Terms &
Conditions

Effective Date: April 8th, 2026

These Terms and Conditions (the "Terms") govern all Engagements (as defined below) between The Worthwhile Company, LLC ("Worthwhile"), a South Carolina limited liability company with its principal office at 201 Riverplace, Suite 500, Greenville, SC 29601, and the entity or individual engaging Worthwhile for services ("Client") under a Statement of Work (or "SOW") or for Services by Request (each as defined below). These Terms are published at www.worthwhile.com/tc and are incorporated by reference into each Statement of Work executed between Worthwhile and Client. By executing a SOW or otherwise engaging Worthwhile for services, Client acknowledges that it has read, understood, and agrees to be bound by the version of these Terms in effect at the time of execution.

---

How These Terms Apply

These Terms serve as the standard legal framework for all Worthwhile engagements. The specific scope, pricing, timeline, and Deliverables for each engagement are defined in the applicable SOW which incorporates these Terms by reference. If a SOW contains terms that conflict with these Terms, the SOW controls only with respect to the specific engagement it covers and only where the terms of the SOW indicate by specific section reference an intent to supersede these Terms. These Terms may not otherwise be modified except by a written amendment signed by both parties.

---

Definitions

The following defined terms are used throughout these Terms. Capitalized terms not defined in this section have the meanings given to them where they first appear.

"Change Order" means a written amendment to an active SOW, signed by both parties, that modifies the scope, Deliverables, timeline, or other material terms of the Engagement as described in Section 1.5.

"Client" means the entity or individual identified in the applicable SOW that engages Worthwhile for Services under these Terms.

"Commercially Reasonable" (including "commercially reasonable efforts," "commercially reasonable care," and "commercially reasonable measures") means the level of effort, diligence, or care that a prudent professional services firm of similar size and capability would exercise under similar circumstances, taking into account the nature of the obligation, industry practices, and the cost of compliance relative to the risks involved.

"Deliverables" means all tangible and intangible Work Product created by Worthwhile specifically for Client and identified as "Deliverables" under an applicable SOW, including any AI-generated content incorporated therein. Deliverables do not include Worthwhile's Service Provider Materials except as set forth in Section 6.2.

"Engagement" means the overall business relationship between Worthwhile and Client as governed by these Terms, encompassing all active SOWs, Services by Request, and Service Addenda between the parties.

"Preliminary Payments" means any upfront, deposit, or milestone-based payments identified in an applicable SOW that are required before Worthwhile commences or continues performance of specific Services. Preliminary Payments are distinct from final payments, which are required before transfer of ownership under Section 6.3.

"Service Addendum" means a supplemental document that sets forth additional or modified terms for specific categories of Services (such as ongoing support, hosting, or managed services), which is incorporated into these Terms by reference. In the event of a conflict between a Service Addendum and these Terms, the Service Addendum controls with respect to the specific services it covers. In the event of a conflict between a Service Addendum and a SOW, the SOW controls where the SOW indicates by express section reference an intent to supersede the terms of the Service Addendum.

"Service Provider Materials" means: (a) pre-existing materials owned, developed, or licensed by Worthwhile prior to the commencement of an Engagement; and (b) any materials developed by or on behalf of Worthwhile during an Engagement for Worthwhile's general business purposes, at Worthwhile's cost or expense, but not inclusive of materials developed by a contractor or subcontractor of Worthwhile specifically as part of a Deliverable.

"Services" means the custom software development, technology consulting, strategic advisory, and related professional services described in Section 1.1 and further specified in the applicable SOW, Service Addendum, or Services by Request arrangement.

"Specifications" means the written functional requirements, acceptance criteria, performance standards, and technical parameters for Deliverables as set forth in the applicable SOW or Change Order. Conformity of Deliverables is measured solely against the Specifications.

"Statement of Work" or "SOW" means the written document executed by both parties, in the form of a statement of work, proposal, order, purchase order, or other engagement document identifying with particularity the Services to be performed by Worthwhile along with other details as set forth more specifically in Section 1.1.

"Work Product" means all materials, documents, code, data, and other tangible outputs produced by Worthwhile in the course of performing Services, whether or not they constitute final Deliverables. Work Product includes drafts, intermediate builds, working files, and project documentation.

"Worthwhile Personnel" means Worthwhile's employees, contractors, and subcontractors who are assigned to perform Services under an applicable SOW.

---

1. Services

1.1 Scope of Services

Worthwhile provides custom software development, technology consulting, strategic advisory, and related professional Services. Specific Services for each Engagement are defined by one or more of the following:

1. Statements of Work (SOW). A signed document describing the specific scope, Deliverables, timeline, performance criteria, and pricing for a defined Engagement or portion of a defined Engagement.
2. Services by Request. Client may request minor or routine Services authorized in writing by designated Client representatives outside an active SOW ("Services by Request"). These Services are provided at Worthwhile's then-current standard rates and governed by these Terms. The scope, Deliverables, timeline, and performance criteria for such Services by Request will be solely as identified in written communications between designated representatives of each party. Any Services that materially expand scope, introduce substantial new Deliverables, or require detailed formal Specifications must be initiated through a new SOW or a Change Order.
3. Service Addenda. Certain Services (such as ongoing support or hosting) may include supplemental terms provided in a Service Addendum, each of which is incorporated into these Terms by reference.

Worthwhile's standard SOW template and current Service Addenda are available upon request from clientservices@worthwhile.com.

1.2 Engagement Commencement

Worthwhile is not obligated to commence or continue any Services until all payments then due have been received, including any Preliminary Payments and any milestone- or phase-based payments required under the applicable SOW. Ownership and license rights in Deliverables remain subject to Sections 6.3 and 12.4.

1.3 Use of Artificial Intelligence

Worthwhile incorporates artificial intelligence tools and technologies ("AI Tools") into its workflows, service delivery, and the solutions it builds for Clients. By engaging Worthwhile, Client acknowledges and agrees to the following:

(a) AI-Assisted Services. Worthwhile may use AI Tools—including but not limited to large language models, code generation tools, automated testing frameworks, and data analysis platforms—to enhance the quality, efficiency, and innovation of its Services.

(b) Human Oversight. All AI-generated outputs incorporated into Deliverables are reviewed and may be refined by Worthwhile's team before delivery. Worthwhile maintains responsibility for conformity of its Deliverables with the Specifications regardless of the tools used to produce them.

(c) No Guarantee of AI Outcomes. AI-generated outputs may contain errors, omissions, or limitations inherent to the current state of the technology, including hallucinations, biases, and inaccuracies. Worthwhile does not warrant that AI-generated components will be error-free, and Client agrees that AI outputs are provided as part of a professional service—not as a standalone product. Worthwhile's liability for harms arising from AI-generated components is limited to whether such components perform materially in accordance with the Specifications set forth in the applicable SOW. Worthwhile shall not be liable for any loss, damage, or claim arising from inaccuracies, biases, hallucinations, or other limitations inherent to AI technology.

(d) Client Data and AI. Worthwhile will not use Client's Confidential Information to train any artificial intelligence model without Client's prior written consent. Where Client data is processed through AI Tools in the course of providing Services, Worthwhile will use Commercially Reasonable measures to protect confidentiality, including selecting tools with data handling policies materially equivalent to Worthwhile's obligations under these Terms.

(e) AI in Recommended Solutions. Where Worthwhile recommends or builds AI-powered solutions for Client, Worthwhile will use Commercially Reasonable efforts to advise Client on known risks and limitations. Client is responsible for independently evaluating the suitability of AI-powered solutions for its use case, including any regulatory or compliance considerations specific to Client's industry or Client's particular use case.

(f) Evolving Technology. The AI landscape changes rapidly. Worthwhile reserves the right to update or change the specific AI Tools it uses, provided such changes do not materially diminish the quality of Services.

(g) AI Training Data and Residual Knowledge. Worthwhile retains the right to use anonymized, aggregated Engagement data—including code patterns, architectural decisions, and problem-solving approaches—for internal process improvement, including the development and refinement of Worthwhile's proprietary AI tools and methodologies, provided such use does not disclose Client's Confidential Information or identify Client. Ownership of AI model weights, fine-tuned models, or other AI artifacts created during an Engagement shall be allocated as specified in the applicable SOW; in the absence of SOW-specific terms, such artifacts are owned by Worthwhile. Nothing in these Terms restricts either party's use of residual knowledge—general skills, experience, ideas, concepts, and know-how—retained in the unaided memory of its Personnel, consistent with Section 6.4. For the avoidance of doubt, this Section 1.3(g) permits internal process improvement and AI-assisted service delivery, but does not permit the use of Client's Confidential Information to train any artificial intelligence model without Client's prior written consent.

1.4 Consulting and Advisory Services

Where Worthwhile provides strategic consulting, technology advisory, or decision-support Services, Client acknowledges that:

(a) Recommendations are based on Worthwhile's professional judgment and the information available at the time they are made.

(b) Client retains sole decision-making authority and responsibility for business decisions made based on Worthwhile's advice.

(c) Worthwhile does not guarantee specific business outcomes resulting from its recommendations.

(d) Advisory Services are distinct from implementation Services and are governed by the applicable SOW.

1.5 Change Orders

Any modification to the scope, Deliverables, timeline, or other material terms of an active SOW must be documented in a written Change Order signed by both parties ("Change Order") to be binding. If Client requests or directs work outside the scope of the active SOW without a signed Change Order, Worthwhile may, at its discretion, perform such work and invoice Client at Worthwhile's then-current standard rates. Worthwhile will use Commercially Reasonable efforts to notify Client before commencing material out-of-scope work.

1.6 No Professional Advice

Worthwhile's Services, including strategic consulting and advisory Services described in Section 1.4, do not constitute and are not a substitute for legal, regulatory, tax, accounting, compliance, or other licensed professional advice. Client is solely responsible for obtaining independent professional advice regarding the legal, regulatory, tax, and compliance implications of business decisions, technology implementations, and strategies discussed or recommended in connection with any Engagement. Worthwhile makes no representations regarding the compliance or conformity of its Deliverables or recommendations with any legal or regulatory requirements, or professional codes of conduct or ethics, except to the extent required generally of any service provider or expressly stated in the applicable SOW.

1.7 SOW Minimum Requirements

A valid Statement of Work must be in writing, signed by authorized representatives of both parties, and must include at minimum: (a) a description of the Services to be performed and Deliverables to be produced; (b) a timeline or milestone schedule; (c) pricing or rate structure, including any fixed-price or not-to-exceed amounts; and (d) acceptance criteria for Deliverables, or a reference to the acceptance process in Section 3.1. Any purported Engagement that does not satisfy these minimum requirements shall be governed by the Services by Request provisions of Section 1.1 and billed at Worthwhile's then-current standard rates. For the avoidance of doubt, informal communications—including emails, verbal agreements, or chat messages—do not constitute a valid SOW regardless of their specificity, unless subsequently formalized in a document meeting the requirements of this section.

---

2. Relationship Between the Parties

2.1 Independent Contractor

Worthwhile is an independent contractor. Nothing in these Terms creates an employment, partnership, joint venture, or agency relationship. Worthwhile retains sole discretion over the manner and means of performing the Services, subject to Client's right to specify desired outcomes and Deliverable requirements. Worthwhile is solely responsible for its own taxes, insurance, and employment obligations.

2.2 Subcontractors

Worthwhile may engage subcontractors to perform portions of the Services, provided that Worthwhile remains responsible for the conformity of Deliverables produced by its subcontractors in accordance with the applicable SOW Specifications. All subcontractors will be bound by written agreements that include: (a) confidentiality obligations at least as protective as those set forth in Section 5; (b) intellectual property assignment or licensing terms consistent with Section 6; (c) indemnification obligations in favor of Worthwhile sufficient to support Worthwhile's obligations to Client under these Terms; and (d) Commercially Reasonable insurance coverage, including professional liability insurance, with limits appropriate to the scope of the subcontractor's Engagement. Subcontractors will not be granted access to Client's Confidential Information or project materials until such agreements are in place. Where a claim arises directly from the acts or omissions of a specific subcontractor, Worthwhile reserves the right to assign to Client any claims or rights of recovery Worthwhile holds against that subcontractor with respect to such claim.

2.3 Shared Practices

Client may require Worthwhile to conform to reasonable written security, confidentiality, or operational practices consistent with Client's regulatory or commercial requirements ("Shared Practices"), provided Client notifies Worthwhile of such requirements in writing prior to or at the commencement of the Engagement. Worthwhile will implement Shared Practices using Commercially Reasonable efforts, and retains sole discretion over the manner in which it implements them. If compliance with a Shared Practice materially increases the cost or complexity of performing the Services, Worthwhile will notify Client and the parties will negotiate an appropriate adjustment to scope, timeline, or fees.

2.4 Non-Solicitation

During the term of any active Engagement and for a period of twelve (12) months following its conclusion, neither party will directly solicit or hire any employee of the other party who was involved in the Engagement, without the other party's prior written consent. This restriction does not apply to individuals who respond to general public job postings. If a party hires an employee of the other party in violation of this section, the hiring party shall pay the other party, as liquidated damages and not as a penalty, an amount equal to fifty percent (50%) of the hired individual's first-year annual compensation (including base salary and any signing bonus), pro-rated based on the proportion of the individual's work during the Engagement that involved substantive Services for the non-hiring party. In no event shall the liquidated damages under this section exceed $150,000 per individual. The parties agree that this amount, as adjusted, represents a reasonable estimate of the damages that would be suffered by the non-hiring party, which would be difficult to calculate precisely.

2.5 Client-Designated Contact

Client will designate a primary point of contact who is authorized to make decisions, approve Deliverables, and provide direction on behalf of Client. Additional contacts may be designated for specific projects. Worthwhile is entitled to rely on communications and approvals from designated contacts as binding on Client.

---

3. Client Responsibilities

The success of each Engagement depends on active Client participation. Client agrees to:

(a) Active Participation. Engage meaningfully throughout the project lifecycle, including attending scheduled meetings, reviewing work in progress, and participating in strategy sessions.

(b) Timely Feedback. Provide feedback, approvals, and requested information within the timeframes established for the Engagement. Delays in Client feedback may result in project timeline shifts, resource reallocation, and increased costs.

(c) Accurate Information. Provide complete and accurate information, materials, and access necessary for Worthwhile to perform the Services.

(d) Acceptance Testing. Review Deliverables and provide written acceptance or specific, actionable feedback within ten (10) business days of delivery, or as otherwise specified in the SOW. If Client does not respond within the applicable review period, the Deliverable is deemed accepted.

(e) Consequences of Delays. If Client delays are material, Worthwhile may pause work, adjust timelines, reassign team members, or adjust project costs upon written notice. Worthwhile will not be liable for delays caused by Client's failure to meet its responsibilities.

(f) Client Materials Warranty. Client represents and warrants that all materials, content, data, and intellectual property provided to Worthwhile for use in performing the Services are owned by Client or that Client holds sufficient rights and licenses to provide such materials. Client further warrants that Worthwhile's use of Client-provided materials in accordance with these Terms will not infringe, misappropriate, or violate the intellectual property rights, privacy rights, or other rights of any third party.

3.1 Acceptance Criteria and Revision Process

Deliverable acceptance is measured solely against the written Specifications and acceptance criteria defined in the applicable SOW. Client's rejection of a Deliverable must identify specific, objective non-conformities against the SOW Specifications with sufficient detail for Worthwhile to reproduce and address the issue. Vague, subjective, or non-specification-based rejections do not constitute valid rejection. Unless otherwise specified in the SOW, up to two (2) rounds of revision to address valid specification non-conformities are included in the Engagement fees. Additional revision rounds beyond the included rounds, or revisions addressing matters outside the original Specifications, will be billed at Worthwhile's then-current standard rates. A "round of revision" means a single consolidated written submission from Client identifying all known specification non-conformities, delivered within the review period established for the applicable Deliverable. Client should consolidate all known issues into each revision round; issues known to Client but not raised in a timely round are deemed accepted. If the parties cannot agree on whether a Deliverable conforms to Specifications, either party may escalate the matter under the dispute resolution procedures in Section 11.

---

4. Billing and Payment

4.1 Invoicing

Worthwhile issues invoices monthly via email to Client's designated billing contact, detailing the Services performed during the billing period. Alternative billing arrangements (such as milestone-based billing) may be specified in the applicable SOW.

4.2 Payment Terms

Unless otherwise specified in a SOW, invoices are due within fifteen (15) days of the invoice date ("Net 15"). A late payment surcharge of 1.5% per month (or the maximum rate permitted by law, whichever is lower) applies to any balance outstanding more than thirty (30) days after the invoice date.

4.3 Payment Methods

Worthwhile accepts payment by credit card, check, ACH, or wire transfer. Payment instructions are included on each invoice, or may be obtained by contacting clientservices@worthwhile.com.

4.4 Expenses

Pre-approved expenses incurred on Client's behalf will be invoiced to Client as incurred. For larger expenses, Worthwhile may request that Client pay the vendor directly. For travel, lodging, or other similar expenses, Worthwhile will comply with Client's reasonable written travel and expense reimbursement guidelines to the extent provided in advance.

4.5 Estimates

Cost estimates provided by Worthwhile are planning tools based on information available at the time and are not fixed-price commitments unless expressly stated in a SOW. Worthwhile's standard practice is to actively manage engagements to the communicated estimate and to notify Client if Worthwhile reasonably expects costs to exceed the estimate by more than fifteen percent (15%).

Client is responsible for payment of all Services performed prior to such notice. Worthwhile will not exceed the estimate beyond that threshold without Client's authorization, which may be provided in writing or through Client's continued direction or acceptance of Services following notice.

4.6 Rates

Worthwhile's standard rates are published at www.worthwhile.com/rates and may be updated from time to time. The rates applicable to a specific Engagement are those set forth in the governing SOW or, for Services by Request, Worthwhile's then-current published rates.

4.7 Suspension for Non-Payment

If any undisputed invoice remains unpaid more than thirty (30) days past its due date, Worthwhile may, upon fifteen (15) days' prior written notice to Client, suspend performance of any affected Engagement until all overdue undisputed amounts are paid in full. Suspension under this section does not: (a) relieve Client of its payment obligations; (b) constitute a breach by Worthwhile or grounds for termination for cause by Client; or (c) waive Worthwhile's right to terminate for cause under Section 12.3. Any project timelines, milestones, or deadlines affected by a suspension are automatically extended by the duration of the suspension. Upon receipt of full payment of all overdue amounts, Worthwhile will resume performance within ten (10) business days, subject to resource availability. Non-payment may also result in the revocation of intellectual property rights and licenses as set forth in Section 6.3.

---

5. Confidentiality

5.1 Definitions

"Confidential Information" means any data, materials, or information not generally known to the public, owned or possessed by a party (the "Disclosing Party") and disclosed to the other party (the "Receiving Party"), whether in oral, written, digital, or other form. Confidential Information includes any third-party information the Disclosing Party is obligated to keep confidential.

"Trade Secrets" means information protected under the South Carolina Trade Secrets Act (S.C. Code § 39-8-10 et seq.) or the Defend Trade Secrets Act (18 U.S.C. § 1832 et seq.). All Trade Secrets are Confidential Information.

5.2 Exclusions

Confidential Information does not include information that: (a) was already known to the Receiving Party at the time of disclosure; (b) was independently developed by the Receiving Party without reference to the Disclosing Party's Confidential Information; (c) is or becomes publicly available through no fault of the Receiving Party; (d) was rightfully disclosed to the Receiving Party by a third party without a confidentiality obligation; or (e) ceases to be confidential due to circumstances beyond the Receiving Party's control. The existence and general nature of the parties' business relationship is not confidential; however, the specific terms of any agreement are Confidential Information.

5.3 Obligations

Each Receiving Party will use Confidential Information solely for the purpose of performing its obligations or exercising its rights under these Terms. Each party will protect the other's Confidential Information using at least the same degree of care it uses for its own confidential information, and in no event less than Commercially Reasonable care. Confidential Information may be disclosed only to employees, agents, or subcontractors who have a need to know and who are bound by confidentiality obligations at least as protective as those set forth here.

5.4 Third-Party Confidentiality Obligations

Each Receiving Party agrees to comply with any confidentiality agreements or similar obligations to which the Disclosing Party is a party, to the extent the Disclosing Party notifies the Receiving Party of such agreements in writing prior to or at the commencement of the Engagement. Before disclosing Confidential Information or Trade Secrets to its employees, agents, or subcontractors, the Receiving Party will ensure that such individuals are bound by written confidentiality agreements with terms at least as restrictive as those in this section.

5.5 Duration

Confidentiality obligations survive termination of the Engagement indefinitely with respect to Trade Secrets, and for a period of five (5) years following termination for all other Confidential Information. Notwithstanding the foregoing, confidentiality obligations under this Section 5 shall automatically terminate with respect to specific Confidential Information that: (i) the Disclosing Party voluntarily makes publicly available without restriction; or (ii) becomes subject to public disclosure due to the Disclosing Party's dissolution, liquidation, or bankruptcy, to the extent such information enters the public domain as a result of those proceedings.

5.6 Equitable Relief

Both parties acknowledge that a breach of this section may cause irreparable harm. In the event of a breach, the Disclosing Party is entitled to seek equitable relief, including injunctive relief, without the requirement of posting a bond, in addition to any other remedies available at law or in equity.

5.7 Scope of Equitable Relief

The right to seek equitable relief under Section 5.6 or Section 6.7 is limited to the protection of the requesting party's own Confidential Information, Trade Secrets, and Intellectual Property. Neither party may seek or obtain injunctive relief that restrains the other party's general business operations, including the right to provide Services to other Clients, to employ or engage Personnel, or to use its own pre-existing IP, except to the narrowest extent necessary to prevent the specific harm at issue. Any request for injunctive relief must be narrowly tailored and proportionate to the threatened harm.

---

6. Intellectual Property

6.1 Definitions

"Intellectual Property" (or "IP") includes all materials protectable under patent, copyright, trademark, or trade secret law, including the right to register, license, and receive damages for infringement.

6.2 Pre-Existing IP

Each party retains ownership of its pre-existing intellectual property. Nothing in these Terms transfers ownership of any pre-existing IP except as expressly provided in Section 6.3. During the Engagement, Client grants Worthwhile a limited, revocable license to use Client's intellectual property solely to the extent necessary to perform the Services. Worthwhile retains ownership of its Service Provider Materials except to the extent any such materials are incorporated into Deliverables and assigned to Client under Section 6.3. For the avoidance of doubt, Service Provider Materials used by Worthwhile in performing the Services but not delivered to Client remain the property of Worthwhile.

6.3 Ownership of Deliverables

Subject to full payment, all intellectual property in Deliverables created specifically for Client under a SOW will be assigned to Client. No license, temporary or otherwise, is granted until all Preliminary Payments identified in the applicable SOW have been received. Until full payment is received, Worthwhile retains all right, title, and interest in any IP it develops. Worthwhile's remedies for non-payment, including revocation of licenses and suspension of Services, are set forth in Section 12.4.

6.4 Residual Knowledge

Nothing in these Terms prevents either party from using general knowledge, skills, experience, ideas, concepts, know-how, or techniques that are retained in the unaided memory of its Personnel, provided such use does not infringe the other party's IP rights or violate confidentiality obligations.

6.5 Open-Source Software

Deliverables may incorporate open-source components subject to their respective licenses. Worthwhile will identify material open-source components in the relevant SOW or project documentation. Client is responsible for compliance with applicable open-source license terms following delivery.

6.6 AI-Generated Content

To the extent that Deliverables include content generated with the assistance of AI Tools, ownership of such content transfers to Client as part of the Deliverable, subject to Section 6.3. Worthwhile does not warrant that AI-generated content is eligible for intellectual property registration or protection under current law, and Client assumes any risk associated with seeking such registration.

6.7 Equitable Relief for IP

Both parties acknowledge that the misappropriation, unauthorized use, or infringement of Intellectual Property may cause irreparable harm to the owner. In the event of any breach of this section, the non-breaching party is entitled to seek equitable relief, including a temporary restraining order, preliminary injunction, and permanent injunction, without the requirement of posting a bond, in addition to any other remedies available at law, in equity, or under this agreement.

---

7. Data Protection and Security

7.1 Data Handling Principles

Worthwhile processes data in accordance with the following principles:

(a) Data is collected and processed only for specified, legitimate purposes related to the Engagement.

(b) Access to Client data is restricted to authorized Worthwhile Personnel, each bound by confidentiality and data protection obligations no less protective than those in Sections 5 and 7, on a need-to-know basis.

(c) Data is encrypted both in storage and during transit using industry-standard protocols.

(d) Data retention is limited to the duration necessary for the Engagement unless otherwise permitted by law.

(e) Worthwhile will not intentionally transfer Client data to data centers outside the United States without prior written consent, except where such transfer is inherent to the operation of third-party infrastructure providers (such as cloud hosting, content delivery networks, or disaster recovery Services) used in the ordinary course of providing Services, provided such providers maintain data protection standards consistent with these Terms and any applicable Data Processing Addendum.

7.2 Data Ownership

As between Worthwhile and Client, Client-provided data remains Client's property or the property of Client's licensors at all times. Data generated by Worthwhile in the course of providing Services (such as analytics, logs, or derivative insights) belongs to Worthwhile, subject to a non-exclusive license granted to Client for its internal use. Each party is responsible for ensuring the legality of data it provides to the other.

7.3 Security Practices

Worthwhile maintains Commercially Reasonable administrative, technical, and physical safeguards designed to protect Client data, including appropriate Personnel screening practices. Security vulnerabilities may be reported to security@worthwhile.com.

7.4 Legal Disclosure

Worthwhile may disclose Client data if required by law, regulation, or valid legal process (such as a court order or subpoena), provided Worthwhile gives Client reasonable advance notice where legally permitted.

7.5 Data Security Incident Notification

In the event either party becomes aware of a security breach that results in verified unauthorized access to, disclosure of, or loss of the other party's data or proprietary materials ("Data Security Incident"), the affected party will: (a) notify the other party in writing within seventy-two (72) hours of discovering the Data Security Incident; (b) provide a description of the nature and scope of the breach, including the categories and approximate volume of data affected; (c) describe the measures taken or proposed to mitigate the breach; and (d) cooperate with the other party's incident response efforts, including providing reasonable assistance with notifications to affected individuals or regulatory authorities as required by applicable law. Each party will cooperate with the other party's investigation of any Data Security Incident by: (i) preserving relevant evidence and access logs in its possession; and (ii) providing timely access to systems or information reasonably necessary for the investigation. Public disclosure of a Data Security Incident identifying the other party shall be limited to disclosures required to be made by the disclosing party by applicable law.

7.6 Business Continuity

Worthwhile maintains Commercially Reasonable business continuity and disaster recovery measures designed to minimize disruption to active Engagements. In the event of a disruptive incident that materially affects Worthwhile's ability to perform Services under an active SOW, Worthwhile will: (a) notify Client within forty-eight (48) hours; (b) provide an estimated recovery timeline; and (c) use Commercially Reasonable efforts to resume performance as promptly as practicable.

7.7 Data Return and Portability

Upon termination or expiration of an Engagement, or upon Client's written request at any time during an active Engagement, Worthwhile will provide Client with a copy of Client-owned data in Worthwhile's possession in a commercially standard, machine-readable format (such as CSV, JSON, SQL export, or other format reasonably agreed by the parties). Client must submit data return requests within thirty (30) days of termination; requests submitted after this period will be accommodated on a Commercially Reasonable basis at Worthwhile's then-current standard rates. Following confirmation of successful data return and expiration of any applicable retention period required by law, Worthwhile will securely delete or destroy all copies of Client data in its possession and, upon Client's request, provide a written certification of destruction signed by an authorized representative. Worthwhile may retain anonymized or aggregated data that does not identify Client or any individual, subject to Section 7.2.

7.8 Post-Deployment Security Responsibilities

Following delivery and acceptance of software Deliverables, Client assumes responsibility for the ongoing security, maintenance, and operation of deployed systems, including: (a) applying security patches, updates, and upgrades recommended by Worthwhile or third-party vendors; (b) maintaining the security of the hosting environment, infrastructure, and access controls; (c) monitoring for and responding to security incidents affecting deployed systems; and (d) ensuring that modifications made to Deliverables after acceptance do not introduce security vulnerabilities.

Worthwhile's liability for security incidents affecting deployed software is limited to vulnerabilities in Worthwhile's original code as delivered and accepted, and does not extend to: (i) vulnerabilities introduced by Client's modifications or configurations; (ii) vulnerabilities in Client's infrastructure or hosting environment; (iii) vulnerabilities in third-party components governed by Section 8.4; or (iv) incidents resulting from Client's failure to apply patches or updates that Worthwhile has made available. Where Worthwhile provides ongoing hosting or managed Services under an active SOW, Worthwhile retains responsibility for application-layer security and configuration of the hosting environment within Worthwhile's direct operational control, excluding vulnerabilities in underlying third-party cloud infrastructure, hypervisors, or hardware not managed by Worthwhile.

Client's obligations under this Section 7.8 apply only to aspects of the deployment within Client's control (such as user access management, content, and Client-side configurations). For the avoidance of doubt, the limitation of liability provisions in Section 9 apply to hosting and managed Services on a per-SOW basis. Client will notify Worthwhile in writing within seventy-two (72) hours of discovering any security incident that affects or may affect Worthwhile-built Deliverables.

7.9 Data Processing Addendum

Where an Engagement involves the processing of personal data subject to applicable data protection laws—including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the Health Insurance Portability and Accountability Act (HIPAA), or other applicable privacy or data protection statutes—the parties shall execute a Data Processing Addendum ("DPA") as required by law and appropriate for the Engagement, which will be incorporated by reference into these Terms and the applicable SOW.

7.10 Client Cyber Insurance

Where Client hosts, operates, or maintains Worthwhile-built software systems in a production environment, Worthwhile strongly recommends that Client maintain Commercially Reasonable cyber liability insurance with limits appropriate to the nature and sensitivity of the data processed by such systems. For Engagements involving the processing of regulated personal data, specific insurance requirements, if any, will be set forth in the applicable Data Processing Addendum. Client's decision not to maintain cyber liability insurance does not diminish Client's obligations or liability under these Terms, including the allocation of post-deployment security responsibilities in Section 7.8.

---