Donna Master Subscription Agreement

01Agreement structure and definitions

1.1 Orders. An Order Form (Order) signed by both parties states the purchased Service, subscription term, Authorized User capacity, usage allowances, fees, billing schedule, onboarding and support. Each Order incorporates this MSA by version and date. The Agreement consists of the Order, this MSA and any expressly incorporated addenda. An Order creates no obligation to buy future services.

1.2 Definitions. Affiliate means an entity that controls, is controlled by or is under common control with a party, where control means owning more than 50% of the voting interests. Authorized Users are individuals Customer permits to use its workspace within the purchased scope, including its lawyers, staff and contractors. Customer Data means content Customer or its Authorized Users submit to the Service, including documents, prompts, communications and case information. Documentation means Provider’s written user guides and descriptions of the Service identified in or supplied with the Order. Output means results the Service generates for Customer. Service means the Donna software and associated hosted functionality purchased in an Order. Subprocessor means a third party Provider engages to process Customer Data on its behalf.

1.3 Precedence. If documents conflict, the following order applies: (a) a signed business associate agreement (BAA) or data processing addendum (DPA), for its subject matter; (b) a mutually signed amendment; (c) an Order provision that expressly identifies an exception to this MSA, for that Order only; (d) this MSA; and (e) other incorporated documents. Terms in purchase orders, click-through screens or Provider’s website do not amend the Agreement.

02Access and customer responsibilities

2.1 Subscription right. Subject to the Agreement, Provider grants Customer a nonexclusive, nontransferable right during the subscription term for its Authorized Users to access and use the Service for Customer’s internal business purposes and to deliver services to its clients. Customer may share Output it has reviewed with its clients. Customer’s Affiliates may use the Service only if named in the Order, and Customer is responsible for their compliance.

2.2 Authorized Users and accounts. Customer controls user permissions and is responsible for its Authorized Users’ acts and omissions, account credentials and compliance with the Agreement. Each user login is for one individual. Customer will promptly notify Provider of suspected account compromise and reasonably assist with remediation.

2.3 Restrictions. Customer will not, and will not permit anyone to: (a) resell, sublicense or provide the Service to anyone other than Authorized Users; (b) share individual credentials or evade usage limits; (c) probe, scan or test the Service’s security without Provider’s written authorization, or disrupt or overload the Service; (d) introduce malicious code; (e) reverse engineer the Service, except to the extent applicable law permits despite this restriction; (f) use the Service to build a competing product or extract its models, prompts or data by automated means; or (g) use the Service unlawfully or to submit content Customer has no right to submit.

2.4 Professional responsibility. Customer is responsible for its compliance with the rules of professional conduct that apply to it, including supervising Authorized Users who are not lawyers, protecting client confidences and obtaining any client consents required to use the Service for a client matter.

2.5 Ownership and feedback. Provider and its licensors retain all rights in the Service, Documentation, underlying technology and improvements, excluding Customer Data and Customer’s rights in Output. No rights are granted except those expressly stated. If Customer or its Authorized Users provide suggestions or feedback about the Service, Provider may use them without restriction or obligation; feedback does not include Customer Data or Customer’s Confidential Information.

2.6 Publicity. Neither party will use the other’s name or logo in publicity, marketing or customer lists without the other’s prior written permission.

03Commercial terms and service delivery

3.1 Fees and payment. Customer will pay the subscription, implementation and usage fees stated in each Order. Unless the Order states otherwise, subscription fees are invoiced annually in advance and invoices are due 30 days after receipt. Fees are stated in US dollars and exclude sales, use, value-added and similar taxes, which Customer pays unless it provides a valid exemption certificate; Provider pays taxes on its own income. Automatic card or bank charges require Customer’s express authorization; choosing card or ACH payment in an Order authorizes Provider to charge that payment method according to the Order’s payment schedule. Undisputed amounts not paid when due accrue interest at 1% per month, or the maximum rate permitted by law if lower, from the due date until paid, and Customer will reimburse Provider’s reasonable costs of collecting them, including attorneys’ fees.

3.2 Committed term. A subscription for a stated term is a commitment for the full term, even when billed monthly or quarterly. Except for termination or refund rights expressly stated in the Agreement, committed fees are noncancelable and nonrefundable, and purchased quantities cannot be reduced during the term. Unused allowances expire at each stated reset date without rollover unless the Order states otherwise.

3.3 Capacity and usage. Unless an Order sets a usage limit, AI usage has no set limit for normal use by Authorized Users in Customer’s own work, subject to fair use. Fair use excludes automated or scripted access, bulk processing well beyond Customer’s ordinary course of work, and use by or for anyone other than Customer, except Customer’s work for its own clients as permitted by Section 2.1. If Customer’s usage is far above typical use for its plan, Provider will contact Customer to agree on a fit, such as a different plan at renewal, and may limit usage only after written notice and 10 days to discuss. Each Order will identify any usage units, how they are measured, reset periods, additional usage rates and any spending cap. Provider will make reasonable usage records available to Customer. Additional usage fees apply only at a metered rate stated in the Order or with the approval of a Customer representative authorized to approve purchases, whom Customer may designate and change in writing. Where no additional usage rate has been agreed, Provider may pause additional consumption at the purchased limit instead of charging a new fee.

3.4 Changes and invoice disputes. Additions to an Order require a written amendment, an additional Order or an authorized purchase approval that records quantities, rates, proration and end date. Customer must identify any invoice dispute in reasonable detail within 30 days of receipt and pay undisputed amounts on time. The parties will work in good faith to resolve disputes, and amounts disputed in good faith will not trigger suspension while Customer cooperates in resolving them.

3.5 Onboarding and implementation. Only the setup, training, migration or other services expressly scoped in an Order or signed statement of work are included. Each scope will specify deliverables, included hours or sessions, responsibilities and timing. Unless the Order states otherwise, included onboarding will be completed within 30 days after the Effective Date. Customer will supply timely personnel, access and materials. Customer-caused delays extend delivery schedules reasonably but do not defer subscription dates or fees unless agreed in writing. Additional work requires written scope and price approval before it begins.

3.6 Support and updates. Provider will provide the support stated in the Order or, if the Order is silent, email support on business days with a target response time of one business day, and will use commercially reasonable efforts to keep the Service available and maintained. Response targets are not resolution guarantees, and service levels or service credits apply only if an expressly incorporated service level agreement says so. Provider may update the Service but will not materially reduce the purchased core functionality or the agreed security safeguards during the current term. Future features, integrations and certifications are not promised unless the Order expressly commits to them.

3.7 Third party integrations. Customer decides whether to enable optional integrations with third party products and is responsible for its agreements with those vendors. Provider is responsible for its own processing and for its Subprocessors, but not for an integration provider’s separate service that Customer independently selects. The Order or Documentation will identify any third party integration on which purchased functionality depends.

04Data, confidentiality and security

4.1 Customer Data. Customer retains all rights in Customer Data. Customer grants Provider only the rights needed to host, process and transmit Customer Data to provide, secure and support the Service, to follow Customer’s documented instructions and to meet legal obligations. Provider personnel may access Customer Data only when needed for those purposes and are bound by confidentiality obligations. Customer represents that it has the rights and consents needed to submit Customer Data.

4.2 No model training; aggregated data. Provider will not use Customer Data or Output to train shared or general-purpose AI models, and will not permit its AI model providers to do so, unless Customer opts in through a separate signed agreement. Provider may use operational metrics and de-identified, aggregated data derived from use of the Service to operate, secure and improve the Service, only if that data contains no Customer Data and does not identify Customer, its clients or any individual. Provider will not sell Customer Data or use it for advertising.

4.3 Personal and regulated data. Each party will comply with privacy laws applicable to its performance. Where applicable law requires a DPA, the parties will sign one before the relevant processing begins. Customer will not submit data requiring a BAA or other special processing terms until the necessary agreement is signed and Provider confirms a supported configuration. Provider makes no representation of HIPAA compliance, certification or audit result except as expressly stated in a signed addendum.

4.4 Subprocessors. Provider will maintain a list of its Subprocessors, available to Customer on request, and will give Customer at least 15 days’ notice by email before adding or replacing a Subprocessor. If Customer objects on reasonable data protection grounds within that period and the parties cannot resolve the objection, Customer may terminate the affected Order and receive a prorated refund of unused prepaid subscription fees. Provider will bind each Subprocessor to data protection obligations at least as protective as the Agreement and remains responsible for its Subprocessors’ performance.

4.5 Safeguards. Provider will maintain reasonable administrative, technical and physical safeguards appropriate to the nature of Customer Data, including encryption of Customer Data in transit and at rest, access restricted to authorized personnel, and reasonable backup and recovery procedures. Any additional controls, hosting regions or retention commitments are as described in a signed security addendum or DPA. Provider will answer reasonable security questionnaires to support Customer’s security review, subject to confidentiality and protection of other customers’ information.

4.6 Security incidents. A Security Incident means unauthorized access to, or unauthorized acquisition, disclosure, loss or alteration of, Customer Data in systems controlled by Provider or its Subprocessors. Provider becomes aware of a Security Incident when its security or engineering personnel know of it or reasonably believe one has occurred. Provider will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident, or within any shorter period required by applicable law or a signed BAA or DPA. Where a signed BAA applies, its rules on when an incident is discovered, including what reasonable diligence would have revealed, also govern. The notice will include the material facts then available, mitigation steps and a contact, with updates as information develops. Provider will reasonably cooperate with Customer’s investigation, mitigation and legally required notices. Notice is not an admission of fault.

4.7 Legal requests for Customer Data. If Provider receives a subpoena, court order or government request for Customer Data, Provider will attempt to redirect the requester to Customer and, unless legally prohibited, will promptly notify Customer so it may seek a protective order or assert privilege. Provider will disclose only the Customer Data it is legally required to disclose.

4.8 Confidentiality. Confidential Information means Customer Data and either party’s nonpublic business, financial and technical information disclosed in connection with the Agreement. The recipient will protect Confidential Information with at least reasonable care, use it only to perform or exercise rights under the Agreement and disclose it only to personnel, advisers and service providers who need access and owe confidentiality duties at least as protective as these. These duties do not apply to information that is or becomes public without breach, was known to the recipient without restriction, is independently developed, or is lawfully received from another source without restriction. Disclosure compelled by law is permitted with prior notice where lawful and reasonable assistance in seeking protection. These duties last for three years after the Agreement ends, and for Customer Data and trade secrets for as long as they remain confidential. Using the Service does not waive any privilege or work-product protection that applies to Customer Data, though the Agreement does not determine whether any privilege applies.

05AI output and warranties

5.1 Human review. Donna is software that assists professional work. Provider is not a law firm, does not provide legal advice and is not a substitute for professional judgment. Customer remains responsible for legal advice, client obligations and decisions. Before relying on, filing or sharing Output, Customer must verify its accuracy, completeness, citations, current legal authority, calculations and deadlines. Output may contain errors or omissions and is not a guarantee of exhaustive review, a legal outcome or the discovery of every relevant fact.

5.2 Output rights. As between the parties, and to the extent permitted by law, Customer owns Output generated for it, and Provider assigns to Customer any rights it has in that Output, excluding the underlying Service technology and third party materials. Output may resemble results generated for others, may include third party content and may not qualify for intellectual property protection.

5.3 Express warranties. Each party represents that it has authority to enter into the Agreement. Provider warrants that during the paid subscription term the Service will materially conform to the functionality described in the Order and Documentation, and that implementation services will be performed in a professional manner with reasonable care. Customer will give prompt, detailed written notice of any material nonconformity, and Provider will use reasonable efforts to correct it within 30 days. If Provider does not correct it within that period, Customer may terminate the affected Order and receive a prorated refund of unused prepaid subscription fees, with remaining fees for the affected subscription cancelled. For deficient implementation services, Provider will reperform them and, if they are not reasonably corrected within that period, refund the fees paid for the deficient portion. These are Customer’s exclusive remedies for breach of these warranties.

5.4 Disclaimer. Except as expressly stated in the Agreement and to the extent permitted by law, the Service, Output and third party materials are provided as is. Provider disclaims all implied warranties, including merchantability, fitness for a particular purpose and noninfringement, and does not warrant uninterrupted or error-free operation, any particular savings or any professional outcome. This section does not reduce Provider’s confidentiality, security, indemnity or other express obligations.

06Term, termination and data return

6.1 Term and renewal. Each Order runs for its stated term. If an Order’s stated start date is earlier than its Effective Date, the term starts on the Effective Date and its end date moves by the same amount. Unless the Order states otherwise, it renews automatically for successive 12-month terms unless either party gives written notice of nonrenewal at least 30 days before the current term ends. If an Order states a renewal price increase, that increase applies on each renewal without further notice. Otherwise, Provider will give at least 60 days’ written notice before the end of a term of any price change for the renewal term; without timely notice, the existing rates apply to that renewal. Price changes never apply retroactively. Nonrenewal does not cancel fees owed for the current term. Either party may terminate this MSA by written notice when no Order is in effect.

6.2 Suspension. Provider may suspend access if undisputed fees are more than 15 days overdue and remain unpaid 10 days after Provider’s written warning. Provider may immediately suspend affected access where reasonably necessary to address unlawful use or a material security threat. Provider will give prompt notice, limit any suspension to what is reasonably necessary and restore access promptly once the issue is resolved.

6.3 Termination for breach. Either party may terminate an affected Order if the other party materially breaches the Agreement and does not cure the breach within 30 days after written notice. If Customer terminates for Provider’s uncured breach, Provider will refund unused prepaid subscription fees and remaining fees for the affected subscription are cancelled. If Provider terminates for Customer’s uncured breach, remaining committed fees for the current term become due, subject to applicable law. Either party may also terminate the Agreement immediately by written notice if the other becomes insolvent, makes an assignment for the benefit of creditors or becomes subject to bankruptcy proceedings that are not dismissed within 60 days.

6.4 Data return and deletion. When an Order ends, Customer’s right to use the affected Service ends. For 30 days afterward, Provider will allow Customer to export Customer Data through the Service’s export features or another reasonably agreed method, unless legally prohibited. Bulk migration or custom data transformation requires a separate scope. Provider will delete Customer Data from active systems within 60 days after the export period ends, and from backups in the ordinary course under its backup retention schedule. Customer Data retained in backups or as required by law remains protected under the Agreement and is used only for recovery or legal compliance. On request, Provider will confirm deletion in writing.

6.5 Survival. Accrued payment obligations and Sections 2.5, 4, 5.2, 5.4, 6.4, 6.5, 7 and 8 survive the end of the Agreement.

07Indemnities and liability

7.1 Provider indemnity. Provider will defend Customer against any third party claim alleging that the Service, as supplied by Provider and used in accordance with the Agreement, infringes a US patent, copyright or trademark or misappropriates a trade secret, and will pay damages finally awarded and settlements Provider approves. This obligation does not apply to the extent a claim arises from Customer Data, Customer modifications, use in breach of the Agreement, or combinations with products not supplied or required by Provider, nor to Output or third party materials. If the Service is, or Provider reasonably believes it may be, subject to such a claim, Provider may obtain the right for Customer to continue using it, modify or replace it without material loss of functionality, or terminate the affected Order and refund unused prepaid fees. This section states Customer’s exclusive remedy for infringement claims, subject to nonwaivable law.

7.2 Customer indemnity. Customer will defend Provider against any third party claim alleging that Customer Data, or Customer’s use of the Service or Output in breach of the Agreement or applicable law, infringes or violates a third party’s intellectual property, privacy or other rights, and will pay damages finally awarded and settlements Customer approves, except to the extent caused by Provider’s breach of the Agreement.

7.3 Indemnity procedure. The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defense and settlement, and provide reasonable cooperation at the indemnifying party’s expense. A delay in notice relieves the indemnifying party of its obligations only to the extent the delay materially prejudices it. No settlement may admit fault by, impose nonmonetary obligations on or require payment by the indemnified party without its consent, which will not be unreasonably withheld. The indemnified party may participate with its own counsel at its own cost.

7.4 Limitation of liability. To the extent permitted by law, neither party is liable for indirect, special, incidental, consequential or punitive damages, or for lost profits, revenue or business opportunities, however caused and under any theory of liability, even if advised of their possibility. Each party’s total aggregate liability arising out of or relating to the Agreement will not exceed the fees paid and payable under the affected Orders for the 12 months before the first event giving rise to liability. For claims arising from breach of Section 4 (Data, confidentiality and security) or from indemnity obligations, each party’s total aggregate liability will instead not exceed two times that amount, and these caps do not stack. None of these exclusions or caps limits Customer’s obligation to pay fees, either party’s liability for fraud or willful misconduct, or liability that cannot lawfully be limited.

08General terms

8.1 Governing law and venue. Texas law governs the Agreement, excluding its conflict-of-law rules. The state and federal courts located in the Texas county where Provider’s registered office is located have exclusive jurisdiction over any dispute arising out of or relating to the Agreement, and each party consents to their jurisdiction. Either party may seek interim injunctive relief in any court of competent jurisdiction to protect its Confidential Information or intellectual property.

8.2 Assignment. Neither party may assign the Agreement without the other’s prior written consent, which will not be unreasonably withheld, except that either party may assign it without consent to an Affiliate or to a successor in a merger, acquisition or sale of all or substantially all of its relevant business or assets, provided the assignee assumes the Agreement in writing and is not a competitor of the other party. Any other attempted assignment is void.

8.3 Force majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, such as natural disasters, war, terrorism, labor disputes, government action or failures of public utilities or networks, except for payment obligations. The affected party must promptly notify the other and use reasonable efforts to mitigate. If the Service is materially unavailable for 30 consecutive days because of such an event, Customer may terminate the affected Order and receive a prorated refund of unused prepaid subscription fees.

8.4 Notices. Notices must be in writing and sent to the notice email addresses in the Order, or to an updated address a party designates by notice. A notice sent by email is effective one business day after it is sent, unless the sender receives an automated message that it was not delivered, and a notice sent by courier is effective on delivery. Notices of breach, termination or an indemnifiable claim must also be marked as legal notices.

8.5 Compliance. Each party will comply with export control and sanctions laws applicable to its performance. Customer will not permit access to the Service from a sanctioned country or by a sanctioned person.

8.6 Relationship. The parties are independent contractors. The Agreement creates no partnership, joint venture, agency or fiduciary relationship, and there are no third party beneficiaries.

8.7 Entire agreement. The Agreement is the parties’ entire agreement regarding the purchased Service and supersedes all prior and contemporaneous proposals and agreements on that subject. Amendments and waivers must be in writing and signed by both parties; a failure to enforce a provision is not a waiver. If any provision is held unenforceable, it will be limited to the minimum extent necessary and the remainder will remain in effect. Headings are for convenience only, and “including” means including without limitation. The Agreement may be signed electronically and in counterparts.