MOONSTAFF AI TERMS OF SERVICE

Version 1.6 Effective date: the date the client portal first presents this version

0. Reading this agreement

These Terms of Service ("Terms") are a binding contract between Moonstaff AI LLC, a Florida limited liability company ("Moonstaff", "we", "us"), and the business that accepts them ("Client", "you"). You accept these Terms on behalf of a business, for business purposes, and not for personal, family, or household purposes.

You accept these Terms by clicking the acceptance control presented with them and submitting an Order Form. That click is your electronic signature. Under the federal ESIGN Act (15 U.S.C. §7001 et seq.) and the Florida Uniform Electronic Transaction Act (Fla. Stat. §668.50) it may not be denied legal effect because it is electronic, and each party agrees to conduct this transaction electronically.

Defined terms. "Order Form" means the electronic form you submit selecting a plan, which records your business details, the plan you chose, the price, and the date. For a Custom AI Department, your Order Form is the Department Start Order you accept with these Terms. "Services" means the work Moonstaff performs for you under these Terms and your Order Form. "System" means, for the Lead Growth System, the seven-component set of automations Moonstaff installs and operates, as listed in the Service Description (version 1.4) displayed with these Terms and recorded with your acceptance under §13; and, for a Custom AI Department, the setup and process mapping described in the Department Start Order (version 1.1). "Moonstaff Platform" means the automations, agents, workflows, prompts, code, integrations, and configurations Moonstaff builds or operates to provide the System, other than Client Assets. "Client Assets" means the accounts, phone numbers, domains, and business listings held in your name; your customer, lead, and call data ("Client Data"); and the content you supply. "Deliverable" means an item Moonstaff delivers for you to keep and operate yourself, such as a document or a configured account in your name.

1. Structure of this agreement

1.1 What forms the contract. Your contract with Moonstaff consists of (a) these Terms, (b) the Order Form you submit, (c) for the Lead Growth System the Service Description, or for a Custom AI Department the Department Start Order, and (d) Moonstaff's Data Processing Addendum (the "DPA"), each in the version displayed with these Terms and recorded with your acceptance under §13. This is the only list of the documents that form your contract. Together they are the entire agreement (§12.9) and they supersede any prior proposal, quote, email, or conversation.

1.2 Order of precedence. If the Order Form and these Terms conflict, the Order Form controls for price, plan, term, and start date. The DPA controls as to personal data. These Terms control for everything else. This ordering is deliberate: the Order Form is the part you actually chose, so it should win on the commercial specifics. The Service Description describes the System; it does not override these Terms, the Order Form, or the DPA, and if it conflicts with any of them, that document controls. For a Custom AI Department, the Department Start Order controls for its fee, what the fee covers, and refunds.

1.3 When these Terms do NOT apply. These Terms govern month-to-month engagements only. An annual commitment — whether prepaid or billed monthly over a fixed term — is executed under a signed Master Services Agreement and Statement of Work, not under these Terms, and that signed agreement governs it. Under it, an annual term is a firm commitment that the client cannot end early for convenience. The term ends after twelve (12) months. It does not renew automatically. Moonstaff reminds the client in writing at least sixty (60) days before the term ends, stating the renewal price. The client renews for another twelve-month term by enrolling in the client portal before the term ends — billed monthly by autopay, or prepaid — or, where the plan offers one, moves to month to month. If the client does nothing, the plan ends with the term. A twelve-month plan is free from go-live to the end of the next full calendar month, and that time is a free trial, during which the client may end the plan and owe no plan fee (go-live on November 15: free to December 31; go-live on October 1: free to October 31). Its twelve-month term is the twelve calendar months from the 1st of the month after go-live (from go-live itself when go-live is on the 1st), so the free months are part of it. Billed monthly, the plan fee is charged on the 1st of each month after the free trial, eleven times. On the prepaid plan the prepaid fee is invoiced on the 1st after the free trial ends, and that month is also free (it is not a trial). A client who moves from month to month to a twelve-month plan after go-live gets the same free months, counted from the 1st after signing, without the free-trial exit (Annex E of the signed agreement). Month to month has no free trial (§3.11).

A Custom AI Department is built and run only under a Department Build Order, which Moonstaff presents in your client portal after mapping and which you are not obliged to sign. It incorporates Moonstaff's Master Services Agreement in the version it names. You sign it electronically in the portal: an owner, officer or LLC manager of record of your business types their full name and title and selects Sign. That is your electronic signature under the ESIGN Act and Fla. Stat. §668.50, for a 12-month term as well as month to month. Once signed, it governs the build and the monthly service and replaces the Department Start Order, except its sections 2 and 6 and the map already delivered.

1.4 Changes to these Terms. We may revise these Terms, the Service Description or the DPA. A revision applies to you only from the start of your next monthly billing period, and only after we have notified you at the email address on your Order Form at least fourteen (14) days in advance. If you do not accept a revision, you may cancel under §11.2 before it takes effect and you will owe nothing further. We will not apply a revised version retroactively to work already performed or already paid for. A revision does not change your fees; only §3.10 or a new Order Form can.

1.5 Amendments to your Order Form. A change to your plan, price, or scope requires a new Order Form accepted the same way, except a change to the monthly fee under §3.10. Neither party can amend by email, phone call, or course of conduct.

2. The Services

2.1 What we do. Moonstaff installs and operates the System for your business. Every engagement receives all seven components; there are no feature tiers. The components, and the order in which they are installed, are listed in the Service Description. These Terms contain no installation date or timeline; any timeline Moonstaff publishes is an estimate and is not a term of this agreement.

2.2 How we work. Moonstaff is an independent contractor. We control the manner, method, and schedule of our work, we supply our own tools and equipment, and we may engage subcontractors provided we remain responsible for their work under these Terms. Nothing here creates an employment, partnership, joint venture, or agency relationship, and neither party may bind the other.

2.3 What we do not do. Moonstaff does not provide legal, tax, accounting, medical, or regulatory advice. Moonstaff is not a marketing agency of record, does not act as your registered agent, and does not hold funds on your behalf.

2.4 Third-party services. The System depends on services Moonstaff does not own or control — telephony carriers, messaging providers, calendar and CRM vendors, model providers, and hosting platforms. Moonstaff is not responsible for a third party's outage, price change, policy change, account suspension, or discontinuation of service. Where a third party requires an account in your name, you hold that account and you are its customer.

2.5 Ad spend is never included. Advertising spend is paid by you, on your own payment method, in your own advertising accounts. Moonstaff never includes ad spend in its fees and never marks it up.

2.6 Support. You reach Moonstaff at hello@moonstaff.ai, on US Eastern business days. Moonstaff's target is a first response within two (2) business days of a request or of a report that something is not working, and it keeps you informed until the matter is resolved. It gives you notice before a planned change likely to interrupt the System, and before changing the AI model behind a component where the change could materially alter its output. These are targets, not guarantees: there is no uptime commitment, no service credit, and no after-hours support. When the System cannot complete a task, it routes the case to the person you name, with a notification, rather than failing silently.

2.7 Your accounts stay yours. You keep your phone numbers, CRM, calendar, business listings, advertising accounts, and domains. Moonstaff never ports or hosts your own phone number. Moonstaff provides one local phone number for your business, set up after your install fee is paid. You forward unanswered calls to that number, and the System sends your business's texts from it. That number remains Moonstaff's, and Moonstaff uses it only for calls and messages handled through the System for you.

2.8 Go-live. When the whole System is ready, Moonstaff tells you in the portal and by email. The whole System includes texting, so Moonstaff sends that ready notice only after the carriers have approved your texting registration (§6.6), unless texting is not part of your plan. Calls and chat may start answering for you before then; that does not start go-live or your monthly fee. If the carriers refuse your texting registration, or have not approved it within twenty (20) business days after Moonstaff files it, the System goes live without texting and your monthly fee starts then; texting is added if and when the carriers approve it, at no extra charge. Your monthly fee is unchanged. Go-live happens when you, or someone you have given portal access, select Accept your system, or, if you raise no specific problem in writing within two (2) business days of that notice, at the end of that period. Moonstaff fixes any specific problem you raise before go-live. Go-live starts your monthly fee: the go-live month is prorated and charged or invoiced at go-live (§3.1).

2.9 Custom AI Department. If your Order Form is a Department Start Order, these Terms apply to it with these differences. You pay the one-time start fee stated on it, in full, before mapping starts; no monthly fee arises under these Terms. §2.1, §2.8, §3.1, §3.2(a), §3.4, §3.5, §3.6, §3.10, §3.11 and §11.2 do not apply to it: the Department Start Order states what the start fee covers, when work starts and when the start fee is refunded, and you cancel it under its section 6. Any build or monthly service beyond the Department Start Order is only under a Department Build Order you sign electronically in your client portal (§1.3).

3. Fees and payment

3.1 What you pay. The install fee and the monthly fee are stated on your Order Form. The install fee is one-time and payable on acceptance; work starts when it clears (§3.4). The monthly fee starts at go-live (§2.8). For the calendar month in which go-live happens you pay a prorated part of the monthly fee, for the days from the go-live day to the end of that month (for example, go-live on the 5th of a 30-day month: 26/30 of the monthly fee), charged or invoiced at go-live. After that the monthly fee is charged or invoiced on the 1st of each month and recurs until you cancel. There is no free trial (§3.11).

3.2 How you pay. You choose one of two ways to pay on the same screen as your acceptance. Both cost the same — no surcharge or fee is added to either.

(a) Autopay from your business bank account or a card. You link the bank account, or enter the card, on Stripe's page and accept Stripe's payment authorization there. If you also check the separate Autopay box, you authorize Moonstaff, through Stripe, to charge that account or card for the install fee on acceptance, for the prorated go-live month at go-live (§3.1), and for the monthly fee on the 1st of each month after that, until you cancel. Moonstaff gives you at least ten (10) days' notice before charging a different amount. You can turn autopay off in the client portal at any time; the next month is then invoiced under (b), and turning autopay off does not cancel the Services. If a charge fails, Moonstaff sends that amount as an invoice under (b).

(b) Invoices. Moonstaff issues an invoice for each amount on your Order Form through Stripe, emailed to your business email and shown in the client portal, and you pay it on its Stripe invoice page by ACH from a US bank account or by card.

Moonstaff never receives or stores your card or bank account numbers; Stripe, the payment processor, holds them. An annual prepaid fee may be paid from a bank account or by card.

3.3 Payment terms. Invoices are due Net 15 from the invoice date; autopay charges are made on their due date. Amounts not paid when due accrue simple interest at 1.5% per month (18% per annum), or the maximum the law allows if lower, from the due date until paid. No other late fee applies.

3.4 Work starts when payment clears. Moonstaff begins work on your install after the install fee has cleared. This is not a credit decision; it is the point at which the engagement is real.

3.5 The install fee is non-refundable once the install starts. The install starts when Moonstaff sends you written notice, in the client portal or by email, that install work has begun. Before the install starts, or if it has not started within ten (10) business days after the install fee clears for a reason other than a delay on your side, Moonstaff refunds the install fee in full on your written request (an email to hello@moonstaff.ai is enough), to the payment method you used, within ten (10) business days of the request. After it starts, it is not, because it pays for work that has been done — except that Moonstaff refunds it in full if Moonstaff gives notice under §11.3 before go-live (§2.8), or if, before go-live, you end these Terms under §11.4 for Moonstaff's material breach that Moonstaff has not cured.

3.6 Monthly fees are not prorated, except the go-live month (§3.1). If you cancel mid-month, the Services continue to the end of that calendar month, that month's fee is due, and no later month is invoiced. See §11.2.

3.7 Taxes. Fees exclude sales, use, and similar transaction taxes. You pay any such tax that applies to the Services, other than taxes on Moonstaff's net income; Moonstaff states it on the invoice where it is required to collect it.

3.8 Expenses. Moonstaff does not bill expenses without your prior written approval.

3.9 Change requests. Work outside the System as described in your Order Form is billed hourly at the change-request rate stated on your Order Form, and only after you approve the estimate in writing.

3.10 Price changes. Moonstaff may change your monthly fee no more than once in any twelve (12) months, by no more than ten percent (10%), on at least sixty (60) days' written notice to the email address on your Order Form. The change takes effect on the 1st of a month. You may cancel under §11.2 before it takes effect; if you do, you never pay the changed fee. The install fee does not change after you accept.

3.11 No free trial. Month to month has no free trial and no free month: your monthly fee starts at go-live, the go-live month prorated (§3.1). You can still cancel at any time under §11.2. The free months, and the free trial in the first of them, are on the twelve-month plans only, under their signed agreement (§1.3). Referral months (Order Form) are added at the end of your plan.

4. Your obligations

4.1 What we need from you. The Services depend on you providing, promptly: access to the systems and accounts the System connects to, the information requested in portal onboarding, a named point of contact who can make decisions, and review or approval when we ask for it.

4.2 Delay. If a deadline slips because we are waiting on you, that is not a breach by Moonstaff, and fees continue to accrue. We will tell you in writing what we are waiting for.

4.3 Your accounts and credentials. You are responsible for the security of your own systems and for the accounts you grant us access to. Grant the least access that works, through an account you create for Moonstaff or a password-manager share — never by email or chat — and revoke it when the engagement ends.

4.4 Accuracy. You are responsible for the accuracy of what you tell us, including your business details, service area, pricing, hours, and the content of any message the System sends on your instruction.

4.5 Data you must not give us. Do not provide Moonstaff with protected health information, payment card numbers, government identification numbers, or account credentials except through the access controls Moonstaff specifies. These Terms are not available to a HIPAA covered entity or business associate; a health-care practice needs a signed agreement and a Business Associate Agreement instead.

4.6 Acceptable use. You will not, and will not let anyone else:

(a) copy, resell, sublicense, or give anyone access to the System, other than your own staff using it for your business;

(b) reverse engineer the System, or try to extract its source code, prompts, or workflows;

(c) circumvent the System's security or usage limits;

(d) use the System for any unlawful, deceptive, or harassing contact; or

(e) upload, or have the System use, content you do not have the right to use.

This §4.6 is in addition to §6, which governs outbound communications and third-party systems.

5. Intellectual property

5.1 Moonstaff background IP. Moonstaff retains all right, title, and interest in its methodologies, techniques, know-how, frameworks, templates, tools, libraries, and reference architectures existing before or developed independently of the Services, and in the general skills, knowledge, and experience of its personnel. Nothing in these Terms transfers that background IP to you.

5.2 Client Assets, Outputs, and the Moonstaff Platform. Client Assets are yours. To the extent Moonstaff holds any rights in the records, messages, and documents the System generates for you ("Outputs"), Moonstaff assigns them to you as they are created, and upon receipt of full payment it assigns to you the rights it may hold in any Deliverable. Moonstaff assigns nothing in the Moonstaff Platform. During the term you may use it as part of the Services; when these Terms end it is disconnected from your systems. Moonstaff makes no representation that any Output or Deliverable is eligible for copyright protection.

5.3 Licence to background IP. To the extent a Deliverable incorporates Moonstaff background IP, Moonstaff grants you a non-exclusive, perpetual, irrevocable, worldwide, royalty-free licence to use, modify, and create derivative works of that background IP solely as embodied in and as necessary to use the Deliverables. You receive no right to licence, sublicence, resell, or distribute Moonstaff background IP on a standalone basis.

5.4 Before payment. Until payment is received, Moonstaff retains all right, title, and interest in the Deliverables, and your use is a revocable licence limited to internal evaluation.

5.5 Third-party and open-source components. Deliverables may incorporate third-party or open-source components. Moonstaff will identify material components and their licences on request. You are responsible for complying with those licences in your use of the Deliverables.

5.6 Residual knowledge. Moonstaff may use general knowledge, skills, and experience gained performing the Services for other clients, provided Moonstaff does not use or disclose your Confidential Information.

5.7 Your materials. You retain all right, title, and interest in the materials, data, code, and systems you provide.

5.8 AI tools and models. Moonstaff uses artificial-intelligence tools and third-party AI models to provide the Services, and names the model providers in its subprocessor list (§7.4). You are responsible for human review of Outputs before relying on them for a decision with legal, financial, or safety consequences.

6. Outbound communications — read this section

This Section applies to everything the System sends — texts, emails, and calls — and to any third-party system it touches. It is the most important Section in these Terms for both parties.

6.1 You are the seller and sender. You are the seller, sender, and originator of every communication transmitted through the System. Every communication is sent in your name, on your behalf, to recipients you supply or authorize, using content, audiences, triggers, and schedules that you approve in writing or in the client portal (an "Approved Configuration"). Moonstaff operates the software that transmits those communications as your service provider, only as the Approved Configuration and this Section direct. Moonstaff does not supply contact lists, choose recipients, or send communications for its own purposes. Approving a configuration — such as an automatic reply to new inquiries, a reactivation sequence, or a post-appointment review request — is your instruction for every transmission it produces until you withdraw that approval.

6.2 You own compliance. You are solely responsible for the lawfulness of your communications and recipient lists and for any sender-reputation or deliverability consequence, including under: the Telephone Consumer Protection Act (47 U.S.C. §227) and 47 C.F.R. §64.1200; the Telemarketing Sales Rule; the CAN-SPAM Act; Fla. Stat. §501.059 and §§501.601–501.626; Tex. Bus. & Com. Code chapters 301, 302, 304 and 305 and Subchapter E of chapter 17; call-recording laws, including Fla. Stat. chapter 934 and Tex. Penal Code §16.02; artificial-intelligence disclosure laws; the CTIA Messaging Principles; and carrier and messaging-provider policies, including the Twilio Messaging Policy. Moonstaff provides no legal opinion as to whether any communication or list is permissible.

6.3 Consent. You will not submit, and will not instruct Moonstaff to message, any number or address unless you hold (a) for any marketing or promotional message, prior express written consent that names your business and meets 47 C.F.R. §64.1200(f)(9) and Fla. Stat. §501.059(1)(g); and (b) for any other message, at least prior express consent for that purpose. You will not use purchased, rented, shared, or appended lists, or consent obtained by or for another business. For each recipient you keep the consent language shown, the method, timestamp, source, and the number or address consented, for at least five (5) years after the last message, and produce those records to Moonstaff within two (2) business days of a request. Nothing is sent to an audience until you have given Moonstaff evidence of that consent.

6.4 Third-party systems and acceptable use. Where the System interacts with a third-party system, website, or public-sector platform, you are solely responsible for ensuring your use complies with that system's terms of service, acceptable-use policy, robots directives, rate limits, and any applicable institutional approval or vendor-registration requirement. You will obtain any approval that system's operator requires.

6.5 No circumvention. The System is designed to operate through a third-party system's intended interface and to preserve its access controls, including human completion of any anti-automation challenge. You will not modify, instruct any party to modify, or operate the System so as to bypass, defeat, or automate past any authentication, rate limit, CAPTCHA, or other access control. Any such modification or use (a) immediately voids all Moonstaff warranties as to the System, (b) is at your sole risk and liability, and (c) is grounds for immediate termination for cause.

6.6 Messaging registration. Business texting in the United States requires carrier registration (A2P 10DLC). Your business is the registered brand. Moonstaff, as your messaging-platform provider, files the brand and campaign registration in your business's name, under your legal name, EIN, address, and website. By accepting these Terms you authorize that filing. The person who accepts these Terms for your business (or, where an owner confirms an employee's order, that owner) is named in the filing as your authorised representative, and their name, title, email and mobile number go to the carriers; that person confirms they may give that authorization for your business. You warrant those details are accurate. Moonstaff writes the sample messages and the opt-in wording the filing needs, for your approval. Moonstaff hosts, for your business and in your business's name, a privacy policy page and an SMS terms page stating that mobile numbers and SMS opt-in data will not be shared or sold to third parties, affiliates, or lead generators for marketing or promotional purposes, and that Moonstaff operates the messaging on your behalf. Moonstaff publishes those pages only after you approve them in the client portal, and keeps them published while the System sends texts for you. You tell Moonstaff promptly if anything on them stops being true for your business. You are responsible for any telemarketing registration or exemption that applies to you (including Tex. Bus. & Com. Code chapter 302 and Fla. Stat. §501.608). Carrier review timelines are outside Moonstaff's control.

6.7 Opt-outs, timing, and frequency. The System processes STOP and equivalent replies immediately and sends no more than one confirmation. You enter any opt-out you receive another way in the portal within one (1) business day. Opt-outs are kept for your business alone and never shared with another Moonstaff client. Unless you set a stricter rule, the System sends only between 9:00 a.m. and 8:00 p.m. Monday to Saturday and 12:00 noon and 8:00 p.m. on Sunday, in the recipient's local time, and no more than three (3) messages or calls to a recipient on the same subject in any 24-hour period across all channels.

6.8 Calls, recording, and AI. Where the System answers calls, its greeting states at the start of every call that the caller is speaking with an AI assistant and that the call is recorded, and offers a person. It answers truthfully if asked whether the caller is speaking with a person. You will not ask Moonstaff to remove or shorten that disclosure.

6.8A Recording consent. You warrant that you have given every notice and obtained every consent the law requires — including under all-party consent laws such as Fla. Stat. chapter 934 — for any call recording, transcript, or other data you give Moonstaff or have the System collect, including any recording you upload for review or coaching. The disclosure in §6.8 covers only calls the System itself answers; it does not cover recordings of your own calls.

6.9 Moonstaff may pause. Moonstaff may pause any Approved Configuration, without liability, where it reasonably believes sending would breach this Section, the law, or a carrier or messaging-provider policy, and will tell you promptly why.

7. Confidentiality

7.1 Mutual obligation. Each party may receive information the other treats as confidential. Each party will use the other's Confidential Information only to perform under these Terms, will protect it with at least reasonable care, and will not disclose it except to personnel, subcontractors, and service providers (including Moonstaff's subprocessors under §7.4) who need it and are bound by comparable obligations.

7.2 Exclusions. Confidential Information does not include information that is or becomes public through no fault of the receiving party, was known to the receiving party without obligation before disclosure, is independently developed without use of the disclosing party's information, or is rightfully received from a third party without restriction.

7.3 Compelled disclosure. A party may disclose Confidential Information where legally compelled, provided it gives the other party prompt notice where lawful so that party can seek a protective order.

7.4 Your customer data. Moonstaff processes Client Data only to provide the Services and on your instructions — these Terms, your Order Form, and the configurations you approve. Moonstaff does not sell Client Data, does not use it for any other purpose, and does not use it or Outputs to train or fine-tune any AI model. Before Client Data reaches a provider, Moonstaff puts in place the no-training setting or terms that provider offers to Moonstaff, and tells you in writing before using one that offers neither (DPA §12(f)). Moonstaff keeps a list of the subprocessors that handle Client Data, gives it to you on request, and gives thirty (30) days' email notice before adding one. The DPA is part of your contract (§1.1) and controls as to personal data (§1.2).

7.5 Publicity. Moonstaff will not name you as a client, use your logo, or describe your results publicly without your separate written consent. Consent to a case study is never a condition of the Services and is never assumed from your acceptance of these Terms.

7.6 Security incidents. If Moonstaff becomes aware of unauthorized access to or acquisition of Client Data in systems Moonstaff operates, it notifies you in writing without undue delay and in any event within forty-eight (48) hours, or sooner where the law requires, with what is then known, and cooperates with you. You decide whether any notice to individuals or regulators is required and make it; Moonstaff does not notify them on your behalf without your written direction.

7.7 How long this lasts. These confidentiality obligations continue for three (3) years after these Terms end, except that trade secrets stay protected for as long as they qualify as trade secrets, and Client Data stays protected for as long as Moonstaff holds it.

7.8 Prior NDA. If you and Moonstaff signed a nondisclosure agreement before you accepted these Terms, from acceptance this Section 7 governs all information exchanged under it, including before acceptance, and that agreement ends. §12.9 does not release any of that information from protection.

8. Warranties and disclaimers

8.1 What Moonstaff warrants. Moonstaff warrants that it will perform the Services in a professional and workmanlike manner consistent with generally accepted industry practice, and that it has the right to grant the licences in §5.

8.1A Remedy. Your exclusive remedy for breach of §8.1 is, at Moonstaff's option, re-performance of the deficient Services or a refund of the fees paid for them, if you give written notice within ninety (90) days of performance.

8.2 No outcome warranty. Except as stated in §8.2A, Moonstaff does not warrant any specific business result. The System is designed to improve response time and follow-up consistency, both of which Moonstaff controls. It cannot control your market, your pricing, your close rate, your capacity, your reputation, or your customers' behaviour, and Moonstaff makes no representation about revenue, lead volume, booking rate, or return on investment.

8.2A Free months. Month to month has no free trial (§3.11). The free months of a twelve-month plan (§1.3) are a fee term, not a promise of any business result, and §8.2 applies in full.

8.3 AI output. The System uses large language models and other probabilistic systems. Their output varies between runs, can be wrong, and must not be relied upon as legal, medical, financial, or regulatory advice. You are responsible for reviewing output that reaches a customer where the message matters.

8.4 No warranty of uninterrupted service. Moonstaff does not warrant that the System or any Deliverable will be uninterrupted or error-free, and does not warrant the availability of any third-party service the System depends on.

8.5 EXCEPT AS STATED IN §8.1, THE SERVICES AND DELIVERABLES ARE PROVIDED "AS IS" AND MOONSTAFF DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

8.6 Your warranties. You warrant that you have authority to enter these Terms and to grant the access you grant, that the information you provide is accurate, and that your use of the System complies with §6.

9. Indemnification

9.1 By Moonstaff. Moonstaff will defend you against a third-party claim that a Deliverable, as delivered by Moonstaff and used as permitted, infringes that third party's US intellectual-property rights, and will pay damages finally awarded or a settlement Moonstaff approves. This obligation does not apply to a claim arising from your modification of a Deliverable, your combination of it with anything Moonstaff did not supply, your continued use after Moonstaff provides a non-infringing alternative, or your breach of §6. Moonstaff's obligations under this §9.1, including defence costs, are subject to §10.2.

9.2 By you. You will defend, indemnify, and hold harmless Moonstaff and its members, employees, and subcontractors from and against any third-party or governmental claim, and the resulting losses, damages, fines, settlements, and reasonable attorneys' fees, arising from:

(a) the content, timing, recipients, consent, or lawfulness of any communication transmitted under an Approved Configuration, including any claim under the TCPA, the CAN-SPAM Act, or a state analogue;

(b) your recipient lists, or the absence of the consent required by §6.3, or your breach of §§6.6–6.8A;

(c) your use of a third-party system in breach of §6.4, or any circumvention described in §6.5;

(d) any representation you make about Moonstaff's work to a customer, regulator, or third party that Moonstaff did not authorise in writing;

(e) your breach of law or of these Terms; and

(f) materials, data, or content you supply.

9.3 Procedure. The indemnified party will give prompt written notice, allow the indemnifying party to control the defence with counsel of its choosing, and cooperate reasonably. A settlement that imposes a non-monetary obligation on the indemnified party requires that party's consent. The indemnified party will not settle a claim without the indemnifying party's prior written consent, which will not be unreasonably withheld.

10. Limitation of liability

10.1 EXCLUSION OF INDIRECT DAMAGES. NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST OR CORRUPTED DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, OR COST OF SUBSTITUTE SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER THEORY OF LIABILITY, AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.2 CAP ON DIRECT DAMAGES. EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS AND YOUR ORDER FORM, TAKEN TOGETHER, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER THEORY, WILL NOT EXCEED THE TOTAL FEES YOU ACTUALLY PAID MOONSTAFF IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. THIS IS A SINGLE AGGREGATE CEILING, NOT A CAP PER CLAIM, PER DELIVERABLE, OR PER MONTH, AND IT IS NOT INCREASED BY THE NUMBER OF CLAIMS MADE.

10.3 Exceptions. The limitations in §10.1 and §10.2 do not apply to: (a) your obligation to pay fees due; (b) either party's breach of §7 (Confidentiality), except that Moonstaff's total liability for breach of §7 and for any security incident affecting Client Data will not exceed three (3) times the fees you paid in the twelve (12) months before the claim arose; (c) liability that cannot be limited under applicable law, including gross negligence, willful misconduct, and fraud; or (d) your indemnification obligations under §9.2(a), (b), (c), and (d).

10.4 Why §10.3(d) sits outside the cap. The claims described in §9.2(a)–(d) turn on decisions that are yours — the recipients you supply, the consent you hold, the content and configurations you approve, the representations you make about Moonstaff's work, and your own compliance with law. Moonstaff's fees are not priced to carry that exposure, and the parties agree it would be unreasonable for Moonstaff to bear such claims without limit while your obligation to defend them is capped. This allocation is an essential basis of the bargain.

10.5 Allocation of risk. The parties acknowledge that the fees reflect this allocation of risk, that these limitations are an essential basis of the bargain, and that they apply even if a limited remedy fails of its essential purpose.

10.6 Notice of claim. Except for payment claims, a party must give the other written notice of any claim arising out of these Terms, describing it in reasonable detail, within one (1) year after that party knew or reasonably should have known of the facts giving rise to it. Giving that notice is a condition of pursuing the claim. This Section does not shorten any limitations period fixed by law.

10.7 Persons protected. These limits also protect Moonstaff's members, employees, and subcontractors. You will bring any claim arising out of the Services only against Moonstaff, not against any of them personally, except for fraud or willful misconduct.

11. Term, cancellation, and what happens after

11.1 Term. These Terms begin when you accept them and continue month to month until either party ends them. There is no minimum term and no cancellation fee.

11.2 You cancel. You may cancel at any time, for any reason, from the Cancel control in your client portal, or by emailing hello@moonstaff.ai. Cancellation takes effect at the end of the calendar month in which you cancel. You keep the Services until then; that month's fee is due (in the go-live month, the prorated fee under §3.1); no later month is invoiced or charged, and autopay stops; nothing else is prorated.

11.3 We cancel for convenience. Moonstaff may end these Terms on thirty (30) days' written notice. If Moonstaff does so, you owe nothing beyond the period already served, and Moonstaff will refund any prepaid amount covering a period after termination — and, if the notice is given before go-live, the install fee in full (§3.5).

11.4 Either party cancels for cause. Either party may terminate immediately on written notice if the other materially breaches and fails to cure within ten (10) days of notice describing the breach. Non-payment more than fifteen days past due, and any breach of §4.6 (acceptable use) or §6.5 (no circumvention), are material breaches. If you terminate under this §11.4 for Moonstaff's uncured material breach before go-live, Moonstaff refunds the install fee in full (§3.5).

11.5 Suspension. Moonstaff may suspend the Services on written notice if your account is more than fifteen days past due, or immediately if continuing would expose Moonstaff to legal liability or breach a third party's terms of service. Suspension does not extend your billing period.

11.6 What survives. §5 (Intellectual property), §6 (Outbound communications), §7 (Confidentiality), §8 (Warranties and disclaimers), §9 (Indemnification), §10 (Limitation of liability), §11.7 (Handover), §12 (General), §13 (Acceptance record) and any accrued payment obligation survive termination.

11.7 Handover on termination. Within fifteen (15) days of termination, whatever the state of your account, Moonstaff will:

(a) transfer ownership of, or provide administrative access to, the accounts created for you in your name;

(b) provide an export of your Client Data held in systems Moonstaff operates for you — including consent records, the opt-out and do-not-contact list, and send logs — in a common machine-readable format (CSV or JSON);

(c) disconnect the Moonstaff Platform from your systems and leave them working as they did before the System was connected (you remove any call forwarding you set up, and the local number Moonstaff provided under §2.7 stops sending or answering for you and stays Moonstaff's); and

(d) then, within sixty (60) days of termination, delete your Client Data and Confidential Information from Moonstaff's systems, except where the law requires Moonstaff to keep it; copies in backups are deleted on the ordinary expiry of the backup cycle.

Moonstaff will not hold your data, your accounts, or your customer records hostage to a billing dispute. If we disagree about money, we resolve that separately; your data is yours.

12. General

12.1 Governing law. These Terms are governed by the laws of the State of Florida, without regard to its conflict-of-laws rules.

12.2 Venue and jury waiver. The state and federal courts located in Broward County, Florida have exclusive jurisdiction. Each party waives trial by jury. There is no arbitration clause and no class-action waiver in these Terms; either party may bring a claim in court, including small-claims court where it has jurisdiction.

12.2A Informal resolution first. Before filing suit, a party sends the other a written description of the dispute, and both try in good faith to resolve it for thirty (30) days after it is received. Any limitations period is paused during those thirty days. This step does not apply to a small-claims action, to an action to collect unpaid fees, or to a request for urgent injunctive relief. It does not change §12.1 or §12.2.

12.3 Notices. Notices to you go to the email address on your Order Form, or the address you later give Moonstaff in writing for notices. You keep that address current; a notice sent to the last address you gave is effective even if you no longer read it. Notices to Moonstaff go to hello@moonstaff.ai. Email notice is effective on the business day after it is sent.

12.4 Assignment. Neither party may assign these Terms without the other's written consent, except to a successor in a merger or sale of substantially all assets, on written notice.

12.5 Subcontractors. Moonstaff may use subcontractors and remains responsible for their performance and for their compliance with §7.

12.6 Force majeure. Neither party is liable for a delay or failure caused by an event beyond its reasonable control — including the failure or suspension of a carrier, messaging provider, AI-model provider, or cloud platform — provided it notifies the other and resumes performance promptly. Such an event is not a material breach. This does not excuse an obligation to pay amounts already due.

12.7 No waiver. A failure to enforce a provision is not a waiver of it.

12.8 Severability. If a provision is held unenforceable, it is modified to the minimum extent necessary to make it enforceable, or severed if it cannot be, and the remainder stays in force.

12.9 Entire agreement. The documents listed in §1.1 are the entire agreement between the parties on their subject matter, subject to §7.8.

12.10 Independent contractor; no agency. Moonstaff is an independent contractor. Neither party is the other's employee, partner, joint venturer, or agent, and neither may bind the other.

12.11 Attorneys' fees. In any action or proceeding to enforce or interpret these Terms, the prevailing party is entitled to recover its reasonable attorneys' fees and costs, including on appeal and in collection.

12.12 Business day. "Business day" means a day other than a Saturday, Sunday, or U.S. federal holiday.

13. How your acceptance is recorded

This Section describes what Moonstaff records when you accept these Terms. It is here so that the record is auditable by you, not only by us.

At the moment you accept, Moonstaff records:

• for each document listed in §1.1 — these Terms, the Service Description or the Department Start Order, and the DPA — its version and a SHA-256 cryptographic hash of the exact text displayed to you, so each document can be proven not to have changed since;
• what the acceptance screen showed: the exact versions and SHA-256 hashes of the documents shown, and the Order Form;
• that the accepting person's email address was verified before acceptance, by that person signing in to the portal with Google, with Microsoft, with a one-time code sent to that email address, or with an invite link emailed to that address, and how and when;
• the UTC timestamp of your acceptance;
• the name, role, and email address of the person accepting, and your business email;
• that person's representation of authority to bind your business, and — where that person is not an owner, officer, or LLC manager of record — the owner's confirmation, which Moonstaff obtains before anything is charged or invoiced;
• the IP address and user-agent string of the accepting browser;
• the contents of the Order Form submitted with the acceptance; and
• if you chose autopay, the exact Autopay text you agreed to, its version and UTC timestamp, the method (bank account or card), and the reference of the payment authorization Stripe recorded.

Moonstaff will provide you a copy of this record, and a PDF of each document listed in §1.1 in the version you accepted, on request at any time — and sends both to the accepting email address and to your business email immediately after acceptance without being asked.

Moonstaff AI LLC Florida limited liability company, document L26000012313 hello@moonstaff.ai

MOONSTAFF AI — SERVICE DESCRIPTION

Version 1.4

What you get

Every client receives all seven components, installed in the order below. There are no feature tiers. Each component is set up for your business, connected to the accounts you already use, and then operated by Moonstaff as part of the monthly service (Terms §2).

A component goes live when the setup steps it depends on are done — for example, nothing is texted until your messaging registration and consent evidence are in place, and nothing answers your calls until call forwarding is set up and tested (Terms §6; your setup checklist in the portal). The Terms contain no installation date.

Also included

• The client portal — your plan, invoices, payments, setup checklist and requests.
• Support on the terms in Terms §2.6 (email, US Eastern business days, a two-business-day response target).
• Changes to wording, schedules and audiences within the components above, approved by you in writing or in the portal (Terms §6.1).

Not included

• Advertising spend.
• Rebuilding your website beyond the capture form, or migrating or cleaning your data.
• Work on systems, accounts or channels not listed above; custom automations (the annual prepaid plan includes one custom internal tool, under its signed Statement of Work).
• Legal, tax or compliance advice — including whether a message or list is lawful (Terms §6.2).
• Use with protected health information (Terms §4.5).

What stays yours

Your phone numbers, website and domain, CRM, calendar, business listings, ad accounts, and your customer, lead and call data. When the service ends, the System is disconnected and your data is exported to you (Terms §11.7). The automations Moonstaff builds and runs are Moonstaff's platform and are not transferred (Terms §5.2).

DATA PROCESSING ADDENDUM — self-serve signup

Version 1.4

This Data Processing Addendum ("DPA") is between MOONSTAFF AI LLC, a Florida limited liability company (Florida document no. L26000012313), whose address for notices is c/o Registered Agents Inc., 7901 4th Street N, Suite 300, St. Petersburg, FL 33702, and hello@moonstaff.ai ("Moonstaff"), and the business that accepts the Moonstaff Terms of Service ("Client").

It forms part of, and is governed by, the agreement between them for Moonstaff's services — the Moonstaff Terms of Service and the Order Form Client accepts with them, on the date of acceptance recorded under Terms of Service §13 (the "Agreement"). Capitalised terms not defined here have the meaning the Agreement gives them.

1. Definitions

1.1 "Personal Data" means information within Client Data (ToS §0) that identifies, relates to, or is reasonably linkable to an individual — including Client's customers, leads, callers, and Client's own staff.

1.2 "Processing" means any operation performed on Personal Data, such as collecting, recording, storing, transcribing, analysing, sending, disclosing, or deleting it.

1.3 "Subprocessor" means a third party that Moonstaff engages to process Personal Data for the Services.

1.4 "Security Incident" means unauthorized access to or acquisition of Personal Data in systems Moonstaff or its Subprocessors operate. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks and other network attacks on firewalls or networked systems.

1.5 "Approved Configuration" has the meaning in ToS §6.1.

1.6 "Data Protection Law" means every law that applies to the Processing, including, as applicable: Fla. Stat. §501.171 and §§501.701–501.722; Tex. Bus. & Com. Code chapters 521 and 541 and §503.001; HIPAA and Tex. Health & Safety Code chapter 181; and any other state privacy, data-security, or breach-notification law.

2. Roles and scope

2.1 Client is the controller — it decides why and how Personal Data is processed. Moonstaff is its processor, service provider, and third-party agent, processing Personal Data only to provide the Services.

2.2 Whether a party acts as controller or processor is determined by the facts of the Processing (Tex. Bus. & Com. Code §541.104(e)). If Moonstaff ever decides the purpose of Processing itself, it is a controller for that Processing and this DPA does not excuse it.

2.3 Where Client is a HIPAA covered entity or business associate, protected health information is processed only under a Business Associate Agreement signed by both parties, which prevails over this DPA as to that information (§14).

3. Documented instructions

3.1 Moonstaff processes Personal Data only on Client's documented instructions. They are: the Agreement; the Order Form; each Approved Configuration; and any other instruction Client gives in writing or in Moonstaff's client portal that is consistent with the Agreement.

3.2 If Moonstaff believes an instruction breaches Data Protection Law, it tells Client promptly and may decline to follow it until Client confirms or changes it in writing. Declining under this Section is not a breach of the Agreement.

3.3 Schedule 1 sets out the nature and purpose of the Processing, the types of Personal Data, the categories of individuals, and its duration (Tex. Bus. & Com. Code §541.104(b)(1)–(4)).

4. Client's responsibilities

Client warrants and will ensure that:

(a) it has a lawful basis, and every notice and consent Data Protection Law requires, for Moonstaff to process Personal Data as the Agreement describes;

(b) it holds the messaging consent ToS §6.3 requires before any audience is messaged, and keeps the records that section describes;

(c) it publishes, and keeps published, a privacy notice that describes the Processing and states that mobile numbers and SMS opt-in data will not be shared or sold to third parties, affiliates, or lead generators for marketing or promotional purposes (the statement carriers require for messaging registration);

(d) it does not give Moonstaff sensitive data — health information, government identification numbers, precise geolocation, or data of known children (see also ToS §4.5); and

(e) the Personal Data it supplies is accurate and was collected lawfully.

5. Moonstaff's personnel

Everyone who processes Personal Data for Moonstaff is bound by a duty of confidentiality (Tex. Bus. & Com. Code §541.104(b)(6)(A)) and processes it only as this DPA permits.

6. Security

6.1 Moonstaff maintains reasonable administrative, technical, and physical measures to protect Personal Data from unauthorized access, destruction, use, modification, or disclosure (Fla. Stat. §501.171(2); Tex. Bus. & Com. Code §521.052(a)). Schedule 3 lists the measures in place today. Moonstaff may change them, but not so as to reduce the overall protection.

6.2 These measures cover data processed by the Services' AI components — prompts, call audio, transcripts, and model outputs — as well as stored records (Tex. Bus. & Com. Code §541.104(a)(2), as amended effective 2026-01-01).

6.3 Moonstaff disposes of Personal Data it no longer needs by erasing it or making it unreadable (Fla. Stat. §501.171(8); Tex. Bus. & Com. Code §521.052(b)).

6.4 Moonstaff makes no representation that the Services are certified under, or audited against, any security framework.

7. Security Incidents

7.1 Moonstaff notifies Client in writing without undue delay and in any event within forty-eight (48) hours of discovering a Security Incident, or sooner where Data Protection Law requires (including Tex. Bus. & Com. Code §521.053(c)). The notice gives what is then known — what was affected, when it was discovered, what Moonstaff has done, and what it recommends — and Moonstaff updates it as it learns more.

7.2 Moonstaff provides all the information Client needs to meet its own notification duties — in any event within ten (10) days of determining the Security Incident (Fla. Stat. §501.171(6)(a)) — and cooperates with Client's investigation, at Client's cost where the incident did not arise from Moonstaff's or its Subprocessor's act or omission.

7.3 Client decides whether any notification is required and makes it — for example, to individuals and the Florida Department of Legal Affairs under Fla. Stat. §501.171, or to individuals and the Texas Attorney General under Tex. Bus. & Com. Code §521.053. Moonstaff does not notify individuals, regulators, or the media about Client's data without Client's written direction, unless the law requires Moonstaff itself to.

7.4 Notice under this Section is not an admission of fault.

7.5 Notices that name Moonstaff. Client will consult Moonstaff in good faith before giving any notice to individuals, regulators or the public that names Moonstaff, except where law prevents it.

7.6 Client's own security. Client is responsible for securing its own accounts, credentials and devices, and anything it stores outside the System, as ToS §4.3 also provides.

8. Assistance

8.1 Individuals' requests. If Moonstaff receives a request from an individual about Personal Data (for example, to access, correct, or delete it), it forwards the request to Client within five (5) business days and does not respond to it itself except to acknowledge receipt. Moonstaff helps Client respond — by export, correction, or deletion — as far as the Services allow (Tex. Bus. & Com. Code §541.104(a)(1)).

8.2 Assessments and compliance. Moonstaff gives Client the information it reasonably needs to complete any data-protection assessment Data Protection Law requires of Client (§541.104(a)(3)).

8.3 Assistance beyond what the Services do in normal operation is at Client's cost, at the hourly rate in the Agreement.

9. Subprocessors

9.1 Client authorizes Moonstaff to use the Subprocessors listed in Schedule 2.

9.2 Moonstaff engages each Subprocessor under a written contract that requires it to meet obligations at least as protective as this DPA (Tex. Bus. & Com. Code §541.104(b)(6)(E)) and remains responsible for each Subprocessor's performance.

9.3 Moonstaff gives Client at least thirty (30) days' email notice before adding or replacing a Subprocessor. Client may object in writing within that period on reasonable data-protection grounds, and the parties will discuss the objection in good faith. If Moonstaff proceeds over the objection, Client may cancel under ToS §11.2 with no fee beyond the current month.

9.4 An emergency replacement needed to keep the Services running may be made on shorter notice, which Moonstaff gives as soon as it can, with the same objection right.

9.5 This Section is Client's written consent to Moonstaff's use of Subprocessors (ToS §7.4, §12.5).

10. Compliance information and assessments

10.1 Moonstaff makes available, on Client's reasonable request, the information needed to show it complies with this DPA (Tex. Bus. & Com. Code §541.104(b)(6)(C)).

10.2 Moonstaff allows and cooperates with reasonable assessments of its compliance by Client or an assessor Client designates who is bound by confidentiality and is not a Moonstaff competitor (§541.104(b)(6)(D)): no more than once in any twelve (12) months (unless after a Security Incident or at a regulator's demand), on thirty (30) days' written notice, starting with documents and written answers, during business hours, without access to other clients' data, and at Client's cost.

10.3 Instead of an assessment, Moonstaff may provide a report from an independent assessor that covers the same controls.

11. Return and deletion

11.1 When the Services end, Moonstaff exports Personal Data it holds for Client — including consent records, the opt-out and do-not-contact list, and send logs — in a common machine-readable format (CSV or JSON) within the time ToS §11.7 provides, and then deletes it within sixty (60) days after the Services end, except as §11.2 provides (§541.104(b)(6)(B)).

11.2 Copies in Moonstaff's routine backups are deleted on their ordinary expiry — at most thirty-five (35) days for database backups and ninety (90) days for replaced stored file versions — and are not used in the meantime except to restore the Services. Personal Data that the law requires Moonstaff to keep, or that is under a legal hold, is kept only for that purpose and remains protected by this DPA. Moonstaff also keeps the records of the Agreement itself, only to prove and enforce it and to meet its legal duties: signed contracts for seven (7) years, protected by S3 Object Lock retention for that period; the record of each acceptance under ToS §13 for the term of the Agreement plus five (5) years, with backup copies of it kept no longer than seven (7) years; and invoices and billing records for as long as tax law requires. These records hold the business contact details of Client and of the people who accepted or signed for it, not Client's customers' Personal Data, and remain protected by this DPA.

11.3 When the deletion under §11.1 is done, Moonstaff sends Client a written deletion receipt, without being asked, stating what was deleted, what §11.2 keeps, and the date by which the remaining backup copies expire.

11.4 Client remains responsible for keeping its own do-not-contact records for as long as the law requires (47 C.F.R. §64.1200(d)(6) — five years).

12. What Moonstaff never does with Personal Data

Moonstaff does not:

(a) sell Personal Data, or share it for targeted advertising (disclosure to a processor is not a sale — Tex. Bus. & Com. Code §541.001(28)(A));

(b) use it for its own purposes or for any purpose outside the Services;

(c) combine it with another client's data, or with data Moonstaff holds for itself;

(d) pool opt-outs or do-not-contact requests across clients — each client's list is kept and applied separately (47 C.F.R. §64.1200(d)(3));

(e) copy it, or Outputs, into another client's prompts, test sets, or evaluation suites;

(f) use it, or Outputs, to train or fine-tune any AI model. Before Personal Data reaches a Subprocessor, including an AI-model provider, Moonstaff puts in place the no-training setting or contract terms that Subprocessor offers to Moonstaff, so that it does not train or improve its general models on Personal Data except as Client authorizes in writing, and tells Client in writing before using a Subprocessor that offers neither (ToS §7.4). This includes providers Moonstaff reaches through another Subprocessor's platform (Schedule 2); or

(g) retain, use or disclose it outside the direct business relationship between Moonstaff and Client. If Moonstaff determines that it can no longer meet its obligations under Data Protection Law (including, where it applies, the California Consumer Privacy Act as amended), it notifies Client in writing, and Client may then take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data. Moonstaff certifies that it understands the restrictions in this Section 12 and will comply with them.

13. Sensitive data and biometrics

13.1 Client does not give Moonstaff sensitive data under the Agreement (§4(d); ToS §4.5).

13.2 The Services create no voiceprint, speaker-identification profile, or other biometric identifier (Tex. Bus. & Com. Code §503.001), and Moonstaff does not turn on any Subprocessor feature that would.

13.3 The Services are not directed to children. Client does not knowingly give Moonstaff the Personal Data of a child under 13 (or, in Texas, a known child).

14. Health information

14.1 No protected health information before a Business Associate Agreement is signed. A business associate includes a subcontractor that creates, receives, maintains, or transmits protected health information for a covered entity (45 C.F.R. §160.103), so a Business Associate Agreement also has to exist, before any such data flows, with each Subprocessor that would touch it.

14.2 Texas Health & Safety Code chapter 181 can apply to anyone who comes into possession of protected health information, whether or not HIPAA does. Client does not give Moonstaff protected health information under the Agreement (§4(d); ToS §4.5); a health-care client needs a signed agreement instead.

15. Where Personal Data is processed

Personal Data that Moonstaff stores on its own infrastructure is stored in AWS United States Regions, and AI-model inference through Amazon Bedrock uses US-only routing. Each other Subprocessor processes Personal Data where Schedule 2 states. Moonstaff does not move Personal Data outside the United States, or engage a Subprocessor that processes it there, without first telling Client under §9.3.

16. Liability, precedence, and term

16.1 Liability. Each party's liability under this DPA is subject to the limitations in the Agreement, including ToS §10.3(b).

16.2 Precedence. As to Personal Data: a Business Associate Agreement prevails over this DPA, and this DPA prevails over the rest of the Agreement. Otherwise the Agreement governs.

16.3 Term. This DPA takes effect with the Agreement and lasts for as long as Moonstaff or its Subprocessors hold Client's Personal Data. §§7, 11, 12 and 16 survive.

16.4 Changes in law. If Data Protection Law changes so that this DPA no longer meets it, the parties will agree in good faith the smallest amendment that does.

16.5 Consideration. Moonstaff's access to Personal Data is not part of the consideration exchanged between the parties under the Agreement.

SCHEDULE 1 — Details of the Processing

Not processed: payment card numbers, government ID numbers, and protected health information (§4(d), §14; ToS §4.5).

SCHEDULE 2 — Subprocessors

Moonstaff updates this schedule, and gives notice under §9.3, before any change.

Not Moonstaff's Subprocessors (Client's own vendors, under Client's own contracts): Client's calendar, CRM, business-listing and advertising accounts that the Services connect to in Client's name. Moonstaff's own business providers — its bank (Mercury), payment processor (Stripe), e-signature provider (SignWell), sales CRM (HubSpot), and DNS host and sign-up and sign-in bot check (Cloudflare) — and the Google or Microsoft account a user chooses to sign in with handle Client's business contact, billing and sign-in details, not Client's customers' Personal Data.

SCHEDULE 3 — Security measures in place

Only measures that exist today are listed. Moonstaff adds a measure here when it is in place, not when it is planned.

Not claimed: any certification (SOC 2, ISO 27001, PCI DSS, HIPAA), penetration testing, 24/7 monitoring, tested backup restores, customer-managed encryption keys, full-disk encryption of workstations, or an uptime level.