Master Terms of Service

5.1 Acceptable Use Policy

The Services are provided exclusively for use by businesses and professionals within the pest control industry for legitimate pest control purposes. Use of the platform for any other industry or for purposes not directly related to pest control operations is prohibited.

5.2 Right to Refuse Service

The Company reserves the right to refuse service to any individual or entity, at its sole discretion, including but not limited to marketing agencies, sales agencies, virtual assistance agencies, resellers, or any other entities that do not directly operate a pest control business. The Company also reserves the right to refuse service to any user who does not meet the Company's standards for legitimate pest control operations or who the Company reasonably believes may misuse the platform. This determination shall be made at the Company's sole discretion, and the Company is not required to provide justification for refusing service or terminating an account.

5.3 Compliance with Laws

You agree to comply with all applicable local, regional, national, and international laws and regulations in connection with your use of the Services. This includes, but is not limited to, laws related to data privacy, communications (including the Telephone Consumer Protection Act (TCPA) and CAN-SPAM Act), and business practices. You are solely responsible for ensuring that your use of the Services is compliant with all such legal requirements.

5.4 Regulatory-Bypass Tools and Third-Party Add-Ons

Pest AI does not build, resell, or support tools designed to circumvent telecommunications, messaging, or consumer-protection requirements. This includes, without limitation, iMessage-based bulk senders, unregistered A2P 10DLC or short-code messaging, ringless voicemail drops sent without required consent, SIM-farm dialers, spoofed caller-ID systems, and any similar tooling marketed as a way to avoid TCPA, CAN-SPAM, TSR, STIR/SHAKEN, carrier-registration, or state-level requirements.

You may choose to connect such tools to the systems we build for you. If you do, you do so at your own risk and on your own account: you remain solely responsible for consent capture, registration, opt-out handling, record-keeping, and every other legal obligation, and you agree that Pest AI has no responsibility or liability for that use. Our Services and any systems we deliver must be used in accordance with all applicable laws and regulatory statutes at all times. Use of the Services to bypass these obligations is a material breach of this Agreement and grounds for immediate suspension or termination under Section 12.

6.1 User Data Ownership

You retain full ownership of all User Content. We do not claim any ownership rights to your User Content. This includes customer lists, financial data, and any other business information you provide. Upon cancellation of your subscription, you may request an export of your User Content, which we will provide in a standard format within 30 days.

6.2 Company Proprietary Information

Notwithstanding the foregoing, the Company retains exclusive ownership of all its Proprietary Information, including but not limited to the software, platform architecture, automations, workflows, integration methods, and any innovations or custom features developed by the Company. Your license to use the Services does not grant you any ownership or rights to this Proprietary Information. AI-generated content remains the property of the Company as described in Section 7.3.

7.1 AI and Model Advancement

The field of artificial intelligence is rapidly evolving. You acknowledge that the Services rely on complex third-party AI models and that the Company does not guarantee the accuracy, reliability, or suitability of any content generated by the AI. The performance and capabilities of the Services may change as these underlying AI models are updated. We are not liable for any consequences arising from such advancements, changes, or any inaccuracies in AI-generated content. You are responsible for reviewing and verifying any information provided by the AI before acting upon it.

7.2 Third-Party Systems

The Services may integrate with or rely on third-party platforms and systems (including the underlying HighLevel platform and other external services). The Company is not responsible for the performance, availability, or integrity of these third-party systems. Any issues, downtime, or data integrity problems arising from third-party systems are outside the Company's control.

7.3 AI-Generated Content Ownership

All AI-generated responses and content produced by the platform are considered part of the Company's Proprietary Information. Users may not use AI-generated content for purposes beyond the intended use within the Services without explicit written permission from the Company.

7.4 Company Use of AI in Service Delivery

To build, audit, troubleshoot, and continuously optimize your account, the Company uses AI systems as a normal part of how it delivers the Services. This includes internal AI tooling as well as third-party and publicly available large language models operating under their respective enterprise or API data terms. These systems may be used during onboarding and on an ongoing basis after setup to review configurations, workflows, automations, prompts, campaign performance, and conversation quality, and to recommend or implement improvements, all for the purpose of delivering the best possible experience to you and your customers.

Access for this purpose is limited to what is reasonably necessary to perform the work, remains subject to the tenant-isolation, access-control, and confidentiality obligations in Section 8 and Part III, and does not change your ownership of your data under Section 6.1. Providers used for AI inference are listed in Section 8.2. You acknowledge that AI-assisted review may produce inaccurate output and that Section 7.1 applies to it.

8.1 Tenant Isolation & Cross-Contamination Controls

Partner data is logically isolated at the database layer. Every record is keyed to an owning organization and protected by PostgreSQL Row-Level Security (RLS) policies enforced by our database engine on every query. Application code cannot bypass these policies, and access tokens are scoped to a single organization so that one partner's queries, AI conversations, or integrations can never read or write another partner's data.

Voice and messaging AI sessions run in isolated per-partner contexts with separate knowledge bases, prompts, and conversation histories. Background jobs and edge functions execute with the requesting organization's scope and are blocked from cross-tenant reads. Production data is never used in development or staging environments without irreversible anonymization.

Third-party integrations (e.g., FieldRoutes, PestPac, GoHighLevel) use partner-specific API credentials stored in an encrypted secret vault, credentials are never shared across partners and are accessible only to the edge functions authorized to call that integration.

8.2 Database & Infrastructure Systems

Our primary application database is PostgreSQL, hosted on Supabase (which runs on AWS infrastructure). Postgres provides ACID transactions, point-in-time recovery, and the Row-Level Security policies described above. Authentication is handled by Supabase Auth (JWT-based, with bcrypt-hashed credentials and MFA support for administrators).

Serverless business logic runs on Supabase Edge Functions (Deno runtime) inside isolated containers. Static assets and the marketing site are served from a global CDN with HTTPS enforced and HSTS enabled. CRM and lead workflows are handled through GoHighLevel; email delivery uses Resend; AI inference is provided by Lovable AI Gateway and the partner-selected model provider (OpenAI, Anthropic, Google, etc.) under their respective enterprise data terms. These same providers may be used for the account auditing and optimization work described in Section 7.4; under their enterprise and API terms, partner data submitted for inference is not used to train public models.

All vendors in our production data path are SOC 2 Type II attested (or equivalent) and operate under signed Data Processing Agreements.

8.3 Additional Security Measures (Integrity & Protection)

• • Encryption: TLS 1.2+ in transit, AES-256 at rest for databases, backups, and object storage.
• • Access control: Principle of least privilege, role-based access, SSO and MFA required for all administrative accounts, periodic access reviews.
• • Secret management: API keys and integration tokens stored in an encrypted secret vault; never committed to source code; rotated on personnel changes or suspected compromise.
• • Input validation: Server-side schema validation (Zod), output sanitization, parameterized queries, and a Content Security Policy to mitigate XSS and injection.
• • Rate limiting & abuse protection: Per-IP and per-account rate limits on public endpoints; bot/spam protection on lead forms.
• • Audit logging: Authentication events, administrative actions, and access to sensitive records are logged and monitored for anomalies.
• • Backups & recovery: Automated daily backups with point-in-time recovery; documented restore procedures; backups encrypted and access-controlled.
• • Vulnerability management: Automated dependency scanning, security headers (CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy), and a published responsible-disclosure policy at /.well-known/security.txt.
• • Personnel: Background checks, confidentiality agreements, and mandatory security training for all team members with production access.
• • Data integrity: Database constraints, transactional writes, and webhook signature verification on inbound integrations to prevent tampering or replay.

9.1 Prohibited Uses

You agree not to use the Services for any of the following purposes:

• • Reverse engineering, decompiling, disassembling, or attempting to derive the source code, structure, or algorithms of any part of the Services
• • Developing, designing, or creating a competing product or service
• • Reselling, rebranding, or redistributing the Services without explicit written permission
• • Violating any applicable laws or regulations
• • Sending unauthorized or unsolicited communications
• • Impersonating others or misrepresenting affiliations
• • Harvesting or collecting data from other users

12.1 HighLevel Account Management Upon Termination

Upon termination of your account, the following policy regarding your account data and the underlying HighLevel system will apply:

• • No Agency Transfers: We will not transfer your account or its contents to another HighLevel (GHL) agency under any circumstances.
• • Account Ejection: Upon your request following termination, we will utilize the HighLevel "eject function." This process involves removing all of our Company's Proprietary Information, including custom workflows, automations, and integrations. Once our proprietary assets are removed, a new, separate GHL instance will be created for you containing your User Content. You will be responsible for all subsequent costs and management of this new instance.

12.2 Refund and Cancellation Policy (No Refunds, No Proration)

All fees paid to the Company are final and non-refundable. This policy applies to every product, service, subscription, and engagement offered by the Company, including but not limited to:

• • PestMail (direct mail platform and any associated print, postage, or fulfillment fees)
• • PestCRM / AI Sales System (all tiers and add-ons)
• • Managed AI (concierge and managed services engagements)
• • Custom Development (custom AI, software, integrations, websites, and funnel builds, including deposits, milestone payments, and project fees)
• • Pest AI Partners Program (membership, partnership, and affiliate fees)
• • All subscription tiers, billed monthly or annually, including any prepaid terms

We do not prorate or refund under any circumstances. This includes, without limitation, early cancellation, non-use or under-use of the Services, dissatisfaction, change of business direction, downgrade requests, mid-cycle cancellations, annual plans cancelled before the term ends, completed or in-progress custom development work, and account suspensions or terminations for violation of this Agreement.

Cancellation and access: You may cancel at any time. Upon cancellation, your account(s) and access to the applicable Services will remain active through the end of the then-current billing cycle (or, for annual plans, through the end of the prepaid annual term). No further charges will be issued after that period. No refund, credit, or proration will be issued for any unused portion of a billing cycle, prepaid term, or project engagement.

Any outstanding usage charges, third-party pass-through costs, or fees incurred prior to cancellation remain due and payable.

12.3 Data Retention After Termination

Upon account termination, the Company will retain your User Content for a period of thirty (30) days to allow for data export and recovery. After this thirty-day period, all User Content will be permanently deleted from the Company's systems. The Company may retain data longer if required by law or for backup and archival purposes. The Company is not responsible for any data loss after the thirty-day retention period has expired.

13.1 Core Services (Included in Subscription)

The following core services are included in the Client's subscription and are provided on an ongoing basis:

• SaaS Platform Access: The Client will be granted access to the Pest AI software-as-a-service platform, including all standard features and functionalities available at the time of subscription. This includes access to the AI-powered tools, automation capabilities, and integrations available through the platform. The Company reserves the right to add, modify, or discontinue features at its discretion, with reasonable notice to the Client.
• 24/7 Live Chat Support: The Company will provide round-the-clock live chat support within the application to assist with any platform-related inquiries, technical issues, or general questions. Support is available in English and will be staffed to provide initial responses within 15 minutes during standard operating hours.
• Whiteglove Onboarding: The Company will provide a comprehensive onboarding process to ensure the Client is fully equipped to utilize the platform effectively. This includes initial setup and configuration, training sessions, best practices guidance, and ongoing support during the initial implementation phase (typically 30-60 days). The Company will assign a dedicated onboarding specialist to work with the Client during this period.

13.2 Optional Services (Available Upon Request)

The following optional services are available on a case-by-case basis and will be detailed in a separate addendum to this Agreement:

• • Custom AI Development: Tailored AI models, workflows, and features developed to meet the Client's specific business requirements.
• • Custom Integrations: Integration of the Pest AI platform with the Client's existing software, CRM systems, databases, or other third-party applications.
• • Website/Funnel Development: Design and development of websites, landing pages, and marketing funnels to support the Client's business objectives.
• • Additional Services: Other custom services as mutually agreed upon by the Company and Client.
• • PestMail: Our automated direct mail and gifting platform. Requires a separate subscription.

15A.2 Client-Elected Add-Ons Are at Client's Own Risk

The Client may choose to connect such tools to the systems delivered under this Statement of Work. If the Client does so, the Client does so at its own risk and on its own account, and remains solely responsible for consent capture, sender registration, opt-out handling, record-keeping, and every other legal obligation. Any such use is outside the scope of Services and outside any warranty, SLA, support obligation, or indemnity the Company provides.

15A.3 Lawful-Use Requirement

The Services and any systems the Company delivers must be used in accordance with all applicable laws and regulatory statutes at all times. Use of the Services, directly or through any client-elected add-on, to bypass those obligations is a material breach of this Agreement and grounds for immediate suspension or termination under Section 12, without refund of prepaid fees.

15A.4 Indemnification for Non-Compliant Use

The Client agrees to defend, indemnify, and hold harmless Pest AI, its officers, employees, and subprocessors from and against any claims, penalties, fines, damages, or costs (including reasonable attorneys' fees) arising out of the Client's use of any regulatory-bypass tool described in Section 15A.1, whether or not that tool was connected to a system delivered by the Company.

17. Definition of Confidential Information

"Confidential Information" means any information disclosed by one party ("Disclosing Party") to the other party ("Receiving Party"), either directly or indirectly, in writing, orally, or by inspection of tangible objects, that is designated as "Confidential," "Proprietary," or some similar designation. Information communicated orally will be considered Confidential Information if it is confirmed in writing as being Confidential Information within a reasonable time after the initial disclosure.

Confidential Information may include, but is not limited to, trade secrets, business plans, financial information, customer lists, technical specifications, source code, algorithms, marketing strategies, pricing information, and any other non-public information.

18. Exclusions from Confidential Information

Confidential Information does not include any information that:

• • Is or becomes publicly known through no fault of the Receiving Party
• • Was in the possession of the Receiving Party prior to disclosure, as evidenced by written records
• • Is independently developed by the Receiving Party without use of the Disclosing Party's Confidential Information
• • Is lawfully obtained from a third party without breach of confidentiality obligations
• • Is required to be disclosed by law, court order, or regulatory requirement, provided prompt notice is given

19. Obligations of the Receiving Party

The Receiving Party agrees to:

• • Use Restrictions: Use the Confidential Information solely for the purpose of evaluating a potential business relationship or performing obligations under this Agreement.
• • Protection Measures: Take all reasonable measures to protect the confidentiality of the Confidential Information, including implementing safeguards no less stringent than those used to protect its own confidential information.
• • Non-Disclosure: Not disclose any Confidential Information to any third party without prior written consent, except as required by law.
• • Return or Destruction: Upon termination or request, promptly return or destroy all Confidential Information and certify such return or destruction in writing.

20. Permitted Disclosures

The Receiving Party may disclose Confidential Information:

• • To employees, contractors, and professional advisors with a legitimate need to know who are bound by written confidentiality obligations
• • As required by law or court order, with prompt written notice to the Disclosing Party
• • With the prior written consent of the Disclosing Party

21. No License or Obligation

Nothing in this Agreement is intended to grant any rights under any patent, copyright, trademark, or other intellectual property right of the other party. The Disclosing Party retains all rights to its Confidential Information. The receipt of Confidential Information does not obligate either party to enter into any business relationship.

22. Term and Survival of NDA

This Agreement shall remain in effect for a period of five (5) years from the Effective Date. The obligations of the Receiving Party with respect to Confidential Information shall survive termination for a period of five (5) years, except that trade secrets shall remain confidential for as long as they qualify as trade secrets under applicable law. Upon termination or request, the Receiving Party shall return or destroy all Confidential Information within 10 business days.

23. No Warranty

The Disclosing Party makes no warranty or representation regarding the accuracy, completeness, or usefulness of the Confidential Information. The Confidential Information is provided "as is" without any representations or warranties, express or implied.

24. Remedies

The Receiving Party acknowledges that any breach of this Agreement may cause irreparable harm to the Disclosing Party for which monetary damages would be an inadequate remedy. Accordingly, the Disclosing Party shall be entitled to seek equitable relief, including injunctive relief and specific performance, in addition to any other remedies available at law or in equity.

25. Mutual Obligations

This Agreement is mutual, and both parties are bound by the same confidentiality obligations with respect to each other's Confidential Information. Both parties acknowledge that they may be both a Disclosing Party and a Receiving Party with respect to different Confidential Information.

26. Accessibility

The Company is committed to ensuring that the Services are accessible to individuals with disabilities. We strive to comply with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards. If you encounter any accessibility issues while using the Services, please contact us at info@pestai.io, and we will make reasonable efforts to address your concerns.

27. Subprocessors and Third-Party Vendors

The Company uses third-party vendors and subprocessors to provide certain aspects of the Services. A current list of subprocessors is available upon request. The Company vets all subprocessors for compliance with applicable data protection laws. Users will be notified of any material changes to subprocessors, and users may object to the addition of new subprocessors by terminating their account within thirty (30) days of notification.

28. Incident Response and Support Escalation

In the event of a security incident, data breach, or service disruption, the Company will take immediate action to investigate and remediate the issue. For urgent issues requiring escalation, users may contact the Company's designated agent at info@pestai.io or by phone during business hours. The Company will prioritize escalated issues and provide status updates within four (4) hours of escalation. Critical security incidents will be escalated to senior management and addressed with the highest priority.

29. Change Management and Notification

While the Company reserves the right to modify this Agreement, any material changes to the terms will be communicated to users with at least thirty (30) days' notice. Material changes include but are not limited to changes to pricing, data handling practices, liability limitations, or core service features. Users who do not accept material changes may terminate their account within the thirty-day notice period without penalty. Non-material changes may be implemented with shorter notice or without advance notice.

30. Insurance

The Company maintains professional liability insurance and cyber liability insurance to protect against data breaches and service failures. The Company's insurance coverage is maintained at levels consistent with industry standards for SaaS providers. Information regarding the Company's insurance coverage is available upon request for qualified business partners.

31. Export Control

The Services and any related technical data are subject to U.S. export control laws, including the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR). Users agree not to export, re-export, or transfer the Services or any technical data to any prohibited country or entity, or for any prohibited end-use, as determined by U.S. government agencies.

32. API Terms (If Applicable)

If the Company provides API access to the Services, the following terms apply:

• • API Use: Users may access the API solely for their own legitimate business purposes within the pest control industry. Reverse engineering, scraping, or automated access for competitive purposes is strictly prohibited.
• • Rate Limits: The Company may impose rate limits on API access to prevent abuse and ensure service quality.
• • API Liability: The Company is not liable for any damages resulting from API downtime, errors, or misuse.
• • API Key Security: Users are responsible for maintaining the confidentiality of their API keys.
• • API Changes: The Company may modify, deprecate, or discontinue API endpoints with thirty (30) days' notice.

33. Governing Law and Dispute Resolution

This Agreement shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of law principles. Any dispute arising out of or relating to this Agreement shall be resolved through binding arbitration in California, in accordance with the rules of the American Arbitration Association.

34. Severability and Entire Agreement

If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. This Agreement constitutes the entire agreement between you and the Company regarding the Services and supersedes all prior agreements and understandings.