MASTER SERVICES AGREEMENT – ONLINE TERMS AND CONDITIONS
This MASTER SERVICES AGREEMENT (together with each Order Form and the Exhibits, the“Agreement”) is entered into as of the Effective Date and is by and between Blazestack, Inc., a Texas corporation with offices located at 3201 Bee Caves Road, Suite 120 #160266, Austin, Texas 78746 (“Blazestack”) and the entity identified in the Order Form or, in the case of a Free Trial, the entity on whose behalf this Agreement is accepted electronically inaccordance with Section 12 (“Customer”). This Agreement governs Customer’s purchase and use of the Software and Services detailed in each Order Form and, in the case of a Free Trial, Customer’s access to and use of theSoftware and Services during the Trial Period. The parties intend that this Agreement will govern all subsequent purchases by Customer for the same Software and Services in the Order Form, and all such subsequent Order Forms accepted by Customer shall also be incorporated into this Agreement by reference.
BYCLICKING “I AGREE” (OR A SIMILAR BUTTON OR CHECKBOX), BY COMPLETING AN ORDER FORM, BY REGISTERING FOR AN ACCOUNT, OR BY ACCESSING OR USING THE SOFTWARE OR SERVICES, THE INDIVIDUAL TAKING SUCH ACTION REPRESENTS AND WARRANTS THAT HE OR SHE HAS THE AUTHORITY TO BIND CUSTOMER TO THIS AGREEMENT, AND CUSTOMER AGREES TO BE BOUND BY THIS AGREEMENT, INCLUDING EACH ORDER FORM AND, IF APPLICABLE, SECTION 12 (FREE TRIAL TERMS). IF THE INDIVIDUAL DOES NOT HAVE SUCH AUTHORITY, OR IF CUSTOMER DOES NOT AGREE TO THIS AGREEMENT, THE INDIVIDUAL MUST NOT ACCEPT THIS AGREEMENT AND MUST NOT ACCESS OR USE THE SOFTWARE OR SERVICES.
1. Definitions. Capitalized terms used in this Agreement shall have themeanings set forth herein.
(a) “Account Activity” means any access to or use of the Software or Services, and any action, instruction, input, request, transaction, download, export, deletion, report, or communication made or submitted through or by means of Customer’s account or any User’s account credentials, session, access token, API key, single sign-on credential, or other authentication mechanism, in each case regardless of (i) whether such activity was authorized by Customer or any User, and (ii) whether such activity was performed by a natural person or by an AI Agent or other automated means.
(b) “AI Agent” means any software, script, bot, model, or system that uses artificial intelligence, machine learning, large language models, or other automated or autonomous technology to access, navigate, operate, interact with, submit data to, extract data from, or otherwise use the Software or Services, in whole or in part, whether developed by Customer or a third party and whether or not a User initiates or supervises such use, including so-called “agentic,” “computer-use,” “browser-use,” or “operator” tools, robotic process automation, headless browsers, automated API clients, Model Context Protocol (“MCP”) servers and clients, tool-calling or function-calling integrations, plugins, connectors, and any other interface or protocol through which an AI system invokes, reads from, or writes to the Software or Services. For clarity, AI Agent does not include (a) the AI Features (as defined in Exhibit B) or anyother functionality (including any API, MCP server, or integration endpoint) that Blazestack itself provides as part of the Software or Services, provided that any Customer or third-party AI system that connects to or uses such functionality remains an AI Agent, or (b) a standard web browser listed in Section 2(c) operated in real time by a User.
(c) “AI Agent Consent” means a written consent, substantially in the form of Blazestack’s then-current AI Agent Consent Agreement or in such other form as Blazestack may approve in writing, executed by an authorized officer of Blazestack, that expressly references Section 3(d), identifies the AI Agent,the Users and use cases covered, and any conditions on such use. No other communication (including any statement by Blazestack support or sales personnel, any support ticket, any failure by Blazestack to detect or block an AI Agent, or any course of dealing) constitutes AI Agent Consent.
(d) “Annual Case Volume” means maximum number of individual incidents at a specificlocation entered in the Software by Customer’s Users per each year of the Term as set forth in an applicable Order Form.
(e) “Confidential Information” mean all oral, electronic, or written non-public, proprietary information, including this Agreement, whether designated as confidential or not at the time of its disclosure, which a reasonable person would know is confidential or by its nature is clearly or should be confidential information including, without limitation, information pertaining to the features, functionality, testing and performance of the Software, Feedback (defined in Section 6(c)), pricing information offered to Customer, personal information of Customer or any User, User’s account username and password to the Software and the Website and/or credit card information.
(f) “Customer Data” means all electronic data or information that Customer submits to the Software or is submitted on behalf of Customer as well as all data generated by the Software, except to the extent of any data, information, or intellectual property owned by Blazestack or third-party.
(g) “Effective Date” means the date on which Customer completes its initial Order Form, as reflected in Blazestack’s records and order confirmation, or, for a Free Trial, the Trial Start Date.
(h) “Free Trial”, “Trial Period”, and “Trial Start Date” have the meanings set forth in Section 12.
(i) “Order Form” means the online order, checkout, plan-selection, or account-upgrade screen (or, if Blazestack elects, a separate written ordering document) that references or is presented together with these Terms and Conditions and through which Customer selects or confirms the Software, Services, Subscription Plan, User-Seats, Annual Case Volume, Fees, and term, together with Blazestack’s electronic order confirmation. Each Order Form is incorporated into and forms part of this Agreement upon Customer’s completion of it, and the information Customer enters in an Order Form is deemed accurate and binding on Customer.
(j) “Services” means certain services that may be offered by Blazestack as set forth in an applicable Order Form during the Term.
(k) “Software” means Blazestack’s proprietary fire investigation software accessible through the internet, that is intended for Customer’s use in fire investigation.
(l) “Subscription Plan” means the subscription tier, features, limits, and pricing selected by Customer in an Order Form, as described on Blazestack’s website or order screen at the time of the Order Form.
(m) “Term” shall have the meaning set forth in Section 7(b) of the Agreement.
(n) “Third-Party Products” means any third party products or services utilized to provide the Software and Services.
(o) “User” means a single, unique authorized individual of the Customer that uses the Software on Customer’s behalf.
(p) “User-Seat” is a license for one User to use the Software.
2. Services; Software and Support.
(a) Services. Blazestack will perform certain services and create and provide certain deliverables as may be set forth in an applicable Order Form, each of which shall be incorporated into and made part of this Agreement (the “Services”).
(b) Software Terms. Subject to Customer’s compliance with the terms and conditions of the Agreement, if Customer is purchasing Blazestack is providing access to the Software, Blazestack hereby grants to Customer a non-exclusive, non-sublicensable, and non-transferable license to use the Software for the number of User-Seats specified on the Order Form (or, for a Free Trial, the number of Users permitted under Section 12) during the Term, or if not specified a reasonable number of Users in the sole discretion of Blazestack. Customer represents and warrants that it shall use the Software and Customer Data only for fire investigation purposes.
(c) System Requirements. Customer shall meet the following minimum system requirements for access to the Services and Software as set forth in an applicable Order Form: Google Chrome™: Version 97 to most current; Microsoft® Edge® Version 96 to most current; Mozilla® Firefox®: Version 96 to most current; and Apple® Safari®: Version 15 to most current, which shall be subject to change from time to time upon written notification to Customer.
(d) Third-Party Products. Blazestack may offer Customer the ability to use Third-Party Products with the Software or Services as set forth in an applicable SOW, subject to Customer’s agreement and compliance with any applicable terms and conditions for those Third-Party Products.
(e) Data Security and Privacy. Blazestack shall maintain a privacy policy that complies with applicable laws in each jurisdiction where it provides the Software and Services to Customer. The parties shall comply with the data processing addendum (“DPA”) attached hereto as Exhibit A, which shall be made a part hereof, and all applicable laws, as it relates to the processing of personally identifiable information (“PII”).
(f) Artificial Intelligence Supplemental Terms. Each party shall maintain compliance with certain terms and conditions related to artificial intelligence, attached hereto as Exhibit B, which shall be incorporated hereto and made a part of this Agreement.
(g) Availability; Maintenance. Blazestack shall use commercially reasonable efforts to make the Software and Services available twenty-four (24) hours a day, seven (7) days a week, consistent with generally accepted industry standards for comparable cloud-based software, excluding (i) scheduled maintenance, which Blazestack will endeavor to perform between Friday 9:00 p.m. and Saturday 5:00 a.m. Central Time or upon reasonable advance notice; (ii) emergency maintenance; and (iii) unavailability caused by events beyond Blazestack’s reasonable control, by Customer’s or any User’s acts or omissions, by third-party software, services, or networks, or by Customer’s failure to satisfy the System Requirements. Blazestack does not guarantee any particular level of availability, and Customer’s sole and exclusive remedy for any unavailability of the Software or Services is Blazestack’s use of commercially reasonable efforts to restore availability and the support described in Section 2(h).
(h) Support. Blazestack will provide support to Customer via telephone, email, and online chat Monday through Friday during the hours of 9:00 a.m. through 5:00 p.m. Central Time, excluding federal holidays (“Support Hours”). Customer may initiate a helpdesk ticket during Support Hours by calling (866) 303-4344, or at any time by emailing support@blazestack.com or initiating an online chat session. Blazestack will use commercially reasonable efforts to respond to all helpdesk tickets within one (1) business day. Blazestack may modify its support offerings from time to time, provided that it does not materially reduce the support described in this Section 2(h) during the then-current Term.
(i) Storage. Unless the Subscription Plan provides otherwise, Blazestack will provide Customer with standard cloud storage of up to three (3) terabytes per each year of the Term for ordinary investigative use, including reports, documents, photographs, audio recordings, and other typical case materials (“Included Storage”). Storage of high-volume or high-bitrate media, including body-worn camera footage, in-car or dash camera video, drone or aerial footage, RAW image files, continuous video recordings, 3D scans, LiDAR data, or other unusually large or data-intensive files (“Excluded Media”), is excluded from the Included Storage and is subject to incremental charges. Customer acknowledges that Excluded Media typically involves materially higher storage, processing, and retention requirements, and that pricing and terms for Excluded Media storage will be set forth in a separate Order Form or in writing as agreed by the parties.
3. Responsibilities and Restrictions.
(a) Blazestack Responsibilities. Blazestack shall: (i) provide the Software and/or Services (as set forth in an applicable Order Form) in accordance with this Agreement and all applicable laws; (ii) make the Software and/or Services available in accordance with Section 2(g); (iii) Blazestack shall maintain commercial general liability, automobile liability, workers’ compensation, employer’s liability, and technology errors and omissions/cyber liability insurance during the Term; and (iv) maintain administrative, technical, and physical safeguards to maintain FBI Criminal Justice Information (CJI) system compliance. Upon request, Blazestack will supply certificates of insurance.
(b) Customer Responsibilities. Customer shall: (i) use the Software and Services in accordance with this Agreement and applicable laws and cooperate with Blazestack in its provision of the Software and Services; (ii) ensure Users to comply with this Agreement; (iii) prevent unauthorized access or use of the Software and Services, including by any AI Agent, and promptly notify Blazestack if Customer discovers or reasonably believes any unauthorized access or use (including any use by an AI Agent not covered by an AI Agent Consent) has occurred; (iv) be responsible for the Customer Data including the accuracy, completeness, and legality of the Customer Data; (v) ensure that any firewalls or other security measures are properly configured to allow Blazestack internet traffic on the necessary IP addresses and ports; and (vi) facilitate Users’ access to *.blazestack.com domains and ability to receive emails from *@blazestack.com email addresses, and calibrate any ad blockers, pop-up blockers, content filters, or any other technologies that may interfere with Blazestack security or User usability, in order to enable proper functioning and delivery of the Software and Services. Furthermore, the Customer is responsible for the results of the use of the Software, including all reports generated therefrom, and hereby acknowledges to Blazestack that (1) Customer is solely responsible for any such use of reports, which Customer creates,(2) Blazestack is not certifying or validating any portion of the reports, and (3) Customer’s use of the Software and Services and all such reports shall comply with Exhibit B and any AI acceptable use policy that Blazestack makes available to Customer in writing, as updated in accordance with Exhibit B.
(c) Restrictions. Only Users may use the Software and Services with the account credentials issued to that User by the Customer, and account credentials shall not be shared. Customer shall not, and shall not permit any third party to: (i) use the Software and Service beyond the scope granted in this Agreement; (ii) use the Software or Services other than as expressly authorized under this Agreement; (iii) interfere with or disrupt the integrity or performance of the Software and Services, or probe, scan, or test the vulnerability of the Software, Services, or any related system or network; (iv) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer or otherwise make the Software or Services available; (v) remove any title, trademark, copyright, or restricted rights notices or labels from the Software or Services; (vi) modify or create a derivative work of the Software and Services or any portion thereof; (vii) reverse engineer, disassemble, decompile, decode, adapt or otherwise attempt to derive or gain access to the source code, object code or underlying structure or algorithms of the Software or Services, in whole or in part; (viii) access or attempt to access or use the Software or Services for purposes of competitive analysis or the development, provision, or use of a competing software service, product, or service; (ix) copy, record, screenshot, or otherwise capture any aspect of the Software or Services in any medium without the prior written consent of Blazestack; (x) access or use the Software or Services by means of any AI Agent, scraper, crawler, or other automated means except as expressly permitted under Section 3(d); (xi) use the Software, the Services, or any data, output, report, documentation, or interface thereof, in whole or in part, to train, fine-tune, evaluate, or improve any AI Technology (as defined in Exhibit B), to create or compile any dataset or corpus for any such purpose, or to develop, benchmark, or improve any product or service that competes with the Software or Services; or (xii) circumvent, disable, or interfere with, or attempt to circumvent, disable, or interfere with, any rate limit, authentication, access control, bot-detection or human-verification mechanism, encryption, or other technical measure that Blazestack uses to protect or control access to the Software or Services. Any breach of clause (vii), (viii), (x), (xi), or (xii) of this Section 3(c), whether by Customer, any User, or any AI Agent, is a material breach of this Agreement not capable of cure. For the avoidance of doubt, this Agreement does not give Customer or any User the right to copy or receive distribution any of the underlying component of the Software or Services.
(d) AI Agents; Automated Access; Responsibility for Account Activity.
(i) Prohibition. Except as expressly permitted by an AI Agent Consent, Customer shall not, and shall not permit any User or third party to, use, deploy, connect, configure, or enable any AI Agent to access or use the Software or Services, or provide any AI Agent with account credentials, sessions, tokens, or other means of access to the Software or Services. Customer acknowledges that the Software and Services are designed for use by human Users and that the Human-in-the-Loop requirements of Exhibit B presuppose human review at each step. Any use of an AI Agent in breach of this Section 3(d) is a material breach of this Agreement not capable of cure and, without limiting Blazestack’s other remedies, grounds for immediate Software/Service Suspension under Section 7(f).
(ii) Consent. Customer may request AI Agent Consent by written notice to Blazestack describing the AI Agent, its provider, the intended use cases, the Users who will direct it, and the data it will access. Blazestack may grant, condition, limit, or withhold AI Agent Consent in its sole discretion, and may revoke or modify any AI Agent Consent upon written notice. Blazestack may condition AI Agent Consent on, among other things, additional Fees, the purchase of additional User-Seats, technical controls (including dedicated credentials, rate limits, logging, and scope restrictions), security review of the AI Agent and its provider, and Customer’s agreement to additional terms.
(iii) Consented AI Agents. If Blazestack grants AI Agent Consent: (A) the AI Agent shall be treated as a User for purposes of all obligations, restrictions, and limitations in this Agreement, and all Account Activity of the AI Agent shall be subject to Exhibit B as if performed by a User; (B) Customer shall designate at least one User who is responsible for directing, supervising, and reviewing the AI Agent’s Account Activity and shall ensure that a natural person reviews and validates all AI Agent outputs, reports, and Customer Data modifications before reliance or operational use; (C) Customer shall not use, and shall ensure the AI Agent does not use, the Software or Services in any manner that circumvents or interferes with access controls, rate limits, security measures, or usage restrictions, or that exceeds the scope of the AI Agent Consent; (D) Customer represents and warrants that its agreements with the AI Agent’s provider do not permit such provider to retain, use, or train on Customer Data, Confidential Information, or any other information obtained from the Software or Services, and that Customer has obtained all rights and consents necessary for the AI Agent to process Customer Data (including any Personal Data, CJI, or Digital Evidence, as defined in Exhibit A); (E) any provider of an AI Agent is a subprocessor or vendor of Customer, not of Blazestack, and Blazestack has no responsibility for such provider; (F) Customer shall maintain complete logs of the AI Agent’s Account Activity and provide them to Blazestack upon request; (G) Customer shall ensure that the AI Agent identifies itself to the Software and Services as an automated agent, and as the specific AI Agent covered by the AI Agent Consent, in the manner Blazestack specifies from time to time (which may include a designated user-agent string, API header, account flag, or dedicated credential); and (H) Customer shall not permit the AI Agent to represent itself as, or to be presented to Blazestack as, a natural person, or to access the Software or Services using the credentials, session, or identity of a natural-person User.
(iv) Responsibility for Account Activity. As between Customer and Blazestack, all Account Activity is deemed to be the act of Customer, and Customer is solely responsible and liable for all Account Activity and all consequences thereof, including any Account Activity performed by an AI Agent (whether or not subject to an AI Agent Consent, whether or not authorized or intended by Customer or any User, and whether or not the AI Agent functioned as designed or intended), and including any resulting input, alteration, corruption, disclosure, export, or deletion of Customer Data, any report generated, any Fees incurred, and any breach of this Agreement or applicable law. Blazestack is entitled to treat all Account Activity as authorized by Customer and to act in reliance on it. Blazestack has no responsibility or liability for any AI Agent, including its performance, availability, security, failure, errors, outputs, or decisions, or for any loss, harm, or damage to Customer, any User, or any third party arising from or related to any AI Agent or its Account Activity. To the extent permitted by applicable law, Customer waives any claim or defense that any Account Activity was unauthorized or was not Customer’s act because it was performed by an AI Agent or other automated means. Nothing in this Section 3(d)(iv) limits Customer’s obligations under Section 3(b)(iii) to prevent unauthorized access or to notify Blazestack of it.
(v) Detection and Blocking. Blazestack may deploy technical measures to detect, limit, challenge, or block automated or AI Agent access to the Software or Services. Blazestack has no liability for any such measures or for any resulting unavailability or degradation, and such measures shall not constitute a failure to meet any obligation under this Agreement, including Section 2(g).
(vi) Suspension of AI Agent Access. Notwithstanding Section 7(f) or any notice or cure period in this Agreement, Blazestack may suspend, restrict, or terminate the access of any AI Agent (whether or not covered by an AI Agent Consent) immediately and without prior notice if Blazestack determines, in its reasonable discretion, that the AI Agent (A) is being used in breach of this Agreement or in a manner that Blazestack considers abusive; (B) is consuming resources, generating requests, or otherwise using the Software or Services at a level that is excessive or that degrades or threatens the performance, stability, or security of the Software or Services for Customer or any other customer; or (C) presents a security, privacy, legal, or compliance risk to Blazestack, the Software, the Services, or any customer or vendor of Blazestack. Blazestack shall use commercially reasonable efforts to notify Customer of any such action and has no liability to Customer or any User for any such action. Any such action with respect to an AI Agent does not by itself suspend the access of Customer’s natural-person Users and is in addition to Blazestack’s rights under Section 7(f).
(vii) Survival. Customer’s obligations under this Section 3(d) and Section 8(d) with respect to Account Activity survive termination or expiration of this Agreement.
4. Fees.
(a) Fees. Customer shall pay all fees specified in all applicable Order Forms (“Fees”). Fees are quoted and payable in United States dollars and are non-refundable, except as described in Section 7 (Term and Termination). Acceptable forms of payment are limited to credit card, ACH, wire transfers, and physical check, provided that Blazestack may change acceptable forms of payment upon thirty (30) days’ notice to the Customer. User-Seats purchased but not utilized during the Term are not eligible for refunds.
(b) Implementation Fee. If applicable, the parties acknowledge and agree that Blazestack incurs substantial up-front costs and commits personnel, resources, and infrastructure upon commencement of implementation services, for implementation, project management, configuration, training, report template setup, SSO configuration, onboarding, and other deployment activities, which may result in an implementation fee as set forth in the Order Form (“Implementation Fees”). For the avoidance of doubt, to the extent applicable, the Implementation Fee shall be due immediately upon the complete execution of this Agreement and shall be separate from any Fees due hereunder and is non-cancelable and non-refundable under any circumstances.
(c) Taxes. Fees are exclusive of all taxes, including any applicable sales, excise, or use taxes (“Taxes”). Customer shall pay any Taxes directly or to Blazestack, as required by law. If Customer is exempt from paying Taxes, Customer shall provide Blazestack with a valid tax exemption certificate.
(d) Invoicing and Payment. All Fees shall become due immediately upon receipt of invoice and shall be payable on a net thirty (30) basis. Customer shall provide Blazestack with complete and accurate billing and contact information and promptly notify Blazestack of any changes throughout the Term. For Order Forms completed online, Customer authorizes Blazestack and its payment processor to charge Customer’s designated payment method for all Fees at the time the Order Form is completed and, for each Renewal Term, on or about the first day of that Renewal Term, and Customer shall keep its payment information current and complete. If Customer’s payment method is declined, Blazestack may suspend access under Section 7(f) until payment is received.
(e) Overdue Fees. If Blazestack does not receive all Fees when due, Blazestack may charge a late fee on the unpaid balance at the lesser of 1.5% per month or the maximum lawful rate, starting from the date the payment was due until the date paid. Customer shall also reimburse Blazestack for all reasonable costs incurred in collecting any amounts not paid when due, including any attorneys’ fees. Blazestack reserves all rights and available remedies to collect overdue Fees from Customer, including but not limited to suspending Customer’s access to the Software and Services until all Fees are paid.
5. Confidentiality.
(a) Protection of Confidential Information. Each party may have access to Confidential Information (“Receiving Party”) that is provided by the other party (“Disclosing Party”). Except to the extent required by Customer’s applicable public records law, each party shall hold Confidential Information in confidence and not, without the consent of the other, disclose it to a third party or use it for any purpose other than in performance of the Agreement. For the avoidance of doubt, the parties acknowledge and agree that this Agreement, including the contents contained herein, may be disclosed pursuant to Customer’s applicable public records law.
(b) Blazestack Confidential Information. Blazestack Confidential Information shall include, without limitation, information pertaining to the features, functionality, testing, Feedback and performance of the Software, each of which Customer shall treat as confidential, proprietary, and trade secret information of Blazestack to the fullest extent permitted by Customer’s applicable public records law. If Customer receives a request under any public records law for any Blazestack Confidential Information, Customer shall (i) promptly notify Blazestack in writing of the request, (ii) assert all exemptions from disclosure available under applicable law, and (iii) to the extent permitted by applicable law, give Blazestack a reasonable opportunity to object to or seek to prevent the disclosure before any Blazestack Confidential Information is released.
6. Proprietary Rights.
(a) Customer Ownership and Licenses. Customer owns all rights, title, and interest in and to Customer Data and any reports generated thereof. During the Term, Customer grants Blazestack a worldwide, non-exclusive, royalty-free, non-sublicensable (except as needed to provide the Software and Services), non-transferable (except as described in Section 11(e) (Assignment)) right to access and use the Customer Data to (i) provide the Software and/or Services to Customer; (ii) monitor and improve the Software and Services; (iii) perform troubleshooting, maintenance, or diagnostic screenings; and (iv) enforce this Agreement or policies governing use of the Software and Services. Customer shall back up Customer Data during the Term and may not have access to the Customer Data via the Software and Services after the Term. Except as outlined herein, Blazestack obtains no interest in Customer Data, and Customer Data is not Blazestack’s business records. Customer is solely responsible for uploading, sharing, managing, and deleting Customer Data. Blazestack will only have access to Customer Data for the limited purposes set forth herein.
(b) De-Identified Data. Blazestack may collect, develop, create, extract, compile, synthesize, analyze and commercialize statistics, benchmarks, measures and other information based upon Customer Data that is: (i) anonymized and not identifiable to any person or entity; (ii) combined with the data of other customers or additional data sources; and (iii) presented in a way which does not reveal Customer’s identity (collectively, “De-Identified Data”). De-Identified Data will be owned solely by Blazestack and may be used for any lawful business purpose.
(c) Feedback. If Customer provides recommendations, suggestions, enhancement requests or any ideas, technology, developments, derivative works, or other intellectual property related to the Software, Services, or Blazestack (“Feedback”), Customer grants to Blazestack sole and exclusive ownership to such Feedback, including any intellectual property rights therein, and the results of the implementation of such Feedback.
(d) Reservation of Rights. This is not a work-for-hire agreement. Blazestack and its licensors reserve all right, title and interest in and to the Software and Services, including all related intellectual property rights therein, subject to the limited rights expressly granted in this Agreement. No other rights are granted to Customer or any third party by this Agreement, whether by implication, waiver, estoppel, or otherwise, or including any intellectual property rights or other right, title, or interest in or to the Software or Services.
7. Term and Termination; Suspension.
(a) Term. The Term begins on the Effective Date and ends on the Termination Date (“Initial Term”). “Termination Date” means the earlier date of: (i) the expiration or termination of all Order Forms under this Agreement (or, for a Free Trial, the expiration or termination of the Trial Period); or (ii) termination of this Agreement under this Section 7.
(b) Automatic Renewal. Following the Initial Term, the subscription for the Software and/or Services set forth in each applicable Order Form will automatically renew for additional twelve (12) month term(s) (“Renewal Term”) at the prevailing list price as determined by Blazestack at the time of such renewal, unless either party receives written notice of an intent not to renew at least thirty (30) days before the end of the Initial Term or such subsequent Renewal Term (which notice Customer may give, for an Order Form completed online, by cancelling automatic renewal through Customer’s account settings or by emailing support@blazestack.com) (collectively, the Initial Term and the Renewal Term shall be the “Term”).
(c) Termination for Cause. A party may terminate this Agreement or any applicable Order Form: (i) if the other party is in material breach of this Agreement and fails to cure the breach within thirty (30) days of receiving written notice from the non-breaching party; or (ii) if the other party becomes the subject of a petition in bankruptcy or any proceeding relating to insolvency, receivership, liquidation or an assignment for the benefit of creditors. If Customer terminates due to Blazestack’s material breach, Customer’s exclusive remedy is a pro-rata reimbursement of prepaid Fees covering the remainder of the Term after the Termination Date. If Blazestack terminates due to Customer’s material breach, Customer will pay any unpaid Fees covering the remainder of the Term including and after the Termination Date. Termination under this Section 7 will not relieve Customer of its obligation to pay any Fees owed for the period prior to the Termination Date. Notwithstanding anything contained herein, as it relates to the appropriation of funds from Customer’s relevant governing authority, Customer shall not invoke the terms of this Section 7 (or any other provision of this Agreement) for convenience or to circumvent the requirements of this Agreement, but only as an emergency fiscal measure during a substantial fiscal crisis, which affects its governmental operations. Further, any such non-appropriation of funds by the governing authority of Customer (e.g., City Council or State Legislature) shall not absolve Customer of liability for payment of the Fees due hereunder, nor shall it absolve Customer of liability for its payment obligations for any unpaid portion of the Fee for portions of the Software or Services rendered under this Agreement prior to Customer’s new fiscal year, which such Fees shall remain due and payable to Blazestack by Customer.
(d) After Termination. Blazestack will not delete Customer Data for ninety (90) days following termination (“Post-Termination Period”). The Software and/or Services will not be functional during the Post-Termination Period other than the ability to retrieve Customer Data. Customer will not incur additional fees if Customer downloads Customer Data during the Post-Termination Period. Blazestack has no obligation to maintain or provide Customer Data after the Post-Termination Period and will thereafter, unless legally prohibited, delete all Customer Data. Upon request, Blazestack will provide written proof that it has successfully deleted and fully removed Customer Data from the Software and/or Services.
(e) Post-Termination Assistance. Blazestack will provide Customer with the same post-termination data retrieval assistance that Blazestack generally makes available to all customers. Requests for Blazestack to provide additional assistance in downloading or transferring Customer Data, including requests for Blazestack’s data egress service, will result in additional fees and Blazestack will not warrant or guarantee data integrity or readability in the external system.
(f) Suspension. Notwithstanding anything to the contrary in this Agreement, Blazestack may temporarily suspend Customer’s and any User’s access to any portion or all of the Software or Services if: (i) Blazestack reasonably determines that (A) there is a threat or attack on the Software or Services or Customer’s or any User’s use of thereof disrupts or poses a security risk to the Software, Services, Blazestack, or any customer or vendor of Blazestack; (B) Customer, or any User, is using the Software or Services for fraudulent or illegal activities, or in breach of Section 3(d), or Section 3(c)(x) through (xii), or Blazestack’s provision thereof is prohibited by applicable law; or (C) subject to applicable law, Customer has ceased to continue its business in the ordinary course or has become insolvent or declared bankruptcy or similar; (ii) any vendor of Blazestack has suspended or terminated Blazestack’s access to or use of any third-party services or products required to enable Customer to access the Software or Services; or (iii) Customer fails to pay any Fees when due (any such suspension described in subclause (i), (ii), or (iii), a “Software/Service Suspension”). Blazestack shall use commercially reasonable efforts to provide written notice of any Software/Service Suspension to Customer and to provide updates regarding resumption of access to the Software or Services following any Software/Service Suspension. Blazestack shall use commercially reasonable efforts to resume providing access to the Software and/or Services as soon as reasonably possible after the event giving rise to the Software/Service Suspension is cured. Blazestack will have no liability for any damage, liabilities, losses (including any loss of data or profits), costs, expenses, or any other consequences that Customer or any User may incur because of a Software/Service Suspension.
8. Warranties and Disclaimers; Indemnification.
(a) Mutual Warranties. Each party represents and warrants that it: (i) has the legal power to enter into this Agreement and will comply with all applicable federal, state and local laws, including, without limitation, import and export control laws and regulations; and (ii) will use reasonable efforts to avoid transmitting to the other party any harmful or malicious code, files, scripts, agents or programs.
(b) Customer’s Representation and Warranties. Customer shall be solely responsible for (i) ensuring Customer owns Customer Data or has the necessary rights to use Customer Data; (ii) ensuring no Customer Data or any User’s use thereof violates this Agreement or applicable laws; (iii) maintaining necessary computer equipment and Internet connections for use of the Software and Services; (iv) verifying the accuracy of any auto generated or AI-generated reports; and (v) ensuring that no AI Agent accesses or uses the Software or Services except in accordance with Section 3(d). If Customer becomes aware of any violation of this Agreement by any User, it will immediately terminate such User’s access to the Software and/or Services.
(c) Warranty Disclaimer. Blazestack hereby disclaims that the functions performed by the Software and Services will meet all of Customer’s requirements, that the operation of the Software and Services will be uninterrupted or error free, that all defects in the Software and Services will be corrected, and that the Software and Services will be available in all languages or all countries. THE WARRANTIES SET FORTH IN THIS AGREEMENT BY BLAZESTACK ARE EXCLUSIVE. THE SOFTWARE, SERVICES, AND ANY THIRD PARTY PRODUCTS ARE PROVIDED “AS IS.” EXCEPT AS EXPRESSLY PROVIDED HEREIN, BLAZESTACK MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, INFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. SPECIFICALLY, THIRD PARTY CONTENT AND TEST FEATURES ARE PROVIDED “AS IS,” EXCLUSIVE OF ANY OTHER WARRANTIES. EACH PARTY DISCLAIMS ALL LIABILITY AND INDEMNIFICATION OBLIGATIONS FOR ANY HARM OR DAMAGES CAUSED BY ANY THIRD-PARTY NETWORKING AND/OR HOSTING PROVIDERS.
(d) Indemnification. To the extent permitted by applicable laws, Customer shall indemnify, defend, and hold harmless Blazestack and its officers, directors, employees, agents, successors, and assigns against all losses arising out of or resulting from any third party claim, suit, action, or proceeding related to or arising out of or resulting from: (i) Customer’s (or any User’s) breach of any representations, warranties, covenant, or obligations under this Agreement, (ii) all matters related to any report generated by Customer from the Software and/or Services, (iii) the transmission of harmful or malicious code, files, scripts, agents or programs by or through Customer (or its Users), (iv) any intellectual property infringement or other matter resulting from the Customer Data, (v) any acts or omissions of Customer (or its Users), and (vi) any Account Activity, including any access to or use of the Software or Services by an AI Agent (whether or not authorized by Customer) and any resulting data exfiltration, unauthorized access, scraping, infringement or misappropriation of intellectual property, security incident, or breach of applicable law.
9. Limitation of Liability.
(a) Limitation of Liability. IN NO EVENT WILL EITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER HEREUNDER IN THE 12 MONTHS PRECEDING THE INCIDENT GIVING RISE TO THE LIABILITY. THE FOREGOING LIMITATIONS WILL NOT APPLY TO CUSTOMER’S PAYMENT OBLIGATIONS OR CUSTOMER’S WILLFUL MISCONDUCT, FRAUD, NEGLIGENCE, OR INDEMNIFICATION OBLIGATIONS.
(b) Exclusion of Certain Damages. IN NO EVENT WILL EITHER PARTY HAVE ANY LIABILITY TO THE OTHER PARTY FOR ANY LOST PROFITS, REVENUES, OR FOR ANY OTHER CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, STATUTORY, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOSS OF USE, LOSS OF TIME, INCONVENIENCE, LOST BUSINESS OPPORTUNITIES, DAMAGE TO GOOD WILL OR REPUTATION, AND COSTS OF COVER, REGARDLESS OF WHETHER SUCH LIABILITY IS BASED ON BREACH OF CONTRACT, TORT, STRICT LIABILITY OR OTHERWISE, AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR SUCH DAMAGES COULD HAVE BEEN REASONABLY FORESEEN, HOWEVER CAUSED, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY. THE FOREGOING WILL NOT APPLY TO THE EXTENT PROHIBITED BY APPLICABLE LAW.
10. Government Matters.
(a) Terms for U.S. Government Customers. This section applies only to Customers that are U.S. government entities subject to the cited regulations (“U.S. Government Customers”). The Software and Services are a “commercial product” (as defined in 48 C.F.R. 2.101) and involves the use of “commercial computer software” and “commercial computer software documentation” (as used in 48 C.F.R. 12.212). All U.S. Government Customers acquire subscriptions to the Software and Services only as a “commercial product” and only with those rights that are granted to all other end-users pursuant to the terms and conditions of this Agreement, consistent with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4.
(b) Non-Discrimination. The parties covenant to conduct business in compliance with applicable federal non-discrimination laws and neither party will discriminate against any person based upon race, religion, creed, color, sex, gender identity and express, pregnancy, childbirth, breastfeeding, medical conditions related to pregnancy, childbirth, or breastfeeding, sexual orientation, marital status, age, national origin, ancestry, genetic information, disability, veteran status, or any other class protected by local, state, or federal law.
11. General Terms.
(a) Dispute Resolution; Governing Law; Forum. The parties shall first attempt to resolve any dispute through mediation. The parties shall jointly select a mediator and shall participate in good faith in the mediation process. The costs of the mediation process shall be shared equally by the parties. The mediation shall take place through virtual/online mediation. If the dispute is not resolved through mediation within 90 days from receipt by one party of the initial notice of the dispute from the other party, either party may proceed to court to seek resolution. Each party waives its right to a jury trial. The laws of the State in which Customer is situated shall govern this Agreement, excluding that State’s choice-of-law provisions. Venue for any disputes that are unsuccessfully resolved via mediation and proceed to legal action shall take place in the County and State in which the Customer is situated.
(b) Notices. Notices under this Agreement must be in writing and will be considered given upon: (i) delivery by traceable courier or mail (delivery confirmation/ return receipt requested); or (ii) the second business day after sending by email. Notices to Blazestack should be sent to notice@blazestack.com. Billing notices and notices relating to this Agreement will be sent to the email address provided by Customer in the Order Form, at registration, or in Customer’s account settings, as most recently updated by Customer.
(c) Customer References. During the Term, Blazestack may include Customer’s name, logo and success stories in Blazestack’s website, press releases, promotional and sales literature, and lists of customers.
(d) Force Majeure. Neither party shall be liable hereunder for any failure or delay in the performance of its obligations under this Agreement, except for the payment of Fees, if such failure or delay is on account of causes beyond its reasonable control, including civil commotion, war, fires, floods, accident, earthquakes, inclement weather, telecommunications line failures, electrical outages, network failures, governmental regulations or controls, casualty, strikes or labor disputes, terrorism, pandemics, epidemics, local disease outbreaks, public health emergencies, communicable diseases, quarantines, or acts of God, in addition to any and all events, regardless of their dissimilarity to the foregoing, beyond the reasonable control of the party deemed to render performance of the Agreement impracticable or impossible, for so long as such force majeure event is in effect. Each party shall use reasonable efforts to notify the other party of the occurrence of such an event within five (5) business days of its occurrence.
(e) Assignment. Neither party may assign any of its rights or obligations under this Agreement without the other party’s prior written consent (not to be unreasonably withheld). Notwithstanding the foregoing, either party may assign this Agreement in its entirety without the other party’s consent to its affiliate or as part of a merger, acquisition, corporate reorganization, or sale of all or substantially of all its assets.
(f) Relationship of the Parties. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties.
(g) Waiver. No failure or delay by either party to exercise any right under this Agreement will constitute a waiver of that right, unless expressly stated in this Agreement.
(h) Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, the provision will be modified to the minimum extent necessary to make it enforceable. This provision will be disregarded only if such modification is not possible or is prohibited by applicable laws. The remaining provisions of this Agreement will remain in full force and effect.
(i) Order of Precedence. If there is a conflict or inconsistency among the documents comprising this Agreement, the following order of precedence shall apply, with each document controlling over those listed after it: (i) the applicable Order Form; (ii) Exhibit A (Data Processing Addendum), solely with respect to the Processing of Personal Data, Agency Data, CJI, and Digital Evidence; (iii) Exhibit B (Artificial Intelligence Supplemental Terms), solely with respect to the AI Features; and (iv) these Terms and Conditions. Any statement in an Exhibit that such Exhibit controls or governs is subject to this Section 11(i). Notwithstanding the foregoing, Section 12 controls over any conflicting provision of this Agreement with respect to a Free Trial.
(j) Entire Agreement; Amendment. This Agreement, including any applicable Order Forms, constitute the entire agreement between the parties with respect to the subject matter set forth herein, and supersedes all prior and contemporaneous agreements, proposals, or representations, written or oral, concerning its subject matter. No terms, provisions, or conditions of any purchase order, acknowledgement, addendum, rider, clickwrap, or clickthrough arrangement, or other business form that Customer may use in connection with the use of the Software or Services will have any effect on the rights, duties, or obligations of the parties under this Agreement, regardless of any failure of Blazestack to object to such terms. Without limiting the foregoing, no terms of service, license, or policy of any AI Agent provider shall bind Blazestack or modify this Agreement. As used in this Agreement, the terms “including,” “include,” and “includes” are not limiting and shall be deemed to be followed by the phrase “without limitation.” Use of the terms “hereunder,” “herein,” “hereby,” and similar terms refer to this Agreement. No modification, amendment, or waiver of any provision of this Agreement shall be effective unless in writing and signed by both parties hereto, except as expressly provided in Section 14 of Exhibit B and Section 12(h). This Agreement may not be amended, supplemented, or otherwise modified by handwritten notes, annotations, strikeouts, or other markings on the document and any such markings or changes shall be void and of no force and effect.
(k) Headings. Headings are for reference only and do not affect the meaning or interpretation of this Agreement.
(l) Counterparts. This Agreement may be executed in one or more counterparts. Each counterpart is an original. All counterparts together form one document. Electronic signatures, and electronic acceptance of this Agreement in accordance with Section 12, are effective as originals and satisfy any requirement under this Agreement or applicable law that this Agreement be in writing or signed.
12. Free Trial Terms.
(a) Applicability. Blazestack may, in its discretion, make the Software and/or Services available to Customer on a free, trial, evaluation, pilot, or similar basis without an Order Form (a “Free Trial”). This Section 12 applies to every Free Trial and, during the Trial Period, controls over any conflicting provision of this Agreement. Except as expressly modified by this Section 12, all provisions of this Agreement (including Sections 3, 5, 6, 8, 9, and 11 and Exhibits A and B) apply to the Free Trial, and each individual who accesses the Free Trial on Customer’s behalf is a User.
(b) Acceptance; Authority. Customer accepts this Agreement for a Free Trial by clicking “I Agree” (or a similar button or checkbox), by registering for an account, or by accessing or using the Software or Services, whichever occurs first (the date of such acceptance, the “Trial Start Date”). The individual accepting this Agreement represents and warrants that he or she is at least eighteen (18) years of age, is an employee or authorized agent of Customer, and has the authority to bind Customer. If Customer is a governmental entity, the individual further represents that Customer’s applicable procurement and contracting rules permit Customer to accept this Agreement electronically for the limited purpose of a no-cost evaluation.
(c) Trial Period. The Free Trial begins on the Trial Start Date and continues for fourteen (14) days, or such other period as Blazestack specifies in writing at registration or thereafter (the “Trial Period”). Blazestack may extend, shorten, suspend, or terminate the Trial Period at any time, for any reason or no reason, without notice and without liability. The Free Trial expires automatically at the end of the Trial Period and does not renew or convert to a paid subscription. Section 7(b) does not apply to a Free Trial. To continue using the Software or Services after the Trial Period, Customer must complete an Order Form.
(d) No Fees; Trial Limits. No Fees are payable for a Free Trial. Blazestack may limit, restrict, or disable any feature, functionality, AI Feature, integration, storage, Annual Case Volume, number of Users, or other aspect of the Software or Services during a Free Trial, and may modify any such limit at any time.
(e) Trial Data. The Free Trial is provided for evaluation purposes only. Unless Blazestack expressly confirms otherwise in writing, Customer shall use only test, sample, or de-identified data in the Free Trial and shall not submit to the Free Trial any CJI, Digital Evidence from an active investigation, or Personal Data (each as defined in Exhibit A). To the extent Customer nonetheless submits any such data, Exhibit A applies to Blazestack’s Processing of it. Customer is solely responsible for exporting any Customer Data it wishes to retain before the end of the Trial Period. Blazestack may delete all Customer Data in the Free Trial environment at any time after the end of the Trial Period without notice and has no obligation to retain, return, or make available any such Customer Data. Section 7(d) and Section 7(e) do not apply to a Free Trial.
(f) No Service Levels; Support. Sections 2(g), 2(h), and 3(a)(ii) do not apply to a Free Trial. Blazestack has no obligation to provide any support, maintenance, uptime, or availability for a Free Trial and may do so, if at all, in its sole discretion.
(g) Disclaimer; Limitation of Liability. WITHOUT LIMITING SECTION 8(c) OR SECTION 9, THE FREE TRIAL IS PROVIDED “AS IS” AND “AS AVAILABLE,” MAY CONTAIN BUGS, ERRORS, OR DEFECTS, AND IS PROVIDED WITHOUT ANY WARRANTY, SERVICE LEVEL, SUPPORT, OR INDEMNITY OBLIGATION OF BLAZESTACK. NOTWITHSTANDING SECTION 9(a), BLAZESTACK’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO A FREE TRIAL SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100). Section 11(c) (Customer References) does not apply to a Free Trial unless and until Customer completes an Order Form.
(h) Modifications. Notwithstanding Section 11(j), Blazestack may modify this Agreement as it applies to Free Trials by posting the modified terms within the Software or at the location where this Agreement is presented for acceptance, or by notice to the email address provided at registration. Modifications take effect upon posting or notice, and Customer’s continued access to or use of the Free Trial after that time constitutes acceptance of the modified terms. If Customer does not agree to a modification, Customer’s sole remedy is to stop using the Free Trial.
(i) Conversion. If Customer completes an Order Form during or after the Trial Period, this Section 12 ceases to apply as of the date Customer completes that Order Form, and Blazestack may, at Customer’s request and in Blazestack’s discretion, migrate Customer Data from the Free Trial environment to Customer’s paid subscription. Blazestack does not warrant the completeness or integrity of any migrated Customer Data.
Exhibit A
(Data Processing Addendum)
This DPA is incorporated into and part of the Master Service Agreement (“MSA”) (as defined below) between the Controller and Processor (collectively, the “Parties”). This DPA reflects the parties’ rights and obligations with respect to Personal Data, Agency Data, and other Criminal Justice Information and Digital Evidence Processed as part of the Services (all as defined below). In the event of a conflict between the terms of this DPA and the MSA with respect to the subject matter herein, the terms of this DPA govern, subject to Section 11(i) of the MSA. Any prior data protection agreements between the Parties are superseded and replaced by this DPA in their entirety. All capitalized terms not defined in this DPA will have the meaning given to them in the MSA.
1. Definitions. For the purposes of this DPA, the following terms shall have the meanings specified below.
“Agency Data” means all data, content, files, evidence, reports, logs, and information provided by or collected on behalf of the Controller through use of the Services, including Personal Data and Criminal Justice Information.
“Breach Event” means any incident where security is compromised, resulting in unintentional or illegal destruction, misplacement, modification, or unauthorized sharing or access to Personal Data that has been transmitted, stored, or otherwise processed.
“Criminal Justice Information” or “CJI” means information as defined by the FBI CJIS Security Policy, including but not limited to criminal histories, arrest data, NCIC-derived data, investigative data, or other law enforcement sensitive content.
“Data Privacy Laws” means all applicable laws and regulations relating to the processing, privacy, and/or use of Personal Data, as applicable to either party or the Services, including jurisdictional, industry-specific, or data-specific laws and regulations including, but not limited to: the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), the United Kingdom Data Protection Act of 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended and including its regulations (“CCPA”), and other applicable U.S. state and federal laws.
“Data Subject” refers to the identified or identifiable natural person whose Personal Data is processed.“Digital Evidence” means any media uploaded or processed through the Services, including photographs, videos, scans, phone extractions, DVR exports, accelerant test results, and related metadata.
“Personal Data” “PII” or “personal data” refers to any information that is tied to a Data Subject that is protected as personal data, personal information, or personally identifiable information under applicable Data Privacy Laws.
“Personnel” refers to the employees or other individuals who are in a contractual relationship with the Processor, including employees or other individuals who are in a contractual relationship with the Sub-Processor.
“Processing” or “Process” means actions performed by the Processor on the Personal Data whether by automated means or not, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Services” means any products or services provided by the Processor pursuant to the MSA.
“Subprocessor” or “Subcontractor” refers to any third party appointed by the Processor to assist in fulfilling its obligations in providing Services to the Controller.
2. Purpose and Role of the Parties. The purpose of this DPA is to define the conditions under which the Processor shall process Personal Data on behalf of the Controller. To the extent that Customer is the Controller of Personal Data, Blazestack is its Processor. To the extent that Customer is a Processor of Personal Data, Blazestack is its Subprocessor. Notwithstanding the foregoing, to the extent any usage data and/or operations data in connection with Customer’s use of the Services (“Non-Personal Data”) is considered Personal Data, Blazestack is an independent data Controller and shall Process such data in accordance with the Agreement and applicable Data Privacy Laws to develop, improve, support, and operate the Services.
3. Scope and Purposes of Processing. This DPA applies to all Personal Data, Agency Data, CJI, and Digital Evidence that Blazestack Processes to provide the Services. Blazestack will Process Personal Data (i) in compliance with Data Privacy Laws; (ii) on Customer’s behalf and in accordance with Customer’s reasonable instructions as mutually agreed upon by the parties; and (iii) to provide the Services to Customer, unless other Processing activities are required to comply with Data Privacy Laws (in which case, Blazestack shall provide prior notice to Customer of such legal requirement, unless such Data Privacy Laws prohibits the disclosure). Blazestack will not (i) share or sell the Personal Data, Agency Data, CJI, and Digital Evidence; (ii) utilize the Personal Data, Agency Data, CJI, and Digital Evidence for advertising or any purpose that is not related to the provision of the Services.
4. Compliance with Laws. The Processor warrants that any Processing activities performed on behalf of the Controller will be conducted in accordance with all applicable Data Privacy Laws. The Processor shall utilize commercially reasonable efforts to notify the Controller in writing if it is no longer able to meet its obligations under applicable Data Privacy Laws.
5. Ownership of Personal Data. All Personal Data and Agency Data processed by the Processor in performing the Services shall remain the property of the Controller.
6. Duration of Processing. Processing obligations under this DPA will begin on the Effective Date (as defined in the MSA) and run until the end of the Processor’s provision of Services to the Controller.
7. Types of Data. The Processor will Process the following categories of CJI, Agency Data, Digital Evidence, and Personal Data provided by the Controller: case management information, Digital Evidence storage and integrity preservation, chain-of-custody preservation, and such other information as necessary to provide the Services.
8. Instructions for Processing. The Processor shall only Process Personal Data in accordance with this DPA, except where otherwise required by applicable law (and in such a case, shall inform the Controller of that legal requirement before processing, unless applicable law prevents it from doing so on important grounds of public interest). The Processor shall inform the Controller if any instruction relating to the Personal Data infringes or may infringe any Data Privacy Laws.
9. Data Subject’s Rights. Customer retains the right to take reasonable and appropriate steps to (i) ensure that Blazestack Processes Personal Data, Agency Data, CJI, and Digital Evidence in accordance with Data Privacy Laws, and (ii) upon notice, stop and remediate unauthorized Processing of Personal Data, Agency Data, CJI, and Digital Evidence.
10. Data Protection Impact Assessments. The Processor shall provide reasonable assistance to the Controller in performing data protection impact assessments related to the Processing of Personal Data, Agency Data, CJI, and Digital Evidence. At the Controller’s reasonable request, the Processor shall provide all reasonably necessary information the Controller needs to meet its data protection assessment obligations.
11. Confidentiality. Both Parties agree to maintain the confidentiality of Personal Data Agency Data, CJI, and Digital Evidence and not to disclose such data except as expressly permitted under the terms of this DPA or the MSA. The Processor shall ensure that all Personnel authorized to Process Personal Data, Agency Data, CJI, and Digital Evidence are subject to binding confidentiality obligations no less restrictive than the terms set forth in the MSA.
12. Liability. The Parties agree to indemnify one another against any claims, including but not limited to damages and fines, arising out of their respective breaches of this DPA. Each Party’s liability is limited to the amount of damages directly caused by its breach of this DPA and is subject to the limitations and exclusions of liability set forth in Section 9 of the MSA.
13. Data Security. The Processor shall, at all times, implement and maintain appropriate technical and organizational security measures to ensure a level of security appropriate to the risk to protect the Personal Data, Agency Data, CJI, and Digital Evidence against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access. Blazestack maintains a documented information security program aligned with FBI CJIS Security Policy; SOC 2 / ISO 27001 principles, and law enforcement evidence integrity norms.
14. Breach Notification. The Processor shall promptly notify the Controller of a Breach Event involving the Controller’s data, or in any event within seventy-two (72) hours or pursuant to applicable Data Privacy Laws. If Blazestack is a processor, Blazestack will not assess the contents of Agency Data (or Customer Data, as defined in the MSA) for the purpose of determining if such data is subject to any requirements under Data Privacy Laws.
15. Subcontractor Requirements. Customer agrees that Blazestack may engage Subcontractors (alternatively referred to herein as Subprocessor) to Process Personal Data, Agency Data, CJI, and Digital Evidence, in the Processor’s sole discretion. Processor’s Subprocessors as of the Effective Date of the MSA are Amazon Web Services (AWS). Any provider of an AI Agent (as defined in the MSA) engaged by Customer is a processor or service provider of Customer, not a Subprocessor of Blazestack, and Customer is solely responsible for such provider’s Processing of Personal Data, Agency Data, CJI, and Digital Evidence obtained through the Services.
16. Destruction or Return of Data. Subject to any terms in the MSA regarding data deletion and/or retention that shall govern in the event of a conflict, Blazestack will, at the choice of Customer and upon Customer’s written request, return to Customer and/or securely destroy all Personal Data, Agency Data, CJI, and Digital Evidence, unless applicable Data Privacy Laws (or other applicable laws) requires Blazestack to retain such information.
17. Audits and Compliance. The Processor shall permit the Controller, or an independent auditor appointed by the Controller (at the Controller’s sole cost and expense), to conduct audits or inspections with reasonable notice during the Processor’s regular business hours to ensure compliance with the terms of this DPA, and applicable Data Privacy Laws. The scope of the audit shall be limited by the Parties to the systems, procedures, and documentation relevant to the Processing of Personal Data under the MSA. Audits may be requested no more than one (1) time annually. The Processor agrees to provide the Controller with all necessary cooperation, access, and support to conduct such audits. The Parties shall consider the findings of any such audit confidential information subject to the terms of the MSA and this DPA.
18. Recordkeeping Obligations. The Processor shall maintain complete, accurate, and up to date written records of all categories of processing activities carried out on behalf of the Controller and ensure such records shall include all information: necessary to demonstrate its compliance with this DPA and that each party is required to record and/or maintain under the applicable Data Privacy Laws.
Exhibit B
(Artificial Intelligence Supplemental Terms)
These AI Supplemental Terms are made a part of that certain Master Services Agreement (“MSA”) attached hereto and apply to the AI Features (as defined herein) provided as part of the Services. In the event of a conflict between these AI Terms and any other terms in the Agreement, these AI Terms control solely with respect to the AI Features, subject to Section 11(i) of the MSA. Nothing in these AI Terms constitutes a representation or warranty by Blazestack beyond those expressly set forth in Section 8 of the MSA, and Section 8(c) of the MSA applies to the AI Features and AI Customer Output.
1. Definitions. For purposes of these AI Terms, the following terms have the meanings set out below. Capitalized terms used but not defined in these Supplemental Terms shall have the meanings set out in the MSA.
“AI Customer Input” means information, data, materials, text, and prompts that is (a) input, entered, posted, uploaded, submitted, transferred, transmitted, or otherwise provided or made available by or on behalf of Customer or any User for processing by or through an AI Feature, or (b) collected, downloaded, or otherwise received by an AI Feature for or on behalf of Customer or any User.
“AI Customer Output” means information, data, materials, text, or other content generated or otherwise output from an AI Feature in response to AI Customer Input or from use of an AI Feature by or on behalf of Customer or its Users.
“AI Feature(s)” means any feature, functionality, or component of the Services that incorporates, uses, depends on, or employs any AI Technology.
“AI Technology” means any and all machine learning, deep learning, and other artificial intelligence technologies, including statistical learning algorithms, models (including large language models), neural networks, and other AI tools or methodologies, all software implementations of any of the foregoing, and related hardware or equipment incorporated into the Software and/or Services.
“Training Data” means any and all information, data, materials, text, and prompts, and other content that is used to train, validate, test, retrain, or improve any AI Technology incorporated into or used with, in connection with, or in support of, the AI Features, except for AI Customer Input, AI Customer Output, and Customer Data.
2. Access and Use of AI Features. The AI Technology and AI Features are intended to streamline and improve upon operations and functionality of the Software and Services and ensure data accuracy. The AI Technology and AI Features will only be used as described in these AI Terms or applicable documentation provided by Blazestack to Customer. All inquiries submitted into the AI Technology or AI Features are processed based upon Customer Data submitted, and Customer and its Users shall review and human-validate all AI Customer Inputs and AI Customer Outputs (Human-in-the-Loop) to ensure the legitimacy and accuracy of the work performed, and shall not use any AI Agent (as defined in the MSA) to perform such review or validation or otherwise to access or use the AI Features except in accordance with Section 3(d) of the MSA. Blazestack shall operate the AI Features consistent with Section 13 (Regulatory Alignment and Evolving Standards).
3. Use of LLMs.
(a) Blazestack selects the LLMs used in the AI Features for performance and reliability and shall use commercially reasonable efforts to ensure that such LLMs are operated within an architecture that is logically isolated from the LLM provider’s general infrastructure, encrypted in transit and at rest, version-pinned, subject to audit logging, and tested against the OWASP Top 10 for Large Language Model Applications and other recognized AI security practices as they evolve.
(b) Blazestack shall not, and shall contractually require its LLM providers not to, use Customer Data, AI Customer Input, or AI Customer Output as Training Data or otherwise to train, retrain, or improve any AI Technology.
(c) Blazestack shall maintain multi-tenant isolation and logical segregation designed to prevent Customer Data from being accessed by or disclosed to other customers through the AI Features. The LLMs do not have direct access to Customer’s databases, and the LLM gateway is not externally accessible; all inference requests are mediated through Blazestack’s controlled backend, which enforces organizational isolation, access control, and auditability. Blazestack shall contractually require its LLM providers not to retain AI Customer Input or AI Customer Output after inference, except as required by applicable law or for a limited period for abuse and misuse monitoring in accordance with such provider’s published terms.
4. Intellectual Property Ownership. Customer controls and owns all rights, title and interest in AI Customer Input, which may include Customer Data. Blazestack obtains no interest in AI Customer Input and will only access AI Customer Input for the limited purposes as outlined in these AI Terms or the MSA. As between the parties and subject to Blazestack’s rights in the Software, Services, and AI Technology, Customer owns the AI Customer Output, subject to Section 6(b) of the MSA (De-Identified Data). Customer acknowledges that AI Customer Output may not be unique and that other customers may receive similar or identical output from the AI Features.
5. Additional Use Restrictions. In addition to the use restrictions on Customer’s use of the Software and Services set out in the Agreement, Customer shall not and shall not permit any Users to: (a) access or use the AI Features or any AI Customer Output to develop, train, or improve any other AI Technology or a competing or similar Software or Service; (b) use web scraping, web harvesting, web data extraction or any other method to extract data from the Software, the Services, the AI Features, or any AI Customer Output; (c) use the AI Features to create or generate AI Customer Output, or use AI Customer Output in a manner, that Customer knows or should know infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or violates any applicable laws; (d) access or use the AI Features, or submit AI Customer Input, by means of any AI Agent (as defined in the MSA) except as permitted under Section 3(d) of the MSA; or (e) use any AI Customer Output as an input to, or to direct the actions of, any AI Agent that accesses the Software or Services.
6. Representations and Warranties. Each party represents, warrants, and covenants to the other party as follows:
(a) Blazestack is in compliance in all material respects with, and shall maintain compliance in all material respects with, all applicable laws related to its design, development, training, use, and provision of the AI Features under this Agreement. Customer is solely responsible for any notice, disclosure, or other obligation imposed on Customer under applicable law (including laws applicable to governmental entities) as a result of Customer’s deployment or use of the AI Features.
(b) Blazestack shall promptly notify Customer in writing if it becomes aware of any change in any applicable laws that would preclude Blazestack’s performance of its obligations related to the AI Features.
(c) Customer shall: (i) review AI Customer Outputs to ensure accuracy and appropriateness; (ii) maintain control over Customer Data and AI Customer Inputs shared with the AI Technology; (iii) comply with applicable laws when utilizing the AI Technology, AI Feature, the Software, and Services; (iv) monitor for potential issues with AI Customer Outputs, including false positives or negatives; and (v) provide timely feedback on Blazestack’s AI Technology’s and AI Feature’s performance.
7. Bias, Fairness, and Non-Discrimination. Blazestack shall implement reasonable technical and organizational measures designed to identify, assess, and mitigate material bias in the design, testing, and deployment of the AI Features. Such measures may include internal testing, evaluation against representative datasets, and periodic review of the AI Features’ performance. Customer acknowledges that AI Customer Outputs are probabilistic in nature and may reflect limitations inherent in machine-learning systems. Customer remains responsible for reviewing AI Customer Outputs prior to reliance or operational use.
8. Transparency, Limitations, and Model Performance. Blazestack shall make available documentation describing the general functionality, intended use, and known material limitations of the AI Features. Customer acknowledges that AI Features may generate outputs that are incomplete, inaccurate, or otherwise unsuitable for certain use cases. AI Features do not provide deterministic results, and performance may vary over time due to changes in data, context, or external conditions.
9. Model Drift and AI-Specific Incident Notification. Blazestack shall monitor the AI Features’ performance and may update, modify, or replace AI Technology to address performance degradation, security concerns, or legal requirements. In the event Blazestack becomes aware of a material degradation in an AI Feature’s performance, systemic hallucination patterns, or AI-specific operational anomalies that materially affect Customer’s use of the AI Features, Blazestack shall provide reasonable notice to Customer consistent with its incident management procedures.
10. Disallowed Content and Prohibited Inputs. Customer shall not, and shall not permit any User to submit AI Customer Input that includes or promotes the following:
(a) hate speech, harassment, or discrimination based on protected characteristics;
(b) sexual content and/or sexual content or any other content involving minors;
(c) explicit threats of violence or instructions to commit violent or criminal acts; and/or
(d) content that violates applicable law or infringes the rights of others.
The foregoing does not prohibit the submission of lawfully obtained evidence, witness statements, photographs, recordings, or other investigative materials for bona fide fire investigation purposes, provided Customer complies with applicable law and this Agreement. Blazestack disclaims all liability for AI Customer Outputs generated from disallowed or prohibited inputs (including AI Customer Inputs) and reserves the right to restrict, suspend, or terminate access to AI Features in response to misuse or violation of this section.
11. AI Output Disclaimer and Limitation of Reliance. AI Customer Outputs are provided for informational and assistive purposes only and do not constitute legal advice, investigative conclusions, or professional judgment. Blazestack does not make determinations, findings, or decisions on behalf of Customer, and any outputs (including AI Customer Outputs)—whether generated through AI Features or non-AI functionality—are intended solely to support, not replace, Customer’s independent analysis and expertise. Customer acknowledges that AI Customer Outputs may reflect limitations, statistical assumptions, or biases inherent in automated systems and must not be treated as definitive, authoritative, or determinative without independent human review and judgment.
12. Usage Controls, Rate Limiting, and Abuse Prevention. Blazestack reserves the right to implement reasonable usage limits, throttling, or rate controls on AI Features to maintain system stability, security, and equitable access across customers. Blazestack may restrict or suspend AI Feature usage in cases of excessive, automated (including any activity of an AI Agent (as defined in the MSA) not covered by an AI Agent Consent), abusive, or anomalous activity, provided such actions are consistent with the Agreement and applicable law.
13. Regulatory Alignment and Evolving Standards. Blazestack shall design and operate AI Features in a manner intended to align with applicable and emerging artificial intelligence laws, regulations, and recognized frameworks, including where applicable OWASP, NIST AI Risk Management Framework, and relevant ISO standards. Customer acknowledges that AI regulatory requirements are evolving, and compliance obligations may change over time.
14. Amendments to AI Supplemental Terms. Notwithstanding Section 11(j) of the MSA, Blazestack may amend these AI Terms to the extent required by applicable law or regulatory guidance or reasonably necessary to address a material security risk, upon at least thirty (30) days’ prior written notice to Customer describing the amendment. If Customer reasonably objects to a material amendment by written notice within such thirty (30) day period, Customer may discontinue its use of the affected AI Features without penalty and without affecting the remainder of this Agreement, and the parties shall negotiate in good faith any resulting adjustment to the Fees. Any other amendment to these AI Terms requires a writing signed by both parties in accordance with Section 11(j) of the MSA.