Terms of Service

1.1 Sparrowhawk provides a cloud-based CRM platform designed for business-to-business commercial operators. The Services include the Sparrowhawk CRM application, APIs, documentation, and customer support.

1.2 We may update, modify, or discontinue features of the Services from time to time. We will use commercially reasonable efforts to notify you of material changes that significantly reduce the functionality you are using.

2.1 You must create an account to use the Services. You agree to provide accurate, current, and complete information during registration and to keep your account information up to date.

2.2 You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. Notify us immediately at help@sparrowhawklabs.com if you suspect unauthorised access.

2.3 You must be at least 18 years old and legally permitted to enter into contracts to use the Services.

2.4 Account Administrator. The individual who creates the account and accepts these Terms acts as the initial Account Administrator. Account Administrators may add, modify, or remove other user accounts; each such user agrees to be bound by these Terms on behalf of the entity. You represent that you have obtained any approvals required by your entity's governing documents (bylaws, partnership agreement, operating agreement) to accept these Terms and to authorize other individuals to use the Services. Changes to the Account Administrator require written notice to help@sparrowhawklabs.com.

Acceptance Record. When you click "I agree" or create an account, Sparrowhawk records the date, time, and version number of the Terms you accepted. You may request a copy of the accepted version by contacting help@sparrowhawklabs.com. Sparrowhawk will provide at least thirty (30) days' advance notice of material changes to these Terms before they take effect; continued use after notice constitutes acceptance of the updated Terms.

3.1 Fees. Access to the Services requires a paid subscription. Fees are set out in your selected plan and are payable in US dollars. All fees are non-refundable except as expressly stated in these Terms.

3.2 Billing. You authorise us (or our contracted payment providers, FluidPay / PayRio) to charge your designated payment method on a recurring basis (monthly or annually, as selected). You are responsible for keeping your payment information current.

3.3 Auto-renewal. Subscriptions renew automatically at the end of each billing period at the then-current price, unless you cancel before the renewal date. Any fee increase upon renewal will not exceed ten percent (10%) of the prior period's fees without your prior written consent.

3.4 Cancellation. You may cancel your subscription at any time through your account settings or by contacting help@sparrowhawklabs.com. Cancellation takes effect at the end of the current billing period. No partial refunds are provided for unused time within a billing period.

3.5 Late payment. If payment fails or is overdue by more than fifteen (15) days, we may suspend your access to the Services after giving you at least seven (7) days' notice.

3.6 Taxes. Fees do not include taxes. You are responsible for all applicable sales, use, and similar taxes, excluding taxes based on our net income.

4.1 Ownership. You retain all rights, title, and interest in data you submit to the Services ("Customer Data"). We do not claim ownership of your Customer Data.

4.2 Licence to us. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, store, transmit, process, and display Customer Data as reasonably necessary to: (a) provide, operate, maintain, and support the Services for you; (b) prevent and address security, fraud, abuse, and integrity issues; (c) comply with applicable law and valid legal process; (d) maintain, improve, and develop the Services; and (e) generate Aggregated Data as described in Section 4.3. This licence terminates with respect to Customer Data when Customer Data is deleted or anonymised in accordance with Section 13.3, except that we may continue to use Aggregated Data already generated.

4.3 Aggregated Data — what it is, what we do with it. "Aggregated Data" means data, statistics, indicators, benchmarks, models, model parameters, embeddings, or insights derived from Customer Data and the operation of the Services that have been de-identified and/or aggregated such that they do not identify, and cannot reasonably be used to re-identify, you, your end-customers, your users, or any individual. We own Aggregated Data and may use it, during and after your subscription, for any lawful purpose, including: (a) operating, securing, and improving the Services; (b) developing new features and products; (c) producing benchmarks, market intelligence, research, and industry insights, including reports we make available to other customers, partners, or the public; and (d) training, tuning, evaluating, and improving algorithms, machine learning models, and analytical features. We will not attempt to re-identify Aggregated Data and will require any third-party recipient of Aggregated Data not to do so.

4.4 Model and feature improvement. We use your Customer Data and Aggregated Data to train, tune, evaluate, and improve the machine-learning models and analytical features that power the Services. Internal model training and evaluation happen under access controls and audit logging — we do not need to de-identify your data before training models we use to run the Services. We do not sell your Customer Data, share it identifiably with other customers, or use it for third-party advertising. When we publish benchmarks, industry insights, or share data with third parties for purposes other than running the Services for you, we use de-identified Aggregated Data only.

4.5 What we do not do. We will not: (a) sell your Customer Data (as "sale" is defined under applicable privacy law) — for clarity, the Contributory Data disclosures described in Section 4.5A are disclosures of business-to-business commercial credit information about business entities, contain no personal information, and are not a sale or sharing of personal information; (b) share your Customer Data for cross-context behavioural advertising; (c) disclose your Customer Data to any other customer in a form that identifies you or any individual; or (d) use your Customer Data for third-party advertising or any purpose unrelated to the Services, our business in providing the Services, or the generation of Aggregated Data. Aggregated Data may be disclosed because, by definition, it does not identify you or any individual.

4.5A Credit & Risk Reporting Partners (Contributory Data). A limited, minimized subset of your Customer Data -- accounts-receivable and payment-performance fields (invoice amounts, aging buckets, payment timeliness, and credit-utilization metrics) together with the identity of the retailer or other business debtor to which those receivables relate (its business name, business licence number, and location) ("Contributory Data") -- is disclosed to vetted third-party credit- and risk-reporting partners listed on our published Data Partner registry ("Contributory Data Partners") so they can generate credit scores, suggested credit limits, and risk reports. This happens in order to provide the Services to you: those scores and reports are made available back to you so you can see the credit health of the accounts you extend payment terms to.

The debtor business identity is included because it is the subject of the commercial credit report. We do not include the names, emails, or phone numbers of individual people, your pricing, or your deal notes, and Contributory Data identifies the business debtor only -- its business and DBA name, business licence number, and location -- with no information about that business's owners, officers, employees or guarantors, and excluding any receivable where the debtor's business name is, or incorporates, a person's name. Contributory Data is business-to-business commercial credit information about business entities and contains no personal information, so this disclosure is not a sale or sharing of personal information under the CCPA/CPRA or comparable US state privacy laws.

Contributory Data Partnerships are on by default. You may opt out at any time, with prospective effect, by emailing privacy@sparrowhawklabs.com (within 15 business days), or through any opt-out control we make available in the Services (effective on confirmation) -- we honour a request through either route as a Contributory Data opt-out. Current partners, and at least 30 days' advance notice of any new partner, are published at sparrowhawklabs.com/legal/data-partners.

4.6 Data processing. We process Customer Data in accordance with our Privacy Policy and Data Processing Agreement.

4.7 Your responsibilities. You are responsible for the accuracy, legality, and quality of Customer Data and for ensuring you have all necessary rights and consents to submit it to the Services and to permit us to process it as described in these Terms.

4.8 Data-Subject Consents. For any personal information you submit that relates to individuals other than yourself or your own personnel (for example, your end-customers, business contacts, or vendors), you represent and warrant that you have obtained all legally required consents from those individuals to submit their information to the Services, or that you have a documented lawful basis under applicable privacy law to do so.

Please read this section carefully. It contains important limitations relevant to operating in a regulated industry.

5.1 Not legal or compliance advice. The Services are a software tool. Nothing in the Services, our documentation, or any communication from Sparrowhawk constitutes legal, regulatory, or compliance advice. Consult qualified legal counsel for guidance on the laws and regulations applicable to your business.

5.2 Your compliance responsibility. You are solely responsible for ensuring your business operations comply with all applicable federal, state, and local laws, including those governing your industry cultivation, processing, distribution, and retail.

5.3 Third-party data. The Services may integrate with third-party systems (e.g., METRC, state regulatory databases, POS systems). We do not guarantee the accuracy, completeness, or timeliness of third-party data and are not liable for errors in such data.

5.4 Regulatory risk. The markets in which you operate are subject to evolving regulation. Changes in law may affect the Services or your ability to use them. We will use commercially reasonable efforts to adapt to material regulatory changes but do not guarantee uninterrupted service.

5.5 Right to cease service. We may suspend or terminate the Services in any jurisdiction where your operations become prohibited or unlawful, or where a bank, payment processor, insurer, hosting provider, or other counterparty essential to our provision of the Services withdraws from, or declines to serve, that jurisdiction or your industry such that we cannot continue on commercially reasonable terms. In such event, we will provide reasonable notice and a pro-rata refund of prepaid, unused fees.

5.7 Not a HIPAA Business Associate. Sparrowhawk is not a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and does not sign Business Associate Agreements. If you are a HIPAA covered entity or business associate, or if you process protected health information (PHI), you may not use the Services to store, transmit, or process PHI unless you and Sparrowhawk have executed a separate written agreement designating Sparrowhawk as a Business Associate and establishing HIPAA-compliant safeguards. By using the Services, you represent and warrant that you will not submit PHI to the Services except as permitted by such a separate BAA.

You agree not to:

• (a) Use the Services for any illegal purpose;
• (b) Submit protected health information or regulated medical records;
• (c) Upload malicious code, viruses, or any harmful content;
• (d) Attempt to gain unauthorised access to the Services or other users' accounts;
• (e) Reverse engineer, decompile, or create derivative works of the Services;
• (f) Resell, sublicence, or provide access to the Services to third parties without our written consent;
• (g) Use the Services for competitive benchmarking or to develop a competing product; or
• (h) Interfere with the performance or availability of the Services.

We may suspend your access immediately if you violate these restrictions.

6.1 Prohibited Data Categories. The following categories of data are prohibited and may not be submitted to the Services:

• (a) Protected health information (PHI) as defined under HIPAA, unless Sparrowhawk and you have executed a separate Business Associate Agreement;
• (b) Payment card data (PAN, CVV, expiration date), except as processed through our contracted payment providers (FluidPay / PayRio);
• (c) Third-party personally identifiable information (names, emails, phone numbers, addresses, government ID numbers, Social Security Numbers) unless you have obtained informed consent from each individual or have a lawful basis under applicable privacy law;
• (d) Attorney-client privileged communications, attorney work product, or confidential legal advice;
• (e) Third-party confidential information, trade secrets, or proprietary data submitted without the third party's authorization;
• (f) Biometric data or genetic information;
• (g) Financial-account credentials or banking-payment information beyond what our payment processors require.

Consequences. If you submit Prohibited Data, Sparrowhawk may (i) quarantine the data within your account, (ii) notify you of the violation and request remediation within fourteen (14) days, (iii) suspend your access if the violation is not remediated, or (iv) delete the Prohibited Data without liability. If Prohibited Data in your account creates a legal or regulatory risk for Sparrowhawk, Sparrowhawk may terminate your account and any active Order on thirty (30) days' notice.

7.1 We target 99.5% monthly uptime for the production Services, excluding planned maintenance and events beyond our reasonable control.

7.2 Planned maintenance will typically occur during low-usage windows with at least 24 hours' advance notice where practicable.

7.3 If availability falls materially below the target in a given month, you may request a service credit by contacting us within thirty (30) days. Credits are applied to future fees and are capped at 30% of that month's fees. Service credits are your sole remedy for downtime.

8.1 Our IP. We own all rights in the Services, including software, technology, branding, and documentation. These Terms do not transfer any intellectual property to you.

8.2 Feedback. If you provide suggestions or feedback about the Services, you grant us a perpetual, royalty-free licence to use and incorporate that feedback without compensation.

9.1 Each party agrees to protect the other's confidential information with at least the same care used for its own confidential information (but no less than reasonable care).

9.2 Confidential information does not include information that is publicly available, independently developed, or rightfully received from a third party.

9.3 Confidentiality obligations survive for three (3) years after termination of these Terms.

10.1 We warrant that the Services will substantially conform to our published documentation during your subscription.

10.2 EXCEPT AS STATED ABOVE, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE ERROR-FREE OR UNINTERRUPTED.

11.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, OR LOSS OF PROFITS, REVENUE, OR DATA.

11.2 EACH PARTY'S TOTAL LIABILITY ARISING OUT OF THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE FEES PAID OR PAYABLE BY YOU IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED US DOLLARS ($100).

11.3 These limitations do not apply to liability for fraud or wilful misconduct.

12.1 We will defend you against third-party claims that your authorised use of the Services infringes a valid US patent, copyright, or trademark, and will pay resulting damages or settlements, subject to the exclusions in these Terms.

12.2 You will defend us against third-party claims arising from your Customer Data, your use of the Services in violation of these Terms, or disputes between you and your customers or users.

12.3 The indemnified party must promptly notify the indemnifying party and provide reasonable cooperation.

13.1 These Terms remain in effect while you have an active account.

13.2 Either party may terminate for material breach if the breach is not cured within thirty (30) days of written notice.

13.3 Post-termination: You may request an export of your Customer Data within thirty (30) days of termination. We will delete or anonymise your data between ninety (90) and one hundred eighty (180) days after termination, subject to legal obligations.

13.4 Sections 4.3 (Aggregated Data — including our continued ownership and use of Aggregated Data already generated), 4.4 (Model and feature improvement, with respect to Aggregated Data only after termination), 4.5 (What we do not do), 4.5A (Credit & Risk Reporting Partners), 8 (IP), 9 (confidentiality), 10.2 (disclaimers), 11 (limitation of liability), 12 (indemnification), and 14 (governing law) survive termination.

13.5 Deleting an individual login. Any individual user may ask us to delete their own login and the personal information tied to it at any time, as described in the "Deleting Your Account" section of our Privacy Policy. Deleting one login does not terminate these Terms for the customer account it belongs to, and the business records that user created stay with that customer account. To close the customer account itself, see §13.1 to §13.3.

14.1 These Terms are governed by the laws of the State of Oregon and applicable federal law, without regard to conflict of law rules.

14.2 Before formal proceedings, the parties will attempt good-faith negotiations for at least thirty (30) days.

14.3 Unresolved disputes will be settled by binding arbitration under the American Arbitration Association's Commercial Arbitration Rules, conducted by one (1) arbitrator in Deschutes County, Oregon.

14.4 Either party may seek injunctive relief from the courts of Deschutes County, Oregon.

15.1 Entire agreement. These Terms (together with any applicable Order and the DPA) constitute the entire agreement between you and Sparrowhawk regarding the Services.

15.2 Amendments. We may update these Terms by posting a revised version. Material changes will be communicated via email or in-app notice at least thirty (30) days before taking effect. Continued use after changes constitutes acceptance.

15.3 Assignment. You may not assign these Terms without our written consent, except in connection with a merger or acquisition. We may assign freely.

15.4 Severability. If any provision is unenforceable, the remaining provisions continue in effect.

15.5 No waiver. Failure to enforce a provision is not a waiver.

15.6 Force majeure. Neither party is liable for delays caused by events beyond reasonable control, including natural disasters, regulatory changes (including regulatory action affecting either party's industrys), internet failures, or third-party service outages.

Questions about these Terms? Contact us:

Sparrowhawk Labs, Inc. 1605 NW Galveston Ave Bend, OR 97703 United States Email: help@sparrowhawklabs.com

---

By creating an account or using the Services, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service and our Privacy Policy.