Free 30-Minute AI Audit: NDA and data consent

MUTUAL NON-DISCLOSURE AGREEMENT

AND DATA PROCESSING CONSENT

Free 30-Minute AI Audit

Version 1 of Wed, Nov 11, 2026

This Mutual Non-Disclosure Agreement and Data Processing Consent (this "Agreement") is entered into as of the Effective Date (defined in Section 9) by and between KISS SOFTWARE, LLC, a California limited liability company (California Entity No. B20250031085), having its business address at 1968 S. Coast Hwy #3320, Laguna Beach, CA 92651, USA, represented by its Manager, Mr. Yevhen Kasyanenko ("KISS"), and the company identified in the Acceptance Record under Section 9 (the "Client"). KISS and the Client are each a "Party" and together the "Parties".

1. PURPOSE

1.1 KISS offers the Client a free AI audit: KISS reviews one data set selected by the Client, estimates in U.S. dollars per month where the reviewed business process may be losing money, and presents the results and three suggested fixes on a call of about 30 minutes, followed by a one-page written report (the "Audit"). The Audit and the report are the only purpose for which KISS may use the Client's information (the "Purpose").

1.2 The Audit is free of charge. Neither Party is obliged to enter into any further agreement. Any paid work is performed only under a separate written agreement or statement of work signed by both Parties.

2. DEFINITIONS

2.1 "Confidential Information" means any non-public business, technical, financial or personal information disclosed by one Party (the "Discloser") to the other (the "Recipient") in connection with the Purpose, in any form, including the Audit Data, the Audit report and the terms of this Agreement.

2.2 "Audit Data" means the export, report or read-only account access the Client provides for the Audit, as listed in Schedule 1, and any copy, extract or analysis of it made by KISS.

2.3 "Personal Information" has the meaning given in the California Consumer Privacy Act of 2018, as amended (Cal. Civ. Code Section 1798.100 et seq., the "CCPA"), and includes phone numbers, email addresses, names and the content of communications.

3. CONFIDENTIALITY

3.1 The Recipient shall (a) use the Discloser's Confidential Information only for the Purpose, (b) not disclose it to any third party except to its personnel and service providers who need to know it for the Purpose and are bound by confidentiality obligations at least as protective as this Agreement, for whom the Recipient remains fully responsible, and (c) protect it with at least reasonable care.

3.2 Confidential Information does not include information that the Recipient can show (a) is or becomes public through no fault of the Recipient, (b) was lawfully known to the Recipient before disclosure without a duty of confidentiality, (c) is lawfully received from a third party without a duty of confidentiality, or (d) is independently developed without use of the Discloser's Confidential Information. Exceptions (a) to (d) do not apply to Personal Information.

3.3 If the Recipient is required by law or court order to disclose Confidential Information, it shall, where legally permitted, give the Discloser prompt written notice and disclose only what is legally required.

3.4 The confidentiality obligations continue for two (2) years after the Effective Date and, for trade secrets and Personal Information, for as long as the information remains a trade secret or is held by the Recipient.

4. CLIENT RESPONSIBILITIES FOR THE AUDIT DATA

4.1 The Client represents that it has the right to provide the Audit Data to KISS for the Purpose, and that any Personal Information in it was collected with the notices and consents required by applicable law.

4.2 Call recordings. The Client shall provide call recordings or transcripts only if every party to each recorded call consented to the recording where the law requires it, including California Penal Code Section 632. Call logs without recordings are sufficient for the Audit.

4.3 Excluded data. Unless the Parties agree otherwise in a separate signed writing, the Client shall not provide: protected health information under HIPAA; payment card numbers or bank account credentials; Social Security, driver's license, passport or other government identification numbers; passwords or login credentials (read-only access is granted through the platform's own user invitation); information about children under 16; or data that the Client is contractually prohibited from sharing. If such data is received by mistake, KISS shall not use it, shall delete it promptly and shall inform the Client.

4.4 Minimization. The Client is encouraged to mask phone numbers, email addresses and names before sending the Audit Data. KISS shall mask or remove direct identifiers it does not need for the Audit before any AI processing. The Parties acknowledge that replacing names does not by itself make data anonymous.

5. HOW KISS PROCESSES THE AUDIT DATA

5.1 Service provider. To the extent the Audit Data contains Personal Information, KISS processes it on behalf of the Client as a "service provider" within the meaning of the CCPA. KISS shall not (a) sell or share the Personal Information, (b) retain, use or disclose it for any purpose other than the Purpose, (c) retain, use or disclose it outside the direct business relationship between the Parties, or (d) combine it with personal information KISS receives from other sources, except as the CCPA permits. KISS shall comply with the CCPA obligations that apply to it, shall provide the same level of privacy protection the CCPA requires, and shall notify the Client if it can no longer meet these obligations. The Client may take reasonable steps to stop and remediate any unauthorized use. KISS certifies that it understands these restrictions.

5.2 No training, no data sets. KISS shall not use the Audit Data to train, fine-tune or improve any AI model, and shall not include the Audit Data, in any form, including aggregated or de-identified form, in any data set that KISS licenses, sells or provides to any third party.

5.3 Where processing takes place. KISS may analyze the Audit Data using third-party AI service providers acting as KISS's service providers, only (a) after masking or removing direct identifiers under Section 4.4, and (b) under the provider's commercial terms that prohibit the provider from using customer data to train its models and that limit retention by the provider. KISS shall give the Client the current list of such providers on request and shall not add a provider for an ongoing Audit without informing the Client; the Client may object, in which case the Audit Data is processed under Section 5.4 or deleted.

5.4 Sensitive businesses. Audit Data of law firms, financial, accounting, insurance, medical and similarly sensitive businesses, and any Audit Data the Client marks as sensitive, is processed only on systems controlled by KISS using locally run AI models, without transfer to any third-party AI service, or only after all Personal Information has been removed.

5.5 Security. KISS stores the Audit Data only in accounts controlled by KISS with access limited to the personnel performing the Audit, protected by unique logins and multi-factor authentication. KISS shall notify the Client without undue delay, and in any case within seventy-two (72) hours, after becoming aware of any unauthorized access to the Audit Data.

5.6 Read-only access. Where the Client grants access to an advertising or other online account, KISS uses read-only or analyst rights only and makes no changes. The Client may revoke the access at any time. KISS shall remove its own access, or ask the Client to remove it, within five (5) business days after the Audit call.

6. RETURN AND DELETION

6.1 KISS shall delete the Audit Data, including all copies and extracts held by KISS and its service providers, within thirty (30) days after the Audit call, or earlier on the Client's written request, and shall confirm the deletion to the Client by email. If no Audit call takes place, the period runs from the date the Audit Data was received.

6.2 KISS may keep the Audit report and its own notes that contain no Personal Information, solely as a record of the services provided, subject to Section 3.

7. NO WARRANTY AND LIABILITY

7.1 The Audit report contains estimates based on the Audit Data and on figures provided by the Client. It is not a guarantee of results and is not legal, tax, accounting or financial advice. Confidential Information is provided "as is".

7.2 Neither Party is liable to the other for indirect, incidental, special or consequential damages or lost profits arising from the Audit. This Section does not limit liability for breach of Sections 3, 4 or 5, for fraud or for willful misconduct.

7.3 Each Party may seek injunctive relief for a breach or threatened breach of Sections 3 or 5 in addition to any other remedy.

8. GENERAL

8.1 Ownership. Each Party keeps all rights in its Confidential Information. The Client owns the Audit Data. KISS owns its methods, tools and know-how used in the Audit. No license is granted except as needed for the Purpose.

8.2 Term. This Agreement starts on the Effective Date. Either Party may end the Audit at any time by written notice; Sections 3 to 8 survive. On termination, Section 6.1 applies from the date of the notice.

8.3 Governing law and venue. This Agreement is governed by the laws of the State of California, without regard to its conflict of laws rules. The state and federal courts located in Orange County, California have exclusive jurisdiction over any dispute arising from this Agreement.

8.4 Notices. Notices under this Agreement are given by email: to KISS at y@kiss.software, and to the Client at the email address in the Acceptance Record.

8.5 Entire agreement. This Agreement is the entire agreement of the Parties on its subject and may be amended only in a writing signed by both Parties. Electronic signatures have the same effect as handwritten signatures.

9. ACCEPTANCE

9.1 The Client accepts this Agreement when a person authorized to bind the Client completes the acceptance form on the KISS audit page and checks the acceptance box, or signs this Agreement electronically. The person accepting represents that he or she has authority to bind the Client.

9.2 The acceptance form records the Client's legal name, state and type of entity, address, the name, title and email of the person accepting, the Audit Data selected under Schedule 1, the version of this Agreement, and the date and time of acceptance (the "Acceptance Record"). The Effective Date is the date of acceptance in the Acceptance Record. This Agreement binds KISS from the Effective Date.

9.3 This version of the Agreement remains available to the Client for download at a permanent link shown on the acceptance page. KISS keeps the Acceptance Record for at least seven (7) years.

9.4 Electronic acceptance under this Section has the same effect as a handwritten signature under the California Uniform Electronic Transactions Act and the federal ESIGN Act.

SCHEDULE 1. AUDIT DATA SELECTED BY THE CLIENT

Selected in the acceptance form: one data set (or more, if agreed). Period: last 1 to 3 months; for sales and stock, last 6 to 12 months.