Master Services Agreement

Platform means the shared Limestone infrastructure used for identity, tenancy, hosting, monitoring, backup, security operations, and support. Module means a discrete Limestone application identified in a Service Order. Products are the Platform and ordered Modules. Products, documentation, implementation, and support are the Service. Authorized Users are Customer personnel and contractors approved to use the Service. Service Order means an ordering document that references this Agreement and states the purchased Products, scope, users, fees, and term, including an Invoice and Service Authorization, Quote, or Statement of Work. A Service Order is executed when Customer either (a) signs it, including by electronic signature, or (b) approves it in writing by email from an authorized representative of Customer that identifies the Service Order by number or date. Provider’s issuance of the Service Order constitutes Provider’s execution.

A Licensed User is a named Authorized User authorized to access a Module under a paid seat in a Service Order. Licensed Users typically perform work within a Module, including resolving, administering, configuring, approving, or reporting. Licensed User seats are counted per Module and are the licensed unit. A Participant is an Authorized User who submits requests, supplies information, takes part in a process, and views the status and records of the Participant's own submissions. Participant access is unlimited and carries no seat charge unless a Service Order states otherwise.

Provider will configure, host, support, and make the ordered Products available as stated in each Service Order. Customer will provide timely access to personnel, information, sample records, workflows, and decisions needed for implementation. Material scope changes require a written change order, which Customer may sign or approve by email in the same manner as a Service Order under Section 1. Customer may permit only Authorized Users to access the Service, is responsible for their compliance, and will not allow named accounts to be shared. Provider may improve security, reliability, or functionality so long as it does not materially reduce the core purchased functionality during the current term.

Customer will use the Service lawfully and for its internal operations; maintain accurate user and contact information; promptly disable departed users; safeguard credentials; not reverse engineer, resell, sublicense, interfere with, or attempt unauthorized access; ensure Customer Data is accurate, lawfully collected, and appropriate for processing; maintain its own internet access, endpoint security, identity controls, and business-continuity procedures; and not enable access to an unlicensed Module. Customer will maintain current commercial, billing, and operational contacts throughout the term.

Customer will pay the fees in each Service Order and later billing invoice. Unless an invoice states another due date, payment is due fifteen (15) calendar days after Customer receives the invoice. Customer must provide written notice of any good-faith dispute within ten (10) business days after receipt, identifying the disputed amount and the basis for the dispute. Undisputed amounts remain due as stated. Undisputed overdue amounts may accrue interest at the lesser of 1.0% per month or the maximum rate permitted by applicable law. Provider will give at least ten (10) days' written notice before suspension for nonpayment. Customer will reimburse Provider's reasonable costs of collection, including attorneys' fees, for undisputed amounts more than thirty (30) days overdue. Fees exclude sales, use, and similar transaction taxes. Customer is responsible for taxes properly imposed on the transaction, excluding taxes on Provider's net income, and will provide any valid exemption or direct-pay certificate before payment is due. Invoices issued after the applicable executed Service Order are for billing purposes only. They do not require signature, do not modify the terms stated in the Service Order, and are subordinate to that Service Order and this Agreement. If a later invoice conflicts with the Service Order, the Service Order controls.

Each Service Order states an included Licensed User count and a per-seat rate for each Module. Customer may add Licensed User seats at any time on written request from a contact identified in the applicable Service Order; no new Service Order is required for seat additions alone. Added seats are billed at the per-seat rate stated in that Service Order, prorated from the first day of the calendar month in which the seat is activated through the end of the then-current service term, and co-terminate with that term. Provider will invoice seat additions on the next regular invoice for the affected Module, except that Provider may invoice separately where the prorated amount exceeds two hundred fifty dollars ($250). At renewal, the active Licensed User count for each Module becomes the baseline for the renewal term. Participant counts are not metered.

Licensed User seats may not be reduced during a service term, and no credit or refund is issued for a seat deactivated mid-term. Customer may reduce its Licensed User count effective at renewal by written notice given at least sixty (60) days before the end of the then-current service term.

Additional Modules purchased during a service term require a new executed Service Order. Fees for an added Module are prorated from the first day of the calendar month in which the Module is activated through the end of the then-current service term, and the added Module co-terminates with that term. Implementation fees for an added Module are not prorated and are invoiced in full.

This Agreement continues until all Service Orders expire or are terminated. Each Service Order states its initial term and automatically renews for successive twelve (12)-month periods unless either Party gives at least sixty (60) days' written notice of non-renewal. Unless a Service Order states otherwise, recurring fees increase by five percent (5%) at renewal. Provider may propose another renewal fee with at least ninety (90) days' notice. Added Modules co-terminate with the active term unless the Parties agree otherwise. Seat additions are governed by Section 4 and do not require a new Service Order. Additional Modules are governed by Section 4.3. Implementation fees are one-time per Module and do not recur.

Provider and its licensors retain all rights in the Platform and Modules, source and object code, architecture, models, prompts, templates, workflows, documentation, know-how, generic configurations, and improvements (collectively, Provider Technology). During an active paid term, Provider grants Customer a limited, nonexclusive, nontransferable right for Authorized Users to access the ordered Modules for Customer's internal operations. No source-code rights or ownership transfer. Provider may use voluntary feedback without restriction if it does not identify Customer or disclose Customer Confidential Information.

Customer retains all rights in data, text, records, attachments, instructions, and other content submitted by or for Customer (Customer Data). Customer authorizes Provider and its subprocessors to process Customer Data only as reasonably necessary to provide, secure, support, and improve the Service, comply with law, and enforce this Agreement. Provider may use aggregated and deidentified statistics that do not identify Customer, an individual, or Customer Confidential Information.

AI features may classify, summarize, retrieve, draft, recommend, or otherwise assist with operations. AI output can be incomplete or incorrect and does not replace qualified human judgment. Customer is responsible for human review before relying on AI output for material operational, safety, legal, employment, financial, or regulated decisions. Provider will not knowingly use Customer Data to train a generally available model without Customer's prior written consent. An AI Usage Allowance is a commercial allowance, not a fixed number of tokens, calls, or outputs. When technically practicable, Provider will notify Customer near 75% and 90% usage. Provider will not impose overage charges without written authorization. If the allowance is exhausted and more usage is not authorized, Provider may notify Customer and rate-limit or temporarily suspend AI-enabled features without incurring additional third-party AI charges; Provider will use reasonable efforts to keep non-AI core functions available and will restore AI features after usage is authorized or a new allowance begins. Unused allowance expires at term-end and is not refundable or transferable.

Customer may apply a deployment name, logo, colors, or domain when stated in a Service Order and grants Provider a limited license to display those materials to deliver and support the Service. Customer owns its supplied marks; Provider owns Limestone, Limestone Technology Group, LimestoneBiz, LimestoneGov, and all Platform and Module names. A customer-facing deployment name is a display configuration and does not transfer ownership. Any required in-product attribution, including placement and removal pricing, will be stated in the Service Order.

Each Party will protect nonpublic information that is marked confidential or reasonably understood to be confidential, use it only for this Agreement, and disclose it only to personnel and contractors who need it and have confidentiality duties. Exclusions apply to information independently developed, rightfully received without restriction, publicly available without breach, or previously known without restriction. If disclosure is legally required, the receiving Party will give prompt notice when lawful and reasonable assistance. Confidentiality duties last five (5) years after disclosure; trade-secret duties last while the information remains a trade secret.

Provider will maintain the safeguards in Schedule C. Each Party will comply with privacy and security laws applicable to its own activities. Customer will not submit regulated or specially protected data, including protected health information, payment-card data, criminal-justice information, tax information subject to special safeguards, or government-classified information, unless the Parties first complete a written assessment, sign any required addendum, and confirm the Service is configured for that data. Provider may suspend the affected workflow immediately on written notice when needed to prevent material security or legal harm.

Provider warrants that implementation and support will be performed in a professional and workmanlike manner and that the Service will materially conform to the functionality stated in the applicable Service Order under normal authorized use. Customer must report a claimed breach with reasonable detail within thirty (30) days after the affected service. Provider's obligation and Customer's exclusive remedy are to reperform or correct the affected service; if Provider cannot do so after reasonable efforts, Customer may terminate the affected Module and receive a prorated refund of prepaid, unused recurring fees for that Module. Except for those express commitments, the Service and AI output are provided "as is" and "as available." To the maximum extent permitted by law, Provider disclaims implied warranties of merchantability, fitness for a particular purpose, title, noninfringement, and warranties arising from course of dealing or usage. Provider does not promise uninterrupted or error-free operation or accurate AI output. This disclaimer does not reduce Schedule B.

Provider will defend Customer against a third-party claim that Customer's authorized use of the unmodified Service infringes a United States patent, copyright, or trademark, and will pay damages finally awarded or agreed in settlement. Provider may modify or replace the affected Module, obtain continued-use rights, or terminate the affected Module and refund prepaid unused recurring fees. This does not apply to claims arising from Customer Data, a Customer-supplied mark, unauthorized use, third-party combinations not supplied by Provider, or Customer specifications.

Customer will defend Provider against a third-party claim arising from Customer Data, a Customer-supplied mark, Customer's violation of law, or Customer's material breach of this Agreement, and will pay damages finally awarded or agreed in settlement.

The indemnified Party must promptly notify the indemnifying Party, provide reasonable cooperation at the indemnifying Party's expense, and allow control of the defense and settlement. No settlement may admit fault by or impose a nonmonetary obligation on the indemnified Party without written consent.

Customer will defend and indemnify Provider against any third-party claim arising from Customer's reliance on, publication of, or action taken on AI-assisted output without the human review required by Section 8 and Schedule C5, and will pay damages finally awarded or agreed in settlement. This obligation is not subject to the caps in Section 14.

To the maximum extent permitted by law, neither Party is liable for indirect, incidental, special, exemplary, punitive, or consequential damages, or for lost profits, revenues, goodwill, or data, even if advised of the possibility. Except as stated in Section 14.2, each Party's aggregate liability arising from this Agreement will not exceed the recurring fees actually paid by Customer for the twelve (12)-month service term in which the event giving rise to the claim occurred. The implementation fee and any AI Usage Allowance are excluded from this cap.

Provider's aggregate liability under Section 13.1 will not exceed three (3) times the recurring fees paid for the service term in which the event occurred. Customer's obligations under Sections 13.2 and 13.4, and liability arising from unauthorized user access, security or privacy violations, prohibited data, AI-safeguard violations, or unauthorized use or misappropriation of Provider Technology, are not subject to a cap. The caps do not limit Customer's payment obligations or either Party's liability for gross negligence, willful misconduct, fraud, or liability that cannot legally be limited.

No claim under this Agreement may be brought more than twelve (12) months after the claiming Party knew or reasonably should have known of the facts giving rise to it, except a claim for nonpayment or where applicable law prohibits that limitation.

Either Party may terminate for a material breach not cured within thirty (30) days after written notice. Provider may suspend sooner when reasonably necessary to prevent material security harm, unlawful use, prohibited data processing, or after the nonpayment notice in Section 4. Provider will limit and promptly lift a suspension when the cause is resolved. At expiration or termination, access ends. At Customer's written request at any time before deletion, Provider will make one commercially reasonable export of Customer Data available in a commonly used format. Provider will not delete Customer Data earlier than sixty (60) days after expiration or termination unless Customer requests earlier deletion or law requires otherwise. Backup copies may remain until overwritten in ordinary retention cycles. Accrued payment obligations remain due. Sections 3, 4, 5, 6, 8, 11, 12, 13, 14, 21, 22, and 23 survive, together with provisions that by nature should survive.

Provider may identify Customer by name and logo in a customer list, capability statement, and factual engagement reference. A case study, testimonial, quotation, or press release naming Customer requires Customer's prior written consent, not to be unreasonably withheld. Customer may not use Provider's name, marks, or Agreement details in external marketing without prior written consent.

Each Party will comply with laws applicable to its own performance. Customer is responsible for the legality of its instructions, Customer Data, access approvals, and use of outputs. Provider is not Customer's legal, tax, regulatory, employment, or safety advisor.

Legal notices must be in writing and delivered by personal delivery, nationally recognized overnight courier, certified mail, or email followed by one of those physical methods. Notices go to the addresses in the applicable Service Order unless updated by written notice. Operational support may use the designated support channel.

Tennessee law governs without regard to conflict-of-law principles. State and federal courts in Blount County, Tennessee have exclusive jurisdiction, and each Party consents to venue. Before filing suit, executives will meet in good faith within ten (10) business days after written escalation, except as reasonably necessary immediate injunctive relief. In a proceeding to enforce this Agreement, the prevailing Party may recover reasonable attorneys' fees and costs.

A Force Majeure Event is beyond a Party's reasonable control, including natural disaster, fire, flood, epidemic, war, terrorism, civil disorder, labor disruption not limited to the affected Party's workforce, widespread internet or utility failure, government action, or critical third-party platform failure despite reasonable contingency measures. The affected Party will promptly notify the other, mitigate, and resume performance. Payment obligations are not excused. If the event materially prevents an affected Service for more than thirty (30) consecutive days, either Party may terminate that Service on written notice. Fees invoiced or accrued before termination remain due, and implementation fees are not refundable.

During the term, Provider will maintain workers' compensation coverage as required by law and commercial general liability insurance. Provider will furnish a certificate of that coverage on reasonable written request. Insurance does not expand Provider's liability under Section 14.

During the term and for twelve (12) months afterward, neither Party will knowingly solicit for employment or directly hire an employee of the other Party who was materially involved in the Service without prior written consent. This does not restrict general advertisements, non-targeted searches, unsolicited applications, or hiring someone whose employment with the other Party ended at least six (6) months earlier.

Neither Party may assign this Agreement without the other's consent, except to an affiliate or with a merger, reorganization, or sale of substantially all relevant assets, with notice and assumption of obligations. The Parties are independent contractors. There are no third-party beneficiaries. If a provision is unenforceable, it will be narrowed to the minimum extent necessary and the remainder continues. No failure or delay in exercising a right is a waiver.

This Agreement, its Schedules, signed addenda, and executed Service Orders are the entire agreement about the Service and supersede prior proposals and discussions on the same subject. Amendments and waivers must be signed by authorized representatives. A later master form does not change an executed Service Order unless the Parties sign an amendment adopting it. Counterparts and electronic signatures are permitted. Customer purchase orders, portals, vendor-onboarding forms, and unsigned billing documents do not modify this Agreement unless an authorized Provider representative expressly signs a document stating the modification. A Customer purchase order may be issued for Customer’s internal processing and may be referenced on a Service Order, but a purchase order does not by itself execute a Service Order, and any preprinted or additional terms in the purchase order do not apply.