Master Subscription Agreement (MSA)

2.1 Services: The “Services” encompass the software and/or platform offered by Snap Compliance, according to the corresponding Services or, where applicable, a free trial period (“Trial Services”). Access is provided under the Software as a Service (SaaS) modality. The Services do not include third-party products or services not controlled by Snap Compliance.

2.2 Service Period: Snap Compliance undertakes to provide access to the Services during the subscription term, or for Trial Services, the period specified upon trial activation.

2.3 Type of Use: The CUSTOMER will obtain access to the Software on their own equipment using the credentials provided by Snap Compliance, according to the subscription plan selected. The features, functionalities, and scope of each plan are detailed on the Snap Compliance website, and the CUSTOMER acknowledges having understood and accepted said conditions upon contracting. The chosen subscription will determine the model type used, the number of authorized users, and the specific conditions applicable to the service. In the event of free services, Snap Compliance reserves the right to discontinue or modify them at any time.

3.1 Fees: The CUSTOMER shall pay the fees (“Fees”) defined in the service subscription provided. These fees may include costs for number of users, storage space, additional modules, or any other concept detailed therein.

3.2 Billing; Taxes:

• The CUSTOMER shall maintain a valid payment method (credit card, debit card, or other accepted means).
• Snap Compliance will bill the Fees at the beginning of the subscription, at the beginning of each renewal, or as specified in the Service Subscription.
• The CUSTOMER shall pay the invoice according to the deadlines indicated (which may be immediately via automatic charge or upon invoice).
• Fees do not include taxes (state, federal, or other). The CUSTOMER assumes payment of applicable taxes, unless the law requires Snap Compliance to collect and remit them.

3.3 Price Changes: Snap Compliance may modify the fees at the beginning of any subscription renewal, reasonably notifying the CUSTOMER before the end of the current period.

3.4 Discounts and Promotions: Certain prices, discounts, or promotions may be temporary and expire upon the next renewal. Snap Compliance may modify or discontinue promotions at any time.

3.5 Free Trial Services:

• If the CUSTOMER accesses a trial period (“Trial Services”), it will begin on the activation date and end on the date communicated or at the start of the paid subscription, whichever occurs first.
• During Trial Services, Snap Compliance may delete or permanently erase the CUSTOMER's information if they do not subscribe to the paid Service or export it before the trial ends.
• Trial Services are offered “as is” and “as available”, without warranties or indemnity liability, except to the extent required by law.

3.6 Suspension for Non-Payment: Failure to pay for more than [30] days from the invoice due date allows Snap Compliance to immediately suspend access to the Services until the debt is settled, without prejudice to other legal actions.

4.1 Term: This MSA enters into force on the Effective Date and will remain until the Service subscription term ends. The Service will automatically renew for successive periods according to the subscription type taken by the CUSTOMER.

4.2 Termination for Cause:

• Either Party may terminate this MSA in the event of a material breach by the other Party, if such breach is not remedied within 10 business days of notification.
• Snap Compliance may terminate immediately if the CUSTOMER incurs in any prohibited uses (see Section 5.5) or fails to pay Fees within [60] days of invoice issuance.
• If a Party files for bankruptcy, insolvency, or liquidation proceedings, the other Party may terminate automatically.

4.3 Effects of Termination:

• Upon termination of the entire MSA, all current Service Subscriptions also terminate.
• The CUSTOMER will cease accessing the Services and Snap Compliance will withdraw such access.
• Unless otherwise agreed, the CUSTOMER shall not be entitled to a refund of fees paid previously.
• Surviving termination: accrued payment obligations, limitations of liability, confidentiality, and intellectual property provisions.

5.1 Intellectual Property Rights:

• Each Party retains ownership of its respective patents, inventions, copyrights, trademarks, trade secrets, and any other intellectual property rights held prior to subscribing to this MSA.
• Snap Compliance retains all rights to the Software and platform (including documentation, manuals, codes, and any element constituting the “Services” or “Service Information”).
• The CUSTOMER retains rights to the information entered, uploaded, or generated on the platform (“CUSTOMER Information”).

5.2 Feedback: If the CUSTOMER provides suggestions or recommendations to Snap Compliance, they grant Snap Compliance an irrevocable, international, royalty-free, and sub-licensable license to use and commercially exploit those suggestions in the development and improvement of the Services.

5.3 License Grant: Snap Compliance grants the CUSTOMER (and their Authorized Users) a limited, non-exclusive, non-transferable, and non-sublicensable license to access and use the Services under the terms and restrictions of this MSA and the Service Subscription.

5.4 Authorized Users:

• The CUSTOMER may designate employees, agents, or contractors to access the Services (“Authorized Users”).
• The CUSTOMER assumes responsibility for all use or misuse of the Services by said Users and will guarantee their compliance with this MSA.
• Each Authorized User will have individual credentials; sharing credentials will be considered a material breach of the MSA.

5.5 Prohibited Uses: The CUSTOMER and Authorized Users shall not:

1. Sell, resell, sublicense, or assign access to the Services to third parties without written authorization;
2. Violate applicable laws or regulations when using the Platform;
3. Attempt to decompile, disassemble, reverse engineer, or discover the source code of the Services;
4. Introduce malicious software (viruses, trojans, worms, etc.);
5. Use automated systems (spiders, scrapers, bots) to extract data without permission;
6. Use the Platform for purposes that compete with or seek to replicate Snap Compliance functionality;
7. Upload unlawful, offensive, injurious information or information infringing third-party rights;
8. Perform any act that threatens the security or availability of the Platform;
9. Allow access to Snap Compliance competitors without express consent;
10. Breach any other policy reasonably notified by Snap Compliance.

6.1 Confidential Information: “Confidential Information” is any technical, financial, or commercial information marked as confidential or which, by its nature, should be understood as such. Each Party agrees not to disclose or use the other Party's Confidential Information except to comply with this MSA.

6.2 Exceptions: Information will not be considered Confidential Information if it: (i) is public domain without infringement, (ii) is independently developed by the receiving Party, (iii) is legitimately communicated by a third party, or (iv) must be disclosed by law or court order.

6.3 Duration: Confidentiality obligations will subsist while this MSA lasts and for [5 years] after its termination, unless it constitutes a trade secret, in which case it will subsist indefinitely.

7.1 Personal Data Protection: Snap Compliance processes the CUSTOMER's personal information in accordance with current regulations (GDPR, CCPA, local LATAM laws) and its Privacy Policy. For data subjects located in Chile, Section 13 also applies. Reasonable measures will be employed to protect the confidentiality, integrity, and availability of data.

7.2 Responsibility for Information: The CUSTOMER is ultimately responsible for the data entered or processed through the Services, as well as for having the necessary legal bases or consents.

8.1 Authority: Each Party declares it has the legal authority to enter into this MSA.

8.2 Snap Compliance Warranties: (i) Will maintain security safeguards; (ii) Services will function substantially according to documentation; (iii) Provided “as available”.

8.3 Disclaimer: Except as expressly indicated, Services are provided “as is”. Snap Compliance will not be responsible for the CUSTOMER's risk management or regulatory compliance, being solely a support tool.

9.1 Indemnification by Snap Compliance: Will defend the CUSTOMER against third-party claims for intellectual property infringement, subject to timely notification and control of the defense.

9.2 Exclusions: Does not apply if infringement derives from misuse, unauthorized modification, or combination with other products.

9.3 Limit: Total liability will not exceed the amount of fees paid in the last 12 months.

9.4 Indemnification by CUSTOMER: The CUSTOMER will indemnify Snap Compliance against claims for prohibited use or infringement of third-party rights via their Information.

10.1 Exclusion of Indirect Damages: Neither Party will be liable for indirect damages, loss of profits, or data.

10.2 Total Liability Limit: Except for exceptions (confidentiality, IP, willful misconduct), liability is limited to Fees paid in the last 12 months. For exceptions, up to ten times that amount.

The use of the application and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

The use of the application and transfer of information related to Microsoft Clarity will adhere to the Microsoft Clarity Privacy Policy.

13.1 Legal Framework and Effective Date: Law No. 21,719, published in Chile's Official Gazette on December 13, 2024, amends Law No. 19,628, now titled "on the protection of personal data", and creates the Personal Data Protection Agency (the "Agency"). Its amendments take effect on December 1, 2026; until then, Law No. 19,628 applies in its current text. This section applies to the processing of data of individuals located in Chile, in the cases set out in Article 1 bis of the law, and supplements Section 7.

13.2 Who Is Responsible for Each Piece of Data:

• Data the CUSTOMER uploads to or generates in the Platform (its clients, counterparties, beneficial owners and employees, and the results of due diligence, screening and risk assessment): the CUSTOMER is the data controller ("responsable de datos") and Snap Compliance acts as data processor ("tercero mandatario o encargado", Article 15 bis). The CUSTOMER is responsible for demonstrating the lawful basis for that processing, including for sensitive data, a category in which the law includes, for example, a person's socioeconomic situation.
• Data Snap Compliance processes on its own behalf: that of Authorized Users, to manage their access, and that of people who visit the website, write through its forms, chat with its assistant or book a meeting. In these cases Snap Compliance is the data controller.

13.3 Snap Compliance's Obligations as Processor: With respect to the CUSTOMER's data, Snap Compliance:

1. Processes it only to provide the Services, in accordance with this MSA and the CUSTOMER's instructions, and never for any other purpose.
2. Does not transfer or disclose it to third parties without the CUSTOMER's express authorization, unless required by law or by a competent authority.
3. Keeps it confidential, including after this MSA ends, and requires the same of its staff and providers (Article 14 bis).
4. Applies the security measures in Section 13.10 (Article 14 quinquies).
5. Reports to the CUSTOMER, without undue delay, any security breach affecting its data, with the information available so that the CUSTOMER can meet its duty to report it to the Agency and, where applicable, to data subjects (Article 14 sexies).
6. Relies on the providers listed in Section 13.5 to host and operate the Platform. By accepting this MSA, the CUSTOMER authorizes that delegation in writing. Snap Compliance requires them to meet the same confidentiality and security obligations and remains jointly and severally liable for the engagement, as Article 15 bis provides. If it adds another provider that processes the CUSTOMER's data, it will update that list.
7. Forwards to the CUSTOMER, without delay, any data subject request it receives about that data, and provides reasonable assistance so the CUSTOMER can respond on time.
8. When the Services end, deletes the data or returns it to the CUSTOMER, as applicable (Article 15 bis).

13.4 Data Snap Compliance Processes as Controller, Why, and on What Basis:

• Platform access. Each Authorized User's name, email, job title and organization, and the log of their activity. Used to manage the account, protect access and keep the audit trail the CUSTOMER needs. Basis: the legitimate interest of Snap Compliance and the CUSTOMER in the security of the service (Article 13(d)).
• Contact, demo, newsletter and download forms. Name, email, phone, company, job title, country, interests and message, depending on the form. Used to respond to you and, if you ask, to prepare a proposal. Basis: the consent you give in the form (Article 12) and the pre-contractual steps you request (Article 13(c)).
• Meeting scheduling. Name, email, company, job title, country, any comment you add, the meeting type and the time you choose. Used to confirm the meeting, send you the invitation and let you reschedule or cancel it. Basis: the pre-contractual steps you request (Article 13(c)).
• Chat with Lucía. Lucía is an artificial intelligence assistant, not a person. We process the content of the conversation and any data you choose to give us, to answer you and, if you ask, hand the conversation over to a Snap Compliance specialist. Basis: our legitimate interest in answering the inquiries we receive (Article 13(d)) and, when you request them, pre-contractual steps (Article 13(c)).
• Website security. IP address, technical browser data and the Cloudflare Turnstile check on forms. Used to tell people apart from automated programs and to limit abuse. Basis: our legitimate interest in protecting the website (Article 13(d)).
• Audience measurement. Cookie identifiers, pages visited and browsing data recorded by Google Tag Manager and Google Analytics, the Meta pixel and Microsoft Clarity. Basis: your consent (Article 12), which you can withdraw at any time by deleting the website's cookies or blocking them in your browser.
• Contracting and billing. Contact and billing details of the person who contracts on behalf of the CUSTOMER. Basis: performance of the contract (Article 13(c)) and compliance with legal obligations (Article 13(b)).

The data in this section comes from you or, for Authorized Users, from the CUSTOMER that grants them access. Snap Compliance does not sell personal data or transfer it to third parties for those third parties' own purposes.

13.5 Providers That Process Data on Behalf of Snap Compliance: Amazon Web Services (hosting of the Platform and the website, databases and artificial intelligence models); SendGrid, by Twilio (email delivery); Microsoft 365 (email and Teams meeting invitations); Cloudflare (Turnstile); and, for audience measurement only, Google, Meta and Microsoft Clarity. They process the data solely to provide their service. Snap Compliance will also disclose data when required by law or by a competent authority.

13.6 International Transfer: The Platform and the website are hosted in the United States, in the us-east-1 region of Amazon Web Services, and the providers in Section 13.5 process the data outside Chile. Unless the Agency declares those countries to offer an adequate level of protection (Article 28), these transfers rely on the data processing agreements signed with each provider, which set out confidentiality and security safeguards (Article 27(b)). You can request a copy of the applicable safeguards by writing to privacy@snap-compliance.com.

13.7 How Long Data Is Kept:

• CUSTOMER data in the Platform, Authorized User accounts and their activity log: for as long as the subscription lasts. After that, Section 13.3, item 8 applies, and Section 3.5 for Trial Services.
• Contacts, conversations and meetings: for as long as they are needed for the request you made or for the business relationship that results from it. If no contract is signed, the data obtained for pre-contractual steps is deleted or anonymized (Article 14(d)).
• Audience measurement: the period configured in each tool, or until you delete the cookies.

In every case, data is kept where a legal obligation requires it or where it is needed to bring, exercise or defend a claim, and only for that time.

13.8 Your Rights as a Data Subject: You have the right to access, rectification, deletion, objection, portability and blocking of your data (Articles 4 to 9), and not to be subject to decisions based solely on the automated processing of your data that produce legal effects on you or significantly affect you (Article 8 bis). If processing is based on your consent, you can withdraw it at any time, without retroactive effect.

• How to exercise them: write to privacy@snap-compliance.com stating your name, your representative's name if you act through one, a postal or email address for our reply, and the data or processing concerned. For rectification, state the changes; for deletion or objection, state the grounds (Article 11).
• Deadlines: we acknowledge receipt and respond within 30 calendar days, extendable once by another 30. While a rectification, deletion or objection request is being resolved, you can ask for your data to be temporarily blocked, and we respond to that within 2 business days.
• Cost: rectification, deletion and objection are always free. Access and portability are free at least once per quarter (Article 10).
• Complaints: if we reject your request or do not respond on time, you can file a complaint with the Agency within the following 30 business days (Article 41).
• Data a CUSTOMER processes in the Platform: the CUSTOMER is the controller, and rights are exercised before it. If the request reaches us, we forward it to the CUSTOMER and let you know.

13.9 Automated Decisions: Snap Compliance does not, on its own behalf, make decisions about individuals based solely on the automated processing of their data. Screening matches, alerts and risk ratings generated by the Platform are produced on behalf of the CUSTOMER, who decides on them. Snap Compliance makes information about the logic applied available to the CUSTOMER, so that the CUSTOMER can give the data subject the explanation, human intervention and review that Article 8 bis requires.

13.10 Security and Breaches: Traffic is encrypted with TLS. Each CUSTOMER's data is kept in a database separate from that of other customers. Internal access is limited to those who need it to operate the service, and operations are recorded in an audit log. If a security breach affects data for which Snap Compliance is the controller and there is a reasonable risk to data subjects, Snap Compliance will report it to the Agency without undue delay. When it affects sensitive data, data of children under 14 or data on economic, financial, banking or commercial obligations, it will also notify each affected data subject (Article 14 sexies).

13.11 Controller and Contact in Chile: The controller of the processing in Section 13.4 is Snap Compliance Labs LLC, represented by its CEO, Alex Siles Loaiza, at the address stated in the Introduction. For data subjects located in Chile and for the Agency, the contact is Snap Compliance Chile SpA, RUT 77.568.668-5, Av. Apoquindo 2930, office 201, 2nd floor, Las Condes, Santiago, Chile, and the email address privacy@snap-compliance.com (Articles 10 and 14).

13.12 Version: version 1.0 of this section, dated October 4, 2026. If it changes, the new version will be published on this page with its date.

14.1 Entire Agreement: This MSA replaces prior agreements.

14.2 Assignment: Requires prior consent, except for merger or acquisition.

14.3 Severability: If a clause is invalid, the rest remains.

14.4 Relationship: Independent contractors.

14.5 Notices: To email info@snap-compliance.com for Snap Compliance.

14.6 Governing Law: State of Delaware, USA.

14.7 Export Control: Compliance with export regulations and sanctions (OFAC).

14.8 Anti-Corruption: Prohibition of bribes and improper payments.

14.9 Publicity: Snap Compliance may refer to the CUSTOMER as a user in marketing materials.

14.10 AML Compliance: The CUSTOMER declares their resources do not come from illicit activities.