Master Services Agreement and Platform Terms of Use

1. Definitions & Platform Overview

• 1.1. Services: Means the cloud-based Software-as-a-Service (SaaS) platform, web portals, mobile applications, APIs, automated data extraction engines, compliance dashboards, and related technologies provided by Mile Marker Safety.
• 1.2. Automated Technologies: Refers to artificial intelligence (AI), machine learning algorithms, computer vision, optical character recognition (OCR), and automated rule engines utilized within the Services.
• 1.3. Customer Data: Includes all Motor Vehicle Records (MVRs), Commercial Driver’s Licenses (CDLs), medical cards, drug and alcohol testing records, background reports, application materials, and personally identifiable information (PII) uploaded, transmitted, or stored by Customer or its applicants/drivers.
• 1.4. Consumer Report / Investigative Consumer Report: Shall have the meanings defined under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (“FCRA”).

2. Automated Technologies & Mandatory Human Review

• 2.1. Decision Support Tool Only: Customer expressly acknowledges that the Services and Automated Technologies function strictly as an administrative data aggregation, extraction, and decision-support tool. The Services do not make autonomous employment, qualification, hiring, firing, or safety classification decisions. Customer retains sole authority and legal responsibility for all employment and regulatory determinations.
• 2.2. Probabilistic Nature of AI & OCR: Customer acknowledges that Automated Technologies are probabilistic in nature. Data extraction accuracy depends on document quality, lighting, resolution, handwriting, stamps, watermarks, and non-standard state/federal formats. Provider does not represent or warrant that data extraction will be 100% accurate, complete, or error-free.
• 2.3. Mandatory Human-in-the-Loop (HITL) Verification: Customer agrees to independently inspect, verify, and confirm all extracted data, AI-generated flags, or inconsistency notices against the original source documents before saving, relying upon, or taking any adverse employment or regulatory action based on such data.
• 2.4. Liability Disclaimer for Regulatory Actions: Provider explicitly disclaims all liability for fines, penalties, audits, out-of-service orders, conditional/unsatisfactory safety ratings, or litigation resulting from Customer’s failure to verify extracted data against source records independently. Customer maintains total responsibility for compliance with FMCSA, DOT, and state safety regulations.

3. FCRA, DPPA & Regulatory Compliance Certification

To the extent Provider acts as a Consumer Reporting Agency (CRA) or transmits consumer data, Customer certifies and warrants strict adherence to the following:

• 3.1. Permissible Purpose Certification: Customer certifies that it will request and use Consumer Reports (including MVRs, PSP reports, and background checks) solely for legitimate, legally permissible employment purposes under FCRA § 604 (15 U.S.C. § 1681b) and the Driver’s Privacy Protection Act (18 U.S.C. § 2721 et seq. — “DPPA”). Customer shall not obtain reports for personal curiosity, spying, or unauthorized third-party redistribution.
• 3.2. Disclosure and Written Authorization: Customer warrants that before ordering any report, it has provided the applicant/driver with a clear and conspicuous written disclosure (in a document consisting solely of the disclosure) that a consumer report may be obtained, and has secured the driver’s explicit written authorization.
• 3.3. Adverse Action Workflow Compliance: Customer covenants that before taking any adverse action (e.g., declining to hire, terminating, or disqualifying a driver) based in whole or in part on information provided by the Services, Customer shall: (1) provide the driver with a Pre-Adverse Action Notice; (2) enclose a copy of the specific report relied upon; and (3) provide a written copy of “A Summary of Your Rights Under the Fair Credit Reporting Act”. After taking adverse action, Customer shall provide a formal Final Adverse Action Notice adhering to all statutory FCRA § 615 requirements.
• 3.4. Secure Data Handling & Disposal: Customer agrees to maintain physical and digital safeguards over all consumer reports. Hard copies must be shredded, burned, or pulverized when no longer required; electronic files must be permanently erased or scrambled in compliance with federal disposal regulations.

4. Screening Tools, Application Questions & Employment Liability

• 4.1. Customer Configuration Ownership: Provider may make available digital application forms, screener questions, and assessment tools. Customer agrees that the selection, configuration, and utilization of these tools are determined exclusively by Customer. Provider acts solely as a technical software publisher.
• 4.2. Disparate Impact & Employment Laws: Customer assumes total legal responsibility for ensuring that its job requirements, screening criteria, and application questions comply with Title VII of the Civil Rights Act, the Age Discrimination in Employment Act (ADEA), the Americans with Disabilities Act (ADA), and state/local equal employment opportunity laws. Customer warrants it will not utilize tools in a manner that creates an unlawful disparate impact.
• 4.3. Accommodation Requests: Customer is solely responsible for receiving, evaluating, and granting reasonable accommodations to candidates with disabilities under the ADA or equivalent state laws.

5. Privacy, Biometrics (BIPA) & State AI Employment Laws

• 5.1. Data Controller Status: Customer is the primary Data Controller of driver PII and warrants that it possesses all requisite legal authority, and driver consents to process such data via the Services.
• 5.2. Biometric Data Prohibition (BIPA): Customer agrees not to upload, process, or store facial recognition scans, fingerprints, voiceprints, or other biometric identifiers via the Services unless an explicit, separate Biometric Addendum has been executed. Customer agrees to indemnify Provider against any claims brought under the Illinois Biometric Information Privacy Act (740 ILCS 14/1) or similar state statutes resulting from Customer’s unauthorized upload of biometric assets.
• 5.3. Automated Employment Decision Tool (AEDT) Notices: Customer acknowledges that state or municipal laws (e.g., Illinois HB 3773, NYC AEDT Law) may require employers to notify applicants when AI tools are used during hiring. Customer assumes full responsibility for providing all required statutory notices to its applicants.

6. Mobile Applications & App Store Terms

• 6.1. Mobile License Grant: If Customer or its authorized drivers download Provider’s mobile application (“Mobile App”), Provider grants a limited, non-transferable, revocable license to execute the object code on authorized devices owned or controlled by Customer or its drivers.
• 6.2. App Store Sourced Applications: Customer acknowledges that this Agreement is between Customer and Provider only, and not with Apple Inc. or Google LLC (“App Store Owners”). App Store Owners carry no obligation to furnish maintenance or support for the Mobile App. In the event of a product liability, regulatory non-compliance, or intellectual property infringement claim, Provider — not the App Store Owner — retains responsibility under the terms of this Agreement.

7. Data Retention, Archiving & Aggregated AI Data Rights

• 7.1. DOT/FMCSA Regulatory Records: Provider shall maintain Driver Qualification (DQ) Files and Safety Performance Histories uploaded to the platform in alignment with 49 CFR § 391.51 standards for the active duration of Customer’s subscription. Customer acknowledges that the Services serve as a data processing tool, and Customer remains responsible for preserving independent backup copies for DOT safety audit readiness.
• 7.2. Post-Termination Export & Deletion: Upon expiration or termination of this Agreement, Customer shall have thirty (30) days (“Retrieval Period”) to export Customer Data. Upon expiration of the Retrieval Period, Provider may permanently purge Customer Data from production servers without further liability.
• 7.3. Aggregated Anonymous Data & AI Model Training: Customer grants Provider a perpetual, irrevocable, worldwide, royalty-free license to compile, synthesize, aggregate, and de-identify Customer Data (“Aggregated Data”). Provider may utilize Aggregated Data to train, refine, and improve its AI models, OCR engines, risk algorithms, and industry benchmarking tools, provided that such data is fully anonymized and contains zero identifiable driver or carrier information.

8. Fees, Pass-Through Costs & Account Security

• 8.1. Subscription & Transactional Fees: Customer agrees to pay all fees outlined on the Order Form. Usage fees for transactional services (state MVR pulls, CDLIS checks) are billed as incurred.
• 8.2. DMV Statutory Fee Pass-Through: Customer acknowledges that state DMVs and governmental registries periodically adjust statutory retrieval fees. Provider reserves the right to adjust transactional pricing immediately upon notice to reflect third-party or government fee increases.
• 8.3. Pre-paid Credits: All pre-paid transaction credits are non-refundable and expire twelve (12) months from the purchase date.
• 8.4. Unique Credential Security: Shared or generic user accounts are strictly prohibited. Customer must assign individual, unique login credentials to each user accessing sensitive driver PII to maintain an accurate audit trail.

9. Indemnification

Customer agrees to defend, indemnify, and hold harmless Mile Marker Safety, its parent companies, officers, directors, employees, and agents from and against any third-party claims, liabilities, losses, damages, penalties, or legal fees arising out of or related to:

• Customer's breach of any covenant or certification under the FCRA, DPPA, or state privacy laws;
• Employment, qualification, hiring, or termination decisions made by Customer;
• Allegations that Customer's screening questions or hiring criteria resulted in an unlawful disparate impact or ADA violation;
• Customer's failure to independently review and verify AI/OCR-extracted data prior to taking regulatory or employment action;
• Customer's unauthorized upload of biometric identifiers (BIPA).

10. Disclaimer of Warranties & Limitation of Liability

• 10.1. “AS IS” Provision: THE SERVICES, AUTOMATED TECHNOLOGIES, AND OCR EXTRACTIONS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” PROVIDER EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
• 10.2. Waiver of Consequential Damages: IN NO EVENT SHALL MILE MARKER SAFETY BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL, OR INCIDENTAL DAMAGES, INCLUDING LOST PROFITS, BUSINESS INTERRUPTION, OR REGULATORY FINES, ARISING OUT OF THE USE OR INABILITY TO USE THE SERVICES.
• 10.3. Liability Cap: PROVIDER’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL AT ALL TIMES BE LIMITED TO THE GREATER OF: (A) THE TOTAL FEES PAID BY CUSTOMER TO PROVIDER IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE INCIDENT, OR (B) ONE HUNDRED DOLLARS ($100.00).

11. Mandatory Binding Arbitration & Class Action Waiver

• 11.1. Binding Individual Arbitration: Customer and Provider agree that any dispute, claim, or controversy arising out of or relating to this Agreement, the Services, or the breach thereof, shall be settled by final and binding arbitration administered by the American Arbitration Association (AAA) in accordance with its Commercial Arbitration Rules. Judgment on the award rendered by the arbitrator may be entered in any court having jurisdiction.
• 11.2. CLASS ACTION WAIVER: ALL CLAIMS MUST BE ARBITRATED ON AN INDIVIDUAL BASIS AND NOT ON A CLASS, COLLECTIVE, OR REPRESENTATIVE BASIS. CUSTOMER EXPRESSLY WAIVES ANY RIGHT TO COMMENCE, JOIN, OR PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS ACTION OR REPRESENTATIVE PROCEEDING AGAINST MILE MARKER SAFETY.
• 11.3. Governing Law & Venue: This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without giving effect to conflict of law principles. Any court proceedings permitted outside of arbitration shall be instituted exclusively in the state or federal courts located in Wilmington, Delaware.

Exhibit A: Security Standards & Breach Notification

• Encryption Standards: Data in transit is secured using Transport Layer Security (TLS 1.2+). Data at rest is encrypted using AES-256 standard encryption.
• Access Control: Multi-Factor Authentication (MFA) and strict Principle of Least Privilege are enforced across all production environments.
• Infrastructure: Hosted on tier-1 cloud infrastructure (AWS/GCP/Azure) maintaining SOC 2 Type II and ISO 27001 certifications.
• Security Incident Response: In the event of a confirmed Security Breach involving unencrypted Customer Data, Provider shall notify Customer without undue delay, and no later than forty-eight (48) hours following confirmation of the incident.