Penzago Master Subscription Agreement

This Master Subscription Agreement (this "MSA") is entered into between GETREFLOW LLC, the operator of the Penzago platform at penzago.com ("Penzago," "we," "us"), and the customer identified on an Order Form referencing this MSA ("Customer," "you"). Penzago is a service of GETREFLOW LLC (d/b/a Penzago). This MSA, the applicable Order Form, the Data Processing Addendum (the "DPA"), and the Acceptable Use Policy (the "AUP") together form the "Agreement." This MSA supersedes the Terms of Service previously published at penzago.com/terms for all customers who execute an Order Form.

1. Definitions

• "Service" means the Penzago multi-tenant software-as-a-service platform, including its dashboard, automation playbooks, workflow engine, messaging features (SMS, RCS, voice, email), AI-assisted features (including the automated AI text responder), and related APIs and documentation.
• "Playbook" means a pre-built automation workflow made available to Customer through the Service.
• "Connected Account" means a third-party account (for example Google, Meta/Facebook, Instagram, LinkedIn, TikTok, HubSpot, Salesforce, Zoho, Mailchimp, Microsoft, Typeform, JotForm, Cloze) that Customer connects to the Service by OAuth authorization or API key.
• "Customer Data" means data submitted to the Service by or on behalf of Customer, including data retrieved from Connected Accounts and Lead Data.
• "Lead Data" means information about Customer's prospective or actual customers processed through the Service, including names, phone numbers, email addresses, form submissions, and message content.
• "Consumer" means an individual whose Lead Data is processed through the Service or who receives communications sent through the Service on Customer's behalf.
• "Messaging Services" means the features of the Service that send SMS, RCS, voice, voicemail, or email communications to Consumers.
• "Platform Terms" means the developer terms, platform policies, and data-use policies of the third-party platforms underlying Connected Accounts, including the Google API Services User Data Policy (including its Limited Use requirements), the Meta Platform Terms and Developer Policies, the LinkedIn API Terms of Use, and the Mailchimp API Use Policy.

2. The Service

2.1 Access. Subject to the Agreement and payment of fees, Penzago grants Customer a non-exclusive, non-transferable right during the Term for its authorized users to access and use the Service for Customer's internal business operations.

2.2 Provisioning. Penzago provisions Customer accounts, selects and grants Playbooks appropriate to Customer's plan and industry, and configures messaging programs. Granted Playbooks activate when Customer connects the integrations they require.

2.3 Accounts. Customer is responsible for the confidentiality of its credentials and for all activity under its accounts, and will notify Penzago promptly of any suspected unauthorized use.

2.4 Support and availability. Penzago provides support by email at hello@getreflow.ai during U.S. business hours. The Service is provided without a guaranteed uptime commitment; Penzago uses commercially reasonable efforts to maintain availability and to schedule maintenance to minimize disruption.

2.5 AI features. Portions of the Service use large language models provided by third-party AI providers to generate message content, including the automated AI text responder. AI-generated messages identify themselves as automated in the conversation. Customer will not configure, prompt, or instruct any AI feature to conceal its automated nature or to make claims Customer knows to be false.

3. Connected Accounts; Authorization to Act

3.1 Appointment. Customer appoints Penzago, and Penzago accepts appointment, as Customer's service provider and limited agent solely to access, retrieve, and act on Connected Accounts as directed by Customer's playbook configuration — including reading and writing CRM records, reading form responses and spreadsheets, reading free/busy data and creating calendar events, retrieving lead form submissions, and publishing social content on Customer's behalf. Penzago acts on Connected Accounts only at and under Customer's direction, for Customer's business purposes, and for no independent purpose of Penzago's own.

3.2 Platform Terms flow-down. Customer's use of each Connected Account through the Service is subject to the applicable Platform Terms, and Customer agrees to comply with them. Without limiting the foregoing: (a) data received from Google APIs is used in accordance with the Google API Services User Data Policy, including Limited Use; (b) Penzago operates as a "Tech Provider" with respect to Meta platform data, which is processed only at Customer's direction; (c) Customer will not use LinkedIn features for recruiting, advertising, or purposes beyond the workflows it configures; and (d) Customer's use of email marketing integrations must comply with the applicable provider's anti-spam policies. Customer will not use the Service to circumvent any limitation imposed by a third-party platform.

3.3 Platform enforcement; no guarantee of platform access. Third-party platforms may change or revoke API access, impose review or verification requirements, expire tokens, or take enforcement action against apps or user accounts at any time. Penzago is not responsible for the acts or omissions of third-party platforms, and platform-imposed interruptions of a Connected Account are not a breach of this MSA. Specifically disclosed: Facebook/Meta long-lived tokens expire approximately every 60 days and require Customer to re-authorize the connection; social publishing features depend on platform review programs and may be limited or unavailable until the relevant approvals are obtained.

3.4 Revocation. Customer may disconnect any Connected Account at any time from its dashboard. On disconnection, Penzago revokes and deletes the associated tokens and pauses dependent Playbooks.

4. Customer Data

4.1 Ownership. As between the parties, Customer owns Customer Data. Customer grants Penzago a non-exclusive license to host, process, transmit, and display Customer Data solely to provide and secure the Service, to comply with law, and as otherwise permitted by the DPA.

4.2 Data protection. The parties' data-protection obligations, including Penzago's obligations as Customer's CCPA "service provider" and state-law "processor," subprocessor terms, security measures, breach notice, and data return and deletion, are set out in the DPA, which is incorporated into this MSA.

4.3 Usage data. Penzago may collect and use technical and usage data about the operation of the Service (excluding Consumer message content) to operate, secure, meter, bill, and improve the Service, and may use such data in de-identified, aggregated form.

4.4 Responsibility for Customer Data. Customer is responsible for the accuracy and lawfulness of Customer Data and for its instructions to the Service, including playbook configuration and message template content Customer supplies.

5. Messaging Services

5.1 Program structure. Messaging Services are operated by Penzago on phone numbers provisioned and managed by Penzago through its carrier partners, under messaging campaigns registered by Penzago. Consumers' receipt of messages is additionally governed by the Penzago Consumer Mobile Messaging Terms.

5.2 Customer consent warranties. Customer represents and warrants, on a continuing basis, that:

(a) for every Consumer whose phone number Customer submits to the Service (directly, through a form, or through a Connected Account) with consent asserted, the Consumer has given prior express written consent to receive automated text messages of the kind the applicable Playbook sends, captured in a manner that meets the requirements of the Telephone Consumer Protection Act, applicable state telemarketing and telephone-solicitation laws, and the CTIA Messaging Principles and Best Practices;

(b) Customer's opt-in disclosures accurately describe the messages that will be sent (including recurring messages where applicable) and were presented unbundled from any condition of purchase;

(c) Customer has not purchased, rented, borrowed, or harvested the contact information of any Consumer submitted to the Service, and no list of Consumers submitted to the Service was obtained from a data broker or lead reseller without consent that specifically named Customer;

(d) where Customer's own website, forms, or phone lines feed the Service, Customer has made the disclosures required by applicable call- and message-recording laws for its jurisdiction and its Consumers' jurisdictions; and

(e) Customer will maintain records evidencing the consent described above (including the consent text presented, timestamp, and source) for at least four (4) years and will not delete such records while a related claim or audit is pending.

5.3 Consent audit right. On no less than ten (10) business days' notice, no more than once in any twelve (12) month period — and additionally at any time for cause (including any carrier complaint, regulator inquiry, litigation threat, or complaint-rate anomaly attributable to Customer's traffic) — Penzago may audit Customer's consent records for Consumers submitted to the Service. Audits are records-based (Customer provides copies or reasonable access), and Penzago will treat audit materials as Customer's Confidential Information. Failure to produce evidence of consent for submitted Consumers is a material breach.

5.4 Compliance features; no circumvention. The Service enforces opt-out processing (including STOP and equivalent carrier keywords, and high-confidence free-text revocation phrases, in every messaging lane), suppression lists, quiet-hours send windows based on recipient location, sender identification, and AI-disclosure requirements. Customer will not attempt to disable, bypass, or degrade any of these features, and will not use the Service to message any Consumer who has opted out through any channel known to Customer.

5.5 Suspension and kill-switch. Penzago may suspend Messaging Services, a specific Playbook, a campaign, or Customer's account, in whole or in part, immediately and without prior notice where Penzago reasonably believes that (a) Customer has breached §5.2 or the AUP; (b) Customer's traffic creates a material risk of carrier filtering or enforcement, platform enforcement, or legal liability for Penzago or other Penzago customers (including complaint-rate spikes and spam-report anomalies); or (c) suspension is required by a carrier, registrar, or platform. Penzago will notify Customer within two (2) business days of any such suspension, describing the basis, and will restore service promptly once the underlying issue is cured. Fees continue to accrue during suspensions caused by Customer's breach; Penzago will credit subscription fees pro rata for suspensions lasting more than five (5) business days that are not attributable to Customer.

5.6 Shared infrastructure. Customer acknowledges that Messaging Services operate on shared, Penzago-registered messaging infrastructure, and that carrier or registrar action triggered by one customer's traffic can affect the platform. This is a principal reason for §§5.2–5.5, and Customer's compliance obligations under them are material terms of the Agreement.

6. Fees and Payment

6.1 Fees. Customer pays the subscription, implementation, and overage fees stated in the Order Form. Subscription fees are billed monthly in advance; overage fees (per lead processed above the plan's included volume, as metered by the Service) are billed monthly in arrears. Payment is processed by Stripe using the payment method on file, which Customer authorizes Penzago to charge on a recurring basis.

6.2 Fee changes. Penzago may change recurring fees on at least thirty (30) days' written notice, effective at the start of a subsequent billing month. If Customer does not accept a fee increase, Customer may terminate under §7.2 effective before the increase applies; continued use after the effective date of a noticed fee change constitutes acceptance of that fee change only.

6.3 Late payment. If a charge fails, Penzago may retry the payment method and will notify Customer. If payment remains outstanding after a reasonable dunning period, Penzago may suspend the Service until paid. Amounts more than thirty (30) days past due may accrue interest at 1.0% per month or the maximum lawful rate, whichever is less.

6.4 No refunds. Except as expressly stated in the Agreement, fees are non-refundable and non-creditable.

7. Term; Termination

7.1 Term. The Agreement begins on the Order Form Effective Date and continues month-to-month until terminated.

7.2 Termination for convenience. Either party may terminate the Agreement effective as of the end of a billing month on at least thirty (30) days' written notice.

7.3 Termination for cause. Either party may terminate immediately on written notice if the other party materially breaches the Agreement and fails to cure within fifteen (15) days of notice (five (5) days for breaches of §5.2 or the AUP), or immediately without a cure period if the breach is incapable of cure or the other party becomes insolvent.

7.4 Effect of termination. On termination or expiration: (a) Customer's access ceases at the effective date, and Penzago cancels the Stripe subscription; (b) a seven (7) day grace period follows during which the deletion of Customer's account data is pending, Customer may request an export of its data (delivered via time-limited secure download links), and Customer may cancel a termination initiated in error; (c) after the grace period, Penzago deletes Customer's OAuth tokens and stored credentials, removes Customer's workflows from the automation engine, and deletes or de-identifies Customer Data as described in the DPA; and (d) records Penzago is legally required or permitted to retain (including Consumer opt-out records, billing records, and audit logs) are retained per the DPA. Sections 4.3, 5.2(e), 8–12, and 14–15 survive termination.

8. Intellectual Property

8.1 Penzago IP. Penzago and its licensors own the Service, including all software, Playbook designs, workflow templates, prompts and AI configurations, documentation, and all improvements — including improvements informed by feedback. No rights are granted except as expressly stated. Customer will not reverse engineer, copy, resell, or build a competing product using the Service, and will not remove proprietary notices.

8.2 Feedback. Customer grants Penzago a perpetual, irrevocable, royalty-free license to use suggestions and feedback without restriction or attribution.

9. Confidentiality

Each party will protect the other's non-public business, technical, and financial information ("Confidential Information") with at least reasonable care, use it only to perform under the Agreement, and disclose it only to personnel and contractors under confidentiality obligations at least as protective. Confidential Information excludes information that is or becomes public without breach, was known without restriction, is independently developed, or is rightfully received from a third party. A party may disclose Confidential Information as required by law with prompt notice to the other party where lawful. These obligations survive for three (3) years after termination; trade secrets are protected for as long as they remain trade secrets.

10. Warranties; Disclaimers

10.1 Mutual. Each party warrants that it is duly organized and has the authority to enter into the Agreement.

10.2 Penzago. Penzago warrants that it provides the Service using commercially reasonable skill and care and maintains the security measures described in the DPA.

10.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THE AGREEMENT, THE SERVICE IS PROVIDED "AS IS" AND PENZAGO DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. PENZAGO DOES NOT WARRANT UNINTERRUPTED OR ERROR-FREE OPERATION, THAT AI-GENERATED CONTENT WILL BE ACCURATE, OR ANY PARTICULAR BUSINESS RESULT (INCLUDING LEAD VOLUME, RESPONSE RATES, OR BOOKINGS). CUSTOMER — NOT PENZAGO — IS RESPONSIBLE FOR REVIEWING AND SUPERVISING ITS PROGRAMS' CONTENT AND CONFIGURATION.

11. Indemnification

11.1 By Customer. Customer will defend and indemnify Penzago, its member(s), and personnel against third-party claims (including regulatory actions and class claims) and resulting damages, penalties, statutory damages, settlements, and reasonable attorneys' fees arising out of: (a) breach of Customer's warranties in §5.2 (consent) or Customer's breach of the AUP; (b) Lead Data or lists Customer submitted, including their source and the consent (or absence of consent) behind them; (c) message content, offers, or business practices specific to Customer, including content Customer supplied or approved; (d) Customer's breach of Platform Terms; and (e) Customer's violation of law in its use of the Service.

11.2 By Penzago. Penzago will defend and indemnify Customer against third-party claims alleging that the Service, as provided by Penzago and used as authorized, infringes a U.S. patent, copyright, or trademark, or misappropriates a trade secret, and will pay resulting damages and reasonable attorneys' fees finally awarded or agreed in settlement. If the Service is enjoined, Penzago may procure the right to continue, modify the Service to be non-infringing, or terminate and refund prepaid unused fees. This §11.2 does not apply to claims arising from Customer Data, Customer's content or configuration, combination with items not provided by Penzago, or use in breach of the Agreement, and states Penzago's entire liability for infringement.

11.3 Procedure. The indemnified party must give prompt notice, tender sole control of defense and settlement (no settlement imposing non-monetary obligations on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party's expense.

12. Limitation of Liability

12.1 No indirect damages. NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY.

12.2 Cap. EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT IS LIMITED TO THE FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY.

12.3 Exclusions from the cap. Sections 12.1 and 12.2 do not apply to: (a) Customer's indemnification obligations under §11.1 and liability for breach of §5.2; (b) Penzago's indemnification obligations under §11.2; (c) Customer's payment obligations; or (d) either party's fraud, gross negligence, or willful misconduct. Statutory damages asserted by Consumers or regulators arising from Customer's consent failures are within §12.3(a) and are not capped.

13. Amendments

Penzago may update this MSA, the DPA, or the AUP from time to time. For any material change — including changes to fees (governed by §6.2), liability, indemnification, dispute resolution, data protection, or the scope of Customer's obligations — Penzago will give at least thirty (30) days' notice by email to Customer's contact of record and a prominent notice in the dashboard, and the change binds Customer only upon Customer's affirmative acceptance (for example, clicking to accept at sign-in). Continued use alone does not constitute acceptance of a material change. If Customer declines a material change, the prior version continues to govern until the end of the notice period, during which either party may terminate under §7.2 without penalty. Non-material changes (clarifications, corrections, feature descriptions) take effect on posting with an updated version date.

14. Governing Law; Venue

The Agreement is governed by the laws of the State of California, excluding its conflict-of-laws rules. The state courts located in Contra Costa County, California, and the United States District Court for the Northern District of California have exclusive jurisdiction over disputes arising out of the Agreement, and each party consents to their jurisdiction and venue and waives trial by jury. This §14 governs disputes between Penzago and Customer; disputes with Consumers under the Consumer Mobile Messaging Terms are governed by the dispute-resolution terms there.

15. General

15.1 Notices. Legal notices must be in writing and are effective when delivered: to Penzago at hello@getreflow.ai; to Customer at the contact email on the Order Form. Either party may update its notice address by notice.

15.2 Assignment. Neither party may assign the Agreement without the other's consent, except that either party may assign it in connection with a merger, reorganization, or sale of substantially all assets, with notice.

15.3 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control (including carrier and platform outages, hosting-provider failures, and government action), except payment obligations.

15.4 Independent contractors; no third-party beneficiaries. The parties are independent contractors. Except as expressly stated (including the enforcement rights in the Consumer Mobile Messaging Terms), there are no third-party beneficiaries.

15.5 Entire agreement; order of precedence; severability; waiver. The Agreement is the parties' entire agreement on its subject and supersedes prior discussions and any Customer purchase-order terms. Precedence: Order Form, then DPA (data protection matters), then this MSA, then the AUP. If a provision is unenforceable, it is modified to the minimum extent necessary and the remainder stands. Failure to enforce is not waiver.