# The Company Company > The company that builds companies ## Home Source: https://www.thecompany.company The Company Company — The company that builds companies --- ## Legal ### Application Terms of Service Source: https://www.thecompany.company/legal/application-terms These Application Terms of Service ("Application Terms") govern your access to and use of the AI-powered business operations platform operated by The Company Company Inc. ("Company," "Co," "we," "us," or "our"), including the web application at [https://app.thecompany.company](https://app.thecompany.company), the desktop and mobile applications, the API, the command-line tools, personal assistants, and every agent, sandbox, integration, and related service we provide (together, the "Application"). These Application Terms are a legally binding agreement between the Company and the individual or entity that creates an account, joins an organization, or otherwise uses the Application ("Customer," "you," or "your"). If you use the Application on behalf of an organization, you represent that you have authority to bind that organization, and "Customer" means that organization. By clicking "I agree," creating an account, joining an organization, or using the Application, you accept these Application Terms and our Privacy Policy ([https://www.thecompany.company/legal/privacy](https://www.thecompany.company/legal/privacy)). If you do not agree, do not use the Application. These Application Terms supplement the Website Terms of Service ([https://www.thecompany.company/legal/terms](https://www.thecompany.company/legal/terms)), which continue to govern the public marketing website. Where the two conflict with respect to the Application, these Application Terms control. If you and the Company have signed a separate written agreement (for example an enterprise order form or a Data Processing Agreement), that agreement controls over these Application Terms to the extent of any conflict. ### 1. Definitions [#1-definitions] * "Agent" means any autonomous or semi-autonomous software process the Application runs on your behalf, including sessions, subagents, personal assistants, automations, and scheduled tasks. * "Authorized User" means an individual you allow to use the Application under your account or organization, including employees, contractors, and agents you invite. * "Connected Service" means any third-party product, service, or account you connect to the Application, including through OAuth, API keys, MCP servers, repository access, or model-provider subscriptions. * "Customer Data" means all data, content, code, credentials, messages, files, and other information that you or your Authorized Users submit to the Application, that the Application retrieves from a Connected Service at your direction, or that an Agent generates, transforms, or records while acting for you, including prompts, transcripts, tool calls, tool results, memories, sandbox contents, and Outputs. * "Documentation" means our published guides and reference material for the Application. * "Output" means text, code, files, actions, or other results the Application produces in response to your instructions. * "Training Data" means Customer Data that we retain and use for the purposes described in Section 5. * "Order" means an order form, checkout page, in-Application plan selection, or other document that specifies the plan, fees, and term for your use of the Application. ### 2. Eligibility and Accounts [#2-eligibility-and-accounts] You must be at least 18 years old to use the Application. The Application is a business tool. It is not directed to children, and we do not knowingly collect information from anyone under 13. You are responsible for all activity under your account and your organization, including activity by Authorized Users and Agents. You must keep credentials confidential, ensure that Authorized Users comply with these Application Terms, and notify us promptly at [legal@thecompany.company](mailto:legal@thecompany.company) of any unauthorized use. Organization owners and administrators may configure permissions, tool policies, model policies, approval requirements, integrations, and secrets for the organization. Those configurations bind every Authorized User in the organization. We may rely on any instruction that comes from an authenticated account or a session acting under one. ### 3. The Application and Agents [#3-the-application-and-agents] #### 3.1 Access [#31-access] Subject to these Application Terms and payment of applicable fees, we grant you a non-exclusive, non-transferable, non-sublicensable, revocable right during the term to access and use the Application for your internal business purposes in accordance with the Documentation. #### 3.2 Autonomous action [#32-autonomous-action] The Application runs Agents that read from and write to Connected Services and external systems on your behalf. Depending on how you configure it, an Agent may, without further confirmation from a human, send and post messages, create and edit documents and records, open, modify, and merge code changes, run commands in sandboxes, modify billing or customer records, schedule and trigger future work, and take any other action available through the tools and integrations you enable. You authorize the Company and its Agents to take these actions on your behalf and in your name. You are solely responsible for deciding which tools, integrations, permissions, approval requirements, and automations to enable, for the instructions you and your Authorized Users give, and for the consequences of actions taken within the authority you configured. We recommend requiring human approval for consequential or irreversible actions, and we are not responsible for losses that human approval would have prevented. #### 3.3 Connected Services [#33-connected-services] Connected Services are provided by third parties under their own terms. You are responsible for holding all rights, licenses, and consents required to connect each Connected Service, for complying with its terms, and for the data an Agent retrieves from it. We may store credentials for Connected Services in encrypted form for as long as the connection is active. We are not responsible for a Connected Service's availability, behavior, data, or changes. If you route model requests through your own subscription with a model provider (for example, a ChatGPT or Grok subscription), your agreement with that provider governs that usage, you are responsible for complying with it, and we make no commitment about how the provider handles data on those requests. #### 3.4 Sandboxes and secrets [#34-sandboxes-and-secrets] Agents may clone repositories, install software, store files, and run commands in sandboxed environments. Secrets you supply are made available to those environments as needed to perform your tasks. You must not place secrets in prompts, files, or Connected Services that are not designated for secrets. We use commercially reasonable measures to exclude secrets from logs, transcripts, and Training Data, but you are responsible for rotating any credential you expose. #### 3.5 Changes to the Application [#35-changes-to-the-application] We may add, change, or remove features, models, model providers, integrations, and limits at any time. We will use reasonable efforts to give notice of changes that materially reduce core functionality of a paid plan. Features marked beta, preview, experimental, or similar are provided as-is, may be withdrawn at any time, and are excluded from any service commitment. ### 4. Customer Data: Ownership and License [#4-customer-data-ownership-and-license] #### 4.1 Ownership [#41-ownership] As between you and us, you own Customer Data. You retain all rights in Customer Data except for the licenses you grant in these Application Terms. #### 4.2 License to operate the Application [#42-license-to-operate-the-application] You grant the Company a worldwide, non-exclusive, royalty-free license to host, copy, store, process, transmit, display, modify, and create derivative works of Customer Data as necessary to provide, secure, maintain, and support the Application, to comply with law, and as otherwise permitted by these Application Terms and the Privacy Policy. #### 4.3 Your representations about Customer Data [#43-your-representations-about-customer-data] You represent and warrant that: * You own or have obtained all rights, licenses, permissions, and consents (including from your employees, customers, counterparties, and the operators of Connected Services) necessary to submit Customer Data to the Application and to grant the licenses in this Section 4 and Section 5; * Customer Data and its use in accordance with these Application Terms do not and will not infringe or misappropriate any third-party right or violate any law or any agreement you are bound by, including the terms of any Connected Service; * You will not submit Customer Data that is subject to regulatory regimes requiring specific safeguards we have not agreed to in writing, including protected health information under HIPAA, payment card data under PCI DSS (other than through our payment processor), data of children under 13, or data subject to export controls, unless a signed agreement with us covers it; and * You have provided any notices to, and obtained any consents from, individuals whose personal information is contained in Customer Data that are required for the processing described in these Application Terms and the Privacy Policy, including for Training Data. ### 5. Service Improvement [#5-service-improvement] #### 5.1 License to improve the Services [#51-license-to-improve-the-services] Unless your organization has elected otherwise under Section 5.3, you grant the Company a worldwide, non-exclusive, perpetual, irrevocable, royalty-free, fully paid, sublicensable (to our service providers and successors) license to retain Customer Data and to use, reproduce, analyze, modify, create derivative works of, and otherwise process it to train, fine-tune, evaluate, test, benchmark, and improve models, Agents, prompts, tools, safety systems, and the Application, and to develop new products and services. #### 5.2 Exclusions [#52-exclusions] We do not use the following as Training Data, regardless of your setting: * Data obtained through Google API scopes (including Gmail, Google Drive, Docs, Sheets, and Calendar) and anything derived from it, consistent with the Google API Services User Data Policy. We store this data as Customer Data to provide the Services, including in transcripts and tool results, but we do not include it in Training Data; * Data obtained through any other Connected Service whose terms prohibit such use, as we determine from time to time; * Secrets, access tokens, API keys, passwords, payment card data, and sandbox environment variables; and * Data from an organization that has opted out under Section 5.3, from the time we process the opt-out. #### 5.3 Organization preference [#53-organization-preference] An organization owner or administrator may opt out of the use of Customer Data under Section 5.1 by emailing [legal@thecompany.company](mailto:legal@thecompany.company) from an owner or administrator account with the subject "Training opt-out". The opt-out takes effect prospectively once we have processed it, for Customer Data processed after that time. It does not require us to delete or stop using Training Data collected before the change, to retrain or delete models, or to remove aggregated or de-identified information. #### 5.4 Models are not Customer Data [#54-models-are-not-customer-data] Models, weights, embeddings, evaluations, prompts, and other artifacts we create using Training Data are our property and are not Customer Data. Deleting Customer Data, closing an account, terminating these Application Terms, or exercising a privacy right does not require us to delete, retrain, or modify any model or artifact already created, and we will not do so except where required by law. #### 5.5 Confidentiality of Training Data [#55-confidentiality-of-training-data] Training Data remains subject to the confidentiality and security obligations in these Application Terms. We do not sell Training Data, and we do not make Customer Data available to other customers except in the form of trained models and improvements to the Application. ### 6. Outputs and AI Limitations [#6-outputs-and-ai-limitations] * **Ownership of Outputs.** Subject to our rights in the Application, models, and any pre-existing materials, we assign to you our rights, if any, in Outputs generated for you. Outputs may not be unique; similar Outputs may be generated for other customers, and you have no rights in Outputs generated for others. * **No warranty of accuracy.** Outputs are produced by probabilistic systems and may be inaccurate, incomplete, outdated, biased, or otherwise wrong, and Agents may take unintended actions. You must review Outputs and Agent actions before relying on them. We do not warrant that Outputs are correct, safe, fit for any purpose, or free of third-party rights. * **No professional advice.** Outputs are not legal, financial, tax, medical, accounting, security, or other professional advice. * **Consequential decisions.** You must not use the Application as the sole basis for decisions that produce legal or similarly significant effects on individuals, including employment, credit, housing, insurance, education, or healthcare decisions, without meaningful human review. * **Third-party models.** We use third-party model providers. We may change providers and models at any time. Provider outages, policy changes, and behavior are outside our control. ### 7. Acceptable Use [#7-acceptable-use] You must not, and must not allow any Authorized User or Agent to: * Violate any law, regulation, or third-party right, or use the Application to do so; * Access another customer's data or any system you are not authorized to access, or use the Application to attempt to do so; * Use Outputs, the Application, or data obtained through it to develop, train, or improve a competing product or a general-purpose model, or to benchmark the Application for publication without our written consent; * Circumvent, disable, or probe safety, rate-limiting, permission, approval, tool-policy, or billing controls; * Reverse engineer, decompile, or extract the source code, prompts, weights, or non-public methods of the Application, except to the extent applicable law prohibits this restriction; * Resell, sublicense, time-share, or provide the Application to third parties as a service, except to Authorized Users; * Transmit malware, or use the Application to generate or distribute spam, harassment, fraud, disinformation, or content that is unlawful, infringing, or harmful; * Use the Application to make automated decisions with legal or similarly significant effects on individuals without the human review Section 6 requires; * Process regulated data described in Section 4.3 without a signed agreement covering it; or * Use the Application in a manner that imposes an unreasonable load on our infrastructure or interferes with other customers. We may investigate suspected violations, suspend affected accounts, Agents, or integrations, and cooperate with law enforcement. ### 8. Fees and Payment [#8-fees-and-payment] * **Plans and credits.** Fees, included usage, credits, and limits are set out in the applicable Order and on our pricing page. Usage beyond included amounts may be billed at the rates then in effect or may cause the Application to pause work until you add credits. * **Billing.** Subscriptions renew automatically for successive terms of the same length unless cancelled before renewal. You authorize us and our payment processors to charge your payment method for all fees when due. Fees are stated and payable in U.S. dollars and are exclusive of taxes, which you are responsible for (other than taxes on our income). * **Changes.** We may change fees on notice; changes take effect at your next renewal. Continued use after the change is acceptance. * **Refunds.** Fees are non-refundable except as required by law or as expressly stated in an Order. Unused credits expire as described on the pricing page or in the Order. * **Late payment.** We may suspend the Application for accounts more than 15 days past due after notice. Amounts unpaid when due accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower. * **Trials and free plans.** Free plans and trials are provided as-is and may be changed, limited, or withdrawn at any time. ### 9. Confidentiality [#9-confidentiality] "Confidential Information" means non-public information disclosed by one party to the other that is designated confidential or that a reasonable person would understand to be confidential, including Customer Data (for you) and the non-public features, prompts, methods, pricing, and roadmap of the Application (for us). The receiving party will use Confidential Information only to perform under these Application Terms (including, for us, the uses of Customer Data permitted by Sections 4 and 5), will protect it with at least reasonable care, and will disclose it only to personnel and service providers bound by comparable obligations. These obligations do not apply to information that is public through no fault of the receiving party, independently developed, or rightfully received from a third party without restriction, and do not prevent disclosure required by law after reasonable notice where permitted. ### 10. Security and Data Handling [#10-security-and-data-handling] We maintain administrative, technical, and physical safeguards designed to protect Customer Data, including encryption in transit and at rest, access controls, logging, and incident response procedures. We will notify you without undue delay of a confirmed security breach affecting your Customer Data, as required by applicable law. Our processing of personal information in Customer Data is described in the Privacy Policy and, where applicable, a Data Processing Agreement. Our sub-processors are listed at [https://www.thecompany.company/legal/sub-processors](https://www.thecompany.company/legal/sub-processors). You are responsible for the security of your own credentials, devices, Connected Services, and sandbox contents, and for backing up Customer Data you cannot afford to lose. ### 11. Intellectual Property [#11-intellectual-property] We and our licensors own the Application, models, Documentation, and all improvements, derivatives, and feedback-derived enhancements, including all intellectual property rights. Except for the rights expressly granted in these Application Terms, no rights are granted to you. If you provide suggestions, ideas, or feedback, you grant us a perpetual, irrevocable, royalty-free license to use them for any purpose without obligation. ### 12. Third-Party Services and Open Source [#12-third-party-services-and-open-source] The Application interoperates with Connected Services and includes open-source components governed by their own licenses. We are not responsible for third-party services, and your use of them is at your own risk. Nothing in these Application Terms limits your rights under an open-source license. ### 13. Term, Suspension, and Termination [#13-term-suspension-and-termination] * **Term.** These Application Terms apply from your first use of the Application and continue until terminated. * **Termination by you.** You may stop using the Application at any time and may request account or organization deletion through the Application or by emailing [legal@thecompany.company](mailto:legal@thecompany.company). Paid subscriptions continue until the end of the current billing term unless cancelled. * **Termination or suspension by us.** We may suspend or terminate your access immediately if you breach these Application Terms, fail to pay, create risk or legal exposure for us, or if we discontinue the Application (in which case we will refund prepaid fees for the unused portion of a paid term). We may otherwise terminate on 30 days' notice. * **Effect.** On termination your right to use the Application ends. For 30 days after termination you may request an export of your Customer Data, which we will use reasonable efforts to provide, after which we may delete it, subject to Section 5.4, our retention practices in the Privacy Policy, and legal requirements. Sections 4, 5, 6, 8 (for amounts owed), 9, 11, 14, 15, 16, 17, and 18 survive. ### 14. Warranties and Disclaimers [#14-warranties-and-disclaimers] Each party warrants that it has the authority to enter into these Application Terms. You further warrant that your use of the Application will comply with law and these Application Terms. EXCEPT AS EXPRESSLY STATED IN THESE APPLICATION TERMS, THE APPLICATION, AGENTS, OUTPUTS, AND DOCUMENTATION ARE PROVIDED "AS IS" AND "AS AVAILABLE." WE DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. WE DO NOT WARRANT THAT AGENTS WILL ACT AS INTENDED, THAT OUTPUTS WILL BE CORRECT, OR THAT THE APPLICATION WILL MEET YOUR REQUIREMENTS. YOU ASSUME ALL RISK ARISING FROM YOUR USE OF THE APPLICATION AND FROM ACTIONS AGENTS TAKE WITHIN THE AUTHORITY YOU CONFIGURED. ### 15. Limitation of Liability [#15-limitation-of-liability] TO THE MAXIMUM EXTENT PERMITTED BY LAW: * NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS INTERRUPTION, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY. * OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE APPLICATION TERMS OR THE APPLICATION WILL NOT EXCEED THE FEES YOU PAID TO US FOR THE APPLICATION IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED U.S. DOLLARS (US $100) IF YOU PAID NO FEES. * WITHOUT LIMITING THE FOREGOING, WE ARE NOT LIABLE FOR ACTIONS TAKEN BY AGENTS WITHIN THE TOOLS, INTEGRATIONS, PERMISSIONS, AND APPROVAL SETTINGS YOU CONFIGURED, FOR OUTPUTS, FOR CONNECTED SERVICES, FOR THIRD-PARTY MODEL PROVIDERS, OR FOR YOUR FAILURE TO BACK UP CUSTOMER DATA. * THESE LIMITATIONS DO NOT APPLY TO YOUR PAYMENT OBLIGATIONS, EITHER PARTY'S INDEMNIFICATION OBLIGATIONS, OR LIABILITY THAT CANNOT BE LIMITED BY LAW. ### 16. Indemnification [#16-indemnification] You will defend, indemnify, and hold harmless the Company and its officers, directors, employees, agents, and affiliates from and against all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) Customer Data, including any claim that Customer Data or our processing of it as permitted by these Application Terms infringes or violates a third party's rights or applicable law; (b) your Connected Services and your compliance with their terms; (c) actions taken by Agents within the authority you configured or at your or your Authorized Users' instruction; (d) your use of Outputs; (e) your breach of these Application Terms; or (f) any dispute between you and a third party, including your customers, employees, or counterparties. We will defend you against third-party claims alleging that the Application, as provided by us and used in accordance with these Application Terms, infringes a United States patent, copyright, or trademark, and pay resulting damages and costs finally awarded, provided you notify us promptly, give us sole control of the defense and settlement, and cooperate reasonably. We have no obligation for claims arising from Customer Data, Outputs, Connected Services, combinations with items we did not supply, or use after we notify you to stop. If the Application is or may be enjoined, we may modify it, procure a license, or terminate the affected part and refund prepaid unused fees. This Section states our entire liability for infringement. ### 17. Dispute Resolution and Arbitration [#17-dispute-resolution-and-arbitration] #### 17.1 Binding arbitration [#171-binding-arbitration] Any dispute, controversy, or claim arising out of or relating to these Application Terms or the Application will be resolved by binding arbitration administered by JAMS under its Streamlined Arbitration Rules and Procedures (or Comprehensive Rules for claims exceeding the Streamlined threshold). The arbitration will be conducted in San Francisco, California, by a single arbitrator, in English. Judgment on the award may be entered in any court of competent jurisdiction. To the extent permitted by law, each party waives any right to a jury trial. #### 17.2 Class action waiver [#172-class-action-waiver] EACH PARTY MAY BRING CLAIMS AGAINST THE OTHER ONLY IN ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate claims of more than one party. Nothing in this Section waives any right to seek public injunctive relief that cannot be waived under applicable law; the arbitrator may award such relief to the extent the law permits, and any request for it that cannot lawfully be arbitrated will proceed in the courts specified in Section 18, without affecting the enforceability of the rest of this Section 17. #### 17.3 Exceptions [#173-exceptions] Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect intellectual property rights or Confidential Information, and either party may bring an individual action in small claims court for qualifying disputes. #### 17.4 Opt-out [#174-opt-out] You may opt out of this Section 17 by emailing [legal@thecompany.company](mailto:legal@thecompany.company) with the subject "Arbitration Opt-Out" within 30 days of first accepting these Application Terms. If you opt out, disputes will be resolved in the courts named in Section 18. ### 18. Governing Law and Venue [#18-governing-law-and-venue] These Application Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-law rules. For any dispute not subject to arbitration, the state and federal courts located in San Francisco, California have exclusive jurisdiction and venue, and each party consents to personal jurisdiction there. The United Nations Convention on Contracts for the International Sale of Goods does not apply. ### 19. Changes to These Application Terms [#19-changes-to-these-application-terms] We may modify these Application Terms. For material changes, including changes to Section 5 (Service Improvement), Section 15 (Limitation of Liability), or Section 17 (Dispute Resolution), we will give reasonable advance notice by email to the addresses associated with your account or by notice in the Application, and we will ask you to accept the updated Application Terms before continuing to use the Application after the effective date. Other changes take effect when posted with a revised "Last Updated" date. If you do not agree to a change, you must stop using the Application before the effective date and may request deletion under Section 13. ### 20. General [#20-general] * **Export and sanctions.** You represent that you are not located in, or a national of, a country subject to U.S. embargo, and are not on any U.S. restricted-party list. You will comply with export-control and sanctions laws. * **U.S. Government users.** The Application is commercial computer software; government users receive only the rights granted to all customers under these Application Terms. * **Publicity.** With your prior consent, we may identify you as a customer by name and logo. You may revoke consent at any time. * **Force majeure.** Neither party is liable for delay or failure caused by events beyond its reasonable control, including third-party service provider or model-provider outages. * **Assignment.** You may not assign these Application Terms without our written consent. We may assign them to an affiliate or in connection with a merger, acquisition, reorganization, or sale of assets. * **Notices.** Notices to us go to [legal@thecompany.company](mailto:legal@thecompany.company) or The Company Company Inc., 1885 Mission St, San Francisco, CA 94103. Notices to you go to the email address on your account or in-Application notice, and are effective when sent. * **Severability; waiver.** If a provision is unenforceable, it will be enforced to the maximum extent permitted and the rest remains in effect. Failure to enforce a provision is not a waiver. * **Independent contractors.** The parties are independent contractors. Nothing creates a partnership, joint venture, agency (other than the Agent authorization in Section 3.2), or employment relationship. * **Entire agreement.** These Application Terms, the Privacy Policy, any Order, any Data Processing Agreement, and the Website Terms (as to the website) are the entire agreement between the parties about the Application and supersede all prior agreements and understandings. Terms in your purchase orders or vendor forms do not apply. ### Contact Us [#contact-us] * Email: [legal@thecompany.company](mailto:legal@thecompany.company) * Address: The Company Company Inc., 1885 Mission St, San Francisco, CA 94103 --- ### Data Processing Agreement Source: https://www.thecompany.company/legal/dpa This Data Processing Agreement ("DPA") forms part of the Application Terms of Service ([https://www.thecompany.company/legal/application-terms](https://www.thecompany.company/legal/application-terms)) or other written agreement (the "Agreement") between The Company Company Inc. ("Company," "Co," "we," or "us") and the customer identified in the Agreement ("Customer"). It applies to the extent we process Personal Information contained in Customer Data on Customer's behalf in providing the Application. It takes effect when Customer accepts the Agreement, whether by clicking to accept the Application Terms or by signing a separate written agreement that incorporates this DPA. Capitalized terms not defined here have the meaning given in the Agreement. **Scope note on training.** Section 5 of the Application Terms grants us a license to use Customer Data for model training and improvement unless Customer opts out as described in Section 5.3 of the Application Terms (by email to [legal@thecompany.company](mailto:legal@thecompany.company)). Processing under that license is performed for our own purposes and is governed by our Privacy Policy and Section 4 of this DPA, not by the processor obligations in Section 3. Customers that require processor-only handling of all Customer Data should opt out before connecting data. ### 1. Definitions [#1-definitions] * "Applicable Data Protection Law" means the U.S. state privacy laws that apply to the processing of Personal Information under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and their implementing regulations. * "Personal Information" means information within Customer Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household, as defined under Applicable Data Protection Law. * "Processing," "Sell," "Share," "Service Provider," "Business," "Consumer," and "Business Purpose" have the meanings given under Applicable Data Protection Law. * "Security Incident" means a confirmed unauthorized access to, or acquisition, disclosure, or loss of, Personal Information in our possession or control. * "Sub-processor" means a third party we engage to process Personal Information on Customer's behalf, as listed at [https://www.thecompany.company/legal/sub-processors](https://www.thecompany.company/legal/sub-processors). ### 2. Roles and Details of Processing [#2-roles-and-details-of-processing] * **Service delivery.** When we process Personal Information solely to provide the Application to Customer as configured by Customer, Customer is the Business and we are the Service Provider. * **Training and our own purposes.** When we retain and use Customer Data for model training and improvement, security, legal compliance, and our own business operations under the Agreement and Privacy Policy, we are a Business for that processing, and Section 3 does not apply to it. * **Nature and purpose.** Hosting, storing, and processing Customer Data; running agents that read from and write to Connected Services at Customer's direction; generating outputs; providing support; and the purposes described in the Privacy Policy. * **Categories of data subjects.** Customer's Authorized Users, employees, contractors, customers, prospects, vendors, and other individuals whose information Customer or its Connected Services include in Customer Data. * **Categories of Personal Information.** Identifiers and contact details, professional information, communications content, commercial and transaction information, internet activity, source code and files, and any other category Customer chooses to connect. Customer must not connect Sensitive Personal Information requiring specific safeguards (for example protected health information) without a separate written agreement. * **Duration.** For the term of the Agreement and thereafter as described in Section 7. ### 3. Service Provider Obligations [#3-service-provider-obligations] For processing described in Section 2 as service delivery, we will: 1. Process Personal Information only on Customer's documented instructions, which are the Agreement, this DPA, and the configurations and instructions Customer and its Authorized Users provide through the Application, including instructions to agents. Actions agents take within the tools, integrations, and approval settings Customer configured are Customer's instructions. 2. Not Sell or Share Personal Information. 3. Not retain, use, or disclose Personal Information for any purpose other than the Business Purposes specified in the Agreement, or outside the direct business relationship with Customer, except as permitted by Applicable Data Protection Law. 4. Not combine Personal Information received from Customer with Personal Information received from another source, except as permitted by Applicable Data Protection Law. 5. Comply with Applicable Data Protection Law and provide the same level of privacy protection as it requires of Customer. We will notify Customer if we determine we can no longer meet our obligations under Applicable Data Protection Law, and Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use. 6. Ensure that personnel with access to Personal Information are bound by confidentiality obligations. 7. Assist Customer in responding to Consumer requests as described in Section 6. 8. Allow Customer to take reasonable steps to ensure we use Personal Information consistently with Customer's obligations, as described in Section 8. ### 4. Training and Improvement Processing [#4-training-and-improvement-processing] Unless Customer's organization has opted out, Customer acknowledges and agrees that: 1. We retain Customer Data, including Personal Information in it, and use it to train, fine-tune, evaluate, test, benchmark, and improve models, agents, prompts, tools, safety systems, and the Application, and to develop new products and services, as a Business. Customer discloses Personal Information to us for these purposes and, to the extent Applicable Data Protection Law treats that disclosure as a sale or sharing, this Section 4 is the contract required by Cal. Civ. Code 1798.100(d) and 11 CCR 7053 for it. 2. For Personal Information we receive for the purposes in Section 4.1, we will: (a) use it only for those purposes and the other purposes disclosed in our Privacy Policy; (b) provide the level of privacy protection Applicable Data Protection Law requires of Customer; (c) not sell or share it onward; (d) notify Customer if we determine we can no longer meet our obligations under Applicable Data Protection Law, after which Customer may take reasonable steps to stop and remediate unauthorized use; and (e) honor Consumer requests directed to us as described in Section 6 and our Privacy Policy. Each party is responsible for its own notice and Consumer-choice obligations under Applicable Data Protection Law, and Customer represents that it has provided the notices and obtained the consents it is required to provide or obtain before disclosing Personal Information to us for these purposes. 3. We exclude from training the data described in Section 5.2 of the Application Terms, including data obtained through Google API scopes and secrets. 4. An opt-out applies prospectively. It does not require us to delete or stop using Customer Data collected before the change, to retrain or delete models, or to remove aggregated or de-identified information. 5. Models and other artifacts we create are our property and are not Personal Information subject to Customer's instructions. ### 5. Sub-processors [#5-sub-processors] Customer authorizes us to engage the Sub-processors listed at [https://www.thecompany.company/legal/sub-processors](https://www.thecompany.company/legal/sub-processors). We will impose data protection obligations on Sub-processors that are no less protective than those in this DPA, and we remain responsible for their performance. We may add or replace Sub-processors from time to time and will update that list when we do. Customer may object to a new Sub-processor on reasonable data protection grounds by writing to [legal@thecompany.company](mailto:legal@thecompany.company); if we cannot resolve the objection, Customer may terminate the Agreement. Connected Services that Customer instructs agents to act in are not our Sub-processors. ### 6. Consumer Requests [#6-consumer-requests] If we receive a request from a Consumer to exercise rights concerning Personal Information we process as Customer's Service Provider, we will direct the Consumer to Customer and will not respond except to acknowledge receipt or as required by law. We will provide Customer reasonable assistance through the Application's deletion and disconnection features and, for access, correction, or export requests, through [legal@thecompany.company](mailto:legal@thecompany.company). Requests concerning our processing as a Business (Section 4) are handled by us under the Privacy Policy. Deletion of Personal Information does not require deletion or retraining of models already created, as permitted by Applicable Data Protection Law. ### 7. Deletion and Return [#7-deletion-and-return] On termination of the Agreement or on Customer's written request, we will delete Personal Information processed as Service Provider from our primary databases within a reasonable period, except where retention is required by law or permitted by the Agreement. Personal Information retained under Section 4 is deleted according to the Privacy Policy. Customer may request an export of its Customer Data by emailing [legal@thecompany.company](mailto:legal@thecompany.company) before termination or within 30 days after it, and we will use reasonable efforts to provide it in a commonly used machine-readable format. ### 8. Security, Audits, and Incidents [#8-security-audits-and-incidents] * **Security measures.** We maintain administrative, technical, and physical safeguards appropriate to the risk, including encryption in transit and at rest, role-based access controls, logging and monitoring, isolated sandbox environments, secret management, and incident response procedures. * **Assessments.** No more than once per 12 months, Customer may request a written summary of our security practices. Where Applicable Data Protection Law gives Customer a right to assess our compliance, Customer may do so at its own expense, limited to the Personal Information processed for Customer, on reasonable notice, during business hours, and subject to confidentiality; a written summary satisfies that right unless the law requires more. * **Security Incidents.** We will notify Customer without undue delay after confirming a Security Incident affecting Customer's Personal Information, as required by Applicable Data Protection Law, and will provide the information reasonably available to us that Customer needs to meet its own notification obligations. ### 9. Customer Obligations [#9-customer-obligations] Customer represents and warrants that it has, and will maintain, all rights, notices, and consents required to connect Customer Data to the Application and to authorize the processing described in this DPA, including processing under Section 4, and that its instructions comply with Applicable Data Protection Law. Customer is responsible for the security of its own credentials, devices, and Connected Services, and for configuring permissions, tool policies, and approval requirements appropriate to the sensitivity of the data it connects. ### 10. General [#10-general] * **Precedence.** This DPA controls over conflicting terms of the Agreement with respect to Personal Information. Section 5 of the Application Terms controls over this DPA with respect to training. * **Liability.** Each party's liability under this DPA is subject to the exclusions and limitations in the Agreement. * **Changes.** We may update this DPA to reflect changes in Applicable Data Protection Law or our practices. Material changes follow the notice process in the Agreement. * **Governing law and disputes.** As stated in the Agreement. * **Jurisdictions outside the United States.** The Application is offered to customers in the United States. We do not represent that this DPA satisfies the requirements of laws outside the United States, including the GDPR or UK GDPR. Customers subject to those laws should not connect data governed by them without a separate written agreement. ### Contact [#contact] * Email: [legal@thecompany.company](mailto:legal@thecompany.company) * Address: The Company Company Inc., 1885 Mission St, San Francisco, CA 94103 --- ### Privacy Policy Source: https://www.thecompany.company/legal/privacy This Privacy Policy describes how The Company Company Inc., a Delaware corporation with its principal place of business at 1885 Mission St, San Francisco, CA 94103 ("Company," "Co," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal information (also called "personal data" in some jurisdictions) when you: * Access or use our AI-powered business operations platform and related services available at [https://www.thecompany.company](https://www.thecompany.company) (the "Services"); * Visit, interact with, or use our website, marketing pages, or communications; or * Communicate with us through email, support channels, or other means. When we decide how and why to process personal information (for example, for account management, billing, marketing, or model training and improvement), we act as a "business" under the California Consumer Privacy Act and "controller" under other privacy laws. When we process Customer Data solely to provide the Services to a business customer, we act as a "service provider" under the CCPA/CPRA and a "processor" under other applicable laws, and that processing is governed by our agreement with the customer, including the Application Terms of Service ([https://www.thecompany.company/legal/application-terms](https://www.thecompany.company/legal/application-terms)) and, where applicable, our Data Processing Agreement ([https://www.thecompany.company/legal/dpa](https://www.thecompany.company/legal/dpa)) ("DPA"). By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services. For information about how we process Customer Data on behalf of our business customers, please see the "Customer Data" item under "Information We Collect" and the sections titled "Improving Our Models and Services" and "Our Roles Under Privacy Law" below. ### Information We Collect [#information-we-collect] #### Information You Provide [#information-you-provide] * **Account Information**: Name, email address, password, and organization details when you create an account, as well as optional profile information (such as display name, avatar, role, and team membership). If you use Google Single Sign-On (SSO) on eligible plans, we receive your Google profile information (including name, email address, and profile picture) from Google when you authenticate. * **Billing Information**: Billing contact name, email address, billing address, tax identifiers (where applicable), and payment method details. We use third-party providers, including Autumn (which uses Stripe as a sub-processor), to process payments. We do not store full payment card numbers on our servers and only retain tokenized payment references and limited card metadata (such as last four digits and card type) as provided by our payment processors. * **Customer Data**: Any data, content, or information you submit through the Services in connection with your use, including data pulled from third-party tools you connect (for example, Slack, Google Workspace, Linear, GitHub, Notion, Attio, Stripe, PostHog, and other integrations or MCP servers you authorize), source code in repositories you connect, files you upload, secrets you store, and everything our agents generate or record while working for you (prompts, transcripts, tool calls and results, memories, sandbox contents, and outputs). Customer Data may include business records, communications, documents, project and ticket information, financial transaction data, and other information depending on the integrations and agent workflows you configure, and it routinely contains personal information about your employees, customers, and counterparties. You control what Customer Data is submitted to or generated through the Services. * **Communications**: Information you provide when you contact us for support, submit feedback, or otherwise communicate with us, including your name, email address, the content of your messages, and any attachments or files you choose to send. * **Professional and Business Information**: Company name, job title or role, department, team membership, and other professional information you provide when creating or managing a workspace or user account. * **Third-Party Integration Credentials**: When you authorize integrations with third-party services, we receive and store authentication credentials (such as OAuth access and refresh tokens and API keys) in encrypted form. We use these credentials only to connect to and act within those third-party services as necessary to perform the tasks and workflows you configure. #### Information Collected Automatically [#information-collected-automatically] When you use the Services, we automatically collect certain information, including: * **Log Data**: IP address, browser type, operating system, referring URLs, pages visited, timestamps, access times, and information about your interactions with specific features of the Services. * **Device Information**: Device type, unique device identifiers, and operating system version, hardware model, browser type and version, screen resolution, and mobile network information (such as carrier and connection type). * **Usage Data**: Features used, actions taken, frequency and duration of activities, and performance data, including agent execution logs, tool calls, error logs, clickstream data, and other information about how you navigate and interact with the Services. * **Geolocation Data**: Approximate location derived from your IP address (for example, city, state, or region). We use this information to provide the Services, maintain security, comply with regional legal requirements, and understand where our users are located. We do not collect precise geolocation (such as GPS coordinates) unless you explicitly enable a feature that requires it. * **Session Information and Recordings**: We may use product analytics tools to collect information about how you use the Services, including through event tracking and, in some cases, session recordings that capture interactions such as mouse movements, clicks, scrolling, and page transitions. We configure these tools to avoid capturing passwords, payment card numbers, and other fields we designate as sensitive. #### Cookies and Tracking Technologies [#cookies-and-tracking-technologies] We use the following categories of cookies and similar technologies: * **Strictly Necessary**: Required for the Services to function, including authentication and security cookies. These cannot be disabled. Without them, we cannot provide the Services. * **Analytics**: Used to understand how users interact with the Services. We use the following analytics services: * **PostHog**: Product analytics and session recording for understanding user behavior and improving the Services, measuring feature adoption, debugging issues, and improving user experience. * **Vercel Analytics**: Web performance and traffic analytics used to monitor page load times, request volumes, and performance metrics. We do not use advertising or marketing cookies. We also do not use third-party advertising pixels (such as the Meta or TikTok pixel) in the Services. You can manage analytics cookies through your browser settings or by contacting us at [legal@thecompany.company](mailto:legal@thecompany.company). Disabling analytics cookies will not affect the functionality of the Services. Depending on your location, you may see additional cookie controls or banners when you visit our website, and you can use those controls to manage your preferences. ### How We Use Your Information [#how-we-use-your-information] We use the information we collect to: * Provide, operate, and maintain the Services. * Process transactions and manage your subscription. * Send transactional communications, including service updates, security alerts, and support messages. * Respond to your requests, comments, and questions. * Monitor and analyze usage patterns and trends to improve the Services. * Detect, prevent, and address fraud, abuse, and security issues. * Comply with legal obligations and enforce our Terms of Service. * Develop new features and functionality. * Train, fine-tune, evaluate, and improve our models and the Services, as described in "Improving Our Models and Services." More specifically, we use personal information for the following purposes: * **Providing and operating the Services**: Creating and managing accounts, authenticating users, executing agent workflows, connecting to third-party integrations you authorize, processing transactions, and providing customer support. * **Improving and developing the Services**: Monitoring and analyzing usage patterns, diagnosing, and fixing bugs, conducting research and development, and testing new features and improvements. * **Model training and improvement**: Training, fine-tuning, evaluating, benchmarking, and improving our AI models, agents, prompts, tools, and safety systems, and developing new products and services, using Customer Data and other information as described in "Improving Our Models and Services." * **Security and abuse prevention**: Detecting, investigating, and preventing fraudulent, harmful, or unauthorized activity; protecting the security and integrity of the Services, our users, and our infrastructure. * **Communications**: Sending transactional messages, service-related announcements, security alerts, technical notices, and administrative messages; responding to your inquiries and support requests. * **Marketing and engagement**: Sending you marketing emails or in-product messages about new features, offers, and events (where permitted by law). You can opt out of marketing communications at any time. * **Compliance and legal obligations**: Complying with applicable laws, regulations, legal processes, and government requests; enforcing our Terms of Service and other policies; and protecting our rights and the rights of others. * **Business operations**: Performing accounting, auditing, billing, reconciliation, and other internal business operations; planning and forecasting; and evaluating or conducting corporate transactions (such as mergers, acquisitions, or financing). We may use aggregated or de-identified information derived from Customer Data for analytics, benchmarking, and improving the Services, and we retain such information indefinitely. ### Improving Our Models and Services [#improving-our-models-and-services] We build and operate AI agents, and we improve them by learning from how they are used. This section describes that processing. * **What we use.** Unless training is turned off for your organization, we retain Customer Data and use it to train, fine-tune, evaluate, test, benchmark, and improve our models, agents, prompts, tools, safety systems, and the Services, and to develop new products and services. This includes prompts, transcripts, agent outputs, tool calls and results, memories, files, repository contents, and data retrieved from Connected Services that are not excluded below. Personal information contained in Customer Data may be included. * **What we never use.** Whether or not your organization has opted out, we exclude: (a) data obtained through Google API scopes (Gmail, Google Drive, Docs, Sheets, Calendar) and anything derived from it, consistent with the Google API Services User Data Policy; (b) data from any other Connected Service whose terms prohibit such use; (c) secrets, access tokens, API keys, passwords, payment card data, and sandbox environment variables; and (d) data from organizations that have opted out, from the time we process the opt-out. * **How to opt out.** An organization owner or administrator can opt out by emailing [legal@thecompany.company](mailto:legal@thecompany.company) from an owner or administrator account with the subject "Training opt-out". The opt-out takes effect when we process the request, and applies to Customer Data processed after that time. It does not require us to delete or stop using data collected before the change, to retrain or delete models, or to remove aggregated or de-identified information. * **Models are not your data.** Models, weights, embeddings, evaluations, and other artifacts we create are our property. When you delete data, close your account, or exercise a deletion right, we remove the affected Customer Data from our primary databases and from the data sets we use for future training within a reasonable period, and make reasonable efforts to remove associated sandbox and runtime storage at the same time. We do not delete, retrain, or modify models already created, except where required by law, so information learned by those models persists. * **Retention.** We retain Customer Data used for training for as long as it is useful for the purposes above, which may be indefinitely. See "Data Retention." * **Confidentiality.** Training data remains subject to the confidentiality and security obligations in our Application Terms. We do not sell it, and we do not make one customer's data available to another customer except in the form of trained models and improvements to the Services. * **Third-party providers.** We do not permit third-party model providers to train their models on Customer Data we send them; their processing is limited to serving our requests under our agreements with them. * **Existing customers.** This section applies to Customer Data of customers who accepted the Application Terms on or after the "Last updated" date above. For customers who used the Services before that date, it applies only after they have received at least 30 days' notice and accepted the updated Application Terms; until then, the previous version of this Privacy Policy governs their Customer Data. ### AI and Automated Processing [#ai-and-automated-processing] Our Services include AI-powered features that process data to provide autonomous agent capabilities. In connection with these features: * **AI Processing**: Customer Data may be processed by AI models to generate outputs, make recommendations, and execute tasks as configured by the Customer. This processing is performed solely to provide the Services. The quality and accuracy of AI outputs depend on the data, prompts, and configurations you provide. * **Third-Party AI Providers**: We use third-party AI model providers (including Anthropic, OpenAI, Google, and xAI, directly or through routing services such as OpenRouter) to power AI features. Customer Data sent to these providers is subject to our agreements with them and is not used by these providers to train their models. If you route requests through your own subscription with a provider, that provider's terms govern those requests and we do not control how it handles the data. The current list of providers is at [https://www.thecompany.company/legal/sub-processors](https://www.thecompany.company/legal/sub-processors). * **AI Logs**: We retain logs of AI inputs and outputs, including prompts, transcripts, and tool calls, to provide the Services, debug issues, ensure quality, and for model training and improvement as described above. These logs are Customer Data and subject to the same protections. We retain them for the periods described in the "Data Retention" section below. * **Automated Decision-Making**: Our AI features may make automated decisions or take automated actions based on Customer configurations. Customers are responsible for implementing appropriate human oversight as required by their use case and applicable law. You must not use AI-generated outputs as the sole basis for decisions that produce legal or similarly significant effects on individuals (such as employment, credit, housing, or healthcare decisions) without appropriate human review and additional safeguards. * **Model Training**: We use Customer Data to train and improve our models unless your organization has opted out. See "Improving Our Models and Services." Depending on your location, you may have rights to object to or opt out of certain automated processing or profiling that produces legal or similarly significant effects. See the "U.S. State Privacy Rights" and "California Residents (CCPA/CPRA and Similar Laws)" sections below for more information. ### How We Share Your Information [#how-we-share-your-information] We do not sell your personal information. We may share information in the following circumstances: * **Service Providers**: With third-party vendors who perform services on our behalf (hosting, sandbox infrastructure, payment processing, analytics, AI model providers, email delivery), subject to confidentiality and data processing obligations and only for the purposes described in this Privacy Policy or in our agreement with your organization. Our current sub-processors are listed at [https://www.thecompany.company/legal/sub-processors](https://www.thecompany.company/legal/sub-processors). * **Connected Services, at your direction**: Our agents read from and write to the third-party services you connect (for example, posting to Slack, opening pull requests on GitHub, or updating CRM records). Information sent to a Connected Service is governed by that service's terms and privacy policy. * **Legal Compliance**: When required by law, regulation, legal process, or governmental request. * **Safety and Rights**: To protect the rights, property, or safety of the Company, our users, or others. * **Business Transfers**: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your information may be transferred as part of the transaction, and we will take reasonable steps to require the recipient to honor this Privacy Policy or notify you of material changes. * **With Your Consent**: When you have given us explicit consent to share your information. We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for analytics, research, and similar purposes. ### Our Roles Under Privacy Law [#our-roles-under-privacy-law] We act in two capacities with respect to Customer Data: * **Service provider / processor.** When we process Customer Data solely to provide the Services to a business customer (for example, running the agent workflows the customer configures), we act as a service provider under the CCPA/CPRA and a processor under other laws. In that capacity we process Customer Data only as instructed by the customer and our agreement with it, do not sell or share it, and do not combine it with personal information from other sources except as permitted by law. * **Business / controller.** When we retain and use Customer Data for model training and improvement, security, legal compliance, and our own business operations, we act as a business under the CCPA/CPRA and a controller under other laws, and this Privacy Policy governs that processing. Because training is on by default, business customers should assume we act as a business for training unless they opt out. If you are an employee, customer, or counterparty of one of our business customers and your personal information is included in Customer Data, the business customer decided to connect that data. Requests about it that relate to the customer's own use of the Services should be directed to that customer. Requests about our training use can be directed to us at [legal@thecompany.company](mailto:legal@thecompany.company), and we will respond as described in the rights sections below, subject to the exceptions described under "Improving Our Models and Services." ### Data Security [#data-security] We implement commercially reasonable technical and organizational measures to protect your information, including: * Encryption of data in transit (TLS) and at rest * Access controls and authentication mechanisms * Regular security reviews * Incident response procedures However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you and/or your organization as required by applicable law and in accordance with our incident response procedures. ### Data Retention [#data-retention] We retain personal information as follows: * **Account Information**: For the duration of your account. After you delete your account or organization, we remove it from our primary databases within a reasonable period, subject to the exceptions below. * **Billing Records**: For at least 7 years after the transaction, as required by tax and financial regulations. * **Customer Data, including AI logs, transcripts, memories, files, and integration data**: For the duration of your account and thereafter for as long as it is useful for the purposes described in this Privacy Policy, including model training and improvement, security, and dispute resolution. This may be indefinite. Deleted sessions and Customer Data subject to a deletion request are removed from our primary databases and from future-training data sets within a reasonable period after deletion, and we make reasonable efforts to remove associated sandbox and runtime storage at the same time; models already trained on that data are not modified, as described in "Improving Our Models and Services." * **Log, Usage, and Analytics Data**: Indefinitely, in identifiable form while your account exists and in aggregated or de-identified form thereafter. * **Support Communications**: Indefinitely. * **Aggregated/De-identified Data**: Indefinitely, as it cannot be used to identify you. * **Third-Party Integration Credentials**: For as long as the connection is active; deleted when you disconnect the integration or delete your account. We may retain information for longer where required by law or where reasonably necessary for legal, tax, accounting, or security purposes. When we delete data from our primary databases, copies may persist in backups, sandbox or runtime storage, and logs for a limited period before being overwritten or removed. ### U.S. State Privacy Rights [#us-state-privacy-rights] If you are a resident of a U.S. state with a comprehensive consumer privacy law, you may have some or all of the following rights over your personal information, subject to certain exceptions and limitations under applicable law. Similar rights may also be available to residents of other states if additional privacy laws come into effect. * **Right to Know / Access**: The right to confirm whether we are processing your personal information and to request access to that information, including the categories of personal information, the categories of sources, the purposes for processing, and the categories of third parties to whom we disclose it. * **Right to Data Portability**: The right to obtain a copy of certain personal information in a portable and, to the extent technically feasible, readily usable format so that it can be transmitted to another entity. * **Right to Delete**: The right to request that we delete personal information we collected from or about you, subject to certain exceptions (for example, when we must retain data to comply with law, to detect security incidents, to protect against fraudulent or illegal activity, or to complete a transaction or perform a contract with you). Deletion removes your personal information from our primary databases and from data sets we use for future training within the time required by applicable law, with reasonable efforts to remove associated sandbox and runtime storage; it does not require us to delete or retrain models already created, as permitted by applicable law. * **Right to Correct**: The right to request that we correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing. * **Right to Opt Out of Certain Processing**: Depending on your state, the right to opt out of our processing of personal information for: (a) "targeted advertising," (b) the "sale" of personal information, and/or (c) "profiling" in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not "sell" your personal information or engage in "targeted advertising" as those terms are defined in most state laws. If our practices change in the future, we will update this Privacy Policy and provide you with any required notices and choices (including any "Do Not Sell or Share" mechanisms). * **Right to Limit Use and Disclosure of Sensitive Personal Information**: In some states, the right to limit our use and disclosure of certain "sensitive" personal information. We collect limited sensitive personal information (such as account login credentials) as described in this Privacy Policy and use it only as reasonably necessary to provide the Services, maintain security, and comply with law. We do not use or disclose sensitive personal information for additional purposes that would give rise to a right to limit in most states' laws. * **Right to Non-Discrimination / Non-Retaliation**: The right not to be discriminated or retaliated against for exercising your privacy rights. We will not deny you goods or services, charge you different prices or rates, or provide you a different level or quality of services solely because you exercised your privacy rights. ### Exercising Your U.S. State Privacy Rights [#exercising-your-us-state-privacy-rights] You or your authorized agent can submit a request to exercise your applicable privacy rights by emailing us at [legal@thecompany.company](mailto:legal@thecompany.company) with a clear description of your request and the state where you reside. We may need to verify your identity (and, where applicable, your agent's authority) before we act on your request. We will respond within the timeframes required by applicable law (typically 45 days, with the ability to extend once where permitted). If we decline to act on your request, we will explain our decision. If your state law gives you the right to appeal our decision, you may do so by replying to our response or emailing us at [legal@thecompany.company](mailto:legal@thecompany.company) with "Privacy Rights Appeal" in the subject line. We will review your appeal and respond within the timeframe required by your state law (typically 45-60 days), explaining our decision. If additional states adopt similar privacy laws in the future, we will treat residents of those states in a manner consistent with this section and update this Privacy Policy as needed. ### California Residents (CCPA/CPRA and Similar Laws) [#california-residents-ccpacpra-and-similar-laws] If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), in addition to the rights described above. Residents of some other states (such as Virginia, Colorado, Connecticut, and similar "Virginia-model" states) have substantially similar rights, although the terminology and scope may differ. * **Right to Know**: You have the right to request that we disclose: (a) the categories of personal information we have collected about you; (b) the categories of sources from which the personal information is collected; (c) the business or commercial purpose for collecting or disclosing personal information; (d) the categories of third parties to whom we disclose personal information; and (e) the specific pieces of personal information we have collected about you. * **Right to Delete**: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, when we must keep information to comply with a legal obligation, to detect or prevent security incidents, or to protect against malicious or illegal activity). * **Right to Correct**: You have the right to request that we correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing. * **Right to Opt Out of Sale/Sharing**: We do not "sell" or "share" your personal information for cross-context behavioral advertising as those terms are defined in the CCPA/CPRA. If our practices change in the future, we will update this Privacy Policy and provide you with appropriate notice and choices, including any required "Do Not Sell or Share My Personal Information" mechanisms. * **Right to Limit Use and Disclosure of Sensitive Personal Information**: We collect certain "sensitive personal information" (such as account login credentials) as described above. We use this information only as reasonably necessary to provide the Services, secure your account, and comply with law, and not for additional purposes that would trigger the CCPA right to limit. If that ever changes, we will provide you with a way to exercise your right to limit such use or disclosure. * **Right to Non-Discrimination**: We will not discriminate against you for exercising any of your CCPA/CPRA rights. This means we will not deny you goods or services, charge you different prices or rates, or provide you a different level or quality of services solely because you exercised your privacy rights. To exercise any of these rights, contact us at [legal@thecompany.company](mailto:legal@thecompany.company). We will verify your identity before processing your request and respond within 45 days as required by law. If we need more time (up to an additional 45 days), we will let you know. If we deny your request, you may have the right to appeal; you can email us with "California Privacy Appeal" in the subject line, and we will respond within the timeframe required by California law. Where other state laws provide similar appeal rights, we will handle those appeals in a manner consistent with this process and applicable law. **Categories of Personal Information Collected** (as defined by the CCPA): | Category | Examples | Collected | Sources | Business Purpose | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | -------------------------------------------------------- | ------------------------------------------------------------------------ | | Identifiers | Name, email, IP address | Yes | Directly from you; automatically from your device | Account creation, authentication, communications | | Commercial information | Subscription records, billing history | Yes | Directly from you; from payment processors | Billing, subscription management | | Internet activity | Browsing history, interactions with Services, agent transcripts and tool calls | Yes | Automatically from your device and our Services | Service improvement, security, analytics, model training and improvement | | Customer Data content | Messages, documents, code, records retrieved from Connected Services or generated by agents, which may include any category of personal information | Yes | Directly from you; from Connected Services you authorize | Providing the Services, model training and improvement, security | | Geolocation data | Approximate location from IP address | Yes | Automatically from your device | Service delivery, security | | Professional information | Company name, job title | Yes | Directly from you | Account setup, personalization | | Sensitive personal information | Account login credentials | Yes | Directly from you | Authentication, account security | ### Do Not Track Signals [#do-not-track-signals] Some browsers include a "Do Not Track" ("DNT") setting that can send a signal to the websites you visit, indicating that you do not want to be tracked. There is currently no common industry standard for how to interpret DNT signals, and we do not respond to DNT signals at this time. You can manage most tracking technologies used by the Services as described in the Cookies and Tracking Technologies section. Certain U.S. state privacy laws (including in California and Colorado) require businesses to recognize browser- or device-level opt-out preference signals or universal opt-out mechanisms, such as Global Privacy Control ("GPC"), when those businesses "sell" or "share" personal information or engage in "targeted advertising" as defined by those laws. We do not currently sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising as those terms are defined under these laws. However, to the extent required by applicable law, when we detect a valid GPC or similar recognized opt-out signal from your browser or device, we will treat that signal as a request to opt out of any sale, sharing, or targeted advertising that may apply to our future data practices. Because we do not currently engage in those activities, honoring such signals will have limited practical effect today but may impact certain non-essential analytics or tracking if our practices change. ### International Data Transfers [#international-data-transfers] Our Services are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States. By using the Services or providing us with information, you understand that your personal information may be transferred to, stored in, and processed in the United States and in other countries where our service providers operate, which may have different data protection laws than those in your country. We do not currently market or offer the Services to individuals located in jurisdictions that impose additional data transfer or localization requirements (such as the European Economic Area, the United Kingdom, or Switzerland), and we do not represent that the Services comply with all laws of any non-U.S. jurisdiction. If you choose to access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with any local laws that apply to you. If, in the future, we intentionally expand to serve users in jurisdictions that require specific cross-border transfer mechanisms (such as Standard Contractual Clauses or participation in a Data Privacy Framework), we will implement appropriate transfer mechanisms to the extent required by applicable law and update this Privacy Policy accordingly. ### Third-Party Links and Services [#third-party-links-and-services] The Services may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access. Your use of third-party services is governed by those services' own terms and privacy policies. ### Changes to This Policy [#changes-to-this-policy] We may update this Privacy Policy from time to time. We will notify you of material changes by: * Posting the updated policy on our website with a revised "Last updated" date * Sending notice to the email address associated with your account, where practicable Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree to the updated Privacy Policy, you must stop using the Services and may request that we delete your account. ### Contact Us [#contact-us] If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at: * Email: [legal@thecompany.company](mailto:legal@thecompany.company) * Address: The Company Company Inc., 1885 Mission St, San Francisco, CA 94103 You may also have the right to lodge a complaint with your local data protection authority or attorney general if you believe we have violated applicable privacy laws. However, we encourage you to contact us first so we can address your concerns. --- ### Sub-processors Source: https://www.thecompany.company/legal/sub-processors This page lists the third parties ("Sub-processors") that The Company Company Inc. ("Company," "Co," "we") uses to process Customer Data in providing the Application. It is incorporated by reference into our Data Processing Agreement ([https://www.thecompany.company/legal/dpa](https://www.thecompany.company/legal/dpa)) and Privacy Policy ([https://www.thecompany.company/legal/privacy](https://www.thecompany.company/legal/privacy)). We update this page when we add or replace a Sub-processor. To receive email notice of changes, write to [legal@thecompany.company](mailto:legal@thecompany.company) with the subject "Sub-processor notifications." ### Infrastructure [#infrastructure] | Sub-processor | Purpose | Location | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | | Amazon Web Services, Inc. | Cloud hosting: compute (EKS), databases (Aurora PostgreSQL), cache (Redis), object storage (S3), container registry, observability | United States | | Vercel Inc. | Hosting of the marketing website and documentation; web performance analytics | United States | | Cloudflare, Inc. | DNS and edge networking | United States (global edge) | | E2B, Inc. | Isolated sandbox environments in which agents clone repositories, run commands, and store working files | United States | | Modal Labs, Inc. | Serverless compute for our embedding and reranking inference service and for hosted open-weight language models (for example Z.ai and Moonshot models) when selected by the organization's model policy | United States | ### AI model providers [#ai-model-providers] Model providers receive prompts, context, and tool results needed to serve a request and return model outputs. Under our agreements with them, they do not use Customer Data to train their models. Requests you route through your own subscription with a provider are governed by that provider's terms, not by our agreement with it. | Sub-processor | Purpose | Location | | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------- | | Anthropic, PBC | Large language model inference | United States | | OpenAI, L.L.C. | Large language model inference | United States | | Google LLC | Large language model inference | United States | | xAI Corp. | Large language model inference | United States | | DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | Large language model inference, only when selected by the organization's model policy | China | | OpenRouter, Inc. | Model routing to the providers above and to additional providers selected by the organization's model policy | United States | ### Agent tools [#agent-tools] | Sub-processor | Purpose | Location | | --------------- | ----------------------------------------------------- | ------------- | | Exa Labs, Inc. | Web search queries issued by agents | United States | | Expand AI, Inc. | Fetching and extracting web pages requested by agents | United States | ### Business operations [#business-operations] | Sub-processor | Purpose | Location | | ---------------------------------- | --------------------------------------------------------------------------- | ------------- | | Autumn (Autumn Technologies, Inc.) | Subscription, credit, and usage billing | United States | | Stripe, Inc. | Payment processing (as a sub-processor of Autumn and directly for invoices) | United States | | PostHog, Inc. | Product analytics and session replay for the Application and website | United States | | Resend, Inc. | Transactional email delivery | United States | ### Connected Services are not Sub-processors [#connected-services-are-not-sub-processors] Third-party services you connect to the Application (for example, Slack, GitHub, Google Workspace, Linear, Notion, Attio, or any MCP server) receive data because you instructed an agent to act in them. They act under their own terms with you and are not our Sub-processors. ### Contact [#contact] Questions about this list: [legal@thecompany.company](mailto:legal@thecompany.company). --- ### Website Terms of Service Source: https://www.thecompany.company/legal/terms These Website Terms of Use ("Terms") govern your access to and use of our public marketing website at [https://www.thecompany.company](https://www.thecompany.company) and any related subdomains we operate (the "Website"). These Terms cover: * Your browsing and use of the Website, including viewing content, signing up for a waitlist or newsletter, and submitting inquiries or contact forms; and * Your creation of a free account through the Website or Application sign-in page (at [https://app.thecompany.company/sign-in](https://app.thecompany.company/sign-in)) using Google Single Sign-On, Enterprise Single Sign-On, or email-based authentication, solely for the purpose of accessing marketing content, requesting demos, or receiving product updates. These Terms do NOT govern your use of the Company's AI-powered business operations platform (the "Application"), which is subject to a separate set of terms (the "Application Terms of Service," available at [https://www.thecompany.company/legal/application-terms](https://www.thecompany.company/legal/application-terms)). If you use the Application, including configuring or running AI agents, submitting Customer Data, or accessing any paid features, the Application Terms of Service apply in addition to these Terms. In the event of a conflict, the Application Terms of Service control with respect to your use of the Application. These Terms are a legally binding agreement between you and The Company Company Inc. ("Company," "we," "us," or "our"). By accessing or using the Website or creating an account through any sign-in method offered on the Website or Application sign-in page, you agree to be bound by these Terms. If you do not agree, please do not access the Website or create an account. ### Definitions [#definitions] * "Agreement" means these Website Terms of Use together with our Privacy Policy (available at [https://www.thecompany.company/legal/privacy](https://www.thecompany.company/legal/privacy)) and any supplemental terms we may provide. * "Account" means a user account you create through the Website or the Application sign-in page, which may provide you with access to waitlist registration, demo requests, newsletter subscriptions, product updates, and other marketing-related features. An Account does not by itself grant you access to the Application or any paid features of the Website. * "Authorization Mechanisms" means the methods available for creating an Account, including: (a) Google Single Sign-On (SSO), which uses OAuth 2.0 to authenticate via your Google account; (b) Enterprise Single Sign-On (SSO), which uses Security Assertion Markup Language (SAML) or similar protocols to authenticate via your organization's identity provider; and (c) email-based authentication, which may use passwordless links, one-time verification codes, or other email-based verification methods. * "Website Content" means the text, graphics, images, videos, blog posts, code samples, and other materials made available on or through the Website. ### Eligibility and Account Registration [#eligibility-and-account-registration] You must be at least 18 years old and have the legal authority to enter into these Terms on behalf of yourself or the entity you represent. You represent that you are not a minor under the age of 18 and that your use complies with any applicable age-gating or parental consent requirements under laws such as COPPA (as amended). We do not knowingly collect data from children under 13. By creating an account, you represent and warrant that: * All registration information you provide is truthful, current, complete, and accurate. * You are signing up for the purpose of learning about our products and Website, receiving marketing communications, or requesting a demo or trial access, and not for any competing, malicious, or fraudulent purpose. * If you create an Account through Google SSO, you represent and warrant that: (a) your Google account is valid and in good standing; (b) you have the authority to grant the permissions requested by the Website to access your Google profile information (including name, email address, and profile picture); and (c) your use of the Website through your Google account does not violate any agreement or policy governing your use of the Google account. * If you create an Account through Enterprise SSO, you represent and warrant that: (a) your organization has authorized your use of the Website through SSO; (b) you have the authority to grant the permissions requested by the Website within your organization's identity provider; and (c) your use of the Website through SSO does not violate any agreement or policy governing your use of your organization's systems. * If you create an Account through email-based authentication, you represent and warrant that: (a) the email address you provide belongs to you or has been authorized for your use; (b) you have the sole control over that email address; and (c) you will promptly notify us if the email address is compromised, no longer accessible, or if your role with respect to any associated account changes. * You are responsible for: (a) all activities conducted through your Account, whether authorized by you or not; (b) maintaining the confidentiality of your authentication credentials and any third-party accounts (Google, your organization's identity provider, or your email account) used to access the Website; and (c) promptly notifying us at [legal@thecompany.company](mailto:legal@thecompany.company) if you become aware of any unauthorized access to your Account or authentication credentials. We may, at our discretion, assign roles or access levels to your Account (for example, as a "waitlist member," "demo requester," "subscriber," or similar designation). These roles are for administrative and marketing purposes only and do not confer any rights to access the Application or its features unless and until a separate agreement is entered into. ### Use of Website [#use-of-website] #### Acceptable Use [#acceptable-use] You may use the Website only for lawful business purposes and in accordance with these Terms. You agree not to: * Violate any applicable law, regulation, or third-party right. * Transmit any malicious code, viruses, or harmful components. * Attempt to gain unauthorized access to any systems or networks connected to the Website. * Interfere with, disrupt, or create an undue burden on the Website or related infrastructure. * Use any AI features or outputs from the Website in a manner that could cause harm, including without limitation generating or disseminating misleading, discriminatory, or unlawful content; or circumventing safety guardrails in any linked AI systems. * Use the Website to develop a competing product or service. * Reverse engineer, decompile, or disassemble any aspect of the Website. * Use the Website for any fraudulent, deceptive, or illegal purpose. * Resell, sublicense, or redistribute the Website without our prior written consent. * Access or use the Website in any manner that exceeds normal human use or volumetric thresholds, including through scraping, data mining, robot harvesting, or any automated data collection method, without our prior written consent. * Impersonate or attempt to impersonate the Company, any employee of the Company, another user, or any other person or entity, including through the use of a false name, credentials, or other information. #### Service Availability [#service-availability] We will use commercially reasonable efforts to make the Website available, but we do not guarantee uninterrupted or error-free operation. The Website is provided on an "as available" basis, and we may modify, suspend, or discontinue any part of the Website at any time with or without notice. #### Regulatory Compliance [#regulatory-compliance] You are solely responsible for ensuring that your use of the Website and any decisions you make based on Website Content comply with all applicable laws, regulations, and industry standards. ### Intellectual Property [#intellectual-property] #### Ownership of Website Content [#ownership-of-website-content] All Website Content, including but not limited to text, graphics, images, videos, audio, blog posts, code samples, documentation, logos, trademarks, trade dress, and other materials, is owned by the Company or its licensors and is protected by applicable intellectual property laws. Nothing in these Terms grants you any right to use our trademarks, trade names, service marks, logos, or other branding without our prior written consent. #### Limited License to Access the Website [#limited-license-to-access-the-website] Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and view the Website and Website Content solely for your own personal or internal business purposes, for the purpose of evaluating the Company and its products and services and not for any commercial exploitation, training of competing AI models, or public dissemination of Website Content or any AI-generated outputs derived therefrom. You may not reproduce, distribute, modify, create derivative works of, publicly display, publicly perform, republish, download, transmit, or sell any Website Content, except as expressly permitted in writing by us. #### Feedback [#feedback] If you submit ideas, suggestions, comments, questions, or other feedback regarding the Website or our products and services ("Feedback"), you agree that: (a) the Feedback is non-confidential and non-proprietary; (b) you have no expectation of compensation for the Feedback; and (c) we may use, disclose, and exploit the Feedback in any manner for any purpose without obligation or compensation to you. You grant us a perpetual, irrevocable, royalty-free license to use, modify, and incorporate Feedback into our products and services, including AI models, without attribution or compensation. ### Confidentiality [#confidentiality] Each party agrees to keep confidential any non-public information disclosed by the other party that is designated as confidential or that reasonably should be understood to be confidential. This obligation does not apply to information that is publicly available, independently developed, or rightfully received from a third party without restriction. ### Account Suspension and Termination [#account-suspension-and-termination] We reserve the right, in our sole discretion, to suspend, restrict, or terminate your access to the Website (including your Account) at any time, with or without notice and without liability, for any reason or no reason, including if we believe you have violated these Terms, engaged in fraudulent or illegal activity, or used the Website in a manner that threatens the security, integrity, or availability of the Website. You may discontinue your use of the Website at any time. You may also request deletion of your Account by contacting us at [legal@thecompany.company](mailto:legal@thecompany.company). We will process such requests within a reasonable timeframe. Upon suspension or termination of your Account, your right to access the Website's account features ceases immediately. Provisions that by their nature should survive termination, including Intellectual Property, Disclaimers, Limitation of Liability, Indemnification, Governing Law, and any other provisions that expressly survive, shall survive any termination or expiration of these Terms. ### Disclaimers [#disclaimers] THE WEBSITE AND ALL WEBSITE CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. WE SPECIFICALLY DISCLAIM ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE WEBSITE WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS. NO ADVICE OR INFORMATION OBTAINED FROM US OR THROUGH THE WEBSITE CREATES ANY WARRANTY NOT EXPRESSLY STATED HEREIN. We make no representations regarding the accuracy, completeness, or reliability of any AI-generated content, summaries, or recommendations on the Website. Any reliance on such content is at your sole risk. AI outputs may contain errors, biases, or hallucinations. WEBSITE CONTENT IS PROVIDED FOR GENERAL INFORMATIONAL AND MARKETING PURPOSES ONLY AND DOES NOT CONSTITUTE PROFESSIONAL ADVICE OF ANY KIND, INCLUDING LEGAL, FINANCIAL, TAX, MEDICAL, OR COMPLIANCE ADVICE. YOU ARE SOLELY RESPONSIBLE FOR ANY DECISIONS YOU MAKE BASED ON WEBSITE CONTENT. ### Limitation of Liability [#limitation-of-liability] TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW: * IN NO EVENT SHALL WE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, BUSINESS OPPORTUNITIES, REVENUE, OR GOODWILL, REGARDLESS OF THE CAUSE OF ACTION OR THEORY OF LIABILITY, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. * OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS SHALL NOT EXCEED ONE HUNDRED DOLLARS (US $100.00). Because the Website is provided free of charge and without any payment obligation, no per-period fee-based cap applies. * THE FOREGOING LIMITATIONS APPLY REGARDLESS OF WHETHER THE DAMAGES ARE BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY. ### Indemnification [#indemnification] You agree to indemnify, defend, and hold harmless the Company, its officers, directors, employees, agents, and affiliates from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to: * Your use of the Website, including any content you submit through contact forms, feedback forms, or other user-submission features. * Your breach of these Terms. * Your violation of any applicable law or third-party right. * Your misuse or misrepresentation of your Account, including any actions taken by other individuals accessing the Website through your Account. * Any dispute between you and a third party relating to your use of the Website. ### Dispute Resolution and Arbitration [#dispute-resolution-and-arbitration] #### Binding Arbitration [#binding-arbitration] Any dispute, controversy, or claim arising out of or relating to these Terms or the Website shall be resolved by binding arbitration administered by JAMS under its Streamlined Arbitration Rules and Procedures. The arbitration shall be conducted in San Francisco, California, by a single arbitrator. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. To the extent permitted by law, you waive any right to a jury trial. #### Class Action Waiver [#class-action-waiver] YOU AND THE COMPANY AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. Nothing in this Section waives any right to seek public injunctive relief that cannot be waived under applicable law; the arbitrator may award such relief to the extent the law permits, and any request for it that cannot lawfully be arbitrated will proceed in the courts specified in the Governing Law section, without affecting the enforceability of the rest of this Section. #### Injunctive Relief [#injunctive-relief] Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement or misappropriation of intellectual property rights or breach of confidentiality obligations. #### Small Claims Exception [#small-claims-exception] Notwithstanding the foregoing, either party may bring an individual action in small claims court for disputes within the court's jurisdictional limits. #### Opt-Out [#opt-out] You may opt out of the arbitration provision by sending written notice to [legal@thecompany.company](mailto:legal@thecompany.company) within 30 days of first accepting these Terms. If you opt out, disputes will be resolved in the courts specified in the Governing Law section. ### Governing Law [#governing-law] These Terms are governed by the laws of the State of Delaware, without regard to its conflict of law provisions. For any disputes not subject to arbitration, the exclusive jurisdiction and venue shall be the state and federal courts located in San Francisco, California, and each party consents to the personal jurisdiction of such courts. ### General Provisions [#general-provisions] #### Force Majeure [#force-majeure] Neither party shall be liable for any failure or delay in performing its obligations where such failure or delay results from circumstances beyond the party's reasonable control, including but not limited to acts of God, natural disasters, pandemics, war, terrorism, labor disputes, government actions, internet or infrastructure failures, or third-party service provider outages. #### Severability [#severability] If any provision of these Terms is found to be unenforceable or invalid by a court of competent jurisdiction, that provision will be enforced to the maximum extent permissible, and the remaining provisions will remain in full force and effect. #### Entire Agreement [#entire-agreement] These Terms, together with our Privacy Policy (available at [https://www.thecompany.company/legal/privacy](https://www.thecompany.company/legal/privacy)), constitute the entire agreement between you and the Company with respect to your use of the Website and your Account, and supersede all prior or contemporaneous agreements, understandings, or representations, whether written or oral. If you enter into a separate agreement for use of the Application (such as the Application Terms of Service or a Data Processing Agreement), that agreement governs your use of the Application and shall supplement, not replace, these Terms with respect to the Website. #### Assignment [#assignment] You may not assign or transfer these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets without your consent. Any attempted transfer or assignment in violation hereof shall be null and void. #### No Waiver [#no-waiver] Our failure to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision. #### Notices [#notices] All legal notices to us must be sent to [legal@thecompany.company](mailto:legal@thecompany.company) or by mail to: The Company Company Inc. 1885 Mission St San Francisco, CA 94103 ### Changes to Terms [#changes-to-terms] We reserve the right to modify these Terms at any time. We will provide notice of material changes by posting updated Terms on the Website with a revised "Last Updated" date. Where practicable, we may also send notice of material changes to the email address associated with your Account. Your continued use of the Website after the effective date of any modifications constitutes acceptance of the updated Terms. If you do not agree to the modified Terms, you must stop using the Website. Material changes may include changes to our data practices, our dispute resolution procedures, or the scope of the license granted to you. We will provide at least 30 days' notice for material changes via email and prominent Website posting. Continued use constitutes acceptance. ### Contact Us [#contact-us] If you have any questions about these Terms, please contact us at: * Email: [legal@thecompany.company](mailto:legal@thecompany.company) * Address: 1885 Mission St, San Francisco, CA 94103 ---