---
title: "Master Services Agreement"
sidebarTitle: "MSA Template"
description: "Lightspark Master Services Agreement."
hidden: true
mode: "wide"
---

_Last updated Jun 23, 2026_

In consideration of the mutual covenants and agreements set forth herein and in the Order to which this Master Services Agreement is attached, the Parties agree as follows:

## 1. Definitions

**1.1** In addition to the terms defined elsewhere in this Agreement, the following terms shall have the meanings set forth below:

- **(a) "Agreement"** means this MSA together with any SLA, all Orders, and all and any Exhibits or other attachments, terms or conditions which reference, and/or are made pursuant to it, and incorporated by reference.
- **(b) "Affiliate"** means with respect to any specified party, any Person that, directly or indirectly, controls, is controlled by, or is under common control with such specified party.
- **(c) "API"** means the application programming interface for sending data to or receiving data from the Service and any libraries made available to Platform for accessing the Service.
- **(d) "Applicable Law"** means with respect to a Person, all federal, state, local or foreign laws, statute, ordinance, treaties, rules, regulations and supervisory guidance, directives, policies, orders, or determinations enacted or issued by a governmental authority, payment network (such as a card network or National Automated Clearing House Association) having jurisdiction over the Person. Applicable Law includes, without limitation, any applicable export control laws, privacy laws, securities laws, and sanctions programs administered in the countries where either Party conducts business, including but not limited to the U.S. Department of Treasury's Office of Foreign Assets Control ("OFAC").
- **(e) "Authorized Users"** means Platform's employees and agents whom Platform directly or indirectly authorizes to access or use the Services.
- **(f) "Business Day"** means any day other than Saturday, Sunday, or a federal holiday in the United States.
- **(g) "Documentation"** means any user instructions, manuals, on-line help files, or other materials that are provided by Lightspark in connection with the API or Service.
- **(h) "End Users"** means the businesses or individuals who access or use the Grid Transaction Services through or in connection with Platform's web-based platforms or mobile applications, and who enter into a direct contractual relationship with Lightspark by accepting the End User Terms.
- **(i) "End User Terms"** means Lightspark's end user terms of service, as located at https://www.lightspark.com/legal/grid/enduserterms and as may be updated by Lightspark from time to time, which govern the direct relationship between Lightspark and each End User with respect to the Grid Transaction Services.
- **(j) "Financial Institution"** means a U.S. federal- or state-chartered bank, trust company, or person licensed by a regulatory authority to provide money transmission services.
- **(k) "Grid Managed Accounts"** include: (i) "Platform Internal Accounts," which are accounts associated with Platform and used for settlement, liquidity, float management, and other platform-level operations; and (ii) "End User Internal Accounts," which are accounts established and maintained by Lightspark for the benefit of individual End Users pursuant to the End User Terms. For the avoidance of doubt, End User Internal Accounts are Lightspark accounts maintained directly for End Users under the End User Terms. They are not sub-ledger entries of, or accounts owned or controlled by, Platform, and each End User's rights with respect to its End User Internal Account are governed exclusively by the End User Terms.
- **(l) "Grid Transaction"** means a payment, payout, currency conversion, or other financial transaction initiated by Platform or an End User and executed by Lightspark through the Service, including cross-border payments, foreign exchange conversions, and transfers to external bank accounts or wallets.
- **(m) "Grid Transaction Services"** means the payment, payout, currency conversion, settlement, and related financial services provided by Lightspark directly to End Users and Platform through the Service, as further described in the applicable Order, Documentation, and End User Terms.
- **(n) "Intellectual Property Right"** means copyrights (including the exclusive right to use, reproduce, modify, distribute, publicly display and publicly perform the copyrighted work), trademark rights (including trade names, trademarks, service marks, and trade dress), patent rights (including the exclusive right to make, use and sell), trade secrets, moral rights, right of publicity, authors' rights, contract and licensing rights, goodwill and all other intellectual property rights as may exist now and/or hereafter come into existence and all renewals and extensions thereof, regardless of whether such rights arise under the law of the United States or any other state, country or jurisdiction.
- **(o) "Liability"** means any liability, whether under contract, tort (including negligence), or otherwise, regardless of whether foreseeable or contemplated by the Parties.
- **(p) "Lightspark Technology"** means, collectively, the Service, API, Documentation, and any other services to be provided pursuant to the Agreement.
- **(q) "Order"** means the order form to which this MSA is attached, or any mutually agreed and executed order form referencing the MSA.
- **(r) "Platform Data"** means any data pertaining to Platform and its Authorized Users that is collected by Lightspark from Platform through the Service (excluding Usage Data) or submitted by Platform, End Users, or Authorized Users to the Service via the API or SDK.
- **(s) "SDK"** means the software development kit that is capable of being embedded into and integrated with Platform's web-based platforms and mobile applications.
- **(t) "Service"** means Lightspark's proprietary technology, platform, provision of the API framework, and the Grid Transaction Services, and related services provided hereunder and set forth on the Order.
- **(u) "SLA"** means the service level agreement set forth in Exhibit B hereto and made part of the Agreement.
- **(v) "Supported Locations"** means the countries and jurisdictions in which Lightspark makes the Grid Transaction Services available, as set forth in the Documentation or as otherwise communicated by Lightspark to Platform from time to time.
- **(w) "Taxes"** means any duties, customs fees, or taxes (other than taxes based on Lightspark's income, revenues, gross receipts, personnel, real or personal property, or other assets), including indirect taxes such as goods and services tax and value-added tax, associated with the purchase of the Service, and any related penalties or interest.
- **(x) "Third-Party Legal Proceeding"** means any formal legal proceeding filed by an unaffiliated third party before a court or government tribunal (including any appellate proceeding).
- **(y) "Third-Party Terms"** means terms and conditions set forth on the Order, provided in Documentation, or otherwise provided by Lightspark to Platform, governing the use of Third-Party Services by Platform, its Authorized Users and End Users, as applicable.

## 2. Service and API Usage

**2.1 Lightspark Services; License.** During the applicable Term, Lightspark will provide the Service as detailed in the relevant Order. Subject to Platform's ongoing compliance with the terms of the Agreement, Lightspark hereby grants Platform a non-exclusive, non-transferable, non-sublicensable, internal use only license, during the period of time commencing on the date set forth in an Order and continuing for the duration of the applicable Term to use the API or SDK to submit to and obtain information from the Service in accordance with any associated Documentation for the Authorized Purpose. Unless otherwise specified in an Order, Lightspark may provide the Service or any aspect of the Service through its subcontractors, provided Lightspark shall (a) remain directly responsible to Platform for the acts and omissions of each subcontractor and (b) ensure that each subcontractor is bound to terms at least as protective of Platform as the terms and conditions of the Agreement. Lightspark may, at any time, modify, suspend, or discontinue any Service component, supported network, or digital asset if such action is required or reasonably advisable due to changes in applicable law, regulatory or partner requirements, sanctions screening results, security risks, network events (including forks or reorganizations), or concerns related to market integrity. Lightspark will use commercially reasonable efforts to provide advance notice of any such action to Platform when reasonably practicable.

**2.2 SLA; Support; Information Security.** Subject to the terms of this Agreement, Lightspark will use commercially reasonable efforts to provide Platform the Service in accordance with the SLA. Subject to the terms hereof, Lightspark will provide Platform with reasonable technical support services in accordance with the terms set forth in Exhibit B. Each Party shall comply with the information security requirements set forth in Exhibit C, which is incorporated into and forms part of the Agreement.

**2.3 Beta Products.** Occasionally, Lightspark looks for beta testers to help test new features on the Service. These features will be identified as "beta" or "pre-release," or words or phrases with similar meanings (each, a "Beta Product"). Beta Products are made available on an "as is," and "as available" basis and, to the extent permitted under applicable law, without any warranties or contractual commitments Lightspark makes for other services.

**2.4 License Restrictions.** Except as the Agreement expressly permits, Platform shall not: (a) copy the Service, or any part of the Service, in whole or in part; (b) modify, correct, adapt, translate, enhance, or otherwise prepare derivative works or improvements of any portion of the Service; (c) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer, or otherwise make available the Service to any third party; (d) bypass or breach any security device or protection used for or contained in the Service or Documentation or attempt to decompile, disassemble, or otherwise reverse engineer any portion of the Service; (e) remove, delete, efface, alter, obscure, translate, combine, supplement, or otherwise change any trademarks, terms of the Documentation, warranties, disclaimers, or Intellectual Property Rights, proprietary rights or other symbols, notices, marks, or serial numbers on or relating to any copy of the Service or Documentation; (f) use the Service or Documentation in any manner or for any purpose that infringes, misappropriates, or otherwise violates any Intellectual Property Right or other right of any third party, or that violates any applicable statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree, or other requirement of any federal, state, local, or foreign government or political subdivision thereof, or any arbitrator, court, or tribunal of competent jurisdiction; (g) use the Service or Documentation for purposes of developing, using, or providing a product or service that competes with, or provides similar functionality to, the Service; (h) use the Service or Documentation in or in connection with the design, construction, maintenance, operation, or use of any hazardous environments, systems, or applications, any safety response systems or other safety-critical applications, or any other use or application in which the use or failure of the Service could lead to personal injury or severe physical or property damage; or (i) use the Service or Documentation in any manner or for any purpose or application not expressly permitted by the Agreement or contemplated by the Documentation. Lightspark may immediately suspend Platform's access to the Service in the event Lightspark discovers that Platform, or any Authorized User, has violated this Section 2.4.

**2.5 End Users; Direct Relationship with Lightspark.** Platform acknowledges and agrees that Lightspark provides the Grid Transaction Services directly to End Users and that Lightspark has a contractual relationship with each End User that is independent from Platform's contractual relationship with its End Users. As such, Lightspark will maintain exclusive control over the actions Lightspark takes with respect to an End User's use of the Grid Transaction Services, including decisions regarding onboarding, verification, transaction execution, suspension, and termination of an End User's access to the Grid Transaction Services.

- **(a) Onboarding and End User Terms Acceptance.** Each End User must accept the End User Terms and complete Lightspark's know-your-customer and know-your-business verification process as preconditions to accessing or using the Grid Transaction Services. Lightspark's onboarding flow will require each End User to accept the End User Terms and complete identity verification before the End User's status is approved and the End User may initiate Grid Transactions. Lightspark will exclusively establish, and may modify, the onboarding criteria for End Users in its sole discretion and in order to comply with Applicable Law.
- **(b) Platform Presentation of End User Terms.** Platform shall, prior to permitting any End User to access the Grid Transaction Services, present each such End-User with (i) a clear and conspicuous disclosure identifying Lightspark as the provider of payment services and stating that the Lightspark Grid End-User Terms of Service (as updated from time to time, the "Grid Terms") apply to the End-User's use of the Grid Services; (ii) a hyperlink or other direct means of accessing the then-current Grid Terms; and (iii) an affirmative acceptance mechanism—such as an unchecked checkbox or a clearly labeled "I Agree" button—that the End-User must actively engage before being permitted to proceed. Platform shall not use pre-checked boxes, passive scrolling, or continued-use mechanisms to satisfy the requirements of this Section. Platform shall present to Lightspark for its approval a mockup or other evidence demonstrating Platform's presentation of the End User Terms and any Third-Party Terms to End Users. Platform may not offer or make available the Grid Transaction Services to End Users without Lightspark's prior written approval pursuant to this Section 2.5(b), and the provisions of this Section 2.5(b) will apply in the event of any subsequent changes to the presentation of the End User Terms. Upon any material update to the Grid Terms, Platform shall re-present the updated terms to affected End-Users and obtain fresh affirmative acceptance before those End-Users continue to access the affected Grid Services. If Lightspark determines, in its reasonable judgment, that Platform's acceptance mechanism or records do not satisfy the requirements of this Section, Lightspark shall notify Platform in writing and Platform shall implement any required remediation within thirty (30) days of such notice (or such shorter period as Lightspark may specify if required by law, regulation, or regulatory examination). Lightspark may suspend Platform's access to affected Grid Services pending remediation if Lightspark reasonably determines that continued access poses material legal or regulatory risk to Lightspark.
- **(c) Platform Records of End Users' Consent to Terms.** Platform shall create and maintain, for each End-User acceptance event, a record containing at minimum: (i) a unique identifier for the End-User; (ii) the date and time of acceptance in Coordinated Universal Time; (iii) the IP address of the device used at the time of acceptance; (iv) the version identifier of the Grid Terms accepted; (v) the acceptance method used (e.g., checkbox, click-to-accept); and (vi) Platform's unique identifier as assigned by Lightspark. Platform shall retain all such records for a period of no less than five (5) years from the date of the relevant acceptance event, or such longer period as may be required by applicable law. Upon Lightspark's written request, Platform shall produce to Lightspark copies of any acceptance records specified in such request within five (5) business days of receipt thereof. Lightspark may exercise its right under this Section (c) at any time, including in connection with a regulatory examination, audit, investigation, or dispute involving an End-User.
- **(d) Platform Bound by End User Terms.** By executing this Agreement, Platform also agrees to the terms and conditions of the End User Terms, which apply when Platform itself receives the Grid Transaction Services as a user (including when Platform initiates Grid Transactions on behalf of its merchants or otherwise). In the event of any conflict between this Agreement and the End User Terms as applied to Platform, this Agreement shall control.
- **(e) Lightspark Compliance Responsibilities.** Lightspark shall be solely responsible for performing all know-your-customer, know-your-business, anti-money laundering, and sanctions screening obligations with respect to End Users in connection with the Grid Transaction Services, in accordance with Applicable Law and Lightspark's compliance program.
- **(f) Platform Liability for Onboarding Failures.** Platform shall be liable for any losses, damages, or claims arising from Platform's failure to properly present the End User Terms to End Users in accordance with this Section 2.5, or from Platform permitting End Users to access or use the Grid Transaction Services without such End Users having accepted the End User Terms and completed Lightspark's onboarding process.
- **(g) End User Suspension and Termination.** Platform may instruct Lightspark to suspend or terminate an End User's access to the Grid Transaction Services by submitting a request through the API or by providing written notice (including by email) to Lightspark, including in connection with (i) a regulatory inquiry or investigation involving the End User, (ii) Platform's termination or suspension of the End User from Platform's own services, (iii) suspected fraud, unauthorized activity, or other misconduct by the End User, or (iv) any other reason. Lightspark will use commercially reasonable efforts to act on such instructions promptly, subject to Lightspark's obligations under Applicable Law and the End User Terms.

**2.6 Consents and Disclosures.** Platform shall be solely responsible for: (a) providing any and all legally required notices and disclosures to Authorized Users and End Users related to Platform's own services and Platform's collection, use, and sharing of data with Lightspark; (b) offering all legally required choices to Authorized Users and End Users to enable them to exercise any granted privacy rights with respect to Platform's services; and (c) obtaining all informed consents from Authorized Users and End Users required to permit (i) Platform to use the Lightspark Technology and receive the Service, including as described in Section 2 and Section 5, (ii) Platform's provision of Platform Data to Lightspark under the Agreement, and (iii) Lightspark's use, accessing, storing, and processing of the Platform Data in accordance with the Agreement, including its use of automated decision making. In addition, Platform shall ensure delivery (and acceptance by, where applicable) of the following to End Users on Lightspark's behalf, in a form and in the manner approved by Lightspark: (d) transaction receipts and confirmations related to Grid Transactions; (e) disclosures required by Applicable Law, Financial Institutions, or Grid Switch Partners; and (f) other required documents as reasonably specified by Lightspark from time to time.

- **(a) Receipt Delivery.** Platform shall generate and deliver to each End User a compliant transaction receipt ("Receipt") for every money transmission transaction processed by Lightspark (each, a "Covered Transaction"), no later than the time required by Applicable Law. Each Receipt shall contain, at minimum, all information required by Lightspark, as communicated in writing to Platform. Platform may deliver Receipts electronically where permitted by Applicable Law. Before the launch of any product or feature through which Covered Transactions will be processed, Platform shall submit to Lightspark for review and prior written approval a complete sample of every Receipt template Platform intends to use, populated with mock data showing all required fields as they will be presented to End Users. Platform shall not use any Receipt format that has not received Lightspark's prior written approval; Lightspark shall not unreasonably withhold, condition, or delay such approval. Platform shall create and maintain complete and accurate records evidencing the content, delivery, and—where technically feasible—receipt or acknowledgment of each Receipt for no less than five (5) years from the applicable transaction date, or such longer period as Applicable Law requires. Within forty-eight (48) hours of a written request by Lightspark, Platform shall furnish to Lightspark all such records for the transactions identified in the request, together with documentation sufficient to constitute proof of delivery, in an organized and readily usable format via Lightspark's designated secure transfer channel.
- **(b) ESIGN Disclosure and Consent.** Prior to delivering any Lightspark required disclosure to an End User or obtaining any required End User consent, Platform shall obtain from each End User a valid consent to conduct business electronically in compliance with the Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) ("ESIGN Act") and any applicable state electronic transactions laws. Such consent shall include: (a) a clear and conspicuous disclosure of the End User's right to receive records in paper form and to withdraw consent; (b) the End User's affirmative agreement to conduct transactions and receive disclosures electronically; and (c) confirmation that the End User has the hardware and software necessary to access and retain electronic records. Platform shall maintain records of each End User's consent and provide such records to Lightspark upon request. Platform shall promptly honor any End User withdrawal of consent. For any End User who has withdrawn or not provided such ESIGN consent, Platform shall not allow such End User to access Grid Transaction Services.
- **(c)** For the avoidance of doubt, Lightspark shall be responsible for providing all legally required notices, disclosures, and consents to End Users with respect to the Grid Transaction Services, including as set forth in the End User Terms, and Platform's obligation under this Section 2.6 is limited to serving as a delivery channel for such notices and disclosures through Platform's interface.

**2.7 Third-Party Services.** The Service may integrate with, provide APIs or link to, or otherwise enable Platform or End Users to access or use services, sites, technology, data, content, and resources that are provided or otherwise made available by third parties (collectively, "Third-Party Services"). For the avoidance of doubt, Third-Party Services do not include the Grid Transaction Services, which are provided directly by Lightspark. Platform or each End User's use of Third-Party Services may be subject to Third-Party Terms or other terms, and unless expressly informed otherwise in writing by Lightspark, Lightspark is not a party to any such agreements. Lightspark has no control over and is not responsible for any Third-Party Services, including for the accuracy, availability, reliability, security, or completeness of information shared by or available through them. Lightspark is not an agent, representative, or fiduciary of Platform, any End User, or any other third party in connection with any Third-Party Service. Lightspark reserves the right to change, suspend, remove, disable, or impose access restrictions or limits on the use of any Third-Party Service at any time with or without prior notice.

**2.8 Grid Transactions.** Lightspark provides the Grid Transaction Services directly to Platform and End Users as part of the Service. Platform acknowledges and agrees that:

- **(a)** Lightspark executes Grid Transactions, including payments, payouts, and currency conversions, directly on behalf of End Users and Platform, as applicable, in accordance with the End User Terms and this Agreement;
- **(b)** Lightspark may establish Grid Managed Accounts at one or more Financial Institutions to hold, receive, and disburse funds in connection with Grid Transactions;
- **(c)** Platform Internal Accounts hold funds for the benefit of Platform, and End User Internal Accounts hold funds for the benefit of the applicable End User in accordance with the End User Terms;
- **(d)** Grid Transactions are available only in Supported Locations and with respect to supported currencies and digital assets as set forth in the Documentation;
- **(e)** Lightspark will provide End Users with transaction quotes that include applicable exchange rates and fees, and upon an End User's acceptance of a quote, Lightspark will execute the Grid Transaction in accordance with the terms of the quote and the End User Terms;
- **(f)** Platform and each End User is responsible for ensuring the accuracy and completeness of all instructions provided in connection with any Grid Transaction, including any recipient information, wallet addresses, transaction amounts, or other required information;
- **(g)** certain Grid Transactions, including those involving digital assets, may be irreversible, and losses due to erroneous, fraudulent, or accidental transactions may not be recoverable;
- **(h)** Lightspark may, in its sole discretion, refuse to execute any Grid Transaction, delay the execution of any Grid Transaction, or reverse or freeze any Grid Transaction if Lightspark determines, in its sole discretion, that such action is required or reasonably advisable due to compliance with Applicable Law, suspected fraud or illegal activity, sanctions screening results, or any other risk identified by Lightspark; and
- **(i)** Platform acknowledges that Lightspark maintains a direct account relationship with each End User through End User Internal Accounts, as governed by the End User Terms. Platform has no ownership interest in, control over, or right to direct the disposition of funds held in any End User Internal Account, except to the extent Platform instructs Lightspark to initiate a Grid Transaction on behalf of an End User in accordance with the Documentation and End User Terms. Platform shall not represent to any End User or third party that End User Internal Accounts are accounts of Platform or that Platform has any right to the funds held therein.

Lightspark may utilize third-party payment processors, banking partners, or other financial service providers (collectively, "Grid Switch Partners") to facilitate certain aspects of Grid Transactions, including settlement, foreign exchange, and payment routing. Lightspark shall remain responsible to Platform for the execution of Grid Transactions notwithstanding its use of any Grid Switch Partners.

**2.9 Open Source and Other Third-Party Components.** The Service may contain certain third-party software modules and components that are subject to separate or additional terms and conditions, including "open source" software modules and components ("Third-Party Components"). In addition, the Service may contain or be provided with certain other software modules and components offered by Lightspark under the terms and conditions of "open source" software licenses ("Lightspark Open-Source Components"). Lightspark will provide Platform all notices and materials required for Lightspark's compliance with the terms and conditions applicable to the Third-Party Components and Lightspark Open-Source Components in the Documentation, within the Service, or through another method chosen by Lightspark in its reasonable discretion. With respect to any Third-Party Components and Lightspark Open-Source Components made available under the terms and conditions of "open source" software licenses ("Open-Source Components"), all use of such Open-Source Components by Platform is governed by, and subject to, the terms and conditions of the open source software license applicable to the Open-Source Component and not the Agreement. With respect to any Third-Party Components that are not Open-Source Components, to the extent any separate or additional terms and conditions apply, Lightspark will provide such terms and conditions to Platform and Platform's use of such Third-Party Components is subject to such terms and conditions.

**2.10 Usage Data.** Lightspark may collect, maintain, process and use diagnostic, technical, usage and related information, including information about Platform's (including its Authorized Users' and End Users') computers, systems and software and their use of the Service ("Usage Data"). Platform agrees that all Usage Data is owned solely and exclusively by Lightspark, and Lightspark accordingly may use such Usage Data for any lawful purpose, including: (a) to provide and maintain the Service for Platform; (b) to develop and improve the Lightspark Technology; (c) to monitor Platform's usage of the Lightspark Technology; (d) for research and analytics and for Lightspark's other business purposes; and (e) to share analytics and other derived Usage Data with third parties solely in deidentified or aggregated form. The Service may contain technological measures designed to prevent unauthorized or illegal use of the Service. Platform acknowledges and agrees that Lightspark may use these and other lawful measures to verify Platform's compliance with the terms of the Agreement and enforce Lightspark's rights, including all Intellectual Property Rights, in and to the Service.

**2.11 Network Risks.** By using the Service, Platform understands that: (a) to the extent the Service utilizes underlying blockchain or distributed ledger networks, Lightspark is not responsible for the operation of such underlying software and networks; (b) there exists no guarantee of functionality, security, or availability of such underlying software or networks; (c) the underlying protocols are subject to sudden changes in operating rules which may materially affect the Service; (d) Lightspark may decide, in its sole discretion, not to support (or cease supporting) certain blockchain networks entirely; and (e) Lightspark assumes no responsibility whatsoever in respect of any underlying software protocols, except to the extent that Lightspark's negligence or willful misconduct directly causes a loss in connection with a Grid Transaction. PLATFORM HEREBY IRREVOCABLY WAIVES, RELEASES, AND DISCHARGES ALL CLAIMS, WHETHER KNOWN OR UNKNOWN TO PLATFORM, AGAINST LIGHTSPARK, ITS AFFILIATES AND THEIR RESPECTIVE SHAREHOLDERS, MEMBERS, DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, AND REPRESENTATIVES RELATED TO ANY OF THE RISKS SET FORTH IN THIS SECTION 2.11, EXCEPT TO THE EXTENT ARISING FROM LIGHTSPARK'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

**2.12 API Rate Limits.** Platform's use of the API is subject to rate limits, call quotas, and other usage restrictions as communicated by Lightspark to Platform from time to time (collectively, "Rate Limits"). Lightspark may modify Rate Limits at any time and will use commercially reasonable efforts to provide advance notice of material changes. If Platform exceeds the applicable Rate Limits, Lightspark may throttle, queue, or reject API requests without liability. Persistent or material violations of Rate Limits may be treated as a breach of Section 2.4 (License Restrictions). Platform may request increased Rate Limits by contacting Lightspark, and any such increase may be subject to additional Fees as set forth in the applicable Order.

## 3. Platform Responsibilities

**3.1 Platform Obligations.** Platform will reasonably cooperate with Lightspark to allow the performance of the Service, including by providing accurate and timely information about End Users as reasonably requested by Lightspark for purposes of compliance with Applicable Law and ongoing due diligence. Lightspark is not responsible for an inability to provide the Service caused by Platform's failure to cooperate as reasonably requested. Lightspark will provide its own equipment and tools to provide the Service. Notwithstanding any provision in the Agreement to the contrary, Platform acknowledges and agrees that Lightspark may refuse to offer Services to End Users for any reason, or no reason, without liability, including in connection with Lightspark's determination, at its sole discretion, that an End User is ineligible for the services, represents compliance or legal risk to Lightspark, or any other reason. Notwithstanding the foregoing, in the event that Lightspark refuses to offer Services to an End User, Lightspark will use commercially reasonable efforts to notify Platform and such End User that Lightspark refuses to provide Services. Platform shall disclose to End Users that the Grid Transaction Services are provided by Lightspark and that End Users' use of the Grid Transaction Services is subject to the End User Terms. Platform shall promptly (and in any event within twenty-four (24) hours) notify Lightspark in writing if Platform becomes aware of or reasonably suspects: (a) any End User complaint related to the Grid Transaction Services; (b) any suspicious, fraudulent, or unauthorized activity by or involving an End User in connection with the Grid Transaction Services; (c) any regulatory inquiry, investigation, or proceeding involving Platform's or an End User's use of the Grid Transaction Services; or (d) Platform's termination or suspension of an End User from Platform's own services. Platform shall cooperate with Lightspark in good faith to investigate and resolve any End User complaints related to the Grid Transaction Services, and shall refer End Users to Lightspark for complaints that relate to the execution, processing, or settlement of Grid Transactions.

**3.2 Restrictions.** Platform will not use the Service to enable any of the following activities: unlawful or abusive activity, fraud, unlawful gambling, intellectual property infringement, investment or credit services, check cashing, bail bonds, collections agencies, counterfeit goods, drugs and drug paraphernalia, adult content and services, multi-level marketing, unfair or deceptive practices, unlawful digital asset exchange, unlawful money services, unlawful money transmission, and any business that Lightspark believes poses elevated financial risk or legal liability. Notwithstanding the foregoing, Lightspark may amend the list of activities set forth in this Section 3.2 from time to time upon ten (10) days advance written notice.

**3.3 Equipment and Security.** Platform shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access or otherwise use the Service, including, without limitation, modems, hardware, servers, software, operating systems, networking, web servers and the like (collectively, "Equipment"). Platform shall also be responsible for maintaining the security of the Equipment passwords (including but not limited to administrative and user passwords) and files, and for all uses of Platform's account or the Equipment with or without Platform's knowledge or consent. Without limiting the foregoing, Platform shall comply with the security requirements applicable to Platform set forth in Exhibit C.

**3.4 Regulatory Cooperation.** Platform shall reasonably cooperate with Lightspark in connection with any examination, audit, investigation, or inquiry by a governmental or regulatory authority having jurisdiction over Lightspark or the Grid Transaction Services, including by promptly providing information, records, and documentation reasonably requested by Lightspark for purposes of responding to such examination, audit, investigation, or inquiry, to the extent such information, records, or documentation relate to Platform's use of the Service, End Users onboarded through Platform, or Grid Transactions initiated through Platform. Lightspark shall reimburse Platform's reasonable out-of-pocket costs incurred in providing such cooperation, except to the extent the examination, audit, investigation, or inquiry arises from Platform's breach of this Agreement or Applicable Law. This Section 3.4 is in addition to, and not a substitute for, the regulatory audit provisions set forth in Exhibit C, Section 5.2.

**3.5 Stablecoin Compliance.** To the extent that any Supported Digital Asset constitutes a "payment stablecoin" under the GENIUS Act or any successor legislation, Lightspark shall ensure that such payment stablecoin is issued by a permitted payment stablecoin issuer as required by Applicable Law. Platform shall cooperate with Lightspark in implementing any changes to the Grid Transaction Services necessitated by the GENIUS Act or regulations promulgated thereunder, including changes to Supported Digital Assets, disclosures, or transaction procedures. Lightspark may modify or discontinue support for any payment stablecoin if required for compliance with the GENIUS Act without such action constituting a breach of the Agreement.

**3.6 Travel Rule and Regulatory Information Sharing.** Without limiting any other obligation of Platform under this Agreement, Platform shall promptly provide to Lightspark, upon request or as required by Lightspark's compliance program, all information necessary for Lightspark to comply with the funds transfer recordkeeping and travel rule requirements under the Bank Secrecy Act and its implementing regulations (collectively, "Travel Rule Requirements"). Such information may include, without limitation: (a) the name, address, and account number (or other unique identifier) of the transmittor and recipient of each Grid Transaction; (b) the identity and address of the financial institution or virtual asset service provider of the transmittor or recipient, as applicable; (c) the amount and date of each Grid Transaction; (d) any payment instructions of each Grid Transaction; and (e) any other information required by Travel Rule Requirements or reasonably requested by Lightspark for compliance purposes. Platform represents and warrants that all information provided pursuant to this Section 3.6 will be accurate and complete. Platform shall include in its own terms and conditions with End Users (to the extent Platform collects any End User information prior to transmitting it to Lightspark) provisions requiring End Users to provide accurate and complete information sufficient to satisfy Travel Rule Requirements. This Section 3.6 is in addition to, and does not limit, Platform's obligations under Sections 2.6, 3.1, 3.3, and 3.4 of this Agreement.

**3.7 NACHA Compliance.** Lightspark acts as a Third-Party Sender (as defined in the NACHA Operating Rules, as amended from time to time) in connection with the ACH origination services described in this Section 3.7. Capitalized terms used but not otherwise defined in this Section 3.7 have the meanings ascribed to them in the NACHA Operating Rules.

- **(a) NACHA Operating Rules.** Platform agrees to comply with the NACHA Operating Rules to the same extent as if Platform were a signatory thereto. Lightspark has no obligation to transmit any Entry it reasonably believes would violate applicable law or the NACHA Operating Rules. Platform consents to Lightspark registering Platform with NACHA as required by the NACHA Operating Rules for Third-Party Sender relationships, and will provide Lightspark with any information required for such registration upon request.
- **(b) ACH Authorization.** Platform authorizes Lightspark to originate ACH credit and debit entries to and from accounts designated by Platform or its Receivers in connection with the Services, as well as ACH debit entries to Platform's own designated account(s) for collection of fees, chargebacks, settlement shortfalls, and other amounts owed to Lightspark.
- **(c) Entry Types.** Platform is authorized to initiate Entries using only the SEC Codes approved by Lightspark in writing. Lightspark may add or remove permitted SEC Codes upon notice. Platform shall not initiate Entries for any prohibited purpose, involving OFAC-sanctioned parties, or that are re-initiated after return except as permitted by the NACHA Operating Rules.
- **(d) Authorization Obligations.** Platform shall obtain a valid Authorization from each Receiver prior to initiating any ACH Entry, in the form required by Lightspark in writing. Each payment instruction submitted to Lightspark constitutes Platform's representation that a valid, enforceable Authorization exists for that Entry. Platform shall retain records of each Authorization for a minimum of two (2) years following its termination or revocation, and shall make Authorization records available to Lightspark within twenty-four (24) hours of request.
- **(e) Exposure Limits.** Lightspark shall establish per-transaction, daily, and aggregate Exposure Limits applicable to Platform's ACH Entries, as communicated to Platform in writing and subject to adjustment by Lightspark at any time based on risk, return rates, or financial condition. Platform shall not submit Entries that would exceed applicable Exposure Limits. Lightspark may require Platform to pre-fund Entries or maintain a reserve as a condition of access to the Services.
- **(f) Return Rate Monitoring.** Platform shall ensure that its ACH Entries do not exceed the return rate thresholds instituted by Lightspark. Platform shall monitor its own return rates and promptly investigate and remediate causes of returns. Platform shall not re-initiate any returned Entry except as expressly permitted by the NACHA Operating Rules. Upon Lightspark's request, Platform shall provide accurate contact information sufficient to respond to authorization inquiries within twenty-four (24) hours.
- **(g) Fraud Monitoring.** Platform shall implement and maintain risk-based processes and procedures reasonably designed to identify ACH Entries that may have been initiated as a result of fraud or without valid Authorization, as required by the NACHA Operating Rules. Such processes must include baseline transaction profiling to detect anomalous activity, pre-submission screening of outbound Entries, and annual review of fraud monitoring procedures. Platform shall cooperate with Lightspark's reasonable requests regarding any suspicious transaction activity.
- **(h) Annual Compliance Audit.** Platform shall complete an annual ACH Rules Compliance Audit as required by the NACHA Operating Rules and shall provide Lightspark with a copy of the results upon request. Platform shall promptly remedy any noncompliance identified and document the remediation steps taken.
- **(i) Audit Rights.** Platform grants Lightspark (and, upon Lightspark's request, the ODFI or NACHA) the right to audit Platform's ACH-related policies, procedures, and records to verify compliance with this Section and the NACHA Operating Rules, upon reasonable prior written notice (except in the event of suspected fraud or material breach, in which case Lightspark may audit on shorter notice). Platform shall cooperate fully with any such audit and shall remediate identified deficiencies within the timeframe specified by Lightspark.
- **(j) Suspension and Termination of ACH Services.** Lightspark may suspend or terminate Platform's access to ACH origination services immediately upon notice if: (i) Platform violates applicable law, the NACHA Operating Rules, or any provision of this Section; (ii) Platform engages in or is associated with fraudulent or illegal activity; (iii) Platform's Unauthorized Return Rate, Administrative Return Rate, or Overall Return Rate exceeds the applicable NACHA threshold; or (iv) Lightspark's ODFI terminates or suspends Lightspark's authority to transmit Entries on Platform's behalf.

## 4. Fees; Payment

**4.1 Invoicing and Payment.** Platform will pay Lightspark all fees of the type and amount set forth in an Order ("Fees"). Lightspark may also charge transaction-based fees directly to End Users in connection with Grid Transactions, as set forth in the End User Terms and the applicable Documentation. Platform will pay for any excess usage beyond any usage limitations or metrics on which Fees are based at the rates set forth in an Order. Lightspark reserves the right to change the Fees or applicable charges and to institute new charges and Fees at the end of the Initial Term or then current Renewal Term (as applicable), upon thirty (30) days prior written notice to Platform (which may be sent by email). Unless otherwise set forth in an Order: (a) unless otherwise required by law, all Fees are non-cancellable, non-refundable, and non-recoupable; and (b) all invoices for Fees are due and payable in the currency described in the Order, or if no such currency is specified, then in United States Dollars. Platform shall pay the Fees and hereby authorizes Lightspark to automatically charge the Fees to the payment method provided to Lightspark by Platform each month or year (as specified in the Order) for the Fees due. If, due to an inaccurate or faulty payment method provided by Platform, Platform's payment is overdue, then Lightspark may (i) charge interest from the due date at the lesser of 1.5% per month (or the highest rate allowed by law, if less) until paid in full, and (ii) suspend the Service if Platform's payment is overdue for more than thirty (30) days, with advance notice to Platform.

**4.2 Taxes.** Platform is responsible for all Taxes arising out of the Agreement or the transactions contemplated by the Agreement. Lightspark will itemize any invoiced Taxes, and Platform will pay invoiced Taxes without any deduction or withholding. The Parties shall reasonably cooperate to more accurately determine each Party's tax liability and to minimize such liability to the extent legally permissible. Platform is solely responsible for determining and fulfilling any tax reporting, collection, or remittance obligations arising from Platform's own business activities. Platform shall provide Lightspark with a completed IRS Form W-9 (or applicable Form W-8, if Platform is a non-U.S. person) upon execution of this Agreement and promptly upon any change in Platform's tax status (and such as other relevant documents as Lightspark may require from time to time).

## 5. Proprietary Rights

**5.1 Intellectual Property Rights.** Platform acknowledges that Lightspark owns and retains all rights, title, and interest, including all Intellectual Property Rights, in and to the Lightspark Technology, including all technology, software, algorithms, user interfaces, trade secrets, improvements, techniques, designs, inventions, works of authorship, and other tangible and intangible material and information pertaining thereto or included therein, and nothing in the Agreement shall preclude or restrict Lightspark from using or exploiting any concepts, ideas, techniques or know-how of or related to the Lightspark Technology or otherwise arising in connection with Lightspark's performance under the Agreement. Other than as expressly set forth in the Agreement, no licenses or other rights in or to the Lightspark Technology are granted to Platform and all such rights are hereby expressly reserved.

**5.2 Feedback.** At its option, Platform may provide feedback, requests, ideas or other suggestions about the Service or the Lightspark Technology (collectively, "Feedback") to Lightspark, and agrees that Lightspark may also use and exploit the Feedback in any manner on a worldwide, irrevocable, perpetual, royalty-free basis, without restriction.

**5.3 Platform Data.** As between Lightspark and Platform, Platform owns all right, title and interest in and to any and all of its Platform Data. Platform hereby grants to Lightspark during the Term a fully paid-up, royalty-free, worldwide, nonexclusive right and license, to use the Platform Data (a) as necessary to perform its obligations under the Agreement (including providing the features and functionality of the Service to Platform and End Users); (b) to enhance, improve, or otherwise modify the Service and for other development, diagnostic and corrective purposes in connection with the Service and other Lightspark offerings; (c) to disclose or use such data solely in aggregate or other de-identified form in connection with its business or the improvement of its services; and (d) for such other purposes as expressly set forth hereunder. The license granted under clause (c) shall survive the expiration or termination of the Agreement with respect to Platform Data that has been aggregated or de-identified during the Term. Platform shall be responsible for all Platform Data. Platform represents and agrees that Platform is solely responsible for (x) providing notices and obtaining consents as legally required from its Authorized Users and End Users for the collection, use, processing and transfer of Platform Data in connection with the Service; and (y) ensuring compliance with all laws in all jurisdictions that may apply to Platform Data provided hereunder, including all applicable international, federal, state, provincial and local laws, rules, and regulations relating to data privacy and security. Platform shall only submit Platform Data to Lightspark as specified in the Documentation. Lightspark does not make any representations as to the adequacy of the Service to process the Platform Data or to satisfy any legal or compliance requirements which may apply to the Platform Data, other than as described herein. The Parties acknowledge that certain End User data may be independently collected by both Lightspark and Platform through their respective relationships with End Users. Each Party independently owns and controls any such identical or overlapping data pursuant to such Party's respective end user agreements and privacy policies, and nothing in this Agreement shall be construed to limit or restrict either Party's independent right to collect, use, or process data obtained directly from End Users through its own contractual relationship with such End Users, subject to Applicable Law.

**5.4 Prohibited Data.** Platform shall not submit to the Service any data that is protected under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Family Educational Rights and Privacy Act ("FERPA"), the Children's Online Privacy Protection Act ("COPPA"), or any analogous state or foreign laws, or any data relating to individuals under the age of eighteen (18) (or such older age of majority as may apply in the relevant jurisdiction). For the avoidance of doubt, Platform may submit financial account numbers (including bank account and routing numbers), tax identification numbers (including Social Security Numbers, Employer Identification Numbers, and Individual Taxpayer Identification Numbers), and other data categories specified in the Documentation as required for the provision of the Grid Transaction Services.

## 6. Term and Termination

**6.1 Term.** The Agreement will start on the Effective Date of the first Order signed by the Parties and will continue during the term set forth in each Order, or until terminated earlier in accordance with the Agreement (the "Term").

**6.2 Termination.** Lightspark may terminate this Agreement at any point, for any reason, upon thirty (30) days' written notice to Platform. Either Party may terminate the Agreement by written notice: (a) if no Orders have been in effect between the Parties for a period of ninety (90) consecutive days; (b) the other Party is in material breach of the Agreement, where such material breach is not cured within thirty (30) days after written notice of such breach; or (c) if (i) the other Party ceases to carry on its business, (ii) a receiver or similar officer is appointed for the other Party's business, property, affairs or revenues and such proceedings continue for forty-five (45) days, (iii) the other Party becomes insolvent, admits in writing its inability to pay debts generally as they come due, is adjudicated bankrupt, or enters composition proceedings, makes an assignment for the benefit of its creditors or another arrangement of similar import, or (iv) proceedings under bankruptcy or insolvency laws are commenced by or against the other Party and are not dismissed within forty-five (45) days; or (d) the purpose of the Agreement is frustrated by operation of law.

**6.3 Wind-Down Period.** Upon the effective date of the expiration or termination of the Agreement for any reason (other than termination by Lightspark for Platform's material breach, in which case Lightspark may immediately cease all Services), a wind-down period of three (3) months shall commence (the "Wind-Down Period"). During the Wind-Down Period: (a) Platform shall continue to make the Service available to End Users through Platform's web-based platforms or mobile applications to permit Lightspark to complete any outstanding Grid Transactions and to fulfill Lightspark's obligations to End Users under the End User Terms and Applicable Law; (b) Lightspark shall not onboard new End Users or process new Grid Transactions initiated after the effective date of termination, but shall use commercially reasonable efforts to complete all Grid Transactions initiated prior to or during the Wind-Down Period; (c) both Parties shall cooperate in good faith to resolve any pending End User complaints related to the Grid Transaction Services; and (d) Lightspark shall provide Platform with reasonable notice of the expected timeline for completing outstanding Grid Transactions. At the conclusion of the Wind-Down Period, Lightspark's obligations to provide the Grid Transaction Services through Platform shall cease, without prejudice to Lightspark's continuing obligations to End Users under the End User Terms.

**6.4 Effect of Termination.** Upon the expiration of the Wind-Down Period (or, in the case of termination for Platform's material breach, upon the effective date of termination): (a) Platform's and its Authorized Users' access to the Service, and the licenses granted to Platform hereunder will automatically terminate; (b) all outstanding payment obligations of Platform will become due and payable immediately; (c) upon Platform's request, Lightspark will delete Platform Data within sixty (60) days, subject to Lightspark's obligation to retain data as required by Applicable Law, the End User Terms, or the DPA; and (d) each Party shall immediately return, or at the other Party's request destroy and certify the destruction of any tangible embodiments of the other Party's Confidential Information, including, as applicable, all copies of the API.

**6.5 Survival.** The following provisions will survive the expiration or termination of the Agreement for any reason: Sections 1, 2.4, 2.5, 2.8, 2.10, 2.11, 3.5, 3.6, 3.7, 4, 5.1, 5.2, 5.4, 6.3 through 6.6, 7 through 12, and Exhibit C (to the extent obligations thereunder relate to data retained after termination or to Security Incidents discovered after termination).

**6.6 Regulatory Data Retention.** Notwithstanding any deletion obligations under Section 6.4(c) or the DPA, each Party shall retain all records required to be maintained by Applicable Law (including the Bank Secrecy Act and its implementing regulations, applicable state money transmission laws, and Sanctions) for the period required by such law, which may extend beyond the termination of this Agreement. Lightspark's obligation to retain End User Data as required by Applicable Law and the End User Terms shall survive termination of this Agreement. Platform shall not delete or destroy any Platform Data or End User Data in Platform's possession that Lightspark may reasonably need for regulatory compliance purposes without first providing Lightspark with thirty (30) days' advance written notice and a reasonable opportunity to obtain copies of such data.

## 7. Confidentiality

**7.1 Confidential Information Defined.** "Confidential Information" means: (a) any information disclosed, directly or indirectly, by or on behalf of one Party ("Disclosing Party") to the other Party ("Receiving Party") pursuant to the Agreement that is designated as "confidential," or in some other manner to indicate its confidential nature; and (b) any information that otherwise should reasonably be expected to be treated in a confidential manner based on the circumstances of its disclosure or the nature of the information itself. Without limiting the foregoing, the Lightspark Technology, the functionality and performance of the Lightspark Technology, including any metrics pertaining thereto, are the Confidential Information of Lightspark, the Platform Data is the Confidential Information of Platform, and the terms (but not the existence) of the Agreement will be kept confidential, respectively, as each Party's Confidential Information. However, Confidential Information does not include any information that: (i) is or becomes generally known and available to the public through no act of the Receiving Party; (ii) was already in the Receiving Party's possession without a duty of confidentiality owed to the Disclosing Party at the time of disclosure by the Disclosing Party, as shown by the Receiving Party's contemporaneous records; (iii) is lawfully obtained by the Receiving Party from a third party who has the express right to make such disclosure; or (iv) is independently developed by the Receiving Party without breach of an obligation owed to the Disclosing Party.

**7.2 Use; Maintenance.** Neither Party shall use the Confidential Information of the other Party for any purpose except to exercise its rights and perform its obligations under the Agreement. Neither Party shall disclose, or permit to be disclosed, either directly or indirectly, any Confidential Information of the other Party, except: (a) to its advisors, or prospective investors or purchasers, in each case subject to written obligations of confidentiality; or (b) where the Receiving Party becomes legally compelled to disclose Confidential Information, notwithstanding the Receiving Party's having given the Disclosing Party prior notice of such legally compelled disclosure and a reasonable opportunity to seek a protective order or other confidential treatment for such Confidential Information (if permitted by applicable law). Each Party will take reasonable measures and care to protect the secrecy of and avoid disclosure and unauthorized use of the other Party's Confidential Information and will take at least those measures taken to protect its own most highly confidential information.

## 8. Indemnification

**8.1 By Lightspark.** Lightspark will defend and indemnify Platform against any Liabilities in any Third-Party Legal Proceeding to the extent arising from allegations that Platform's use, as authorized in the Agreement, of the Service during the applicable Term constitutes an infringement of the U.S. Intellectual Property Rights of any third party. Lightspark will also defend and indemnify Platform against any Liabilities in any Third-Party Legal Proceeding to the extent solely arising from Lightspark's failure to comply with applicable anti-money laundering laws, sanctions laws, or know-your-customer requirements in connection with the Grid Transaction Services. Lightspark will also defend and indemnify Platform against any Liabilities in any Third-Party Legal Proceeding to the extent solely arising from the use of the Services in breach of any trade and economic sanctions laws and regulations, including the Export Administration Regulations maintained by the U.S. Department of Commerce, trade and economic sanctions maintained by OFAC, and the International Traffic in Arms Regulations maintained by the U.S. Department of State. The foregoing obligations do not apply with respect to portions or components of the Service (a) not supplied by Lightspark; (b) made in whole or in part in accordance with Platform specifications; (c) that are modified after delivery by Lightspark; (d) combined with other products, processes or materials where the alleged infringement relates to such combination; (e) where Platform continues allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement; or (f) where Platform's use of the Service is not strictly in accordance with this Agreement. If, due to a claim of infringement, the Service is held by a court of competent jurisdiction to be or is believed by Lightspark to be infringing, Lightspark may, at its option and expense (i) replace or modify the Service to be non-infringing provided that such modification or replacement contains substantially similar features and functionality, (ii) obtain for Platform a license to continue using the Service, or (iii) if neither of the foregoing is commercially practicable, terminate this Agreement and Platform's rights hereunder and provide Platform a refund of any prepaid, unused Fees for the Service.

**8.2 By Platform.** Platform will defend, indemnify and hold harmless Lightspark against any Liabilities in any Third-Party Legal Proceeding to the extent arising from: (a) allegations that the use by or on behalf of Lightspark of the Platform Data in accordance with the Agreement violates a third party's rights or any laws; (b) arising out of any unauthorized access or use of the Service by Platform or any Authorized Users or any third party utilizing any access credentials of Platform, End Users, or any Authorized Users; (c) the use of the Service in violation or in connection with a violation of this Agreement or applicable law; (d) arising from Platform's negligence or willful misconduct; (e) arising out of modifications to any Lightspark Technology not made by Lightspark; or (f) arising out of Platform's or Authorized Users' use of or reliance on information provided via the Service, including any allegations that any use of information provided via the Service by Platform or Authorized Users infringes or misappropriates any third party's rights or violates any laws.

**8.3 Exclusions.** Section 8.1 will not apply to the extent the underlying allegation arises from: (a) the indemnified Party's breach of the Agreement; (b) the indemnified Party's breach of applicable law or regulation; or (c) for any use of the Service in combination with materials not provided by Lightspark under the Agreement, unless the combination is required by the Agreement.

**8.4 Conditions.** Any indemnified Party must promptly notify the indemnifying Party in writing of any allegation(s) that preceded the Third-Party Legal Proceeding and cooperate reasonably with the indemnifying Party to resolve the allegation(s) and Third-Party Legal Proceeding. If breach of this Section 8.4 prejudices the defense of the Third-Party Legal Proceeding, the indemnifying Party's obligations under Section 8.1 or Section 8.2 (as applicable) will be reduced in proportion to the prejudice.

**8.5 Remedies.** Notwithstanding anything herein to the contrary, if any intellectual property infringement claim is brought or threatened against Platform, or if Lightspark reasonably believes that the Service may infringe a third party's Intellectual Property Rights, then Lightspark may, at its sole option and expense: (a) procure for Platform the right to continue to use the Service; (b) modify the Service, as applicable, to make it non-infringing without materially reducing its functionality; (c) replace the affected aspect of the Service with non-infringing technology having substantially similar capabilities; or (d) if Lightspark determines, in its sole discretion, that none of the foregoing remedies are commercially practicable, then it may choose to suspend or terminate the impacted Service or the Agreement as a whole and refund Platform, on a pro-rated basis, any pre-paid Fees for the corresponding unused portion of the Term.

## 9. Warranties; Disclaimers

**9.1 Mutual Warranties.** Each Party represents and warrants to the other that: (a) it has the legal power and authority to enter into this Agreement; (b) it is duly organized, validly existing, and in good standing under the applicable laws of the jurisdiction of its origin; and (c) it will comply with all applicable laws in performing its obligations or exercising its rights in this Agreement.

**9.2 Lightspark Representations and Warranties.** Lightspark represents, warrants, and covenants to Platform that: (a) Lightspark has, and throughout the Term and any additional periods during which Lightspark does or is required to perform the Service will have, the unconditional and irrevocable right, power, and authority, including all permits and licenses required, to provide the Service and the Grid Transaction Services and grant and perform all rights and licenses granted or required to be granted by it under the Agreement; (b) Lightspark will use commercially reasonable efforts to ensure the Service operates in material conformance with its applicable Documentation; (c) Lightspark is registered as a money services business with the Financial Crimes Enforcement Network ("FinCEN") and holds all state licenses and registrations required to provide the Grid Transaction Services in each Supported Location; (d) Lightspark maintains and will continue to maintain throughout the Term an anti-money laundering and sanctions compliance program designed to comply with Applicable Law, including the Bank Secrecy Act, its implementing regulations, and the sanctions programs administered by OFAC; and (e) Lightspark will perform all know-your-customer, know-your-business, and sanctions screening obligations with respect to End Users as required by Applicable Law in connection with the Grid Transaction Services. The Service may be temporarily unavailable for scheduled maintenance or for unscheduled emergency maintenance, either by Lightspark or by third-party providers, or because of other causes beyond Lightspark's reasonable control, but Lightspark shall use reasonable efforts to provide advance notice in writing or by email of any scheduled service disruption.

**9.3 Platform Representations and Warranties.** Consistent with Platform's obligations in the Agreement, Platform represents, warrants and covenants that (a) it has and will have all rights necessary and full legal authority to provide the authorizations, rights, and licenses provided to Lightspark under the Agreement, including (i) the right to input, import, upload, submit or otherwise provide Lightspark with access to Platform Data via the Service, SDK or API; (ii) the authority to grant the rights in and to Platform Data granted to Lightspark in the Agreement; (b) Platform and its Authorized Users will only use the Service or API for legally permissible purposes; (c) it will at all times comply with applicable law and any other law or regulation that is applicable to Platform; (d) Platform will use the Service only in compliance with the Documentation and Lightspark's standard published policies then in effect; and (e) Platform does not hold itself out to End Users or any third party as a money transmitter, money services business, bank, or other financial institution in connection with the Grid Transaction Services, and Platform does not independently provide money transmission, payment, or other financial services to End Users through the Grid Transaction Services except as authorized by and through Lightspark. Platform agrees, as between the Parties, that Platform bears all responsibility and liability for the accuracy, completeness, possession, and use of Platform Data in connection with the Agreement.

**9.4 No Financial, Professional, or Investment Advice.** Lightspark is not in the business of providing legal, tax, audit, accounting, or brokerage, nor other professional services or advice. Platform acknowledges and agrees, and Platform will procure that each End User agrees pursuant to the End User Terms, that information provided by Lightspark is informational only, and should not be considered a substitute for the services or advice of a competent professional.

**9.5 Digital Asset Risks.** The digital assets about which information is provided via the Service are not viewed by the issuer or sponsor, or those buying or selling the digital asset, as securities under U.S. laws or relevant applicable laws. As a result, it is unlikely that fulsome disclosures from the issuer or sponsor, or any executive officer associated with the digital asset or related protocol have been provided, and others may have better or more information than the information made available to Platform or End User via the Service or to which either person may independently have access. There are risks associated with investing in digital assets, including stablecoins. Loss of principal is possible and stablecoins may be "depegged," meaning they cease to maintain a stable value, and such stablecoins may not be redeemable for underlying collateral. Volatility is highly likely, and some of the protocols and platforms may fail entirely due to forking, flaws in the code, hacking, or other malicious attacks. Some high-risk investments may use leverage, which may accentuate gains and losses. A digital asset's past investment performance is not a guarantee or predictor of future performance. THE DISCLAIMERS IN THE AGREEMENT DO NOT REPRESENT A COMPLETE STATEMENT OF RISK FACTORS ASSOCIATED WITH AN INVESTMENT IN ANY OF THE DIGITAL ASSETS OR PRODUCTS THAT MAY BE VIEWED OR TRACKED ON OR THROUGH THE SERVICE OR THIRD-PARTY SERVICES. PLATFORM SHOULD CONSIDER THESE RISK WARNINGS CAREFULLY AND TAKE APPROPRIATE INVESTMENT ADVICE BEFORE TAKING ANY DECISION TO PURCHASE OR TRADE A DIGITAL ASSET. AS A CONDITION FOR EACH END USER'S USE OF THE GRID TRANSACTION SERVICES (DIRECTLY OR THROUGH A PLATFORM), LIGHTSPARK SHALL SET FORTH APPROPRIATE RISK DISCLOSURES IN THE END USER TERMS.

**9.6 General Disclaimer.** EXCEPT AS EXPRESSLY SET FORTH IN SECTIONS 9.1 AND 9.2, THE LIGHTSPARK TECHNOLOGY IS PROVIDED "AS IS" AND ON AN "AS AVAILABLE" BASIS. LIGHTSPARK HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. LIGHTSPARK SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. LIGHTSPARK MAKES NO WARRANTY OF ANY KIND THAT THE LIGHTSPARK TECHNOLOGY, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL MEET PLATFORM'S OR ANY OTHER PERSON'S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY SOFTWARE, SYSTEM OR OTHER SERVICES, OR BE ACCURATE, COMPLETE, FREE OF HARMFUL CODE, OR ERROR FREE.

## 10. Limitation of Liability

NOTWITHSTANDING ANYTHING TO THE CONTRARY, EXCEPT FOR (A) BODILY INJURY OF A PERSON OR (B) EITHER PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS OR (C) EITHER PARTY'S INDEMNIFICATION OBLIGATIONS, IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO THE AGREEMENT, HOWEVER CAUSED, AND BASED ON ANY THEORY OF LIABILITY, WHETHER FOR BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. LIGHTSPARK'S TOTAL LIABILITY (INCLUDING ATTORNEYS' FEES) ARISING OUT OF OR RELATED TO THE AGREEMENT (EXCEPT FOR PLATFORM'S PAYMENT OBLIGATIONS) WILL NOT EXCEED THE AMOUNT PAID OR PAYABLE BY PLATFORM HEREUNDER DURING THE 12-MONTH PERIOD PRIOR TO THE DATE THE CLAIM AROSE. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING ANY FAILURE OF THE ESSENTIAL PURPOSE OF ANY LIMITED OR EXCLUSIVE REMEDY.

## 11. Insurance

During the Term and for three (3) years following the Term, Platform will maintain insurance policies at its own expense for commercial general liability with a minimum coverage of $1,000,000. At Lightspark's request, Platform will provide certificates of insurance evidencing such coverage.

## 12. General Provisions

**12.1 Notices.** Any required notice shall be given in writing by customary means with receipt confirmed at the address of each Party set forth above, or to such other address as either Party may substitute by written notice to the other, or by email. Notices will be deemed to have been given at the time of actual delivery in person, one (1) day after delivery to an overnight courier service, three (3) days after deposit in certified mail, or upon sending of an email. The Parties may use emails to satisfy written approval and consent requirements under the Agreement.

**12.2 Assignment.** This Agreement is not assignable, transferable or sublicensable by Platform except with Lightspark's prior written consent. Lightspark may transfer and assign any of its rights and obligations under this Agreement without consent. Any other non-permitted assignment will be void and ineffective.

**12.3 Force Majeure.** Except for the obligation to pay Fees, neither Party will be liable for any failure or delay in its performance under the Agreement due to any cause beyond its reasonable control, including an act of war, terrorism, act of God, earthquake, flood, pandemic, embargo, riot, sabotage, labor shortage or dispute, governmental act or failure or degradation of the Internet (a "Force Majeure Event"). The delayed Party shall give the other Party notice of such cause and shall use its commercially reasonable efforts to correct such failure or delay in performance.

**12.4 Governing Law.** The Agreement shall be governed by and construed under the laws of the State of California without reference to conflict of laws principles. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Subject first to Section 12.7, if a lawsuit or court proceeding is permitted under the Agreement, the Parties will be subject to the exclusive jurisdiction of the state and federal courts located in San Francisco, California, and the Parties hereby agree and consent to the exclusive jurisdiction and venue of such courts.

**12.5 Anti-Bribery.** Neither Party will take any action that would be a violation of any applicable laws that prohibit the offering, giving, promising to offer or give, or receiving, directly or indirectly, money or anything of value to any third party to assist Lightspark or Platform in retaining or obtaining business. Examples of these kinds of laws include the U.S. Foreign Corrupt Practices Act and the UK Bribery Act 2010.

**12.6 Publicity.** Lightspark may identify Platform and use Platform's name and logo in Lightspark's marketing materials and on its website. Except as expressly provided for herein, Platform may not use the name, logo, or other trademarks of Lightspark for any purpose without Lightspark's prior written approval.

**12.7 Arbitration.** The Parties agree to resolve all disputes arising under or in connection with the Agreement through binding arbitration. A Party who intends to seek arbitration must first send a written notice of the dispute to the other Party. The Parties will use good faith efforts to resolve the dispute directly, but if the Parties do not reach an agreement to do so within thirty (30) days after the notice is received, either Party may commence an arbitration proceeding. The arbitration will be conducted in accordance with the applicable rules of the American Arbitration Association ("AAA Rules"). The arbitration will be conducted in English in San Francisco, California, USA. If the Parties do not agree on an arbitrator, the arbitrator will be selected in accordance with the applicable rules of the AAA for the appointment of an arbitrator. The selection of an arbitrator under the rules of the AAA will be final and binding on the Parties. The arbitrator must be independent of the Parties. The arbitrator's decision will be final and binding on both Parties, and the arbitrator must issue a reasoned written decision sufficient to explain the essential findings and conclusions on which the decision and award, if any, are based. The costs and expenses of the arbitration will be shared equally by both Parties; however, if the arbitrator finds that either the substance of the claim or the relief sought in arbitration is frivolous or brought for an improper purpose (as measured by the standards set forth in Federal Rule of Civil Procedure 11(b)), then the payment of all fees will be governed by the AAA Rules. Notwithstanding the foregoing, this Section 12.7 will not prohibit either Party from: (a) bringing an individual action in small claims court; (b) seeking injunctive or other equitable relief in a court of competent jurisdiction; (c) pursuing an enforcement action through the applicable federal, state, or local agency if that action is available; or (d) filing suit in a court of law to address an intellectual property infringement or misappropriation claim. If this Section 12.7 is found to be unenforceable, the Parties agree that the exclusive jurisdiction and venue described in Section 12.4 will govern any action arising out of or related to the Agreement.

**12.8 Conflicting Terms.** In the event of conflict or inconsistency among the documents constituting this Agreement, the following order of precedence shall apply (highest to lowest): (1) any amendment to this MSA; (2) the applicable Order; (3) Exhibit C (Information Security Requirements); (4) Exhibit B (Service Level Agreement); (5) this MSA (excluding Exhibits); (6) the DPA; and (7) the Documentation.

**12.9 Equitable Relief.** Each Party acknowledges and agrees that a breach or threatened breach by such Party of any of its obligations under Section 7, Exhibit C, or, in the case of Platform, Section 2.4, would cause the other Party irreparable harm for which monetary damages would not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other Party will be entitled to equitable relief, including a restraining order, an injunction, specific performance, and any other relief that may be available from any court, without any requirement to post a bond or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity, or otherwise.

**12.10 Miscellaneous.** This Agreement is the sole agreement of the Parties concerning the subject matter hereof and supersedes all prior agreements and understandings with respect to said subject matter. Platform may not subcontract or delegate any rights or obligations granted to it under the Agreement to any third parties, including its consultants or contractors, without the prior written consent of Lightspark. Platform agrees that it is solely responsible for any liability arising out of its Authorized Users or End Users access and use of the Lightspark Technology in violation of the Agreement. No terms of any purchase order, acknowledgement, or other form provided by Platform in connection with an Order will modify the Agreement, regardless of any failure of Lightspark to object to such terms. Any ambiguity in the Agreement shall be interpreted without regard to which Party drafted the Agreement or any part thereof. In the Agreement, the word "including" or any variation thereof means "including, without limitation" and shall not be construed to limit any general statement that it follows to the specific or similar items or matters immediately following it. There are no third-party beneficiaries to the Agreement. The Agreement may only be amended by a writing signed by both Parties. No agency, partnership, joint venture, or employment is created as a result of this Agreement and Platform does not have any authority of any kind to bind Lightspark in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing Party will be entitled to recover costs and attorneys' fees. The Parties consent to electronic signatures and agree that the Agreement may be executed in counterparts. The headings in the Agreement are inserted for convenience and are not intended to affect the interpretation of the Agreement. The relationship between the Parties shall be that of independent contractors. Lightspark may use subcontractors or otherwise delegate aspects of its performance under the Agreement; provided that Lightspark shall remain responsible hereunder for any such subcontractor's performance. Waiver of any term of the Agreement or forbearance to enforce any term by either Party shall not constitute a waiver as to any subsequent breach or failure of the same term or a waiver of any other term of the Agreement. Any provision found to be unlawful, unenforceable or void shall be severed from the remainder of the Agreement and the remainder of the Agreement will continue in full force and effect without said provision. The Parties agree to comply with all applicable export control laws and regulations related to their performance of the Agreement.

---

# Exhibit B — Service Levels

This Service Level Agreement ("SLA") governs Platform's use of the Service during the Term, and unless otherwise provided herein, is subject to the provisions of the Agreement. Unless otherwise expressly defined below, the capitalized terms used herein have the meaning assigned to them in the Agreement. If a capitalized term is not defined or has a meaning ascribed to it in the context in which it is used, the capitalized term will have the industry standard meaning.

## 1. Definitions

**1.1** In addition to the terms defined elsewhere in this Agreement, the following terms shall have the meanings set forth below:

- **(a) "Availability"** means the time periods that the Service is accessible by Platform and Authorized Users.
- **(b) "Business Hours"** means 8:00 a.m. PT to 6:00 p.m. PT on Business Days.
- **(c) "Emergency Maintenance"** means unplanned or unanticipated maintenance of the Service causing the Service to be unavailable, as reasonably determined by Lightspark, including maintenance that may be required to address material security-related issues or technical problems that would impact the Availability of the Service and resolution of which cannot wait until the next Scheduled Maintenance or cannot be remedied in the course of Scheduled Maintenance. Lightspark shall use commercially reasonable efforts to notify Platform in advance of any Emergency Maintenance, and shall promptly notify Platform of the Emergency Maintenance and actions being taken in the course thereof once Lightspark becomes aware of an occasion requiring Emergency Maintenance.
- **(d) "Maintenance"** means Emergency Maintenance and Scheduled Maintenance.
- **(e) "Monthly Uptime Percentage"** is calculated by subtracting from 100% the percentage of minutes during the month in which the Service is Unavailable. Monthly Uptime Percentage measurements exclude downtime resulting directly or indirectly from any SLA Exclusion.
- **(f) "Problem"** means a Severity 1 Problem, Severity 2 Problem, or Severity 3 Problem.
- **(g) "Scheduled Maintenance"** means maintenance performed outside of standard business hours by or on behalf of Lightspark for which Lightspark provides notice to Platform of such maintenance no less than seventy-two (72) hours prior to the occurrence of maintenance that will involve both Parties. Scheduled Maintenance shall not include instances of Emergency Maintenance unless otherwise agreed by the Parties in writing.
- **(h) "Scheduled Uptime Minutes"** means the difference between (i) the total aggregate minutes in the applicable month and (ii) minutes in that month in which the Service is not Available to Platform due to Scheduled Maintenance.
- **(i) "Service Level"** means the service level commitments set forth in Section 2.
- **(j) "Service Level Credit"** means the credit set forth in Section 4.2.
- **(k) "Service Level Default"** means a failure to satisfy the Service Level set forth in Section 2.
- **(l) "Severity 1 Problem"** means the Service or API is inoperative, or the functionality or performance is impaired to the point of preventing critical business operations. Examples of Severity 1 Problems include complete inability to initiate or receive payments via the API, or all or most API endpoints returning errors or timing out.
- **(m) "Severity 2 Problem"** means the performance or functionality of the Service or API is impaired to the point of threatening to prevent critical business operations but the issue does not rise to the level of a Severity 1 Problem.
- **(n) "Severity 3 Problem"** means the Service or API is experiencing errors or problems that do not impact normal business operations and that do not rise to the level of a Severity 1 or Severity 2 Problem.
- **(o) "System Availability"** means the percentage of total time during which the Service is Available to Platform, expressed as a percentage calculated in accordance with the following formula: System Availability = ((Scheduled Uptime Minutes – Unscheduled Outage Minutes) / Scheduled Uptime Minutes) × 100.
- **(p) "Unavailable"** and **"Unavailability"** mean the Service does not respond to API requests resulting in the Service not being functional, or resulting in Platform being unable to access the Service for a period of thirty (30) or more consecutive minutes.
- **(q) "Unscheduled Outage Minutes"** means all those minutes in which the Service is not Available to Platform, excluding (i) minutes arising from Scheduled Maintenance and (ii) minutes arising from any of the SLA Exclusions specified in Section 3. Unscheduled Outage Minutes shall be counted from the time that Platform notifies Lightspark of an outage to the time that a representative of Lightspark notifies Platform that the outage is resolved.

## 2. Availability Commitment

Subject to Section 3, in each calendar month during the Term, Lightspark will make the Service available with a Monthly Uptime Percentage equal to or greater than 99.9% (the "Availability Commitment").

## 3. SLA Exclusions

**3.1** The Service Level commitments do not apply to any Unavailability, inaccessibility, or performance issues resulting from the following ((a)–(i), the "SLA Exclusions"):

- **(a)** Maintenance;
- **(b)** Platform's failure to migrate to the current API version within the applicable Migration Period (as defined in Section 7);
- **(c)** causes outside of Lightspark's reasonable control, including a Force Majeure Event;
- **(d)** actions or inactions of Platform or any third party not authorized or controlled by Lightspark;
- **(e)** use on or in a sandbox, testing, development, or other non-production environment;
- **(f)** the equipment, software, or other technology of Platform or any third-party services (other than third-party equipment, software, or other technology within Lightspark's control);
- **(g)** the suspension or termination of Platform's right to use the Service in accordance with the Agreement;
- **(h)** failure of hardware, software, or other equipment provided by Platform, or Platform's or its Authorized Users' inability to access the internet or the Service due to technical difficulties of Platform's internet service provider; or
- **(i)** catastrophic outages of critical third-party infrastructure providers (such as AWS or comparable cloud infrastructure) or power providers outside of Lightspark's reasonable control.

## 4. Service Level Defaults

**4.1 Termination Right.** In the event that Lightspark breaches the Availability Commitment set forth in Section 2.1 for (a) three (3) consecutive months, or (b) four (4) months in any rolling six (6) month period, such failure will be deemed a material breach of the Agreement, for which Platform will be entitled to terminate the Agreement pursuant to Section 6 of the MSA. In addition, should Lightspark fail to achieve 99.7% System Availability for three (3) consecutive calendar months in a twelve (12) month period, Platform shall have the right to terminate the Agreement and Lightspark shall refund to Platform any prepaid amounts for the portion of the Service not yet provided. For the avoidance of doubt, the prepaid fee refund in the preceding sentence is the exclusive refund remedy for Service Level Defaults under this SLA, and Platform may not seek a duplicative refund under the general termination provisions of the MSA with respect to the same period of Unavailability.

**4.2 Service Level Credits.** If Lightspark fails to meet the Availability Commitment set forth above, it shall issue to Platform the following Service Level Credits as Platform's exclusive remedy and Lightspark's exclusive liability for such failure (expressed as a percentage of monthly Fees, prorated accordingly in the event of annual or quarterly Fees):

| System Availability (Monthly) | Service Level Credit (% of monthly Fees) |
| --- | --- |
| 99.9% – 99.0% | 5% |
| 98.9% – 97.0% | 10% |
| Below 97.0% | 25% |

Platform must request any Service Level Credit in writing within thirty (30) days of the month in which the Service Level Default occurred, and must provide reasonable evidence of the Unavailability. If Platform does not request a Service Level Credit within such period, Platform will be deemed to have waived its right to such credit. Service Level Credits may not be exchanged for, or converted to, monetary amounts.

**4.3 Root Cause Analysis.** In the event of a Service Level Default, Lightspark will perform a root cause analysis and upon request from Platform provide Platform with a written report, in accordance with Lightspark's standard practices, but not later than ten (10) Business Days from the date that Platform requested such report. The root cause analysis report shall include, at minimum: (a) a description of the incident and its impact; (b) the root cause of the Unavailability; (c) the corrective actions taken to resolve the incident; and (d) the preventive measures being implemented to avoid recurrence.

## 5. Technical Support

**5.1 General Support.** Lightspark will provide general advice and technical support on Business Days during Business Hours as well as technical assistance and remediation for operational issues as further described below. Platform may submit customer support requests (a) via email at support@lightspark.com, (b) by submitting a customer support ticket via support.lightspark.com, or (c) as set forth in Section 5.2.

**5.2 24/7 Support for Severity 1 Problems.** Lightspark will provide 24/7 support for Problems that Platform reasonably believes may constitute a Severity 1 Problem via (a) support-urgent@lightspark.com, or (b) by submitting a customer support request ticket identified as "Urgent Priority" via support.lightspark.com. Notwithstanding anything set forth in this SLA, Lightspark has no obligation to respond outside of Business Hours or Business Days unless the suspected Severity 1 Problem is reported using the methods set forth in this Section 5.2.

**5.3 Response Times.** Lightspark will use commercially reasonable efforts to correct all Problems and install enhancements or upgrades as necessary to operate the Service. Problems will be identified by Lightspark or reported by Platform and categorized by Lightspark as Severity 1 Problems, Severity 2 Problems, or Severity 3 Problems. Lightspark will use commercially reasonable efforts to adhere to the following response time frames:

| Problem Type | Target Response Time |
| --- | --- |
| Severity 1 Problem | 60 minutes |
| Severity 2 Problem | 1 Business Day |
| Severity 3 Problem | 3 Business Days |

## 6. Maintenance

**6.1 Scheduled Maintenance.** To maintain the performance and security of the Service, Lightspark may perform Scheduled Maintenance during which time the Service will be unavailable; provided that Scheduled Maintenance will be conducted between 12:00 a.m. (PT) and 8:00 a.m. (PT) on Sunday, unless the Parties agree otherwise in writing. Lightspark shall provide Platform with no less than seventy-two (72) hours' advance written notice of any Scheduled Maintenance.

**6.2 Emergency Maintenance.** From time to time, Lightspark may need to perform Emergency Maintenance of the Service and may not be able to provide Platform with advance notice. If Lightspark determines Emergency Maintenance is required, Lightspark will use commercially reasonable efforts to notify Platform as soon as reasonably possible, and to minimize disruptions to Platform. Lightspark shall use commercially reasonable efforts to minimize the amount of any Emergency Maintenance required.

## 7. Software Upgrades

**7.1 New Versions.** Lightspark may from time to time release new versions of the API or other APIs (each, an "API Update"). If an API Update includes changes that are not backward-compatible with the then-current version (a "Breaking Change"), Lightspark will provide Platform with reasonable advance written notice describing the Breaking Change and any migration steps required.

**7.2 Migration Period.** Platform must complete migration to the updated version of the API within three (3) months following Lightspark's notice of a Breaking Change (the "Migration Period"). Lightspark will use commercially reasonable efforts to maintain support for the prior version during the Migration Period, after which Lightspark may discontinue support for the deprecated version without further notice. Lightspark does not ensure backward compatibility of the API with any deprecated version after expiration of the applicable Migration Period.

**7.3 Critical Updates.** Notwithstanding Section 7.2, if Lightspark identifies an API Update as critical to the security, stability, or legal compliance of the Service (a "Critical Update"), Platform must apply the Critical Update within the time period specified by Lightspark in its notice, which may, in Lightspark's sole discretion, be shorter than the general Migration Period and may require immediate application in the event of a security vulnerability or regulatory requirement. If Platform fails to apply a Critical Update within the specified time period, Lightspark may suspend Platform's access to the affected Service until the Critical Update is applied.

**7.4 No Obligation to Upgrade Functionality.** For clarity, this Section 7 addresses API versioning and deprecation only. Nothing in this Section obligates Lightspark to release any API Update or to add new features or functionality to the API or the Service.

## 8. Exceptions to SLA Credits and Remedies

**8.1** Notwithstanding anything herein to the contrary, minutes in which the Service is not available due to any SLA Exclusion shall not be considered Unscheduled Outage Minutes or a failure to meet the System Availability commitment for the purposes of the calculation of System Availability or the determination of Service Level Credits.

**8.2** Service Level Credits are Platform's sole and exclusive remedy for any Service Level Default. Service Level Credits shall not be cumulative with any other remedies available to Platform under the Agreement with respect to the same incident or period of Unavailability, except for the termination right set forth in Section 4.1.

---

# Exhibit C — Information Security Requirements

This Exhibit sets forth the information security requirements applicable to each Party's handling of data in connection with the Agreement. Unless otherwise expressly defined below, the capitalized terms used herein have the meaning assigned to them in the Agreement.

## 1. Definitions

**1.1** For purposes of this Exhibit C, the following terms shall have the meanings set forth below:

- **(a) "End User Data"** means any data or information relating to an End User that is collected, received, created, or processed by either Party in connection with the Grid Transaction Services, including personal information, identity verification data, transaction data, and account information, whether such data originates from the End User directly (including through the End User Terms) or is transmitted by Platform to Lightspark.
- **(b) "Lightspark System"** means the systems, networks, software, and infrastructure owned or operated by or on behalf of Lightspark that are used to provide the Service.
- **(c) "Security Incident"** means any unauthorized access to, use of, disclosure of, modification of, or loss of Platform Data or End User Data, or any breach of a Party's security measures that could reasonably lead to the foregoing.
- **(d) "Security Program"** means a Party's then-current information security program, which includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Platform Data and End User Data against unauthorized disclosure, misuse, loss, or alteration.

## 2. Lightspark Security Responsibilities

**2.1** Lightspark shall comply with the following requirements during the Term:

- **(a) Security Program.** Lightspark shall implement and maintain a Security Program that complies with industry-standard practices to protect Platform Data and End User Data, including but not limited to: (i) the principles of SOC 2 (System and Organization Controls 2) for security and availability; and (ii) ISO 27001-equivalent controls where applicable.
- **(b) Background Checks.** Lightspark will conduct background checks on employees who will have access to Platform Data or End User Data, except where expressly prohibited by Applicable Law.
- **(c) Access Controls.** Lightspark shall: (i) restrict access to Platform Data and End User Data to authorized personnel on a need-to-know basis, using multi-factor authentication ("MFA"), role-based access controls ("RBAC"), and least-privilege principles; (ii) use secure authentication mechanisms for the Service; and (iii) revoke access credentials promptly upon termination of employment or authorization of any personnel.
- **(d) Encryption.** Lightspark shall: (i) encrypt Platform Data and End User Data at rest using AES-256 or equivalent or higher standards; and (ii) encrypt transmissions of Platform Data and End User Data in transit using TLS 1.3 or equivalent or higher standards.
- **(e) Business Continuity and Disaster Recovery.** Lightspark shall maintain a business continuity and disaster recovery ("BCP/DR") program designed to ensure the continued availability and resilience of the Service and the recovery of Platform Data and End User Data in the event of a major disruption. Lightspark shall: (i) maintain geographically distributed and redundant infrastructure for critical systems; (ii) conduct BCP/DR testing at least annually; and (iii) maintain recovery time objectives ("RTO") and recovery point objectives ("RPO") appropriate to the nature of the Service.
- **(f) Network Security.** Lightspark shall maintain network security controls, including: (i) firewalls and network segmentation to restrict unauthorized access to systems processing Platform Data or End User Data; (ii) intrusion detection and prevention systems; (iii) logging and monitoring of access to systems processing Platform Data or End User Data; and (iv) regular vulnerability scanning and penetration testing.
- **(g) Secure Development.** Lightspark shall maintain secure software development practices, including: (i) code reviews; (ii) security testing prior to deployment; and (iii) timely remediation of identified vulnerabilities.
- **(h) Physical Security.** Lightspark shall maintain reasonable physical security controls over any facilities from which personnel access Platform Data or End User data, including access controls, visitor management, and secure disposal of physical media.
- **(i) Compliance and Verification.** Lightspark shall: (i) perform annual third-party audits of its Security Program (e.g., SOC 2 Type II); and (ii) upon Platform's written request (no more than once per calendar year), provide its most recent SOC 2 Type II report and/or ISO 27001 certification. Such reports shall be treated as Lightspark's Confidential Information.

## 3. Platform Security Responsibilities

**3.1** Platform shall comply with the following requirements during the Term:

- **(a) Credentials.** Platform shall safeguard all API keys, access tokens, passwords, and other authentication credentials provided by Lightspark using industry-standard security practices, including: (i) storing credentials in encrypted form; (ii) restricting access to credentials to authorized personnel on a need-to-know basis; (iii) never embedding credentials in publicly accessible code repositories or client-side applications; and (iv) notifying Lightspark immediately and rotating credentials upon suspected or confirmed unauthorized access or disclosure.
- **(b) Compliance with Security Guidelines.** Platform shall follow all security guidelines, integration requirements, and technical specifications provided by Lightspark in its Documentation or otherwise communicated to Platform regarding the use of the Service and API.
- **(c) Security Program.** Platform shall implement and maintain a Security Program that meets or exceeds industry standards, including administrative, physical, and technical safeguards appropriate to the nature and sensitivity of data received through or processed in connection with the Service, comprising at minimum: (i) industry-standard security measures for the transmission and storage of data, including encryption of data in transit and at rest; (ii) adequate physical security of premises housing systems that access the Service or store data received through the Service; (iii) access controls based on business need, limiting access to authorized personnel using role-based access controls and least-privilege principles; (iv) regular employee training on security safeguards, acceptable use, and incident response; (v) network security programs, including firewalls, intrusion detection and prevention systems, and encryption; (vi) policies and procedures for the secure disposal and destruction of data that is no longer required to be retained; and (vii) logging and monitoring of access to systems processing data received through the Service.
- **(d) Equipment and Account Security.** Platform is solely responsible for obtaining and maintaining the security of all equipment, hardware, servers, software, operating systems, networking, and other technology used by Platform to connect to, access, or use the Service (collectively, "Equipment"), and for maintaining the security of all user accounts, passwords (including administrative and user passwords), API keys, and files associated with Platform's use of the Service. Platform is responsible for all access to and use of the Service through its accounts, credentials (including API keys and access tokens), or Equipment, whether or not authorized by Platform.
- **(e) Malware Prevention.** Platform shall ensure that viruses, malware, or other harmful code are not introduced to the Lightspark System and will notify Lightspark immediately after becoming aware of any security flaw or malware in any transmission. Platform is solely responsible for the security of data in its possession or control outside of the Service.

## 4. Security Incidents

**4.1 Notification.** Each Party shall promptly notify the other Party in writing after becoming aware of a confirmed Security Incident affecting Platform Data, End User Data, or the Service, and in no event later than forty-eight (48) hours after becoming aware of such Security Incident. Such notification shall include, to the extent known: (a) a description of the nature of the Security Incident; (b) the categories and approximate number of data subjects and data records concerned; (c) the likely consequences of the Security Incident; and (d) the measures taken or proposed to be taken to address the Security Incident and mitigate its effects.

**4.2 Lightspark Incident Response.** Lightspark shall investigate, contain, and remediate any Security Incident affecting the Lightspark System at its own expense and shall: (a) take reasonable steps to mitigate the effects of the Security Incident; (b) provide reasonable cooperation and assistance to Platform in connection with Platform's investigation and any required regulatory notifications; (c) preserve relevant evidence and logs; and (d) upon Platform's written request, provide a written summary of the Security Incident, the root cause (if determined), and the remediation measures taken.

**4.3 Platform Incident Response.** Platform shall investigate, contain, and remediate any Security Incident affecting Platform's systems at its own expense and shall: (a) take reasonable steps to mitigate the effects of the Security Incident; (b) provide reasonable cooperation and assistance to Lightspark in connection with Lightspark's investigation and any required regulatory notifications; (c) preserve relevant evidence and logs; and (d) upon Lightspark's written request, provide a written summary of the Security Incident, the root cause (if determined), and the remediation measures taken.

**4.4 Notification to End Users and Regulators.** Unless otherwise required by Applicable Law or agreed in writing by the Parties, Lightspark shall be responsible for providing any required notifications to End Users and regulatory authorities in connection with a Security Incident affecting End User Data to the extent caused by a breach of Lightspark's Security Program. Platform shall be responsible for providing any required notifications to End Users and regulatory authorities in connection with a Security Incident to the extent caused by a breach of Platform's Security Program or by Platform's systems, Equipment, or personnel. Each Party shall provide any required notifications to End Users and regulatory authorities within the timeframes required by Applicable Law, and in any event within thirty (30) days of confirming the Security Incident, unless a shorter period is required by Applicable Law.

## 5. Audits

**5.1 Security Certifications.** Upon Platform's reasonable request, Lightspark shall provide Platform with a copy of its most recent SOC 2 Type II report or ISO 27001 certification, subject to Lightspark's standard confidentiality requirements.

**5.2 Regulatory Audits.** Each Party shall cooperate with any audit, examination, or inquiry by a regulatory authority having jurisdiction over the Party or the Service, and shall provide the other Party with reasonable notice and cooperation in connection with any such audit, examination, or inquiry to the extent it relates to the other Party or the Service.

## 6. Subprocessors and Third Parties

Lightspark may engage subprocessors (including Grid Switch Partners and cloud infrastructure providers) to process Platform Data or End User Data in connection with the Service, provided that: (a) Lightspark shall remain directly responsible to Platform for the acts and omissions of its subprocessors; (b) Lightspark shall ensure that each subprocessor maintains security controls consistent with industry-standard practices and compliance frameworks, including SOC 2 Type II, ISO 27001, or equivalent security standards, verified through annual security due diligence reviews; and (c) upon Platform's written request, Lightspark shall provide a list of subprocessors that process Platform Data or End User Data.

## 7. Updates to Security Requirements

Lightspark may update the security requirements set forth in this Exhibit C from time to time to reflect changes in industry standards, regulatory requirements, or Lightspark's Security Program. Lightspark shall provide Platform with reasonable advance notice of any material changes to this Exhibit C. If a material change would materially diminish the protections afforded to Platform Data or End User Data, Platform may object in writing within thirty (30) days of receiving notice, and the Parties shall negotiate in good faith to resolve the objection.
