Master Subscription Agreement

1. Definitions and Contract Structure

(a) “Applicable Data Protection Law” means any law or regulation applicable to a party’s Processing of Personal Data under the Agreement and governing privacy, data protection, data security or breach notification. “Authorized User” means an individual whom Customer permits to use the Service for Customer’s business. “Customer Data” means data, documents, records, images and other content submitted to or generated for Customer through the Service. “Documentation” means Provider’s then-current user materials for the Service. “Order Form” means a written or electronic ordering document accepted by both parties. “Personal Data” means Customer Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual or household, and includes personal data, personal information and similar terms under Applicable Data Protection Law. “Process” and “Processing” mean any operation performed on Personal Data, whether or not by automated means. “Service” means the hosted software, mobile application, enabled modules, Documentation and support identified in an Order Form. “Subprocessor” means a third party engaged by Provider to Process Personal Data on Customer’s behalf. “Subscription Term” means the term stated in an Order Form.

(b) Each Order Form creates a separate agreement between Provider and the Customer signing it. An Order Form controls as to the subscribed product, enabled modules, usage limits, support tier, fees, term and any special term that expressly identifies the provision of this Agreement being modified. This Agreement controls all other matters. Sections 5 and 6 constitute the parties’ binding data-processing terms and apply automatically whenever Provider Processes Personal Data on Customer’s behalf; no separate data-processing addendum is required for the Processing described in this Agreement. If the parties later sign a data-processing or privacy addendum, it controls only to the extent of a conflict concerning privacy or Processing of Personal Data.

2. Subscription Rights and Authorized Users

(a) Subject to Customer’s payment of applicable fees and compliance with the Agreement, Provider grants Customer a limited, nonexclusive, nontransferable and nonsublicensable right during the Subscription Term to access and use the Service for Customer’s internal business operations in the territory stated in the Order Form.

(b) Customer may authorize its officers, employees, drivers, contractors and other individuals acting for Customer who require access for an approved business purpose. Customer shall control approval and removal of Authorized Users, maintain accurate account information, protect credentials, and remain responsible for activity conducted through its accounts.

(c) Customer shall not sell, sublicense, rent, timeshare, publish or provide the Service to a third party; permit access for another entity’s business; reverse engineer or attempt to obtain source code; remove proprietary notices; circumvent security or usage limits; use the Service to create a competing product; or access the Service for unlawful, abusive or unauthorized purposes, except to the extent a restriction is prohibited by applicable law.

3. Service Delivery, Changes and Support

(a) Provider shall use commercially reasonable efforts to operate the Service and provide the functions enabled in the applicable Order Form. Provider may use cloud, communications, mapping, telematics, artificial-intelligence, payment and other service providers as reasonably necessary to operate the Service.

(b) Standard Support consists of reasonable assistance to Customer’s designated administrators during Provider’s normal business hours, together with commercially reasonable response efforts for material production outages or confirmed security incidents. No uptime commitment, response-time guarantee, service credit or twenty-four-hour support obligation applies unless expressly stated in an Order Form or service-level addendum.

(c) Provider may perform scheduled or emergency maintenance and may modify the Service to improve security, reliability, legal compliance or functionality. Provider will not knowingly eliminate a material subscribed function without reasonable notice or a commercially reasonable substitute, except where immediate action is necessary for security, legal compliance or third-party service changes.

(d) Customer shall provide reasonable cooperation, accurate problem information, supported devices and networks, and timely access to authorized personnel when needed for support. Provider is not responsible for failures caused by Customer systems, unauthorized modifications, third-party outages or misuse.

4. Fees, Taxes and Payment

(a) Customer shall pay the subscription, implementation, usage and approved pass-through charges stated in the Order Form. Unless the Order Form provides otherwise, recurring fees are invoiced monthly in advance and are due within fifteen (15) days after invoice. Undisputed overdue amounts may accrue interest at one percent (1.0%) per month or the maximum lawful rate, whichever is lower.

(b) No third-party or pass-through cost is chargeable unless the Order Form or a later written approval identifies the category and pricing method. Customer is responsible for sales, use and similar transaction taxes imposed on its subscription, excluding taxes measured by Provider’s income.

(c) Provider may suspend access for undisputed amounts remaining unpaid after written notice and a reasonable opportunity to cure. Customer shall notify Provider promptly of any good-faith billing dispute and pay all undisputed portions when due.

5. Customer Data, Privacy and Data Processing

(a) As between the parties, Customer retains all right, title and interest in Customer Data. Customer instructs Provider to Process Customer Data only as necessary to provide, configure, host, secure, support, maintain, troubleshoot and improve the Service for Customer; enable features and integrations selected by Customer; follow Customer’s documented lawful instructions consistent with the Agreement; prevent, detect and address fraud, abuse and security threats; and comply with applicable law. The Agreement, each Order Form, Customer’s configuration and authorized use of the Service, and consistent written instructions constitute Customer’s documented instructions. If applicable law requires Provider to Process Personal Data other than on Customer’s instructions, Provider shall inform Customer before that Processing unless the law prohibits notice.

(b) For Personal Data Processed by Provider on Customer’s behalf, Customer is the controller or business and Provider is the processor, service provider or contractor, as those roles are defined by Applicable Data Protection Law. The subject matter is Provider’s operation and support of the Service; the nature of the Processing may include collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, transmission, combination, restriction, return and deletion; the purposes are those stated in Section 5(a); and the duration is the applicable Subscription Term plus the period reasonably required to return or delete Personal Data. Each party remains independently responsible for Personal Data it Processes for purposes it determines, such as its own business-contact, billing, legal-compliance and relationship-management activities.

(c) The individuals whose Personal Data may be Processed include Authorized Users; Customer’s officers, employees, drivers and contractors; carriers, brokers, shippers, consignees, customers, vendors and other business contacts; and individuals identified in records or documents submitted through the Service. Depending on enabled modules, Personal Data may include names and contact information; account credentials, permissions and identifiers; employment, driver and qualification information, including government-issued identifiers where applicable; vehicle, equipment, load, route, location and telematics information; customer, carrier, transaction, billing and accounting information; documents, records, images and signatures; communications and support information; and device, log and usage information. Customer shall not submit biometric identifiers or biometric information unless an Order Form expressly enables the applicable feature and Customer has provided all required notices and obtained all required written releases.

(d) Customer is responsible for the lawfulness, accuracy and source of Customer Data; determining and documenting a lawful basis for Processing; providing legally required notices; obtaining legally required consents, authorizations and releases; permissions granted to Authorized Users; configuring the Service appropriately; responding to individuals whose data Customer controls; and instructions given to Provider. Customer represents that it has authority to provide Customer Data and instruct Provider to Process it. Customer shall not submit data it lacks authority to Process or instruct Provider to violate law. Provider shall notify Customer if Provider reasonably believes a Customer instruction violates Applicable Data Protection Law, unless notice is prohibited by law.

(e) Provider shall not: (i) sell or share Personal Data, as those terms are defined by Applicable Data Protection Law; (ii) retain, use or disclose Personal Data outside the direct business relationship with Customer or for any purpose other than the limited and specified purposes in the Agreement; (iii) combine Personal Data with personal data received from another person or collected from Provider’s own interaction with an individual, except as permitted by Applicable Data Protection Law and reasonably necessary to provide, secure or improve the Service for Customer; (iv) use Personal Data for targeted advertising or profiling in furtherance of decisions producing legal or similarly significant effects; or (v) use identifiable Customer Data to train a general-purpose artificial-intelligence model without Customer’s separate written authorization. Provider certifies that it understands and will comply with these restrictions.

(f) Provider may create and use aggregated or de-identified operational and usage information for security, analytics, benchmarking and improvement of its services if the information does not identify Customer, an Authorized User, a customer, a driver or another individual; Provider maintains the information in de-identified form; and Provider does not attempt to re-identify it except solely to test whether its de-identification processes comply with law.

(g) Provider shall limit access to Personal Data to personnel who require access to perform the Agreement, ensure that those persons are subject to appropriate confidentiality duties, and require them to Process Personal Data only as authorized. The confidentiality obligations in Section 8 also apply to Customer Data and Personal Data.

(h) Customer generally authorizes Provider to engage Subprocessors reasonably necessary to operate the Service. Provider shall require each Subprocessor by written contract to protect Personal Data and perform the applicable privacy, confidentiality and security obligations imposed on Provider under the Agreement. Provider remains responsible for each Subprocessor’s performance to the extent required by Applicable Data Protection Law. Provider shall maintain a current list of material Subprocessors and provide it on reasonable request. Upon Customer’s written request, Provider shall give reasonable advance notice of a material new Subprocessor so the parties may address documented data-protection concerns in good faith.

(i) Taking into account the nature of the Processing and information available to Provider, Provider shall provide reasonable assistance to Customer with requests to access, correct, delete, restrict or obtain a portable copy of Personal Data; security and breach-notification obligations; data-protection assessments; and consultations or inquiries from a competent regulator. Customer is responsible for verifying a requester’s identity, determining whether a request is valid, and communicating with the requester or regulator. Provider shall not respond directly except on Customer’s documented instruction or as required by law.

(j) Upon reasonable written request, Provider shall make available information reasonably necessary to demonstrate compliance with Sections 5 and 6. Not more than once in any twelve-month period, unless a Security Incident as defined in Section 6(b), reasonable evidence of material noncompliance or a regulator requires otherwise, Customer may request a reasonable security questionnaire, available independent assessment report or other proportionate review. Any review shall protect Provider’s Confidential Information and other customers’ data, avoid unreasonable interference with Provider’s operations, and use existing reports before requesting an on-site assessment. Customer bears its review costs unless the review identifies Provider’s material breach. Provider shall notify Customer if Provider determines it can no longer meet its obligations under Applicable Data Protection Law, and Customer may take reasonable and appropriate steps to stop and remediate unauthorized Processing.

(k) During the Subscription Term, Customer may export Customer Data as permitted by the Service. Upon expiration or termination, Provider shall make a commercially reasonable export of then-available Customer Data available for thirty (30) days upon request. At Customer’s written direction, Provider shall thereafter delete or return Personal Data and delete existing copies, except to the extent law requires retention. Provider may retain Personal Data in backups, security records or disaster-recovery systems until deletion in the ordinary course, provided retained data remains protected, is not used for another purpose and is isolated from ordinary access. If Customer gives no timely direction, Provider may delete or render Customer Data inaccessible after the thirty-day export period.

(l) Each party shall comply with Applicable Data Protection Law as it applies to that party’s performance. Provider shall not transfer Personal Data across a national border in violation of Applicable Data Protection Law. If a change in law requires reasonable changes to the parties’ Processing arrangement, the parties shall cooperate in good faith to implement them through a signed amendment or Order Form.

6. Security and Incident Cooperation

(a) Provider shall maintain a written information-security program containing commercially reasonable administrative, technical and physical safeguards appropriate to the nature and risk of the Service and Customer Data. Safeguards shall include, as appropriate, access controls and least-privilege practices; credential and secret protections; personnel security and training; secure development, change-management and vulnerability-management practices; logging and monitoring; backup, recovery and continuity measures; vendor-risk management; and encryption in transit and at rest for systems designed to transmit or store Personal Data.

(b) “Security Incident” means a confirmed unauthorized access to, acquisition, use, alteration, destruction or disclosure of Personal Data in Provider’s or a Subprocessor’s custody or control. Security Incident does not include unsuccessful attempts or activities that do not compromise Personal Data, such as unsuccessful login attempts, pings, scans, denial-of-service attempts or attacks blocked by security controls.

(c) Provider shall notify Customer without unreasonable delay after becoming aware of a Security Incident and, when Applicable Data Protection Law requires a shorter period, within that period. To the extent reasonably available, notice shall describe the nature of the Security Incident, the categories of Personal Data and individuals affected, likely consequences, and measures taken or proposed to contain, investigate and remediate it. Provider may provide information in phases as it becomes available and may delay information when required by law enforcement or applicable law.

(d) Provider shall take commercially reasonable steps to contain, investigate and remediate a Security Incident and shall provide information and cooperation reasonably necessary for Customer to satisfy applicable notification duties. Customer controls notices to individuals, regulators and third parties concerning Customer Data unless Provider is independently required by law to provide notice. Neither party shall issue a public statement identifying the other party without prior notice and reasonable consultation, except as required by law. Notice or cooperation under this Section is not an admission of fault or liability.

(e) Customer shall use reasonable safeguards for credentials, devices and local systems; follow Provider’s security instructions; limit access to authorized personnel; promptly disable access for departed or unauthorized users; and promptly notify Provider of suspected compromise. Provider is not responsible for unauthorized access resulting from Customer’s failure to comply with these obligations, except to the extent caused by Provider.

7. Intellectual Property and Feedback

(a) Provider and its licensors, including FR8 Technologies IP, LLC, retain all right, title and interest in the Service and its source code, object code, architecture, designs, Documentation, prompts, schemas, models, marks, improvements and related intellectual property. Customer receives only the subscription rights expressly granted by this Agreement and an Order Form.

(b) Customer acquires no ownership, authorship, joint-development, lien, security interest or other proprietary right by paying fees, funding a feature, providing requirements, testing, reporting a defect or requesting a modification. General improvements, updates, bug fixes, integrations and customer-requested features remain owned by Provider or its licensors unless a separate signed agreement expressly states otherwise.

(c) Customer retains ownership of Customer Data and Customer-specific content that does not embody or disclose the Service’s source code or proprietary architecture. Provider may use feedback and suggestions without restriction or payment, provided it does not disclose Customer’s Confidential Information or publicly identify Customer without permission.

(d) Customer may use Provider-approved product names and marks solely to identify its authorized use of the Service and in accordance with Provider’s brand instructions. All goodwill arising from such use benefits the applicable mark owner.

8. Confidentiality

(a) Each party shall protect the other party’s nonpublic business, technical, security, financial and operational information (“Confidential Information”) with at least reasonable care, use it only to perform or exercise rights under the Agreement, and disclose it only to personnel, professional advisers and service providers who need to know and are subject to appropriate confidentiality duties.

(b) Confidential Information excludes information that the receiving party can document was lawfully known without restriction, independently developed without use of the information, lawfully received from a third party without restriction, or publicly available without breach. A legally compelled disclosure may be made after notice and reasonable cooperation where permitted by law.

(c) Source code, credentials, nonpublic security information and trade secrets shall remain protected for so long as they remain confidential. Other confidentiality obligations survive for five (5) years after termination.

9. Acceptable Use and Third-Party Services

(a) Customer shall use the Service lawfully and shall not upload malicious code; interfere with availability; probe or test security without written authorization; access another customer’s data; misrepresent identity or authority; or use the Service in a manner reasonably likely to harm Provider, another customer or an individual.

(b) Third-party integrations and platforms may be governed by separate terms and may change or discontinue independently of Provider. Provider will use commercially reasonable efforts to maintain material integrations but does not warrant the continued availability of a third-party service.

10. Term, Suspension, Termination and Transition

(a) This Agreement begins when Customer signs its first Order Form and remains effective while any Order Form remains in effect. The Subscription Term and renewal provisions for each Service are stated in the applicable Order Form.

(b) Either party may terminate an Order Form for a material breach not cured within thirty (30) days after written notice, or immediately if the breach is not curable, involves unauthorized use of intellectual property, creates a material security or legal risk, or results from insolvency or cessation of business.

(c) Provider may suspend affected access when reasonably necessary to protect the Service, Customer Data, another customer or applicable law, or for material nonpayment after notice. Provider shall limit a suspension to the scope and duration reasonably necessary and restore access after the condition is cured.

(d) Upon termination, Customer shall stop using the affected Service and pay undisputed accrued charges. Termination does not grant Customer source-code access, a perpetual license, continued hosting rights or ownership of an improvement. Any transition services must be stated in a signed writing identifying their scope, duration, fees and security conditions.

11. Representations, Warranties and Disclaimers

(a) Each party represents that it is duly organized, has authority to enter into the Agreement, and will comply with laws applicable to its own performance. Provider represents that it has authority to provide the Service. Customer represents that its use, Customer Data and instructions will not violate law or third-party rights.

(b) Provider warrants that the Service will materially conform to the applicable Documentation during the Subscription Term when used as authorized. Customer’s exclusive remedy for breach of this warranty is commercially reasonable correction or re-performance, or, if Provider cannot do so, termination of the affected Service and refund of prepaid unused fees for the terminated period.

(c) Except for the express warranty above, the Service is provided “as is” and “as available.” Provider disclaims implied warranties of merchantability, fitness for a particular purpose, noninfringement and uninterrupted or error-free operation to the maximum extent permitted by law. Provider does not guarantee business outcomes, Customer’s regulatory compliance, or continued availability of third-party services.

12. Indemnification

(a) Customer shall defend and indemnify Provider and its licensors, officers and personnel against third-party claims arising from Customer Data, Customer’s violation of law or third-party rights, or Customer’s or an Authorized User’s prohibited use of the Service, except to the extent caused by Provider’s breach of the Agreement.

(b) Provider shall defend Customer against a third-party claim alleging that Customer’s authorized use of the unmodified Service infringes a United States patent, copyright or trademark, and shall pay damages finally awarded or approved in settlement. Provider has no obligation for claims arising from Customer Data, Customer specifications, unauthorized modifications, combinations not supplied by Provider, continued use after notice, or free or beta features.

(c) If an infringement claim is likely, Provider may obtain continued use rights, modify or replace the affected Service, or terminate it and refund prepaid unused fees for the terminated period. The indemnified party shall give prompt notice, reasonable cooperation and control of the defense to the indemnifying party, subject to the indemnified party’s right to participate with its own counsel at its expense.

13. Limitation of Liability

(a) Neither party is liable for indirect, incidental, special, exemplary, punitive or consequential damages, or for lost profits, revenue, goodwill or business interruption, arising from the Agreement, even if advised that such damages were possible.

(b) Except for Customer’s payment obligations, either party’s fraud or willful misconduct, Customer’s unauthorized use of the Service or intellectual property, and obligations that cannot lawfully be limited, each party’s aggregate direct liability arising from an Order Form shall not exceed the greater of ten thousand dollars ($10,000) or the fees paid or payable under that Order Form during the twelve (12) months preceding the event giving rise to the claim. Provider’s aggregate liability for breach of confidentiality, confirmed security obligations, or its indemnity under Section 12(b) shall not exceed two times that amount.

14. General

(a) The parties are independent contractors. The Agreement does not create a partnership, joint venture, fiduciary relationship, joint employment, franchise, guaranty or agency, and neither party may bind the other.

(b) Neither party may assign the Agreement without the other party’s prior written consent, except in connection with a merger, reorganization or sale of substantially all assets relating to the Agreement if the assignee assumes the assigning party’s obligations in writing. Provider may also assign the Agreement to a successor to the Service or its business. Any prohibited assignment is void.

(c) Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations. The affected party shall use reasonable efforts to reduce the impact and resume performance.

(d) Notices shall be in writing and delivered personally, by nationally recognized courier, certified mail, or email with confirmation of receipt to the contacts stated in the Order Form or later designated in writing. Provider’s notice address is 7450 Duvan Drive, Tinley Park, Illinois 60477.

(e) The Agreement is governed by Illinois law, without regard to conflict-of-law principles. The state and federal courts located in Cook County, Illinois have exclusive jurisdiction, and each party consents to that venue.

(f) The Agreement is the entire agreement concerning the Service and supersedes prior oral or informal understandings on that subject. Amendments and waivers must be in a signed writing. If a provision is unenforceable, it shall be enforced to the maximum extent permitted and the remaining provisions remain effective. No person other than the parties is a third-party beneficiary. Counterparts and electronic or PDF signatures are effective as originals.

(g) Provisions concerning payment, confidentiality, Customer Data, security, intellectual property, indemnification, limitations of liability, transition and general interpretation survive as necessary to give them effect.