Terms of Service and Subscription Agreement

Business customers | Canada and United States Version 2.3 | 13 October 2026 | Effective upon Customer acceptance

This Agreement is between 1000946657 ONTARIO INC., an Ontario corporation operating Nur7 (Nur7, we, us or our), and the business for which the authorized representative completes the signup and account-connection process (Customer, you or your). The website, connected Instagram account and accepted checkout records identify the subscription. This Agreement governs authorized setup, your trial and subscription, automated Instagram publishing and keyword-based product-link replies.

The Key Terms, sections 1-13, Schedule A (Customer Data Processing), Schedule B (Regional Terms) and your accepted commercial order record form one Agreement. The schedules are included in your electronic acceptance; no separate signature or countersignature is required. Regional provisions apply according to their stated scope, not merely the currency you pay in.

These Key Terms are binding. Sections 4-5 explain billing and refunds; section 12 limits liability. Schedule B preserves applicable mandatory rights. The service is for business use, not personal, family or household use.

1. Acceptance, business use and account authority

1.1 Acceptance and order record. You accept this complete Agreement, including both schedules, by selecting an agreement checkbox or another action clearly presented, before you take it, as acceptance of these linked terms. A clearly identified acceptance through the Instagram connection step can cover setup and account processing; recurring charges require the separate payment authorization in section 4.3. The terms must be available to review and retain before acceptance. Your submitted website, connected account, billing contact and accepted checkout terms form the commercial Order. Preliminary technical preparation using information you submit is described in our Privacy Policy. Selecting a country, merely visiting a page or connecting an account without clear agreement notice does not, by itself, accept all these terms or authorize recurring charges. Where a written processing agreement is required before entrusted personal data is accessed, the relevant acceptance and authority must be established before that access; later acceptance does not retroactively cure it.

1.2 Authority and eligibility. The person accepting confirms that they have reached the age of majority where they reside, can enter a binding contract and are authorized to bind the Customer, authorize payments and permit access to its website and Instagram account. A sole proprietor contracts in their own legal capacity. The service is offered to businesses in Canada and the United States for business purposes. A business-use statement does not remove a protection that applicable law makes non-waivable.

1.3 Information and security. Provide accurate country, website, account and billing information requested during signup, and keep your billing email and account details current. You represent that these identify a genuine business for which you have the authority stated in section 1.2. We do not promise independent verification of every customer or representative. We may request additional identity, location, tax or authority information where reasonably needed to supply the service or comply with law. Your billing contact is the service and privacy-notice contact unless you designate another; ensure notices reach the appropriate person in your business. Protect credentials and private management links and promptly report suspected misuse. You are responsible for your authorized users and instructions, but not misuse caused by our breach. Do not email Instagram passwords or payment-card credentials.

1.4 Recurring-payment consent and evidence. The applicable price and currency, trial-start rule, automatic conversion, renewal frequency and cancellation terms must be prominently disclosed near the recurring-payment consent control. Authorization must be express and affirmative, not inferred from silence or a preselected option. We retain the acceptance version and timestamp with the relevant account and commercial records for the period required by applicable law or payment rules, or otherwise reasonably needed to evidence the authorization and resolve disputes. No particular document-hash technology, signature certificate or separate full-document email is promised. You can save the linked Agreement; we will provide an accepted-version copy on request and the confirmations separately required by section 4.2. These administrative records do not authorize indefinite retention of shopper conversations.

2. Included service and automatic operation

2.1 Standard subscription. Each subscription covers one product website and one supported Instagram account. After setup, we create and publish one AI-generated, five-image narrative product carousel per service day, with a caption and calls to action to comment or send a direct message for product information or a purchase link, and to visit your website. Your selected plan determines the service days: every calendar day for the Daily plan, or alternate calendar days anchored to your first confirmed post for the Every other day plan. Dates use Ontario (Eastern Time), unless we confirm another posting time zone with you. An unsuccessful scheduled post does not shift that calendar. The subscription follows the actual calendar, not a fixed 30-post allowance, subject to section 9.

2.2 Selection and publication. Products are selected automatically, including through randomized selection, from eligible information on your website or otherwise supplied by you. Products may repeat; we do not promise to feature every product or give each equal exposure. You authorize us to generate, adapt and publish content without your individual approval of each carousel, caption or reply. Exact publication times, a particular creative outcome and human review of every item are not included.

2.3 Comments and direct messages. The standard reply service uses configured product keywords and comment triggers to send an automated product-link response on your behalf; it is not a general AI inbox assistant. You authorize the account, comment and message access needed to recognize those triggers and deliver the requested response, including a private reply to a qualifying comment. Comment-triggered replies cover the latest 49 posts supported by the integration. Configured direct-message keywords are not limited by that post window and remain available while the subscription and connection are active, subject to product/link availability and provider limits. Delivery depends on account permissions, supported interactions, platform messaging windows, rate limits and platform rules. The service does not include open-ended answers to arbitrary questions, guaranteed replies to every message, unrestricted inbox management or live human customer support.

2.4 Seller responsibilities. A call to action such as "Comment/DM to buy" offers product information or a purchase link; it does not itself complete a purchase. You remain the seller and are responsible for your inventory, prices, sales taxes, checkout, payment collection, fulfilment, product returns, warranties and complaints. We are not your merchant of record and cannot accept orders, collect shopper payments, issue product refunds or make new guarantees on your behalf.

2.5 Scope and controls. Paid advertising, advertising spend, additional accounts, custom development and other services are excluded unless separately agreed. There are no undisclosed usage charges. You may request product exclusions, report errors or request a pause through our contact email. For an urgent stop, cancel or revoke the Instagram connection. Revocation alone does not cancel the subscription; an identifiable request to stop or cancel the paid service does, under section 5. Email, SMS, telephone and bulk outbound marketing campaigns to shoppers are not included.

3. Advertising, messaging and permitted use

3.1 Customer materials and product facts. You confirm that you have the rights and permissions needed for the photographs, descriptions, trademarks and other materials you supply or make available, including permission from people depicted where required. Keep product facts, prices, availability and links accurate. Provide support for objective product claims and promptly identify recalls, restrictions, inaccuracies and products that must not be promoted.

3.2 Nur7's content responsibilities. We will provide the service with reasonable care and skill, base product claims on information made available to us and not knowingly publish false claims, fabricated reviews or unsupported endorsements. AI can produce inaccurate text, misleading product depictions or inappropriate output. Monitor your account and promptly report problems; we will reasonably cooperate to stop or correct affected automation. Automatic-publication authorization does not excuse our own breach, negligence or unlawful conduct. We may withhold a claim or product where reliable supporting information is unavailable.

3.3 Automation and media disclosures. The standard product-link response is automated and keyword-based, not a conversation with a human employee or a general-purpose AI chatbot. A separate automation label on every response is not a standard promised feature. Neither party may falsely present automated responses as personally written by a named human or deliberately mislead recipients about the nature of the service. We will provide disclosures required for the particular interaction by applicable law or binding platform rules. Generated images may be resized, reformatted or processed for publication; preservation of every item of file metadata is not promised. This does not authorize removal of protected rights information, required provenance or labels where law or binding provider/platform terms prohibit it, or misleading product depictions.

3.4 Requested replies and recipient choices. The included workflow delivers product links in response to supported keyword requests and does not run unsolicited follow-up marketing sequences. Keyword matching is not a general understanding of message intent; a keyword appearing in a complaint, refusal or stop request is not, merely for that reason, a new request for a product link. You authorize only replies that are requested or otherwise lawfully permitted. The service does not include a general marketing suppression database or a promise to interpret every incoming message. Neither party may disregard a legally effective objection or withdrawal of permission. A response to a clear, fresh request may be sent where lawful. Required identification and unsubscribe mechanisms will be supplied where applicable; the Agreement does not require an unsubscribe footer on a response that is legally exempt. The Customer remains responsible for its own inbox handling, notices and lawful instructions, without relieving Nur7 of duties applicable to its own activity.

3.5 Prohibited and restricted use. Do not use the service for unlawful, fraudulent, infringing or deceptive activity, harassment, fabricated testimonials, unauthorized access or bypassing platform controls. Unlawful or platform-prohibited products are ineligible. Age-restricted products and regulated health or financial claims require our prior written approval and necessary safeguards. The standard service is not for regulated professional advice, emergency assistance or decisions about credit, employment, housing, insurance, health care or similar significant individual interests. Processing subject to special public-sector, health-record or child-directed-service requirements requires separate written approval and appropriate terms before use.

4. Free trial, pricing and recurring payments

4.1 Trial start and duration. The standard trial lasts fourteen consecutive days (336 hours), or the different trial duration expressly displayed and accepted in your offer, starting only after setup is complete and the first post is confirmed as published. Clicking “Activate trial,” submitting payment details or creating a payment-provider record before that does not start paid service or shorten the trial. No subscription fee is due while awaiting the first confirmed post or during the trial. One trial per business is included unless we expressly offer otherwise. If a technical or processing error causes an earlier subscription charge, it is an error, not an authorized exception to this offer; we will correct it promptly and refund the premature charge. This does not permit a known billing error to be left uncorrected or limit mandatory remedies.

4.2 Confirmations and reminders. We will provide the electronic subscription confirmation, billing information and cancellation instructions required by applicable law and payment-network rules. Our additional trial reminder is scheduled for around three days before the trial ends and is sent to the billing email provided at checkout. Processing and delivery timing can vary; this is not an exact 72-hour delivery guarantee. You should retain the trial and first-charge details provided to you and keep a working billing email. We will also provide any earlier or additional notice required for the accepted payment method; the three-day reminder is not a substitute for it. The Agreement does not promise automatic extensions or an automatic rescheduling system for every failed email. However, where a required notice or authorization condition has not been satisfied, we may not charge until it is lawfully satisfied; a necessary postponement is free. An unread or filtered email does not itself cancel the subscription. These limitations do not excuse failure to send a notice we are required to send.

4.3 Automatic conversion and authorization. Unless you cancel before the trial ends, it automatically converts to a paid monthly subscription. By expressly accepting the recurring-payment authorization, you authorize Nur7, through Stripe or a replacement processor notified to you, to store or use your authorized payment method and charge the disclosed fee and applicable tax at trial end and at each monthly renewal until cancellation. No new acceptance is needed for a renewal at the accepted price unless law or payment rules require it. A reminder does not replace initial authorization. Any payment method requiring a separate mandate or authorization will not be charged without it.

4.4 Price and tax. The Daily plan is CAD 300 or USD 215 per month. The Every other day plan is CAD 210 or USD 150 per month, plus applicable tax. Only the plan actually offered, displayed and accepted at checkout applies; listing a standard price here does not mean both currencies are available through every checkout. These are separate fixed prices, not an exchange-rate conversion. Any introductory discount and its duration are shown before billing authorization. The current new-signup offer is 50% off the first three paid months for Daily or the first paid month for Every other day, for eligible signups received before November 1, 2026 at 00:00 Eastern Time. The free trial begins with the first confirmed post; introductory paid pricing follows the trial, then the accepted standard monthly price applies. We will not silently substitute a different currency or charge both prices. Taxes lawfully collected must be disclosed before payment authorization in the amount or manner applicable law permits and identified in the billing record. You are responsible for fees imposed by your own bank or card issuer. There is no setup or cancellation fee. The parties remain responsible for their own tax obligations; this clause does not establish a tax exemption or authorize collection without a lawful basis.

4.5 Monthly periods and records. Paid service is billed in advance for successive calendar-month periods beginning at trial end or an expressly confirmed later start. Renewals fall on the corresponding monthly billing date, or the last available date in a shorter month, as shown in your billing record. Required receipts, invoices and subscription communications may be supplied by Nur7 or Stripe on our behalf. We will provide any renewal reminder required by applicable law or payment rules; a separate annual reminder is not otherwise included as a contractual promise. Notices go to the billing email you supply, not necessarily the contact address shown on Instagram.

4.6 Failed payments. If payment fails or requires authentication, posting and replies may pause while we notify you and retry the authorized payment under payment-provider rules. Payment failure is not cancellation. Customer-caused pauses do not automatically extend the billing period; section 5 still applies. We may terminate for unresolved nonpayment. After effective cancellation, no new renewal charge will be initiated. Any properly accrued unpaid amount must be identified separately and cannot include unused future service after cancellation.

4.7 Price changes. A price increase applies only to a future billing period after clear advance notice of the new price, effective date and cancellation method. We will meet any applicable statutory or payment-network notice period and obtain renewed acceptance where required. No fixed 30-day period is otherwise promised. Notice must give you a reasonable opportunity to cancel before the changed price applies, and no change may retrospectively alter a paid period. Posting a different price on our website alone does not authorize a different charge to an existing subscription.

5. Cancellation and proportional refunds

5.1 Cancellation methods. Cancel at any time without a fee through the cancellation control in your private Nur7 management link. This is the direct self-service route for immediate cancellation and ordinary prorated refunds. For a lost link, access problem or cancellation assistance, contact n@nur7.ai with enough information to identify your subscription. No reason for cancellation, telephone call or retention conversation is required. Reasonable identity checks may prevent unauthorized cancellation but must not obstruct a valid request. This section does not exclude a cancellation or withdrawal method that applicable law or payment rules require us to honour.

5.2 Effective time and corrections. Self-service cancellation takes effect when the cancellation control is completed, and future renewals stop. If we receive a clear, identifiable cancellation or payment-authorization withdrawal through another legally effective route, we will honour the effective time required by applicable law or payment rules and will not use our processing delay to justify unauthorized renewals. Email assistance is not represented as an instant automated cancellation feature. We will promptly stop initiating new posts and replies and provide required confirmation; an action already transmitted to Instagram may still finish. Cancellation during the trial prevents the first subscription charge. Any renewal incorrectly charged for a period beginning after effective cancellation must be reversed or refunded in full. This correction duty is not limited to the most recent charge.

5.3 Refund calculation. We refund unused time in the paid billing period containing the effective cancellation time, using the actual fee paid after discounts and that period's actual duration:

Refund = fee actually paid for the period x (unused time remaining / total time in that billing period), plus the corresponding tax actually collected.

Time is measured using the billing-period start, end and effective cancellation timestamps. The result is rounded to the nearest cent; we do not assume a 30-day month or deduct our processing fees. We account for previous refunds so the same time is not refunded twice. Trial, free or unpaid time has no cash refund. Used time is otherwise non-refundable except as this Agreement or applicable law provides.

5.4 Refund processing. Ordinary cancellation refunds are returned to the original payment method in the original charge currency, not merely credited against a future purchase. We do not deduct our payment-processing fees. We will initiate a refund promptly and within any applicable legal or payment-rule deadline; a separate five-business-day guarantee is not promised. Bank posting times vary. If the original method cannot receive the refund, we will arrange a lawful alternative. A dispute or processor restriction may affect execution, but does not remove an amount owed or require waiver of a lawful dispute right. Necessary correction of a failed or incorrect refund may be handled with support rather than an automated adjustment feature.

5.5 Existing content and data. Cancellation does not automatically remove delivered posts or messages. You may manage them within Instagram and retain the delivered-content rights in section 6. Data return and deletion follow Schedule A and, where applicable, Schedule B. Cancelling Nur7 does not cancel a shopper's purchase from you.

6. Content permissions and intellectual property

6.1 Customer materials licence. You retain your rights in your website, product information, photographs, branding and other supplied materials (Customer Materials). You grant us a non-exclusive, worldwide, royalty-free licence to access, retrieve, copy, store, adapt and use them only as reasonably necessary to provide, secure and support the service, create and publish content, handle permitted interactions and fulfil our obligations. We may extend necessary permissions to service providers under appropriate restrictions. This includes permissions needed to deliver content to Instagram under its applicable terms. Personal data remains subject to Schedule A.

6.2 Delivered content. To the extent we own transferable copyright in final customer-specific carousels, captions and replies delivered through the service, including during the trial, we assign it to you on delivery. Our software, workflows, general templates, tools, pre-existing technology and third-party rights are excluded. For our pre-existing elements embedded in delivered content, you receive a perpetual, worldwide, non-exclusive, royalty-free licence to use, reproduce, edit and distribute them as part of that content for your business, including after cancellation.

6.3 AI and third-party limits. AI output may not be unique or protected by copyright. We do not promise exclusivity, registrability or that another user will not receive similar output. Third-party materials remain subject to their rights. Neither party may use the other's name, logo, private data or results for an unrelated testimonial, portfolio, advertisement or endorsement without separate permission.

6.4 End of permission. Our licence ends when no longer necessary for service performance, permitted deletion or legally required retention. It does not allow posting after cancellation or use for unrelated purposes. Your delivered-content rights survive termination.

7. Privacy and binding data-processing terms

7.1 Incorporated protection. Schedule A is a binding data-processing agreement for personal information handled on your behalf, including supported Instagram events used for product-link replies. It applies to authorized setup, trial and paid service and continues while relevant information is retained. Schedule B supplements it where the relevant law applies. No separate signature is required when the complete Agreement has been validly accepted. Initial technical preparation that does not access entrusted personal information is distinct from processing that requires a prior written mandate or other specific authority; section 1.1 governs that distinction.

7.2 Other information and privacy notice. We separately handle business-contact, billing, consent, security and compliance information for necessary service administration as described in our public Privacy Policy. That notice does not expand permitted uses of entrusted shopper information or override Schedule A. Contact n@nur7.ai, for the attention of the person responsible for privacy, for information, requests or complaints. A Privacy Policy is a description of processing and rights, not blanket consent to unrelated marketing.

8. Confidentiality

Each party will protect the other's non-public business information that is marked confidential or reasonably understood to be confidential, including credentials and private communications. Use is limited to this Agreement; disclosure is limited to people who need it for that purpose and are bound to protect it. Information independently developed, lawfully obtained without restriction or made public without breach is excluded. Legally compelled disclosure is permitted only to the required extent, with prior notice where lawful and practicable. Duties continue while information remains confidential; Schedule A additionally protects personal data.

9. Availability, interruptions and third parties

9.1 Dependencies. Service depends on your website, a valid Instagram connection, eligible product information and third-party systems. Platform, payment, hosting and AI providers may change features or rules, impose limits or experience outages. We do not guarantee uninterrupted availability, platform approval, freedom from account restrictions or any amount of reach, engagement, traffic or sales. We will use reasonable efforts to maintain service and address failures within our control. Nur7 is independent and is not endorsed by Meta, Instagram or Stripe.

9.2 Pauses. Posting or replies may pause for maintenance, an outage, expired permissions, payment issues, safety concerns or lawful suspension. A pause caused by your instructions, materials, payment failure or loss of permissions does not itself cancel or extend the subscription. We will notify you of a material pause we identify. You may cancel rather than continue paying during a pause.

9.3 Service failures. Report a missed post or other material service problem so we can investigate and use reasonable efforts to restore service or correct the affected activity. Missed posts do not accumulate as additional future deliverables, and no automatic service-day credit or fixed daily service-level refund is included. You may cancel and obtain the unused-time refund under section 5. This does not remove a refund, compensation or other remedy available for our breach under the Agreement or applicable law, or authorize us to charge for a service we knowingly do not provide. Any discretionary credit or agreed settlement is recorded separately, without double recovery for the same loss.

9.4 Events outside reasonable control. Neither party is responsible for delay caused by events beyond reasonable control despite reasonable precautions, such as natural disasters, widespread outages or government restrictions. The affected party must reasonably mitigate the effects. This does not authorize charges after cancellation, excuse accrued refunds or erase a failure to take required safeguards. Our subcontractors' data-processing obligations remain our responsibility under Schedule A.

10. Suspension and termination by Nur7

We may restrict affected features or suspend service as reasonably necessary for unlawful use, a security threat, platform requirements, material breach or nonpayment. Where practicable, we will give notice and a reasonable opportunity to correct a remediable issue. Urgent or serious risks may require immediate action. We may terminate for a material breach not cured within 10 business days after notice, or immediately if it cannot reasonably be cured or continued service creates a serious legal or security risk.

We may otherwise discontinue service or terminate on 30 days' notice, or shorter notice where law or a platform requirement makes that necessary. Termination stops renewals and includes the unused-time refund under section 5, even for breach. Accrued fees for past service remain payable; an unused-time refund will not be forfeited as a penalty. Delivered-content rights, confidentiality, data protection, accrued payment and refund duties, liability and dispute provisions survive where relevant.

11. Warranties and third-party claims

11.1 Service standard and disclaimers. We will exercise reasonable care and skill and fulfil our express commitments. Except for those commitments and non-excludable rights, service and AI output are provided on an "as available" basis without other warranties, including implied warranties of merchantability, fitness for a particular purpose or non-infringement. Creative preferences, sales and platform performance are not guaranteed. Service is not legal, tax or other professional advice.

11.2 Customer indemnity. To the extent legally permitted, you will defend and indemnify Nur7 against third-party claims, damages and reasonable legal costs to the extent caused by Customer Materials infringing others' rights, your unlawful products or instructions, or intentional misuse. This excludes the portion caused by our breach, negligence, unlawful conduct or unsupported claims we add to otherwise accurate materials. It does not indemnify a penalty that cannot lawfully be indemnified.

11.3 Claim procedure. We will promptly notify you of a covered claim, allow you to control its defence with reasonably qualified counsel and reasonably cooperate at your expense. Delayed notice reduces your duty only to the extent it materially prejudices the defence. No settlement may admit our fault, impose non-monetary obligations on us or leave us a payment obligation without our consent, not unreasonably withheld.

12. Limitations of liability

12.1 Excluded losses. To the fullest extent legally permitted, neither party is liable to the other for indirect, incidental, special, consequential or punitive damages, including consequential loss of profits, revenue, goodwill or business opportunities, even if advised of the possibility. This does not exclude covered third-party amounts under section 11 or matters excepted below.

12.2 Nur7 liability cap. Nur7's total aggregate liability arising from or relating to this Agreement is limited to the greater of (a) subscription fees actually paid to Nur7 in the 12 months before the first event giving rise to the claim or (b) CAD 300 or USD 215 in your accepted currency. It applies across related claims and legal theories, including contract, tort and negligence, subject to section 12.3 and Schedule B.

12.3 Exceptions. No provision excludes or limits fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any liability or remedy that cannot lawfully be limited. The cap does not reduce refunds owed, authorize unpaid future periods after cancellation or eliminate statutory privacy rights. Properly owed payment obligations are not capped. These allocations govern permitted claims between the parties, not the powers of regulators or independent rights of individuals, and do not excuse a statutory duty. Applicable mandatory regional protections control.

13. Changes, notices and general terms

13.1 Agreement changes. We will clearly notify you before a material change takes effect, identify the change and explain how to cancel. Any notice period, form or fresh acceptance required by law or payment rules applies; a fixed 30-day period is not otherwise promised. You must have a reasonable opportunity to cancel before a material adverse change applies. Continued use constitutes acceptance only where legally effective. A change may not retrospectively remove an accrued claim, refund or right, and a webpage update alone does not replace an accepted contract. New data uses require their own lawful basis and any required consent. An urgent legal or security change may take effect sooner only to the extent necessary and lawful, with notice as soon as practicable.

13.2 Contact and electronic notices. Send support, cancellation-assistance, contractual and privacy correspondence to n@nur7.ai, addressed to 1000946657 ONTARIO INC., operating Nur7, Ontario, Canada. The merchant contact and transaction disclosures supplied at checkout form part of the Order; required merchant address and telephone information must be made available there before payment authorization. We send necessary account notices to your billing email and may use the management interface where permitted. You agree to receive and retain electronic service records. This is not consent to unrelated promotional messages or a waiver of another notice or legal-service method required by law.

13.3 Ontario law and courts. Ontario law and applicable federal Canadian law govern, without applying conflict-of-laws rules, subject to overriding mandatory law. Subject to mandatory forum rights and lawful small-claims proceedings, the parties submit disputes to the exclusive jurisdiction of Ontario courts. First attempt good-faith resolution through the contact above where practicable; that is not a mandatory waiting period and does not prevent urgent relief, regulator complaints or filing to preserve a limitation period. This Agreement imposes no mandatory arbitration or class-action waiver and does not shorten a statutory limitation period.

13.4 Relationship and assignment. The parties are independent contractors. There is no partnership, employment or general agency; our authority is limited to authorized publishing and replies. You may assign with our consent, not unreasonably withheld. We may assign in a genuine merger, reorganization or sale of the relevant business if the successor assumes our obligations, we notify you and data-protection requirements are met. Cancellation and refund rights remain unchanged. Each party must comply with applicable trade and sanctions restrictions; this clause does not require conduct contrary to Canadian law.

13.5 Language and legal scope. The parties choose English for this Agreement and related communications only to the extent law permits. Schedule B addresses Quebec language requirements. This is a services agreement, not a sale of goods, and the United Nations Convention on Contracts for the International Sale of Goods does not apply. Mandatory local rights are not waived by a language, location, business-use or governing-law statement.

13.6 Entire agreement and priority. This Agreement, the accepted Order and mutually accepted written amendments are the entire service agreement. Conflicts are resolved in this order: mandatory law; applicable Schedule B provisions; Schedule A for personal-data matters; a specifically negotiated lawful amendment; the Key Terms and accepted Order's commercial details; then the remaining general terms. Stronger safeguards specifically agreed after a required assessment also apply. Checkout details cannot silently remove cancellation, refunds or mandatory rights. An invoice, customer purchase-order boilerplate or a unilateral instruction does not amend this Agreement.

13.7 Severability and survival. An unenforceable term is limited or severed only to the extent necessary and lawful; the remainder continues. Not enforcing a right is not a waiver. No non-party obtains a contractual enforcement right solely from this Agreement, without affecting independent statutory rights. Binding processing duties continue for all retained Customer Personal Data.

Schedule A | Customer Data Processing

Binding part of the Agreement | No separate signature required

A1. Roles, scope and applicable law

A1.1 Roles. For personal data we handle on your behalf through the service (Customer Personal Data), you determine the business purposes and act as controller or business, and Nur7 acts as processor or service provider, as those terms apply. Where you act on another business's behalf, you must have authority to engage us as a further processor. Roles are determined by the actual processing and applicable law, not labels alone.

A1.2 Applicable Data Protection Law. This means privacy, security, breach-notification and data-protection laws actually applicable to a party or the processing, including relevant Canadian federal, provincial and territorial laws and U.S. federal and state laws and regulations, as amended or replaced. No law is made applicable merely by being mentioned. Schedule B adds requirements where its conditions are met.

A1.3 Other roles. This Schedule does not change Meta's or another independently acting platform's duties under its own relationship with you or individuals. Nur7's own administrative information under section 7.2 is handled for necessary service administration, billing, security and legal compliance, not as permission to repurpose shoppers' data. The same provider may have different roles for different activities.

A2. Processing instructions and description

A2.1 Instructions. This Agreement, your configuration and lawful recorded instructions are your documented processing instructions. Nur7 will process only to fulfil those instructions and the specific purposes below, or as law requires. We will notify you if an instruction appears unlawful or we can no longer comply, and may suspend the affected processing while it is resolved. Unless prohibited, we will notify you before legally compelled processing outside your instructions and limit disclosure to what is required.

A2.2 Specific purposes. You disclose Customer Personal Data only so Nur7 can connect and operate your authorized Instagram account; match supported comments or DMs to configured product keywords and triggers; select and deliver the corresponding requested or otherwise lawful product-link reply; publish authorized product content where personal data is involved; maintain the identifiers, product mappings and delivery status needed for those functions; provide associated support, error correction, access security and abuse prevention; and carry out your lawful access, return and deletion instructions. The standard keyword-reply workflow does not send shopper conversations to the AI-generation workflow used to create carousels. Product materials provided for carousel creation may separately contain personal data and remain protected by this Schedule. General-purpose advertising networks, unrelated profiling and unrelated product development are not instructed purposes.

A2.3 Data and individuals. Individuals include your shoppers, prospective shoppers, people interacting with your account and authorized users. Data may include names, handles, platform and conversation identifiers, contact details volunteered in messages, comment and message text and attachments needed for a supported inquiry, product interests, response and delivery metadata, and personal data incidentally present in authorized product materials. Only data reasonably necessary for a supported feature may be accessed or used. Account tokens and credentials must be protected even where they are not personal data.

A2.4 Operations and duration. Operations include authorized retrieval, receipt, organization, keyword matching, content generation using permitted product materials, storage, delivery through necessary providers, support, correction, restriction, return and deletion. Processing lasts for authorized setup and service and afterwards only for a lawful, necessary close-out, security, records or other permitted purpose. It does not extend paid service. Schedule A9 and any stricter applicable requirement in Schedule B govern retention. Cancelling service does not represent that all copies are automatically erased at that moment; neither does it permit indefinite retention.

A3. Use restrictions and customer duties

A3.1 Purpose and combination limits. We will not sell Customer Personal Data; share it for cross-context behavioural advertising; use it for unrelated marketing or targeted advertising; or retain, use or disclose it outside the direct service relationship or the specific purposes in A2.2, except as expressly permitted or required for our processor role by Applicable Data Protection Law. We will not combine it with another customer's data or data from our independent interactions with individuals unless expressly permitted for that role and necessary for an authorized purpose. We will not publish private messages publicly without lawful instruction and an adequate legal basis.

A3.2 AI providers. We will not use Customer Personal Data to train general-purpose AI models or permit our AI subprocessors to do so. We will use appropriate provider terms and settings and limit transmitted data to what is necessary for the instructed function. The use of AI to create carousels does not authorize sending shopper conversations into that generation workflow. Any expansion of that use requires the applicable prior notice, lawful instructions and other required permissions and safeguards. We will not treat removal of a name alone as sufficient anonymization or as permission for an otherwise prohibited use.

A3.3 Your duties. You must have the notices, rights, consents or other lawful basis required to collect and entrust this data to us, maintain an appropriate public privacy notice, provide accurate instructions and respond to individuals' requests as required. Do not instruct collection of payment-card credentials, government identifiers, medical records, biometric identifiers, precise location or other unnecessary sensitive data. The service is not designed for child-directed interactions. If unnecessary sensitive or children's data is incidentally received, both parties will restrict its use and cooperate in prompt lawful deletion or other required action. Each party remains responsible for its own legal duties.

A4. Security and confidentiality

We will maintain organizational, physical and technical safeguards appropriate to the sensitivity of Customer Personal Data, its quantity, the processing and reasonably foreseeable risks, including controls on access and disclosure and protection of credentials. Access is limited to authorized people who need the data for permitted purposes and are bound by an appropriate contractual, statutory or professional confidentiality duty. We will use provider security features appropriately and take reasonable corrective action on identified material risks. No particular certification, universal MFA configuration, encryption architecture or independent audit is represented by this Agreement. This flexibility does not reduce security measures required by applicable law, binding platform/provider terms or the actual risk.

A5. Subprocessors and locations

A5.1 Initial authorization and information. You give general authorization to necessary hosting, storage, Instagram-integration, communication, security and other providers acting as our further processors (Subprocessors) for the specific purposes in A2.2. The relevant provider categories and identified providers are described in our Privacy Policy. On request, and before processing where law requires, we will supply information about relevant identities, functions and processing locations needed for lawful instructions and oversight. A separately hosted public register is not a promised feature. A provider acting independently for its own purposes is not described as our Subprocessor for that independent activity merely because it is mentioned in our policy.

A5.2 Provider changes. We may add or replace necessary providers while preserving the protection required by this Schedule. Where applicable law requires prior notice or an opportunity to object before a new Subprocessor is engaged, we will provide it with enough time for a meaningful response; the Agreement does not otherwise promise a universal 15-day notice or 10-day objection window. A reasonable objection based on the applicable data-protection requirement will be addressed in good faith. If a lawful solution is unavailable, the affected processing must not proceed in breach of that requirement, and either party may end the affected service with the unused-time refund. A provider change cannot bypass a required prior transfer assessment.

A5.3 Provider protections and responsibility. We will use applicable provider agreements or other legally permitted binding arrangements that establish the confidentiality, limited use, security, assistance, retention and further-processing protections required for the relevant data and role. Existing standard terms or an incorporated DPA may satisfy this duty when they apply to our account, the information and the relevant law; a bespoke agreement is not inherently required. Merely listing a provider or accepting terms outside their stated scope does not establish those protections. We remain responsible for delegated obligations as applicable law requires and will pass on required instructions. Optional service guarantees in this Agreement are not a claim that each provider supplies an identical feature or deadline; mandatory downstream protections cannot be reduced for that reason.

A5.4 Cross-border processing. Necessary provider processing may occur outside the Customer’s province or country, including in the United States; Canadian-only storage is not promised. We will give the relevant location and safeguard information needed for any legally required notice, assessment or instruction before the affected transfer where required. Authorities in another jurisdiction may have lawful access under its laws. Neither country selection nor acceptance of this clause substitutes for a required assessment, individual notice or safeguard. Provider and transfer questions may be sent to n@nur7.ai.

A6. Individual rights and required assistance

We will forward relevant individual requests to the Customer where appropriate, respond ourselves where legally required and provide the assistance required for our processing role, taking account of the nature of the processing and information available to us. This includes required access, correction, deletion, portability, restriction and appeal handling, as well as relevant security, incident, transfer and other assessments or regulator inquiries. The Customer must provide adequate, lawful instructions and the information reasonably needed to identify the request. A self-service export or deletion feature is not promised; assistance may use existing administrative tools and support. Mandatory duties and response periods still apply. Optional work beyond those duties may be separately scoped and priced before it begins, but no undisclosed fee or new purchase is a condition of a legally required response or remedy.

A7. Incidents

A7.1 Notice and response. We will notify your designated privacy or incident contact, or otherwise your billing email, without undue delay after becoming aware of a breach affecting Customer Personal Data, including unlawful access, use, disclosure, alteration, loss or destruction, and earlier where law requires. We will take reasonable containment, investigation and remediation measures, provide available information on the event, affected data and likely consequences, and send updates as facts become known. We will not postpone an initial required notice until the investigation is complete. Schedule B2 includes Quebec attempted-violation reporting.

A7.2 Cooperation. Each party will reasonably cooperate in mitigation and required notifications. You normally coordinate notices concerning processing on your behalf; Nur7 may independently notify a regulator or individual where legally required. Notice is not by itself an admission of fault. The Agreement does not waive either party's reporting duties or an individual's rights.

A8. Verification and remediation

We will provide relevant information in our possession reasonably needed to demonstrate compliance and allow oversight required by Applicable Data Protection Law. Where adequate and legally permitted, written answers, existing documentation or an available independent report may be used before a more intrusive assessment; no existing certification or annual third-party audit is represented. Necessary verification must protect other customers’ data and system security and use reasonable confidentiality and scheduling arrangements without defeating a statutory right. The Customer may take reasonable steps to stop and remediate unauthorized use where law requires, and we will notify it if we determine we cannot meet our applicable duties. Extra work beyond required oversight needs a separate agreement; legally required cooperation is not waived.

A9. Return, deletion and survival

Retention is purpose-limited, not indefinite. Customer Personal Data may be retained only while necessary for the instructed service or a specific continuing lawful purpose. Service cancellation stops new service activity but does not itself run a comprehensive automatic deletion or export of every application, provider and backup copy. We will return or delete data on lawful instructions and at service end to the extent required by Applicable Data Protection Law, and otherwise remove or irreversibly de-identify it when no longer lawfully needed. Request return before cancellation where practicable; this does not delay cancellation or defeat a legally available later request. No universal 30-day active-system or 90-day backup deadline is promised.

We must maintain and apply a workable retention and disposal practice covering information under our control and necessary instructions to Subprocessors. Separate billing, tax, consent, dispute and security records may be retained only for their applicable legal or necessary recordkeeping purposes, not as a reason to keep every shopper message. Backups and retained provider copies remain protected and may be retained only as law permits; an unspecified backup rotation is not an exception to a binding deadline. If retained data is restored, the same purpose restrictions and valid deletion obligations apply. Required deletion or retention information will be supplied on request. Any shorter mandatory deadline, including the applicable Quebec requirement in B2.2, controls. Independent platform copies are governed by that platform’s own duties; our copies remain our responsibility. This Schedule continues while we or our Subprocessors retain the information.

Schedule B | Regional Terms

Conditional supplements to one common Agreement

B1. When regional terms apply

These provisions apply where the relevant law governs the Customer, Nur7 or particular processing. Applicable law can depend on individuals and activities as well as business location; billing currency and address alone do not determine it. They do not make every Canadian or U.S. law apply to every subscription. The common protections in the Agreement remain contractual commitments even where a particular statute does not apply.

B2. Canada, including Quebec

B2.1 Canadian privacy protections. Where applicable, the parties will fulfil their respective obligations under PIPEDA and relevant provincial or territorial private-sector privacy laws. Nur7 will maintain comparable protection for entrusted data through its arrangements with providers and cooperate with necessary oversight. Where Alberta law requires foreign-provider transparency, we will supply the processing-country and purpose information, relevant outsourcing-policy information and privacy contact needed for the Customer's notices before affected processing. Each party is responsible for notices it must give directly.

B2.2 Quebec entrusted processing. Where section 18.3 of Quebec's Act respecting the protection of personal information in the private sector applies to the entrusted processing, this Agreement and Schedule A constitute the written service mandate. Nur7 must maintain the specified confidentiality safeguards, use the data only to perform that mandate and not retain the data after the mandate or contract expires, except to the extent retention is expressly required by law. Necessary return must be arranged before expiry where practicable; otherwise the data must be securely destroyed at expiry. Schedule A9's general retention provisions do not authorize later retention of that data. Applicable requirements must also be imposed on Subprocessors.

B2.3 Quebec notice and verification. For entrusted information subject to section 18.3, we will notify the Customer’s person responsible for privacy without delay of a violation or attempted violation of a confidentiality obligation of which we become aware and allow that person to verify confidentiality requirements. The Customer must identify that person when needed; the billing contact may be the same person and otherwise must promptly route the notice. General incident definitions or ordinary assessment procedures cannot narrow these rights.

B2.4 Quebec transfers and assessments. Before affected data is entrusted outside Quebec, the party required to conduct a privacy impact assessment must complete it and establish adequate protection. Nur7 will provide relevant information about the processing, safeguards, providers and locations. Any necessary additional contractual safeguards arising from the assessment must be agreed and implemented before affected processing begins or materially changes. Pending those prerequisites, affected processing must not begin. Accepting this Agreement is not a representation that an assessment has been completed or a substitute for it. This does not shift Nur7's own assessment or other legal duties to the Customer.

B2.5 Quebec language and civil-law protections. The English-language choice in section 13.5 applies only where legally permitted, including a valid exception for a contract in relations outside Quebec. It is not a statement that a French version has been supplied. Where French-first presentation or other language steps are mandatory, Nur7 must provide them before requesting acceptance in another language, without an additional charge. Mandatory language rights, protections against abusive or unintelligible standard terms and non-excludable liability under applicable Quebec law prevail. Nothing waives a statutory cancellation or refund right.

B3. United States data-processing requirements

B3.1 State-law processor contracts. Where a U.S. state privacy law requires a controller-processor contract, Schedule A supplies the processing instructions, specific purposes, data types, duration and the parties' duties. Nur7 will provide the level of protection that law requires, keep personnel bound to confidentiality, use written Subprocessor contracts, assist with individual rights and required assessments, permit required oversight and return or delete data at the Customer's direction. The rights of individuals, regulators and the Customer under that applicable law are not reduced by contractual labels or limitations.

B3.2 California service-provider and contractor terms. To the extent the California Consumer Privacy Act and its regulations (CCPA) apply to entrusted personal information, the Customer discloses it only for the limited, specific business purposes described in A2.2. Nur7 acts as a service provider or, where applicable, contractor, and certifies that it understands and will comply with the restrictions in this Agreement. Nur7 will not sell or share the information, use it beyond those purposes or outside the direct business relationship, or combine it with information from another source or its own interaction with individuals, except as expressly allowed by the CCPA and consistent with the agreed purposes.

B3.3 California compliance rights. Nur7 must comply with applicable CCPA duties and provide the same level of privacy protection required by that law. The Customer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized use. Nur7 must notify the Customer if it determines that it can no longer meet its obligations; enable compliance with applicable consumer requests; provide required assistance for cybersecurity audits, risk assessments and automated-decisionmaking obligations; and impose compliant written requirements on further processors. Schedule A's procedures do not restrict these statutory rights.

B4. Mandatory subscription, remedy and forum protections

Where an applicable federal, provincial, territorial or state law gives a Customer additional non-waivable billing, renewal, cancellation, refund, language, warranty, liability, venue or other rights, those rights control over a conflicting provision. Nur7 will provide any legally required additional notice, consent control, retainable acknowledgment or cancellation method rather than relying solely on this statement. A required prior notice or consent that has not been obtained cannot be replaced by a later signature or by Ontario governing law. No provision prevents lawful payment disputes, regulator complaints, independent privacy rights or access to a forum that mandatory law makes available.

End of Agreement | Version 2.3