Terms of Service

Effective Date: August 8, 2026 · Version 1.0

Effective Date: Phase-0 (pre-launch); commercial activity has not commenced.

These Terms of Service ("Terms") form a binding agreement between Ellis Intelligence LLC, a Colorado limited liability company doing business as DSAR Engine ("DSAR Engine", "we", "us", "our"), and the business subscribing to or using the Service ("Customer", "you").

The Service is for use by businesses managing their own consumer privacy requests. It is not a consumer product. Consumers who submit privacy requests through a Customer's intake page are data subjects whose requests the Customer fulfills — they are not parties to these Terms and are not customers of DSAR Engine. Consumers seeking to exercise privacy rights or seeking compliance advice should contact the company that holds their data, or qualified counsel.

1. The Service

1.1 DSAR Engine is a software-as-a-service application that helps a company run its consumer privacy requests — access, deletion, opt-out, and correction requests under U.S. state privacy laws — end to end: intake, identity verification, fulfillment tracking, and closure, each on the applicable statutory clock, with a tamper-evident chain-of-custody record for every request. The Service includes a Customer-configurable public intake page, a request cockpit, per-jurisdiction deadline clocks and reminders, and a downloadable audit export.

1.2 Tier-specific features and limits (including any request-volume or usage bands) are described at dsarengine.com/pricing. Tier names, and the figures behind them, live on that page and are never restated in these Terms. Tier names: Starter, Growth, Scale. Figures live at dsarengine.com/pricing and are never restated here.

1.3 Business Use Only. The Service is intended for use by businesses for business purposes.

1.4 DSAR Engine Is Not a Law Firm and Does Not Provide Legal Advice. DSAR Engine is a software vendor providing request-tracking, identity-verification workflow, deadline-clock, reminder, and audit-record tooling, together with professionally-drafted templates. DSAR Engine is not a law firm, attorney, or privacy-compliance consultant in any jurisdiction. DSAR Engine does not: - Provide legal advice or render compliance opinions - Determine whether any consumer request is valid, exempt, or must be fulfilled - Decide what any privacy law requires in your specific circumstances - Guarantee that any request handling, timing decision, notice, or workflow satisfies any state privacy law or any other law - Fulfill requests on your behalf, or transmit consumer data to a requester, except where you or your staff direct and complete that step - Represent you in any regulatory proceeding, investigation, or litigation

Your own staff review and fulfill every request; DSAR Engine keeps it on the clock and on the record. You remain solely responsible for your compliance with applicable privacy law. Engage qualified counsel for legal advice specific to your circumstances. See also the standalone Disclaimers and Liability framing at dsarengine.com/disclaimers.

1.6 No Affiliation, Endorsement, or Regulatory Action. DSAR Engine is not affiliated with, endorsed by, sponsored by, or officially recognized or supported by the Federal Trade Commission ("FTC"), any state attorney general, any state regulator, or any other government agency, or the U.S. Government in any way. DSAR Engine does not predict, forecast, or represent how the FTC, any state regulator, or any other agency will assess, review, or act on any request, rule flag, or other Service output, and DSAR Engine does not act, and is not authorized to act, on behalf of the FTC, any state regulator, or any other government agency in any capacity. DSAR Engine is not privacy counsel or a compliance advisor. Using DSAR Engine does not create any government-recognized status. DSAR Engine's outputs, marketing pages, and app UI render as plain text/typography only — no seal, badge, ribbon, watermark, or certificate-style graphic, or other supportive-looking insignia — so no surface visually or verbally suggests such affiliation, endorsement, sponsorship, official recognition, predictive authority, or action on any government agency's behalf.

1.7 The public intake page. Processor hosts and renders the Customer-configurable public intake page and collects the information a Consumer enters there — including identity-verification information — on Customer's behalf and on Customer's instructions. Processor does not determine the purposes of that collection and does not use Consumer Data for any purpose other than providing the Service.

2. Account

2.1 Account creation requires an authorized representative of the Customer entity.

2.2 Each seat is for a single named individual. Seat-sharing is prohibited.

3. Subscriptions, Pricing, Billing

3.1 Starter, Growth, and Scale are monthly or annual subscriptions, billed via Stripe; annual pricing is shown at dsarengine.com/pricing.

3.2 Pricing at dsarengine.com/pricing. 30-day notice for material changes.

3.3 Billing via Stripe.

3.5 Refunds. Monthly fees are non-refundable for the current period except pro rata on our material breach or on discontinuation under §10.

3.6 No Service-Level Credits or Refunds. The Service carries no uptime or response-time commitment. No service credit, fee credit, refund, or other remedy arises from any delay, outage, missed response target, or unmet support expectation. The §12.1 limited-warranty remedy and the §10.2 pro-rata refund on our own discontinuation remain the only remedies.

4. Customer Data; Flat Multi-Tenancy

4.1 Ownership. As between us, you own all data you submit or collect through the Service ("Customer Data"), including consumer request records, requester contact and verification data, fulfillment-step records, deadline and clock state, generated correspondence, and chain-of-custody event logs.

4.2 License to Us. You grant us a limited license to host, store, transmit, display, and process Customer Data solely to provide and support the Service.

4.3 No Training / No Selling. We do not sell or share Customer Data, and we do not use it to train any model or to improve a Service used by other customers. See our Privacy Policy.

4.4 Flat Per-Tenant Isolation. Each Customer is a single tenant; consumers who file requests are records within that tenant, not sub-tenants. Row-level isolation enforces that no Customer can access another Customer's data. The Service does not offer nested tenancy or full reseller white-label; a per-tenant logo and accent color on the public intake page is available as a light branding option, addressed in Acceptable Use.

4.5 Controller / Processor Roles. With respect to the consumer data processed through the Service to receive, verify, track, and fulfill privacy requests, you are the controller (or "business") and we are the processor (or "service provider"), processing on your documented instructions. The consumers who submit requests are your data subjects, not ours. We do not determine the purposes of processing that consumer data, do not use it for our own purposes, and do not sell or share it.

4.6 AI Processing (If Used); Anthropic Subprocessor. DSAR Engine does not currently use an external LLM provider or make an LLM API call for inference. If an AI feature ships, the provider is added to the subprocessor list first, and this section is updated to state the masking control before any Customer Data reaches it.

4.7 Not a Consumer Reporting Agency; No Consumer Reports. DSAR Engine is not a consumer reporting agency, a furnisher of information to a consumer reporting agency, or a user of consumer reports under the Fair Credit Reporting Act, 15 U.S.C. §1681 et seq. ("FCRA"). The Service does not assemble, evaluate, or furnish consumer reports and does not generate any notice, decision, or determination about a consumer. Identity-verification information collected through the Service is processed solely as your processor, on your documented instructions, to facilitate your own response to the underlying consumer request on the correct timeline; it is not collected, used, or retained for any consumer-reporting purpose. You will not use the Service, or any information collected through it, to obtain, assemble, or furnish a consumer report, or to make any decision that FCRA governs.

4.8 The Public Intake Page. The Service includes a Customer-configurable public intake page at which a consumer submits a privacy request and, where you enable it, completes identity verification. Although DSAR Engine hosts and renders that page and collects the information the consumer enters, it does so as your processor and on your behalf — the consumer's relationship is with you, the company that holds their data. You are responsible for the lawfulness of the requests you accept through that page and for the content of any Customer-configured copy, logo, or branding you apply to it (light white-label per §5.3).

5. Acceptable Use

5.1 No reverse engineering, no scraping, no building a competing product from the Service, no resale.

5.2 AUP. Use is governed by the Acceptable Use Policy at dsarengine.com/acceptable-use, including the DSAR Engine addendum. The addendum covers the consumer-intake-page representations, the prohibition on collecting verification PII beyond what the chosen method requires, and the prohibition on using the Service for any request workflow you lack a lawful basis to process.

5.3 Light White-Label Only. The Service permits a per-tenant logo and accent color on the public intake page only; it does not permit white-labeling the application itself, and it does not grant any reseller or sub-tenant rights. You may not provision Service access to third parties as a resold or managed service without a separate executed agreement.

5.4 Customer Responsibility for Fulfillment. Your staff review and complete each fulfillment step (gather, redact, fulfill, close). The Service tracks the deadline and logs each step; it does not gather, redact, or transmit consumer data on your behalf, and it does not decide whether a request is valid. You are responsible for the substance and lawfulness of every fulfillment action you take.

6. Privacy-Law Disclaimers and Software Behavior

6.1 Templates and Rule Content Are Informational. Notice and response templates and per-state rule content are based on counsel review at the time of publication, the data you provide, and the rule overlays in the Service at the time of use. They may not reflect subsequent changes to any law. You are responsible for reviewing every output and every rule the Service surfaces for accuracy and legal sufficiency before reliance.

6.2 No Validity Determination. The Service never renders a determination of a consumer request's validity. No code path emits "this request is valid / invalid" or "the law requires X." The Service surfaces the workflow stages (verify → gather → redact → fulfill → close); your staff decide at each stage. This is a deliberate software design choice and a core risk-management control.

6.3 No Compliance Guarantee. Deadline countdowns, reminders, rule flags, audit records, and any other Service artifacts are software-generated outputs to assist your privacy operations. They are not legal advice and not compliance opinions. DSAR Engine does not guarantee compliance with any specific law for any specific request. Reminder and exactly-once-delivery features are designed to keep requests on the clock; they are not an absolute guarantee that no deadline will ever be missed.

6.4 Chain-of-Custody Is Integrity, Not Compliance. The tamper-evident audit export proves that the record of a request's handling was not altered. It does not certify that you are compliant with any law. You will not represent the audit export as a compliance certification.

6.5 No Counsel Representation. You will not represent to any consumer, regulatory body, court, or third party that DSAR Engine is privacy counsel, a compliance advisor, or that any output was prepared or endorsed by a licensed attorney, unless that is independently true based on your own counsel's review.

6.6 Banned Representations. You will not represent that DSAR Engine "guarantees" compliance with any privacy law, that it "ensures" you "never miss a deadline" as an absolute guarantee, or that it is "set-and-forget." These representations are false and create liability. You will not make them in any marketing, onboarding, or customer-facing material related to the Service.

6.7 No Autonomous Fulfillment. Consistent with §6.2, the Service does not autonomously verify, gather, redact, fulfill, or close a consumer request, and it does not transmit a response to any consumer, regulator, or other third party without your staff's affirmative action at each workflow stage. Because a fulfilled response reaches the requesting consumer — a party outside your control once sent — this sits in the stricter tier of our consequence-scaled no-autonomous-action approach.

7. Regulatory Contingency

7.1 We operate subject to an evolving U.S. state privacy-law landscape and to Federal Trade Commission ("FTC") and state-attorney-general enforcement. If a regulatory body issues guidance or a rule that affects our lawful operation in a particular state or for a particular use case, we may modify, restrict, or withdraw the Service accordingly.

7.2 If we withdraw the Service from a jurisdiction in response to regulatory action, we will provide at least 30 days' notice and refund pro rata any prepaid fees for the period after withdrawal.

8. Intellectual Property

8.1 Service IP. We own the Service, including the rule overlays, deadline-clock and reminder logic, identity-verification workflow, template compilations, and chain-of-custody architecture. No rights are granted to you except as expressly set forth.

8.2 Feedback. Standard perpetual-license grant on feedback.

8.3 Customer References. We may identify you as a customer (name, logo) on the customers page unless you opt out.

8.4 IP & Assignment Rider. An IP & Assignment Rider addressing ownership and assignment of intellectual property is incorporated by reference into these Terms and controls over this §8 and over §15.4 on the subjects within its scope.

8.5 Present assignment of Derivative IP. To the extent any Derivative IP would otherwise vest in Customer — by operation of law, under any work-made-for-hire or commissioned-work doctrine, because Customer's use, Inputs, or Feedback contributed to it, or on any other basis — Customer hereby irrevocably and presently assigns to Company all right, title, and interest in and to that Derivative IP, effective automatically upon its creation and without further action or consideration.

9. Privacy and Data Processing

9.1 Our Privacy Policy is at dsarengine.com/privacy. The Data Processing Addendum at dsarengine.com/dpa applies under standard triggers and is recommended for every Customer given the consumer-PII processed through the Service. Where the DPA and these Terms conflict as to the processing of Customer Data, the DPA controls.

10. Suspension and Termination

10.1 By You. Cancel per §3 anytime; effective end of the current period. 10.2 By Us. Material breach, AUP violation, or non-payment. 30 days' notice with pro rata refund for discontinuation other than for cause. Regulatory withdrawal per §7. 10.3 Open Requests on Termination. On termination or suspension, Customer Data enters read-only for 30 days for Customer-led export. Open requests with running statutory clocks will be flagged; you are responsible for managing those requests through other means during any suspension and after termination. 10.4 Effect. Customer Data is deleted within 30 days of termination unless retention is required by law, by an active litigation hold, or unless export has been requested within that window. 10.5 Survival. Sections 4 (data), 6 (disclaimers), 8 (IP), 11 (Confidentiality), 13 (Liability), 14 (Indemnification), and 15 (General) survive termination.

11. Confidentiality

Each party treats the other's confidential information, and we treat all Customer Data, as confidential. Standard processor confidentiality commitments apply. Confidentiality obligations survive 5 years post-termination for business confidential information; trade-secret protection is indefinite; consumer data is subject to any longer retention or destruction obligation under applicable law and the DPA.

12. Warranties and Disclaimers

12.1 Limited Warranty. The Service performs substantially per documentation. Exclusive remedy: repair or pro rata refund.

12.2 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN §12.1, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY ABOUT RULE CURRENTNESS, DEADLINE-CALCULATION ACCURACY, TEMPLATE LEGAL SUFFICIENCY, OR COMPLIANCE WITH ANY PRIVACY LAW FOR ANY SPECIFIC REQUEST.

12.3 No Compliance Guarantee. We do not warrant that any deadline calculation, reminder, generated output, rule flag, or chain-of-custody export will satisfy any state privacy law as applied to your specific facts, jurisdiction, or regulatory environment.

13. Limitation of Liability

13.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS, LOST REVENUE, LOST DATA, OR ANY DAMAGES ARISING FROM A FAILED CONTRACT, DISQUALIFIED BID, REGULATORY ACTION, OR FCA PROCEEDING, EVEN IF ADVISED.

13.2 OUR TOTAL CUMULATIVE LIABILITY ARISING FROM OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE FEES YOU PAID US IN THE TWELVE MONTHS PRECEDING THE CLAIM.

13.3 No Liability for Request Outcomes or Regulatory Actions. We are not liable for: any consumer's or data subject's claim arising from how you handled, timed, or fulfilled a request; any regulatory finding that your handling of a request was non-compliant; any allegation that a Service output or rule misled a consumer or a regulator; or any allegation arising from your representation to any party about our role or the legal sufficiency of our outputs. This carve-out is stated as broadly as possible and applies uniformly regardless of the specific statute, regulation, or regulatory or enforcement body involved; a party asserting that this carve-out does not apply to a particular claim, statute, or regulatory or enforcement body bears the burden of establishing that, rather than us bearing the burden of having disclaimed each one individually.

14. Indemnification

14.1 Stated in the contract you execute. Both indemnities — ours for IP infringement and yours — are stated in full on the face of §1 of the DSAR Engine Order Form Face Terms ("1. Indemnification"), which is the indemnification block carried on the face of the click-signed Order Form you accept, rendered above the agree control. Those provisions govern; this §14 is a cross-reference and does not restate them.

14.2 No separate indemnity. These Terms state no indemnification obligation separate from, additional to, or narrower than SOW §1, and nothing in these Terms enlarges or limits it. Where these Terms refer to the §14 indemnity (§10.4 survival), the reference is to SOW §1.

15. General Provisions

15.1 Governing Law. Colorado. The United Nations Convention on Contracts for the International Sale of Goods ("CISG") does not apply. 15.2 Disputes. Binding arbitration via JAMS in Boulder County, CO. Each party waives any right to a jury trial and to participation in any class, collective, or representative proceeding. Either party may seek injunctive relief in court for §5, §6, §8, or §11 breaches. 15.3 Notices, Force Majeure, Entire Agreement, Modifications (30-day), Severability, No Waiver, Independent Contractors. Standard. Written notice under these Terms (email to the billing contact or in-product notice) is deemed given when sent or first displayed; any notice period runs from that date, and failure to read a notice does not extend it. 15.4 Assignment; Change of Control. You may not assign, delegate, or transfer these Terms, in whole or in part, whether by operation of law, merger, or change of control, without our prior written consent; any attempted assignment in violation of this sentence is void. We may, without your consent and without notice except as any applicable data-protection law requires, assign or transfer these Terms and all of our rights and obligations under them, in whole or in part, (a) to a successor or acquirer in connection with a merger, acquisition, or sale of substantially all of our business or assets, or (b) to an affiliate, subsidiary, or newly formed entity in connection with a corporate conversion, reorganization, or contribution or drop-down of assets undertaken to effect a sale, reorganization, or transfer of the specific business line or product to which these Terms relate. Upon such an assignment, all of our rights under these Terms pass to the assignee, the assignee assumes our obligations arising after the assignment, and your continued use of the Service constitutes acknowledgment of the assignee as "DSAR Engine" going forward. A change in our ownership, control, equity holders, or entity form is not a breach of, default under, or ground to terminate, suspend, renegotiate, or re-price these Terms, and does not trigger any right of termination, consent, first refusal, most-favored-nation, audit, or refund on your part. This §15.4 controls over any contrary term in a Customer purchase order or procurement addendum.

15.5 Regional and Supplemental Terms. No jurisdiction-specific supplemental term applies today. Where a supplemental jurisdiction-specific term applies, it controls over a conflicting general term of these Terms for that jurisdiction only.

Contact

DSAR Engine — Ellis Intelligence LLC Email: legal@ellisintel.com Address: 1500 N Grant St, Ste N, Denver, CO 80203, USA