SPIN Pulse
by Colab91
Terms of Service, Privacy Policy, and Data Processing Addendum
Effective Date: September 3, 2026
Colab91 Inc.
1325 Main Street, Suite 1404
Katy, Texas 77494, USA
spin@colab91.com
PLEASE READ CAREFULLY BEFORE YOU ACCEPT
These Terms govern your use of SPIN Pulse. By checking the box marked "I agree to the Terms" at signup, you are entering into a binding legal agreement with Colab91 Inc. on behalf of the business you represent. If you are not authorized to bind that business, or if you do not agree with these Terms, do not check the box and do not create an account.
Key things you are agreeing to:
You are signing up on behalf of a business (not as an individual consumer).
SPIN Pulse has three tiers: a Free tier (view-only, no payment method required), a 7-day Trial that unlocks the analytical layer, and a Paid Subscription (monthly or annual) that unlocks the opportunity toolkit. If you start a Trial and do not cancel by day 7, your payment method is charged the one-time setup fee plus your first subscription payment. See Section 4 and Section 5.
We use anonymized, aggregated data from your account to improve the Service for everyone. See Section 11.
You must not upload personal data of employees, consumers, patients, cardholders, or other categories listed in Section 9.
You agree that for any data you upload to the Service, you are authorised to do so.
PART A — TERMS OF USE
1. Definitions
Capitalized terms used in these Terms have the meanings given below.
"Colab91", "we", "us", "our" means Colab91 Inc., a company organized under the laws of the State of Delaware, USA, with offices at 1325 Main Street, Suite 1404, Katy, Texas 77494.
"You", "your", "Customer" means the business entity you represent when you accept these Terms.
"Authorized User" means an employee, contractor, or agent of the Customer to whom the Customer grants access to the Service through a Seat.
"Service" or "SPIN Pulse" means the SPIN Pulse spend-intelligence application, including the ingestion, cleaning, supplier normalization, classification, opportunity assessment, dashboards, chat interface ("Spinny"), APIs, and any related features made available by Colab91 to the Customer.
"Customer Data" means the data files uploaded by the Customer to the Service (such as accounts payable, purchase order, purchasing-card, vendor master, and contract data), together with the outputs derived specifically for the Customer (such as the Customer's spend cube and dashboards).
"Aggregated Data" means metadata, statistical, and benchmark data derived from Customer Data that has been de-identified so that it does not identify the Customer or any natural person, and that is combined with data from other customers. Aggregated Data is not Customer Data.
"Seat" means a single, individually named user license entitling one Authorized User to access the Service.
"Subscription" means a Paid Subscription to the Service on a monthly or annual billing plan, as selected by the Customer at conversion from Trial or at direct signup.
"Trial" means the seven (7) calendar day trial of the Service described in Section 4.2.
"Setup Fee" means the one-time setup fee described in Section 5.2.
"Order" means the pricing and Seat selection the Customer confirms at checkout, which is deemed incorporated into these Terms.
"Feedback" means any suggestion, correction, comment, or classification override that a Customer or Authorized User submits about the Service or its outputs.
2. The Service
SPIN Pulse is a self-serve, cloud-hosted spend-intelligence platform. The Customer uploads its own spend and supplier data; the Service ingests those files, cleans and normalizes them, classifies suppliers and transactions against a proprietary taxonomy, produces a spend cube, and surfaces opportunity and savings insights through dashboards and the Spinny chat interface.
SPIN Pulse is a self-service product. Colab91 does not select, validate, or curate the data the Customer uploads. The Customer is solely responsible for the accuracy, legality, and content of Customer Data, and for ensuring that it has all rights necessary to upload that data to the Service.
3. Eligibility and Account Registration
The Service is available only to businesses. By creating an account, you represent and warrant that:
You are at least 18 years of age;
You are creating the account on behalf of a legal business entity, and not as an individual consumer;
You have full legal authority to bind that entity to these Terms;
All information you provide at signup (including business name, business address, and payment information) is accurate and complete; and
Your business is not located in, and you are not accessing the Service from, a country or region subject to comprehensive US trade sanctions (currently Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions), and you are not a person or entity on the US Treasury OFAC SDN list or any equivalent sanctions list.
Colab91 may verify the information provided at signup and may suspend or terminate any account where the representations above prove to be inaccurate.
You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Sharing credentials is prohibited (see Section 8).
4. Service Tiers
SPIN Pulse is offered in three tiers. Eligibility (Section 3) and the terms of these Terms apply to all three.
4.1 Free tier
View-only access to the Customer's own uploaded spend data at the summary level. No payment method is required. The Free tier is available indefinitely, subject to Colab91's right to modify features under Section 22.
4.2 Seven-day Trial
A 7-day trial that opens the full analytical layer of the Service. A valid payment method is required to start a Trial. The Customer's card will not be charged during the Trial. Trial features do not include actions reserved for Paid Subscribers (such as supplier reclassification), as displayed at signup.
The Trial is available once per Customer account. If the Customer has previously used a Trial or has previously been a Paid Subscriber, no further Trial is available.
The Customer may cancel at any time during the Trial through the in-app cancellation option or by writing to spin@colab91.com. If the Customer cancels before the end of day 7, no charge will be made; access to Trial features ends at cancellation and the account reverts to the Free tier.
4.3 Paid Subscription
Full access to the analytical and opportunity layers of the Service. Paid Subscriptions are offered on monthly or annual billing plans, both subject to a one-time setup fee. Billing mechanics are set out in Section 5.
5. Billing, Renewal, and Cancellation
5.1 Conversion from Trial to Paid Subscription
If the Customer does not cancel by the end of day 7 of the Trial, the Trial converts automatically to a Paid Subscription on day 8. At that point, Colab91 (through its payment processor, Stripe) will charge the Customer's payment method (a) the one-time setup fee applicable to the selected plan, plus (b) the first billing cycle fee for the selected plan (monthly or annual). By providing a payment method and accepting these Terms, the Customer expressly authorizes these charges.
The Customer may also convert to a Paid Subscription before the end of the Trial by selecting the option in the Service, in which case the setup fee and first billing cycle fee are charged at conversion.
5.2 One-time setup fee
A one-time setup fee applies to each Paid Subscription. The setup fee is non-refundable. The setup fee is charged once per Customer account and does not apply again in respect of subsequent renewals within the same account.
If the Customer terminates a Paid Subscription and starts a new Paid Subscription for the same account within the ninety (90) day retention period described in Section 20, the setup fee will not apply to the new Subscription. If the Customer starts a new Paid Subscription after the 90-day retention period has expired (at which point Customer Data has been permanently deleted), the setup fee will apply again. See Section 20.6.
The current setup fee is displayed at checkout together with the applicable subscription fee.
5.3 Subscription plans and pricing
The Customer selects at checkout either a monthly plan or an annual plan, together with the number of Seats. The applicable subscription fee is set out in the Customer's Order at checkout, in the currency displayed. Unless expressly stated otherwise, fees are exclusive of any taxes, duties, or withholdings, which are the Customer's responsibility.
Pricing is tiered by Seat count and usage entitlements, as displayed on the Colab91 pricing page or at checkout.
5.4 Billing cycles
Subscription fees are billed in advance. A monthly plan is billed in one-month cycles; an annual plan is billed in one-year cycles. Each cycle begins on the same calendar day of the month (or year) as the day the Subscription first began (or, where that day does not exist in a given period, the last day of that period). At the start of each cycle the Customer's payment method will be automatically charged the subscription fee for that cycle.
5.5 Auto-renewal
The Subscription renews automatically at the end of each billing cycle for a further cycle of the same length, and continues to renew until the Customer cancels. By accepting these Terms, the Customer expressly consents to this automatic renewal and to the corresponding recurring charges to the payment method on file.
Colab91 will send an email reminder to the Customer's account email address at least seven (7) days before each monthly renewal, and at least thirty (30) days before each annual renewal, confirming the upcoming charge amount and the date it will be made. It is the Customer's responsibility to keep the account email address current.
5.6 Cancellation
The Customer may cancel the Subscription at any time through the in-app cancellation option in account settings or by writing to spin@colab91.com. Cancellation takes effect at the end of the then-current billing cycle. The Customer will retain access to the Service through the end of the cycle for which payment has already been made.
5.7 No refunds
Except where required by applicable law, all fees are non-refundable. This includes the setup fee and any partial period of a monthly or annual cycle. Colab91 does not provide refunds or credits for partially used cycles, for features not used, or for the Customer's dissatisfaction with the Service. This includes cases where the Customer forgets to cancel before a renewal charge is made.
5.8 Price changes
Colab91 may change the fees (including the setup fee, monthly subscription fees, and annual subscription fees) from time to time. Any fee increase will take effect no earlier than thirty (30) days after Colab91 notifies the Customer by email. If the Customer does not accept the new fee, the Customer's sole remedy is to cancel the Subscription before the new fee takes effect.
5.9 Payment failure
If a scheduled charge fails (for example, because the card on file has expired, has insufficient funds, or is declined), access to paid features of the Service will be locked immediately upon the failed charge. The account will remain locked until a valid payment method is provided and the outstanding balance is successfully charged. If the balance remains unpaid for thirty (30) days after the failed charge, Colab91 may terminate the Subscription and delete Customer Data in accordance with Section 20.
5.10 Taxes
The Customer is responsible for all sales, use, VAT, GST, and similar taxes assessed on the fees, other than taxes based on Colab91's net income. If Colab91 is required to collect any such tax, it will be added to the invoice.
6. Seats and the One-Machine Rule
Each Seat entitles one (1) Authorized User to access the Service. Seats are per-user and non-transferable within an active session. Credentials must not be shared. Multiple people using the same credentials is a breach of these Terms.
One machine at a time. A single Seat may only be used on one device at a time. If the same credentials are used to sign in on a second device while an active session exists on the first, the earlier session will be terminated automatically and the Authorized User will be signed out of the first device. This is enforced by a concurrent-session limit at the platform level.
If the Customer requires simultaneous access on multiple devices for the same user, or access for more than one Authorized User, the Customer must purchase additional Seats through the Order.
The Customer is responsible for all activity that occurs under its account, including the acts and omissions of Authorized Users and any third party who obtains access through the Customer's credentials. The Customer must promptly notify Colab91 at spin@colab91.com of any suspected unauthorized use of the account.
7. License Grant
Subject to the Customer's compliance with these Terms and payment of applicable fees, Colab91 grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable license during the term of the Subscription to access and use the Service, solely for the Customer's own internal business purposes.
No other rights are granted by implication, estoppel, or otherwise. All rights not expressly granted are reserved by Colab91.
8. Acceptable Use
The Customer will not, and will not permit any Authorized User or third party to:
Access or use the Service other than as expressly permitted by these Terms;
Share credentials, transfer a Seat, or otherwise permit access to the Service by anyone who is not an Authorized User with a valid Seat;
Copy, modify, translate, adapt, or create derivative works of the Service or any part of it;
Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, models, taxonomy, or benchmark library of the Service, except to the extent this restriction is prohibited by applicable law;
Remove, obscure, or alter any proprietary notice on the Service;
Access the Service in order to build a competing product or service, to copy features, or to benchmark the Service for a competing product;
Use the Service to transmit or store any content that is unlawful, infringing, defamatory, obscene, harassing, or that violates the intellectual property, privacy, or other rights of any third party;
Use the Service to transmit malware, viruses, or other harmful code, or to conduct any denial-of-service or intrusion activity;
Circumvent, disable, or otherwise interfere with authentication, security, session limits, or usage limits of the Service;
Use the Service in any way that circumvents or attempts to circumvent the intended use of natural language processing features, such as Spinny;
Use any automated scraping tool to extract data from the Service, other than through interfaces that Colab91 expressly documents for that purpose; or
Upload any data category prohibited under Section 9.
Colab91 may investigate suspected violations and may suspend or terminate access to the Service for violations, without liability.
9. Prohibited Data — Data the Customer Must Not Upload
SPIN Pulse is designed exclusively for supplier-side and financial spend data. The Service does not need — and the Customer must not upload — personal data of individuals. In particular, the Customer must not upload, and must not permit any Authorized User to upload, any of the following into the Service:
Employee data of any kind, including names, contact details, salary data, HR data, or performance data;
Consumer or customer personal data, including any data about the Customer's own end-customers;
Cardholder data regulated by the Payment Card Industry Data Security Standard (PCI-DSS), including primary account numbers, CVV/CVC codes, or magnetic-stripe data;
Protected health information (PHI) regulated by HIPAA or any equivalent health-privacy law;
Data about children under the age of 16, including any data regulated by COPPA or equivalent laws;
Biometric data (such as fingerprints, facial-recognition templates, or voiceprints);
Government-issued identifiers (such as Social Security numbers, passport numbers, Aadhaar numbers, or PAN);
Special categories of personal data under Article 9 of the EU GDPR (including data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health data, sex life or sexual orientation, genetic data, or biometric data used for identification);
Data regulated as sensitive personal information under the California Consumer Privacy Act (CCPA/CPRA) or as sensitive personal data under India's Digital Personal Data Protection Act (DPDPA);
Classified, export-controlled, or national-security data;
Data unlawfully obtained or data that the Customer does not have all rights necessary to upload.
The Customer acknowledges that the fields SPIN Pulse actually processes to build a spend cube — supplier names, transaction amounts, account codes, categories, dates, and similar commercial fields — do not require any of the prohibited data listed above.
9.1 Incidental personal data of sole-proprietor suppliers
The Customer's supplier records may include the names of small suppliers and sub-contractors who happen to be sole proprietors or natural persons trading in their own name. This is treated as incidental personal data. The Customer represents and warrants that it has a lawful basis under applicable data-protection law to share such supplier names with Colab91 for the purposes of the Service. Colab91 will process such incidental personal data as a processor on the Customer's behalf, under the terms of Part C (Data Processing Addendum).
9.2 If prohibited data is uploaded
Colab91 does not actively inspect Customer Data at upload for prohibited categories, and cannot practically refuse a specific upload in advance. If Colab91 later becomes aware that Customer Data contains prohibited categories (whether through the Customer's notice, a data-subject request, a support ticket, or otherwise), Colab91 may, without notice or liability:
Delete the affected records or files from the Service;
Suspend or terminate access to the Service; and/or
Take any other steps Colab91 considers reasonably necessary to protect the Service and other customers.
The Customer accepts sole responsibility for any prohibited data it uploads. Colab91 makes no representation or warranty of compliance with any law or regulation applicable to prohibited data (including HIPAA, PCI-DSS, GLBA, COPPA, GDPR Article 9, or DPDPA sensitive data provisions), and disclaims any obligation to comply with such laws in connection with prohibited data. The Customer will indemnify Colab91 for any claim, loss, or liability arising from prohibited data uploaded to the Service, as further set out in Section 18.
10. Ownership of Customer Data and the Platform
10.1 Customer Data
As between Colab91 and the Customer, the Customer owns all right, title, and interest in and to Customer Data, including the spend cube and dashboards derived specifically for the Customer's account. Colab91 claims no ownership of Customer Data.
The Customer grants Colab91 a non-exclusive, worldwide, royalty-free license during the term of the Subscription to host, copy, transmit, process, display, and otherwise use Customer Data solely as necessary to (a) provide and improve the Service to the Customer, (b) prevent or address technical, security, or operational issues, (c) comply with law, and (d) generate Aggregated Data in accordance with Section 11.
10.2 The Platform
Colab91 owns and retains all right, title, and interest in and to the Service, including all software, models (including large language models trained or fine-tuned by Colab91), taxonomies, benchmark libraries, supplier-parenting databases, market-intelligence databases, algorithms, documentation, user interfaces, and all improvements, modifications, and derivative works of any of the foregoing. Nothing in these Terms transfers any ownership of the Service to the Customer.
10.3 Feedback
If the Customer or an Authorized User provides Feedback, the Customer grants Colab91 a perpetual, irrevocable, worldwide, royalty-free, sublicensable license to use, disclose, reproduce, modify, and otherwise exploit the Feedback for any purpose, including to improve the Service, without any obligation or compensation to the Customer.
11. Aggregated Data, and Model Improvement
11.1 Aggregated Data
A core purpose of the Service is to produce industry benchmarks that make the Service more useful for everyone who uses it. Colab91 will process Customer Data to derive Aggregated Data, which Colab91 owns and may retain and use indefinitely, including after the Customer's account is terminated. Aggregated Data will not identify the Customer or any natural person, and will be combined with data from other sources so that no single customer's data can be re-identified.
Examples of Aggregated Data include (without limitation):
Category-level spend as a percentage of total spend, by industry and revenue or spend band;
Typical supplier count in a given category for a business of a given size;
Category spend velocity and seasonality;
Supplier-parenting relationships and supplier canonical names;
Market-intelligence data points about supplier ownership, geography, and industry classification.
The examples above are illustrative and not exhaustive. Colab91 reserves the right to derive additional Aggregated Data from Customer Data provided that the resulting data does not identify the Customer or any natural person.
Colab91 does not publish or share individual customer data externally. Aggregated Data may be shared with other customers and with prospective customers of the Service only in aggregated form and only where the aggregation is sufficient to prevent re-identification of any individual customer.
Colab91 will not share Aggregated Data in a form that names, tags, or otherwise identifies the Customer.
11.2 Model improvement and shared learning
The Service uses machine-learning models (including a specialized language model trained on procurement data) to normalize suppliers, roll suppliers up to parent entities, classify transactions, and produce opportunity insights. Feedback, corrections, and overrides submitted through the Service — for example, when an Authorized User re-classifies a transaction or corrects a supplier normalization — are used by Colab91 to improve those models for all customers of the Service.
The purpose of this shared learning is to avoid duplicating research across accounts, reduce processing cost, and improve the accuracy of supplier normalization, supplier parenting, classification, and market-intelligence outputs. Colab91's shared reference databases (including its supplier-parenting database, taxonomy library, and market-intelligence library) are built and maintained in part from these corrections.
The Customer agrees that Colab91 may use Feedback, classification overrides, and other corrections submitted through the Service to train and improve these shared models and reference databases, and that the resulting improvements form part of the Service and belong to Colab91.
11.3 Benchmarking is a condition of use
The Customer's participation in benchmarking and shared model improvement, as described in this Section 11, is mandatory for use of the Service on the self-serve tier and is a material part of the consideration for the fees. There is no opt-out on the self-serve tier.
12. GPO Strategy and GPO Activation
Colab91 is not a group purchasing organization.
12.1 GPO Strategy — available to all customers
For certain spend categories, the Service will identify that group purchasing organization ("GPO") sourcing is likely to deliver savings. This identification is offered as a recommendation and is available to all Customers regardless of location. Categories flagged with a "GPO strategy" recommendation carry a suggestion to source spend through a GPO.
12.2 GPO Activation — North American customers only
In-tool activation of specific pre-negotiated GPO deals ("GPO Activation") is available only to Customers whose contracting entity is registered in the United States, Canada, or Mexico ("North America"), and only in respect of the Customer's spend with suppliers based in North America. Eligibility is determined by the country of registration of the Customer's business entity as recorded at signup.
Customers whose contracting entity is registered outside North America will receive GPO Strategy recommendations but will not have access to the in-tool GPO Activation feature. Colab91 makes no commitment to extend GPO Activation to any additional geography, and non-availability of GPO Activation outside North America is not a breach of these Terms.
12.3 GPO deal terms are between the customer and the GPO
Where GPO Activation is available, the actual sourcing contract is between the Customer and the applicable GPO or supplier. Colab91 is not a party to that contract, does not warrant the terms of any GPO deal, and is not responsible for the performance of any GPO or supplier.
13. Confidentiality
Each party (as "Recipient") may receive from the other party (as "Discloser") information that is confidential and proprietary. Confidential Information includes, without limitation, Customer Data, the non-public features and internals of the Service, pricing, and business plans.
The Recipient will use Confidential Information only to perform its obligations and exercise its rights under these Terms, will protect Confidential Information with at least the same degree of care it uses for its own confidential information of like importance (and in no event less than a reasonable standard of care), and will not disclose Confidential Information to any third party except to those of its employees, contractors, and advisors who need to know and who are bound by confidentiality obligations at least as protective as these Terms.
Confidential Information does not include information that (a) is or becomes publicly available through no fault of the Recipient, (b) was known to the Recipient before disclosure, (c) is received from a third party without breach of any obligation, or (d) is independently developed without use of the Confidential Information.
The Recipient may disclose Confidential Information to the extent required by law, provided that it gives prompt notice (where lawful) to the Discloser.
14. Service Availability and Support
Colab91 will use commercially reasonable efforts to make the Service available and to correct material errors. The Service is offered on a best-efforts basis. Colab91 does not provide an uptime service-level agreement on the self-serve tier. From time to time, Colab91 may perform maintenance and updates that reduce availability.
Support is provided by email at spin@colab91.com. Colab91 will use reasonable efforts to acknowledge support requests within one (1) business day of receipt. Response times are targets, not guarantees, and are not backed by service credits.
15. Warranty Disclaimer
THE SERVICE, ALL OUTPUTS (INCLUDING CLASSIFICATIONS, SUPPLIER NORMALIZATIONS, BENCHMARKS, OPPORTUNITY IDENTIFICATIONS, AND SAVINGS ESTIMATES), AND ALL RELATED MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT ANY WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, COLAB91 DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, AND QUIET ENJOYMENT.
WITHOUT LIMITING THE FOREGOING, COLAB91 DOES NOT WARRANT THAT CLASSIFICATIONS PRODUCED BY THE SERVICE WILL BE ACCURATE, THAT SUPPLIER PARENTING WILL BE CORRECT IN EVERY CASE, THAT BENCHMARKS WILL MATCH THE CUSTOMER'S OWN MARKET CONDITIONS, THAT IDENTIFIED SAVINGS OPPORTUNITIES WILL BE REALIZED, THAT GPO STRATEGY RECOMMENDATIONS WILL PRODUCE SAVINGS, OR THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.
THE CUSTOMER IS SOLELY RESPONSIBLE FOR THE BUSINESS DECISIONS IT MAKES BASED ON OUTPUTS OF THE SERVICE. NOTHING IN THE SERVICE IS LEGAL, FINANCIAL, TAX, ACCOUNTING, OR PROFESSIONAL ADVICE.
16. AI System Disclosure
The Service uses artificial intelligence, including large language models and machine-learning classifiers, to process Customer Data and produce outputs. Specifically:
The classification, supplier normalization, and supplier parenting engines are machine-learning systems trained on procurement data, including data derived from prior customer engagements;
The Spinny chat interface uses a third-party large language model provided by Anthropic PBC to translate user questions into structured queries against the Customer's spend cube. Numerical answers are computed deterministically against the Customer's data, not generated by the language model;
AI outputs may contain errors. The Customer must not rely on AI outputs without appropriate review, particularly for decisions with material financial or legal consequences;
Colab91 will maintain reasonable documentation of the AI systems used in the Service to support the Customer's own compliance with AI-governance obligations under laws such as the EU AI Act, where applicable.
Where a Customer is subject to sector-specific AI regulation (for example, financial-services AI-model risk management), the Customer is responsible for its own compliance with those obligations, including any obligation to conduct impact assessments, to disclose AI use to its own customers, or to obtain regulator approvals.
17. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF BUSINESS OPPORTUNITY, LOSS OF GOODWILL, OR LOSS OF DATA, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR THE SERVICE, WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE, EVEN IF THAT PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (a) THE FEES ACTUALLY PAID BY THE CUSTOMER TO COLAB91 IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (b) FIVE THOUSAND US DOLLARS (US$5,000).
THE FOREGOING EXCLUSIONS AND LIMITATIONS DO NOT APPLY TO: (I) A PARTY'S PAYMENT OBLIGATIONS UNDER THESE TERMS; (II) THE CUSTOMER'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 18; (III) EITHER PARTY'S LIABILITY FOR FRAUD, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT; (IV) EITHER PARTY'S LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW; OR (V) THE CUSTOMER'S BREACH OF SECTIONS 8 (ACCEPTABLE USE), 9 (PROHIBITED DATA), OR 13 (CONFIDENTIALITY).
THE PARTIES ACKNOWLEDGE THAT THE LIMITATIONS SET OUT IN THIS SECTION 17 FORM A FUNDAMENTAL BASIS OF THE BARGAIN AND REFLECT THE FEES PAID FOR THE SERVICE.
18. Indemnification
18.1 Indemnification by the Customer
The Customer will defend, indemnify, and hold harmless Colab91 and its officers, directors, employees, and agents from and against any claim, demand, action, loss, damage, liability, cost, or expense (including reasonable attorneys' fees) arising from or relating to:
The Customer Data, including any allegation that Customer Data infringes the intellectual property, privacy, publicity, or other rights of any third party, or violates any law;
Any upload of data prohibited under Section 9, including any regulatory penalty or third-party claim resulting from such upload;
The Customer's or any Authorized User's breach of these Terms, including the Acceptable Use provisions in Section 8;
The Customer's use of the outputs of the Service, including any decision or action taken by the Customer in reliance on such outputs; and
The Customer's failure to obtain any consent or provide any notice required by applicable data-protection law in respect of personal data included in Customer Data.
18.2 Indemnification by Colab91
Colab91 will defend, indemnify, and hold harmless the Customer against any third-party claim that the Service, when used by the Customer in accordance with these Terms, infringes a US patent, US copyright, or US trademark of that third party, and will pay any damages and reasonable attorneys' fees finally awarded against the Customer in such claim (or agreed to in settlement).
Colab91 has no obligation under this Section 18.2 for any claim to the extent it arises from (a) Customer Data, (b) the Customer's combination of the Service with any product or service not provided by Colab91, (c) modifications of the Service not made by Colab91, or (d) use of the Service after Colab91 has advised the Customer to discontinue use to avoid an infringement claim.
If use of the Service is enjoined or, in Colab91's reasonable opinion, is likely to be enjoined, Colab91 may, at its option and expense, (i) procure the right for the Customer to continue using the Service, (ii) modify the Service so that it becomes non-infringing, or (iii) terminate the Subscription and refund any prepaid fees for the unused portion of the then-current monthly cycle. This Section 18.2 states Colab91's sole liability, and the Customer's sole remedy, for any claim of intellectual-property infringement by the Service.
18.3 Indemnification procedure
The party seeking indemnification will (a) give prompt written notice of the claim to the indemnifying party, (b) grant the indemnifying party sole control of the defense and settlement of the claim (provided that no settlement admitting liability of the indemnified party may be made without its prior written consent, not to be unreasonably withheld), and (c) provide reasonable cooperation, at the indemnifying party's expense.
19. Term and Termination
19.1 Term
These Terms take effect when the Customer creates an account and continues until the Customer's account is terminated in accordance with this Section 19.
19.2 Termination for convenience by the Customer
The Customer may terminate at any time by cancelling the Subscription in accordance with Section 5.4. Termination takes effect at the end of the then-current monthly billing cycle.
19.3 Termination for cause by Colab91
Colab91 may suspend or terminate the Customer's account, in whole or in part, on written notice (which may be by email to the account email) if:
The Customer fails to pay any fee when due (with the timing set out in Section 5.9);
The Customer materially breaches these Terms (including the Acceptable Use provisions or the Prohibited Data provisions) and does not cure that breach within fifteen (15) days of notice, or where the breach is not capable of cure;
Colab91 reasonably determines that continued provision of the Service poses a security, legal, or regulatory risk to Colab91 or to other customers; or
The Customer becomes insolvent, admits inability to pay debts as they fall due, makes an assignment for the benefit of creditors, or is subject to bankruptcy or similar insolvency proceedings.
19.4 Termination for cause by the Customer
The Customer may terminate immediately by written notice to Colab91 if Colab91 materially breaches these Terms and does not cure that breach within thirty (30) days of receiving written notice describing the breach.
20. Effect of Termination and Data Handling on Exit
20.1 Access during the paid cycle
Because subscription fees are paid in advance, on cancellation the Customer will retain access to the Service (including the dashboard) through the end of the billing cycle for which payment has already been made. During this period, the Customer may download or export any Customer Data it wishes to retain, using the export functions in the Service.
Once the paid cycle ends, or immediately upon termination for cause by Colab91, access to the Service will be turned off.
20.2 No post-termination export
After access is turned off, the Customer will not be able to download or export Customer Data from the Service, and Colab91 has no obligation to provide, and will not provide, post-termination data exports. The Customer is solely responsible for exporting any Customer Data it wishes to retain before its access ends.
20.3 Data retention and permanent deletion
Colab91 will retain Customer Data on its production systems for ninety (90) days after access is turned off. During this 90-day period, access to the Service remains disabled but Customer Data is preserved. On expiry of the 90-day period, Customer Data is permanently deleted from Colab91's production systems and is not recoverable.
20.4 No separate backup archive
Colab91 does not maintain a separate long-term backup archive of Customer Data. Routine operational backups made by Colab91's infrastructure providers roll over within their normal retention windows and are not restored except in a disaster recovery event.
20.5 Aggregated Data survives
Aggregated Data derived from Customer Data before termination is de-identified and is not Customer Data. It is retained by Colab91 indefinitely as part of its benchmark library and shared reference databases, as described in Section 11.
20.6 Reactivation and setup fee
If, during the 90-day retention period, the Customer starts a new Paid Subscription for the same account, Colab91 will (on request to spin@colab91.com) reactivate the account with Customer Data intact, and the Setup Fee will not apply to the new Subscription. Reactivation after the 90-day retention period has expired will be treated as a new account: Customer Data must be re-uploaded from scratch, and the Setup Fee will apply.
20.7 Accelerated deletion on request
The Customer may request accelerated deletion of Customer Data by writing to spin@colab91.com. Colab91 will delete Customer Data from production systems within thirty (30) days of the request, subject to any legal hold or retention obligation Colab91 is subject to (for example, tax records or pending litigation). Accelerated deletion cancels the reactivation option in Section 20.6.
20.8 Survival
Sections 1 (Definitions), 5.7 (No refunds), 8 (Acceptable Use, insofar as it applies to residual access), 9 (Prohibited Data, insofar as it applies to indemnification), 10 (Ownership), 11 (Aggregated Data), 13 (Confidentiality), 15 (Warranty Disclaimer), 17 (Limitation of Liability), 18 (Indemnification), 20 (Effect of Termination), 24 (Governing Law), 25 (Dispute Resolution), and any other provision that by its nature is intended to survive, will survive termination of these Terms.
21. Suspension
In addition to any right of termination, Colab91 may suspend the Customer's access to the Service, in whole or in part, immediately and without notice, if Colab91 reasonably determines that the Customer's use of the Service (a) poses a security risk to the Service or to other customers, (b) may adversely affect the Service or other customers, (c) may expose Colab91 to liability, or (d) may be fraudulent. Colab91 will restore access promptly after the circumstance giving rise to the suspension is resolved.
22. Modifications to the Service
Colab91 may add, modify, or remove features of the Service from time to time. If a change materially reduces the core functionality of the Service to the Customer during a paid billing cycle, the Customer's sole remedy is to terminate the Subscription and receive a pro-rata refund of prepaid fees for the unused portion of the current cycle.
23. Modifications to These Terms
Colab91 may modify these Terms from time to time. If Colab91 makes a material change, Colab91 will notify the Customer by email to the account email address and by in-app notice at least thirty (30) days before the change takes effect. Continued use of the Service after the effective date of the change constitutes acceptance of the modified Terms. If the Customer does not accept the modified Terms, the Customer's sole remedy is to cancel the Subscription before the change takes effect. Non-material changes (including corrections of typographical errors and updates to sub-processor lists) take effect when posted.
24. Governing Law
These Terms and any dispute arising from or relating to these Terms or the Service are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
25. Dispute Resolution and Venue
25.1 Informal resolution
Before initiating any formal proceeding, a party will first send written notice to the other party describing the dispute and the relief sought. The parties will attempt in good faith to resolve the dispute through informal discussions for at least thirty (30) days after the notice.
25.2 Venue
Any dispute that is not resolved informally will be brought exclusively in the state or federal courts located in the State of Delaware, USA. Each party consents to the personal jurisdiction of those courts and waives any objection to venue in those courts on the grounds of inconvenient forum. Each party irrevocably waives any right to a trial by jury.
25.3 Injunctive relief
Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or confidential information.
25.4 Time bar
Any claim arising out of or relating to these Terms or the Service must be brought within one (1) year after the cause of action accrues. Otherwise the claim is permanently barred.
26. General Provisions
26.1 Entire agreement
These Terms (together with the Order and any addendum expressly incorporated) are the entire agreement between the parties regarding the Service and supersede any prior or contemporaneous agreements or representations. Any conflicting terms in a Customer's purchase order or other business form are of no force or effect.
26.2 Assignment
The Customer may not assign or transfer these Terms, or any right or obligation under them, without Colab91's prior written consent. Colab91 may assign these Terms without consent to an affiliate or in connection with a merger, acquisition, or sale of substantially all its assets. Any assignment in violation of this Section is void.
26.3 No agency
Nothing in these Terms creates any partnership, joint venture, agency, or employment relationship between the parties.
26.4 No third-party beneficiaries
These Terms do not confer any rights on any third party (other than permitted successors and assigns).
26.5 Force majeure
Neither party is liable for delay or failure in performance (other than payment obligations) caused by circumstances beyond its reasonable control, including natural disasters, acts of war or terrorism, riots, civil unrest, epidemics, pandemics, governmental action, labor disputes, or failures of internet or public utilities.
26.6 Notices
Notices to Colab91 must be sent by email to spin@colab91.com with a copy by mail to Colab91 Inc., 1325 Main Street, Suite 1404, Katy, Texas 77494, USA. Notices to the Customer will be sent by email to the account email address on file. Email notices are effective on the business day after they are sent.
26.7 Waiver and severability
A waiver of any provision must be in writing and is not a waiver of any other provision. If any provision is held to be unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in full force.
26.8 Export and sanctions compliance
The Customer will comply with all applicable export-control and economic-sanctions laws in its use of the Service, including US Export Administration Regulations and OFAC sanctions.
26.10 Headings and language
Headings are for convenience only and do not affect interpretation. These Terms are entered into in the English language; any translation is provided for convenience only, and the English version controls in case of inconsistency.
PART B — PRIVACY POLICY
This Privacy Policy describes how Colab91 Inc. collects, uses, discloses, and protects information in connection with SPIN Pulse. This Privacy Policy forms part of the Terms and applies together with them. Capitalized terms not defined here have the meanings given in Part A.
B1. Scope of this Privacy Policy
This Privacy Policy applies to:
Information Colab91 collects from Authorized Users when they create and use an account (this is personal data of Authorized Users, for which Colab91 is a controller);
Information Colab91 collects from visitors to Colab91's public website (this is personal data of website visitors, for which Colab91 is a controller); and
Any incidental personal data included in Customer Data (this is personal data for which the Customer is the controller and Colab91 is a processor — see Part C for details of that relationship).
B2. Information We Collect from Authorized Users
Account information
When an Authorized User signs up, Colab91 collects: name, business email address, business name, business address, job title (optional), and password (stored in hashed form).
Billing information
Payment card details are collected and processed directly by Colab91's payment processor, Stripe. Colab91 does not receive or store full card numbers. Colab91 stores billing metadata such as the last four digits of the card, card brand, cardholder name, billing address, subscription plan, and payment history.
Usage information
Colab91 collects information about how the Service is used, including logins, sessions, features accessed, queries submitted to Spinny, classification overrides, IP address, browser type, device type, operating system, and timestamps. This information is used for security, product improvement, and the enforcement of the Seat and concurrent-session rules described in Section 6.
Support communications
If an Authorized User contacts Colab91 by email, Colab91 will retain those communications and any information the Authorized User provides.
B3. Information We Collect from Website Visitors
When a person visits the Colab91 website, Colab91 collects standard web-server logs (IP address, browser type, referring URL, pages visited, and timestamps), and uses cookies as described below.
B4. Cookies and Similar Technologies
Colab91 uses cookies and similar technologies on its website and in the Service.
Strictly necessary cookies. Used to authenticate Authorized Users, maintain sessions, enforce the concurrent-session rule, and remember basic preferences. These cannot be turned off without breaking the Service.
Analytics cookies. Used to understand how the Service and the website are used, in aggregate, so Colab91 can improve them.
No advertising or tracking cookies. Colab91 does not use advertising cookies and does not participate in cross-site advertising networks.
Where required by law (for example, in the EU, UK, and California), Colab91 will present a cookie banner on the website that allows the visitor to accept or reject non-essential cookies. Cookie preferences can be changed at any time through the cookie settings link in the website footer.
Colab91 does not currently respond to browser "Do Not Track" signals but honors Global Privacy Control (GPC) signals from residents of jurisdictions where GPC has legal effect.
B5. How We Use Information
Colab91 uses the information described above to:
Provide and operate the Service, including authentication, billing, support, and enforcement of these Terms;
Communicate with Authorized Users about the Service, including transactional emails (billing, renewal reminders, security notices, product updates);
Improve the Service, including through analytics and, in respect of Customer Data, through Aggregated Data and shared model improvement as described in Section 11;
Detect, prevent, and address fraud, security incidents, and violations of these Terms;
Comply with legal obligations, respond to lawful requests, and enforce Colab91's legal rights.
Colab91 does not sell personal data. Colab91 does not use personal data for cross-context behavioral advertising.
B6. Legal Bases for Processing (EU/UK GDPR)
For Authorized Users and website visitors located in the European Economic Area, the United Kingdom, or Switzerland, Colab91 relies on the following legal bases:
Performance of a contract — to provide the Service to the Authorized User and the Customer;
Legitimate interests — to improve the Service, secure it, prevent fraud, and communicate about the Service, provided those interests are not overridden by the individual's rights;
Legal obligation — to comply with law;
Consent — for non-essential cookies and for any optional marketing communications (which can be withdrawn at any time).
B7. How We Share Information
Colab91 shares information only as follows:
Sub-processors. Colab91 uses the third-party service providers listed in Part D to help operate the Service. Each sub-processor is bound by contract to protect information consistently with this Privacy Policy and the DPA in Part C.
Corporate affiliates. Colab91's parent company, Amavco Growth Partners Pvt Ltd (India), provides operational, engineering, and human-in-the-loop support to the Service and is treated as a sub-processor. See Part D and Part C.
Legal and regulatory. Colab91 may disclose information where required by law or in response to a lawful government or court request. Where lawful, Colab91 will notify the affected Customer or Authorized User before disclosing.
Business transfers. In connection with a merger, acquisition, financing, or sale of assets, Colab91 may transfer information to the successor entity, subject to the same or equivalent privacy commitments.
Aggregated Data. Colab91 may share Aggregated Data with other customers and prospective customers, and may otherwise use it for any business purpose. Aggregated Data does not identify any individual or Customer. Colab91 does not publish or share individual customer data externally.
Colab91 does not sell or rent personal data to third parties.
B8. International Data Transfers
Colab91 is headquartered in the USA. Its operational team (including engineering and human-in-the-loop reviewers) is based in India through Amavco Growth Partners Pvt Ltd. Sub-processors are located in multiple jurisdictions (see Part D).
Personal data will be transferred to, stored in, and processed in the USA, India, and other jurisdictions where Colab91 or its sub-processors operate. Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of data protection, Colab91 relies on:
The European Commission's Standard Contractual Clauses (2021 modules) and, for UK transfers, the UK International Data Transfer Addendum;
Where applicable, the EU-US Data Privacy Framework and the UK Extension, in respect of sub-processors that are certified under those frameworks;
Additional safeguards where required by law.
For personal data transferred out of India, Colab91 complies with cross-border transfer requirements of India's Digital Personal Data Protection Act, 2023, including restrictions on transfers to countries designated by the Government of India as ineligible.
B9. Data Retention
Colab91 retains personal data only for as long as needed for the purposes described in this Privacy Policy or as required by law:
Account information — for as long as the account is active, and then in accordance with Section 20 (data-handling on exit);
Billing records — for at least seven (7) years to satisfy tax and accounting obligations;
Support communications — for up to three (3) years after last activity;
Website logs — for up to twelve (12) months;
Customer Data — see Section 20.
B10. Security
Colab91 uses reasonable and appropriate technical and organizational measures to protect information, including encryption of Customer Data at rest (AES-256) and in transit (TLS 1.2 or higher), role-based access controls, multi-factor authentication for administrative accounts, security monitoring and logging, and periodic review of access. Further detail is set out in Part C, Schedule 2.
No security system is perfectly secure. Authorized Users are responsible for protecting their own credentials and for using strong, unique passwords and multi-factor authentication where offered.
B11. Your Privacy Rights
Depending on where an individual is located, they may have rights under law to:
Access personal data Colab91 holds about them;
Request correction of inaccurate personal data;
Request deletion of personal data (subject to legal exceptions);
Request restriction of processing or object to processing based on legitimate interests;
Request a portable copy of certain personal data;
Withdraw consent where processing is based on consent;
Not be subject to unlawful discrimination for exercising these rights;
Lodge a complaint with a supervisory authority (in the EU/UK), the California Privacy Protection Agency (in California), or another applicable regulator.
These rights include, without limitation, the rights available under the EU and UK GDPR, the California Consumer Privacy Act (CCPA) as amended by the CPRA, and India's Digital Personal Data Protection Act (DPDPA).
To exercise any of these rights, contact Colab91 at spin@colab91.com. Colab91 will respond within the time period required by applicable law (typically 30 days). Colab91 may need to verify the requester's identity before responding, and may decline requests that are manifestly unfounded, excessive, or that would infringe the rights of others.
Where personal data is included as incidental personal data in Customer Data, the Customer is the controller and requests should be directed to the Customer. Colab91 will assist the Customer in responding to such requests as set out in Part C.
B12. Children
The Service is not directed to individuals under 18. Colab91 does not knowingly collect personal data from anyone under 18. If Colab91 becomes aware that it has collected personal data from a person under 18, it will delete that data as soon as reasonably practicable.
B13. Changes to this Privacy Policy
Colab91 may update this Privacy Policy from time to time. Material changes will be notified in accordance with Section 23. The "Effective Date" at the top of these Terms indicates when they were last updated.
B14. Contact
Questions about this Privacy Policy, or to exercise any right, contact:
Colab91 Inc.
Attention: Privacy
1325 Main Street, Suite 1404
Katy, Texas 77494, USA
Email: spin@colab91.com
PART C — DATA PROCESSING ADDENDUM
This Data Processing Addendum ("DPA") forms part of the Terms and applies to Colab91's processing of Personal Data on behalf of the Customer in connection with the Service. In case of conflict with Part A or Part B in respect of the processing of Personal Data, this DPA controls.
C1. Definitions
For the purposes of this DPA:
"Data Protection Law" means all laws applicable to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK Data Protection Act 2018 and UK GDPR, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the CPRA ("CCPA"), other US state privacy laws, India's Digital Personal Data Protection Act, 2023 ("DPDPA"), and any equivalent law.
"Personal Data" has the meaning given by applicable Data Protection Law and, in the context of this DPA, means only Personal Data included as incidental personal data within Customer Data (such as sole-proprietor supplier names) and Personal Data of Authorized Users to the extent processed on behalf of the Customer.
"Controller", "Processor", "Data Subject", "Process" and cognates have the meanings given by GDPR, or the equivalent terms under other Data Protection Law.
"Sub-processor" means any third party engaged by Colab91 to process Personal Data on Colab91's behalf.
"SCCs" means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office.
"DPF" means the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
C2. Roles of the Parties
For Personal Data included as incidental personal data within Customer Data (such as the names of sole-proprietor suppliers), the Customer is the Controller and Colab91 is the Processor.
For Personal Data of Authorized Users collected in respect of account, billing, and use of the Service, Colab91 is the Controller in its own right, and this DPA does not apply (Part B applies instead).
This DPA does not apply to Aggregated Data, which by definition does not identify any Data Subject.
For the purposes of the CCPA, Colab91 is a "service provider" of the Customer with respect to Customer Data. Colab91 will not sell or share Personal Data, and will not process Personal Data for any purpose other than the business purposes set out in this DPA.
C3. Subject Matter, Nature, Purpose, and Duration
The subject matter of the Processing is Personal Data incidentally included within Customer Data uploaded to the Service. The nature of the Processing is ingestion, cleaning, normalization, classification, storage, hosting, transmission, and analytical processing for the purpose of producing a spend cube and related insights for the Customer, and derivation of Aggregated Data as permitted under the Terms. The Processing will continue for the duration of the Customer's Subscription and thereafter until Personal Data is deleted in accordance with Section 20 of Part A.
Categories of Data Subjects: sole proprietors and other natural-person suppliers or sub-contractors of the Customer whose names appear in Customer Data. Categories of Personal Data: supplier names, and any commercial contact or address information present in Customer Data.
C4. Customer Instructions
Colab91 will process Personal Data only on the documented instructions of the Customer. The Terms (including this DPA) and the ordinary use of the Service by the Customer through the Service's interfaces constitute the Customer's documented instructions. Any additional or different instructions must be agreed in writing between the parties, and Colab91 may charge for work to implement them.
Colab91 will inform the Customer without undue delay if it considers that an instruction infringes Data Protection Law, unless prohibited by law from doing so.
C5. Customer Warranties
The Customer warrants that it has all rights necessary under Data Protection Law to disclose Personal Data to Colab91 and to have Colab91 process it as contemplated by the Service, including a valid legal basis (such as the Customer's legitimate interests in supplier management), and that it has provided any notices required by law to Data Subjects.
C6. Confidentiality of Colab91 Personnel
Colab91 will ensure that its personnel who have access to Personal Data are subject to written confidentiality obligations and are trained on data protection and information security.
C7. Security
Colab91 will implement and maintain the technical and organizational measures described in Schedule 2 to protect Personal Data against a Personal Data Breach. These measures include encryption in transit (TLS 1.2 or higher) and at rest (AES-256), access controls based on least privilege, multi-factor authentication for administrative access, network segmentation, logging and monitoring, periodic vulnerability assessment, and personnel security.
C8. Sub-processors
C8.1 Authorization
The Customer authorizes Colab91 to engage the sub-processors listed in Part D. The Customer authorizes Colab91's parent company, Amavco Growth Partners Pvt Ltd (India), as a sub-processor for operational, engineering, and human-in-the-loop support.
C8.2 New sub-processors
Colab91 will maintain an up-to-date sub-processor list in Part D and will notify the Customer of any new sub-processor at least fifteen (15) days before that sub-processor begins processing Personal Data, by email to the account email or by in-app notice. The Customer may object to the new sub-processor within that period by writing to spin@colab91.com. If the parties cannot agree on a resolution, the Customer may terminate the Subscription and receive a pro-rata refund of prepaid fees for the unused portion of the then-current monthly cycle. Continued use of the Service after the fifteen-day period constitutes acceptance.
C8.3 Sub-processor obligations
Colab91 will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA. To the extent required by applicable Data Protection Law, and always subject to the limitations of liability in Section 17 of Part A, Colab91 remains liable to the Customer for the acts and omissions of its sub-processors in respect of Personal Data.
C9. International Transfers
C9.1 EU/UK/Swiss transfers
Where Personal Data of Data Subjects in the European Economic Area, the United Kingdom, or Switzerland is transferred to Colab91 (in the USA) or to a sub-processor in a country not covered by an adequacy decision, the transfer is made under:
The SCCs (Module Two, Controller to Processor), which are incorporated by reference into this DPA and completed as follows: the Customer is the data exporter; Colab91 is the data importer; the optional docking clause applies; Clause 7 (docking) is included; Clause 9(a) Option 2 (general written authorization) applies with a fifteen-day notice period per Section C8.2; Clause 11(a) (independent dispute resolution) does not apply; Clause 17 Option 1 (governing law of the Republic of Ireland) applies; Clause 18 (competent courts of Ireland) applies; Annexes I, II, and III are populated by the details in this DPA, Schedule 2 (security measures), and Part D (sub-processor list) respectively;
For UK transfers, the UK Addendum, which is incorporated by reference and completed as follows: Table 1 (parties) — the parties named in the Terms; Table 2 — the SCCs referred to above; Table 3 — Annexes as above; Table 4 — neither party may end the UK Addendum on change of the Approved Addendum;
For Swiss transfers, the SCCs as adapted for Switzerland (references to Regulation (EU) 2016/679 read as references to the Swiss FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner).
Where Colab91 or the relevant sub-processor is certified under the DPF, the DPF (with the UK Extension and the Swiss-US framework as applicable) may be used as the transfer mechanism instead of, or in addition to, the SCCs.
C9.2 India cross-border transfers
Personal Data received from Data Subjects in India may be transferred to and processed in the USA and other countries as required to provide the Service. Colab91 complies with the DPDPA in respect of such transfers, including the restrictions on transfers to countries notified by the Government of India from time to time. Colab91's parent company, Amavco Growth Partners Pvt Ltd, is established in India and provides operational support to the Service; intra-group transfers between Amavco Growth Partners Pvt Ltd and Colab91 Inc. are made subject to a written intra-group data transfer agreement that reflects the requirements of the DPDPA.
C9.3 US state privacy laws
For personal information of California residents, Colab91 is a service provider under the CCPA and will process personal information only for the business purposes set out in this DPA. For personal information of residents of other US states with applicable privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others), Colab91 acts as a processor and will provide equivalent commitments.
C10. Data Subject Rights
Taking into account the nature of the processing, Colab91 will use reasonable technical and organizational measures to assist the Customer in responding to requests from Data Subjects to exercise their rights under Data Protection Law. If Colab91 receives a request directly from a Data Subject in respect of Personal Data processed for a Customer, Colab91 will forward the request to the Customer and will not respond directly except to acknowledge receipt or as required by law.
C11. Data Protection Impact Assessments
On request, Colab91 will provide the Customer with reasonable assistance in respect of data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 of the GDPR (or equivalent obligations), to the extent the Customer requires that assistance in respect of Colab91's Processing of Personal Data and does not otherwise have the necessary information available.
C12. Personal Data Breach Notification
Colab91 will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer. The notification will include the information reasonably necessary for the Customer to comply with its own breach-notification obligations, to the extent that information is available at the time. Colab91 will provide further information as it becomes available.
A notification is not an admission of fault or liability.
C13. Audit
Colab91 will make available to the Customer, on written request no more than once per year, information reasonably necessary to demonstrate compliance with this DPA. This will normally take the form of Colab91's most recent third-party audit reports or certifications (as they become available) and answers to a reasonable written questionnaire. Where a Data Protection Law entitles the Customer to a further on-site audit, the parties will agree in advance on the scope, timing, and duration, and the Customer will bear the reasonable costs of the audit.
C14. Return or Deletion of Personal Data
On termination of the Subscription, Colab91 will delete or return Personal Data in accordance with Section 20 of Part A. Backup copies will be handled as described in Section 20.4. Aggregated Data is not Personal Data and is retained by Colab91 as described in Section 11.
C15. Prohibited Personal Data
The Customer will not include in Customer Data any Personal Data of a category prohibited under Section 9 of Part A. If prohibited Personal Data is nonetheless uploaded, Colab91 may act as described in Section 9.2, and the Customer will indemnify Colab91 as set out in Section 18.
C16. Liability
The parties' aggregate liability under this DPA is subject to the limitations of liability in Section 17 of Part A. Each Data Subject's right to receive compensation under Data Protection Law is not affected.
C17. Term and Order of Precedence
This DPA takes effect on the same date as Part A and terminates automatically on the termination of Part A (except that Sections that by their nature should survive will survive). In case of conflict between this DPA and Part A or Part B, this DPA controls in respect of the Processing of Personal Data. The SCCs and UK Addendum incorporated by Section C9 prevail over this DPA in respect of transfers covered by them.
Schedule 2 — Technical and Organizational Security Measures
Colab91 implements and maintains the following measures:
Encryption: AES-256 encryption for Personal Data at rest; TLS 1.2 or higher for data in transit.
Access control: role-based access control on least-privilege principles; unique user IDs; multi-factor authentication for administrative access; concurrent-session controls on customer-facing accounts.
Authentication: password complexity requirements; hashed password storage; SSO available on eligible plans.
Network security: network segregation between environments; ingress restrictions; firewalling of production systems; TLS termination at the edge.
Data segregation: logical separation of Customer Data at the tenant level, backed by row-level security in the database and enforced at the application layer.
Logging and monitoring: security event logging; anomaly detection on authentication and access.
Vulnerability management: regular patching; periodic vulnerability assessment; independent penetration testing.
Personnel security: background checks where lawful; onboarding and annual security training; written confidentiality obligations.
Vendor security: written data-protection terms with sub-processors; review of sub-processor security posture.
Business continuity: regular encrypted backups; disaster recovery procedures; documented incident response process.
Physical security (via cloud providers): hosting in facilities with SOC 2 or ISO 27001 certified physical controls.
PART D — LIST OF SUB-PROCESSORS
The table below identifies the sub-processors Colab91 uses to provide the Service as of the Effective Date. This list may be updated in accordance with Section C8.
Sub-processor
Purpose
Data handled
Location
Amazon Web Services, Inc.
File storage (S3) for uploaded Customer Data and derived spend cube files.
Customer Data (including any incidental personal data such as sole-proprietor supplier names), account metadata.
USA (region as configured)
Anthropic PBC
Large language model provider powering the Spinny chat interface. Translates natural-language questions into structured queries; does not produce the numerical answers, which are computed against the Customer's cube.
Chat prompts and structured query outputs. Configured for zero data retention where offered by the provider.
USA
Amavco Growth Partners Pvt Ltd (parent company of Colab91 Inc.)
Engineering, operations, and human-in-the-loop review of edge cases and low-confidence classifications.
Customer Data (including any incidental personal data such as sole-proprietor supplier names), account metadata, support communications.
India
Railway Corp.
Application backend hosting — API, background workers (Celery), and cache (Redis).
Customer Data in transit and during processing; account and usage metadata.
USA
Rampart Corporation of Canada
Canada
Stripe, Inc.
Payment processing, card storage, invoicing, tax handling, and recurring billing.
Billing information (payment card details, cardholder name, billing address), subscription and payment history. Colab91 does not receive full card numbers.
USA
Supabase, Inc.
Managed Postgres database and authentication.
Customer Data (in the database), account credentials (hashed passwords), account metadata, usage logs.
USA (region as configured)
Vercel Inc.
Frontend application hosting (Next.js).
Session data, request/response logs. No Customer Data is stored on Vercel; Customer Data is retrieved by the browser from the backend over TLS.
USA (edge network global)
Additional notes:
Third-party LLM interaction. When an Authorized User interacts with Spinny, the language model provider (Anthropic PBC) processes the prompt text and any structured context needed to answer. Colab91 configures the provider for zero data retention where that option is offered. Numerical values in answers are computed by Colab91's deterministic calculator against the Customer's spend cube; they are not generated by the language model. This design is intended to prevent numerical hallucination and to limit the exposure of raw Customer Data to the language model.
Cloud regions. Colab91 hosts the Service primarily in the USA. Some sub-processors operate globally distributed infrastructure (for example, content delivery networks); this is limited to non-sensitive elements such as static assets.
Marketing and website services. Colab91 may from time to time engage additional service providers for its public website (for example, form providers or analytics). These providers process only website-visitor data and are not sub-processors of Customer Data.
Acceptance
By checking the box marked "I agree to the Terms" at signup, the Customer confirms that (a) it has read these Terms in full, (b) the individual accepting has authority to bind the Customer, and (c) the Customer accepts these Terms, including Parts A, B, C, and D, and the incorporated SCCs and UK Addendum where they apply.