Terms of Service

1. Acceptance of Terms

By accessing or using Flowstate Mortgage, LLC's services, including our CRM platform, website, and related services (collectively, the "Service"), you agree to be bound by these Terms of Service ("Terms"). If you are accepting these Terms on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind that entity to these Terms, and "you" and "your" will refer to that entity. If you disagree with any part of these Terms, you may not access the Service.

2. Description of Service

Flowstate Mortgage, LLC ("FlowState," "we," "our," or "us") provides a cloud-based customer relationship management platform specifically designed for mortgage lenders, including:

• Automated workflow management and document processing
• Client communication and relationship management tools
• Compliance tracking and regulatory reporting
• Integration with third-party mortgage industry tools and Connected Accounts
• AI-powered analytics, pipeline intelligence, and reporting capabilities
• User account management and authentication services

3. User Accounts and Registration

To access certain features of the Service, you must register for an account. You agree to:

• Provide accurate, current, and complete information during registration
• Maintain and promptly update your account information
• Maintain the security of your password and account
• Accept responsibility for all activities under your account
• Notify us immediately of any unauthorized use of your account

4. Subscription and Payment Terms

Subscription Plans:

We offer various subscription plans with different features and pricing. Current pricing is available on our website and may be updated from time to time.

Payment:

• Subscription fees are billed in advance on a monthly or annual basis
• All fees are non-refundable except as required by law
• You authorize us to charge your payment method for all fees
• We may suspend or terminate your account for non-payment

Price Changes:

We may modify subscription fees with 30 days' notice. Continued use after the effective date constitutes acceptance of new pricing.

5. Acceptable Use Policy

You agree not to use the Service to:

• Violate any applicable laws or regulations
• Infringe on intellectual property rights
• Transmit harmful, offensive, or inappropriate content
• Attempt to gain unauthorized access to our systems
• Interfere with or disrupt the Service
• Use the Service for any fraudulent or illegal activities
• Reverse engineer or attempt to extract source code
• Resell or redistribute the Service without authorization
• Access or use Connected Account data belonging to another user, or attempt to circumvent data isolation controls

6. Data Ownership, Privacy, and Security

Your use of the Service is also governed by our Privacy Policy, which is incorporated into these Terms by reference. You retain ownership of your data, and we will process it in accordance with our Privacy Policy and applicable data protection laws. This includes data you provide directly as well as data accessed through Connected Accounts (as defined in Section 8 below).

Data Security:

We implement industry-standard security measures, including 256-bit TLS encryption in transit, AES-256 encryption at rest, role-based access controls, and regular security assessments. Our security practices are built on SOC 2 frameworks, with formal certification in progress. You acknowledge that no system is completely secure and are responsible for maintaining appropriate security measures for your own credentials and account access.

Data Breach Notification:

In the event of a confirmed security breach that results in unauthorized access to your personal information or Connected Account data, FlowState will notify affected users within seventy-two (72) hours of confirming the breach. Notification will include a description of the breach, the categories of data affected, the measures taken to address the breach, and recommended protective steps. Full details of our breach notification commitments are described in Section 7 of our Privacy Policy.

Aggregated and De-Identified Data:

We may create aggregated, de-identified data derived from your use of the Service, including from Connected Account data. Such data cannot reasonably be used to identify you or any individual. We may use aggregated, de-identified data for any lawful business purpose, including product improvement, analytics, benchmarking, and developing new features. This data is not subject to deletion requests and may be retained indefinitely.

7. Intellectual Property

The Service and its original content, features, and functionality are owned by Flowstate Mortgage, LLC and are protected by international copyright, trademark, patent, trade secret, and other intellectual property laws.

License to Use the Service:

We grant you a limited, non-exclusive, non-transferable, non-sublicensable license to use the Service for your internal business purposes in accordance with these Terms. This license does not include the right to modify, distribute, or create derivative works based on the Service.

Your Content:

You retain all ownership rights in data and content you submit to the Service ("Your Content"). You grant FlowState a non-exclusive, worldwide, royalty-free license to use, process, and store Your Content solely as necessary to provide and improve the Service. This license terminates when you delete Your Content or terminate your account, except with respect to aggregated and de-identified data as described in Section 6.

8. Connected Accounts and Third-Party Integrations

The Service allows you to connect third-party accounts and services ("Connected Accounts") to enhance your FlowState experience. Connected Accounts currently include Microsoft Outlook (email and calendar) and may in the future include services such as Google Workspace, Salesforce, Zillow, and other mortgage industry platforms. Connecting a third-party account is voluntary and user-initiated.

Permissions and Access:

When you connect a third-party account, FlowState will request specific permissions through that provider's authorization process (such as OAuth 2.0). FlowState applies the principle of minimum necessary access and requests only the permissions required to deliver the specific features you use. The permissions FlowState requests depend on the integration and may include:

• Read your email (Mail.Read) — FlowState accesses your inbox to surface relevant client communications within the CRM, helping you track and respond to borrower interactions
• Send email on your behalf (Mail.Send) — FlowState can send emails from your connected account when you compose messages within the CRM
• Access your calendar (Calendars.ReadWrite) — FlowState syncs your calendar to help schedule, track, and manage client meetings and deadlines

We will clearly disclose the specific permissions requested before you authorize each Connected Account. You may review and revoke these permissions at any time through your FlowState account settings or directly through the third-party provider's security settings.

License Grant:

By connecting a third-party account to FlowState, you grant FlowState a non-exclusive, worldwide, royalty-free license to access, retrieve, process, store, and use data from that Connected Account for the purposes of providing, maintaining, improving, and developing the Service, including building aggregate analytics and product intelligence features. This license is subject to the data use restrictions described in Section 3 of our Privacy Policy ("What We Do Not Do With Your Data"). This license continues for as long as the Connected Account remains linked and, with respect to aggregated and de-identified data, indefinitely.

Data Handling:

FlowState accesses email messages, calendar events, and associated metadata from your Connected Accounts. We store the data elements necessary to provide Service features, which may include message metadata, sender and recipient information, subject lines, message content, calendar event details, and attachments. Our Privacy Policy describes in detail what data we collect, how we use it, what we do not do with it, and how long we retain it.

Your Authority to Connect:

You represent and warrant that you have all necessary rights, permissions, and authority to grant FlowState access to each Connected Account, including any required authorization from your employer, organization, or account administrator. If you connect an account owned or managed by your employer or organization, you are responsible for ensuring you have the authority to do so. You will indemnify FlowState against any claims arising from your lack of authority to connect a third-party account.

Disconnecting:

You may disconnect any Connected Account at any time through your FlowState account settings. Upon disconnection, FlowState will cease accessing new data from that account and will delete stored data from that Connected Account within thirty (30) calendar days, except for: (a) aggregated and de-identified data, which may be retained indefinitely; and (b) data required to be retained for legal, regulatory, or compliance obligations. Backup copies may persist for up to ninety (90) days following deletion. You may request an export of your Connected Account data before disconnection, which will be fulfilled within fifteen (15) business days.

Third-Party Terms and Limitations:

Your use of Connected Accounts remains subject to the applicable third party's terms of service and privacy policies. FlowState is not responsible for the availability, accuracy, or completeness of data obtained through third-party integrations, or for any changes to, suspension of, or discontinuation of third-party services. FlowState's liability for claims arising from Connected Account data shall not exceed the fees paid by you for the Service in the three (3) months preceding the claim, notwithstanding any other limitation of liability in these Terms.

Platform Compliance:

FlowState's use of data from Connected Account providers complies with those providers' applicable developer policies and terms, including the Microsoft Identity Platform Terms of Use and (when available) the Google API Services User Data Policy, including the Limited Use requirements. Platform-specific disclosures are provided in Section 13 of our Privacy Policy.

9. Service Availability and Support

We strive to maintain high service availability but do not guarantee uninterrupted access. We provide customer support during business hours and will use reasonable efforts to resolve issues promptly. Planned maintenance windows will be communicated in advance where feasible.

10. Confidentiality

Each party agrees to hold in confidence all non-public information disclosed by the other party that is designated as confidential or that reasonably should be understood to be confidential ("Confidential Information"). Confidential Information includes, without limitation, your Connected Account data, business data, and FlowState's proprietary technology, product plans, and security architecture.

• The receiving party will use Confidential Information only as necessary to perform its obligations or exercise its rights under these Terms
• The receiving party will protect Confidential Information using the same degree of care it uses for its own confidential information, but no less than reasonable care
• Confidential Information may be disclosed to employees, contractors, and agents who need to know it and who are bound by confidentiality obligations at least as protective as these Terms
• Confidentiality obligations do not apply to information that is publicly available, already known to the receiving party, independently developed, or required to be disclosed by law (with reasonable notice to the disclosing party where permitted)

Confidentiality obligations survive termination of these Terms for three (3) years, except that obligations with respect to trade secrets survive for as long as the information remains a trade secret under applicable law.

11. Termination

Either party may terminate these Terms at any time with thirty (30) days' written notice. FlowState may terminate or suspend your access immediately if you materially breach these Terms. Upon termination:

• Your access to the Service will cease
• You remain responsible for any outstanding fees
• We will provide you with thirty (30) days following termination to export your data, including Connected Account data, in a machine-readable format
• After the export period, we may delete your data in accordance with our retention policies
• All Connected Accounts will be automatically disconnected, and data from those accounts will be handled in accordance with the disconnection procedures described in Section 8, including the thirty (30) day deletion timeline and retention of aggregated and de-identified data

Survival:

The following sections survive termination: Section 6 (Data), Section 7 (Intellectual Property), Section 10 (Confidentiality), Section 12 (Disclaimers and Limitation of Liability), Section 13 (Indemnification), Section 14 (Governing Law and Disputes), and any other provisions that by their nature should survive.

12. Disclaimers and Limitation of Liability

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. FLOWSTATE DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL FLOWSTATE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF FLOWSTATE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

FLOWSTATE'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNTS PAID BY YOU TO FLOWSTATE FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100).

Exceptions to Limitations:

The limitations of liability in this section do not apply to: (a) either party's indemnification obligations under Section 13; (b) either party's breach of confidentiality obligations under Section 10; (c) FlowState's obligations under its data breach notification commitments; or (d) liability arising from a party's gross negligence, willful misconduct, or fraud.

13. Indemnification

Your Indemnification of FlowState:

You agree to indemnify, defend, and hold harmless FlowState and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from or related to:

• Your use of the Service in violation of these Terms
• Your violation of any applicable law or regulation
• Your connection of a third-party account without proper authority, including claims from your employer or organization regarding unauthorized account access
• Your Content or data you submit to the Service that infringes third-party rights

FlowState's Indemnification of You:

FlowState will indemnify, defend, and hold harmless you and your officers, directors, employees, and agents from and against any third-party claims alleging that the Service (excluding Your Content and third-party integrations) infringes a valid United States patent, copyright, or trademark, provided that you:

• Promptly notify FlowState in writing of the claim
• Grant FlowState sole control of the defense and settlement
• Provide reasonable cooperation at FlowState's expense

If FlowState believes the Service may infringe, FlowState may, at its option and expense: (a) obtain the right for you to continue using the Service; (b) modify the Service to make it non-infringing; or (c) if neither (a) nor (b) is commercially reasonable, terminate the affected portion of the Service and refund prepaid fees for the unused subscription period.

Data Breach Indemnification:

If a data breach occurs due to FlowState's failure to implement or maintain the security measures described in these Terms and our Privacy Policy, FlowState will indemnify you against direct damages resulting from that breach, subject to the liability cap in Section 12, except that the cap shall not apply where the breach results from FlowState's gross negligence or willful misconduct.

14. Governing Law and Disputes

These Terms are governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict of law provisions.

Arbitration:

Any dispute, claim, or controversy arising out of or relating to these Terms or the Service (a "Dispute") that cannot be resolved through good-faith negotiation within thirty (30) days shall be resolved by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules. Arbitration shall take place in Dallas County, Texas, before a single arbitrator. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.

Class Action Waiver:

YOU AND FLOWSTATE AGREE THAT EACH PARTY MAY BRING DISPUTES AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS AND MAY NOT PRESIDE OVER ANY FORM OF CLASS OR REPRESENTATIVE PROCEEDING.

Exceptions:

• Small claims: Either party may bring an individual action in small claims court for Disputes within that court's jurisdictional limits
• Injunctive relief: Either party may seek emergency or provisional injunctive relief from a court of competent jurisdiction in Dallas County, Texas to protect its intellectual property rights or Confidential Information, without waiving the right to arbitrate

Arbitration Costs:

FlowState will pay all AAA filing fees, administration fees, and arbitrator fees for Disputes involving claims of less than $75,000. For Disputes involving claims of $75,000 or more, costs and fees will be allocated in accordance with AAA Commercial Arbitration Rules. Each party bears its own attorneys' fees unless the arbitrator determines that a party's claim or defense was frivolous, in which case the arbitrator may award reasonable attorneys' fees to the prevailing party.

15. Changes to Terms

We may modify these Terms at any time. For material changes — particularly those affecting Connected Account data handling, pricing, or liability provisions — we will notify you by email at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the modified Terms. If you do not agree with the revised Terms, you may terminate your account before the changes take effect.

16. General Provisions

• Entire Agreement: These Terms, together with the Privacy Policy and any Order Forms, constitute the entire agreement between you and FlowState regarding the Service and supersede all prior agreements and understandings
• Severability: If any provision of these Terms is held to be unenforceable, the remaining provisions will remain in full force and effect
• Waiver: Failure to enforce any provision of these Terms shall not constitute a waiver of that provision or any other provision
• Assignment: You may not assign these Terms without FlowState's prior written consent. FlowState may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided the assignee agrees to be bound by these Terms
• Force Majeure: Neither party shall be liable for any delay or failure to perform due to causes beyond its reasonable control, including natural disasters, acts of government, pandemic, or infrastructure failures
• Notices: All notices under these Terms shall be sent by email to the address associated with your account (for notices to you) or to legal@flowstate.mortgage (for notices to FlowState)

17. Contact Information

For questions about these Terms, please contact us at: