Terms of Service

These Terms of Service (“Terms”) govern your access to and use of Outscope (“Service”), operated by Diverse Media Systems LLC, a California limited liability company (“Outscope,” “we,” “us,” or “our”).

By accessing or using the Service — including by sending email to any Outscope testing domain — you agree to these Terms. If you do not agree, do not use the Service.

PLEASE READ THESE TERMS CAREFULLY. THEY INCLUDE A BINDING ARBITRATION PROVISION AND A CLASS-ACTION WAIVER (SECTION 25), WHICH AFFECT HOW DISPUTES ARE RESOLVED.

1. Description of Service

Outscope provides a message testing, analysis, and quality assurance platform designed for development, staging, and testing environments. The Service currently focuses on email, and Outscope may, from time to time, extend the Service to support additional messaging channels (for example, SMS or social, chat, or other electronic messaging). References in these Terms to “email” apply equally to any such additional channel as the context permits. The Service may:

• Receive test emails
• Analyze email content and metadata
• Generate automated quality assessments
• Provide deliverability and authentication insights
• Generate automated reports and testing feedback (report depth varies by subscription tier; deeper AI-powered analysis generally requires a paid plan or available bonus or promotional credits)
• Provide an AI chat assistant and synthetic QA-agent features (availability varies by plan)

The Service is intended solely for testing and quality assurance purposes, regardless of the messaging channel used. Outscope may add, modify, or discontinue supported channels in accordance with Section 23 (Changes to the Service), and any change to these Terms required to support a new channel will be made in accordance with Section 24 (Changes to These Terms), including the Material Change notice requirements where applicable.

2. Eligibility, Commercial Use, and Geographic Availability

You must be at least 18 years old and capable of forming a binding contract to use the Service. If you use the Service on behalf of a company or other entity, you represent that you have authority to bind that entity to these Terms, and “you” includes that entity. In these Terms, “you” (also referred to as the “Customer”) means the individual or entity that has agreed to these Terms.

You represent and warrant that you are entering into these Terms for business, commercial, or professional purposes and not primarily for personal, family, or household use, regardless of whether you sign up using an individual or business email address.

The Service is currently offered to users in the United States. Visitors from other (non-sanctioned) locations may register interest but may not be able to create an account at this time.

The Service is not available in, and may not be accessed from, jurisdictions subject to comprehensive U.S. sanctions, and may not be used by persons on U.S. restricted-party lists. We enforce geographic restrictions at the network, sign-up, and processing layers. You represent that you are not located in such a jurisdiction, are not on any such list, and will not use the Service in violation of U.S. export-control or sanctions laws.

You may not use a virtual private network (VPN), proxy, anonymizer, false location or account information, or any other means to circumvent or attempt to circumvent our geographic or technical access controls, or to access or use the Service from, or on behalf of any person located in, a jurisdiction from which access is restricted. Any such circumvention or attempted circumvention is a material breach of these Terms and may result in immediate suspension or termination of your account without notice, in addition to any other rights or remedies available to us.

3. Intended Use

Outscope is designed for non-production testing environments. You agree that the Service is not intended for:

• Production customer communications
• Routine processing of personal information
• Protected Health Information (PHI)
• Payment card information
• Government-issued identifiers
• Regulated or highly sensitive information

If you choose to submit such information, you do so at your own risk and subject to these Terms.

4. Not a HIPAA Business Associate

Outscope is not a HIPAA Business Associate and does not enter into Business Associate Agreements. The Service is not designed for, and shall not be used to transmit, receive, store, or process Protected Health Information. Any transmission of PHI through the Service is a material breach of these Terms and may result in immediate account suspension and deletion of all associated data without notice.

5. Account Registration

To access certain features, you may be required to create an account. You agree to:

• Provide accurate information
• Maintain the confidentiality of account credentials
• Promptly notify us of unauthorized access
• Accept responsibility for activities occurring under your account

6. Customer Content

“Customer Content” includes emails, data, text, attachments, metadata, and other information submitted to the Service. You retain ownership of Customer Content.

You grant Outscope a limited, non-exclusive license to receive, store, process, analyze, transmit, display, and delete Customer Content solely for the purposes of operating, maintaining, securing, and providing the Service, and improving the Service’s features and reliability. This license does not include the use of identifiable Customer Content to train artificial-intelligence or machine-learning models. Nothing in this Section restricts Outscope’s creation and use of de-identified or aggregated data as permitted under the Data Processing Addendum.

7. Your Responsibilities

You represent and warrant that:

• You have the right to submit Customer Content to the Service
• Submission of Customer Content does not violate applicable law
• Submission of Customer Content does not violate contractual obligations owed to third parties
• You have obtained any permissions, consents, or authorizations required for your use of the Service
• Your use of the Service, and any communications you test or send through it, comply with applicable email, marketing, and privacy laws (including, as applicable, CAN-SPAM, the TCPA, the GDPR, and the CCPA)
• You have all rights, consents, and legal basis necessary under applicable law to submit third-party email content (including sender email addresses and message content) to Outscope for processing and to have Outscope generate and transmit an automated reply on your behalf as described in Section 11(a), and your own privacy policy or equivalent disclosures adequately describe your use of Outscope as a service provider or data processor for this purpose.

You are solely responsible for Customer Content submitted through your account or systems.

You are responsible for independently maintaining copies of any Customer Content or data you may need. The Service is a testing and quality-assurance tool and is not a system of record, backup, or archival service, and Outscope has no obligation to store, retain, or return Customer Content except as expressly set out in the Data Processing Addendum. To the maximum extent permitted by law, Outscope is not liable for any loss, deletion, or unavailability of Customer Content.

8. Prohibited Content and Activities

You may not use the Service to:

• Submit unlawful content
• Distribute malware or malicious code
• Conduct spam campaigns
• Circumvent security controls
• Access another user’s information
• Reverse engineer the Service
• Interfere with Service operations
• Violate applicable laws or regulations

You also agree not to intentionally submit:

• Protected Health Information (PHI)
• Payment card data
• Social Security numbers
• Government-issued identification numbers
• Production customer datasets
• Sensitive regulated information

unless separately authorized in writing by Outscope.

9. Sensitive Data Handling

The Service includes certain automated detection capabilities designed to identify categories of sensitive information. These controls are provided for convenience only. Outscope does not guarantee detection, redaction, quarantine, or deletion of sensitive information submitted by users. Users remain solely responsible for ensuring that submitted content is appropriate for the Service.

10. Shared Visibility Within Your Organization

Analysis history and records associated with a Customer’s account (including sender email addresses, subject lines, findings summaries, and scores or verdicts) are private to the individual account by default and are not visible to other users unless access is affirmatively authorized as described in this section.

Where this capability is available, a Customer may authorize specific individuals, identified by email address, to access shared analysis history or records associated with the Customer’s account or team. Access will not be granted automatically based on a shared email domain or organizational affiliation alone.

The Customer, and not Outscope, is responsible for determining which individuals are authorized to access shared history and for ensuring that such sharing is consistent with the Customer’s own internal policies and any obligations owed to the individuals whose information may appear in that history.

You represent and warrant that you have provided any notice, and obtained any consent, required under applicable law before authorizing shared visibility of records that identify or relate to a specific individual (including the sender’s email address and any personal data referenced in a findings summary). This obligation is in addition to, and not in place of, your representations elsewhere in these Terms regarding your own privacy notices and consents.

Records made visible under this section remain subject to the confidentiality, data-handling, and retention terms elsewhere in these Terms and the Outscope Privacy Policy.

11. Unsolicited Submissions to Testing Domains

Outscope operates email testing domains that receive email without prior configuration. If you send email to an Outscope testing domain — with or without an account — that email is a voluntary submission governed by these Terms and the Privacy Policy. Outscope assumes no obligation of confidentiality, no duty to analyze, respond to, preserve, or return unsolicited submissions, and no responsibility for content transmitted to its testing domains in error. Automated email replies sent through the Service fall into two distinct categories, described below. Subsection (a) (Customer-Attributed Replies) is the default and general rule and applies whenever a reply is sent to a sender associated with a Customer’s account; subsection (b) (Outscope-Initiated Replies) is a narrow exception that applies only to replies with no associated Customer account.

(a) Customer-Attributed Replies. Where an email is submitted in connection with a specific Customer’s account (for example, by or on behalf of that Customer’s systems under test) and Outscope generates an automated reply, that reply is sent by Outscope on the Customer’s behalf and identifies itself as an automated Outscope service. In that case, the Customer - and not Outscope - is the party on whose behalf the communication is made, and Outscope acts solely as the Customer’s service provider and processor with respect to the reply and the underlying Customer Content and does not use such content for its own independent purposes.

(b) Outscope-Initiated Replies (No Associated Customer). Where a third party sends an email to an Outscope testing address and no Customer account is associated with the submission, Outscope is the sender of any automated reply and is solely responsible for its own compliance with applicable law.

Any automated reply we send to an unsolicited submission includes the ability to opt out of further replies.

12. Outscope’s Rights Regarding Submitted Content

To protect the Service, its users, and third parties, Outscope reserves the right to refuse or reject content, remove content, quarantine content, suspend processing, restrict access, delete content, and suspend or terminate accounts, where we reasonably believe such action is necessary to address security, privacy, legal, operational, or abuse-related concerns. We are not obligated to monitor all content submitted to the Service.

Some decisions to refuse, reject, remove, quarantine, restrict, or suspend processing of content, or to restrict or suspend an account under this section, may be made by automated tools without human review.

13. Subscription and Billing

Certain features require a paid subscription. Subscription fees are billed monthly, in advance. Unless otherwise required by law:

• Fees are non-refundable
• Subscription changes take effect according to applicable billing terms
• Failure to pay may result in suspension or termination

Payment processing is provided by Stripe. Outscope does not receive or store payment card numbers.

Taxes. All fees are exclusive of taxes. You are responsible for all sales, use, value-added, goods-and-services, withholding, and similar taxes, duties, and governmental charges (excluding taxes based on Outscope’s net income) arising from your subscription to or use of the Service. If Outscope is required to collect or remit any such taxes, they will be added to your invoice.

Subscription auto-renewal. Paid subscriptions automatically renew at the end of each monthly billing cycle, and your payment method on file will be charged for the next cycle until you cancel. The recurring price and billing interval are disclosed at checkout before payment.

Cancellation. You may cancel at any time from your account’s self-service billing portal at /settings; cancellation takes effect at the end of the current billing cycle, and no early-termination fees apply. We will provide at least 30 days’ notice of any change to recurring pricing.

Free trial. Paid plans may be offered with a free trial (currently 7 days). During the trial you have full access to the paid features at no charge. Unless you cancel before the trial ends, your payment method on file will be automatically charged the then-current plan price ($15/month for Starter or $59/month for Pro, as selected at checkout) when the trial ends, and the subscription then continues under the auto-renewal terms above. The trial length and the price charged after the trial are disclosed at checkout before you provide payment details. You may cancel at any time before the trial ends — from your self-service billing portal at /settings — to avoid being charged. Free trials are limited to one per customer, and we may modify or discontinue trial offers at any time.

14. Referral Program and Promotional Credits

We may offer referral rewards and other promotional credits (“bonus credits”) — currently 50 bonus credits for a successful referral. Bonus credits do not expire while your account remains open and in good standing, but they have no cash or monetary value, are not refundable or transferable, and may be used only for AI-powered features within the Service (such as AI email analysis and QA-agent runs). Credits obtained through fraud, self-referral, automation, or other abuse may be revoked, and the associated accounts may be suspended. We may modify, suspend, or discontinue any referral or promotional program at any time; changes will not remove bonus credits already earned in good faith while your account remains open.

15. Beta and Experimental Features

The Service may include beta, preview, or experimental features (including features enabled for limited groups of users). Such features are provided “AS IS,” may change or be withdrawn at any time without notice, may be subject to additional limits, and are excluded from any commitments made elsewhere in these Terms regarding availability or functionality.

16. Rate Limits and Fair Use

The Service enforces rate limits, size limits, and per-sender ingestion limits to ensure platform stability, prevent abuse, and bound per-analysis cost. Limits vary by subscription tier and may be adjusted at our discretion based on operational needs, with material changes communicated through your account dashboard or email. Exceeding any limit may result in temporary throttling, deferred analysis, deterministic-only (rules-based) results, or — for sustained or abusive patterns — account suspension. For your current account’s limits, see your account dashboard or contact billing@outscope.ai.

17. Intellectual Property; Feedback

The Service, including software, designs, trademarks, documentation, and related materials, is owned by Diverse Media Systems LLC or its licensors and is protected by copyright, trademark, and other intellectual-property laws. Except as expressly permitted, no rights are granted to you beyond those necessary to use the Service.

If you provide suggestions, ideas, or other feedback about the Service, you grant Diverse Media Systems LLC a perpetual, irrevocable, worldwide, royalty-free license to use that feedback for any purpose, without obligation or compensation to you. Feedback does not include Customer Content.

18. Disclaimer of Warranties

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUTSCOPE DISCLAIMS ALL WARRANTIES, INCLUDING:

• MERCHANTABILITY
• FITNESS FOR A PARTICULAR PURPOSE
• NON-INFRINGEMENT
• ACCURACY OF RESULTS
• AVAILABILITY OR UPTIME
• DETECTION OF EVERY DEFECT, ERROR, SENSITIVE-DATA INSTANCE, OR COMPLIANCE ISSUE IN CONTENT SUBMITTED FOR ANALYSIS

Analysis results, scores, recommendations, and AI-generated outputs are informational only and should not be relied upon as legal, compliance, security, or business advice. Use of the Service does not create any fiduciary, professional-services, or advisory relationship, and does not ensure that your communications comply with any law or standard.

19. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUTSCOPE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES. THIS INCLUDES DAMAGES ARISING FROM:

• LOSS OF DATA
• LOSS OF BUSINESS
• LOSS OF PROFITS
• SERVICE INTERRUPTION
• SECURITY INCIDENTS
• CONTENT SUBMITTED BY USERS
• THIRD-PARTY ACTIONS

OUTSCOPE’S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS, IN THE AGGREGATE ACROSS ALL CAUSES OF ACTION, SHALL NOT EXCEED THE GREATER OF: (A) THE AMOUNT PAID BY YOU TO OUTSCOPE DURING THE TWELVE (12) MONTHS PRECEDING THE CLAIM; OR (B) ONE HUNDRED U.S. DOLLARS ($100). THE EXISTENCE OF MORE THAN ONE CLAIM WILL NOT ENLARGE THIS LIMIT. THESE LIMITATIONS APPLY REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE), EVEN IF OUTSCOPE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, ANY CLAIM ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS, WHETHER BROUGHT BY YOU OR BY OUTSCOPE, MUST BE FILED WITHIN ONE (1) YEAR AFTER THE CLAIM ACCRUES, OR IT IS PERMANENTLY BARRED.

20. Indemnification

You agree to defend, indemnify, and hold harmless Diverse Media Systems LLC (including the Outscope service), its members, managers, officers, employees, contractors, and affiliates from claims, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising from:

• Your use of the Service
• Customer Content submitted by you
• Violation of these Terms
• Violation of applicable law, including email, marketing, and privacy laws
• Violation of third-party rights

These Terms do not require Outscope to indemnify you or any third party.

Outscope will provide you with notice of any claim subject to indemnification (provided that any failure or delay in providing notice will not relieve you of your obligations except to the extent you are materially prejudiced). Outscope may, at its option, assume and control the defense and settlement of any such claim with counsel of its choice, in which case you will reimburse the reasonable costs and attorneys’ fees Outscope incurs. You may not settle or compromise any claim in a manner that imposes any obligation or liability on, requires any admission or payment by, or adversely affects the rights of, Outscope without Outscope’s prior written consent. You will provide reasonable cooperation in the defense of any indemnified claim.

21. Privacy

Use of the Service is also governed by the Outscope Privacy Policy, which is incorporated into these Terms by reference.

To the extent Outscope processes personal data on your behalf in connection with the Service, that processing is also governed by the Outscope Data Processing Addendum, which is incorporated into these Terms by reference.

22. Suspension and Termination

Outscope may suspend or terminate access to the Service at any time if these Terms are violated, security risks are identified, abuse is detected, it is required by law, or it is necessary to protect the Service or its users. Upon termination, your right to use the Service will immediately cease. Provisions that by their nature should survive termination — including Intellectual Property and Feedback, Disclaimer of Warranties, Limitation of Liability, Indemnification, and Dispute Resolution — will survive.

Some suspension, restriction, or termination decisions may be made by automated tools without human review.

23. Changes to the Service

We may modify, suspend, discontinue, or update the Service at any time. We are not liable for modifications or discontinuation of Service features.

24. Changes to These Terms

We may modify these Terms from time to time. We will provide notice of changes by posting the updated Terms and updating the “Last updated” date. Except with respect to Material Changes, continued use of the Service after changes become effective constitutes acceptance of the revised Terms. When you create an account or complete a subscription checkout, we record the version of the Terms you accepted and the time of acceptance.

A “Material Change” means any of the following: (i) any change to the dispute resolution and arbitration provisions in Section 25; (ii) any change to the scope or price of the Service or to the frequency or method of payment; or (iii) any change required by a new or amended law or regulation. Changes that do not meet this definition are non-material and remain governed by the notice-and-continued-use provision described above.

For a Material Change, in addition to the general notice described above, we will send an email notice to the account holder at the email address on file. Continued use of the Service after such notice constitutes acceptance of the revised Terms.

25. Dispute Resolution — Arbitration and Class-Action Waiver

PLEASE READ THIS SECTION CAREFULLY — IT REQUIRES ARBITRATION OF DISPUTES ON AN INDIVIDUAL BASIS AND WAIVES JURY TRIALS AND CLASS ACTIONS.

Informal resolution first. Before filing any claim, you agree to contact us at legal@outscope.ai with a written description of the dispute and give us 60 days to work together in good faith to resolve it informally. Most concerns can be resolved this way.

Binding arbitration. Except as provided below, any dispute arising out of or relating to these Terms or the Service that is not resolved informally shall be resolved by binding arbitration on an individual basis, administered by the American Arbitration Association under its Commercial Arbitration Rules. The Federal Arbitration Act governs this provision. The arbitration will be conducted in California or, where available, remotely by videoconference or on written submissions.

Exceptions. Either party may (a) bring an individual claim in small-claims court, or (b) seek injunctive or other equitable relief in court for actual or threatened infringement or misuse of intellectual property or for unauthorized access to the Service.

Class-action and jury waiver. ALL CLAIMS MUST BE BROUGHT IN THE PARTIES’ INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE CLAIMS OR PRESIDE OVER ANY FORM OF REPRESENTATIVE PROCEEDING. EACH PARTY WAIVES THE RIGHT TO A TRIAL BY JURY. If the class-action waiver is found unenforceable as to a particular claim, that claim (and only that claim) shall proceed in court, and the waiver shall remain enforceable as to all other claims. Nothing in this section waives claims for public injunctive relief where such waiver is prohibited by law.

26. Governing Law

These Terms shall be governed by the laws of the State of California, without regard to conflict of law principles. Subject to the Dispute Resolution section above (including its small-claims and equitable-relief exceptions), any dispute that is not subject to arbitration shall be brought exclusively in the state or federal courts located in California, and the parties consent to personal jurisdiction and venue there.

27. Order Forms

These Terms constitute the master terms governing your access to and use of the Service. Discrete projects, customizations, or enterprise arrangements may be documented in one or more supplemental order forms or insertion orders (each, an “Order Form”) that incorporate these Terms by reference. Each Order Form is subject to and governed by these Terms. In the event of a conflict between an Order Form and these Terms, these Terms will control, except that the Order Form will control solely with respect to the specific scope, deliverables, pricing, or other matters expressly addressed in that Order Form.

Miscellaneous

Severability. If any provision of these Terms is held invalid or unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

Entire agreement. These Terms, together with the Privacy Policy, any Order Forms entered into by the parties, and any terms presented at checkout, constitute the entire agreement between you and Diverse Media Systems LLC regarding the Service and supersede all prior or contemporaneous agreements on that subject.

Assignment. We may assign these Terms (including in connection with a merger, acquisition, or sale of assets). You may not assign these Terms or your account without our prior written consent; any attempted assignment in violation of this provision is void.

No waiver. Our failure to enforce any provision of these Terms is not a waiver of the right to enforce it later.

Force majeure. Outscope is not liable for any delay or failure to perform caused by events beyond its reasonable control, including acts of God, natural disasters, labor disputes, utility or internet failures, cloud-provider outages, governmental actions, or security incidents caused by third parties.

No third-party beneficiaries. These Terms do not confer any rights on any third party.

Notices. We may provide notices to you via the email address on your account or through the Service; notices are deemed received when sent. Legal notices to Outscope must be sent to legal@outscope.ai.

Contact Information

For questions regarding these Terms:

legal@outscope.ai

Diverse Media Systems LLC

California, United States

Data Processing Addendum

This Data Processing Addendum ("DPA") is incorporated into and forms part of the Outscope Terms of Service (the "Terms") between Diverse Media Systems, LLC, d/b/a Outscope ("Outscope," "we," "us") and the entity or individual identified as "Customer" in the Terms ("Customer," "you"). This DPA applies automatically, without further action, whenever Customer's use of the Service involves the processing of Personal Data as described below. Capitalized terms not defined in this DPA have the meanings given in the Terms.

1. Definitions

• "Personal Data" means information relating to an identified or identifiable individual that Outscope processes on Customer's behalf in connection with the Service, including sender email addresses, message subject lines, and message content submitted to or received through the Service.
• "Data Protection Laws" means the California Consumer Privacy Act as amended by the California Privacy Rights Act and its implementing regulations, and any other U.S. state, federal, or other applicable law governing the privacy or protection of personal data, in each case to the extent applicable to the processing of Personal Data under this DPA.
• "Business" and "Service Provider" have the meanings given under the CCPA/CPRA, and correspond respectively to Customer and Outscope for purposes of this DPA, except where a different Data Protection Law uses different terminology (e.g., "controller" and "processor"), in which case those terms apply as the context requires.
• "Security Incident" means a confirmed unauthorized access to, or acquisition, disclosure, alteration, or destruction of, Personal Data processed by Outscope under this DPA.
• "Subprocessor" means a third party engaged by Outscope to process Personal Data in connection with providing the Service.

2. Roles of the Parties

For Personal Data processed under this DPA, Customer is the Business and Outscope is the Service Provider. Outscope will process Personal Data only as a Service Provider, and not as an independent Business, except as permitted under Section 6.

Outscope will comply with the applicable requirements of Data Protection Laws applicable to it as a Service Provider and will provide the same level of privacy protection to Personal Data as is required of businesses under the CCPA/CPRA. Outscope certifies that it understands the restrictions set out in this DPA and will comply with them.

To enable Customer to take reasonable and appropriate steps to help ensure that Outscope’s use of Personal Data is consistent with Customer’s obligations under Data Protection Law, Outscope will, on Customer’s reasonable written request and no more than once every twelve (12) months (unless more frequently required by a supervisory authority or following a Security Incident), make available a summary of its then-current technical and organizational measures or a relevant third-party audit or certification report. On-site audits are not required except to the extent mandated by applicable Data Protection Law and, where so mandated, will be conducted on reasonable prior notice, during normal business hours, no more than once per year, subject to Outscope’s reasonable confidentiality and security requirements, and at Customer’s expense.

3. Scope and Purpose of Processing

Outscope processes Personal Data solely to provide the Service to Customer, as further described in Exhibit A. Outscope will not process Personal Data for any purpose other than the business purposes specified in Exhibit A, the Terms, and Customer's documented instructions, unless required to do so by law.

4. Customer's Instructions

Outscope will process Personal Data only in accordance with Customer's documented instructions, which are given by Customer's use of the Service and configuration of its account. If Outscope believes an instruction violates Data Protection Law, Outscope will notify Customer and may suspend performance of that instruction until the parties resolve the issue.

5. Confidentiality

Outscope will ensure that personnel authorized to process Personal Data are subject to a duty of confidentiality with respect to that data.

6. Use Restrictions

Outscope will not:

• sell or share Personal Data, as those terms are defined under the CCPA/CPRA;
• retain, use, or disclose Personal Data for any purpose other than the business purposes specified in Exhibit A, or as otherwise permitted by Data Protection Law;
• retain, use, or disclose Personal Data outside the direct business relationship between Outscope and Customer, including by combining Personal Data received from Customer with personal data received from another customer or source, except that Outscope may create and use de-identified or aggregated data as described in Section 11.
• Nothing in this Section limits Outscope’s ability to retain, use, or disclose Personal Data to the extent permitted for a service provider under the CCPA/CPRA, including: (a) for Outscope’s internal use to build or improve the quality of the services it provides to Customer, provided that Outscope does not use the Personal Data to perform services on behalf of another person; (b) to detect, prevent, or investigate data security incidents, or to protect against malicious, deceptive, fraudulent, or illegal activity; and (c) for the purposes enumerated in California Civil Code section 1798.145(a)(1)–(a)(7). This Section does not permit Outscope to sell or share Personal Data.

7. Subprocessors

Customer authorizes Outscope to engage the Subprocessors listed in Exhibit B to process Personal Data. Outscope will impose data protection obligations on each Subprocessor that are substantially consistent with this DPA.

8. Security Measures

Outscope will maintain commercially reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, as further described in Exhibit C.

9. Security Incident Notification

Outscope will notify Customer without undue delay after confirming a Security Incident affecting Customer's Personal Data, and will provide the information reasonably available to Outscope to help Customer meet its own notification obligations under applicable law. Outscope’s notification is not an acknowledgment of fault or liability. This notification obligation is in addition to, and not in place of, the security incident notification provisions in the Terms.

10. Assistance with Individual Rights Requests

If Outscope receives a request from an individual seeking to exercise rights under Data Protection Law with respect to Personal Data processed under this DPA, Outscope will not respond directly (except to direct the individual to Customer) and will promptly forward the request to Customer. Outscope will provide reasonable assistance to help Customer respond to verified requests, taking into account the nature of the processing. Assistance beyond what is required of a Service Provider under applicable Data Protection Law will be provided at Customer’s reasonable expense.

11. De-Identified and Aggregate Data

Notwithstanding Section 6, Outscope may create and use data that has been de-identified or aggregated such that it can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual, for purposes including product improvement, trial and abuse prevention, and analytics. Outscope will maintain and use de-identified data only in a de-identified fashion, will not attempt to re-identify it except to determine whether its de-identification process satisfies applicable legal requirements, and will contractually obligate any recipient of de-identified data to comply with these same restrictions, consistent with CCPA/CPRA requirements for de-identified information.

12. Return and Deletion of Data

Upon expiration or termination of the Terms, or upon Customer's written request, Outscope will delete or return Personal Data within a commercially reasonable period, except to the extent Outscope is required or permitted to retain it by law or as described in Outscope's then-current Retention Policy (for example, residual copies in encrypted backup systems pending the ordinary backup cycle, or hashed data retained solely for trial-abuse prevention that no longer identifies an individual).

13. Other Data Protection Laws

This DPA is designed to satisfy applicable U.S. data protection law requirements for service provider or processor contracts. If Customer's use of the Service involves the personal data of individuals located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction whose law imposes additional or different requirements on data processing agreements (such as the EU or UK GDPR), Customer must notify Outscope before submitting such data through the Service, and the parties will execute a supplemental module (including, if applicable, the European Commission's Standard Contractual Clauses or the UK's International Data Transfer Addendum) before that processing begins. Outscope may decline to process Personal Data subject to such laws until an appropriate supplemental module is in place.

14. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set forth in Section 19 of the Terms, which apply to this DPA as if fully set forth herein.

15. Term and Order of Precedence

This DPA remains in effect for as long as Outscope processes Personal Data on Customer's behalf under the Terms. In the event of a conflict between this DPA and the Terms regarding the processing of Personal Data, this DPA controls; the Terms control as to all other matters.

16. Miscellaneous

This DPA is governed by the same governing law and dispute resolution provisions set forth in the Terms.

Exhibit A – Description of Processing

Subject matter: Provision of the Outscope email quality assurance, deliverability, and compliance analysis service.

Duration: For as long as Customer's account remains active, plus any additional period described in Outscope's Retention Policy.

Nature and purpose of processing: Receiving, analyzing, and generating reports on email messages submitted to or sent to addresses associated with Customer's account; generating automated replies as described in Section 11 of the Terms; detecting and flagging (by description only, not by extracting or retaining the underlying value) potential sensitive identifiers such as Social Security numbers appearing in message content.

Categories of data subjects: Customer's authorized users; third-party individuals who send email to an Outscope testing address in connection with Customer's use of the Service.

Categories of Personal Data: Sender email addresses, message subject lines, message content, and related metadata; descriptions (not values) of any detected sensitive identifiers.

Categories of recipients: Outscope personnel and Subprocessors with a need to know, as necessary to provide the Service.

Exhibit B – Subprocessors

Exhibit C – Security Measures

Outscope maintains technical and organizational measures designed to protect Personal Data, including encryption of data in transit and at rest, access controls limiting internal access to Personal Data on a need-to-know basis, and defined data retention and deletion practices as described in Outscope's internal policies.