Dealer Subscription Agreement

Version 1.0, October 2026. DealSafe Corporation, 211 W 19th St Ste 300, Cheyenne, WY 82001. Questions: support@dealsafe.com. Companion documents: the Order Form (Exhibit A), the Privacy Notice, and the Privacy & Information Security Program (available on request).

1. Agreement; Orders

This Dealer Subscription Agreement, together with each Order Form executed or accepted hereunder (collectively, this “Agreement”), is entered into by and between DealSafe Corporation, a Wyoming corporation having its principal place of business at 211 W 19th St Ste 300, Cheyenne, WY 82001 (“DealSafe”), and the dealership identified on the applicable Order Form (“Customer,” and together with DealSafe, each a “Party” and collectively the “Parties”). This Agreement is effective as of the date of Customer's first Order Form or subscription activation, whichever is earlier (the “Effective Date”).

Each Order Form shall identify Customer's rooftops, the subscription tier applicable to each rooftop, and the applicable fees. Where Customer subscribes through DealSafe's website, Customer's tier selection and checkout confirmation shall constitute the Order Form. By executing an Order Form, creating an account, or otherwise accessing or using the Service, Customer agrees to be bound by this Agreement. Each individual accepting this Agreement on behalf of Customer represents and warrants that he or she is duly authorized to bind Customer.

In the event of any conflict or inconsistency, the following order of precedence shall apply: (a) the Order Form, with respect to the commercial terms stated therein; (b) this Agreement; and (c) the Privacy Notice and any other policies referenced herein. Any additional or conflicting terms contained in any Customer purchase order or other Customer ordering documentation shall be void and of no force or effect.

2. Definitions

“Customer Data” means all electronic data and information submitted to the Service by or on behalf of Customer or its consumers, including, without limitation, credit applications, identity-verification records, consent records, screening results, and the access, routing, and event logs associated with Customer's account, together with Customer's program documents, training logs, and other compliance records maintained within the Service (collectively, the “Book of Evidence”).

“Order Form” means any written or electronic ordering document (including, without limitation, a website tier selection and checkout confirmation) specifying Customer's rooftops, tiers, and fees, and entered into or accepted under this Agreement.

“Rooftop” means a single physical dealership location of Customer. Two franchises sharing one address and one dealer-management-system instance may be treated as a single Rooftop only if confirmed by DealSafe in writing.

“Service” means the DealSafe compliance platform described in Section 3, subscribed at the tier or tiers set forth in the Order Form, together with associated onboarding, training, and support services.

“Subscription Term” has the meaning assigned in Section 8.1.

“Tier” means a published subscription plan for the Service (currently Showroom, The Desk, or The Group), as described at dealsafe.com/pricing and summarized in Section 3.

“User” means any individual whom Customer authorizes to access or use the Service under Customer's account, including, without limitation, Customer's owners, general managers, finance and insurance (“F&I”) personnel, sales personnel, and office staff.

3. The Service

3.1 Scope of the Service. DealSafe shall provide compliance software for automobile dealerships. Depending upon the subscribed Tier, the Service shall include, as applicable: a written information security program built and maintained for the dealership; Qualified Individual support; a guided and versioned risk assessment; role-based training with completion logs; a vendor oversight register; an incident response plan and annual drill; an annual board report; secure QR-based customer intake with identity verification completed on the buyer's own mobile device (with in-store assisted-tablet and remote-link options); capture of deal-level consents, each separately captured and time-stamped; a role-restricted vault for consumer personal information in which access is limited to General Manager and F&I roles and every access is logged; Red Flags screening on every transaction and a written Identity Theft Prevention Program maintained current by the Service; OFAC screening on demand; stipulation (“stip”) requests and storage; routing of completed applications, at Customer's direction, to Customer's credit application networks, lenders, and dealer-management system; co-borrower support; audit support in connection with lender and insurer reviews; and exportable compliance evidence records (the Book of Evidence), exportable within forty-eight (48) hours as a standard. Customers subscribed at The Group Tier shall additionally receive a group dashboard and reporting, a buy-sell diligence package, a dedicated program manager, and the capability to transfer applicant records between Customer's rooftops.

3.2 Tiers. The current Tiers and their respective included capabilities are summarized in the table below (stated per Rooftop per month, as published at dealsafe.com/pricing):

Included capability	Showroom — $399	The Desk — $699	The Group — $999
Written information security program, built and maintained	✓	✓	✓
Qualified Individual support and task calendar	✓	✓	✓
Risk assessment, guided and versioned	✓	✓	✓
Role-based training with completion logs	✓	✓	✓
Vendor oversight register and policy library	✓	✓	✓
Incident response plan and annual drill	✓	✓	✓
Annual board report	✓	✓	✓
Per-deal identity verification before funding	–	✓	✓
QR customer intake (verification, application, all consents on the buyer's phone; iPad-assisted and remote-link options)	–	✓	✓
Role-based PII access (GM and F&I only, every access logged)	–	✓	✓
Red Flags ITPP, written and auto-updated	–	✓	✓
OFAC screening on demand	–	✓	✓
Credit checks through 700Credit on the Customer's own 700Credit account	–	✓	✓
Stip requests and storage	–	✓	✓
Book of Evidence export (48-hour standard)	–	✓	✓
Lender and insurer audit support	–	✓	✓
Co-borrowers: add and link at any point in the process	–	✓	✓
Group dashboard and reporting	–	–	✓
Buy-sell diligence package	–	–	✓
Dedicated program manager	–	–	✓
Move applicants between rooftops	–	–	✓

All Tiers include: no setup fee; video-led onboarding; export of Customer Data upon expiration or termination of the subscription; and support availability including Saturdays.

3.3 No replacement of Customer's compliance program. DealSafe is not a consumer reporting agency, a lender, a credit application network, or a law firm. DealSafe does not render credit decisions and does not provide legal advice. The Service is intended to support, and shall not be construed to replace, Customer's own compliance program. Regulatory compliance remains the sole responsibility of Customer, as set forth in Section 13.

3.4 Availability; modifications to the Service. DealSafe shall use commercially reasonable efforts to make the Service available twenty-four (24) hours per day, seven (7) days per week, except for (a) scheduled downtime, of which DealSafe shall provide reasonable advance notice and which DealSafe shall, where practicable, schedule outside dealership business hours, and (b) any unavailability caused by circumstances beyond DealSafe's reasonable control, including, without limitation, internet or telecommunications failures, cloud-infrastructure failures, network intrusions or denial-of-service attacks, and events of force majeure under Section 22. DealSafe may modify or update the Service from time to time; provided, however, that no such modification or update shall materially degrade the capabilities of Customer's subscribed Tier during any Subscription Term for which fees have been paid.

4. Credit Reports and Consumer Consents

4.1 Credit reports obtained on Customer's own account. Consumer reports are obtained through Customer's own 700Credit account. The Service captures the consumer's consent within the intake flow; Customer initiates the consumer report request; and the Service records the results in the applicable deal record. DealSafe does not obtain consumer reports, is not a consumer reporting agency, does not resell consumer reports, and renders no credit decisions. Customer's agreement with 700Credit (or with any other consumer-report provider integrated into the Service) is solely between Customer and such provider.

4.2 Permissible purpose; bureau obligations. Customer certifies that it shall request and use consumer reports solely for a permissible purpose under the Fair Credit Reporting Act (“FCRA”) and applicable state law; that it shall comply with its own agreements with consumer reporting agencies, credit application networks, and lenders, including, without limitation, all certification, adverse-action, risk-based-pricing, and record-retention obligations thereunder; and that its personnel shall access consumer report data through the Service only as permitted by such agreements and applicable law.

4.3 Consumer consents. The Service captures each deal-level consent — privacy policy acknowledgment, terms acceptance, hard-credit consent, and electronic-signature consent — separately and with an individual time stamp. Customer shall be solely responsible for the content and legal sufficiency of its own consumer-facing notices and consent language presented within the intake flow, and for the lawfulness of its collection, use, and disclosure of consumer information.

4.4 Dealer-directed routing. Completed applications shall be transmitted from the vault only upon Customer's documented instruction. Recipients of routed data — credit application networks (including, without limitation, DealerTrack, RouteOne, and CUDL), lenders, and Customer's dealer-management system — are independent recipients selected solely by Customer and are not DealSafe subprocessors. With respect to such transfers, DealSafe's obligations shall be limited to: (a) transmitting only upon Customer's instruction; (b) transmitting only the data elements Customer has directed; (c) encrypting each such transmission; (d) logging each disclosure event; and (e) retaining the corresponding evidence record. DealSafe shall not be responsible for any recipient's handling of data following completion of a dealer-directed transfer.

5. Subscriptions, Rooftops, and Tier Changes

5.1 Per-Rooftop subscriptions. Subscriptions are priced and administered on a per-Rooftop basis. Each Rooftop shall require a separate subscription at the Tier set forth on the Order Form, and each such subscription shall cover all Users of that Rooftop without per-seat limitation. A customer operating multiple Rooftops shall maintain a separate subscription for each Rooftop.

5.2 Addition and removal of Rooftops. Customer may add a Rooftop at any time; the subscription for any such additional Rooftop shall commence upon activation, shall be billed at the then-current published price for the selected Tier, and shall have its own Subscription Term commencing upon such activation. Customer may remove a Rooftop effective as of the expiration of the then-current Subscription Term applicable to such Rooftop, by written notice of non-renewal given in accordance with Section 8.1.

5.3 Tier changes. Customer may upgrade the Tier applicable to any Rooftop at any time; any such upgrade shall take effect immediately upon activation, and DealSafe shall prorate the incremental fee on a basis no less favorable to Customer than daily proration for the remainder of the then-current billing period. Downgrades shall take effect only as of the commencement of the next Renewal Term for the applicable Rooftop.

5.4 Group features. Group-level features (the group dashboard, group-wide reporting, the buy-sell diligence package, the dedicated program manager, and the capability to transfer applicant records between rooftops) are available exclusively at The Group Tier. Any applicant deal record transferred between Customer's rooftops shall transfer intact — including the application, consent records, identity-verification records, and access log — shall remain restricted to General Manager and F&I roles at the receiving Rooftop, and such transfer shall itself be logged.

6. Accounts, Users, and Roles

6.1 Administration of Users. Customer shall administer its own Users and shall: (a) maintain individual, non-shared credentials for each User; (b) restrict roles affording access to consumer personal information (the General Manager and F&I roles) to personnel with a legitimate business need for such access; (c) promptly revoke access for departed personnel; and (d) ensure that all role assignments are accurate. All role changes and all access events involving consumer personal information are logged by the Service and constitute part of Customer's compliance record.

6.2 Account security. Customer shall be responsible for all activity occurring under its User accounts. Customer shall use commercially reasonable efforts to prevent unauthorized access to, or use of, the Service, and shall notify DealSafe promptly upon becoming aware of any such unauthorized access or use.

6.3 Acceptable use. Customer shall not: (a) use the Service to process data that Customer has no lawful right to collect or use; (b) attempt to circumvent or defeat the access controls, role restrictions, or logging functions of the Service; (c) use the Service to transmit unsolicited communications in violation of applicable law; (d) reverse engineer the Service, except to the extent such restriction is prohibited by applicable law; or (e) access or use the Service for the purpose of developing a competing product or service, or of benchmarking the Service for competitive purposes.

7. Fees, Billing, and Payment

7.1 Fees. The fees payable hereunder shall be the published per-Rooftop, per-month prices for the subscribed Tier set forth on the applicable Order Form, quoted and payable in United States dollars. No setup fee shall apply. Except as expressly set forth in this Agreement or as required by applicable law, all fees are non-refundable, and all payment obligations are non-cancelable during the applicable Subscription Term.

7.2 Billing. Subscriptions shall be billed monthly in advance throughout the applicable Subscription Term. Implementation, onboarding, and training are included within the subscription fees.

7.3 Price changes. Published price changes shall apply to new subscriptions upon publication. With respect to Customer's existing subscriptions, DealSafe shall provide not less than sixty (60) days' prior written notice of any fee increase, and any such increase shall apply solely to Subscription Terms commencing after the expiration of such notice period. DealSafe shall not impose retroactive fee adjustments, integration access charges, or data-export fees.

7.4 Overdue amounts. Any amount not received by DealSafe by its due date shall accrue late charges at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law, accruing from the due date until such amount is paid in full.

7.5 Suspension for non-payment. If any amount remains unpaid for more than fifteen (15) days beyond its due date, DealSafe may suspend the affected subscription(s) until all overdue amounts are paid in full; provided, however, that DealSafe shall have given Customer not less than ten (10) days' prior written notice of such suspension. During any period of suspension, Customer Data shall remain preserved and exportable in accordance with Section 9.

7.6 Taxes. All fees are exclusive of taxes. Customer shall be responsible for all applicable sales, use, and similar taxes arising out of this Agreement, excluding taxes imposed upon DealSafe's net income.

8. Term, Renewal, and Termination

8.1 Term; renewal. This Agreement shall commence on the Effective Date and shall continue in effect until the expiration or termination of all Subscription Terms hereunder. Each subscription shall commence upon the activation date set forth on the applicable Order Form and shall continue for an initial term of twelve (12) months (the “Initial Term”). Thereafter, each subscription shall renew automatically for successive twelve (12)-month terms (each, a “Renewal Term,” and together with the Initial Term, the “Subscription Term”), unless either Party delivers written notice of non-renewal to the other Party not less than thirty (30) days prior to the expiration of the then-current Subscription Term.

8.2 No mid-term cancellation. Subscriptions are non-cancelable during the applicable Subscription Term, except pursuant to Section 8.3. Either Party may prevent renewal of any subscription by timely delivery of a notice of non-renewal under Section 8.1. No refunds of prepaid fees shall be made upon expiration, non-renewal, or termination, except as expressly set forth in this Agreement or as required by applicable law.

8.3 Termination for cause. Either Party may terminate this Agreement, or any affected subscription, for cause upon written notice if the other Party: (a) materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice thereof; or (b) becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation, or assignment for the benefit of creditors, which proceeding is not dismissed within sixty (60) days.

8.4 Effect of termination. Upon any expiration or termination of this Agreement: (a) all accrued and unpaid fees shall become immediately due and payable; (b) Customer may export Customer Data in accordance with Section 9 prior to closure of the account; and (c) each Party shall, upon the written request of the other Party, return or destroy the other Party's Confidential Information, subject to the retention provisions of Section 9 with respect to Customer Data. In the event Customer terminates this Agreement for cause pursuant to Section 8.3(a), DealSafe shall refund any prepaid fees attributable to the unused portion of the terminated Subscription Term. In the event DealSafe terminates this Agreement for cause pursuant to Section 8.3(a), all remaining fees for the balance of the then-current Subscription Term shall accelerate and become immediately due and payable.

8.5 Survival. Sections 4, 7 (with respect to accrued amounts), 9, 10, 12, 13, 14, 15, 17, 18, 19, 21, and 22 shall survive any expiration or termination of this Agreement.

9. Customer Data: Ownership, Export, Retention, and Deletion

9.1 Ownership; license to DealSafe. As between the Parties, Customer retains all right, title, and interest in and to Customer Data. Customer hereby grants to DealSafe a limited, non-exclusive, non-transferable license to host, process, and transmit Customer Data solely as necessary to provide the Service and as otherwise instructed by Customer in accordance with this Agreement.

9.2 Export during the Subscription Term. Throughout each Subscription Term, the Book of Evidence — comprising program documents, training logs, identity-verification records, consent records, screening results, access logs, vendor contracts, and testing results — shall be exportable by Customer within forty-eight (48) hours of request as a standard.

9.3 Export upon expiration or termination. Upon expiration, non-renewal, or termination of any subscription, DealSafe shall make Customer's applications, consent records, and access logs available for export prior to closure of the applicable account. DealSafe shall not charge any fee in connection with such export.

9.4 Retention. Deal records, including associated personal information, consent records, screening results, and access logs, shall be retained for seven (7) years from the date of deal completion, consistent with the record-retention horizons applicable to dealership credit transactions, unless Customer instructs earlier deletion in accordance with Section 9.5 or a legal hold applies. Following Customer's export upon expiration or termination, DealSafe shall delete Customer Data in accordance with this retention schedule, subject to applicable legal holds.

9.5 Deletion. Deletion requests may be initiated by Customer or by the consumer and shall be executed through DealSafe's support ticket process. Consumer-initiated requests shall be coordinated with Customer, which remains the controller responsible for assessing any retention obligations that may override deletion. Verified deletions shall be executed against primary data stores and shall propagate to backups in the ordinary backup-rotation cycle; all deletion events shall be logged, and the requesting party shall receive written confirmation upon completion. Records subject to litigation hold, regulatory inquiry, or an active transaction shall be exempt from deletion until such hold is released.

10. DealSafe's Data Commitments (Service-Provider Terms)

With respect to consumer personal information processed through the Service, DealSafe acts as a service provider to Customer and, where the CCPA/CPRA applies, as a “service provider” and “contractor” under California Civil Code §1798.100 et seq. DealSafe hereby commits that it shall:

1. process personal information solely to provide the Service as documented herein and as instructed by Customer, and for no other purpose;
2. not sell or share personal information, and not use personal information for cross-context behavioral advertising;
3. not retain, use, or disclose personal information outside the direct business relationship with Customer;
4. not combine personal information received through the Service with personal information received from or on behalf of other sources, except as permitted by applicable law for service providers;
5. maintain the administrative, technical, and physical safeguards described in DealSafe's Privacy & Information Security Program, including encryption of stored data, an additional application-layer encryption of Social Security numbers, driver's-license images, and credit report data, role-based access restrictions, access logging, and multi-factor authentication on all DealSafe personnel systems;
6. ensure that all DealSafe personnel are bound by written confidentiality obligations covering Customer Data, and maintain the restriction that no DealSafe employee or contractor has access to consumer personal information held in the platform;
7. provide reasonable assistance to Customer, through the Service's export and deletion capabilities and DealSafe's support processes, in responding to consumer access, correction, and deletion requests; consumer requests received directly by DealSafe shall be routed to Customer within five (5) business days;
8. notify Customer without undue delay, and in any event with a target of within seventy-two (72) hours of confirmation, of any confirmed security incident affecting Customer Data, in accordance with Section 12;
9. notify Customer in the event DealSafe determines that it can no longer meet its obligations under this Section 10; and
10. upon expiration or termination, make available for export Customer's applications, consent records, and access logs in accordance with Section 9, and thereafter delete Customer Data in accordance with the retention schedule set forth herein, subject to applicable legal holds.

10.1 Data residency. All Customer Data shall be stored and processed exclusively within the United States (Amazon Web Services, Northern California region). DealSafe shall not transfer consumer personal information outside the United States, and no subprocessor shall store or process consumer personal information outside the United States.

10.2 Audit support. DealSafe's program documentation, control evidence, and exportable evidence packages shall support Customer's audits by lenders, insurers, and regulators, and shall be made available for Customer's own review upon reasonable prior written notice. Such audit support is included within the subscription fees.

11. Subprocessors and Dealer-Directed Disclosures

11.1 Subprocessors. DealSafe's then-current subprocessors, and the categories of data accessible to each, are set forth in DealSafe's subprocessor register, which shall be made available to Customer upon request. As of the Effective Date, the subprocessor register comprises Amazon Web Services (hosting, storage, and transactional email) and 700Credit (consumer reporting and compliance screening services, engaged at Customer's direction on Customer's own 700Credit account). Each subprocessor shall be bound by written terms no less protective than those set forth in Section 10. DealSafe shall notify Customer prior to any new subprocessor obtaining access to consumer personal information.

11.2 Dealer-directed recipients are not subprocessors. As set forth in Section 4.4, credit application networks, lenders, and Customer's dealer-management system receive routed data as independent recipients selected solely by Customer. DealSafe does not control, and shall not be responsible for, the handling of data by any such recipient following completion of a dealer-directed transfer.

12. Security Incident Notification

12.1 Notice to Customer. DealSafe shall notify Customer without undue delay, and in any event with a target of within seventy-two (72) hours of confirmation, of any confirmed security incident affecting Customer Data, and shall supply the technical facts and evidence record reasonably required for Customer's own assessment and regulatory filings.

12.2 Support of Customer's regulatory notification obligations. The notification obligation to the Federal Trade Commission under 16 CFR §314.4(j) (security events involving five hundred (500) or more consumers, within thirty (30) days of discovery) belongs to Customer as the financial institution; DealSafe bears no independent obligation under 16 CFR §314.4(j). DealSafe's notice obligations under Section 12.1 are intended to enable Customer to satisfy its own notification deadline, and DealSafe shall supply the evidence record reasonably required for Customer's Federal Trade Commission filing and any applicable state breach-notification obligations.

12.3 Coordination of consumer notices. The Parties shall coordinate with respect to any consumer-facing notification so that consumers are not subject to duplicate or inconsistent notices. Unless the Parties otherwise agree in writing, Customer, as the Party maintaining the direct consumer relationship, shall issue consumer notices, and DealSafe shall supply the technical facts and evidence record in support thereof.

13. Customer Responsibilities; Compliance Allocation

13.1 Customer remains the financial institution. Customer remains the “financial institution” under the Gramm-Leach-Bliley Act and shall be solely responsible for its own compliance program under the FTC Standards for Safeguarding Customer Information (16 CFR Part 314), the Red Flags Rule, the FCRA, and applicable state law, including, without limitation: (a) its own written information security program and designated Qualified Individual, which the Service supports but does not replace; (b) its own privacy notices and consumer-facing disclosures; (c) the lawfulness of its collection, use, and disclosure of consumer information; (d) the accuracy of all data submitted to or routed through the Service, and of its routing instructions; and (e) its own agreements with consumer reporting agencies, credit application networks, lenders, and its dealer-management-system provider.

13.2 No compliance warranty. DealSafe does not represent or warrant that use of the Service will achieve or ensure Customer's regulatory compliance, or any particular audit, examination, or enforcement outcome, as further set forth in Section 17.

14. Intellectual Property

14.1 DealSafe's rights; license to Customer. DealSafe retains all right, title, and interest in and to the Service, including, without limitation, its software, designs, and documentation, together with all improvements and derivative works thereof, and reserves all rights not expressly granted herein. Subject to the terms of this Agreement, DealSafe hereby grants Customer a non-exclusive, non-transferable (except in accordance with Section 22) right, during the applicable Subscription Term, to access and use the Service in accordance with this Agreement.

14.2 Customer's rights. Customer retains all right, title, and interest in and to Customer Data, as set forth in Section 9.1, and in its own materials, notices, and consent language.

14.3 Feedback. DealSafe may use any suggestions or feedback provided by Customer to improve the Service, without obligation or restriction; provided, however, that no such use shall disclose Customer Data or Customer's Confidential Information.

15. Confidentiality

15.1 Definition. “Confidential Information” means all non-public information disclosed by one Party (the “Disclosing Party”) to the other Party (the “Receiving Party”) that is designated as confidential or that reasonably ought to be understood to be confidential given its nature and the circumstances of disclosure. Customer Data constitutes Customer's Confidential Information and is additionally governed by Sections 9 through 12, the Privacy Notice, and DealSafe's Privacy & Information Security Program, which, being more specific, shall control with respect to Customer Data. Confidential Information shall not include information that: (a) is or becomes publicly available through no breach of any obligation owed to the Disclosing Party; (b) was known to the Receiving Party prior to disclosure without breach of any obligation owed to the Disclosing Party; (c) is received from a third party without breach of any obligation owed to the Disclosing Party; or (d) was independently developed without use of or reference to the Disclosing Party's Confidential Information.

15.2 Protection. The Receiving Party shall protect the Confidential Information of the Disclosing Party using at least the degree of care it uses to protect its own confidential information of like nature, and in no event less than reasonable care; shall use such Confidential Information solely for the purposes of this Agreement; and shall limit access thereto to its personnel and advisors who are bound by obligations of confidentiality no less protective than those set forth herein.

15.3 Compelled disclosure. In the event the Receiving Party is compelled by applicable law or legal process to disclose any Confidential Information of the Disclosing Party, the Receiving Party shall, to the extent legally permitted, provide the Disclosing Party with prompt prior written notice and reasonable assistance to contest such disclosure, and shall disclose only that portion of the Confidential Information legally required to be disclosed. DealSafe shall, whenever lawful, refer any authority seeking consumer personal information to Customer as the data controller.

15.4 Equitable relief. The Receiving Party acknowledges that any unauthorized use or disclosure of Confidential Information may cause irreparable harm for which monetary damages would be an inadequate remedy, and that the Disclosing Party shall accordingly be entitled to seek equitable relief, including injunctive relief, in addition to any other remedies available at law or in equity.

16. Publicity

Neither Party shall issue any press release, or use the name, trademarks, or logos of the other Party in any marketing or promotional materials, without the prior written consent of the other Party; provided, however, that DealSafe may identify Customer as a customer of the Service, by name and rooftop count only and without use of any logo, in internal reporting. Any use of Customer's name, logo, or testimonial on DealSafe's website or in DealSafe's external marketing materials shall occur solely pursuant to a separate written consent, which may be granted on the Order Form.

17. Representations, Warranties, and Disclaimers

17.1 DealSafe warranty. DealSafe warrants that: (a) it shall provide the Service in a professional and workmanlike manner consistent with its published documentation; and (b) it has the full right, power, and authority to provide the Service without infringing the intellectual-property rights of any third party.

17.2 Customer warranty. Customer represents and warrants that: (a) it has, and at all times during each Subscription Term shall maintain, all rights, consents, and lawful bases necessary to submit data to the Service and to direct the routing thereof; and (b) its use of the Service shall comply with all applicable laws and regulations.

17.3 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICE IS PROVIDED “AS IS,” AND DEALSAFE HEREBY DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW. WITHOUT LIMITING THE FOREGOING, DEALSAFE DOES NOT WARRANT THAT USE OF THE SERVICE WILL ACHIEVE OR ENSURE CUSTOMER'S REGULATORY COMPLIANCE, OR ANY PARTICULAR AUDIT, EXAMINATION, OR ENFORCEMENT OUTCOME.

18. Limitation of Liability

18.1 Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, DEALSAFE'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE SERVICE IN ANY TWELVE (12)-MONTH PERIOD SHALL NOT EXCEED THE FEES ACTUALLY PAID BY CUSTOMER FOR THE SERVICE IN SUCH PERIOD; PROVIDED, HOWEVER, THAT WITH RESPECT TO ANY BREACH BY DEALSAFE OF SECTION 10 (DATA COMMITMENTS), SUCH AGGREGATE LIABILITY SHALL NOT EXCEED THREE (3) TIMES THE FEES PAID BY CUSTOMER IN THE APPLICABLE TWELVE (12)-MONTH PERIOD.

18.2 Exclusion of consequential damages. IN NO EVENT SHALL EITHER PARTY HAVE ANY LIABILITY TO THE OTHER PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOST PROFITS OR LOST REVENUES, HOWSOEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

18.3 Exceptions. The limitations set forth in this Section 18 shall not apply to: (a) a Party's indemnification obligations under Section 19; (b) any liability that cannot be limited or excluded under applicable law; or (c) Customer's obligation to pay fees due and owing hereunder.

19. Indemnification

19.1 Indemnification by DealSafe. DealSafe shall defend Customer against any third-party claim alleging that the Service, as provided by DealSafe and used by Customer in accordance with this Agreement, infringes the intellectual-property rights of such third party, and shall indemnify Customer against all costs and damages finally awarded on, or agreed in settlement of, any such claim. In the event the Service becomes, or in DealSafe's reasonable opinion is likely to become, the subject of any such claim, DealSafe may, at its option: (a) procure for Customer the right to continue using the Service; (b) modify or replace the Service in a manner that does not materially degrade the capabilities of Customer's subscribed Tier; or (c) terminate the affected subscription and refund any prepaid, unused fees. This Section 19.1 sets forth DealSafe's sole and exclusive liability, and Customer's sole and exclusive remedy, for any claim of intellectual-property infringement.

19.2 Indemnification by Customer. Customer shall defend DealSafe against any third-party claim arising out of or relating to: (a) Customer's unlawful use of the Service; (b) Customer's instructions to route or disclose data; (c) Customer's consumer-facing notices or consent language; or (d) Customer's breach of this Agreement; and shall indemnify DealSafe against all costs and damages finally awarded on, or agreed in settlement of, any such claim.

19.3 Indemnification procedure. The indemnified Party shall: (a) promptly deliver written notice of the claim to the indemnifying Party; (b) grant the indemnifying Party sole control of the defense and settlement of the claim (provided that no settlement imposing non-monetary obligations upon the indemnified Party shall be made without such Party's prior written consent); and (c) provide reasonable cooperation and assistance at the indemnifying Party's expense. Any failure to deliver prompt notice shall relieve the indemnifying Party of its obligations under this Section 19 only to the extent of any resulting prejudice.

20. Modifications to this Agreement

DealSafe may modify this Agreement upon not less than thirty (30) days' prior written notice of any material modification, which notice shall be posted and transmitted by email to Customer's designated account contacts. Customer's continued use of the Service following the effective date of any such modification shall constitute acceptance thereof; if Customer does not accept a modification, Customer may deliver a notice of non-renewal in accordance with Section 8.1 prior to the effective date of such modification. No modification shall diminish the commitments set forth in Section 10 with respect to Customer Data previously processed under this Agreement.

21. Governing Law; Disputes

21.1 Governing law; venue. This Agreement shall be governed by, and construed in accordance with, the laws of the State of Wyoming, without regard to its conflict-of-laws principles. The state courts situated in Laramie County, Wyoming, or the United States District Court for the District of Wyoming, shall have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and each Party hereby irrevocably consents to the personal jurisdiction and venue of such courts.

21.2 Good-faith resolution. Prior to the initiation of any action or proceeding, the Parties shall attempt in good faith to resolve the dispute for a period of thirty (30) days following written notice thereof. Notwithstanding the foregoing, either Party may seek equitable relief at any time to protect its intellectual-property rights or Confidential Information.

22. General Provisions

(a) Relationship of the Parties. The Parties are independent contractors, and nothing in this Agreement shall be construed to create any partnership, franchise, joint venture, agency, or employment relationship between the Parties. There are no third-party beneficiaries to this Agreement.

(b) Notices. All notices hereunder shall be in writing and shall be deemed duly given when delivered personally, when sent by nationally recognized overnight courier, or when sent by email with confirmation of transmission: if to DealSafe, to support@dealsafe.com or to the address set forth on the first page hereof, Attn: Legal; and if to Customer, to the notice address set forth on the applicable Order Form.

(c) Waiver; cumulative remedies. No failure or delay by either Party in exercising any right hereunder shall operate as a waiver thereof. All rights and remedies hereunder are cumulative and not exclusive.

(d) Severability. If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be modified to the minimum extent necessary to render it enforceable, and the remaining provisions of this Agreement shall continue in full force and effect.

(e) Assignment. Neither Party may assign this Agreement, in whole or in part, without the prior written consent of the other Party; provided, however, that either Party may assign this Agreement without such consent to a successor in interest in connection with a merger, reorganization, or sale of all or substantially all of its assets, provided that the assignee agrees in writing to be bound by this Agreement. Any attempted assignment in violation of this Section shall be void. The data commitments set forth in Section 10 shall bind any successor or permitted assignee of DealSafe.

(f) Force majeure. Neither Party shall be liable for any delay or failure in performance caused by events beyond its reasonable control, provided that the affected Party uses commercially reasonable efforts to resume performance promptly.

(g) Export and sanctions compliance. Each Party shall comply with all applicable United States export control and economic sanctions laws and regulations in connection with this Agreement.

(h) Entire agreement. This Agreement, including all Order Forms and exhibits hereto and the Privacy Notice referenced herein, constitutes the entire agreement between the Parties with respect to its subject matter and supersedes all prior or contemporaneous agreements, proposals, and representations, whether written or oral. Any additional or conflicting terms contained in any Customer purchase order or other Customer ordering documentation shall be void and of no force or effect.

(i) Counterparts; electronic signatures. This Agreement and each Order Form may be executed in one or more counterparts, including by means of electronic signature, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

Signatures

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date. Signatures are collected electronically on the Order Form.

Exhibit A: Order Form

The Order Form is the commercial document each dealership signs electronically: rooftops, tier, monthly fee, effective date and the 12-month initial term. It is prepared and signed through DealSafe's order system and incorporates this Agreement by reference. The order of precedence is set out in Section 1.