Master SaaS Agreement

This Master SaaS Agreement ("Agreement") is between Sona8 Inc., a Delaware corporation, 1875 Mission St Ste 103 #813, San Francisco, CA 94103, USA ("Sona8"), and the customer named in an Order Form ("Customer"). It applies to each Order Form that references it.

1. Definitions

• Affiliate: an entity that controls, is controlled by, or is under common control with a party.
• Authorized Users: Customer's and its Affiliates' employees and contractors whom Customer allows to administer or view results in the Service.
• Participants: Customer's employees or other individuals whom Customer invites to take part in interviews through the Service.
• Customer Data: all data submitted to or generated in the Service by or for Customer, including interview audio, transcripts, and the themes, statements and reports derived from them.
• Usage Data: technical and statistical data about use and performance of the Service, aggregated and de-identified so that it does not identify Customer, any individual, or the content of any interview.
• Documentation: Sona8's then-current user and security documentation for the Service.
• Order Form: an order signed by both parties that references this Agreement.
• Service: Sona8's hosted employee-listening platform described in the Order Form, including its AI interviewers and analytics.
• Subscription Term: the period stated in the Order Form, including renewals.

2. The Service

2.1 Access. During the Subscription Term, Sona8 grants Customer a non-exclusive, non-transferable right for its Authorized Users to access and use the Service for Customer's internal business purposes, within the scope set out in the Order Form.

2.2 Affiliates. Customer's Affiliates may use the Service under Customer's Order Form. Customer is responsible for their compliance.

2.3 Support and availability. Sona8 provides support and availability as set out in the SLA (sona8.com/legal/sla, at the version stated in the Order Form).

2.4 Updates. Sona8 may update the Service. Updates will not materially reduce the core functionality or security of the Service during the current Subscription Term.

2.5 Subcontractors. Sona8 may use subcontractors and subprocessors. It remains responsible for their performance. Subprocessors of personal data are governed by the DPA.

3. Customer responsibilities

3.1 Accounts. Customer is responsible for its Authorized Users' account credentials and activity. It must notify Sona8 promptly of any unauthorized use.

3.2 Participant notices and legal basis. Customer is responsible for informing Participants about the interviews, for having a lawful basis for the processing, and for meeting any employee consultation duties. This includes works council co-determination where applicable. Sona8 will provide reasonable information about the Service to help.

3.3 Restrictions. Customer will not, and will not allow anyone to: (a) resell, sublicense or provide the Service to third parties; (b) reverse engineer or attempt to extract source code or model weights, except where law permits; (c) use the Service to build a competing product; (d) carry out security or load testing without Sona8's prior written consent; (e) use the Service unlawfully or in breach of the Acceptable Use Policy (sona8.com/legal/aup, at the version stated in the Order Form); or (f) use interview results to take individual employment decisions in a way that breaches applicable law.

3.4 Suspension. Sona8 may suspend access if Customer's use poses an imminent security risk or legal violation, or if undisputed fees are more than 30 days overdue after written notice. Sona8 will limit the suspension to what is necessary and restore access promptly once the issue is resolved.

4. Data, AI and privacy

4.1 Customer Data. As between the parties, Customer owns Customer Data. Customer grants Sona8 a limited right to process Customer Data only to provide, secure and support the Service for Customer, and as required by law.

4.2 No AI training on Customer Data. Sona8 will not use Customer Data to train, fine-tune or improve any AI model, whether Sona8's or a third party's. Sona8 will require its AI subprocessors not to use Customer Data for model training; their retention of Customer Data is limited as set out in Section 3.3 of the DPA.

4.3 Usage Data. Sona8 may collect and use Usage Data to operate, secure and improve the Service. Usage Data never includes interview content.

4.4 Data protection. The Data Processing Agreement (sona8.com/legal/dpa, at the version stated in the Order Form) forms part of this Agreement and governs Sona8's processing of personal data in Customer Data.

4.5 Security. Sona8 maintains the technical and organizational measures described in the DPA and the Documentation. They are designed to protect Customer Data against unauthorized access, loss or disclosure.

4.6 AI output. The Service uses AI to generate themes, summaries and de-identified supporting statements. Sona8 designs the Service to link each finding to the statements that support it. Customer acknowledges that AI output can contain errors and should be reviewed before significant decisions are based on it.

5. Fees and payment

5.1 Fees. Customer pays the fees in the Order Form. Unless stated otherwise, fees are billed annually in advance and due within 30 days of invoice, in the currency stated in the Order Form.

5.2 Taxes. Fees exclude taxes. Customer pays all applicable sales, use, VAT and similar taxes, except taxes on Sona8's income. For EU business customers, the reverse-charge mechanism applies where applicable.

5.3 Additional usage. If Customer exceeds the quantities in the Order Form, Sona8 may invoice the excess at the Order Form rates, pro-rated for the remaining Subscription Term.

5.4 Late payment. Overdue undisputed amounts may bear interest at 1% per month, or the legal maximum if lower. Customer may dispute an invoice in good faith by notifying Sona8 before its due date.

5.5 Renewal pricing. Sona8 may increase fees for a renewal term by notifying Customer at least 90 days before the term ends. Unless the Order Form says otherwise, the increase will not exceed 7% over the prior term's fees.

6. Term and termination

6.1 Term. This Agreement runs while any Order Form is in effect.

6.2 Renewal. Each Subscription Term renews automatically for 12 months. It does not renew if either party gives written notice of non-renewal at least 60 days before the current term ends.

6.3 Termination for cause. Either party may terminate an Order Form if the other party materially breaches this Agreement and does not cure within 30 days of written notice. Either party may also terminate if the other becomes insolvent or ceases business.

6.4 Effect. On termination, Customer's access ends and unpaid fees for the period before termination become due. If Customer terminates for Sona8's breach, Sona8 refunds prepaid fees for the remaining Subscription Term.

6.5 Data export and deletion. For 30 days after termination, Customer may export its results through the Service free of charge and may request transcripts and other raw data in a machine-readable format. Sona8 then deletes Customer Data as set out in the DPA, unless the law requires it to be kept.

6.6 Survival. Sections 4, 5 (for amounts due), 6.4 to 6.6 and 7 to 12 survive termination.

7. Warranties

7.1 Mutual. Each party warrants that it has authority to enter into this Agreement and will comply with laws applicable to its performance.

7.2 Service warranty. Sona8 warrants that the Service will perform materially as described in the Documentation. If it does not, Customer must notify Sona8. Sona8 will then use reasonable efforts to correct the non-conformity. If Sona8 cannot do so within 30 days, Customer may terminate the affected Order Form and receive a refund of prepaid fees for the remaining Subscription Term. This, plus SLA credits, is Customer's exclusive remedy for breach of this warranty.

7.3 Disclaimer. Except as expressly stated in this Agreement, the Service is provided "as is". Each party disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement.

8. Indemnification

8.1 By Sona8. Sona8 will defend Customer against any third-party claim alleging that the Service infringes or misappropriates that party's intellectual property rights. Sona8 will pay the damages, costs and reasonable attorneys' fees finally awarded, or agreed in a settlement Sona8 approves. Sona8 has no obligation for claims caused by Customer Data, modifications not made by Sona8, or combination with items not provided by Sona8.

8.2 Mitigation. If the Service is, or Sona8 reasonably believes it may be, subject to such a claim, Sona8 may: (a) obtain the right for Customer to keep using it; (b) modify it so it is non-infringing without material loss of functionality; or (c) if neither is commercially reasonable, terminate the affected Order Form and refund prepaid fees for the remaining Subscription Term.

8.3 By Customer. Customer will defend Sona8 against any third-party claim arising from Customer Data, from Customer's breach of Section 3.3, or from Customer's failure to meet its obligations to Participants under Section 3.2. Customer will pay the damages, costs and reasonable attorneys' fees finally awarded or agreed in settlement.

8.4 Procedure. The indemnified party must notify the other promptly and give it sole control of the defense and settlement. It must also provide reasonable cooperation, at the indemnifying party's expense. No settlement may impose an admission or obligation on the indemnified party without its consent.

9. Limitation of liability

9.1 Exclusion of indirect damages. Except for Unlimited Claims, neither party is liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or goodwill, even if advised of the possibility.

9.2 General cap. Except for Increased Claims and Unlimited Claims, each party's total liability under this Agreement is capped. The cap is the fees paid and payable by Customer under the Order Forms in the 12 months before the event giving rise to the claim.

9.3 Increased cap. For Increased Claims, each party's total liability is capped at the greater of (a) 2 times the general cap and (b) 50,000 in the currency of the Order Form. Increased Claims are breaches of Section 4 (Data, AI and privacy), of the DPA, or of Section 10 (Confidentiality), including resulting security incidents. For those claims, this cap replaces the general cap; the two are not added together.

9.4 Unlimited Claims. No cap applies to: (a) a party's fraud, gross negligence or willful misconduct; (b) Customer's obligation to pay fees; (c) a party's defense and payment obligations under Section 8; or (d) liability that cannot be limited by law.

9.5 Damage required. Liability under this Agreement requires damage actually incurred by the claiming party and proven in accordance with applicable law.

10. Confidentiality

10.1 Obligation. Each party will use the other's Confidential Information only to perform under this Agreement. It will protect that information with at least reasonable care and disclose it only to employees, advisors and contractors who need to know it and are bound by similar obligations. Confidential Information includes Customer Data, pricing, the Order Form and non-public technical or business information.

10.2 Exceptions. Confidential Information does not include information that is or becomes public through no fault of the recipient, was already known to the recipient, is independently developed, or is rightfully received from a third party.

10.3 Compelled disclosure. A party may disclose Confidential Information if required by law. Where legally permitted, it must give prompt notice and limit the disclosure to what is required.

11. Intellectual property

Sona8 and its licensors own the Service, the Documentation and all improvements, including those based on Usage Data or feedback. Customer owns Customer Data. No rights are granted except as expressly stated. Customer may give feedback, which Sona8 may use without restriction.

12. General

12.1 Governing law and venue. This Agreement is governed by the laws of the State of Delaware, excluding conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. The state and federal courts in San Francisco, California have exclusive jurisdiction. An Order Form may specify a different governing law and venue.

12.2 Publicity. Neither party may use the other's name or logo publicly without prior written consent.

12.3 Assignment. Neither party may assign this Agreement without the other's consent. Either party may assign it without consent to a successor in a merger, acquisition or sale of substantially all relevant assets, on notice.

12.4 Force majeure. Neither party is liable for delays caused by events beyond its reasonable control. This does not excuse payment obligations.

12.5 Changes to these terms. Sona8 may publish new versions of this Agreement, the SLA, the DPA and the Acceptable Use Policy. The version referenced in an Order Form applies until that Subscription Term ends. A new version applies only from the next renewal, and only if Sona8 has given notice at least 90 days before that renewal.

12.6 Order of precedence. If documents conflict, the following order applies: (a) the EU Standard Contractual Clauses and UK Addendum; (b) the DPA, for data protection matters; (c) the Order Form; (d) the SLA; (e) this Agreement; (f) the Acceptable Use Policy. Customer purchase-order terms do not apply, even if accepted or signed.

12.7 Export and sanctions. Each party will comply with applicable export control and sanctions laws.

12.8 Notices. Notices must be in writing and sent to the addresses in the Order Form. Email is sufficient except for notices of breach or termination, which also require a copy to legal@sona8.com or to Customer's legal contact.

12.9 Miscellaneous. This Agreement, with the Order Forms, SLA, DPA and Acceptable Use Policy, is the parties' entire agreement on its subject. Amendments must be in writing and signed by both parties. If a provision is unenforceable, the rest remains in effect. A failure to enforce a right is not a waiver. The parties are independent contractors. There are no third-party beneficiaries.