The terms for your account, with a plain-English summary beside every section.

These Terms of Service (the "Terms") are an agreement between PulsePoint Systems, LLC, a Delaware limited liability company trading as Kernstra ("Kernstra", "we", "us"), and the business or organization on whose behalf an account is created or used ("you"). They govern the Kernstra website, the Kernstra console and its accounts, development and evaluation use of Kernstra software, and the support we provide (together, the "Services").

A license to use the Kernstra Web SDK (the "SDK") in production is governed by the Kernstra Web SDK License Terms (the "License Terms") and the order that grants it (an "Order", as the License Terms define it). Where an Order or the License Terms conflict with these Terms, the Order prevails, then the License Terms, then these Terms. A separate written agreement signed by both parties prevails over all of them wherever they conflict. Capitalized words that these Terms do not define have the meaning the License Terms give them (for example Application, Competitor, End User, Internal Audience, License Key, List Fees and Production Use).

The summaries headed "In plain English" are there to help you read; they are not part of the Terms and do not change their meaning.

The Services are provided only for business and professional purposes. By creating an account or accepting these Terms you confirm that you act in the course of a trade, business, craft or profession and not as a consumer, that you do not acquire the Services as a final consumer, and that the person accepting has the authority to bind the business or organization they act for. If you are not authorized to accept these Terms for an organization, do not create an account for it. Laws that protect consumers do not apply to the Services to the extent the law allows them to be excluded for business customers.

You must give accurate and complete information when you create an account and keep it up to date. Each account is for one named person, who signs in with an emailed link or a Google account; you are responsible for keeping that email account or Google account secure, and for everything done through the accounts of your organization. Tell us at once at security@kernstra.com if you believe an account or a license key has been used without authority. We may refuse to open an account, or ask you to verify the information you gave us, where we reasonably believe it is needed to prevent fraud or abuse or to comply with law.

Each account belongs to one or more organizations. An organization's owners may invite and remove members, change roles, request and sign Orders, manage billing and keys, and ask us to close the organization; members may create development keys and use the console as their role allows. We may rely on instructions from any owner of an organization as the organization's instructions. You are responsible for the people you invite, for removing those who should no longer have access, and for making sure that an organization always has an owner who can act for it.

We may issue development license keys to your organization free of charge. Subject to these Terms, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable license to install and use the SDK with a development key to develop, build and test your own applications, to demonstrate them to prospective buyers, and to evaluate the SDK: on developer machines, build and test systems, and staging and preview deployments. A development key may run on any host, but it may not be used for Production Use. Output produced under it carries a visible mark, and no output produced under a development or evaluation key, marked or not, may be used for a business purpose other than development, testing and demonstration.

The opening conditions of the License Terms and its Sections 2.4 to 2.7 (staging keys, End Users, contractors, interactive use), 3 (Restrictions), 4 (License Keys and Verification), 5 (Ownership), 6 (Third-Party Components) and 7.5 (use beyond your license) apply to development and evaluation use as if set out in these Terms, in the version of the License Terms that your organization's latest Order names or, without one, the latest published version; a change in them that is adverse to you applies as Section 18 provides. A trial or evaluation license we create for you is governed by Section 2.2 of the License Terms. A development key carries no expiry date. We may change the features of, limit or stop offering development keys, and may revoke a development key used in breach of these Terms. Development use carries no fees, no warranty (Section 15) and no support commitment.

License keys are issued to your organization and may not be shared with or used by another organization, except that your contractors may use your development and staging keys for your applications as Section 2.6 of the License Terms allows. A production key is protected by the domains it names, not by secrecy, and its presence in your client-side code is its intended use. A development key works on any host, and an offline key works without contacting us; both must be kept within your organization and those contractors and protected as you protect your own credentials. You are responsible for all use of the keys issued to you. We may revoke, rotate or reissue a key to protect the Services, as Section 4.2 of the License Terms describes.

You will not, and will not let anyone else: (a) use the Services in breach of applicable law or to process content you have no right to process; (b) access or try to access the Services other than through the interfaces we provide, or probe, scan or test their vulnerability without our written permission (our security disclosure policy is on our Security page); (c) interfere with or overload the Services, or get around their rate limits, quotas or security measures; (d) upload malware or any file you know to be harmful; (e) give false information, impersonate anyone, or create accounts or organizations by automated means, to obtain more development keys or trials than we allow, or to avoid a suspension or a limit; (f) resell or provide access to the Services to third parties, other than to your members and the contractors Section 6 allows; (g) use the Services to build or improve a product that competes with them, or to benchmark them for publication except as Section 3(h) of the License Terms allows; or (h) use the Services in breach of Section 20.1 (export and sanctions).

You may ask for help through a support case in the console or at support@kernstra.com. We aim to answer within one business day; response times are commitments only where an Order states them. Send us documents, screenshots or personal data only where we need them to help you, and never a license key or a password. Your own messages and contact details are ours to process as the Privacy Policy describes. Where you share content that contains personal data of others, such as a document or a screenshot, you confirm that you may lawfully share it with us for that purpose, and we process it on your behalf under Section 12.2.

Accounts and development keys are free of charge. Paid licenses, their fees, taxes, billing and renewal are governed by the Order that grants them and by Section 7 of the License Terms. Prices published on our website describe our current offers; the price that binds us is the one in a signed Order.

We may change, add or remove features of the Services at any time, except that we will not remove a feature an Order includes during a paid billing period, as Section 12.1 of the License Terms provides. The console and our licensing service are provided as available; the SDK keeps running for a period without our licensing service as Section 4.1 of the License Terms describes. We may carry out maintenance that briefly interrupts the console, and we aim to schedule it when use is low.

The Services, the SDK and all intellectual property rights in them belong to Kernstra and its licensors; nothing in these Terms transfers them to you, and no rights are granted except those these Terms or the License Terms expressly grant. You keep all rights in your applications and in the documents and content you process. If you give us suggestions or feedback, we may use them for any purpose without obligation to you. The Kernstra name and logo are our trademarks; you may name Kernstra and the SDK to describe your use of them truthfully, but not in a way that suggests we endorse you.

12.1 The license check. We process personal data as the Privacy Policy describes. The SDK processes documents in the End User's browser and sends no document content to us. For the collection and transmission of the license status check from your End Users' browsers (Section 3 of the Privacy Policy), you and we are joint controllers under Article 26 of Regulation (EU) 2016/679 (the "GDPR") and comparable laws, and this Section 12.1 is our arrangement between joint controllers. You will give your End Users, before the SDK loads, the information in Section 3 of the Privacy Policy, by linking to it or reproducing it, and obtain any consent that the law that applies to you requires for the SDK's storage in their browser (in the EEA, Article 5(3) of Directive 2002/58/EC and the national laws implementing it, including Norway's Electronic Communications Act section 3-15; in the UK, the Privacy and Electronic Communications Regulations; in Switzerland, Article 45c of the Telecommunications Act). We are solely responsible for the processing after we receive the data, and we answer data subjects about it; you will pass on to us without delay any request you receive about it. The essence of this arrangement is available to data subjects in Section 3 of the Privacy Policy. Each party will comply with the data protection law that applies to it.

12.2 Processing for you. Where we process personal data on your behalf (for example in content you share with us in a support case) ("Customer Personal Data"), Sections 12.2 to 12.6 are the data processing agreement between us under Article 28 of the GDPR and of the UK GDPR, the Swiss Federal Act on Data Protection and the other data protection laws that require one. You are the controller (or, where you act for your own customer, its processor, and we your sub-processor) and we are your processor. The subject matter and purpose are the support and other Services you ask for; the nature of the processing is storage, retrieval and review; the duration is the term of these Terms and the period in 12.2(g); the data subjects and categories of data are those in 12.6. You will not share special categories of data or data about criminal convictions unless we agree in writing. We will:

1. process Customer Personal Data only on your documented instructions (these Terms and your requests in the console or by email), including with regard to transfers of personal data to a third country, unless Union or Member State law, UK law or other law to which we are subject requires otherwise, in which case we tell you first where that law allows; and tell you at once if we believe an instruction breaks data protection law;
2. ensure that the people we authorize to process it are bound by confidentiality;
3. protect it with the technical and organizational measures in 12.6, which we may improve but not materially weaken;
4. engage only the sub-processors that Section 9 of the Privacy Policy lists as acting for us (Hetzner, Amazon Web Services, Cloudflare and Zoho), which you authorize; tell you at least thirty (30) days before adding or replacing one, by updating that list and by email to your organization's owners, so that you may object on reasonable grounds, in which case we will work with you on an alternative or you may end the affected Services and receive a refund of prepaid fees for them; and bind each sub-processor by contract to the same data protection obligations as in this Section 12, remaining fully liable to you for its performance;
5. help you, taking into account the nature of the processing, to answer requests from data subjects and to meet your obligations on security, breach notification, impact assessments and consultation with authorities;
6. notify you without undue delay, and in any case within seventy-two (72) hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information you need to meet your own obligations;
7. at your choice, return (by sending you the files) or delete Customer Personal Data within thirty (30) days after you ask us to, which you may do at any time and after your organization is closed, unless Union or Member State law, UK law or other law to which we are subject requires us to keep it, in which case we keep protecting it under this Section; copies in encrypted backups are overwritten within thirty (30) days for point-in-time backups and within twelve (12) months for monthly backups, and are not restored except to recover the Services; and
8. make available the information needed to demonstrate compliance with this Section, by answering your written questions and security questionnaires and by providing our security documentation; and allow an audit by you or an independent auditor bound by confidentiality, on thirty (30) days' notice, at your expense, not more than once a year, and at any time after a personal data breach affecting Customer Personal Data, where there are indications of non-compliance, or where a supervisory authority requires it.

12.3 International transfers. Where Customer Personal Data is transferred from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference, whether or not an adequacy decision or a certification framework also covers the transfer: Module Two (controller to processor), or Module Three (processor to processor) where you act as a processor, with you as the data exporter and us as the data importer; clause 7 (docking) applies; under clause 9, option 2 (general written authorization) applies with the notice period in 12.2(d); the optional wording in clause 11 does not apply; clauses 17 and 18 choose the law and courts of Ireland; under clause 13, the competent supervisory authority is that of the Member State in which the data exporter is established or, if it is not established in the European Union, of the Member State in which its representative under Article 27 GDPR is established or, if it has none, of the Member State in which the data subjects whose data is transferred are located; and Annexes I to III are completed by 12.6. For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018) applies, with its Part 2 Mandatory Clauses; Table 1 is completed by the parties in 12.6, Table 2 by the version of the clauses, the modules and the options chosen above, Table 3 by 12.6, and in Table 4 neither party may end it when it is revised. For transfers from Switzerland, the same clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, references to the GDPR read as references to the Federal Act on Data Protection, and "Member State" not read so as to exclude data subjects in Switzerland from suing where they habitually reside. If these Terms and those clauses conflict, the clauses prevail.

12.4 Liability. Our liability to you under this Section 12 is subject to Section 16, except to the extent the law does not allow it to be limited. Nothing in these Terms limits the rights of data subjects, or either party's liability to them, under the Standard Contractual Clauses.

12.5 United States. For Customer Personal Data subject to the California Consumer Privacy Act or a similar US state law, we act as your service provider or processor: we will not sell or share it; retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Services; or combine it with personal data we receive from others, except as that law permits. We will comply with that law, tell you if we can no longer do so, and let you take reasonable and appropriate steps to stop and remediate any unauthorized use of the data.

12.6 Details of the processing (Annexes I to III). Parties: the data exporter is you, as identified in your organization's billing details, contact through its owners; the data importer is PulsePoint Systems, LLC, contact legal@kernstra.com; your acceptance of these Terms is the signature of both. Data subjects: your staff, your customers and their staff, and persons named in content you share with us. Categories of data: whatever that content contains; no special categories unless agreed in writing. Frequency: occasional, with each support case. Nature and purpose: storage, retrieval and review to provide the support you ask for. Retention: as 12.2(g). Sub-processors: those named in 12.2(d), for hosting, file storage and backups, network delivery and email, in the locations Section 9 of the Privacy Policy gives. Technical and organizational measures: encryption in transit (TLS) and at rest, with keys in AWS Key Management Service; files stored privately with access limited by policy to the service; every uploaded file scanned for malware before it can be read; staff access limited by role, protected by strong authentication and audited; logs that never contain license keys, sign-in links, tokens or card data; encrypted backups with point-in-time recovery; deletion and erasure procedures as the Privacy Policy describes.

Each party may receive information from the other that is marked confidential or that a reasonable person would understand to be confidential, including the prices and terms of Orders, our security review materials and non-public product plans ("Confidential Information"). The receiving party will use the other's Confidential Information only to perform or use the Services and the License Terms, will protect it with at least reasonable care, and will disclose it only to its employees, contractors and advisers who need it and are bound by similar duties, or where law requires (giving notice where it lawfully can). Information that is or becomes public through no fault of the receiving party, that it already knew or developed independently, or that it received lawfully from a third party without a duty of confidence, is not Confidential Information. These duties last for three (3) years after the information was disclosed, and for trade secrets for as long as they remain trade secrets.

You may stop using the Services at any time. To close an organization or have your account erased, ask us in a support case or by email to legal@kernstra.com; we will confirm before we act. Closing an organization ends its development and staging keys at once and its paid licenses at the end of their paid periods, as the License Terms and their Orders provide; the organization closes when the last of them ends.

We may suspend an account, an organization or its keys, with notice where practicable, if we reasonably believe that it is being used in breach of these Terms or the License Terms or for fraud or abuse, that its use puts the Services, other customers or third parties at risk, or that suspension is required by law. We lift a suspension once its cause is resolved. We may close an account or an organization on written notice if its breach is material and not cured within thirty (30) days of notice, or at once if the breach cannot be cured, or on ninety (90) days' notice if it has no paid license. What happens to your data afterwards is described in the Privacy Policy and in Section 12.2(g). Sections 5 (second paragraph), 11, 12 (for as long as we hold Customer Personal Data), 13, 15 to 17 and 19 to 21 survive the end of these Terms.

TO THE EXTENT THE APPLICABLE LAW ALLOWS, AND EXCEPT AS AN ORDER OR THE LICENSE TERMS EXPRESSLY PROVIDE FOR A PAID LICENSE, THE SERVICES, DEVELOPMENT AND EVALUATION KEYS AND ANY SUPPORT ARE PROVIDED "AS IS" AND "AS AVAILABLE", AND KERNSTRA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE OR SECURE.

TO THE FULLEST EXTENT THE LAW ALLOWS, NEITHER PARTY IS LIABLE UNDER OR IN CONNECTION WITH THESE TERMS FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL OR DATA, HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THEIR POSSIBILITY.

TO THE FULLEST EXTENT THE LAW ALLOWS, KERNSTRA'S TOTAL LIABILITY UNDER OR IN CONNECTION WITH THESE TERMS IS LIMITED TO ONE HUNDRED US DOLLARS (US$100) OR, IF YOUR ORGANIZATION HOLDS A PAID LICENSE WHEN THE EVENT GIVING RISE TO THE CLAIM OCCURS, TO THE LIMIT IN SECTION 10.2 OF THE LICENSE TERMS, WHICH THEN APPLIES TO THESE TERMS AND THE LICENSE TERMS TOGETHER, NOT TO EACH SEPARATELY.

These limits do not apply to liability for death or personal injury caused by negligence, to liability under product liability law, to any other liability that cannot be limited by law, to a party's fraud, gross negligence or willful misconduct, to your breach of Section 5 (as to the License Terms sections it applies), 6 or 7, or to your obligations under Section 17. If you are established in Germany or Austria, Section 10.5 of the License Terms applies in place of the second paragraph of this Section.

You will defend Kernstra and its officers, employees and contractors against any third-party claim arising from your use of the Services in breach of these Terms, or from the applications, documents or content you or your End Users process with the Services, except to the extent the claim results from our negligence or breach, and will pay the damages and costs finally awarded or agreed in a settlement you approve. Kernstra will give you prompt notice of the claim, control of its defense and settlement (a settlement that imposes obligations on Kernstra needs its consent), and reasonable cooperation at your expense. Kernstra's own indemnity for intellectual property claims is in Section 11.1 of the License Terms and applies only to paid licenses.

We may change these Terms by publishing a new version at this address, and we tell your organization's owners of every change by email or in the console. A material change takes effect no earlier than thirty (30) days after that notice, unless it is required sooner by law or to address a security risk. The console asks each person to accept the new version at their next visit; using the Services after a new version takes effect confirms your acceptance. A change to Section 12, 13 or 16 that is adverse to you applies to an organization with a paid license only from the end of its current Order term, unless it agrees earlier. If you do not accept a new version, you may stop using the Services and ask us to close your organization before it takes effect. A change does not alter the License Terms version an Order names. Every version we have published remains available on request, and the console shows the versions each person accepted.

These Terms and any dispute arising out of or in connection with them or the Services are governed by the laws of the State of Delaware, United States of America, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply. If you are domiciled in the United States, the state and federal courts located in the State of Delaware have exclusive jurisdiction, and each party submits to their personal jurisdiction. If you are domiciled elsewhere, any such dispute is finally resolved by arbitration administered by the International Centre for Dispute Resolution under its International Arbitration Rules, before one arbitrator, seated in Wilmington, Delaware, and conducted in English. Either party may seek an injunction or other urgent relief to protect its intellectual property or Confidential Information, and either party may bring a claim solely for payment of an undisputed amount due, in any court of competent jurisdiction. The ICDR International Expedited Procedures apply where their conditions are met, and any hearing is held by video conference unless the arbitrator decides otherwise.

Before starting proceedings (other than for urgent relief), a party will tell the other in writing what the dispute is about, and both will try in good faith to resolve it for thirty (30) days. Each party may bring claims only in its individual capacity and not as a member of a class or representative action. TO THE FULLEST EXTENT THE LAW ALLOWS, EACH PARTY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THESE TERMS.

20.1 Export and sanctions. You will comply with the export control and economic sanctions laws of the United States and other applicable countries. You represent that you are not located in, organized under the laws of, or ordinarily resident in a country or region subject to comprehensive US sanctions, and that neither you nor anyone owning fifty percent (50%) or more of you is named on a US or other applicable restricted-party list. We may suspend or close an account at once if this is or becomes untrue.

20.2 Notices. We may send notices to the email address of your organization's owners or in the console; they are effective on the next business day. Notices to us go to legal@kernstra.com and, for a notice of breach, termination or a legal claim, also in writing to the postal address we give on request; they are effective on receipt.

20.3 Assignment. You may not assign or transfer these Terms, by operation of law or otherwise, without our prior written consent, except to a successor in a merger or a sale of substantially all of your business or assets that is not a Competitor and agrees to them in writing. We may assign them to an affiliate or to a successor of our business.

20.4 Force majeure. Neither party is liable for a failure or delay caused by events beyond its reasonable control, such as natural disaster, war, terrorism, labor dispute, epidemic, government action, or a failure of the internet or of a third-party service, provided it uses reasonable efforts to resume.

20.5 The whole agreement. These Terms, with the Privacy Policy and, for a paid license, the License Terms and its Order, are the entire agreement between the parties about the Services and replace any earlier agreement or representation about them. Terms in a purchase order or similar document of yours do not apply, even if we accept or sign it. If a provision is held unenforceable, it is enforced to the maximum extent possible and the rest remains in effect. A failure to enforce a provision is not a waiver. The parties are independent contractors, and nothing in these Terms creates a partnership, joint venture, agency or employment relationship. No third party has rights under these Terms, except data subjects under the Standard Contractual Clauses. These Terms are written in English, and any translation is for convenience only.

20.6 Mandatory local rights. Where the law of the country in which you are established gives you a right or a protection that cannot be excluded or limited by agreement, that right stands, these Terms apply to it only to the extent the law allows, and the rest of these Terms is unaffected; nothing in these Terms excludes, restricts or modifies such a right.

PulsePoint Systems, LLC, trading as Kernstra. Email: legal@kernstra.com. Postal address: given on request.