Terms of Service
Last Updated: April 22, 2026
These Terms of Service (“Terms”) govern your access to and use of the Winston AI platform and services (the “Services”) operated by Treez Inc. (“Winston AI,” “we,” “us,” or “our”), a Delaware corporation. By creating an account, clicking “Sign Up,” “Accept,” or any similar acceptance mechanism, or by accessing or using the Services, you agree to be bound by these Terms.
If you are accessing or using the Services on behalf of a company, organization, or other entity (an “Organization”), you represent and warrant that you have authority to bind that Organization to these Terms, and the term “you” shall refer to both you and that Organization.
1. Definitions
- “API”
- The application programming interfaces with respect to the Services that enable access to or integration with the Services by authorized third-party software.
- “Applicable Laws”
- All applicable foreign, domestic, federal, state, local, and regional laws, rules, regulations, ordinances, orders, guidelines, and industry self-regulatory principles, including without limitation those governing data privacy, artificial intelligence, and regulated industries.
- “Authorized Users”
- Your employees, contractors, and agents whom you authorize and for whom you have purchased access to use the Services on your behalf.
- “Confidential Information”
- Any non-public information that is marked or identified as confidential, or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.
- “Customer Data”
- Data, content, or information (i) inputted by or on behalf of Authorized Users into the Services, or (ii) created, collected, generated, processed, or stored in connection with Authorized Users' use of the Services, including without limitation sales data, inventory data, operational data, consumer transaction records, and consumer personally identifiable information. Customer Data excludes Aggregated Performance Data and AI Training Data.
- “Feedback”
- Suggestions, comments, or ideas regarding the features, functions, or operation of the Services.
- “Order”
- The Subscription Order Form or other ordering document that references and incorporates these Terms.
- “Output”
- Any analysis, report, recommendation, insight, or other content generated by the Services in response to or based upon Customer Data or Input.
- “Services”
- The Winston AI cloud-based artificial intelligence software platform, including all features, modules, tools, APIs, updates, and associated professional services listed in the Order.
- “Subscription Fees”
- The fees listed in your Order for use of the Services.
- “Subscription Term”
- The subscription period specified in the Order.
2. Subscription Terms
2.1 Software Subscription
Subject to payment of Subscription Fees and the terms of these Terms, you may access and use the Services in the configuration described in the Order solely for your own internal business purposes during the Subscription Term. You may purchase additional Authorized Users or service modules at any time; applicable Subscription Fees will be prorated for the remainder of the then-current Subscription Term. Winston AI provides technical support and updates for the Services during the Subscription Term at no additional charge, as described in Section 5.
2.2 Subscription Renewal
Except as otherwise specified in an Order, subscriptions will automatically renew for additional periods equal to the expiring Subscription Term, unless either party provides written notice of non-renewal at least 60 days before the end of the then-current Subscription Term. All Customer obligations under these Terms shall remain in effect for so long as Customer is accessing or using the Services.
2.3 Professional Services
If the applicable Order provides for professional services (including onboarding, configuration, or implementation services), such services shall be delivered in accordance with that Order or a separate statement of work. These Terms shall apply to all such professional services.
3. Use of the Services
3.1 Account Access
You are responsible for obtaining and maintaining all equipment, software, and connectivity necessary to access and use the Services. You agree to promptly notify Winston AI of any suspected or unauthorized use of your account.
3.2 Authorized Users
You determine access controls for your Authorized Users. You are responsible for all activity occurring under your account by Authorized Users and for their compliance with these Terms. Authorized User credentials are for named individual users and may not be shared.
3.3 Acceptable Use and Restrictions
You will not, and will not knowingly permit any Authorized User or third party to:
- Reverse engineer, decompile, disassemble, or otherwise attempt to derive source code, underlying algorithms, structure, or organization from the Services.
- Use the Services to provide service bureau, time-sharing, managed service, or similar computing services to third parties.
- Use any Confidential Information of Winston AI to develop, assist in developing, or benchmark any product or service that competes with the Services.
- Remove, alter, or obscure any copyright, trademark, or other proprietary notice contained in or displayed by the Services.
- Interfere with or disrupt the integrity, security, or performance of the Services, including by transmitting any virus, malware, or harmful code.
- Gain or attempt to gain unauthorized access to the Services, related systems or networks, or accounts of other customers.
- Use the Services to collect, process, store, or transmit data in violation of any Applicable Laws.
- Use the Services to make fully automated consequential decisions affecting individuals without human review, where such use is prohibited or restricted under applicable law.
- Input, upload, or process any “protected health information” as defined under HIPAA. The Services are not HIPAA-compliant, Winston AI is not a HIPAA Business Associate, and Winston AI does not enter into Business Associate Agreements.
- Sublicense, sell, resell, transfer, assign, or otherwise commercially exploit or make available to any third party the Services or any Output, except as expressly permitted under these Terms.
3.4 Third-Party Integrations
The Services may integrate with third-party data sources, APIs, and platforms (“Third-Party Integrations”). Winston AI may, at any time in its sole discretion, enable or disable such integrations. Your use of any Third-Party Integration is subject to the applicable terms of the relevant third party. Winston AI shall not be liable for the acts or omissions of any Third-Party Integration provider.
4. Artificial Intelligence
4.1 AI-Powered Features
Certain features of the Services utilize generative artificial intelligence and machine learning models, which may be provided by third-party AI providers (each, a “Third-Party AI Provider”). You consent to Winston AI's use of such Third-Party AI Providers as subprocessors in connection with the delivery of the Services.
4.2 Input and Output
You may provide prompts, data, documents, or other input to be processed by the Services (“Input”) and receive Output generated by the Services. You retain ownership of your Input. Ownership of Output is as set forth in Section 7 (Proprietary Rights).
4.3 AI Model Training
Winston AI may use Customer Data, Input, Output, and Aggregated Performance Data in de-identified or aggregated form to train, fine-tune, and improve the AI models underlying the Services (“AI Training Data”). Winston AI will not use raw, identified Customer Data to train AI models in a manner that would permit a third party to reconstruct or identify your specific Customer Data. Third-Party AI Providers may retain Input and Output for up to 30 days for safety and compliance review purposes.
4.4 Output Limitations
Output generated by the Services is provided for informational and operational purposes only. Due to the nature of machine learning, Output may not be unique, may contain errors or inaccuracies, and may not reflect events occurring after the relevant model's training cutoff. You are solely responsible for evaluating the accuracy and suitability of any Output before relying upon it. Output should not be construed as professional, legal, financial, regulatory compliance, or tax advice.
4.5 Regulated Industry Disclaimer
If you operate in a regulated industry — including without limitation cannabis and cannabis-adjacent retail, financial services, healthcare, pharmaceuticals, or any other industry subject to federal, state, or local licensing and compliance requirements — you acknowledge and agree that: (a) Winston AI does not provide regulatory compliance, licensing, or legal advice; (b) Output does not constitute, and may not be relied upon as, a representation that your operations are in compliance with any Applicable Laws; and (c) you are solely responsible for your compliance with all Applicable Laws governing your operations. Winston AI recommends that you consult qualified legal, regulatory, and compliance counsel for advice specific to your regulatory environment.
4.6 Responsible AI
Winston AI maintains internal governance practices applicable to the Services, including periodic evaluations to assess the quality and reliability of AI-generated Output. Winston AI will comply with all laws and regulations applicable to its integration and use of AI within the Services.
5. Support Terms
5.1 Technical Support
As part of these Terms and included in the Subscription Fees, Winston AI will provide technical support through its online knowledge base, interactive support portal, and critical-issue telephone support. Support hours, response times, and procedures are as set forth in your Order. Winston AI will not be responsible for providing technical support for problems attributable to errors in your equipment, data, hardware, networking, or internet access.
5.2 Software Updates
Winston AI makes updates (error corrections, bug fixes, and enhancements) to the Services on an ongoing basis. Except in the case of urgent updates, Winston AI will schedule maintenance during non-peak hours and will use commercially reasonable efforts to provide advance notice of any planned unavailability. Winston AI's standard maintenance window is 11:00 PM to 3:00 AM prevailing Pacific Time.
5.3 Customer Infrastructure
You are responsible for maintaining the equipment and infrastructure necessary to access the Services, including (a) 99.95% power availability; (b) 99.95% network uptime; (c) adequate IT support personnel; (d) current firewall and anti-virus software; and (e) minimum internet connectivity of 1 Mbps upload and 10 Mbps download.
6. Payment
6.1 Payment Terms
Unless otherwise specified in your Order, Subscription Fees and applicable implementation or professional services fees are due and payable within 30 days of invoice date. API fees, if applicable, are due and payable within 10 days of the invoice date (invoiced monthly in arrears). Late payments on undisputed amounts are subject to interest at 1.5% per month, or the maximum permitted by Applicable Law, whichever is lower, plus reasonable collection costs. Billing disputes must be reported to Winston AI in writing within 60 days of the invoice date. Except as otherwise provided in these Terms, all payment obligations are non-cancelable and fees paid are non-refundable.
6.2 Taxes
All fees are exclusive of applicable sales, use, GST, VAT, or similar taxes. Such taxes, if applicable, will be charged separately unless you provide a valid tax exemption certificate in advance. You are solely liable for applicable sales and use taxes.
7. Proprietary Rights
7.1 Winston AI IP
Winston AI owns all right, title, and interest in and to the Services, including all modifications, enhancements, and Output generated by the Services' AI models (to the extent such Output does not incorporate your Customer Data). These Terms do not grant you any ownership interest in the Services. If you provide Feedback, you hereby assign to Winston AI all right, title, and interest in such Feedback, and Winston AI may freely use and exploit Feedback without restriction or compensation to you.
7.2 Customer Data Ownership
You are the exclusive owner of and retain all rights, title, and interest in your Customer Data. You hereby grant Winston AI a non-exclusive, worldwide, sublicensable, royalty-free license to collect, process, use, transmit, store, and display your Customer Data solely as necessary to provide the Services, improve the Services, develop new products and services, and as otherwise permitted under these Terms and Applicable Laws.
7.3 Aggregated and De-identified Data
Winston AI may collect, use, and disclose to third parties aggregated, de-identified, or anonymized data derived from your Customer Data (“Aggregated Performance Data”), including operational benchmarks, industry analytics, and performance summaries. Winston AI will not disclose Aggregated Performance Data in a manner that identifies you or your customers without your prior written consent.
7.4 Attribution
Unless otherwise specified in your Order, Winston AI may identify you as a customer in its marketing materials and website. Winston AI will promptly remove such identification upon your written request.
8. Data and Data Protection
8.1 Customer Data Responsibilities
You are responsible for the accuracy, quality, integrity, and legality of your Customer Data. You represent and warrant that you have all necessary rights, licenses, consents, and permissions to provide Customer Data to Winston AI and to authorize Winston AI to process such data as contemplated by these Terms.
8.2 Privacy Obligations
You will maintain an accessible privacy policy and will provide legally adequate privacy notices, disclosures, and opt-out opportunities as required by Applicable Laws to all individuals whose data you collect or provide to Winston AI in connection with your use of the Services.
8.3 Data Security
Each party will maintain commercially reasonable administrative, physical, and technical safeguards to protect the security, confidentiality, and integrity of Customer Data and systems used in connection with these Terms. You are responsible for properly configuring access rights for your Authorized Users, securing your equipment and devices used to access the Services, and the secure transmission of Customer Data to the Services.
8.4 Data Access and Controls
Customer Data will not be accessed by Winston AI personnel except as necessary to identify, investigate, or resolve technical problems with the Services, or to verify your compliance with these Terms.
8.5 Compelled Disclosure
Winston AI may disclose Customer Data if required to comply with a valid court order, subpoena, or Applicable Law. Winston AI will provide you with prompt written notice of any such request (unless prohibited by law) and will cooperate with you to seek confidential treatment, limit the scope of disclosure, or contest the disclosure requirement.
8.6 Data Processing
To the extent Winston AI processes any personal information contained in Customer Data, Winston AI shall do so in accordance with its Privacy Policy and any applicable data processing addendum agreed between the parties.
9. Confidentiality
9.1 Obligations
Each party (as receiving party) will: (a) protect the other party's Confidential Information with at least the same degree of care it uses to protect its own Confidential Information, but in no event less than reasonable care; (b) use Confidential Information only for the purposes contemplated under these Terms; and (c) not disclose Confidential Information to any third party other than its employees, agents, and advisors who have a need to know and are bound by confidentiality obligations at least as restrictive as these Terms.
9.2 Exceptions
Confidential Information does not include information that: (a) was known to the receiving party prior to disclosure without confidentiality obligation; (b) is or becomes publicly available through no fault of the receiving party; (c) is rightfully received from a third party without a duty of confidentiality; or (d) is independently developed without use of the disclosing party's Confidential Information.
9.3 Compelled Disclosure
The receiving party may disclose Confidential Information when compelled by law, provided it gives the disclosing party prior written notice (if legally permitted) and cooperates with the disclosing party's efforts to seek a protective order or confidential treatment.
9.4 Injunctive Relief
Each party acknowledges that breach of its confidentiality obligations may cause irreparable harm and that the non-breaching party shall be entitled to seek injunctive or other equitable relief, without bond and in addition to all other remedies at law or equity, to prevent any actual or threatened breach.
10. Termination and Suspension
10.1 Termination for Cause
Either party may terminate these Terms if the other party commits a material breach and fails to cure such breach within 30 days of written notice. If you terminate these Terms for Winston AI's material breach, Winston AI will refund the unused, prepaid portion of Subscription Fees for the remainder of the Subscription Term.
10.2 Suspension
Winston AI reserves the right to temporarily suspend your access to the Services if: (a) you have undisputed amounts more than 30 days past due; (b) you have failed to pay renewal fees when due; or (c) Winston AI reasonably determines that your use of the Services creates a security vulnerability, violates these Terms, or violates Applicable Laws. Winston AI will use commercially reasonable efforts to provide prior notice of suspension and will promptly restore access upon resolution.
10.3 Effect of Termination
Upon expiration or termination of these Terms, you will (a) cease all use of and access to the Services, and (b) pay to Winston AI any accrued but unpaid Subscription Fees through the effective date of termination. Absent a termination for Winston AI's material breach, all unpaid Subscription Fees for the remainder of the Subscription Term shall remain due and payable.
10.4 Survival
Sections 1, 4.3, 7, 8, 9, 10.3, 11, 12, 13, and 14 shall survive the expiration or termination of these Terms.
11. Representations and Warranties
11.1 Mutual Warranties
Each party represents and warrants that: (a) it is duly organized, validly existing, and in good standing under the laws of its jurisdiction; (b) it has full power and authority to enter into these Terms and perform its obligations; and (c) these Terms constitute a valid and binding obligation, enforceable against such party.
11.2 Customer Warranties
You represent and warrant that: (a) you have obtained and shall maintain all rights, licenses, consents, permissions, and lawful bases required by Applicable Laws to provide Customer Data to Winston AI; (b) you have provided legally adequate privacy notices and opt-out opportunities to all individuals whose data you provide to Winston AI; and (c) your Customer Data and Winston AI's processing thereof as contemplated by these Terms does not and will not violate any Applicable Laws or the intellectual property or privacy rights of any third party.
12. Disclaimer and Limitation of Liability
12.1 Disclaimer
THE SERVICES AND ALL OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WINSTON AI DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WINSTON AI DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, ACCURATE, OR MEET YOUR REQUIREMENTS.
12.2 No Compliance Warranty
WINSTON AI DOES NOT PROVIDE REGULATORY COMPLIANCE, LICENSING, LEGAL, FINANCIAL, OR TAX ADVICE. OUTPUT IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY AND DOES NOT CONSTITUTE, AND MAY NOT BE RELIED UPON AS, A DETERMINATION THAT YOUR OPERATIONS COMPLY WITH ANY APPLICABLE LAWS, LICENSES, OR REGULATORY REQUIREMENTS.
12.3 Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES, INCLUDING WITHOUT LIMITATION LOSS OF REVENUE, PROFITS, BUSINESS, DATA, GOODWILL, OR ANTICIPATED SAVINGS, REGARDLESS OF WHETHER SUCH DAMAGES ARE BASED ON CONTRACT, TORT, STRICT LIABILITY, OR ANY OTHER THEORY.
EXCEPT AS SET FORTH BELOW, EACH PARTY'S TOTAL CUMULATIVE LIABILITY TO THE OTHER ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE TOTAL SUBSCRIPTION FEES PAID OR PAYABLE BY YOU IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
THE AGGREGATE LIABILITY CAP DOES NOT APPLY TO: (A) WINSTON AI'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 13.1 (IP INDEMNIFICATION); (B) WINSTON AI'S OBLIGATIONS UNDER APPENDIX A (DATA PROCESSING ADDENDUM) WITH RESPECT TO A SECURITY INCIDENT INVOLVING CUSTOMER PERSONAL DATA CAUSED BY WINSTON AI'S BREACH OF ITS SECURITY OBLIGATIONS THEREUNDER; OR (C) EITHER PARTY'S LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY ITS GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.
13. Indemnification
13.1 By Winston AI
Winston AI will defend you against, and indemnify and hold you harmless from, any third-party claim alleging that the Services, as provided by Winston AI and used by you strictly in accordance with these Terms, infringe or misappropriate any United States patent, copyright, trademark, or trade secret of a third party (an “IP Claim”). Winston AI's obligations under this Section do not apply where an IP Claim arises from your use of the Services in combination with unauthorized software or data, your unauthorized use of the Services, modifications made by you, or Output generated using Customer Data you provided.
13.2 By You
You will defend Winston AI and its affiliates, and their respective officers, directors, employees, and agents, against any third-party claim arising out of or relating to: (a) your use of the Services in violation of these Terms or any Applicable Laws; (b) your Customer Data, including any claim that your Customer Data violates any Applicable Law or infringes any intellectual property or privacy right; (c) any consumer data or personally identifiable information you provide to Winston AI; (d) your material breach of any representation, warranty, or obligation under these Terms; or (e) the gross negligence or willful misconduct of you or your Authorized Users.
13.3 Indemnification Process
Each party's indemnification obligations are conditioned on: (a) the indemnified party promptly notifying the indemnifying party in writing of the claim; (b) the indemnified party granting the indemnifying party sole control of the defense and settlement negotiations; and (c) the indemnified party cooperating reasonably, at the indemnifying party's expense.
14. General
14.1 Governing Law and Venue
These Terms are governed by the laws of the State of California, without regard to its conflict of laws principles. Exclusive jurisdiction and venue for any disputes shall be in the federal courts of the Northern District of California or, if federal jurisdiction does not apply, in the state courts of San Francisco, California.
14.2 Arbitration; Class Action Waiver
Except as provided below, any dispute, claim, or controversy arising out of or relating to these Terms or the Services will be resolved by final and binding arbitration administered by JAMS pursuant to its then-current Streamlined Arbitration Rules and Procedures. The arbitration will be conducted by a single neutral arbitrator in San Francisco, California.
CLASS ACTION WAIVER: TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, ALL DISPUTES MUST BE BROUGHT IN THE PARTIES' INDIVIDUAL CAPACITIES AND NOT AS A PLAINTIFF, CLASS MEMBER, OR REPRESENTATIVE IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING.
You may opt out of this arbitration agreement by sending written notice to legal@treez.io within thirty (30) days of first accepting these Terms.
14.3 Relationship of Parties
These Terms do not create any agency, partnership, joint venture, or franchise relationship. Neither party has authority to bind the other.
14.4 Assignment
Neither party may assign the Order or these Terms without the other party's prior written consent, except in connection with a merger, acquisition, reorganization, or sale of all or substantially all of the assets or equity of such party.
14.5 Notices
Legal notices under these Terms must be in writing and addressed to: Winston AI (Treez Inc.), 548 Market Street, #97004, San Francisco, CA 94104; email: legal@treez.io.
14.6 Force Majeure
Neither party will be liable for any delay or failure to perform (excluding payment obligations) caused by circumstances beyond its reasonable control, provided that party uses commercially reasonable efforts to mitigate the impact.
14.7 Amendment
Winston AI reserves the right to modify these Terms at any time by posting revised Terms on its website and, for material changes, providing you with at least thirty (30) days' prior written notice by email. Your continued use of the Services after the effective date of any modification constitutes your acceptance of the revised Terms.
14.8 Severability
If any provision of these Terms is held illegal, invalid, or unenforceable, that provision will be severed and the remaining provisions will remain in full force and effect.
14.9 Waiver
No waiver of any provision of these Terms shall be effective unless in writing. Failure to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision.
14.10 Entire Agreement
The Order and these Terms (including Appendix A) constitute the complete and exclusive agreement between the parties regarding the Services and supersede all prior or contemporaneous agreements or understandings relating to this subject matter. In the event of a conflict, the Order takes precedence over these Terms, and the DPA (Appendix A) takes precedence over the Order with respect to the processing of Customer Personal Data.
14.11 Contact
If you have questions regarding these Terms, please contact us at legal@treez.io or by mail at: Winston AI (Treez Inc.), 548 Market Street, #97004, San Francisco, CA 94104.
Related Platform Agreements
Depending on the products and services identified in your applicable Order Form(s), your use of those products may also be governed by one or more of the following separate agreements. Each governs only the platform to which it corresponds and is independent of these Terms.
- Point-of-sale platform: treez.io/terms
- eCommerce platform: gapcommerce.com/terms-of-services
- Loyalty platform: stickycards.co/terms-and-conditions
Appendix A — Data Processing Addendum
Incorporated into and forming part of the Winston AI Terms of Service
A.1 Purpose and Scope
This Data Processing Addendum (“DPA”) forms part of and is incorporated into the Winston AI Terms of Service (the “Agreement”). This DPA applies where and to the extent that Winston AI processes Customer Personal Data on your behalf in the course of providing the Services. In the event of any conflict between this DPA and the Agreement with respect to the processing of Customer Personal Data, this DPA controls.
A.2 Definitions
- “Controller”
- The entity that determines the purposes and means of processing Personal Data.
- “Customer Personal Data”
- Any Personal Data contained in Customer Data that Winston AI processes on your behalf in connection with the Services.
- “Data Protection Laws”
- All applicable laws and regulations relating to the processing of Personal Data, including without limitation the CCPA/CPRA and any other applicable state, federal, or international data protection laws.
- “Personal Data”
- Any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.
- “Processor”
- The entity that processes Personal Data on behalf of a Controller.
- “Security Incident”
- Any confirmed unauthorized access to, acquisition of, disclosure of, or destruction of Customer Personal Data processed by Winston AI under this DPA.
- “Sub-processor”
- Any third party engaged by Winston AI to process Customer Personal Data on Winston AI's behalf in connection with the Services.
A.3 Roles of the Parties
As between the parties, you are the Controller and Winston AI is the Processor with respect to Customer Personal Data. Each party will comply with its obligations under applicable Data Protection Laws in its respective role.
A.4 Winston AI's Processing Obligations
Winston AI will process Customer Personal Data only as necessary to perform the Services and as otherwise instructed by you in writing. Winston AI will not process Customer Personal Data for any purpose other than: (a) providing, maintaining, and improving the Services; (b) complying with Applicable Laws; or (c) as otherwise authorized under the Agreement. Winston AI will ensure that all personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.
A.5 Your Processing Obligations
You represent and warrant that you have a valid legal basis for each category of Customer Personal Data you provide to Winston AI, have provided all required notices and obtained all required consents, and that your instructions comply with applicable Data Protection Laws. You acknowledge that the Services are not designed to process protected health information as defined under HIPAA. Winston AI is not a HIPAA Business Associate and does not enter into Business Associate Agreements.
A.6 Sub-processors
You authorize Winston AI to engage Sub-processors. Winston AI's current Sub-processors include third-party AI model providers (including without limitation Anthropic PBC, OpenAI LLC, and Google LLC) and cloud infrastructure providers. Winston AI will provide at least thirty (30) days' prior written notice of any intended addition or replacement of a Sub-processor. If you reasonably object on legitimate data protection grounds, the parties will negotiate in good faith, and if unresolved within thirty (30) days, you may terminate the affected Services and receive a refund of unused prepaid Subscription Fees.
A.7 Security
Winston AI will implement and maintain commercially reasonable technical and organizational measures including: (a) encryption of Customer Personal Data in transit and at rest; (b) access controls limiting access to authorized personnel; (c) regular security testing and vulnerability assessments; and (d) incident detection and response procedures. Winston AI's security obligations under this DPA are a material obligation of the Agreement.
A.8 Security Incidents
Winston AI will notify you without undue delay, and in any event within seventy-two (72) hours of becoming aware of a confirmed Security Incident, by email to the address on file for your account. The notification will include the nature of the incident, categories and approximate number of affected individuals and records, likely consequences, and measures taken or proposed.
A.9 Data Subject Rights
Winston AI will provide reasonable assistance to enable you to respond to requests from individuals exercising their data subject rights with respect to Customer Personal Data. You are responsible for determining whether a request is valid and for communicating with the requesting individual.
A.10 Data Retention and Deletion
Winston AI will retain Customer Personal Data for the duration of the Subscription Term and for such additional period as required by Applicable Laws. Upon expiration or termination of the Agreement, or upon your written request, Winston AI will, at your election, delete or return Customer Personal Data to you within sixty (60) days, except to the extent retention is required by Applicable Laws or by Winston AI's legitimate business purposes.
A.11 Audit Rights
Upon your written request no more than once per calendar year, Winston AI will provide a summary of its then-current data security practices and, upon reasonable prior written notice of at least thirty (30) days and at your expense, cooperate with an audit of Winston AI's processing activities and security controls relevant to Customer Personal Data.
A.12 U.S. Privacy Law Provisions
California (CCPA/CPRA): Winston AI is a “service provider” as defined under the CCPA with respect to Customer Personal Data processed on your behalf. Winston AI will not sell or share Customer Personal Data, or retain, use, or disclose it for any purpose other than performing the Services or as otherwise permitted under the CCPA.
Other U.S. State Privacy Laws: To the extent other U.S. state privacy laws apply (including the Colorado Privacy Act, Connecticut Data Privacy Act, Texas Data Privacy and Security Act, Virginia Consumer Data Protection Act, or similar legislation), Winston AI will process Customer Personal Data as a “processor” or equivalent role and will cooperate with you in good faith to satisfy applicable requirements.
HIPAA Exclusion: The Services are not HIPAA-compliant. Winston AI does not act as a Business Associate as defined under HIPAA and does not enter into Business Associate Agreements. Any submission of PHI to the Services is a material breach of these Terms.
A.13 International Data Transfers
The Services are operated from the United States. Winston AI will make available to customers who require an international transfer mechanism a Standard Contractual Clauses addendum (“SCC Addendum”) for transfers of personal data of individuals located in the EEA, UK, or Switzerland. To request an SCC Addendum, contact legal@treez.io.
A.14 Governing Law
This DPA is governed by the same law and subject to the same dispute resolution provisions as the Agreement.
Winston AI™ | USPTO Serial No. 99772160
548 Market Street, #97004, San Francisco, CA 94104 | legal@treez.io