Terms of Service

Version 5. Effective October 25, 2026.

These Terms are between Sondola Inc., a Delaware corporation ("Sondola", "we", "us", "our"), and the organisation that creates or uses a Sondola workspace ("you", "Customer"). They govern Sondola (the "Service"), a metrics dashboard that reads business data from tools you already use and shows it back to you.

About the "In short" summaries. Sections marked In short are plain-English summaries. They are not part of the agreement and they do not change it. Where a summary and a section differ, the section governs.

In short. This is a business contract. It says what Sondola does and does not do with your data, how paid plans will work, and the limits of what we are responsible for. Earlier versions are listed at the end of this page.

1. Definitions

Account Data means what you and your users give us or we record about you: names, work email addresses, authentication and multi-factor records, roles and permissions, workspace settings, support messages, in-app feedback and any screenshots attached to it, billing details once billing opens, and logs of how the Service is used.

AI Output means content generated for you by a large language model through an AI feature of the Service, such as a suggested connector, event or metric definition.

Beta Feature means a feature labelled beta, preview, early access or similar.

Connected Source means a third-party product you authorise us to read: an analytics tool, an advertising platform, an app store, a payment processor, an accounting system, a bank, a messaging tool, a cloud or AI provider's billing data, or any other integration we offer.

Connected Source Data means what we read from a Connected Source on your instruction.

Customer Data means Connected Source Data, Typed-in Data and Derived Data together.

DPA means the Data Processing Addendum at https://sondola.com/legal/dpa.

Derived Data means the metrics, comparisons, goals, forecasts, alerts, digests and images the Service computes from Connected Source Data and Typed-in Data.

Free Use means any use of the Service you do not pay for, including use of a workspace under §12.3 and use under Sondola for Startups.

Order means the plan and price details shown at checkout, in the Service or in an order form you accept.

Paid Plan means a subscription to the Service that you pay for.

Program means Sondola for Startups, and Program Terms means its terms at https://sondola.com/legal/startup-program-terms.

Third-Party Service means a product operated by someone other than us that you choose to use with the Service, including a Connected Source, a Slack workspace, an AI provider whose key you add, and any AI assistant you point at the Service.

Typed-in Data means readings that an owner or manager of your workspace types into the Service by hand. The Service labels them Typed in.

Workspace means your separate tenant in the Service. Customer Data is stored against exactly one Workspace.

2. Accepting these Terms, and who may use Sondola

In short. Sondola is for businesses. The person who signs up confirms they can bind their company.

2.1 How you accept. You accept these Terms when the person creating your Workspace confirms that they accept them, or when anyone uses the Service on your behalf. We record which version was accepted and when.

2.2 Authority. The individual who accepts represents and warrants that they are authorised to bind the organisation named in the Workspace. If they register with an email address on that organisation's domain, or enter its name, they are treated as authorised. An individual who accepts without authority is personally responsible to us for the consequences of that lack of authority.

2.3 Business use only. The Service is for businesses. You confirm that you use it for a trade, business or profession, and not as a consumer. A sole proprietor using the Service for their business is a business for this purpose.

2.4 Who may not use it. You may not use the Service if you or any user is under 18, or if §22.4 (export and sanctions) would be breached.

2.5 What this agreement includes. This agreement consists of these Terms, the DPA, any Order and, if we accept you into the Program, the Program Terms. If they conflict, the DPA governs the processing of personal data in Customer Data, the Program Terms govern the Program, an Order governs its price and term, and these Terms govern everything else. The Privacy Policy explains how we handle Account Data as a controller. It is a notice, not part of this agreement.

3. Three kinds of data, and who is responsible for each

In short. We decide how to handle your account details, so we are responsible for those. You decide what we read from your tools and what we do with it, so you are responsible for that and we act on your instructions.

3.1 Account Data. We act as the controller (a "business" under California law). Our Privacy Policy describes what we collect, why, how long we keep it, and the rights people have.

3.2 Customer Data. For Customer Data we act as your processor (a "service provider" under California law). We process it only on your documented instructions and for no other purpose. Those instructions are this agreement, the DPA and the settings and authorisations you choose in the Service. The DPA forms part of this agreement and applies without a signature.

3.3 We keep them apart. We do not combine Customer Data from one Workspace with Customer Data from another, and we do not combine it with data from any other source, except where you separately and specifically ask us to.

4. Connected Sources

In short. You connect your own tools using your own credentials. Sondola uses that access to read. It does not change or delete your data in those tools. Two features are not reads, and we name them below. You need the right to connect each tool, and providers can change things we do not control.

4.1 Your instruction. Connecting a Connected Source is your instruction to us to read the data that connection permits, on the schedule the Service describes, for as long as the connection is active. You may revoke it at any time by disconnecting in the Service or by revoking access at the provider.

4.2 Sondola reads. It does not change your data. Sondola reads from your Connected Sources. It does not create, change or delete your records in them. We ask for read-only access wherever a provider offers it. Some providers only issue keys or permissions that could also write, and we use those only to read. Two things are not reads, and we state them plainly:

(a) Google Cloud billing. To read your costs, the Google Cloud billing connector runs one query a day in your Google Cloud project. Google may record that query as a job in your project and may bill you for it under your agreement with Google.

(b) Slack digest. If you connect Slack, the Slack digest and alerts post the messages you set up to the channel you choose.

If we add a connector or feature that does anything else in a Connected Source, we will say so on its setup page before you connect it.

4.3 Totals and spending lines, not customer records. The Service keeps aggregate business metrics (totals, rates, balances and time series), not individual-level records about your customers or end users. Some tools only give their figures as a list, such as subscriptions and charges in a billing tool. The Service counts those lists as it reads them and keeps only the totals. Spending is the exception, and it is about your company's own payments. From a bank, card or accounting tool the Service keeps each spending line, with its date, amount, payee or account name and category. From an AI or cloud provider's cost reports it keeps cost and usage by model, project and key. Both are Connected Source Data, and the Privacy Policy describes them. If this changes for a particular connector, we will say so on the connector's page before you connect it, and in the Privacy Policy.

4.4 Your rights and consents. You represent that you are authorised to connect each Connected Source, that you hold all rights and consents needed for us to receive and process what it returns, and that doing so does not breach your agreement with that provider or with anyone else. We cannot check this and we rely on you for it.

4.5 Connected Sources are not our subprocessors. A Connected Source is your vendor, under your agreement with it. We do not control it, do not warrant its availability or accuracy, and are not liable for its acts, omissions or outages. Our subprocessors, the vendors we choose, are listed at https://sondola.com/legal/subprocessors.

4.6 Platform terms we pass through to you. Some providers require that anyone reading their data on your behalf be bound by terms at least as protective as their own. In addition to everything else in this agreement:

(a) Apple. We handle App Store Connect and Apple Ads data solely as your service provider, use it only to provide the Service to you, do not disclose it to any other party, and do not combine it with any other customer's data or contribute it to any cross-developer repository.

(b) Meta. We process Meta Platform Data only for the permitted purposes in Meta's developer documentation, do not sell, license or broker it, do not attempt to re-identify anyone from it, and share it onward only where you expressly direct us to and we have recorded that direction.

(c) Google. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve user-facing features of the Service, and for no other purpose.

(d) Slack. We do not use Slack API Data to train a large language model, and do not use data from one organisation to benefit another organisation or any third party.

(e) Your part. You agree not to use the Service in a way that would put us or you in breach of any Connected Source's terms.

4.7 Deletion on disconnect. When you disconnect a Connected Source we stop collecting from it, retire the connection so no scheduled job can use it again, and delete the raw responses we cached from it within 30 days. We do not yet revoke the credential at the provider on your behalf. That step is yours, and the Service tells you where to take it for each connector. We will update this section if we start doing it. Derived Data already in your dashboard stays until you delete it or close your Workspace.

4.8 Provider changes. Connected Sources are run by other companies, which change their APIs, permissions, rate limits, prices and terms. We may change, suspend, limit or retire any connector, or any feature that depends on one, at any time, including where a provider changes or ends our access or requires us to. We will tell you as soon as reasonably practical when a connector you use is affected. We are not liable for any change, outage, inaccuracy, restatement or loss of access caused by a provider, and fees are not reduced because of one.

4.9 Costs at the provider. Any charge a provider makes to you for API calls, queries, seats or usage connected with our reads, including the query in §4.2(a), is yours to pay under your agreement with that provider. Each setup guide says what the connector asks for.

4.10 Your credentials. You are responsible for creating credentials with the narrowest scope your provider allows, for rotating them, and for revoking them at the provider when you disconnect. We store credentials encrypted and do not show them in the Service after you save them. We are not responsible for misuse of a credential that results from your own systems, staff or other vendors.

5. Your account

5.1 Users. You control who has access to your Workspace and at what level. You are responsible for your users' acts and omissions as if they were your own, and for removing access promptly when someone leaves.

5.2 Activity under your log-ins. You are responsible for all activity under your users' log-ins, whether or not you authorised it, except activity caused by a third party exploiting a vulnerability in the Service itself.

5.3 Security. Tell us at security@sondola.com without delay if you believe an account, credential, token or share link has been compromised. We strongly recommend multi-factor authentication for every user, and we require it for anyone with administrative access to the Service's own operations.

5.4 Accurate details. Keep your Workspace name, legal name and administrator email address current. We rely on that email address for notices and are not responsible for notices you miss because it is out of date.

5.5 One company per Workspace. A Workspace is for one company and its affiliates. Do not open several Workspaces to get around plan limits or Program rules.

6. Acceptable use

You will not, and will not let anyone else:

1. use the Service to store or process data you have no right to process
2. type in, upload or connect payment card numbers, individuals' bank account numbers, government identification numbers, health information or other special-category or sensitive personal data, except where a Connected Source returns it in the ordinary course and the Service is designed to handle it
3. attempt to access another Workspace, probe or scan our systems, load-test the Service, or get around any limit, authentication or security control
4. reverse engineer, decompile or attempt to derive source code, except where the law gives you that right despite this restriction
5. copy features or the interface of the Service to build a competing product, or access the Service to do so
6. scrape or crawl the Service, or access it by automated means other than our documented tokens and interfaces within their limits
7. resell, sublicense or offer the Service to third parties as a service bureau, except that you may show your own metrics to your own staff, board, investors, lenders, auditors and advisers
8. upload malicious code, or use the Service to send unsolicited or unlawful messages
9. use the Service in a way that breaches a Connected Source's terms (see §4.6)
10. use the Service for any purpose where a failure could lead to death, personal injury or environmental damage
11. use the Service in breach of any law, including privacy, securities, export control and sanctions law

We may suspend access under §14.2 where we reasonably believe continued access presents a security risk, a legal risk, or a risk to other customers.

7. Sharing features, and what they mean

In short. Some features send your numbers to people or places you choose, which we do not control. None of them runs until you use it, and each is your decision.

7.1 Share links. You may create a link that shows a metric as an image to anyone who opens it, without signing in. Anyone who has the link can see what it shows, and can pass it on. Links are designed to be unguessable and we store only a hash of the token, but a link is a bearer credential, so treat it like a password. You choose how long each link lives and you can revoke any link, or all of them, at any time. Publishing through a share link is your disclosure of your information, and you are responsible for who receives it and for any confidentiality obligation you owe about it. We will tell you promptly if we become aware of unauthorised access to one of your links.

7.2 AI access (MCP). You may create a personal, read-only token that lets an AI assistant you choose read your Workspace's metrics. When you do, you instruct us to send that data to that assistant's provider. That provider is your vendor, not our subprocessor. We did not select it, we do not control it, and we are not responsible for how it stores, uses or trains on what it receives, or for any action the assistant takes. Review its terms before you connect it. Tokens are read-only, scoped to one Workspace, shown once, stored as a hash and revocable at any time.

7.3 Slack digest and alerts. If you connect Slack, we post the metrics you configure to the channel you choose. Everyone in that channel can see them.

7.4 Investor updates. You may email an update to people you name. It can carry the figures you choose to include, among them cash, burn and spend read from your bank, cards and books, and AI cost. Each recipient gets their own link, and you can see when it is opened. Sending an update is your disclosure of your information to the people you chose. You are the controller of your recipients' personal data, and you are responsible for any notice, lawful basis or confidentiality obligation that applies to them.

8. AI features

In short. AI suggestions can be wrong, so check them before you rely on them. If you add your own AI key, your agreement with that provider applies. We do not train AI on your data, and our contracts with AI providers prohibit them from training on what we send.

8.1 What they are. Some features use a large language model to produce AI Output, for example suggesting which events in a connected tool could define a metric. AI features are optional.

8.2 AI Output can be wrong. AI Output is generated by a statistical model. It can be inaccurate, incomplete, out of date or inconsistent with your data, and it can be affected by content in a Connected Source that is designed to manipulate a model. AI Output is a suggestion. It is not a fact, a calculation we have checked, or advice. Review it before you rely on it, adopt it or share it. You are responsible for what you do with AI Output, including any metric definition, goal or message you accept from a suggestion.

8.3 Your own key. If you add your own key from an AI provider such as Anthropic or OpenAI, AI features run on your account with that provider, under your agreement with it. That provider is your vendor, not our subprocessor. You are responsible for its terms, its charges and the settings on your account with it, including whether it retains or trains on what it receives. We do not see or handle that payment, and we are not responsible for that provider's acts, outages or charges.

8.4 Our providers. Where a feature runs on a model we selected, that provider is our subprocessor and is named on our Subprocessors page before it handles your data. Our contracts with AI providers prohibit them from training on what we send them.

8.5 No training by Sondola. We do not use Customer Data to train, fine-tune or evaluate any AI or machine-learning model.

8.6 Limits and changes. We may set usage limits on AI features, and may change, suspend or withdraw any AI feature or AI provider at any time, including for cost, security, legal or quality reasons.

8.7 No warranty. AI features and AI Output are provided as is, without any warranty, on every plan.

9. What we never do

These are commitments, not marketing. If any of them is to stop being true, we will give you at least 30 days' notice before the change takes effect. If you are on a Paid Plan and do not accept the change, you may terminate before it takes effect and we will refund prepaid fees for the unused part of your term.

• We do not sell Customer Data, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act.
• We do not use Customer Data to train, fine-tune or evaluate any machine-learning model. Our contracts with AI providers prohibit them from training on what we send, and our contracts with our other subprocessors limit them to processing it on our instructions.
• We do not use one customer's Customer Data to serve, benchmark or improve the Service for another customer. Isolation between Workspaces is enforced by row-level security in the database, designed so that one Workspace cannot read another Workspace's data, and checked by automated tests.
• We do not create, change or delete your records in a Connected Source. §4.2 names the two things that are not reads.
• We do not ask a provider for write access to your data where it offers read-only access.
• We do not publish, aggregate or benchmark your numbers against anyone else's. If we build such a feature it will be opt-in, and we will describe exactly what it uses first.

10. Our access to your data

Our staff may access Customer Data only:

• to provide support you have asked for
• to investigate a security incident or a defect
• where you have specifically asked us to
• where the law requires it

Each such access requires multi-factor authentication and is recorded in an audit log that is append-only and not editable through the application. Our systems are designed so that staff cannot read the credentials held for your Connected Sources. We do not sign in as you.

11. Ownership

11.1 Yours. You own Customer Data. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, process and display it, solely to provide, secure and support the Service for you and as you direct through the Service. That licence ends when the data is deleted.

11.2 Ours. We own the Service, our software, metric definitions and formulas, templates, documentation, the format and design of Derived Data, and our brand, with all improvements to them. Nothing in this agreement transfers them to you. During the term you have a non-exclusive, non-transferable, non-sublicensable right to use the Service for your internal business purposes, and to share Derived Data with your staff, board, investors, lenders, auditors and advisers.

11.3 Feedback. If you or your users send us ideas, suggestions or bug reports ("Feedback"), you grant us a perpetual, irrevocable, worldwide, royalty-free, transferable and sublicensable licence to use, modify and commercialise it without obligation to you. We will not identify you as the source without your permission. Feedback does not include Customer Data.

11.4 Service metadata. We may use information about how the Service performs and is used (request volumes, error rates, feature usage, connector reliability) to operate, secure and improve it. This is metadata about our software. It does not include your metric values, and we do not disclose it in a way that identifies you.

12. Plans, free use, Beta Features and Sondola for Startups

In short. Prices are on the pricing page. Free use and beta features come without service levels or warranties and can change. Workspaces created before these Terms keep the Service without charge for at least 12 months after paid plans open, with at least 90 days' notice before any charge.

12.1 Plans and prices. The features, limits and price of each plan are shown on our pricing page at https://sondola.com/pricing or in your Order. The price in your Order applies to your current subscription term.

12.2 Free Use. Free Use has no service levels, no support commitment and no warranty. We may change the features or limits of Free Use, or end it, on at least 30 days' notice, except as §12.3 and the Program Terms provide.

12.3 Workspaces created before October 25, 2026. If your Workspace was created before these Terms took effect, you may keep using the Service for that Workspace without charge until at least 12 months after the date we first make Paid Plans available. We will give you at least 90 days' written notice before we charge anything for that Workspace, and we will not charge you unless you choose a Paid Plan and give us a payment method. Until that date we will not end Free Use for that Workspace under §12.2. The features of the Service may still change as the Service develops, and §12.4 (inactivity), §14 (suspension and termination) and the rest of these Terms still apply. You may also apply to Sondola for Startups. This section replaces the statement in earlier versions of these Terms that what was free would stay free.

12.4 Inactive free Workspaces. We may close a Free Use Workspace that has had no sign-in and no active Connected Source for 90 days. We will give its administrators at least 14 days' notice by email first. After closure, the 30-day export window in §14.5 applies.

12.5 Beta Features. Beta Features are optional, may be incomplete or change, may never become generally available, and may be withdrawn at any time without notice. They have no service levels and are provided as is, without any warranty, support, indemnity or data-retention commitment. Our commitments in §9 and the DPA still apply to any Customer Data they process. Do not publish details of a Beta Feature we have asked you to keep confidential.

12.6 Sondola for Startups. If we accept your Workspace into the Program, the Program Terms apply in addition to these Terms.

13. Fees, billing, renewal and taxes

In short. Paid plans are not on sale yet. When they are, they are paid in advance and renew for the same term unless you cancel first. Price changes apply at your next renewal with at least 30 days' notice.

13.1 Billing is not yet open. We do not take payments yet, and nobody owes us fees today. This section applies to Paid Plans once they become available. When they do, payments will be processed by the payment processor named on our Subprocessors page.

13.2 Fees. You will pay the fees for your plan shown on the pricing page or in your Order. Fees are per Workspace unless the plan says otherwise.

13.3 Prepaid billing. Fees are billed in advance, monthly or yearly as you choose, to the payment method you provide. You authorise us and our payment processor to charge that method for all fees when due.

13.4 Automatic renewal. Your subscription renews automatically for a further term of the same length, at the price then in effect, unless you cancel in the Service before the renewal date. We will email a reminder before a yearly subscription renews. Cancelling stops the next renewal. It does not end or refund the current term.

13.5 Price changes. We may change prices. A change takes effect at your next renewal, and we will give you at least 30 days' notice. If you do not accept it, cancel before the renewal.

13.6 Taxes. Fees exclude sales, use, value-added, goods and services and similar taxes. You will pay any such taxes that apply, except taxes on our net income. If you give us a valid exemption certificate or a VAT number for reverse charge, we will apply it.

13.7 Fees are non-refundable. Fees are non-refundable and payment obligations are non-cancellable, except where these Terms expressly provide a refund (§9, §14.3, §14.4(e), §16.1, §17.1, §21.3 and §22.3), where the Subprocessors page provides one on an objection, or where the law requires one.

13.8 Late payment. If a payment fails or is overdue, we will tell you in writing. If it is still unpaid at least 15 days after that notice, we may suspend your Workspace until it is paid. Amounts more than 30 days overdue accrue interest at 1 percent a month or the highest rate the law allows, whichever is lower.

13.9 Billing disputes. Tell us at legal@sondola.com within 60 days of a charge if you believe it is wrong. We will review it in good faith. Undisputed amounts remain payable.

13.10 Upgrades and downgrades. Upgrades take effect immediately and are prorated. Downgrades take effect at the next renewal. A downgrade may remove features or history limits, and we are not responsible for what is lost as a result, provided we warn you in the Service before you confirm.

14. Term, suspension, termination and your data

14.1 Term. This agreement runs from acceptance until every Workspace you hold is closed. A Paid Plan subscription runs for the term you chose and renews under §13.4.

14.2 Suspension. We may suspend all or part of the Service for your Workspace if (a) a payment is overdue as §13.8 describes, (b) we reasonably believe your use breaches §6 or the law, or presents a security risk or a risk of harm to us, other customers or a provider, (c) a provider requires us to, or (d) the law or a court requires us to. Except for suspension under (a), which always follows the notice in §13.8, we will give you notice and a chance to fix the problem first where that is reasonable in the circumstances. Where it is not, we will tell you why as soon as we reasonably can. We will limit any suspension to what is needed and lift it once the cause is resolved. Suspension does not stop fees accruing on a Paid Plan unless the suspension is our fault.

14.3 Termination by you. You may close your Workspace at any time in the Service. For a Paid Plan, closing takes effect at the end of the current term and is not refunded, unless you terminate for our material breach that we have not cured within 30 days of your notice, in which case we refund prepaid fees for the unused part of the term.

14.4 Termination by us. We may terminate:

(a) for your material breach not cured within 30 days of our notice

(b) immediately on notice, for a breach of §6 or §22.4 that presents a serious risk, or for non-payment that remains unresolved 30 days after we suspended your Workspace under §13.8

(c) Free Use, on at least 30 days' notice, subject to §12.3 and the Program Terms, or under §12.4

(d) a Paid Plan at the end of its current term, on at least 30 days' notice

(e) on at least 60 days' notice if we discontinue the Service, in which case we refund prepaid fees for the unused part of the term

14.5 What happens to your data. On termination or closure:

If we terminated under §14.4(b) for a security risk, we may provide your export in a way that addresses that risk, for example as a file we send you rather than through access to the Service. We will delete sooner on written request, except where the law requires us to keep something.

14.6 Fees on termination. Termination does not relieve you of fees that accrued before it.

15. Confidentiality

15.1 Each party will protect the other's non-public information that it receives under this agreement with at least reasonable care, use it only for this agreement, and disclose it only to employees, contractors and advisers who need it and are bound to keep it confidential.

15.2 Customer Data is your confidential information. Our non-public pricing, roadmap, Beta Features and non-public security details are ours.

15.3 These obligations do not cover information that is public through no fault of the recipient, was already known to it, is independently developed, or is lawfully received from someone else. Disclosure compelled by law is permitted, with prompt notice to the other party where notice is lawful.

15.4 Either party may disclose the existence and terms of this agreement in confidence to its actual or prospective investors, lenders, acquirers and their advisers.

15.5 These obligations last for 3 years after termination, and for as long as the information remains confidential in the case of Customer Data and trade secrets.

16. Warranties and disclaimers

In short. On paid plans we promise reasonable care, and if we fall short we fix it or refund the unused part of your term. Free use, beta features and AI come as they are. The numbers are estimates from other companies' systems, not advice, and what you send to investors is your statement.

16.1 Our warranty (Paid Plans only). We will provide the Service with reasonable skill and care, and will not materially reduce the overall security of the Service during your paid term. If we breach this warranty and you tell us within 30 days, we will use reasonable efforts to fix the problem. If we cannot fix it within 30 days of your notice, you may terminate the affected subscription and we will refund prepaid fees for the unused part of the term. This is your sole and exclusive remedy for breach of this warranty.

16.2 Your warranties. You warrant that you have the rights and consents described in §4.4, that Typed-in Data is accurate to the best of your knowledge, and that your use of the Service complies with law.

16.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN §16.1, THE SERVICE, FREE USE, BETA FEATURES, AI FEATURES AND AI OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT THE LAW ALLOWS, WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY AND QUIET ENJOYMENT, AND ANY WARRANTY THAT THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE OR ERROR-FREE, OR THAT ANY DATA WILL BE ACCURATE, COMPLETE OR PRESERVED.

16.4 The numbers are estimates. The Service reports figures obtained from third-party systems we do not control and cannot check. Those systems restate, backfill and correct their own data, and our calculations depend on what they return and on the settings you choose. Metrics, goals, forecasts, pace, runway, burn, alerts and any summary or digest are estimates for information only. They are not accounting records, financial statements, audited figures, tax filings, valuations or securities disclosure. Typed-in Data is shown as it was entered and labelled Typed in.

16.5 Not a system of record. Keep your own records in your accounting, banking and other systems. Sondola is not a backup or a system of record.

16.6 No professional advice. We are not an accountant, auditor, tax adviser, lawyer, investment adviser, broker-dealer or fiduciary. Nothing in the Service, including AI Output, is financial, legal, tax, accounting or investment advice. You are responsible for the decisions you make and the conclusions you draw from the Service, and for getting professional advice where you need it.

16.7 What you send others is your statement. Investor updates, share links, Slack digests and anything else you send, share or publish through the Service are your statements, made by you to people you choose. You decide what they say and whether they are accurate and complete. We are not a party to them and are not responsible for your obligations to their recipients, including under securities, confidentiality or consumer protection law.

17. Indemnities

17.1 By us (Paid Plans only). If you are on a Paid Plan, we will defend you against any third-party claim that the Service, used as this agreement permits, infringes a United States patent, copyright or trademark or misappropriates a trade secret, and pay the damages finally awarded or agreed by us in settlement. If such a claim is made or likely, we may get you the right to keep using the Service, modify it so it does not infringe, or, if neither is commercially reasonable, end the affected subscription and refund prepaid fees for the unused part of the term. We have no obligation for claims arising from Customer Data, a Connected Source or other Third-Party Service, AI Output, a Beta Feature, Free Use, a combination with anything we did not provide, use not permitted by this agreement, or continued use after we told you to stop. §18.3 caps this obligation. This section states our entire liability, and your sole remedy, for infringement claims.

17.2 By you. You will defend us, our affiliates and our and their personnel against any third-party claim or regulatory action, and pay the resulting damages, fines, penalties, settlements and reasonable legal costs, to the extent it arises from (a) Customer Data or Typed-in Data, (b) your breach of §4.4, §4.6, §6 or §22.4, (c) any investor update, share link, digest or other content you send, share or publish through the Service, or anyone's reliance on it, (d) your use of an AI assistant or AI provider with the Service, or (e) your violation of law.

17.3 Process. The party seeking indemnity must notify the other promptly (late notice only reduces the obligation to the extent it causes prejudice), let the indemnifying party control the defence and settlement, and cooperate reasonably at the indemnifying party's cost. The indemnified party may take part with its own counsel at its own cost. No settlement that admits fault for, or imposes an obligation on, the indemnified party binds it without its consent, which it will not unreasonably withhold.

18. Limitation of liability

In short. On a paid plan our liability is capped at what you paid in the 3 months before the problem. For free use, the startup program and beta features it is US$100. Neither of us pays for indirect losses. Your payment obligations, your indemnity and your breaches of acceptable use are not capped.

18.1 No indirect damages. EXCEPT FOR EXCLUDED CLAIMS, NEITHER PARTY IS LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, SAVINGS, GOODWILL OR BUSINESS OPPORTUNITY, LOST OR CORRUPTED DATA, OR THE COST OF SUBSTITUTE GOODS OR SERVICES, HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THEIR POSSIBILITY.

18.2 Cap. EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, ON ANY THEORY, INCLUDING NEGLIGENCE AND BREACH OF THE DPA, WILL NOT EXCEED:

(a) FOR A PAID PLAN, THE FEES YOU ACTUALLY PAID US FOR THE SERVICE IN THE 3 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, AND

(b) FOR FREE USE, THE PROGRAM OR A BETA FEATURE, US$100.

A claim that arises from Free Use, the Program or a Beta Feature is subject to (b), even if you also have a Paid Plan. Several claims do not enlarge these limits.

18.3 Indemnity cap. OUR TOTAL LIABILITY UNDER §17.1 WILL NOT EXCEED TWO TIMES THE AMOUNT IN §18.2(a).

18.4 Excluded Claims. The limits in §18.1 and §18.2 do not apply to the following "Excluded Claims":

(a) your obligation to pay fees

(b) your obligations under §17.2

(c) your breach of §6

(d) a party's fraud or wilful misconduct

For Sondola, the only Excluded Claims are fraud and wilful misconduct.

18.5 Why these limits. The prices and the availability of Free Use reflect these limits, and both parties rely on them. They apply even if a limited remedy fails of its essential purpose.

18.6 Where the law does not allow a limit. If the law does not allow a limitation or exclusion in this section, it applies to the fullest extent the law allows.

18.7 Time limit. Any claim arising out of or relating to this agreement must be brought within one year after it accrued, or it is barred.

19. Publicity

19.1 We may list your company name, in plain text, among our customers on our website and in sales materials, unless you tell us not to at legal@sondola.com. We will remove it within 30 days of your request.

19.2 We will not use your logo or trademarks, quote anyone at your company, publish a case study about you, or say that you take part in the Program, without your prior written consent. Email is enough, and you may withdraw consent for future use at any time.

19.3 You may say that you use Sondola. You may not suggest that we endorse you or your figures.

20. Disputes

In short. Talk to us first. If that fails, disputes go to individual arbitration in Wilmington, Delaware, under Delaware law, not to class actions or juries. Small claims court and urgent injunctions are allowed. You can opt out of arbitration within 30 days.

20.1 Talk first. Before starting any proceeding, contact us at legal@sondola.com with a description of the dispute. Both parties will try in good faith to resolve it within 30 days.

20.2 Governing law. The laws of the State of Delaware govern this agreement and any dispute arising out of or relating to it, without regard to conflict-of-laws rules. The Federal Arbitration Act governs §20.3 to §20.8. The UN Convention on Contracts for the International Sale of Goods does not apply.

20.3 Arbitration. Any dispute arising out of or relating to this agreement or the Service that is not resolved under §20.1 will be finally settled by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules, before one arbitrator. The seat of arbitration is Wilmington, Delaware, and the arbitration will be conducted in English. Judgment on the award may be entered in any court of competent jurisdiction.

20.4 Who decides. The arbitrator decides all questions about the existence, scope, validity, interpretation and enforceability of this agreement to arbitrate, except that a court decides whether §20.5 is enforceable.

20.5 Individual claims only. Each party may bring claims against the other only in its individual capacity, and not as a plaintiff or class member in any class, collective, consolidated or representative proceeding. The arbitrator may not consolidate the claims of more than one customer and may award relief only in favour of the individual party seeking it. This does not waive the right to seek public injunctive relief where the law does not allow that right to be waived. If this §20.5 is found unenforceable for a claim, that claim proceeds in court under §20.9 and the rest of §20 continues to apply to other claims.

20.6 Mass filings. If 25 or more similar demands for arbitration are filed against us by or with the help of the same law firm, group or coordinated parties, they will be administered under any AAA rules for multiple or mass filings in effect at the time, and the parties will ask that they be processed in batches of no more than 25 demands, with one arbitrator for each batch. Limitation periods for demands waiting in a later batch are paused until that batch begins.

20.7 Confidentiality. The arbitration, including any filings, hearings, evidence and award, is confidential, except as needed to enforce or challenge an award or as the law requires.

20.8 Exceptions. Either party may bring an individual claim in a small claims court with jurisdiction. Either party may also seek an injunction or other equitable relief in court to protect its intellectual property, its confidential information or the security of the Service, without first going through §20.1 or arbitration.

20.9 Courts and jury waiver. Any matter that is not arbitrated will be heard only in the state or federal courts located in Delaware, and each party consents to their jurisdiction. EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL IN ANY SUCH MATTER.

20.10 Opting out of arbitration. You may reject §20.3 to §20.7 by emailing legal@sondola.com within 30 days after you first accept these Terms, with your Workspace name and a clear statement that you opt out of arbitration. Opting out costs nothing and affects nothing else in this agreement. An opt-out you sent under an earlier version of these Terms remains in effect.

20.11 Changes to this section. We will give at least 30 days' notice of any change to this §20. A change does not apply to a dispute already notified to us under §20.1 or filed before the change takes effect.

21. Changes to these Terms

21.1 We may change these Terms. For a material change we will give at least 30 days' notice by email to your administrator and in the Service before it takes effect. Other changes take effect when posted. A change the law requires takes effect when the law requires.

21.2 Changes apply only from their effective date. Continued use after that date is acceptance. Every prior version stays listed at the end of this page.

21.3 If you are on a Paid Plan and a material change reduces your rights, you may terminate before the change takes effect by notice to legal@sondola.com, and we will refund prepaid fees for the unused part of your term.

22. General

22.1 Notices. We send notices to the administrator email address on your Workspace and in the Service. You send notices to legal@sondola.com. An email notice is treated as received on the business day after it is sent.

22.2 Assignment. You may not assign or transfer this agreement without our written consent, except to a successor in a merger, acquisition or sale of all or substantially all of your assets, on notice to us. Program benefits transfer only as the Program Terms allow. We may assign or transfer this agreement, in whole or in part, to an affiliate, or to a successor in a merger, acquisition or sale of all or substantially all of the assets of the business that operates the Service, on notice to you. Any attempted assignment in breach of this section is void. This agreement binds and benefits the parties and their permitted successors and assigns.

22.3 Force majeure. Neither party is liable for delay or failure to perform, other than a failure to pay, caused by events beyond its reasonable control, including failure or unavailability of hosting, cloud, network, email or payment providers, a Connected Source's outage, API change or withdrawal of access, cyberattacks (unless caused by our failure to keep reasonable security), labour action, fire, flood, epidemic, war, terrorism and government action. If such an event stops the Service for more than 30 consecutive days, either party may terminate the affected subscription, and we will refund prepaid fees for the unused part of the term.

22.4 Export and sanctions. You represent and agree that neither you nor any user is located in, organised in or ordinarily resident in a country or region subject to comprehensive United States sanctions, is named on or owned 50 percent or more by anyone named on a United States government restricted-party list, or will use the Service for a prohibited end use. You will comply with United States export control and sanctions laws. We may suspend or terminate immediately if this changes.

22.5 Severability. If a provision is unenforceable, it is modified to the minimum extent needed to make it enforceable, and the rest stands.

22.6 No waiver. Not enforcing a right is not a waiver of it.

22.7 Independent contractors. Nothing here creates a partnership, joint venture, employment, fiduciary or agency relationship.

22.8 Third parties. There are no third-party beneficiaries of this agreement, except that our affiliates and our and their personnel may rely on §17.2 and §18.

22.9 Entire agreement. This agreement is the whole agreement about its subject matter and replaces all earlier agreements, proposals and statements about it, including marketing statements. Terms in your purchase orders or other forms do not apply.

22.10 Survival. Sections 4.4, 4.6, 4.9, 9 (for 30 days after termination), 11, 13 (for amounts owed), 14.5, 14.6, 15, 16, 17, 18, 20, 22.2 and this 22.10 survive termination.

22.11 Electronic communications. You agree to receive notices and agreements electronically. Headings and "In short" summaries are for convenience only.

22.12 Government users. The Service is "commercial computer software" under FAR 12.212 and DFARS 227.7202.

What changed in version 5

• §1 names Sondola Inc., a Delaware corporation, as the contracting party and adds definitions for Paid Plans, Free Use, Beta Features, AI Output and the Program.
• §2 adds how you accept, authority, business use only and the order of the documents. The Privacy Policy is now a notice and not part of the agreement.
• §4.2 states the read-only commitment exactly, and names the two things that are not reads: the daily Google Cloud billing query and the Slack digest. §4.8 to §4.10 cover provider changes, provider costs and credentials.
• §6 expands acceptable use. §8 is a new AI section. §9 rewrites the commitments so each one can be checked.
• §12 and §13 add plans, Free Use, Beta Features, the Program and the terms for paid plans when billing opens. The statement that what is free today stays free is replaced by §12.3, which keeps Workspaces created before these Terms free for at least 12 months after paid plans open, with at least 90 days' notice before any charge.
• §14 adds suspension, including for non-payment after at least 15 days' notice, and aligns the deletion table with the Privacy Policy.
• §16 to §18 add a sole remedy, estimate and no-advice language, paid-plan limits on our warranty and indemnity, and new liability caps: fees paid in the 3 months before the claim on paid plans, and US$100 for Free Use, the Program and Beta Features. Gross negligence is no longer excluded from the cap for Sondola.
• §19 adds publicity rules. §20 adds the arbitration seat in Wilmington, delegation, mass filings, confidentiality, small claims and a jury waiver, and keeps the 30-day opt-out.
• §22.2 lets us assign to an affiliate or a successor on notice.

Previous versions: version 1, published September 1, 2026. Version 2, published September 24, 2026, reworded some sentences so they read plainly and stated the read-only commitment the way the product did. Version 3, published September 24, 2026, removed the terms that only applied to a paid service, added Typed-in Data to Customer Data and said how long the record of what each account agreed to is kept. Version 4, published September 25, 2026, described the spending lines and AI cost data the Service keeps, added investor updates to the sharing features and rewrote some sections as lists. Version 5 is described above.