taxes, excluding taxes based on Clasp’s income.

4.6 No Refunds

Except as required by law, all fees are non-cancelable and non-refundable. This includes Payment Fees, as described in Section 4.2.

4.7 Subscription Plans, Changes, and Auto-Renewal

Customer may change its Subscription Plan (where other plans are offered) or cancel at any time through the Service or by written notice to Clasp. A change or cancellation takes effect as stated in the Service at the time of the change and, unless stated otherwise, at the end of the then-current Subscription Term. No refund or credit is given for any unused portion of a Subscription Term.

Subscription Terms renew automatically for successive one-month periods unless Customer cancels, Clasp deletes Customer’s workspace under Section 16.7, or this Agreement is otherwise terminated. Clasp may elect not to renew by giving Customer written notice at least thirty (30) days before the effective date of non-renewal.

4.8 Unpaid Fees

Clasp does not suspend access to the Service for unpaid Payment Fees, which are collected by the Payment Processor under Section 4.2. If Customer does not pay fees for an optional paid feature when due, Clasp may disable that feature until payment is made. Restrictions on access and deletion of workspaces are otherwise governed by Sections 16.3, 16.4, and 16.7.

4.9 Pricing Changes

Clasp may change Payment Fees or other fees, or introduce new fees, by giving Customer at least thirty (30) days’ advance notice by email or in the Service. A change applies only to Client Payments, disbursements, and other transactions processed on or after its effective date. Promotional or custom rates agreed in an Order Form apply only for the period and on the terms stated there; when they end, Clasp’s standard rates apply without further notice. If Customer does not agree to a change, Customer’s sole remedy is to cancel under Section 4.7 before the change takes effect.

4.10 Billing Disputes

Customer must notify Clasp of any good-faith billing dispute within fifteen (15) days of the invoice date or the date the disputed fee is collected. The parties will work together in good faith to resolve the dispute. Customer will pay all undisputed amounts when due.

5. Data & Security

5.1 Customer Data Ownership

Customer retains all right, title, and interest in and to Customer Data. Except for the limited rights expressly granted in this Agreement, nothing in this Agreement transfers ownership of Customer Data to Clasp.

5.2 License to Process Customer Data

Customer grants Clasp a non-exclusive, worldwide, royalty-free license to host, store, process, transmit, index, and display Customer Data solely as necessary to provide the Service, including document ingestion, OCR processing, search indexing, AI-assisted time-entry drafting, and related functionality.

5.3 Document Processing (OCR, Indexing, Embeddings)

(a) Ingestion methods. Documents may enter the Service through user upload, third-party imports (Google, Dropbox, OneDrive), client portal uploads, email ingestion, Connectors, or migrations performed by a third-party migration provider as described in Section 2.12.

(b) OCR and indexing. Clasp uses Unstructured.io to perform OCR and extract text for indexing and search. OCR is read-only and does not modify document content.

(c) Embeddings. Text embeddings generated for search and retrieval are stored in Clasp’s database. Embeddings may persist until Clasp implements configurable deletion logic.

(d) Limited external AI processing. Except as described in this paragraph, Customer Data is not sent to external large language models for training or inference, and AI-Assisted Functionality operates on metadata or embeddings only. The optional Time Capture feature, when Customer elects to enable both Time Capture and AI processing for Time Capture, sends system-generated metadata (not document text) to OpenAI to generate draft time-entry descriptions, as described in Appendix H. Under OpenAI’s published API terms, data submitted through the API is not used to train OpenAI’s models. If Clasp introduces other optional AI features that rely on external large language models, such features will use enterprise-grade APIs that do not train on Customer Data, and Clasp will update Appendix H.

5.4 Storage, Backups, and Prior Versions

(a) Storage providers. Documents and files are stored in Google Cloud Storage in per-organization buckets. Structured application data, account data, and embeddings are stored in a managed database hosted by Supabase.

(b) Backups and prior versions. Clasp relies on the native durability and redundancy of its infrastructure providers and does not maintain separate customer-accessible backups. Clasp may retain prior versions of documents and records for its own operational purposes. Prior versions are not accessible to Customer through the Service unless Clasp expressly makes them available, and Clasp does not guarantee that any prior version exists, how long it is retained, or that deleted, overwritten, or corrupted Customer Data can be recovered or restored.

(c) No multi-region commitments. Clasp does not guarantee multi-region replication, disaster recovery RTO/RPO targets, or secondary backup sites.

(d) Cold storage. Cold-storage tiers may be introduced in the future; no such tier exists today.

5.5 Public Sharing Architecture

Customer may share documents via public links or email-based invitations. Public sharing is Customer-controlled. Clasp is not responsible for mis-addressed, forwarded, or improperly shared links, or for access by recipients selected by Customer. Public sharing uses time-limited signed URLs and may expose document metadata.

5.6 Logging & Audit Trails

(a) Activity logs. Clasp maintains lightweight activity logs showing significant actions within cases and tasks.

(b) System logs. Backend system logs may contain metadata necessary for debugging and operational monitoring.

(c) No audit log module. Clasp does not currently provide a customer-facing audit log or reporting module.

(d) Retention. Log retention periods may vary and are not guaranteed. Logs may persist in system backups until backup cycles expire.

(e) Exports. Logs are not included in standard data exports.

5.7 Security Controls

Clasp will maintain administrative, technical, and physical safeguards designed to protect Customer Data from unauthorized access, consistent with Clasp’s Security Baseline (Appendix B).

Clasp does not currently represent or warrant compliance with, or certification under, any specific framework (such as SOC 2, ISO 27001, GDPR, HIPAA, or CCPA). Clasp uses these frameworks as guides for its security and privacy practices, is working toward alignment with them and, where available, certification or attestation, and uses a compliance management framework to implement and track its security controls and policies. This statement describes ongoing efforts only. It is not a commitment, representation, or warranty that Clasp will achieve or maintain any certification, attestation, or compliance by any date, and Customer may not rely on it as such. Section 3.6(a) continues to apply regardless of these efforts.

5.8 Access Control & Authentication

(a) User roles. The Service supports Firm User, Admin, and Super Admin roles.

(b) Authentication. Users sign in using either a one-time password (OTP) delivered by email or “Sign in with Google.” OTP constitutes multi-factor authentication for purposes of this Agreement. Clasp does not currently support SAML, enterprise single sign-on, or other identity-provider integrations.

(c) Customer responsibility. Customer is responsible for securing the email and Google accounts its Users use to sign in, including enabling the security features those providers offer.

(d) Provisioning. Admins and Super Admins may provision and deprovision users.

(e) Revocation. Clasp may suspend access to protect the security of the Service.

5.9 Secrets Management

Integration tokens and system credentials are stored in an enterprise-grade secrets management system. Clasp does not maintain per-tenant encryption keys unless and until a customer-managed key architecture is implemented.

5.10 Encryption Architecture

The Service encrypts Customer Data at rest using industry-standard encryption provided by Clasp’s cloud infrastructure. Clasp is evaluating an optional customer-managed encryption key model for future release, but this feature is not currently available and Clasp makes no commitment regarding timing or functionality. If customer-managed keys are introduced and Customer elects to use them, certain features of the Service may be limited or unavailable, and Clasp will not be able to recover encrypted data if Customer loses or mismanages its keys.

5.11 Incident Response

Clasp will acknowledge security incidents affecting Customer Data within forty-eight (48) hours of Clasp’s confirmation of the incident, by notifying affected Customers (for example, by email to Customer’s account administrators), and will use commercially reasonable efforts to investigate and remediate the incident. Clasp will share additional information as it becomes available and as Clasp reasonably determines appropriate. Security reports from Customers will be reviewed on a commercially reasonable efforts basis; the forty-eight (48) hour period runs from Clasp’s confirmation of an incident, not from receipt of a report.

5.12 Subprocessors

Clasp may use subprocessors to provide the Service, including cloud hosting, database, OCR, email delivery, messaging, payments, document editing, error monitoring, and AI-assisted features. The current list of subprocessors is provided in Appendix H.

Clasp may add, replace, or remove subprocessors at any time and may update Appendix H and its public subprocessor list accordingly. Clasp will use reasonable efforts to inform Customer of material additions (for example, by posting the updated list or by email to Customer’s account administrators). Customer may object to a new subprocessor by written notice to Clasp within fifteen (15) days of that notice, stating reasonable data-protection grounds. If the parties cannot resolve the objection in good faith, Customer’s sole and exclusive remedy is to cancel the affected Subscription Plan effective at the end of the then-current Subscription Term, without refund or credit. Customer’s continued use of the Service after the notice period constitutes acceptance of the updated list.

5.13 Customer Security Responsibilities

Customer is responsible for securing its own systems, devices, and networks used to access the Service; managing user access; and ensuring that Customer Data submitted to the Service complies with applicable laws and professional obligations.

5.14 Immutable Records

Signed documents generated through Clasp’s e-signature module are locked and cannot be deleted or altered by Users. They are deleted only when the workspace containing them is deleted under Section 16. Paid invoices may be reversed, but audit trails persist.

6. Privacy

6.1 Privacy Policy

Customer’s use of the Service is subject to Clasp’s Privacy Policy, incorporated into this Agreement by reference. The Privacy Policy describes the categories of information Clasp collects, how such information is used, and the choices available to Customer. In the event of a conflict between the Privacy Policy and this Agreement, this Agreement controls.

6.2 Data Processing Roles

With respect to Customer Data, Customer is the controller (or “business”) and Clasp acts as Customer’s processor (or “service provider”), processing Customer Data only on Customer’s instructions as set out in this Agreement and as given through Customer’s use and configuration of the Service. Customer determines the purposes and means of processing Customer Data. With respect to Account Data and Usage Data, Clasp acts as an independent controller for purposes of providing, securing, billing, supporting, and improving the Service. The DPA forms part of this Agreement and governs Clasp’s processing of personal data in Customer Data.

6.3 Use of Customer Data

Clasp will process Customer Data only to provide the Service, to maintain and improve the Service’s security and performance, and as otherwise permitted under this Agreement. Clasp will not sell Customer Data or use Customer Data for advertising or marketing purposes. Clasp may also use payment and billing records within Customer Data, such as payment amounts, dates, and methods, to calculate and reconcile Payment Fees, administer Section 16.7, and support Customer’s use of the Service’s payment features. These activities use billing and account information only and do not involve access to the contents of Customer’s documents or matters.

6.4 Privacy Compliance

Clasp does not currently represent or warrant compliance with any specific privacy framework or regulation, including GDPR, CCPA, HIPAA, or similar laws, and Section 5.7 applies to this Section. Customer is responsible for determining whether its use of the Service satisfies its legal and professional obligations.

6.5 Data Subject Requests

Except as the DPA provides, Clasp has no obligation to respond to data subject or consumer rights requests on Customer’s behalf. If Clasp receives such a request relating to Customer Data, Clasp may direct the requester to Customer.

6.6 Retention and Deletion

Clasp retains Customer Data only for as long as reasonably necessary to provide the Service, to complete the deletion process described in Section 16.7, and to comply with applicable law or legal process. Customer may delete certain Customer Data through the Service. Deleted data may persist in system logs, prior versions, or backups until those logs, versions, or backups expire in the ordinary course of Clasp’s operations, and Clasp does not guarantee deletion from them. Clasp is not Customer’s records custodian and does not retain Customer Data to satisfy Customer’s record-retention obligations, which remain Customer’s sole responsibility. Clasp may retain Account Data, its own records of Payment Fees and transactions, and records of account actions (such as notices, compliance events, deletions, and data deliveries) as needed for its legal, tax, accounting, and dispute-resolution purposes. Clasp may retain records of account actions for up to ten (10) years. Workspace deletion, data export, and archive retention are described in Sections 16.5 and 16.7.

6.7 Cross-Border Transfers

Customer Data may be stored or processed in the United States or other locations where Clasp or its subprocessors operate. Clasp will use reasonable measures to ensure that such transfers comply with applicable law, but does not guarantee compliance with any specific cross-border transfer mechanism.

6.8 Confidentiality

Clasp will treat Customer Data as Confidential Information and will not disclose Customer Data except to subprocessors authorized under Appendix H or as required to comply with law, legal process, or governmental request.

7. AI-Assisted Functionality

7.1 Scope

The Service includes certain machine-learning-based or AI-assisted components used to support search, document handling, workflow automation, and time-entry suggestions (“AI-Assisted Functionality”). Except for the optional Time Capture feature described in Section 5.3(d), AI-Assisted Functionality operates solely on metadata, embeddings, or other derived representations and does not transmit Customer Data or document text to external large language models. Time Capture operates only on system-generated metadata and never on document text.

7.2 Limited Generative Functionality

The Service does not include generative AI features, automated drafting, or model-driven legal analysis, with the sole exception of optional Time Capture AI processing, which generates draft time-entry descriptions from system-generated metadata only and is available only when Customer elects to enable it. All Time Capture outputs are drafts that require Customer’s review and approval. AI-Assisted Functionality is otherwise limited to internal processing that supports search, organization, and workflow efficiency.

7.3 No Legal Advice

AI-Assisted Functionality does not provide legal advice, make legal determinations, or replace professional judgment. Customer is solely responsible for reviewing and validating all outputs generated or suggested by the Service.

7.4 Accuracy and Limitations

AI-Assisted Functionality may generate incomplete, inaccurate, or unexpected outputs. Customer acknowledges that such outputs may require human review and that Clasp does not guarantee the accuracy, completeness, or reliability of any AI-assisted result.

7.5 Model Improvements

Clasp may use aggregated, anonymized, or de-identified data to improve the performance, safety, and reliability of AI-Assisted Functionality. Clasp will not use Customer Data in identifiable form to train external machine learning models.

7.6 No Automated Decision-Making

AI-Assisted Functionality does not perform automated decision-making that produces legal, financial, or similarly significant effects. Customer remains solely responsible for all decisions made using or informed by the Service.

7.7 Connectors and Customer-Directed AI

(a) Connectors. Clasp may make available a Model Context Protocol (MCP) connector or similar interface (each, a “Connector”) that allows Users to connect Customer’s account to AI assistants, agents, and other third-party AI services that Customer selects (“Connected AI Services”).

(b) No native AI; Customer’s choice. Connectors contain no native AI. Whether to use a Connector or any Connected AI Service, which Connected AI Service to use, and how to configure it, including the permissions, scopes, and data made available through it, are decisions made solely by Customer and its Users.

(c) Third-Party Services. Connected AI Services are Third-Party Services. Clasp does not select, operate, control, or monitor them, and is not responsible for how they access, process, store, retain, use, or disclose Customer Data, or for their outputs, availability, or security. When Customer or a User enables a Connector, Customer instructs Clasp to make the selected Customer Data available to the Connected AI Service, and Customer’s use of the Connected AI Service is governed by its provider’s terms.

(d) Customer responsibility. Customer is solely responsible for (i) reviewing and approving the access it grants through a Connector; (ii) ensuring that its use of Connectors and Connected AI Services complies with applicable law, professional obligations, client confidentiality duties, and consent requirements; (iii) reviewing and validating all outputs and all actions taken by or through a Connected AI Service; and (iv) revoking access when it is no longer needed.

(e) Changes. Connectors may be limited in the objects and actions they support, and Clasp may modify, restrict, or discontinue any Connector at any time. Sections 13, 14, and 15 apply to Connectors and Connected AI Services.

8. E-Signatures

8.1 E-Signature Functionality

The Service includes an electronic signature module that allows Users to prepare, send, and execute documents electronically (“E-Signature Functionality”). Electronic signatures generated through the Service are provided solely for convenience and may not meet all legal or regulatory requirements for every transaction.

8.2 Legal Effect

Customer is solely responsible for determining whether electronic signatures generated through the Service satisfy Customer’s legal, regulatory, or professional requirements. Clasp does not represent or warrant that any electronically signed document will be enforceable, admissible, or legally sufficient in any jurisdiction.

8.3 Signature Records

Documents executed through the Service are locked upon completion and cannot be altered. Certain metadata or audit information may be retained by Clasp for operational or security purposes, but Clasp does not guarantee the availability, completeness, or retention period of such metadata.

8.4 Customer Responsibilities

Customer is responsible for:

(a) verifying the identity of signatories;

(b) ensuring that documents sent for signature are accurate and complete;

(c) confirming that electronic signatures are appropriate for the intended transaction; and

(d) complying with all applicable laws governing electronic signatures and recordkeeping.

8.5 No Notarization or Identity Verification

E-Signature Functionality does not include identity verification, notarization, witness services, or any enhanced authentication beyond the mechanisms expressly provided within the Service.

8.6 Limitations

Clasp does not guarantee:

(a) that E-Signature Functionality will meet any specific legal standard;

(b) that signed documents will be retained for any particular period;

(c) that E-Signature Functionality will be suitable for documents requiring heightened authentication or formal execution procedures; or

(d) that the E-Signature Functionality complies with ESIGN, UETA, or any state-specific electronic signature or record-keeping requirements.

9. Confidentiality

9.1 Use of Confidential Information

Each party will:

(a) use the other party’s Confidential Information (as defined in Section 1.2) only as permitted under this Agreement;

(b) protect Confidential Information using at least the same degree of care it uses to protect its own confidential information, and no less than reasonable care; and

(c) limit access to Confidential Information to personnel and contractors who need to know it for purposes of this Agreement and who are bound by confidentiality obligations no less protective than those in this Section.

9.2 Exclusions for Customer Data

Customer Data is subject to the additional protections and limitations described in Sections 5 (Data & Security) and 6 (Privacy). If there is a conflict between this Section 9 and Sections 5 or 6, Sections 5 and 6 control with respect to Customer Data.

9.3 Compelled Disclosure

A party may disclose Confidential Information to the extent required by law, subpoena, or court order, provided that (to the extent legally permitted) the receiving party gives prompt notice to the disclosing party and reasonably cooperates in any effort to seek confidential treatment or limit disclosure.

9.4 No Subpoena Support

Clasp has no obligation to respond to subpoenas, discovery requests, or other legal process directed to Customer. Customer is solely responsible for identifying, preserving, collecting, reviewing, and producing Customer Data in response to any such requests. Clasp will not act as Customer’s agent or legal representative in connection with legal process and will not provide litigation support, data authentication, or expert testimony. To the extent Clasp receives legal process seeking Customer Data, Clasp may, but is not obligated to, notify Customer.

9.5 Return or Deletion

Upon request or termination of this Agreement, each party will delete or return the other party’s Confidential Information, except that:

(a) Clasp may retain Customer Data as permitted under Sections 5, 6, and 16.7; and

(b) each party may retain Confidential Information in routine backups or archives until those backups expire in the ordinary course of business.

9.6 Injunctive Relief

Unauthorized use or disclosure of Confidential Information may cause irreparable harm. The disclosing party is entitled to seek injunctive relief in addition to any other remedies available at law or in equity.

10. Intellectual Property

10.1 Ownership of the Service

Clasp and its licensors retain all right, title, and interest in and to the Service, including all software, workflows, user interfaces, designs, documentation, templates, models, algorithms, and other technology provided or made available under this Agreement. No rights are granted to Customer except as expressly stated in this Agreement.

10.2 Customer Data

Customer retains all right, title, and interest in and to Customer Data, as described in Section 5.1. Except for the limited rights granted in Section 5.2, nothing in this Agreement transfers ownership of Customer Data to Clasp.

10.3 License to Use the Service

Subject to Customer’s compliance with this Agreement, Clasp grants Customer a limited, non-exclusive, non-transferable, non-sublicensable license to access and use the Service during the Subscription Term, solely for Customer’s internal business purposes.

10.4 Restrictions

Customer will not, and will not permit any third party to:

(a) copy, modify, or create derivative works of the Service;

(b) reverse engineer, decompile, or attempt to extract source code;

(c) remove or obscure proprietary notices;

(d) access the Service to build a competitive product; or

(e) use the Service in violation of the Acceptable Use Policy.

10.5 No Rights to Clasp IP

Except for the limited license expressly granted in Section 10.3, Customer receives no rights to Clasp’s intellectual property, including any rights to software, source code, models, algorithms, or internal tools used to provide the Service.

10.6 No Custom Development

Clasp does not provide custom development services under this Agreement. Any suggestions, requests, or recommendations from Customer regarding new features or modifications do not create any obligation for Clasp to develop or deliver such features.

10.7 Reservation of Rights

Clasp reserves all rights not expressly granted in this Agreement. No implied licenses are granted under this Agreement, whether by estoppel, course of dealing, or otherwise.

11. Feedback

11.1 Feedback License

If Customer or its Users provide suggestions, ideas, recommendations, or other feedback relating to the Service (“Feedback”), Customer grants Clasp a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, transferable, sublicensable license to use, modify, incorporate, and otherwise exploit such Feedback for any purpose, without restriction or obligation to Customer.

11.2 No Obligation

Clasp has no obligation to review, implement, or respond to any Feedback, and providing Feedback does not create any expectation of feature development, product changes, or service commitments.

11.3 No Compensation

Customer acknowledges that it will not receive any compensation, attribution, or ownership interest for Feedback, and that Clasp may use Feedback in products or features made available to other customers.

12. Reservation of Rights; Additional Restrictions

12.1 Reservation of Rights

Except for the limited rights expressly granted to Customer in this Agreement, Clasp retains all rights, title, and interest in and to the Service, including all intellectual property and proprietary rights. No rights are granted to Customer by implication, estoppel, or otherwise.

12.2 No Implied Functionality

Customer acknowledges that access to the Service does not include any rights to:

(a) underlying software, source code, models, algorithms, or system architecture;

(b) any features, modules, or enhancements not expressly made available as part of the Service; or

(c) any future functionality, integrations, or performance improvements unless separately purchased or agreed in writing.

12.3 No Competitive Use

Customer may not, and may not permit any third party to, use the Service or any information, data, workflows, models, or insights derived from the Service to build, train, improve, benchmark, or assist in the development of any product or service that competes with or is intended to compete with Clasp.

12.4 No Transfer or Assignment of IP

Nothing in this Agreement transfers or assigns any intellectual property rights of either party. Customer may not sublicense, assign, or transfer any rights granted under this Agreement except as expressly permitted in Section 17 (Governing Law; Dispute Resolution; Miscellaneous).

12.5 Open Source Components

The Service may include open-source components subject to separate license terms. Such components are provided under their applicable licenses, and nothing in this Agreement limits Customer’s rights under those licenses.

13. Warranties; Disclaimers

13.1 Limited Warranty

Clasp warrants that it will provide the Service in a professional and workmanlike manner consistent with generally accepted industry standards. Customer’s exclusive remedy for breach of this warranty is for Clasp to re-perform the applicable Services.

13.2 No Legal Advice

The Service, including any AI-Assisted Functionality, Billing and Trust Features, or E-Signature Functionality, does not provide legal, accounting, or financial advice, make legal determinations, or replace professional judgment. Customer is solely responsible for reviewing and validating all outputs and ensuring compliance with applicable laws, ethical rules, and professional obligations.

13.3 No Accuracy or Output Warranty

Clasp does not warrant that:

(a) the Service or any outputs (including AI-assisted suggestions, metadata, time-entry drafts, ledgers, balances, calculations, or document handling results) will be accurate, complete, or reliable;

(b) the Service will meet Customer’s requirements; or

(c) any errors or defects will be corrected.

13.4 No E-Signature Validity Warranty

Clasp does not warrant that any electronically signed document will be enforceable, admissible, or legally sufficient in any jurisdiction. Customer is solely responsible for determining whether electronic signatures are appropriate for its intended transactions.

13.5 No Uptime or Performance Warranty

Clasp does not warrant that the Service will be uninterrupted, error-free, secure, or available at any particular time. Scheduled maintenance, unscheduled downtime, and third-party outages may affect availability.

13.6 No Warranty for Third-Party Services

Clasp is not responsible for, and makes no warranties regarding, any third-party products, services, integrations, or platforms, including email providers, cloud storage services, identity providers, Payment Processors, migration providers, Connectors, and Connected AI Services.

13.7 General Disclaimers

Except as expressly stated in Section 13.1, the Service is provided “as is” and “as available.” To the maximum extent permitted by law, Clasp disclaims all warranties, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, or quiet enjoyment.

14. Indemnification

14.1 Customer Indemnification

Customer will defend, indemnify, and hold harmless Clasp and its affiliates, owners, directors, officers, employees, contractors, and agents (the “Clasp Parties”) from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of or relating to:

(a) Customer’s use of the Service in violation of this Agreement or applicable law;

(b) Customer Data, including any allegation that Customer Data infringes, misappropriates, or violates any third-party rights;

(c) Customer’s failure to obtain necessary rights or consents to upload or process Customer Data;

(d) Customer’s use of any outputs generated by the Service, including AI-assisted suggestions, Billing and Trust Feature outputs, or electronically signed documents, or Customer’s use of any Connector or Connected AI Service;

(e) any dispute between Customer and its Users, clients, or counterparties; or

(f) any claim by a Portal User relating to Customer’s legal services, communications, or payments, or to Customer Data.

14.2 Procedure

The indemnified party will:

(a) promptly notify the indemnifying party of the claim (failure to do so will not relieve the indemnifying party of its obligations except to the extent materially prejudiced);

(b) permit the indemnifying party to control the defense and settlement of the claim; and

(c) reasonably cooperate at the indemnifying party’s expense. The indemnifying party may not settle any claim that imposes obligations on the indemnified party without its prior written consent.

14.3 No Clasp Indemnification

Clasp does not provide any indemnification of any kind, including for intellectual property infringement, data breaches, security incidents, AI-generated outputs, e-signature validity, or third-party services.

15. Limitation of Liability

15.1 Exclusion of Certain Damages

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, consequential, special, exemplary, or punitive damages, or for any loss of profits, revenue, goodwill, or data, even if advised of the possibility of such damages.

15.2 Cap on Direct Damages

Except for Customer’s payment obligations and Customer’s indemnification obligations under Section 14, each party’s total aggregate liability arising out of or relating to this Agreement will not exceed the greater of (a) the fees received by Clasp from or on behalf of Customer under this Agreement, including Clasp’s platform fee portion of Payment Fees, in the twelve (12) months preceding the event giving rise to the claim, and (b) one hundred U.S. dollars (US $100).

15.3 No Liability for Outputs or Decisions

Clasp will have no liability arising from or relating to:

(a) any outputs, suggestions, or results generated by the Service, including AI-Assisted Functionality and the Billing and Trust Features;

(b) any decisions made or actions taken by Customer based on such outputs; or

(c) any electronically signed documents or the legal sufficiency, enforceability, or admissibility of such documents.

15.4 No Liability for Third-Party Services

Clasp will have no liability for any third-party products, services, integrations, or platforms, including email providers, cloud storage services, identity providers, Payment Processors, migration providers, Connectors, Connected AI Services, or any changes or outages affecting such services.

15.5 Allocation of Risk

The limitations in this Section 15 are fundamental elements of the basis of the bargain between the parties. The Service would not be provided without these limitations.

15.6 Clasp Parties

To the maximum extent permitted by law, no Clasp Party other than Clasp has any personal liability arising out of or relating to this Agreement or the Service. Customer will bring any claim only against Clasp. Each Clasp Party may enforce Sections 13, 14, and 15 as a third-party beneficiary.

16. Term & Termination

16.1 Term

This Agreement begins on the Effective Date and continues until all Subscription Terms have expired or this Agreement is terminated as permitted below.

16.2 Subscription Term; Renewal

Each Subscription Term is the one-month period described in Section 1.2, unless an Order Form states otherwise. Renewal, changes, and cancellation of a Subscription Plan are governed by Section 4.7.

16.3 Termination for Cause

Either party may terminate this Agreement upon written notice if the other party:

(a) materially breaches this Agreement and fails to cure the breach within thirty (30) days after receiving written notice; or

(b) becomes insolvent, files for bankruptcy, or ceases business operations.

16.4 Suspension

Clasp may suspend Customer’s access to the Service:

(a) as described in Section 16.7, including if Customer has not completed Firm Verification; or

(b) immediately, if Customer’s use of the Service poses a security risk, violates the Acceptable Use Policy, or could harm the Service or any third party, or if Customer is using the Service in violation of applicable law.

Clasp will restore access once the issue is resolved.

16.5 Effect of Termination

Upon termination of this Agreement or expiration of the applicable Subscription Term:

(a) Customer’s rights to access and use the Service will immediately cease;

(b) Customer will pay all outstanding fees;

(c) Clasp will have no obligation to maintain or provide access to Customer Data except as required under Sections 5 and 6 and, where applicable, Section 16.7;

(d) each party will delete or return the other party’s Confidential Information as required under Section 9; and

(e) if Customer deletes its workspace or cancels, Customer instructs Clasp to delete Customer Data, and Clasp will deliver the data export and retain the archive described in Sections 16.7(d) and 16.7(e), either by emailing a download link to Customer’s Super Admins or by providing one on request through Clasp support. Customer is responsible for retrieving any Customer Data it wishes to keep before the archive period ends.

16.6 No Refunds

Except as expressly stated in this Agreement, all fees are non-refundable, and termination does not relieve Customer of its payment obligations for the remainder of the then-current Subscription Term.

16.7 Workspace Deletion and Data Export

The Service is provided without subscription fees because Clasp is compensated through Payment Fees. Accordingly, Clasp may delete inactive workspaces as described in this Section 16.7. Clasp permanently deletes a workspace’s Customer Data under this Section only after it has delivered the data export described in Section 16.7(d).

(a) Verified Customers. If no Client Payment has been processed through Customer’s workspace for one hundred fifty (150) consecutive days, counted from the later of Customer’s most recent Client Payment and the date Customer completed Firm Verification, Clasp may delete Customer’s workspace and terminate this Agreement. Days during which the Payment Processor has suspended Customer’s ability to accept Client Payments are not counted. Each new Client Payment restarts the count. Clasp may disregard Client Payments that are refunded, reversed, or nominal, or that appear intended only to avoid deletion.

(b) Unverified Customers. Customer must complete Firm Verification to accept Client Payments. If Customer has not completed Firm Verification within seven (7) days after its account is created, Clasp may restrict access to the Service until Customer completes it. If Customer has not completed Firm Verification within thirty-seven (37) days after its account is created, Clasp may delete Customer’s workspace and terminate this Agreement. Clasp may approve or decline Firm Verification in its discretion and may rely on the Payment Processor’s onboarding decision.

(c) Notice. Clasp will give Customer at least thirty (30) days’ notice before deleting a workspace under Section 16.7(a), and at least seven (7) days’ notice before deleting a workspace under Section 16.7(b), by email to Customer’s Super Admins and Admins and by notice in the Service. Clasp may, but is not required to, send additional reminders, and may extend or pause any deletion date in its discretion. Notices are effective when sent to the email addresses associated with Customer’s account, and Customer is responsible for keeping those addresses current. Before deleting a workspace, Clasp will make reasonable attempts to contact Customer to help it keep its workspace or retrieve its data. The notices described in this Section 16.7(c) satisfy that obligation, and Clasp may, but is not required to, use additional means of contact.

(d) Data export. When a workspace is deleted under this Section 16.7, Clasp will make available to each of Customer’s Super Admins a download of Customer Data, consisting of Customer’s documents in their folder structure and spreadsheet exports of Customer’s records (such as contacts, cases, time entries, invoices, payments, and trust records). Each download link is personal to the Super Admin it is sent to, requires a one-time code sent to that Super Admin’s email address, and expires thirty (30) days after it is sent. Clasp may resend a link on request while it retains the archive described in Section 16.7(e). If no Super Admin can be reached, Clasp may, after confirming the requester’s identity and authority by reasonable means, send a link to a different address. The export does not include system logs, prior versions, or derived data such as embeddings. Clasp is not responsible for access to a download by anyone who controls a Super Admin’s email account. The export is delivered when Clasp sends the download link by email to each Super Admin on Customer’s account (or to an address provided under this Section 16.7(d)). Customer agrees to this method of delivery. Delivery is effective, and Customer is deemed to have received its Customer Data, when the email is sent, whether or not it is opened, the link is used, or the data is downloaded. Delivery of the export fulfills any obligation of Clasp to return Customer Data under this Agreement.

(e) Archive and restoration. Clasp will retain an archive of a deleted workspace for ninety (90) days after deletion. During that period, Clasp may restore the workspace at Customer’s request, which reinstates this Agreement on its then-current terms. A restored workspace is subject to a new deletion date stated in Clasp’s restoration notice, which will be at least thirty (30) days after restoration, and a workspace deleted under Section 16.7(b) remains restricted after restoration until Customer completes Firm Verification. After the archive period, Clasp will permanently delete the archive, subject to Section 6.6, and the workspace cannot be restored. Clasp may retain Customer Data beyond the archive period only where required by law or legal process.

(f) Customer responsibility. Customer is solely responsible for exporting and retaining any Customer Data it needs before its workspace is deleted, including records it must keep under applicable law or rules of professional conduct (such as client trust account and client file retention requirements). Deletion of a workspace in accordance with this Section 16.7 is not a breach of this Agreement, and Clasp will have no liability for any loss of Customer Data or access resulting from it. Clasp is not Customer’s records custodian. Some records, such as client trust account records, may need to be kept for several years, and Customer must keep the export or other copies for as long as its obligations require.

17. Governing Law; Dispute Resolution; Miscellaneous

17.1 Governing Law

This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles.

17.2 Mandatory Binding Arbitration

Except for claims seeking injunctive relief or to enforce a party’s intellectual property rights, any dispute, claim, or controversy arising out of or relating to this Agreement will be finally resolved by binding arbitration administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules. The arbitration will take place in Wilmington, Delaware before a single arbitrator. The arbitrator must be a licensed attorney with at least ten (10) years of experience in commercial contract disputes. The arbitrator will apply this Agreement as written.

17.3 Individual Claims Only

The parties agree that arbitration will be conducted solely on an individual basis. Class actions, collective actions, private attorney general actions, and representative proceedings are not permitted. The arbitrator may not consolidate claims of multiple parties.

17.4 Injunctive Relief Carve-Out

Either party may seek temporary or permanent injunctive relief in a court of competent jurisdiction in Delaware to protect its Confidential Information or intellectual property rights, or to prevent unauthorized access to or use of the Service.

17.5 Venue for Permitted Court Actions

For any action permitted under this Agreement that is not subject to arbitration, the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Wilmington, Delaware.

17.6 Assignment

Customer may not assign, transfer, or delegate this Agreement, in whole or in part, without Clasp’s prior written consent. Any attempted assignment in violation of this Section is void. Clasp may assign this Agreement without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets.

17.7 Subcontractors

Clasp may use subcontractors and subprocessors to provide the Service, as described in Section 5.12. Clasp remains responsible for its subcontractors’ compliance with this Agreement, subject to Section 15 (Limitation of Liability).

17.8 Notices

Notices under this Agreement must be in writing and will be deemed given when delivered by email, personal delivery, or certified mail. Notices to Clasp must be sent to hello@clasplegal.com. Notices to Customer may be sent to the email or physical address associated with Customer’s account. Customer consents to receive notices, disclosures, data exports, and other communications from Clasp electronically, including by email and in the Service. Notices and deliveries Clasp sends by email to Customer’s Super Admins or Admins are effective when sent, whether or not they are opened.

17.9 Updates to this Agreement

Clasp may update this Agreement, including the DPA, the Appendices, and its standard policies (the Acceptable Use Policy, Privacy Policy, Portal and E-Signature Terms of Use, Cookie & Tracking Technologies Disclosure, and Public Subprocessor List), at any time by posting the updated version on Clasp’s website or in the Service. An update takes effect when posted unless it states a later date. If an update is material, Clasp will take reasonable steps to inform Customer, such as by email to Customer’s account administrators or an in-product notice. Changes to Payment Fees are also subject to the notice period in Section 4.9. Customer’s continued use of the Service after an update takes effect constitutes acceptance of the update. If Customer does not agree to an update, Customer’s sole remedy is to stop using the Service and cancel under Section 4.7. An update does not apply to any dispute that arose before the update took effect, and terms in an Order Form signed by both parties may be changed only by a written agreement signed by both parties.

17.10 Force Majeure

Neither party is liable for delays or failures to perform caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, labor disputes, government actions, internet or telecommunications failures, or third-party service outages.

17.11 Publicity

Clasp may identify Customer as a customer of the Service and may use Customer’s name and logo in its customer lists and marketing materials, unless Customer opts out by providing written notice.

17.12 Accessibility

Clasp strives to improve the accessibility of the Service but does not represent or warrant compliance with any specific accessibility standard or regulation.

17.13 Entire Agreement

This Agreement, together with the Order Form, the DPA, and the Appendices, constitutes the entire agreement between the parties and supersedes all prior or contemporaneous agreements, proposals, or representations relating to its subject matter.

17.14 Severability

If any provision of this Agreement is held invalid or unenforceable, the remaining provisions will remain in full force and effect.

17.15 Waiver

A party’s failure to enforce any provision of this Agreement is not a waiver of that provision or any other provision.

17.16 Survival

Sections 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16.5, 16.7(d) through 16.7(f), and 17 will survive termination of this Agreement.

Appendices

The following Appendices form part of this Agreement. Appendix lettering is retained from the original contract structure; there are no other appendices.

Appendix A — Service Description. Description of the current Clasp platform, including modules, capabilities, and limitations.

Appendix B — Security Baseline. Technical and organizational security measures currently implemented by Clasp.

Appendix E — Support & SLAs. Support hours, response expectations, exclusions, and service availability commitments.

Appendix H — Subprocessors. List of third-party vendors engaged by Clasp to process Customer Data.

Clasp Policies

The following standalone policies are referenced by this Agreement and may be updated by Clasp as described in Section 17.9.

Acceptable Use Policy (AUP). Defines prohibited conduct, prohibited and restricted data, system misuse, AI-related boundaries, and enforcement actions.

Privacy Policy. Describes how Clasp collects, uses, stores, and shares personal data.

Portal and E-Signature Terms of Use. Terms for Portal Users of the client portal, payment, and e-signature features, presented to anyone who signs a document through the Service.

Cookie & Tracking Technologies Disclosure. Explains the cookies and similar technologies Clasp uses and the options available to users.

Public Subprocessor List. Identifies the third-party vendors engaged by Clasp to process Customer Data, with descriptions of their roles and data categories.

Data Processing Addendum (DPA). Forms part of this Agreement, as described in Section 6.2.

Clasp may also publish other informational documents from time to time, such as a security overview or trust page, a vulnerability disclosure program, or an AI transparency statement. Unless expressly incorporated into this Agreement, those documents are informational only and are not part of this Agreement.