Shadow AI Vulnerability Scanning Software
Authorized Partner Operator Click-Through Terms of Service

These Authorized Partner Operator Terms of Service ("Terms") govern an authorized reseller’s, distributor’s or independent consultant’s access to and operation of the Glasswing AI Shadow AI Vulnerability Scanning Software and related accounts, reports, documentation, support and hosted functionality (collectively, the "Scanner Service"). The Scanner Service is provided by IPivot, Corp. d/b/a Glasswing.ai ("Glasswing").

Purpose of the Scanner Service

The Scanner generates controlled test traffic from an authorized corporate endpoint to determine whether selected AI applications and agents appear Accessible, Blocked, Redirected or Inconclusive through the organization’s existing cybersecurity controls. In addition to assessing cybersecurity exposure, the Scanner serves as an important sales lead-generation and qualification tool.

A Contractual and Authorized Partner may use the Scanner Service to assess authorized customer and prospect corporate endpoints, networks and cybersecurity environments for this purpose. Partner may use the resulting Product Output to generate and qualify Glasswing sales opportunities and arrange follow-up meetings to explain the findings, discuss potential remediation and evaluate relevant Glasswing products, professional services or other next steps. The Scanner identifies potential open Shadow AI exposure; it does not establish actual AI-application or AI-agent usage, prompt submission, data transfer, file upload or download, data leakage or organization-wide exposure.

1. Eligibility; No Appointment Created

Partner must be a contractual and authorized reseller, distributor or independent consultant acting solely in a commercial or professional capacity under a current written reseller, distribution, consulting or other partner agreement with Glasswing ("Partner Agreement") and the applicable entitlement. These Terms are not offered for personal or consumer use. These Terms do not independently appoint Partner, grant a territory, establish exclusivity, create deal-registration rights or authorize use of Glasswing trademarks beyond the Partner Agreement.

Partner’s authority to resell, distribute, demonstrate or operate the Scanner Service exists only within the scope and term of the Partner Agreement, applicable Order Form and account entitlement. Partner shall stop using the Scanner Service when that authority expires, is suspended or is terminated.

2. Agreement Structure and Order of Precedence

The applicable purchase record, quote or ordering document is the "Order Form." The Glasswing AI Data Processing Addendum ("DPA") governs Glasswing’s Processing of personal data on Partner’s behalf. Together, these Terms, the Partner Agreement, applicable Order Form and DPA form the agreement governing Partner’s operation of the Scanner Service (the "Operator Agreement"). The Glasswing AI End User License Agreement ("EULA") governs separately purchased Glasswing products, and the Customer Terms of Service govern a customer’s own license and use when applicable.

In a conflict: (a) incorporated international-transfer clauses control to the extent required by law; (b) the DPA controls Processing and protection of personal data; (c) the Partner Agreement controls appointment, resale authority, territory, discounts, deal registration, customer ownership and other channel-commercial matters; (d) the Order Form controls pricing, quantities, term, Product Edition and purchased scope; (e) these Terms control Partner’s installation, access, operation and use of the Scanner Service; and (f) the EULA controls separately purchased product licenses.

"Product Edition" means the edition, configuration and entitlement identified in the Order Form, license key or Partner account. "Product Output" means reports, findings, scores, classifications, recommendations, exports and other results generated by or derived from the Scanner Service. "Customer Data" means data, information and content submitted to, collected by or Processed through the Scanner Service by or for Partner or an Assessment Customer, excluding Protected AI Assets and aggregated or de-identified information that does not identify Partner, an Assessment Customer or an individual. "Process" and "Processing" have the meanings assigned in the DPA.

"Protected AI Assets" means all current and future Glasswing software, source code, object code, binaries, applications, tools, scanners, agents, interfaces, APIs, architectures, configurations, credentials, license keys, datasets and databases—including the Fbot dataset and intelligence—destination and domain lists, SNI and related identifiers, signatures, mappings, metadata, classifications, categories, labels, taxonomies, risk scores, country and jurisdiction attributes, testing and scoring methodologies, reports, analytics, dashboards, Product Output, models, model artifacts, embeddings, vector databases, knowledge graphs, retrieval systems, algorithms, workflows, documentation, research, findings, trade secrets, know-how, improvements, modifications, derivative works and all selections, arrangements, compilations and nonpublic characteristics of the foregoing, whether or not separately protectable under intellectual-property law.

"Security Incident" means any actual or reasonably suspected unauthorized access, acquisition, use, disclosure, copying, extraction, loss, alteration, compromise or destruction of the Scanner Service, credentials, Product Output, Customer Data, Protected AI Assets or systems used to access, store or Process them.

Glasswing and its licensors retain all right, title and interest in the Scanner Service and Protected AI Assets. Except for rights expressly granted in the Operator Agreement, no rights are granted by implication, estoppel or otherwise.

3. Accounts, Authorized Partner Operators and Responsibility

“Authorized Partner Operator” means the single, specifically identified Partner employee whom Partner designates, and Glasswing authorizes, to install, access and operate the Scanner Service under a particular purchased partner-operator license or seat. An independent contractor may not serve as an Authorized Partner Operator unless Glasswing expressly approves that individual in writing. Partner is responsible for registration and billing information, credential security, training, supervision, the Authorized Partner Operator and all activity under its licenses, seats and accounts.

Each purchased partner-operator license or seat may be assigned to only one Authorized Partner Operator and activated on only one registered partner-issued Windows, macOS or Linux endpoint owned or controlled by Partner (“Authorized Partner Endpoint”). Only the identified Authorized Partner Operator may access, install, configure or operate the Scanner Service or initiate an Assessment under that license or seat. Partner shall permit operation only after completion of any training or certification required by Glasswing and shall not share installers, credentials, activation keys, licenses, seats or account access.

4. Partner Operator License; Resale Distinction

Subject to timely payment and compliance with the Operator Agreement, Glasswing grants Partner a limited, non-exclusive, non-transferable and non-sublicensable right during the applicable term to designate one Authorized Partner Operator for each purchased partner-operator license or seat to install, access and operate the Scanner Service on one Authorized Partner Endpoint within the purchased limits for Partner’s internal enablement and to assess the authorized corporate endpoints, networks and cybersecurity environments of Partner’s customers and prospects for sales lead generation, sales qualification, exposure assessment and remediation validation. Only one Active Assessment may be conducted under a license or seat at a time.

The operator license does not transfer ownership of the Scanner Service to Partner or an Assessment Customer. Any right to resell the Scanner Service must arise from the Partner Agreement. Unless Glasswing expressly approves otherwise, an end-customer license is provisioned directly to the end customer and requires the end customer to accept the applicable Customer Terms of Service and DPA.

Partner may use only the Product Edition, scan counts, reruns, locations, retention, report rights and number of partner-operator licenses or seats shown in the Order Form or entitlement. Each purchased license or seat permits one Authorized Partner Operator, one Authorized Partner Endpoint and no more than one Active Assessment at a time. A Remediation Validation Report is an included capability when entitled, not a separate software license.

“Active Assessment” means an Assessment that has been initiated and has not completed, failed, been cancelled or otherwise terminated by the Scanner Service.

Authorized Partner Operator Reassignment. Partner may request reassignment of a license or seat to another employee by providing the replacement employee’s name, business email address, title, certification status and other information reasonably requested by Glasswing. Reassignment is effective only after Glasswing approves the request and updates the entitlement. Unless Glasswing approves otherwise, a license or seat may not be reassigned more than once during any thirty-day period.

Authorized Partner Endpoint Reassignment. Partner may request reassignment to a replacement partner-issued Windows, macOS or Linux endpoint owned or controlled by Partner. Reassignment is effective only after Glasswing approves and registers the replacement endpoint and deactivates the previously registered endpoint. Unless Glasswing approves otherwise, an Authorized Partner Endpoint may not be reassigned more than once during any thirty-day period.

5. Permitted Partner Operating Models

An "Assessment Customer" is a customer or prospect that has authorized Partner to conduct an assessment. Partner may operate under these models only within its entitlement:

• Resale only: Partner facilitates a sale but does not access or Process the end customer’s personal data;
• Partner-operated assessment: Partner conducts or manages an authorized assessment for an Assessment Customer;
• Customer-owned, Partner-assisted operation: the Assessment Customer owns the entitlement and authorizes the Authorized Partner Operator to assist; or
• Glasswing-approved demonstration or simulation: Partner uses only synthetic or expressly approved demonstration data and functionality.

Partner shall not use a live assessment entitlement as a general demonstration tool, convert a simulation into a live customer assessment without authorization, or provide managed services beyond rights granted in the Partner Agreement.

Within the Partner Agreement and applicable entitlement, Partner may use authorized assessment findings to identify and qualify potential Glasswing opportunities, explain open Shadow AI exposure, recommend a full assessment or remediation engagement, support an authorized Scanner resale, and validate whether remediation changed the tested result. These permitted sales activities do not authorize testing without Assessment Authorization or permit unsupported, deceptive or organization-wide claims.

6. Required Customer and Prospect Authorization

Before every live third-party assessment, Partner must obtain legally sufficient written authorization ("Assessment Authorization") from the owner or authorized administrator of every endpoint, network, DNS service, security tenant and environment to be tested. Authorization from a prospect is required to the same extent as authorization from an existing customer.

The Assessment Authorization must identify the Assessment Customer; authorized representative and contact information; approved endpoints, networks, DNS services, security tenants and locations; permitted dates or testing window; approved Tested Paths; purpose; applicable data scope; the authorized Partner Operator; escalation contact; and any restrictions or stop conditions.

Partner and the Authorized Partner Operator may not approve or self-authorize an assessment on behalf of an Assessment Customer. Glasswing may rely on an Assessment Authorization supplied by Partner, but that reliance does not reduce Partner’s responsibility for its validity, scope or accuracy. Government or public-sector assessments require Glasswing’s prior written approval and any applicable public-sector terms.

Partner shall verify the signer’s authority, retain the Assessment Authorization and related scope evidence for at least five years after the assessment, provide it to Glasswing upon reasonable request, and immediately stop testing if authorization is withdrawn, the responsible owner requests a stop or unexpected operational impact occurs.

Partner shall not assess unrelated third parties, service-provider tenants, personal environments, guest networks or other systems that the Assessment Customer does not own or have authority to test. Knowledge of a DNS resolver or IP address is not authorization.

7. Tested Path and Defensible Results

"Tested Path" means the endpoint, active DNS resolver and route, egress and destination path, and the endpoint, browser, VPN, Zero Trust/SSE, CASB, firewall, proxy, secure web gateway and other controls through which Scanner Service traffic actually travels.

Partner must verify and document the reference endpoint, network family, DNS resolver and egress path; VPN or Zero Trust steering and policy health; endpoint, browser, CASB, firewall, proxy and secure-web-gateway status; whether the scanner process is within enforcement scope; and available control-console evidence.

Partner shall not characterize results as a defensible assessment of corporate control coverage when the scan used a home, guest, unmanaged, bypass or otherwise unqualified path. Partner must disclose material limitations and may describe only accessibility from the Tested Path actually assessed.

8. Exposure Testing; Not Usage Monitoring

The Scanner Service generates controlled DNS queries and TLS connection attempts, including Server Name Indication, to determine whether selected AI-application destinations appear Accessible, Blocked, Redirected or Inconclusive from the tested endpoint and active path. An Accessible result identifies a potential exposure or control-coverage gap; it does not prove employee use, communication with an AI application, AI-agent execution, prompt submission, data transmission or file upload or download.

Unless a separately licensed capability expressly states otherwise, the Scanner Service does not inspect prompts, responses, content, files or actual employee traffic. Partner shall accurately explain this limitation in demonstrations, proposals, reports and customer discussions.

The Scanner Service is designed to generate limited DNS and TLS traffic and is not designed for exploitation, disruption, penetration testing or vulnerability testing of an external destination. Partner shall not configure or use it for those purposes.

9. Limited Dataset Sample

The Scanner Service tests only a limited sample of destinations selected from Glasswing’s proprietary dataset and does not disclose or test 100% of that dataset. The number and selection may vary by Product Edition, entitlement, assessment configuration and methodology. An application not included in an assessment must not be interpreted as blocked, inaccessible, approved, absent or evaluated.

10. Result Definitions and Required Interpretation

Result	Required meaning
Accessible	The destination appeared reachable from the Tested Path; potential exposure, not proof of usage.
Blocked	Corroborated evidence indicated that an applicable control denied the tested connection. A timeout, DNS failure, connection error or unavailable destination is not, by itself, Blocked.
Redirected	The Tested Path appeared to send the request to a different destination or approved alternative.
Inconclusive	Available evidence did not support a reliable Accessible, Blocked or Redirected classification.

Partner shall identify the tested endpoint, Tested Path, assessment time, relevant configurations, confidence and limitations. Partner shall not represent results as organization-wide, continuous, proof of use, proof of data transfer, compliance certification or a guarantee of security or policy effectiveness.

11. Product Output; Delivery and Customer Communications

Partner may deliver authorized Product Output to the applicable Assessment Customer and use it internally solely to support that authorized engagement. Partner may share it with Glasswing and with advisers or remediation providers authorized by the Assessment Customer and bound by confidentiality and restricted-use obligations at least as protective as those applicable to the Product Output.

Partner must preserve Glasswing attribution and report legends unless Glasswing approves a white-label arrangement in writing. Partner shall not alter results out of context, omit material limitations, make unsupported comparative claims, publicly publish, sell, separately license or benchmark Product Output, or represent that Glasswing has guaranteed or certified the Assessment Customer’s security or compliance.

Partner may recommend a Glasswing meeting, full assessment or remediation engagement, but shall not use Product Output to pressure, deceive or materially misrepresent risk. Partner is responsible for its proposals, sales statements and recommendations.

12. Resale, Marketing and Brand Conduct

Partner may market and resell only as authorized by the Partner Agreement. Partner shall use current Glasswing-approved product names, descriptions, trademarks, claims and materials; shall not modify Glasswing marks; and shall not make warranties, commitments, discounts, support promises, performance claims or legal representations on Glasswing’s behalf unless expressly authorized in writing.

Except where Glasswing is the seller of record or applicable law permits otherwise, Partner independently determines its end-customer resale prices and commercial terms. Any suggested resale price or pricing guidance from Glasswing is nonbinding, and Partner remains responsible for complying with competition and antitrust laws.

Partner is an independent contractor and has no authority to bind Glasswing. Partner shall not imply exclusivity, agency, endorsement of an Assessment Customer, or ownership of Glasswing technology or datasets. Customer and opportunity protection, if any, is governed solely by the Partner Agreement and approved deal registration.

13. Acceptable Use and Protected AI Assets

Partner shall not, and shall not permit others to:

• scan without authorization, exceed an approved scope or use the Scanner Service unlawfully or disruptively;
• copy, reproduce, modify, translate, adapt, distribute, sell, resell, license, sublicense, rent, lease, lend, host, timeshare or otherwise provide the Scanner Service or Protected AI Assets except as expressly authorized by the Operator Agreement;
• reverse engineer, decompile, disassemble, decode, analyze, inspect or test the Scanner Service or Protected AI Assets to discover source code, structure, composition, logic, algorithms, methods, nonpublic interfaces, vulnerabilities, destination-selection criteria or other underlying ideas, except only to the limited extent a restriction is prohibited by applicable law after prior written notice to Glasswing;
• bypass licensing, usage limits, access controls, technical safeguards, monitoring, authentication or other protective measures, or access nonpublic functionality;
• scrape, crawl, spider, mine, harvest, enumerate, download, export, extract, record or capture nonpublic destination lists, domain or SNI data, metadata, classifications, taxonomies, scores, mappings, testing methods, results at scale or other Protected AI Assets;
• identify, infer, reconstruct, approximate, reproduce, map, enrich or create a substitute or derivative dataset, taxonomy, scoring system, destination inventory, intelligence service or replacement for any Protected AI Asset, including through repeated queries, scans, reruns, aggregation, correlation or statistical inference;
• use the Scanner Service, Product Output or Protected AI Assets to develop, train, fine-tune, reinforce, align, optimize, test, validate, evaluate, benchmark, distill, extract, improve or operate any artificial-intelligence, machine-learning, analytics, cybersecurity, discovery, classification, governance or competitive product, service, model or dataset;
• place, upload, submit, disclose or make the Scanner Service, Product Output or Protected AI Assets available to any generative-AI system, retrieval-augmented generation system, vector database, embedding system, knowledge graph, autonomous agent, synthetic-dataset process, prompt library, model-extraction system, code assistant or third-party content-analysis service, except a Glasswing-approved system used strictly for the authorized engagement;
• benchmark, conduct competitive analysis, compare vendor coverage, publish comparative claims or use results to evaluate Glasswing or another vendor without Glasswing’s prior written consent;
• provide software, credentials, destination lists, Product Output or nonpublic documentation to a customer, prospect, competitor, unauthorized person or unauthorized territory except for expressly permitted delivery of Product Output;
• challenge Glasswing’s ownership, seek to register intellectual-property rights in Protected AI Assets, remove proprietary notices or misrepresent the source, ownership or limitations of Product Output;
• introduce malicious code, interfere with integrity or attempt unauthorized access; or
• use the Scanner Service or Protected AI Assets for competitive intelligence, commercial exploitation unrelated to an authorized engagement, or any purpose outside the Operator Agreement.

Partner shall promptly notify Glasswing of suspected extraction, reconstruction, competitive misuse or an attempt to obtain Protected AI Assets beyond the authorized interface. No assessment, report-delivery right, interoperability activity or legal exception grants a right to retain, disclose or use Protected AI Assets beyond the minimum expressly authorized scope.

14. Data Protection, Privacy Roles and Telemetry

Partner is not a processor or Subprocessor solely because it resells or supports the Scanner Service. If an Assessment Customer engages Partner to conduct or manage an assessment, the Assessment Customer is ordinarily the controller or business, Partner is ordinarily its processor or service provider, and Glasswing may act as Partner’s Subprocessor. Roles depend on actual Processing activities, contracts and applicable law.

If an end customer contracts directly with Glasswing and Partner merely facilitates the sale without accessing personal data, Partner ordinarily has no processor role. If Partner Processes personal data at the end customer’s documented direction, Partner may act as the end customer’s processor or service provider. If Glasswing appoints Partner in writing to Process personal data on Glasswing’s behalf, Partner may act as Glasswing’s Subprocessor. Partner shall not assume a Subprocessor role without a written appointment defining its instructions and obligations.

Partner shall accept and comply with DPA Version 1.2 when Glasswing Processes personal data on Partner’s behalf. Partner shall obtain documented customer instructions, provide required privacy and employee notices, establish a lawful basis, address workplace-monitoring and works-council requirements, honor data-subject rights, avoid unnecessary sensitive data and use Product Output containing personal data only for the authorized engagement.

Personal data contained in Product Output, telemetry or scanner results remains protected under the DPA and applicable law. Partner shall not sell or share personal data, use it for unrelated marketing, combine customer datasets, build employee profiles for unrelated purposes or make employment decisions based solely on scanner-accessibility results.

Glasswing may collect operational telemetry and use aggregated or de-identified information as permitted by the DPA. Partner is responsible for accurately informing the Assessment Customer of the parties that will Process personal data.

15. Security and Confidentiality

Each party will use reasonable safeguards appropriate to the information it handles. Partner shall maintain least-privilege access, unique accounts, multifactor authentication where available, endpoint and network security, credential management, secure report storage and transmission, personnel training, incident response, logging and secure deletion practices appropriate to its operation of the Scanner Service and protection of Protected AI Assets.

Partner shall notify Glasswing without undue delay, and in no event later than twenty-four hours after discovery, of a Security Incident. Notice shall include available information about the nature, timing, systems and information affected, containment measures and responsible contact. Partner shall promptly contain, investigate and remediate the Security Incident; preserve relevant evidence; provide material updates; avoid public statements identifying Glasswing without prior consultation unless legally required; and reasonably cooperate with Glasswing and affected Assessment Customers. Partner shall not notify regulators or third parties on Glasswing’s behalf without Glasswing’s written authorization unless required by law.

Each party shall protect the other party’s nonpublic confidential information using at least reasonable care, use it only for the Operator Agreement and disclose it only to personnel and advisers who need to know and are bound by confidentiality. Standard public, prior-knowledge, independent-development and lawful-receipt exclusions apply. Confidentiality survives five years; trade-secret and Protected AI Asset duties continue while protected by law; and duties for personal data continue while retained.

16. Feedback; Ownership Reservation

Partner may provide suggestions, corrections, ideas, enhancement requests or other feedback concerning the Scanner Service or Protected AI Assets (collectively, "Feedback"). Partner is not required to provide Feedback. To the extent Partner does so, Partner grants Glasswing a perpetual, irrevocable, worldwide, transferable, sublicensable and royalty-free right to use, reproduce, modify, distribute, commercialize and otherwise exploit the Feedback without restriction or attribution, provided that Glasswing does not publicly identify Partner as the source without permission.

No Assessment Authorization, access right, operator license, report-delivery right, Feedback submission, interoperability activity or disclosure transfers ownership of the Scanner Service, Product Output, Protected AI Assets or any improvement, modification or derivative work. Partner shall not contest or assist another person in contesting Glasswing’s ownership or intellectual-property rights.

17. Assessment Records; Audit and Cooperation

Partner shall maintain records reasonably sufficient to demonstrate compliance, including Assessment Authorizations, scope, dates, operator identity, Tested Path evidence, entitlement used, reports delivered, customer contacts, applicable Terms and DPA versions, security incidents and deletion or retention status. Partner shall retain Assessment Authorization and scope records for at least five years unless law or the Partner Agreement requires longer.

Upon reasonable notice, Glasswing may verify Partner’s compliance no more than once in a twelve-month period and additionally after a suspected material violation, unauthorized scan, Security Incident, regulator request or credible dataset-extraction, reconstruction or competitive-misuse concern. Verification may include written certifications, relevant records, entitlement and access logs, and a narrowly scoped audit by Glasswing or an independent professional bound by confidentiality. It must minimize disruption and protect unrelated customer information. Partner shall cooperate, preserve relevant evidence and promptly correct identified material noncompliance. If verification confirms a material violation, Partner shall reimburse Glasswing’s reasonable verification costs to the extent permitted by law.

18. Service Changes, Support and Availability

Glasswing may update the Scanner Service, supported destinations, methodology and features for security, accuracy, performance or compliance. Glasswing will not materially reduce purchased core functionality during a paid term without reasonable notice, except for a security, legal or third-party dependency issue. Support, service levels, maintenance and end-of-life commitments apply only if stated in the Partner Agreement, Order Form or incorporated support policy.

19. Fees, Taxes, Renewal and End-Customer Transactions

Fees, payment, discounts, term, renewal, cancellation, resale economics and taxes are governed by the Partner Agreement, Order Form or purchase flow. Partner is responsible for taxes on its transactions, excluding taxes on Glasswing’s net income. Partner shall not collect payment, issue refunds or make commitments on Glasswing’s behalf except as expressly authorized.

If Partner purchases a renewing operator subscription, the Order Form or purchase flow will state the renewal period, price or pricing method, notice period and cancellation procedure. Fees are nonrefundable except as expressly stated in the Operator Agreement.

20. Suspension and Termination

Glasswing may immediately suspend access for unauthorized scanning, missing or falsified Assessment Authorization, dataset extraction or reconstruction, credential compromise, a Security Incident, security threat, unlawful activity, sanctions exposure, material misrepresentation, competitive misuse or use outside the Partner Agreement. For nonpayment or a correctable administrative issue, Glasswing will provide notice and a reasonable opportunity to cure when practicable. Glasswing will restore access within a commercially reasonable period after the condition causing suspension has been resolved.

Either party may terminate for an uncured material breach after thirty days’ written notice, immediately for an incurable breach, or upon insolvency or cessation of business to the extent permitted by law. Glasswing may terminate immediately for repeated unauthorized scanning, extraction or reconstruction, competitive misuse, intentional misrepresentation, material compromise of Protected AI Assets or loss of Partner authorization.

Upon expiration or termination, Partner shall stop operating and representing authorization to use the Scanner Service; return or securely delete software, credentials, nonpublic materials and Protected AI Assets; and preserve or deliver Product Output and customer records as required by law, the Assessment Customer and the Operator Agreement. At Glasswing’s request, Partner shall certify completion in writing. Personal-data return and deletion are governed by the DPA.

21. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EXCEPT FOR EXPRESS WARRANTIES IN THE PARTNER AGREEMENT OR ORDER FORM, THE SCANNER SERVICE AND PRODUCT OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE.” GLASSWING DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

GLASSWING DOES NOT WARRANT THAT THE SCANNER SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE; IDENTIFY EVERY APPLICATION, AGENT, DOMAIN, CONTROL OR EXPOSURE; PRODUCE THE SAME RESULT FROM ANOTHER ENDPOINT OR PATH; OR ESTABLISH ACTUAL USAGE, DATA TRANSFER, COMPLIANCE, SECURITY OR ABSENCE OF RISK.

22. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE OR CONSEQUENTIAL DAMAGES, OR LOST PROFITS, REVENUE, BUSINESS, GOODWILL OR DATA, ARISING FROM THE SCANNER SERVICE, EVEN IF ADVISED OF THE POSSIBILITY.

EXCEPT FOR AMOUNTS THAT CANNOT LAWFULLY BE LIMITED AND ANY DIFFERENT CAP IN THE PARTNER AGREEMENT, EACH PARTY’S AGGREGATE LIABILITY ARISING FROM THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE BY PARTNER FOR THE SCANNER SERVICE DURING THE TWELVE MONTHS PRECEDING THE EVENT. THIS CAP DOES NOT APPLY TO PAYMENT OBLIGATIONS, PARTNER’S BREACH OF SECTION 6 OR 13, INDEMNIFICATION OBLIGATIONS, OR A PARTY’S FRAUD, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

23. Partner Indemnification

Partner will defend Glasswing and its affiliates, officers, directors and personnel from a third-party claim and indemnify them for covered damages, settlements and reasonable costs to the extent arising from Partner’s unauthorized or out-of-scope assessment; absence or falsification of Assessment Authorization; unlawful use; privacy or workplace-monitoring violation; Customer Data infringement; sales promise or misrepresentation; unauthorized publication or alteration of Product Output; acts or omissions of the Authorized Partner Operator or other Partner personnel; dataset extraction, reconstruction, unauthorized AI-system use or competitive misuse; breach of Section 13; or gross negligence, willful misconduct or fraud.

Glasswing will give prompt notice, provide reasonable cooperation at Partner’s expense and permit Partner to control the defense with qualified counsel. Partner may not settle in a manner that admits Glasswing fault, imposes liability or requires Glasswing action without prior written consent, not to be unreasonably withheld. If Partner fails to assume or diligently conduct the defense, Glasswing may defend or settle and recover reasonable covered costs.

24. Compliance with Law; Export, Sanctions and Anti-Corruption

Partner shall comply with applicable privacy, employment, computer-access, cybersecurity, marketing, export-control, sanctions, anti-bribery and anti-corruption laws. Partner shall not permit access from an embargoed jurisdiction or prohibited party, export or re-export contrary to law, offer anything of value to improperly influence a decision, or scan a system without legally sufficient authorization.

25. Electronic Acceptance and Records

Partner agrees to transact electronically. The acceptance interface must display conspicuous links to these Terms and DPA Version 1.2, identify each version, use an unchecked affirmative-acceptance checkbox, allow download or printing, and prevent operation until acceptance. Glasswing may retain Partner’s legal name and type, Partner Agreement identifier, accepting user and business email, authority representation, UTC timestamp, IP address, user-agent, document versions, entitlement, immutable copies or hashes and related audit evidence. Glasswing will make an accepted copy available to Partner.

26. Equitable Relief; Governing Law and Venue

Partner acknowledges that unauthorized disclosure, extraction, reconstruction, competitive use or other misuse of Confidential Information or Protected AI Assets may cause immediate and irreparable harm for which monetary damages may be inadequate. Glasswing may seek temporary, injunctive or equitable relief, without limiting other remedies and without posting bond except to the extent required by law.

These Terms are governed by Delaware law, without regard to conflict-of-law principles. Subject to Glasswing’s right to seek temporary, injunctive or equitable relief in any court of competent jurisdiction, the parties consent to the exclusive jurisdiction and venue of the state courts located in Delaware and the United States District Court for the District of Delaware.

27. General

Partner may not assign these Terms without Glasswing’s consent, except with a permitted assignment under the Partner Agreement. Partner may not assign to a Glasswing competitor. Neither party is liable for delay caused by events beyond reasonable control, excluding payment obligations.

The parties are independent contractors. These Terms do not create partnership, agency, fiduciary, franchise or employment relationships. The parties do not intend to create a franchise; if mandatory law would require registration, disclosure or other franchise compliance, Partner shall not operate under these Terms in the affected jurisdiction unless the parties execute an appropriate written arrangement.

If a provision is unenforceable, it will be enforced to the maximum lawful extent and the remainder remains effective. Failure to enforce is not a waiver.

The Operator Agreement is the entire agreement concerning Partner’s operation of the Scanner Service. These Terms may be amended by a later click-through version affirmatively accepted by Partner, but a click-through amendment does not amend the Partner Agreement, an Order Form or the DPA except where that document expressly permits the amendment or the parties separately agree in writing.

Provisions concerning accrued payments, Assessment Authorization and records, Product Output, Protected AI Assets, privacy, confidentiality, acceptable use, disclaimers, liability, indemnification, law and venue, and provisions that by nature should survive will survive expiration or termination.

28. Notices and Contact

Legal notices to Partner may be sent to its account administrator or address in the Partner Agreement or Order Form. Notices to Glasswing must be sent to IPivot, Corp. d/b/a Glasswing.ai, Attn: Legal, 31241 North Star Way, Valley Center, CA 92082, with a copy to legal@ipivot.ai. Partner is responsible for keeping its contact information current.

CLICK-THROUGH ACCEPTANCE RECORD

Present this record immediately above the acceptance control. The application should retain the accepted document versions, Partner account, accepting user, timestamp and associated audit evidence.

Partner legal name	____________________________________________
Partner type	Reseller / Distributor / Independent Consultant
Partner Agreement ID	____________________________________________
Authorized representative	____________________________________________
Title	____________________________________________
Business email	____________________________________________
Acceptance action	I ACCEPT
Operator Terms version	1.4 — August 19, 2026
DPA version	1.2 — August 5, 2026
Date/time and audit ID	Captured electronically