Meritclaw Customer Agreement

1.1 Components. The Agreement consists of, in this order of precedence: (a) any Custom Agreement or Enterprise Addendum signed by both parties, which supersedes only the clauses it expressly names; (b) the Order (the plan, term, quantities and fees displayed and confirmed at checkout, including any promotional, founding-customer or negotiated rate that is not published on the Pricing Page); (c) these terms; (d) Schedule A (Pricing and Session Terms); (e) Schedule B (Data Processing Addendum, the "DPA"); and (f) the Meritclaw Data Retention and Destruction Policy published at https://meritclaw.com/data-retention (the "Retention Policy"), which is incorporated by reference and not restated here.

1.2 One agreement for every customer. Enterprise customers accept this same Agreement. Custom terms for enterprise customers are made by Enterprise Addendum, not by editing this document.

1.3 Custom development is a product, not a contract change. White-labelling, additional workflows, ATS or HRIS connectors and similar work are purchased as a separate SKU under a statement of work or quote (Section 10.11). They do not vary this Agreement.

1.4 Candidates. Individuals who participate in Sessions are governed by the Meritclaw Candidate Terms of Use at https://meritclaw.com/candidate-terms and the Meritclaw Privacy Policy at https://meritclaw.com/privacy. Those documents do not form part of the contract between Customer and Verificient, but Customer's obligations regarding Candidates are set out in Sections 6 and 7.

"Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where control means more than 50% ownership or the power to direct management.

"Authorized User" means an employee, contractor or agent of Customer or its Affiliates whom Customer permits to access the Customer dashboard.

"Candidate" means any individual whom Customer invites to complete a Session, including job applicants, contractors and, for Training Verification, Customer's own employees.

"Candidate Data" means personal data relating to a Candidate that is collected or generated through the Services for a given Session, including (as applicable to Customer's configuration) face captures, Session Media, identity-verification results, scores, transcripts, résumé-probe outputs and Integrity Reports.

"Customer Content" means material Customer or its Authorized Users provide to the Services, including job descriptions, company documents, assessment content, training modules, monitored links and configuration settings.

"Customer Data" means Customer Content, Candidate Data, account data and any other data processed by the Services on Customer's behalf.

"Integrity Export" means the export described in Section 12.6, consisting of the Session face capture, the integrity event list and one supporting image per event, and not the full Session recording.

"Integrity Report" means the report or equivalent integrity summary generated at the end of a Session listing detected events and indicators for Customer's review, in each case reflecting the monitoring features Customer enabled for that Session.

"Meritclaw Link" means the product that monitors Candidates who open a URL supplied by Customer (an assessment, meeting, exam or video that Customer already runs).

"Meritclaw Platform" means the product that combines hiring, Training Verification and link monitoring with tools to generate, deliver and score assessments and to probe résumés.

"Monitoring Application" means the Meritclaw desktop client a Candidate installs on their computer to participate in Desktop Monitoring. Where dual-camera capture is enabled, a phone may be used only as a supplemental camera: the Candidate scans a QR code to open a supported mobile browser and share the phone's camera as a second video stream. Verificient does not install an application on the phone and does not monitor the phone device—only the video stream the Candidate shares.

"Browser Monitoring" means in-browser monitoring of a Session using a supported web browser, without installing the Monitoring Application, when Customer has not required Desktop Monitoring for that Session.

"Desktop Monitoring" means monitoring through the Monitoring Application, including OS-level signals not available in Browser Monitoring alone.

"Active monitoring period" means the continuous interval from when Verificient marks monitoring as started for a sitting until monitoring ends (including when the Candidate ends the Session, a timeout or trial cap applies, or an Authorized User ends the Session).

"Plan" means the subscription tier selected in the Order (Starter, Growth, Scale or Enterprise) for Meritclaw Link or Meritclaw Platform.

"Pricing Page" means the current Meritclaw pricing published at https://meritclaw.com/pricing, as updated from time to time.

"Services" means Meritclaw Link, Meritclaw Platform, the Monitoring Application, the Customer dashboard, APIs, documentation and related support that Verificient makes available under this Agreement.

"Session" means one monitored assessment or one monitored interview taken by one Candidate under Customer's monitoring configuration for that link, assessment or job (Browser Monitoring and/or Desktop Monitoring; optional identity verification and Session recording). Section 3.3 sets out when a Session is counted against the Session Allowance.

"Session Allowance" means the number of Sessions included in a Plan for a Subscription Year, as stated in the Order and Schedule A.

"Session Media" means video, audio and screen recordings from the monitored Session and, when dual-camera capture is enabled, supplemental second-camera video from a phone stream, generated when Customer has enabled Session recording; Session Media may be absent when recording is disabled.

"Subscription Term" means the initial term selected in the Order (one month or twelve months) and each renewal term. "Subscription Year" means each twelve-month period of an annual Plan, or the rolling twelve months from the start date of a monthly Plan.

"Training Verification" means use of the Services to verify identity and monitor an employee or contractor while they complete a training module, examination or certification.

3.1 Products. Customer may subscribe to Meritclaw Link, Meritclaw Platform, or both. Each is a subscription, billed monthly or annually. Features of each product are described on the Pricing Page and in the documentation.

3.2 Included on every Plan. Unless Schedule A states otherwise, every Plan includes without cap or additional charge: monitored links; jobs and training modules; AI assessment generation from a job description or company material; résumé probing and candidate scoring (Platform only); and access to Browser Monitoring, Desktop Monitoring, dual-camera monitoring, identity verification, Session recording with review, and Integrity Reports. Customer chooses, per link, assessment or job, which of those monitoring features apply to each Session. Disabling a feature may reduce the evidence available for that Session; Customer is responsible for its configuration (Section 6.1).

3.3 Sessions are the only metered unit. A Session is counted against the Session Allowance when the Active monitoring period for that Session has run for more than five minutes. A Session that the Candidate abandons within the first five minutes of the Active monitoring period is not counted. If Customer enabled identity verification (face scan) for that Session, the Candidate must complete identity verification before the Session counts; if identity verification is disabled for that Session, completion of identity verification is not required for counting. Session Allowance metering does not require Session Media or face captures when Customer has disabled Session recording or identity verification for that Session. The following are never counted or charged: invitations that are not taken up; applicants who interact only with the résumé-probing agent; assessment generation; and link creation.

3.4 Monitoring requirements. Customer configures each Session for Browser Monitoring, Desktop Monitoring, or both as offered in the dashboard. When Customer requires Desktop Monitoring, the Candidate must install the Monitoring Application on their computer and meet the published device, camera and network requirements for that mode. When Customer allows Browser Monitoring only, the Candidate must use a supported browser on their computer and meet the published requirements for browser monitoring. Monitoring (including OS-level signals, where applicable) applies to the Session on the Candidate's computer or browser, not to the phone. When Customer enables dual-camera capture for a Session, the Candidate may use a phone only as a supplemental second camera: the Candidate scans a QR code to open a supported mobile browser and share the phone's camera as an additional video stream. No Meritclaw application is installed on the phone, and the phone is not subject to Browser Monitoring or Desktop Monitoring—whether the Session uses Browser Monitoring, Desktop Monitoring, or both. Customer is responsible for communicating the applicable requirements to Candidates. Verificient does not warrant that any particular Candidate device, browser or network will support a Session.

3.5 AI-assisted features. Assessment generation, résumé probing, scoring and integrity detection use machine learning and other automated techniques. Their outputs are aids to human judgement and may contain errors. Section 8 governs how they may be relied upon.

3.6 Deployment and third-party platforms. Customer may use the Services standalone or in conjunction with third-party platforms (for example, video-conferencing tools, applicant tracking systems and learning management systems). Those platforms are governed by their own terms. Verificient is not responsible for their availability, conduct or data practices, and Customer authorises Verificient to exchange Customer Data with any platform Customer connects.

3.7 Changes to the Services. Verificient may modify the Services, provided that changes made during a paid Subscription Term do not materially reduce the core functionality of the Plan purchased. Verificient may discontinue a feature on at least 30 days' notice, or without notice where required for security or legal reasons.

3.8 Support and availability. Verificient provides email support during its published business hours and uses commercially reasonable efforts to keep the Services available, subject to scheduled and emergency maintenance. No service-level commitment, uptime credit or support response time applies unless set out in an Enterprise Addendum.

4.1 Business use. The Services are offered to organizations for their own hiring, assessment, interview and training purposes. They are not offered to consumers.

4.2 Account information. Customer must provide accurate, current and complete account and billing information and keep it updated. Customer designates an account owner whose email address must remain active to receive plan, billing and legal notices.

4.3 Credentials and responsibility. Customer is responsible for all activity under its account and by its Authorized Users and Affiliates, for keeping credentials confidential, and for notifying Verificient promptly of any unauthorised access.

4.4 Affiliates and agencies. Customer's Affiliates may use the Services under Customer's account. A staffing agency, recruiter or consultancy may use the Services on behalf of its clients, provided that Customer remains fully responsible for compliance with Sections 6, 7 and 9 in respect of those clients and their Candidates. Reselling, embedding via API, or providing the Services to third parties as a service requires an Enterprise Addendum.

5.1 Scope. New customers may evaluate the Services for a free trial of seven days, limited to three Sessions, with each trial Session automatically ending after the first ten minutes of the Active monitoring period (monitoring ceases at that point; any Session recording Customer enabled also stops). Whether a trial Session counts toward the three-Session cap follows Section 3.3 (including the five-minute Active monitoring period). A valid payment card is required to start the trial; the card is not charged during the trial.

5.2 Automatic conversion. At the end of the trial period, unless Customer has cancelled the trial or upgraded under Section 5.3, the trial converts automatically to the Plan, billing period and product (Meritclaw Link or Meritclaw Platform) selected at signup, and Verificient charges the card on file the Fee for that Plan shown at signup (the "Conversion Fee"). The Subscription Term begins on the conversion date, and the Session Allowance, overage, renewal, cancellation and all other terms of the selected paid Plan then apply. Customer will be shown the Conversion Fee, the conversion date and how to cancel, clearly and separately, before the card is captured at signup, and Verificient will send a reminder email to the account owner at least three days before the conversion date.

5.3 Upgrading during the trial. Customer may at any time during the trial select any Plan and billing period through the dashboard. Upgrading ends the trial immediately: the card on file is charged the Fee for the selected Plan, the Subscription Term begins on that date, and the trial limits in Section 5.1 no longer apply.

5.4 Cancelling the trial. Customer may cancel the trial at any time before the conversion date through the dashboard, without charge. Cancellation stops the conversion; access ends when the trial period ends. Cancellation after the conversion date is a cancellation of the selected Plan under Section 11.2, and the Conversion Fee is not refundable.

5.5 Trial data. Data created during a trial is retained and destroyed on the same schedule as any other Customer Data under the Retention Policy; a trial that ends without conversion or upgrade does not extend any period.

5.6 Conditions. The trial is provided "as is", without warranty or support commitment, may be modified or withdrawn at any time, and is limited to one trial per organization. Verificient may apply technical anti-abuse controls.

6.1 Customer makes the decisions. Customer is the employer, hiring organization or training provider. Customer decides whom to invite, what to assess, how to configure monitoring, how to interpret Integrity Reports and scores, and what action to take. Verificient provides tools and evidence; it does not make, and is not a party to, any hiring, employment, certification or disciplinary decision.

6.2 Notices, consents and lawful basis. Customer is responsible for determining that its use of the Services is lawful in every jurisdiction where it invites Candidates, and in particular for:

(a) Biometric collection. When Customer enables identity verification (face scan) for a Session, Customer warrants that it has a lawful basis for collecting biometric identifiers and biometric information (including face geometry and face captures) from each Candidate invited to that Session. Verificient delivers an enrollment notice and captures consent from each Candidate on Customer's behalf and retains the consent record as evidence. Customer warrants that this notice and consent mechanism, as configured, satisfies Customer's written-notice and written-release obligations (including under the Illinois Biometric Information Privacy Act and equivalent laws). The obligation remains Customer's.

(b) AI in hiring. Customer is responsible for any notice, disclosure, consent, bias-audit, impact-assessment or opt-out obligation that applies to its use of automated or AI-assisted tools in employment decisions (including, where applicable, Illinois Public Act 103-0804 (HB 3773) and the Illinois Artificial Intelligence Video Interview Act, New York City Local Law 144, the Colorado Artificial Intelligence Act and similar laws). Verificient includes a standard AI-use sentence in the enrollment notice; the duty is Customer's.

(c) Electronic monitoring. Customer is responsible for issuing any electronic-monitoring notice required by the laws of the states or countries where its Candidates or employees are located, and for any consultation with a union, works council or employee representative body.

(d) Candidates outside the United States. Customer warrants that inviting Candidates located outside the United States, and any retention period Customer configures for them, is lawful for those Candidates. Verificient hosts and processes data in the United States (DPA, Section B.8).

6.3 Accommodation and alternative path. Customer warrants that it maintains an alternative way to complete any assessment, interview or training for Candidates who cannot complete facial verification because of a disability, or who object on sincerely held religious grounds, and that Customer handles such requests directly. The Services do not provide an in-Session bypass of identity verification.

6.4 Training Verification. Biometric verification is disabled by default for training. Customer may enable it for a programme only after confirming that the programme results in a credential, attestation or certification; enabling it is Customer's representation that this is so. Where the law of a Candidate's location restricts conditioning employment on biometric consent (Colorado is an example), Customer warrants that it treats verification as voluntary and does not penalise refusal. Where Customer invites hiring Candidates located in Colorado and requires biometric verification, Customer represents that it has determined that this use falls within a purpose for which Colorado law permits an employer to require biometric consent.

6.5 Meritclaw is not a system of record. Customer is responsible for its own employment, EEO and affirmative-action recordkeeping obligations (for example, 29 C.F.R. §§ 1602.14 and 1627.3 and OFCCP rules). Verificient deletes Customer Data on the schedule in the Retention Policy regardless of those obligations. Customer must export what it needs (Section 12.6) before expiry.

6.6 Candidate rights requests. Customer is the point of contact for Candidates exercising access, deletion, correction or similar rights. Verificient does not act on requests received directly from Candidates other than to refer them to Customer (or, where law requires, to handle them itself and notify Customer), and makes no turnaround commitment to Candidates. Where an Illinois applicant asks Customer to destroy an interview recording captured through the Services, Customer must instruct deletion in the dashboard promptly, so that Verificient can destroy the recording and all copies within 30 days of the applicant's request as the Retention Policy provides.

6.7 Consent withdrawal. A Candidate may withdraw biometric consent at any time through the link Verificient provides at enrollment and in its emails to the Candidate. Verificient honours the withdrawal, captures no new face image without asking consent again, and notifies Customer. Withdrawal is not retroactive as to completed Sessions except as the Retention Policy provides. Customer determines any consequence for the Candidate.

6.8 Lawful and non-discriminatory use. Customer will use the Services only for lawful purposes; will not use them to screen for roles that are unlawful; will not use them to elicit information about protected characteristics; and will comply with employment, anti-discrimination, privacy and consumer-reporting laws applicable to it.

7.1 Verificient's relationship with Candidates is limited to providing the enrollment flow and the monitoring experience configured for each Session (Browser Monitoring and/or the Monitoring Application) under the Candidate Terms of Use and Privacy Policy. Verificient is not a party to any employment, contractor, training or certification relationship and gives Candidates no service level, availability promise or remedy.

7.2 A Candidate who disputes an Integrity Report, a score or an outcome must raise it with Customer. Verificient will not adjudicate disputes between Customer and Candidates but will, at Customer's request, provide the Session evidence retained at that time.

7.3 Customer will not use the Services to monitor any individual outside a Session that the individual has enrolled in, or for covert surveillance. Monitoring runs only while a Session is active and the Candidate has been notified.

7.4 Customer warrants that it will not invite any individual under 16 years of age to a Session, and will notify Verificient promptly if it learns that it has. Verificient does not collect dates of birth and cannot verify age; each Candidate is asked to confirm at enrollment that they are at least 16. If Verificient learns that information has been collected from someone under 16, it destroys that information and notifies Customer, regardless of any retention setting.

8.1 Evidence, not determination. Integrity Reports, event flags, identity-verification results, JD-fit, authenticity, assessment and integrity scores, and any other output of the Services are indicators for human review. They are not determinations that a Candidate has committed fraud or misconduct, is or is not who they claim to be, or is or is not qualified.

8.2 No guarantee of detection. Cheating tools, deepfake software and impersonation techniques evolve continuously. Verificient does not warrant that the Services will detect every instance of misconduct, or that every flag indicates misconduct. False positives and false negatives are possible.

8.3 Human review. Customer will ensure that a qualified person reviews the relevant evidence before taking any adverse action against a Candidate based on an output of the Services, and Customer is solely responsible for any explanation, appeal or reconsideration process it offers.

8.4 Not legal advice; no compliance assurance. Nothing in the Services, the documentation, enrollment notices, consent flows or any communication from Verificient is legal advice or a representation that Customer's use of the Services complies with any law. Customer is responsible for obtaining its own legal advice.

8.5 Live dashboard actions. Actions taken by Authorized Users during a live Session (for example, ending a Session or closing an application on a Candidate's device) are Customer's actions.

9.1 Customer will not, and will not permit anyone to: (a) copy, modify, reverse-engineer, decompile or attempt to derive the source code, detection logic or threat signatures of the Services or the Monitoring Application; (b) use the Services to develop, test or evaluate tools designed to evade monitoring, or to build a competing product; (c) resell, sublicense, time-share or embed the Services without an Enterprise Addendum; (d) circumvent usage limits, Session counting, security controls or anti-abuse measures; (e) upload Customer Content that infringes third-party rights, is unlawful, or contains malicious code; (f) use the Services in violation of export-control or sanctions laws; (g) use the Services for covert surveillance, or for any purpose other than the hiring, assessment, interview and training purposes for which they are designed; or (h) probe, scan or test the vulnerability of the Services without written permission.

9.2 Suspension. Verificient may suspend access, in whole or in part and with such notice as is practicable, if (a) Customer breaches this Section 9 or Section 6, (b) Customer's use threatens the security, integrity or availability of the Services or other customers, (c) Customer's account information is materially inaccurate, (d) Customer's Fees are overdue beyond the grace period in Section 10.9, or (e) suspension is required by law. Verificient will restore access promptly once the cause is resolved. Fees continue to accrue during a suspension caused by Customer.

10.1 Fees. Customer will pay the fees stated in the Order ("Fees"). The Fees displayed at checkout are the contractual price for the Subscription Term and may reflect a promotional, founding-customer, partner or negotiated rate that is not published on the Pricing Page. Schedule A summarises the standard published Plans as of the version date of this Agreement; where Schedule A and the Pricing Page differ, the Pricing Page governs new Orders and the Order governs existing ones.

10.2 Payment method. A valid payment card on file is required for every Plan. Customer authorises Verificient (and its payment processor) to charge that card for all Fees as they fall due, including the first Plan Fee, recurring Plan Fees, upgrade charges and overage. The first Plan Fee must be paid by card before the Services are activated for the Subscription Term. Payment by ACH, bank transfer or invoice is available only under an Enterprise Addendum.

10.3 Billing cycles. Monthly Plans are charged monthly in advance on the anniversary of the Order date. Annual Plans are charged annually in advance. Overage is charged in arrears as described in Section 10.5.

10.4 Session Allowance. Each Plan includes a Session Allowance per Subscription Year. Unused Sessions do not roll over, are not refundable and expire at the end of the Subscription Year (annual Plans). On a monthly Plan, one-twelfth of the annual Session Allowance is available in each monthly billing period and any unused portion expires at the end of that period. Sessions consumed count in the order taken.

10.5 Overage. When Customer has used its Session Allowance, Sessions continue without interruption and each additional Session is charged at the overage rate for Customer's Plan as published on the Pricing Page (current rates in Schedule A). Overage is calculated automatically and charged to the payment card on file. Overage charges are batched and collected when the accrued overage balance reaches a threshold (currently US$100); any remaining balance below that threshold is charged at the end of the billing period or on renewal. There is no ceiling on overage: Customer may continue to consume Sessions at the overage rate for as long as the Plan remains active, and Customer may upgrade at any time under Section 10.6 if a higher Plan would be more economical. Verificient sends courtesy notifications as the allowance runs down; failure to send or receive a notification does not waive overage Fees.

10.6 Upgrades. Customer may upgrade at any time (to a higher Plan, from monthly to annual billing, or to add seats where seats are sold). Upgrades take effect immediately. Verificient credits the unused portion of the current Plan pro rata against the new Plan for the remainder of the Subscription Term and charges the difference.

10.7 Downgrades and other changes. A downgrade to a lower Plan takes effect at the next renewal date. The following are not permitted during a Subscription Term: changing an annual Plan to monthly billing; reducing seats on an annual Plan; reducing seats on a monthly Plan mid-cycle; and any change that would require Verificient to issue a refund.

10.8 Renewal and price changes. Each Subscription Term renews automatically for a further term of the same length unless Customer cancels through the dashboard before the renewal date (Section 11.2) or Verificient gives notice of non-renewal at least 30 days before the renewal date. Each renewal is at the published price for Customer's Plan in effect on the renewal date. If that price is higher than the Fees in Customer's current Order, Verificient will notify the account owner at least 30 days before the renewal date, and Customer may cancel before the renewal date if it does not accept the new price. Promotional or founding-customer rates apply only for the Subscription Term stated in the Order unless the Order says otherwise. Verificient does not change the Fees for a Plan during a paid Subscription Term.

10.9 Failed payment and late payment. If a charge fails, Verificient will retry and notify the account owner. If Fees remain unpaid 10 days after notice, Verificient may suspend the Services until paid. Overdue amounts may bear interest at 1.5% per month or the maximum rate permitted by law, whichever is lower, and Customer will reimburse reasonable collection costs. Customer must raise any good-faith billing dispute in writing within 15 days of the charge; undisputed amounts remain payable.

10.10 Taxes and transaction charges. Fees exclude sales, use, value-added, goods-and-services, withholding and similar taxes. Customer is responsible for all such taxes other than taxes on Verificient's net income. If Customer must withhold tax, it will gross up the payment so Verificient receives the full Fee. Verificient invoices from its United States entity and, at launch, does not calculate or collect local taxes at checkout; where Verificient later becomes obliged to collect a tax on Customer's Fees, it may add that tax to subsequent charges. Card-processing fees are borne by Verificient; bank, wire and currency-conversion charges are borne by Customer.

10.11 Custom development. Customer may purchase custom work (for example, white-labelling, an additional workflow, or an ATS/HRIS connector) as a separate SKU under a statement of work or quote. Standard customisation packages are priced on the Pricing Page (currently a US$2,500 fixed package for simple customisation); work beyond that scope is quoted separately. Custom work is invoiced separately, is not part of the Plan Fees, and is delivered under this Agreement. Unless the statement of work says otherwise, Verificient owns the resulting work and licenses it to Customer for the Subscription Term.

10.12 No refunds. Except where this Agreement expressly provides for a credit or refund, all Fees are non-cancellable and non-refundable.

11.1 Term. The Agreement starts when Customer accepts it and continues until every Subscription Term has ended or the Agreement is terminated under this Section.

11.2 Cancellation by Customer. Cancellation of a free trial before conversion is governed by Section 5.4. Customer may cancel a Plan at any time through the dashboard. Cancellation takes effect at the end of the current paid Subscription Term, not on the date notice is given. An annual Plan remains active, and Customer remains liable for its Fees, until the end of the annual term; no pro-rata refund is given. A monthly Plan remains active until the end of the current billing month. Overage accrued before cancellation takes effect is still invoiced.

11.3 Termination for cause. Either party may terminate the Agreement if the other party materially breaches it and does not cure the breach within 15 days after written notice. Verificient may terminate immediately on notice if Customer breaches Section 6 or 9 in a way that exposes Verificient or Candidates to legal risk, or if Customer becomes insolvent. Either party may terminate immediately if the other becomes subject to bankruptcy or insolvency proceedings.

11.4 Effect of ending. When the Agreement or a Plan ends: (a) Customer's access to the Services ends at the end of the paid Subscription Term (or immediately on termination for cause); (b) Customer Data expires on its normal schedule under the Retention Policy — there is no accelerated purge and no extension — and Customer should complete any Integrity Export or download before access ends; (c) accrued Fees, including overage, become payable; (d) on written request made after the last Customer Data has expired, Verificient will provide a certificate of destruction; and (e) Sections 2, 6, 8, 10 (as to amounts owed), 11.4, 12, 13, 14, 15.4, 16, 17 and 19 and the DPA survive.

11.5 No post-term access. No read-only or archival access is provided after a Plan ends. Customer should download or export any Integrity Reports and Integrity Exports it wishes to keep before its access ends.

12.1 Ownership. As between the parties, Customer owns Customer Data. Customer grants Verificient a non-exclusive licence to host, process, transmit and display Customer Data solely to provide, secure, support and improve the Services and as instructed by Customer.

12.2 Roles. Customer is the controller (or business) and Verificient is the processor (or service provider) of Candidate Data. The DPA in Schedule B applies to all personal data in Customer Data and forms part of this Agreement. Verificient processes Candidate Data only on Customer's documented instructions and does not use Candidate Data for its own purposes.

12.3 No training on Customer Data. Verificient will not use Customer Data or Candidate Data to train, fine-tune or improve any generative or foundation model. Verificient may use de-identified technical signatures of tools and techniques detected during Sessions (application and process names and evasion patterns, containing no Session Media, face captures, transcripts, assessment responses or any data identifying a Candidate or Customer) and anonymized session statistics to maintain its threat-detection capability, as described in the Retention Policy and Privacy Policy.

12.4 Retention. Customer Data is retained and deleted in accordance with the Retention Policy. In summary, as at the version date of this Agreement: face captures, Session Media, Candidate profiles, scores, transcripts and match results are retained for 30 days by default; the pseudonymous integrity event log for 12 months; and consent records for 3 years. Customer may extend the retention of Session Media and related records to a maximum of 12 months using the presets offered in the dashboard; face captures are retained for no more than 3 months regardless of any other setting.

12.5 Extension is Customer's decision. Any retention period Customer selects beyond the defaults is Customer's decision as controller. Customer warrants that the extended period is lawful for every Candidate it invites, including Candidates outside the United States, and extended retention is at Customer's risk. Retention changes apply prospectively only; data already stored keeps its original expiry. Verificient is not obliged to retain any Customer Data beyond the configured period. Customer's remedy if it needs data for longer is export, not extension.

12.6 Integrity Export. Customer may configure automatic delivery of an Integrity Export for each Session, either to an endpoint Customer specifies or as a dashboard download, seven days before the Session Media expires. Once delivered, the export is Customer's data, held under Customer's own policies, and Verificient does not retain a copy. If delivery to Customer's endpoint fails after Verificient's standard retries, Verificient will make the export available in download mode and notify Customer; the endpoint failure is not a breach by Verificient.

12.7 Deletion by Customer. Customer may delete any Candidate's data from the dashboard at any time. Deletion executes immediately without Verificient involvement; Verificient's obligation is that the deletion is carried out across its systems in accordance with the Retention Policy.

12.8 Legal hold. On written request, Verificient will place a legal hold on specified Customer Data. A hold must be scoped to identified Candidates or Sessions and carry a review date; open-ended holds are not accepted, and Verificient reviews active holds at least quarterly. Biometric data is excluded from a hold unless the request specifically names it and Customer confirms the lawful basis for continued retention. When a hold is released, the affected records are destroyed within 30 days.

12.9 Security. Verificient maintains an information-security programme with administrative, technical and physical safeguards appropriate to the sensitivity of Candidate Data, including encryption in transit and at rest, access controls, logging and incident response, as described in the DPA. Verificient will notify Customer of a security incident affecting Customer Data as set out in the DPA.

12.10 Aggregated data. Verificient may create and use aggregated or de-identified statistics derived from use of the Services (for example, Session volumes and detection rates) that do not identify Customer or any Candidate.

13.1 "Confidential Information" means non-public information disclosed by one party to the other in connection with this Agreement that is marked confidential or would reasonably be understood to be confidential, including Customer Data, Integrity Reports, pricing and the non-public features of the Services. It excludes information that is or becomes public through no fault of the recipient, was already known to the recipient, is independently developed, or is rightfully received from a third party without restriction.

13.2 Each party will use the other's Confidential Information only to perform this Agreement, will protect it with at least reasonable care, and will disclose it only to personnel, Affiliates and contractors who need to know it and are bound by obligations at least as protective. A party may disclose Confidential Information where required by law or court order, after giving the other party reasonable notice where lawful. These obligations continue for three years after the Agreement ends, and indefinitely for Candidate Data and trade secrets.

14.1 Verificient and its licensors own all rights in the Services, the Monitoring Application, detection models and signatures, documentation, and all improvements. No rights are granted except the limited right to access and use the Services during the Subscription Term in accordance with this Agreement.

14.2 Customer owns Customer Content. Assessments generated by the Services from Customer Content may be used by Customer for its internal hiring and training purposes for the Subscription Term and thereafter as retained in Customer's own systems; the underlying generation technology remains Verificient's.

14.3 Customer grants Verificient a perpetual, irrevocable licence to use any feedback or suggestions about the Services without obligation to Customer.

14.4 Customer will not remove or obscure proprietary notices, and will not use Verificient's or Meritclaw's trademarks except as permitted in writing or as part of a white-label customisation purchased under Section 10.11.

15.1 Mutual. Each party warrants that it has the authority to enter into this Agreement and will comply with laws applicable to its performance.

15.2 Verificient. Verificient warrants that during a paid Subscription Term the Services will perform materially in accordance with the documentation and will not contain malicious code introduced by Verificient. Customer's sole remedy for breach of this warranty is for Verificient to use reasonable efforts to correct the non-conformity and, if Verificient cannot do so within 30 days of notice, to refund the Fees paid for the affected Services for the period of non-conformity and terminate the affected Plan.

15.3 Customer. Customer warrants that it has obtained all rights, consents and notices required to provide Customer Content and Candidate Data to Verificient and to invite Candidates to Sessions, and that its use of the Services complies with Sections 6, 7 and 9.

15.4 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS SECTION 15, THE SERVICES ARE PROVIDED "AS IS" AND VERIFICIENT DISCLAIMS ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY AND UNINTERRUPTED OR ERROR-FREE OPERATION. WITHOUT LIMITING THE FOREGOING, VERIFICIENT DOES NOT WARRANT THAT THE SERVICES WILL DETECT ALL MISCONDUCT, IMPERSONATION, DEEPFAKES OR UNAUTHORISED TOOLS; THAT ANY SCORE, FLAG OR REPORT IS ACCURATE OR COMPLETE; THAT ANY CANDIDATE DEVICE OR NETWORK WILL SUPPORT A SESSION; THAT THIRD-PARTY PLATFORMS WILL BE AVAILABLE; OR THAT CUSTOMER'S USE OF THE SERVICES COMPLIES WITH ANY LAW. FREE TRIALS AND BETA FEATURES ARE PROVIDED WITHOUT ANY WARRANTY.

16.1 By Verificient. Verificient will defend Customer against any third-party claim that the Services, as provided by Verificient and used in accordance with this Agreement, infringe a United States patent, copyright or trademark or misappropriate a trade secret, and will pay damages and costs finally awarded or agreed in settlement. Verificient may, at its option, modify or replace the Services to be non-infringing, procure the right for Customer to continue using them, or terminate the affected Plan and refund prepaid Fees for the remainder of the Subscription Term. Verificient has no obligation for claims arising from Customer Content, combination with items not supplied by Verificient, or use in breach of this Agreement.

16.2 By Customer. Customer will defend Verificient and its Affiliates, officers, directors and employees against any third-party claim (including a claim by a Candidate, employee, regulator or class) arising from: (a) Customer's failure to provide any notice or obtain any consent or release required under Section 6 or applicable law, including biometric-privacy, AI-in-hiring, electronic-monitoring and data-protection laws; (b) any hiring, employment, certification, training or disciplinary decision made by Customer; (c) any retention period configured by Customer beyond the defaults, or any legal hold requested by Customer; (d) Customer Content; (e) Customer's use of the Services in breach of Section 6, 7 or 9; or (f) the acts of Customer's Affiliates, Authorized Users or clients — and will pay damages, penalties and costs finally awarded or agreed in settlement.

16.3 Procedure. The indemnified party will give prompt notice of the claim, allow the indemnifying party to control the defence and settlement (provided no settlement admits fault on behalf of, or imposes obligations on, the indemnified party without its consent, not to be unreasonably withheld), and cooperate at the indemnifying party's expense. This Section 16 states each party's sole liability and exclusive remedy for third-party claims covered by it.

17.1 Exclusion. TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE UNDER THIS AGREEMENT FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL OR DATA, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY.

17.2 Cap. EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO VERIFICIENT IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM (OR, FOR A FREE TRIAL, US$100).

17.3 Specific exclusions. Verificient is not liable for any loss arising from (a) fraud, misrepresentation or misconduct by a Candidate that the Services did not detect or flagged incorrectly; (b) any decision Customer makes in reliance on an output of the Services; (c) unavailability of a Candidate device, network or third-party platform; or (d) deletion of Customer Data in accordance with the Retention Policy or Customer's instructions.

17.4 Exceptions. Sections 17.1 and 17.2 do not limit (a) Customer's obligation to pay Fees; (b) either party's indemnification obligations under Section 16; (c) liability for breach of Section 13, except that claims relating to Candidate Data remain subject to the cap in Section 17.2; (d) Customer's liability for breach of Section 6 or 9; or (e) liability that cannot be limited by law, including for gross negligence, wilful misconduct or fraud.

18.1 Verificient may update this Agreement, the Schedules and the Retention Policy. Verificient will post the updated version with a new version date and, for material changes, notify the account owner by email at least 30 days before the change takes effect.

18.2 Material changes take effect for Customer at the start of Customer's next Subscription Term, unless earlier effect is required by law or to address a security or legal risk, in which case Verificient will explain the reason in its notice. If Customer does not accept a material change, its remedy is to cancel before the change takes effect (Section 11.2). Continued use after the effective date is acceptance.

19.1 Governing law and venue. This Agreement is governed by the laws of the State of Delaware, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods. The state and federal courts located in the State of Delaware have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and each party submits to that jurisdiction. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or Confidential Information.

19.2 No class actions. To the extent permitted by law, each party will bring claims only in its individual capacity and not as a plaintiff or class member in any class, consolidated or representative proceeding.

19.3 Assignment. Customer may not assign this Agreement without Verificient's written consent, except to a successor in a merger, acquisition or sale of substantially all assets that assumes this Agreement in writing and is not a competitor of Verificient. Verificient may assign this Agreement to an Affiliate or successor. Verificient may use subcontractors and sub-processors as set out in the DPA and remains responsible for them.

19.4 Publicity. Verificient may identify Customer by name and logo as a customer in customer lists and marketing materials unless Customer opts out by email to legal@verificient.com. Any case study or quotation requires Customer's prior approval.

19.5 Export and sanctions. Each party will comply with applicable export-control and sanctions laws. Customer represents that it and its Authorized Users are not located in, or owned or controlled by a person in, a country or on a list subject to comprehensive U.S. sanctions.

19.6 Government customers. If Customer is a U.S. government entity, the Services are "commercial computer software" and "commercial computer software documentation" and are provided with only the rights set out in this Agreement.

19.7 Force majeure. Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disaster, epidemic, war, terrorism, labour action, internet or utility failure, or governmental action. If a force majeure event continues for more than 60 days, either party may terminate the affected Plan on notice, and Verificient will refund prepaid Fees for the unperformed period.

19.8 Notices. Notices to Customer are sent to the account owner's email address and are effective when sent. Notices to Verificient must be sent by email to legal@verificient.com with a copy by post to the address in the preamble, and are effective on receipt.

19.9 Relationship; third parties. The parties are independent contractors. No Candidate, Authorized User or other third party has rights under this Agreement.

19.10 Entire agreement; waiver; severability. This Agreement (with the documents listed in Section 1.1) is the entire agreement about its subject matter and supersedes all prior proposals and understandings. Terms in a Customer purchase order or vendor portal have no effect. No waiver is effective unless in writing. If a provision is unenforceable it will be modified to the minimum extent necessary and the remainder will continue in effect.

19.11 Electronic acceptance. This Agreement may be accepted electronically at checkout and any signature or acceptance recorded by Verificient's systems is as valid as a handwritten signature. A Custom Agreement or Enterprise Addendum must be signed by both parties.

19.12 Interpretation. Headings are for convenience; "including" means "including without limitation"; and references to law include amendments and successors.

Contact. Verificient Technologies, Inc., 300 Witherspoon Street, Suite 201, Princeton, New Jersey 08542 · legal@verificient.com · support@verificient.com

This Schedule summarises the standard published Plans as at the version date of this Agreement. The Pricing Page governs new Orders and the Order governs an existing subscription (Section 10.1). Prices are in US dollars, excluding taxes (Section 10.10), and annual Plans are billed once per year at a 15% discount to the monthly-equivalent price shown.

A.1 Meritclaw Link

A.2 Meritclaw Platform

A.3 What a Session is

A Session is one monitored assessment or one monitored interview under Customer's monitoring configuration for that sitting (Browser Monitoring and/or Desktop Monitoring). Sessions are counted as described in Section 3.3 (Active monitoring period of more than five minutes; identity verification when enabled). Résumé probing, assessment generation, job and training-module creation, and monitored-link creation are unlimited and never counted. Example: if 1,000 candidates interact only with the résumé-probing agent for a role, 80 are invited to a monitored assessment and 80 complete more than five minutes of Active monitoring, that is 80 Sessions.

A.4 Included on every Plan

Unlimited monitored links · unlimited jobs and training modules · unlimited AI assessment generation · unlimited résumé probing and candidate scoring (Platform) · access to Browser Monitoring, Desktop Monitoring, dual-camera monitoring, identity verification, Session recording with review, and Integrity Reports — each applied per Session only when Customer enables it in the dashboard.

A.5 Overage

Sessions beyond the Session Allowance continue automatically at the overage rate above. Overage charges are batched and collected when the accrued balance reaches a threshold (currently US$100); any remaining balance is charged at the end of the billing period or on renewal. Customers receive notifications as the allowance runs down (Section 10.5).

A.6 Free trial, discounts, custom work and Enterprise

Free trial: 7 days, up to 3 counted Sessions (Section 3.3), each trial sitting capped at 10 minutes of Active monitoring; card required at signup; converts automatically to the Plan, billing period and product selected at signup at the end of the trial unless cancelled or upgraded (Section 5).

Discounts: Founding-customer, partner and other promotional rates are offered case by case and appear in the Order; they are not published prices and do not carry over to renewal unless the Order says so.

Custom development: a fixed US$2,500 package covers simple customisation (for example, white-labelling or one additional workflow). ATS/HRIS connectors and other work are quoted separately (Section 10.11).

Enterprise: negotiated per-Session pricing, API access and embedding, white-label, SSO, service levels and a dedicated account team are available under an Enterprise Addendum.

This DPA forms part of the Agreement and applies to Verificient's processing of personal data in Customer Data. Capitalised terms not defined here have the meaning in the Agreement. Where the Agreement and this DPA conflict on the processing of personal data, this DPA controls. The Retention Policy and the Privacy Policy are incorporated by reference and are not restated.

B.1 Roles

Customer is the controller (and, under U.S. state privacy laws, the business) of Candidate Data. Verificient is the processor (service provider). Verificient processes Candidate Data only on Customer's documented instructions, which are: this Agreement, the configuration settings Customer selects in the dashboard, and any further written instructions Customer gives that are consistent with the Services. Verificient will inform Customer if, in its opinion, an instruction infringes applicable data-protection law.

B.2 Details of processing

B.3 Verificient's obligations

Verificient will: (a) process Candidate Data only as instructed and not for its own purposes; (b) not sell, share for cross-context advertising, rent, lease, trade or otherwise profit from Candidate Data, and not use it to train generative or foundation models; (c) ensure personnel with access are bound by confidentiality; (d) implement the security measures in B.6; (e) assist Customer, taking into account the nature of the processing, in responding to data-subject requests and in meeting its security, breach-notification, impact-assessment and consultation obligations; (f) delete or return Candidate Data as set out in B.9; and (g) make available information reasonably necessary to demonstrate compliance and allow audits as set out in B.7.

B.4 Biometric data

(a) Verificient captures a live facial image (a Baseline Reference) at each verification checkpoint and compares frames sampled during the Session to it in memory; sampled frames and any representation of face geometry derived from them are not stored, and only the outcome (score, verdict, timestamp) is recorded. Face captures are retained for no longer than the period stated in the Retention Policy (currently 30 days by default and never more than 3 months). (b) Verificient maintains and publishes a retention schedule and destruction guidelines for biometric data in the Retention Policy. (c) Verificient delivers the enrollment notice and captures consent on Customer's behalf and retains the consent record for the period in the Retention Policy as evidence for Customer; Customer remains responsible under Section 6.2 for the sufficiency of the notice and release. (d) Verificient will not disclose biometric data except to Customer, to sub-processors under B.5 for the purpose of providing the Services, or as required by law. (e) Consent withdrawal is honoured as described in Section 6.7.

B.5 Sub-processors

Customer authorises Verificient to engage the sub-processors listed at https://meritclaw.com/subprocessors (cloud hosting and infrastructure providers for Candidate Data; Stripe for Customer payment data only). Verificient will notify the account owner, and update the published list, before any new sub-processor begins processing Candidate Data. Customer's remedy if it does not accept a new sub-processor is to cancel under Section 11.2. Verificient imposes data-protection obligations on sub-processors no less protective than this DPA and remains liable for their performance. No sub-processor performs face matching or receives sampled frames or derived representations of face geometry.

B.6 Security measures

Verificient maintains: encryption of Customer Data in transit and at rest; access controls and authentication; activity logging, including of dashboard actions that view, change retention for, or delete Candidate Data; restriction of access within Verificient to personnel who need it to operate or support the Services; face matching performed entirely on infrastructure Verificient controls; storage lifecycle rules that destroy data automatically at the end of its retention period, with destruction following NIST SP 800-88 guidance across primary storage, replicas and backups, and quarterly verification that expired data is absent; and the incident protocol for biometric data set out in Section 10 of the Retention Policy. Verificient will not materially reduce the overall level of protection during a Subscription Term.

B.7 Audits

Verificient will provide, on request no more than once per year, its most recent third-party security assessment or attestation and responses to a reasonable security questionnaire. Where these do not reasonably satisfy Customer's legal obligations, Customer may conduct an audit on 30 days' notice, during business hours, no more than once per year, at Customer's expense, by an independent auditor bound by confidentiality, scoped to Verificient's processing of Customer Data.

B.8 International transfers

Customer Data is hosted and processed in the United States. Where Customer invites Candidates located outside the United States and the transfer of their data to the United States requires a legal mechanism, Customer as controller is responsible for putting that mechanism in place, and for the lawfulness of the invitation under Section 6.2(d). Verificient will provide the information in this DPA and reasonable cooperation to support Customer in doing so.

B.9 Data-subject requests, incidents, deletion

(a) Requests. Verificient will refer any Candidate request it receives to Customer within five business days and will assist Customer in responding through the tools in the dashboard (deletion, export). Verificient makes no commitment directly to Candidates. (b) Incidents. Verificient will notify Customer without undue delay, and in any event within 72 hours after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Candidate Data, will invalidate any affected face captures so that they cannot be used for a further identity match, and will provide information reasonably required for Customer to meet its own obligations to notify affected individuals and regulators, which remain Customer's as controller. Notification is not an admission of fault. (c) Deletion. Customer Data is deleted on the schedule in the Retention Policy, on Customer's dashboard instruction, and following the end of the Agreement as set out in Section 11.4, subject only to legal hold under Section 12.8 and retention required by law. A certificate of destruction is available under Section 11.4(d).

B.10 U.S. state privacy law terms

To the extent the CCPA/CPRA or a similar U.S. state privacy law applies, Verificient acts as a service provider or processor; will not retain, use or disclose Candidate Data outside the direct business relationship with Customer or for any purpose other than the business purpose specified; will not combine Candidate Data with personal data it receives from other sources except as permitted for service providers; will comply with applicable obligations and provide the same level of privacy protection as required of Customer; will notify Customer if it can no longer meet its obligations; and grants Customer the right to take reasonable steps to stop and remediate unauthorised use.

B.11 Liability

Each party's liability under this DPA is subject to Section 17 of the Agreement.