TERMS OF SERVICE: UCM PLATFORM (MORTGAGE MECHANIC CRM & REALTOR PLATFORM)

VERSION: 5.2 (UNIFIED - AUDIT #19 REMEDIATION: ASSET-DISSIPATION, RESPA § 8 FMV CERTIFICATE, SMS COMPLIANCE ARMOR)

EFFECTIVE DATE: 2026-10-19

CONTRACTING ENTITY: Under Contract LLC, a Florida limited liability company

GOVERNING LAW: The State of Florida

ARBITRATION SEAT: Florida

ARBITRATION ADMINISTRATOR: American Arbitration Association (AAA)

CHANGES FROM v5.1. v5.2 syncs the unified agreement with the sibling silo (UCR) and fortifies the SMS re-engagement and consent posture following Audit #22: (1) dollar-first Reg Z-compliant re-engagement (no estimated APR); (2) fail-closed TCPA prior-express-written-consent gate; (3) RESPA § 8 co-marketing FMV certificate language; (4) asset-dissipation and STOP/opt-out handling. v5.1 (below) fortified the unified agreement following Audit #14 and the rollout of Epics 104 through 133 across the Mortgage Mechanic CRM and Realtor Platform:

1. Sovereign Mobility & Sphere of Influence (SOI) Data Boundary (§ 9.2(a), § 10.2): Clarified the IP and data portability boundaries for Individual Sovereign Users operating under Freedom Tier sponsorships. Personal contacts, historical SOI relationships, and portable pipeline metadata remain the sole property of the individual originator/agent; sponsoring brokerages retain ownership strictly over statutory loan transaction files, regulatory compliance records, and supervision logs created under that brokerage's license.

2. Statutory & Regulatory Calculation Safe Harbor (§ 6B): Added comprehensive safe harbor disclaimers for automated regulatory logic, including TRID 3-day delivery countdowns, federal holiday business day calendars, IRC § 121 capital gains exclusions, § 121(d)(6) depreciation recapture, and RESPA Section 8 expense/gift splits. All such logic is established as decision-support tooling; the Company does not provide legal, CPA, tax, or settlement services.

3. Electronic Signatures and Contracting (§ 6C): Expressly incorporated the E-SIGN Act and UETA standards for cryptographic touch signatures, draw signatures, Micro-LOE bilateral execution, and stipulation acknowledgments, establishing conclusive party intent and authority.

4. In-Call Telemetry & Two-Party Consent Warranty (§ 5.9): Added express representation, warranty, and indemnification that Business Users will comply with state wiretap and two-party recording consent statutes prior to activating audio transcription, whisper coaching, or call telemetry.

IMPORTANT NOTICE: THESE TERMS CONTAIN A BINDING ARBITRATION PROVISION AND A CLASS ACTION WAIVER, INCLUDING A DELEGATION CLAUSE (SECTION 14). BY EXECUTING A CLICKWRAP AGREEMENT TO ACCESS OR USE THE PLATFORM, THE BUSINESS USER AGREES TO THESE TERMS AND WAIVES ITS RIGHT TO A TRIAL BY JURY FOR COVERED CLAIMS.

WHO THIS AGREEMENT IS WITH. This agreement is between Under Contract LLC, a Florida limited liability company ("Company", "Under Contract", "we", "us", or "our") and a Business User (a mortgage originator, real estate brokerage, agent, or other business entity that licenses the Platform). It does not govern consumers (borrowers, homebuyers, or other individuals). Consumer use of any consumer-facing surface (including the EMD portal, magic links, the borrower passport, and the wiring-instruction display) is governed by the separate Consumer Terms of Use and Privacy Notice (the "Consumer Terms"), and nothing in this agreement purports to bind, waive, or limit the rights of any consumer who is not a party to it.

1. NATURE OF THE PLATFORM AND ROLE OF THE COMPANY

The Company provides a multi-tenant software-as-a-service ("SaaS") platform consisting of the Mortgage Mechanic CRM ("CRM") and the Realtor Platform (collectively, the "Platform"). The Company is strictly a technology infrastructure provider. The Company is not a lender, mortgage broker, real estate broker, depository institution, escrow agent, money transmitter, or title insurer.

No fiduciary duty; no duty to verify wires or escrow. The Company is a software provider and owes no fiduciary, trustee, escrow, agency, or similar duty to any Business User, consumer, or third party. The Company has no duty to verify, authenticate, validate, or investigate: (a) the authenticity or integrity of any wiring instruction, escrow instruction, or bank-account detail; (b) the identity or authority of any party that supplies an escrow destination; or (c) whether any account is a genuine escrow account. The Business User and the consumer, not the Company, are responsible for independently confirming every escrow destination and wiring instruction by direct voice contact with the title company or other party of record using a number already on file.

Payment instruction, not custody. Where the Platform supports an Earnest Money Deposit ("EMD") or similar transfer, it functions solely as a technical interface that transmits a payment instruction the consumer authorizes directly with a licensed third-party payment processor or financial institution of record (the "Processor"). The Processor, not the Company, receives, holds, and moves funds. The Company does not take custody of, hold, control, or have access to consumer funds, and does not act as escrow agent for any deposit. "EMD staging" means only the preparation and transmission of a consumer-authorized instruction to the Processor, and nothing more.

Conduit for transmission; no control. (a) Any instruction the Platform prepares is transmitted as the consumer's own instruction, for which the Company acts solely as a technology and communications conduit for transmission only, and the Company does not act as an agent for the transmission of money or on behalf of any party. (b) The Company has no authority to bind the Processor, to direct or control the movement of funds, to select the destination of funds, or to hold an instruction in any form that constitutes a fund balance, deposit, or stored value. (c) The lawful authority to move funds is the Processor's license and the consumer's authorization, not the Company's, and the Processor is the party of record for the transfer; the Company is not a party to the movement of funds. (d) Where the Platform queues, retries, or forwards an instruction, it does so only as transmission infrastructure, and at no point does a queued or retried instruction constitute or become a Company-held fund. (e) The Company's fee (if any) is a technology fee for the Platform (including any per-message or per-record Telecom Wallet fee under Section 3), and is charged for software use, not for the transmission of money; no Company fee is assessed on, calculated from, or tied to the amount of any consumer deposit or transfer. Where any fee could be construed as a transmission charge, the parties intend the fee to be a technology fee and the Company does not act as a money transmitter.

Wire fraud and misdirected funds expressly excluded. To the maximum extent permitted by law, the Company shall have no liability for any loss arising out of or relating to wire fraud, business email compromise, social engineering, spoofed or compromised escrow instructions, misdirected EMD funds, or funds sent to a fraudulent or incorrect account, whether or not the Platform displayed, transmitted, queued, or "confirmed" a destination. The Platform's display of a destination account number is a presentation of the destination supplied by the title company or Business User of record, and is not a verification, endorsement, guarantee, or authentication of that account by the Company. See Section 8A (Indemnification).

The Platform's automated features do not constitute financial, legal, tax, or real estate brokerage advice.

2. RESPA §8 COMPLIANCE AND ANTI-KICKBACK PROVISIONS

The Platform facilitates collaboration between mortgage originators and licensed real estate professionals. Each Business User represents that it is responsible for its own compliance with the Real Estate Settlement Procedures Act (RESPA), 12 U.S.C. § 2607, and Regulation X, 12 C.F.R. Part 1024, in connection with its use of the Platform.

1. Uniform, referral-neutral pricing. Platform fees are set at published rates that do not vary based on any settlement-service referral relationship. Any promotional, beta, or founding pricing is offered on equal terms to all similarly situated users regardless of whether a user is a source of settlement-service referrals. The Company prohibits, and the Platform does not facilitate, the subsidization, discounting, or waiver of a Business User's Platform fees by a mortgage originator or other settlement-service provider on behalf of a referring party.

2. Investment on arm's-length terms. Any equity or convertible instrument (including a SAFE) issued to a Business User or an affiliate of a Business User was offered and sold on bona fide, arm's-length terms, at a price and on conditions available to investors who are not sources of settlement-service referrals, and was supported by capital genuinely at risk. Returns, distributions, and conversion terms are determined solely by the instrument's ownership economics and are never adjusted, directly or indirectly, by the volume, value, or existence of settlement-service referrals. No investment is offered or accepted on the condition, understanding, or expectation that the holder will refer settlement-service business, and the Company does not use any holder's referral volume, value, or existence as a factor in establishing, adjusting, or maintaining any economic term of an investment. The Company maintains records sufficient to demonstrate that any such investment was offered on terms comparable to those made available to investors who are not sources of settlement-service referrals. The Company has obtained the advice of counsel regarding the structure of any such investment and maintains that advice in its records; nothing in this Section is a representation to any regulator or consumer, and no Business User may rely on it as legal advice.

3. Affiliated business arrangements. Where a Business User's ownership interest and its referral relationships may constitute an affiliated business arrangement under 12 C.F.R. § 1024.15, the Business User is solely responsible for making any required affiliated-business-arrangement disclosure to the consumer and for satisfying the applicable conditions. The Company does not make that disclosure on any Business User's behalf.

4. Independent counsel. Each Business User is responsible for obtaining its own RESPA and licensing counsel. This Section allocates responsibility between the parties and does not bind, and is not a representation to, any regulator or consumer.

3. TELECOM WALLET AND MICRO-TRANSACTION FEES

The Platform integrates third-party APIs for services including Title X-Ray, identity verification (Plaid/Stripe), message dispatch (Twilio/Postmark), and electronic deposit routing.

1. Business billing only; Consumer Convenience Fees. Costs incurred via the "Telecom Wallet" (including telephony, carrier messaging, and internal verification lookups) are the sole responsibility of the Business User and are billed directly to the Business User's enterprise invoice. The Company strictly prohibits marking up third-party fees or passing any Platform or internal SaaS operating cost to a consumer through a Closing Disclosure, settlement statement, or mortgage instrument. Nothing in this Section prohibits the collection of disclosed, direct consumer convenience fees for voluntary electronic payment and funds-routing services (such as earnest money deposit transfers) initiated by the consumer.

2. Idempotency and finality. Cryptographic idempotency keys for business wallet debits and message dispatches are designed to prevent duplicate processing. A Business User's debit that is successfully verified against the Platform's tamper-evident ledger is presumed final, except for a debit resulting from Company error, a duplicate charge, or an unauthorized transaction, which the Business User may dispute. This Section applies strictly to business-to-business Platform fees and does not affect, waive, or limit any consumer right under Regulation E, the EFTA, applicable card-network rules, or other applicable law.

4. DATA PROVENANCE AND K-ANONYMITY

1. Tamper-evident ledgers and lawful deletion. The Platform maintains cryptographically chained, tamper-evident ledgers for compliance events. A Business User shall not attempt to fork, alter, or tamper with the chain state. The Company honors lawful deletion, correction, and access requests under the GLBA, the CCPA/CPRA, and other applicable privacy laws through a governed administrative process. Where a record must be preserved in the tamper-evident chain, the Company effects deletion by cryptographic erasure or equivalent means designed to render the underlying personal information irrecoverable from the live system and from the ledger while preserving chain integrity (the record is tombstoned - overwritten with a sentinel marker). The Company applies the same standard to replicas and backups on a rolling basis consistent with its backup-retention window; to the extent a copy in an archival backup has not yet aged out of that window, the Company will not restore it into live use and will overwrite it on the next cycle. (See the Privacy Policy for the current implementation status; the Company does not represent a stronger deletion guarantee than the Privacy Policy states.)

2. K-anonymity aggregation. Analytical outputs are bound by a k-anonymity floor of k = 5 (a minimum cohort of five) to prevent subtraction attacks and PII reconstruction, and the Company performs and documents periodic re-identification testing against that floor. The Company may suppress, obscure, or deny any query that falls below that threshold. Aggregated, de-identified outputs are never sold or priced on a per-referral or per-consumer basis, and are not sold to any party in a manner that re-identifies or is reasonably likely to permit re-identification of any individual.

5. TRIGGER LEADS AND TCPA COMPLIANCE

The Platform provides compliance controls that detect credit-inquiry trigger leads and hold a drafted response for human review.

1. Compliance controls; best efforts; not a warranty. The Platform implements commercially reasonable software controls that are best-effort aids to the Business User's own compliance, are not a guarantee, warranty, or representation that any communication is lawful or compliant, and are not a substitute for the Business User's independent TCPA, TSR, state telemarketing, and DNC compliance. The Company does not warrant that the controls will detect every restricted communication or every do-not-contact condition, and the Business User assumes the risk of any communication that the controls do not block.

(a) Suppression control. The Platform is designed to refuse transmission to a number on a do-not-contact or suppression list, and to refuse a communication that its controls identify as a trigger-lead solicitation restricted by the Homebuyers Privacy Protection Act or other applicable law. This control is a technical measure, not a promise of detection.

(b) Timing control. The Platform is designed to refuse transmission of a communication that its controls determine would fall outside the federally or state-permitted contact hours for the recipient, determined by the recipient's best-available location signal or, where none is available, by the Company's default business time zone. A message that the controls determine falls outside permitted hours is blocked, not held for automatic release; the Platform does not auto-release a blocked message when the permitted window next opens. Re-sending is a deliberate, new human action by the Business User during approved hours (see the engineering requirement in `LAUNCH-BLOCKING-LEGAL-FORMATION.md`, Ticket 1).

Every refused transmission is recorded on the Platform's tamper-evident ledger with the reason and the acting Business User.

2. Sole sender. The Platform is a drafting and compliance-aid tool. The Business User is the sole sender and initiator of every communication and is solely responsible for having a lawful basis and prior express consent where required by the TCPA, the TSR, state mini-TCPA/telemarketing laws, and other applicable law. The Business User controls the content, the audience, the timing of any send it approves, and the decision to send; the Platform does not originate, initiate, or send any communication on its own behalf or as the consumer's caller.

3. Consent warranty (opt-in). As a condition of using any messaging feature - including Bulk SMS, automated Sequences, and any automated text or call - the Business User represents, warrants, and covenants that, for every telephone number it uploads, imports, enrolls, or causes the Platform to message:

(a) it has obtained prior express written consent compliant with the TCPA and its implementing rules (47 C.F.R. § 64.1200), or, where the communication is purely informational and no written consent is required, prior express consent, in each case given directly to the Business User and not to the Company;

(b) the consent identifies the Business User (or its brand) as the sender, is not the Company's, and was not obtained by the Company;

(c) the number is not on any federal or state do-not-call registry for which the Business User lacks a valid exemption or existing-business-relationship basis, and is not subject to a prior opt-out, revocation, STOP, or internal suppression the Business User has failed to record;

(d) the Business User will honor opt-out/STOP requests promptly and will maintain and update its suppression records;

(e) it will not use the Platform to send any communication that constitutes an unsolicited advertisement, telemarketing, or "trigger-lead" solicitation where such a communication is prohibited by the Homebuyers Privacy Protection Act, the TSR, or applicable state law.

The Business User bears the entire burden of establishing consent. The Company does not obtain consent on the Business User's behalf and does not adjudicate or independently verify the legal sufficiency of any consent; it provides a recording and suppression mechanism only, and gives no legal assurance of TCPA compliance. The Platform's compliance gate (suppression, quiet-hours, and consent-basis recording) is a risk-reduction tool and a mechanism that executes the Business User's instructions, not a certification and not an adjudication of consent, and it does not shift the consent obligation from the Business User to the Company.

4. TCPA indemnification (express and unmistakable). To the maximum extent permitted by law, and as an express and unambiguous allocation intended to satisfy the clarity requirement for self-indemnification under Florida law, the Business User shall defend, indemnify, and hold harmless the Company, its officers, directors, employees, and agents from and against any and all claims, actions, proceedings, investigations, losses, liabilities, damages, fines, penalties, judgments, settlements, and costs (including reasonable attorneys' fees) arising out of or relating to: (a) any text message, call, or email sent or initiated by the Business User, or from a number the Business User caused the Platform to message; (b) any alleged violation of the TCPA (47 U.S.C. § 227), including statutory damages of $500–$1,500 per violation under 47 U.S.C. § 227(b)(3); (c) any alleged violation of the Telemarketing Sales Rule (16 C.F.R. Part 310), the Homebuyers Privacy Protection Act, the CAN-SPAM Act (15 U.S.C. § 7701 et seq.), or any state mini-TCPA / telemarketing / do-not-call statute; (d) the Business User's failure to obtain, record, or honor consent, or its failure to honor an opt-out or suppression request; and (e) any class, collective, or representative action premised on the Business User's messaging. This indemnity applies even where the claim alleges the Company's concurrent or contributory negligence, and it is intended to be enforceable to the fullest extent of Florida law; provided, however, that it does not extend to the Company's sole negligence, gross negligence, willful misconduct, or fraud, or to any liability that may not be indemnified under applicable law. Where the Company is not named as a party, the Business User may settle a covered claim without the Company's consent but shall give the Company prompt notice and reasonable cooperation; where the Company is named, the Business User shall not settle in a manner that imposes any obligation, admission, or liability on the Company without the Company's prior written consent, which shall not be unreasonably withheld. If either party prevails in an action to enforce this indemnity, the prevailing party is entitled to recover its reasonable attorneys' fees and costs. This indemnity survives termination.

5. A2P 10DLC, carriers, and the Telecom Wallet. The Business User acknowledges that messaging is transmitted using the Business User's own messaging credentials and brand identity (bring-your-own-key), and that the brand/campaign registration, messaging reputation, throughput tier, and number provisioning belong to and are the responsibility of the Business User - not the Company. Any carrier rejection, suspension, number block, throughput downgrade, or fine imposed by a carrier, registry, or messaging intermediary as a result of the Business User's content, volume, or consent practices is the Business User's sole risk and cost. Third-party messaging and wallet fees are the Business User's responsibility under Section 3. The Company does not mark up or absorb these costs (Section 3.1).

6. Sender role; allocation of decision-making (not an admission). The parties agree, as a matter of risk allocation, that the Business User - and not the Company - is the sender, initiator, caller, and "entity that makes or initiates" any communication for purposes of the TCPA and all analogous law. To that end, and as a matter of fact and contract: (i) the Company provides transmission, suppression, and quiet-hours infrastructure only; (ii) the Company does not select recipients, message content, or send timing - the Business User defines the audience and body, and any automation (a blast, a sequence step, a queued message) merely executes the Business User's saved instructions on the Business User's explicit approval, in the Business User's own messaging identity; and (iii) the Business User remains the sole decision-maker as to every communication. The Company's suppression and quiet-hours controls (Section 5.1) are compliance mechanisms that operate on the Business User's instructions; they are not the Company's exercise of discretion over who is contacted. This characterization is a contractual allocation of risk and responsibility and is not an admission or representation concerning the legal status of either party, and it does not bind any non-party, consumer, or regulator, who are not parties to these Terms. The Business User shall not represent, in any dispute, filing, or communication, that the Company selected recipients, authored content, initiated a communication, or is responsible for a communication.

7. Recording mechanism, not adjudication. The Platform provides a mechanism to record a consent basis, suppression state, and quiet-hours decision, and to block on those records. The Company does not adjudicate, independently verify, or certify the legal sufficiency of any consent or contact basis. Providing the mechanism does not make the Company the sender and does not shift the consent obligation from the Business User to the Company.

8. No consumer consent obtained by the Company. Nothing in this Section has any effect on the rights of any consumer, who is not a party to these Terms. The Company does not obtain consumer consent to messaging on the Business User's behalf; any consumer-facing messaging consent (if any) is obtained and recorded by the Business User or by the consumer directly through a consumer-facing surface governed by the separate Consumer Terms.

9. In-Call Telemetry, Call Recording, and Audio AI Coaching. The Platform may provide voice telemetry, real-time transcription, audio processing, or AI-assisted call coaching features. The Business User represents, warrants, and covenants that prior to enabling or utilizing any recording, listening, or transcription feature on any voice or video communication, the Business User has provided all required notices and obtained all legally necessary consents under applicable federal and state wiretap, eavesdropping, and call-recording statutes (including all "all-party" or "two-party" consent jurisdictions such as California, Florida, Illinois, Pennsylvania, and Massachusetts). The Business User shall indemnify, defend, and hold harmless the Company under Section 8A from and against any claim, penalty, or liability arising out of or relating to any alleged unauthorized recording or interception of communications.

6. AUTOMATED WORKFLOWS

The Platform's automated features produce outputs that require human review; the Business User is the ultimate decision-maker for any action taken on those outputs. To the maximum extent permitted by law, the Business User assumes responsibility for its own decisions to act on automated outputs. This Section does not limit the Company's liability for its own gross negligence, willful misconduct, or fraud (see Section 8).

6A. AI CO-PILOT; FAIR LENDING; ECOA; DISPARATE IMPACT

1. Analytical tool only. The AI Co-Pilot and any analytical, scoring, ranking, or "recommendation" feature (the "AI Features") are decision-support and analytical tools only. No output of any AI Feature is a credit decision, an underwriting determination, an approval or denial, a guarantee of terms, a recommendation that any particular credit decision be made, or advice of any kind. The AI Features analyze borrower-profile data and surface information for the Business User's independent review.

2. Business User is the sole decision-maker. The Business User, and not the Company, is the sole decision-maker for every credit decision, pricing decision, product selection, and adverse action. The Business User bears 100% of the legal responsibility for compliance with the Equal Credit Opportunity Act (ECOA), 15 U.S.C. § 1691 et seq., Regulation B, 12 C.F.R. Part 1002, the Fair Housing Act, 42 U.S.C. § 3601 et seq., and all other federal and state fair-lending, non-discrimination, and fair-housing laws, including the obligation to avoid and monitor for disparate impact and to provide any required adverse-action notices and statements of reasons.

3. No reliance absent independent review. The Business User shall not use any AI Feature output as the sole basis for any credit, pricing, or eligibility decision, and shall independently review every AI Feature output for accuracy and non-discriminatory effect before acting on it. The Business User is responsible for documenting that independent review.

4. Indemnity. The Business User shall indemnify, defend, and hold harmless the Company from and against any claim, action, investigation, or proceeding alleging discrimination, disparate impact, or a violation of ECOA, Regulation B, the Fair Housing Act, or any state fair-lending law, arising from the Business User's credit, pricing, or product decisions, including the Business User's decision to follow, modify, or override any AI Feature output. Where a claim arises from both the Company's design of an AI Feature and the Business User's decision, the Business User's indemnity applies to the portion of liability attributable to the Business User's decision, and the Company's liability for the portion attributable to its own design is subject to Section 8. The Business User acknowledges it has the ability and the duty to disregard any AI Feature output and that its decision, not the output, is the credit decision.

5. Company role. The Company provides tooling, not advice. The AI Features do not constitute financial, legal, tax, underwriting, or fair-lending advice, and the Company makes no representation that use of the AI Features ensures compliance with any fair-lending law. The Company's compliance guardrails (including any refusal, deny-list, or human-review controls) are aids to the Business User and do not shift any legal responsibility from the Business User to the Company.

6B. STATUTORY CALCULATIONS, REGULATORY TIMERS, AND TAX ESTIMATES (TRID, IRC § 121, RESPA)

1. Decision-support only; not professional advice. The Platform includes automated algorithmic calculations, statutory clocks, and tax estimation tools, including without limitation: (a) TILA-RESPA Integrated Disclosure (TRID) 3-day delivery and waiting-period countdowns under Regulation Z (12 C.F.R. § 1026.19); (b) United States federal holiday and business day calendars; (c) Internal Revenue Code (IRC) Section 121 primary residence capital gains exclusions ($250,000 / $500,000 caps), § 121(c) unforeseen circumstance prorations, and § 121(d)(6) depreciation recapture calculations; and (d) RESPA Section 8 50/50 expense and co-marketing split assertions. All such features, timers, outputs, and calculations are provided strictly as automated informational aids and decision-support tools for the Business User's independent review and verification.

2. No legal, CPA, tax, or settlement advice. The Company is not a certified public accountant (CPA), tax attorney, licensed settlement agent, or regulatory compliance auditor, and does not provide legal, accounting, tax, or closing advice. The Platform's statutory calculators make baseline mathematical projections based on user-supplied parameters and do not account for individual taxpayer tax brackets, alternative minimum tax (AMT), state-specific tax liabilities, local recording rules, or lender-specific underwriting overlays.

3. Independent verification duty; assumption of risk. The Business User has the sole and non-delegable duty to independently verify all statutory deadlines, TRID delivery timetables, closing disclosure timing, tax implications, and settlement expense splits with qualified legal, tax, or compliance counsel. The Business User assumes all risk and liability arising out of any missed regulatory deadline, rate-lock expiration, tax underpayment, or compliance penalty resulting from reliance on Platform calculations, and agrees that the Company bears no liability therefor.

6C. ELECTRONIC SIGNATURES, CONTRACTING, AND MICRO-LOE TOUCH STAMPS (E-SIGN / UETA)

1. Enforceability and intent. Where the Platform provides electronic contracting features, digital touch signatures, draw-to-sign interfaces, bilateral Micro-LOE execution, or stipulation acknowledgments, the parties agree that such features comply with the Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. § 7001 et seq.) and the Uniform Electronic Transactions Act (UETA) as adopted in the applicable jurisdiction.

2. Binding effect. The Business User agrees that applying a digital signature, drawing a signature stamp, clicking to accept or bind, or causing a cryptographic timestamp to be appended to a document on the Platform demonstrates affirmative intent to be legally bound by that document with the same legal effect, validity, and enforceability as an ink-and-paper manual signature.

3. Authority representation. The Business User warrants that any employee, loan officer, transaction coordinator, processor, or authorized representative who executes a document, agreement, or stipulation on the Platform possesses actual legal authority to bind the Business User.

7. SECURITY, PRIVACY, AND DATA PROCESSING

1. Safeguards. The Company maintains an information security program with administrative, technical, and physical safeguards designed to meet the GLBA Safeguards Rule and applicable state law.

2. Business User's own GLBA obligation; no joint controllership; effect. The Business User is, and shall at all times remain, responsible for its own compliance with the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. § 6801 et seq., the GLBA Safeguards Rule (16 C.F.R. Part 314), and all applicable state privacy and data-security laws with respect to any Non-Public Personal Information ("NPI") it collects, processes, stores, transmits, or maintains, whether on the Platform, in its own systems, or through any third-party tool. The Business User is the controller/business of the NPI it submits or receives through the Platform and shall maintain its own written information security program providing protections at least equal to those required by the GLBA Safeguards Rule. As between the parties, and without purporting to bind any regulator or consumer, the parties agree the Company is not a joint controller or joint business of the Business User with respect to such NPI, and that the Business User does not delegate to the Company any compliance obligation the Business User owes under the GLBA. This allocation does not, and is not intended to, limit the Company's independent obligations under the GLBA or the Safeguards Rule as a service provider, which the Company performs through its own program (Section 7.1).

3. No liability for Business User-side breaches; indemnity. To the maximum extent permitted by law, the Company shall have no liability for any security incident, data breach, or data loss that originates in the Business User's own systems, devices, accounts, personnel, side tools, or third-party services outside the Platform, or that results from the Business User's failure to maintain its own safeguards. The Business User shall indemnify, defend, and hold harmless the Company from and against any claim, regulatory action, fine, or liability arising from a security incident or NPI-handling failure on the Business User's side, including any claim that the Company shares responsibility for the Business User's own GLBA compliance.

4. Breach notification. The Company will notify affected Business Users of a security incident involving their data without undue delay and consistent with Fla. Stat. § 501.171 and other applicable breach-notification laws, and will cooperate in required consumer notifications.

5. Data Processing Addendum. The Company's processing of personal information on behalf of a Business User, and the Company's use of subprocessors (including Plaid, Stripe, Twilio, and Postmark), is governed by the Data Processing Addendum (the "DPA"), which is incorporated by reference and controls in the event of a conflict with these Terms as to data processing.

8. LIMITATION OF LIABILITY

The Platform transmits consumer-authorized instructions to third-party financial institutions, Processors, and escrow accounts; it does not take custody of, hold, or control consumer funds, and settlement timing depends on those third parties and their networks. To the maximum extent permitted by law, the Company is not liable for delays, failures, or interruptions caused by third-party payment networks, financial institutions, Processors, or API providers outside the Company's reasonable control.

Wire fraud and misdirected funds. Without limiting the foregoing, and to the maximum extent permitted by law, the Company is not liable for any loss arising from wire fraud, business email compromise, social engineering, spoofed or compromised escrow or wiring instructions, misdirected EMD funds, or funds sent to a fraudulent or incorrect account. See Section 1 and Section 8A.

Nothing in these Terms limits liability for the Company's own gross negligence, willful misconduct, or fraud, for bodily injury or death caused by the Company's negligence, or for any liability that may not be limited under applicable law. The carve-out for bodily injury does not extend to economic loss, emotional-distress damages, or any other non-bodily claim, which remain subject to the cap. Subject to the immediately preceding paragraph (which preserves liability for the Company's gross negligence, willful misconduct, fraud, and bodily injury), and to the maximum extent permitted by law, the Company's aggregate liability arising out of or relating to the Platform shall not exceed the greater of (a) the fees paid by the Business User to the Company in the twelve months preceding the event giving rise to the claim, or (b) US$500; and the Company shall not be liable for indirect, incidental, special, punitive, or consequential damages.

This Section limits liability only as between the Company and the Business User. It does not purport to limit any right of a consumer who is not a party to these Terms; consumer remedies, if any, are addressed in the Consumer Terms and are not waived here.

8A. INDEMNIFICATION

1. By the Business User. The Business User shall indemnify, defend, and hold harmless the Company and its officers, directors, employees, and agents from and against any and all claims, actions, investigations, liabilities, damages, losses, fines, penalties, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) the Business User's use of the Platform in violation of these Terms or applicable law; (b) any credit, pricing, underwriting, or product decision made by the Business User, including any claim under ECOA, Regulation B, the Fair Housing Act, or any state fair-lending law (see Section 6A); (c) any wiring instruction, escrow destination, or account data that the Business User or its personnel supplies, alters, or transmits, and any loss arising from a wire-fraud, business-email-compromise, social-engineering, or credential-compromise event that occurs through, or by use of access gained via, the Business User's (or its personnel's) systems, accounts, email, or credentials, including where the fraudulent instruction was introduced by a third party impersonating the Business User, a lender, a title company, or any party to the transaction; (d) any security incident or NPI-handling failure on the Business User's side (see Section 7.3); (e) any communication the Business User sends or initiates, including any claim under the TCPA, the TSR, state telemarketing law, or any federal or state wiretap or call-recording statute (see Section 5, including § 5.9), including any claim that the Company is vicariously or directly liable for a communication to the extent the Business User controlled the content, audience, timing, or decision to send; (f) the Business User's violation of RESPA or any licensing or consumer-protection law applicable to the Business User (see Section 2); and (g) any claim arising out of or relating to the Business User's reliance on or use of automated statutory calculations, tax estimates, or TRID timers (see Section 6B).

2. By the Company. The Company shall indemnify, defend, and hold harmless the Business User from and against any claim to the extent arising from the Company's gross negligence, willful misconduct, or fraud, or from the Company's infringement of a third party's intellectual property rights in the Platform. The Company assumes no indemnity for ordinary negligence, and the Business User's exclusive remedy for the Company's ordinary negligence is subject to the limitations in Section 8.

3. Procedure. The indemnified party shall give prompt written notice of any claim, allow the indemnifying party to control the defense (with counsel reasonably acceptable to the indemnified party), and cooperate reasonably. The indemnifying party shall not settle a claim in a manner that imposes a non-monetary obligation on the indemnified party without its consent.

4. Scope of the Business User's indemnity. The Business User's indemnification obligations in this Section are direct and are not limited by the liability cap in Section 8, but apply only to claims within the enumerated categories above. The parties acknowledge that this allocation is a material term of the bargain, reflects the Business User's control of the credit decision, the communication, and its own environment, and is supported by the Business User's obligation to maintain the insurance required by Section 11A.

9. INTELLECTUAL PROPERTY; DATA OWNERSHIP AND ANALYTICAL RIGHTS

1. Platform. As between the parties, the Company owns all right, title, and interest in the Platform, including all software, models, documentation, interfaces, scoring logic, benchmark and derived-analytics layers, and all improvements to any of them. The Company grants the Business User a non-exclusive, non-transferable, revocable license to use the Platform during the term, solely for its internal business purposes and subject to these Terms.

2. Business Data. The Business User owns its Business Data - the records it enters or uploads and that identify it or its clients (for example, its contacts, deals, documents, messages, and notes). The Business User grants the Company a limited license to process the Business Data to provide, secure, and support the Platform, subject to the DPA. "Business Data" does not include the Derived Data described in Section 9.3.

(a) Sovereign Mobility & Sphere of Influence (SOI) Data Boundary (Freedom Tier). Where an individual professional (such as a mortgage loan originator or real estate licensee) maintains an Individual Sovereign workspace or participates in a Freedom Tier sponsorship structure (pursuant to Epic 133):

(i) Sovereign User Data: The individual professional exclusively owns and retains all right, title, and interest in and to their personal Sphere of Influence (SOI), personal contacts, leads, self-sourced client records, branding assets, direct consumer relationships, and portable pipeline metadata ("Sovereign Data"). Sponsoring brokerages and umbrella organizations hold no ownership, proprietary interest, or trade secret claim over Sovereign Data.

(ii) Brokerage Compliance Records: The sponsoring brokerage or lender owns and controls only the transaction-specific regulatory loan files, completed Uniform Residential Loan Applications (Form 1003), executed purchase contracts, statutory disclosures, closing packages, and compliance supervision logs generated while the individual professional acted under that brokerage's license and oversight ("Brokerage Compliance Records"), solely as required by federal and state statutory record-retention mandates.

3. Perpetual, irrevocable anonymized-analytics license. In consideration of the Company's provision of the Platform and the pricing offered (which the parties agree is fair consideration), the Business User grants the Company a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, sublicensable license, subject to the DPA and applicable law, to collect, process, aggregate, de-identify, and use data that the Platform generates from or in connection with the Business User's use (including de-identified outcomes, transaction characteristics, and non-identifying usage signals) to create and exploit aggregated, de-identified, anonymized data - including benchmarks, scoring models, market intelligence, and derived analytics (collectively, "Derived Data") - for any lawful business purpose, including the operation, improvement, and commercialization of the Platform, and including after termination or expiration of these Terms. This license survives termination and cannot be revoked. For the avoidance of doubt:

(a) "Derived Data" excludes all individual-level personal information and any data from which a reasonable recipient could re-identify an individual or a Business User's client. The Company will de-identify data before use and will apply the k-anonymity floor in Section 4.2 (k = 5) to any Derived Data.

(b) The Company covenants not to attempt to re-identify any individual or Business User client from Derived Data, and will contractually bind its sublicensees to the same covenant.

(c) "Usage signals" does not include the Business User's identifiable client identifiers - client names, emails, phone numbers, and addresses are excluded from Derived Data except in de-identified, aggregated form.

(d) The Business User covenants not to attempt to re-identify any individual from any output, and shall not combine Derived Data outputs with other data to re-identify a person.

(e) This license is subject to and does not override any processing limitation the DPA or applicable privacy law imposes.

4. Ownership of Derived Data. All Derived Data and the Company's benchmark, scoring, and analytics layers are and remain the sole and exclusive property of the Company, and the Business User has no right, title, or interest in them and no right to receive, copy, or export them (see Section 10.2).

5. De-identified data. De-identified or aggregated data is not "personal information" or "personal data" under applicable privacy law to the extent permitted by law, and the Company's obligations under the DPA do not restrict the Company's use of it. The Company will not sell Derived Data on a per-consumer or per-referral basis (Section 4.2).

10. TERM, TERMINATION, AND DATA RETURN

1. Term and termination. These Terms continue until terminated. Either party may terminate for material breach not cured within thirty (30) days of notice, or as otherwise stated on an order form. The Company may suspend or terminate a Business User's access for a violation of Section 5 (messaging consent), non-payment, or a security or legal risk.

2. Export boundary on termination (churn) and sponsorship transitions. During the term, the Business User may export its Business Data at any time through the Platform's export tools. On termination, the Business User's license ends, and upon written request made within sixty (60) days after termination the Company will make available for export, in a commercially reasonable, machine-readable standard format, the Business User's Business Data (Section 9.2). Upon termination or transition of any sponsorship relationship under the Sovereign Mobility framework (Epic 133), the Individual Sovereign User may immediately export, port, and retain their Sovereign Data (Section 9.2(a)(i)) without restriction, interruption, delay, or penalty, while the former sponsoring brokerage retains access only to the Brokerage Compliance Records (Section 9.2(a)(ii)) necessary for statutory retention. The Business User's export right expressly excludes only: (a) Derived Data and the Company's benchmark, scoring, analytics, model, and intelligence layers (Section 9.3-§9.4); (b) the Company's software, source code, schemas, models, and documentation; (c) Company-licensed third-party intelligence (this exclusion does not include the Business User's own uploaded documents or messages); (d) any other tenant's data or any data that would breach another tenant's confidentiality; and (e) any consumer personal information the Company is required by law to retain or erase (Section 4.1). The export right is a return of the Business User's own Business Data and is not a forfeiture of the Business User's property; the Company may condition export on payment of outstanding fees and on the Business User's certification that it will handle exported personal information lawfully. The Company shall not use the export boundary to withhold the Business User's own records.

3. Deletion after export. After the export window, the Company may delete the Business Data, subject to (i) the Company's legal-retention obligations, (ii) the tamper-evident ledger obligations in Section 4, and (iii) the perpetual anonymized-analytics rights in Section 9.3, which survive and are unaffected by deletion.

4. Survival. The data-processing (Sections 4 and 7), limitation-of-liability (Section 8), indemnification (Section 8A), intellectual-property (Sections 9 and 10), RESPA-responsibility (Section 2), telemarketing/TCPA and in-call recording (Section 5), automated-workflows, statutory-calculations, e-signatures, and fair-lending/AI (Sections 6, 6A, 6B, and 6C), wire-fraud and platform-role (Section 1), insurance (Sections 11 and 11A), condo/fair-housing (Section 16), and arbitration (Section 14) Sections survive termination. This enumeration does not limit the survival of any other provision that by its nature is intended to survive.

11. INSURANCE

The Company maintains, at commercially reasonable levels, technology errors-and-omissions and cyber-liability insurance, with minimum limits of USD 1,000,000 per claim and USD 2,000,000 in the aggregate. Certificates of insurance are available to a Business User on request under NDA.

11A. BUSINESS USER INSURANCE

The Business User shall maintain, at its own expense and throughout the term, (a) professional liability / errors-and-omissions coverage and (b) cyber-liability / network-security and privacy coverage, in each case with limits of not less than USD 1,000,000 per claim, issued by an insurer rated A- or better, and shall name the Company as an additional insured or loss payee to the extent of the Business User's indemnification obligations under Section 8A. The Business User shall provide a certificate of insurance on request and within fifteen (15) days of any renewal or material change, and shall give the Company thirty (30) days' notice of cancellation. Failure to maintain the required coverage is a material breach.

12. ASSIGNMENT

The Business User may not assign these Terms without the Company's consent. The Company may assign these Terms, in whole or in part, without the Business User's consent, to an affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets or equity, provided that any assignee (i) assumes in writing the Company's obligations under these Terms and the DPA, and (ii) remains bound by the data-processing and privacy commitments in Sections 4 and 7 as to personal information previously processed. The Company will give the Business User written notice of any assignment, and the Business User may terminate on thirty (30) days' notice, without penalty, upon an assignment to a person that is (a) a direct competitor of the Business User in its primary line of business, or (b) engaged primarily in the collection, purchase, or sale of consumer debt. These Terms bind and benefit the parties' permitted successors and assigns.

13. FORCE MAJEURE

Neither party is liable for a failure or delay caused by events beyond its reasonable control, including acts of God, network or Processor outages, and governmental action, provided it uses reasonable efforts to resume performance. The Business User's obligation to pay accrued fees for services already provided is not excused by force majeure; only prospective performance is suspended.

14. DISPUTE RESOLUTION; ARBITRATION; DELEGATION; CLASS WAIVER; MASS-ARBITRATION BATCHING; OPT-OUT

1. Coverage and scope. Any dispute, claim, or controversy arising out of or relating to these Terms, the Platform, or the parties' relationship - whether based in contract, tort, statute, fraud, misrepresentation, or any other legal theory, and whether arising before or after these Terms - will be resolved by binding arbitration, and this clause binds and benefits each party's officers, directors, employees, agents, affiliates, successors, and assigns, and any person or entity claiming through a party (including a consumer or third party asserting a claim by, through, or on behalf of a Business User).

2. Administration. Arbitration will be administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules and, where applicable, its Mass Arbitration Supplementary Rules and Consumer Rules. If the AAA is unavailable or declines to administer, the parties shall select a mutually acceptable administrator; if they cannot agree within 20 days, a court of competent jurisdiction shall appoint one. The seat of arbitration is the State of Florida. Governing law for the arbitration is the Federal Arbitration Act (9 U.S.C. § 1 et seq.), which the parties agree governs the enforceability and interpretation of this Section.

3. Delegation. The arbitrator, and not any court, has exclusive authority to resolve any dispute about the interpretation, applicability, enforceability, or formation of this arbitration agreement, including the enforceability, scope, and arbitrability of the class-action waiver in Section 14.4 and the question of whose signature or assent binds a party. This delegation is clear and unmistakable and is severable. A court retains authority only over (i) the enforceability of the delegation clause itself and (ii) the carve-outs in Section 14.6.

4. Class waiver. Claims must be brought in an individual capacity and not as a class, collective, or representative action, and the arbitrator may not consolidate more than one party's claims except under Section 14.5. If the class waiver is unenforceable as to a particular claim, that claim proceeds in court only as to that claim, and the remainder of this Section still applies; the finding of unenforceability as to one claim does not require re-writing or voiding the rest of this Section.

5. Mass-arbitration batching. If 25 or more similar demands are filed against the Company by or with the coordination of the same counsel or group, the parties agree to batch the demands: a single arbitrator shall preside over a staged process of representative test cases (not fewer than 10), with the remaining demands stayed pending resolution of the test cases, and fees allocated among the batching claimants. The validity and application of this batching provision is for the arbitrator, not a court.

6. Carve-outs (mutual). Either party may (i) bring an individual action in small-claims court for a claim within that court's jurisdiction; (ii) seek injunctive or other equitable relief in court to prevent infringement or misuse of its intellectual property (the Company) or to enforce its rights under Section 5 (the Business User); or (iii) bring or participate in a proceeding before a government regulator. Nothing here waives or purports to waive any right of a non-party consumer.

7. Opt-out. A Business User may opt out of this Section by sending written notice to the Company within 30 days after first accepting these Terms. An opt-out does not affect any other provision.

8. Survival. This Section survives termination.

15. GENERAL

Governing law: the State of Florida, without regard to conflicts principles, provided that mandatory consumer-protection and licensing laws of a Business User's home state continue to apply where required. Notices to the Company: Under Contract LLC, Attn: Legal, [email protected] (a physical notice address is available on request).

Business-tool representation. The Business User represents that it accepts these Terms as a commercial business user in the course of its trade or business, that it has authority to bind the entity or individual named on the account, and that it is not a consumer for purposes of these Terms. Where the Business User is an individual acting in a professional capacity, the Business User acknowledges it is contracting as a business and not as a consumer.

Entire agreement; assignment of assent. These Terms, the DPA, and any order form are the entire agreement between the parties and supersede prior agreements on the subject. Acceptance of these Terms occurs by the affirmative clickwrap action recorded by the Platform; no other course of dealing constitutes acceptance. A waiver must be in writing. If a provision is unenforceable, the rest remain in effect.

Survival. See Section 10.4.

16. FLORIDA CONDO / STRUCTURAL-COMPLIANCE TOOLS; FAIR HOUSING

1. Condo Dossier - informational only. The Platform provides a "Condo Dossier" and related structural-compliance tools that store and display documents belonging to a building - including a Fannie Mae Form 1076 (Condo Questionnaire), a Structural Integrity Reserve Study ("SIRS," Fla. Stat. § 718.112(2)(g)), and a Florida Milestone Inspection (Fla. Stat. § 553.899) - and compute document-currency labels (for example, whether a stored document is "current" for a coverage year, or whether the building's stored paperwork is "complete"). All such features, and every label they produce, are provided for informational purposes only and are document-currency labels, not approvals, certifications, or legal conclusions. In particular, any label such as "clean" or "condo-approved" in the product means only that a stored document is on file for a coverage year and that a reserve study is reported as funded; it is not a representation or warranty that the building is actually in statutory compliance, is approved by any lender, or is a sound or safe investment, and the product must present such labels as "dossier current (as reported)" rather than as an approval. A Dossier entry is a stored document with a date and a reported status. It is not: a lender project-approval decision; a title opinion; a verification or certification that a building is actually in statutory compliance; a determination of a reserve study's accuracy, funding, or adequacy; legal, accounting, engineering, or real-estate advice; or a substitute for the signed association documents and the parties' own due diligence. The signed documents control if anything the Platform displays differs from them.

2. No liability for condo data, deadlines, or transaction outcomes. To the maximum extent permitted by law, the Company bears no liability to the Business User or any third party for: (a) inaccurate, incomplete, out-of-date, unverified, or mis-reported HOA, association, manager, or third-party data (a reported SIRS "funded" status is as-reported, not independently verified); (b) a missed, miscalculated, or statutorily changed SIRS, milestone-inspection, disclosure, or other deadline; (c) a project-review, loan, or transaction that is delayed, denied, or fails for any reason relating to a building's compliance status; or (d) any representation a Business User makes to a client, lender, or counterparty based on a Dossier entry. The Platform computes dates and may send advisory reminders; it does not practice law, does not give legal advice, does not decide contingencies, and does not generate or interpret contract or disclosure forms.

3. Independent-verification duty; no reliance; assumption of risk. (a) The Business User is solely responsible for independently verifying every building's compliance status and every deadline against the authoritative, signed source documents, and for obtaining its own legal, engineering, and compliance advice. (b) The Business User acknowledges that it has not relied, and will not rely, on any Dossier entry or label in deciding whether to proceed with, price, or advise on any transaction, and that any such decision is the Business User's own. (c) The Business User assumes all risk of any condo or structural-compliance transaction, including the risk that a document or status is stale, unverified, or inaccurate. (d) To the maximum extent permitted by law, the Company disclaims liability for negligent misrepresentation and for any claim premised on reliance on a Dossier entry or label, and the Business User waives any such reliance-based claim; nothing in this clause waives liability for fraud or intentional misrepresentation, which cannot be waived under Florida law. A "current," "clean," or "dossier current (as reported)" label is not a legal conclusion and must not be relied upon as one.

4. Fair Housing. The Platform may provide AI-assisted drafting and an output-side Fair Housing backstop. The Business User is solely responsible for the compliance of any listing, advertisement, or published copy with the Fair Housing Act (42 U.S.C. § 3601 et seq.), Florida's Fair Housing Act, and applicable local law. Any Fair Housing scan the Platform performs is a risk-reduction backstop and drafting aid only; it is not a legal review, certification, or guarantee, and it does not transfer the Business User's Fair Housing obligations to the Company. The Business User shall not publish any copy flagged by the Platform without independent review by its broker and, where appropriate, counsel.

17. ORDER OF PRECEDENCE; UNIFICATION; COUNSEL REVIEW

1. Order of precedence. If a conflict exists between these Terms and the DPA as to data processing, the DPA controls; as to all other matters, these Terms control. If a conflict exists between these Terms and the Consumer Terms as to a consumer, the Consumer Terms control as to that consumer. If a conflict exists between these Terms and any separate product-specific terms previously issued for the CRM or the Realtor Platform, these v5.2 Terms control, and those prior terms are superseded for the surfaces they governed.

2. Unification. These Terms replace any prior Terms of Service for the CRM or the Realtor Platform. The two products are governed by this single agreement and the single Privacy Policy (v5.0).

3. Counsel review. This document was prepared with the assistance of counsel; it must be reviewed and finalized by qualified counsel before it governs live use. This document is not legal advice.