Commercial Terms

Effective August 26, 2026. These Commercial Terms supplement the consumer Terms of Use. We preserve prior versions and provide the version governing an organization's account on request.

• An organization designates administrators to manage membership, roles, billing and enforced settings such as multi-factor authentication.
• The organization is responsible for its administrators' instructions and actions. Administering access does not transfer a member's personal data to the organization.
• Members keep control of their sign-in credentials. An organization may remove a member's access to organizational resources without acquiring memories held outside that organizational context.

• Provide required notices and obtain the permissions or consents needed for your instructions, including where your Customer Data concerns employees, customers, children, health information, biometric information, neural information or other sensitive categories.
• Use the service lawfully and give Mpalo instructions that are clear, proportionate and within the scope of the service.
• Respect people whose information appears in Customer Data. An organization does not acquire another person's rights merely because it submits information about them.
• Tell Mpalo promptly if you receive a privacy request, regulatory request or security incident that requires our assistance.

• API keys are organizational credentials. Keep them secret, rotate them when staff leave and revoke them when compromise is suspected.
• Rate limits apply per key or account as documented. Sustained abuse may throttle or suspend a key. We notify the technical or billing contact we hold where doing so is safe.
• If you direct requests to your own inference or storage provider, that provider is not an Mpalo subprocessor for the directed processing. Its terms, costs and compliance obligations are yours.
• Do not resell raw access, conceal that a product runs on Mpalo, or use the service for covert cognitive surveillance, unauthorized intimate cognitive or neural inference, targeted manipulation designed to bypass meaningful agency, or offensive cognitive manipulation systems targeting civilian populations.

Mpalo may use subprocessors for infrastructure, authentication, payments, communications, security and other functions. We require them to process Customer Data only for the services and instructions established in our agreements. We communicate material subprocessor changes through the applicable service documentation or contract. International transfers use a mechanism required by applicable law.

Each party protects the other's non-public information and uses it only for the relationship. Mpalo's current security measures are described on the Safety & Security page and in applicable contract schedules. We do not imply a certification we do not hold.

Where applicable law or a signed agreement requires an audit, Mpalo may satisfy it through current security documentation, an independent assurance report, a questionnaire and reasonable additional evidence. Audits must protect other customers' information and Mpalo's security.

Either party may end an organizational subscription as stated in the order or at the close of a billing period. Mpalo may suspend access for non-payment, security risk, unlawful instructions or material breach. We will provide notice and an opportunity to cure where the risk permits.

Nothing in these Terms excludes responsibility that cannot lawfully be excluded. Liability allocation, warranties, support levels, service credits, governing law and dispute procedures are governed by the signed order where one exists. Otherwise, the consumer Terms apply to matters not addressed here, with mandatory commercial rights preserved.