CLASSIFICATION: LEGAL-CRITICAL — DRAFT

This is the first complete draft of Mpalo's Consumer Terms of Service, governing the relationship between Mpalo Inc. and individual users of consumer-facing Mpalo products, including the browser extension and any future consumer products. It must be reviewed and approved by qualified legal counsel before publication.

Companion documents: 3.2 Privacy Policy Decision Record · 3.3 Privacy Policy Draft · 3.4 Commercial ToS · 3.1 Legal & Tax Risk Register

---

Palo Bloom — Consumer Terms of Service

Effective date: April 9, 2026

Last updated: April 9, 2026

Version: 1.0

Full changelog: mind.mpalo.com/legal/changelog

These terms apply if you are an individual using Mpalo's browser extension or any consumer-facing Mpalo product for personal, non-commercial purposes. If you are a developer or business using the Palo Bloom API, the Commercial Terms of Service apply instead.

Please read these. They're written to be understood, not to hide things.

---

1. Who We Are

Mpalo Inc. is a Delaware Public Benefit Corporation. We exist to advance the responsible development of memory in AI — and to do it in a way that puts you, the person, first. The company is named after Palo, a real cat. That's not a brand decision. It's where this started.

Registered address: [PLACEHOLDER — Delaware registered agent address]

Contact: privacy@mpalo.com

---

2. What the Browser Extension Does

The Mpalo browser extension adds AI memory functionality to supported chatbot interfaces. When you type into a supported chatbot, the extension captures your input and sends it to Palo Bloom's API to be stored as a memory that can inform future interactions.

The extension only activates when you are actively using a supported chatbot. It does not run in the background. It does not monitor your browsing. It does not collect anything outside of your active interaction with a supported chatbot interface. [CONFIRM WITH ENGINEERING — verify before publication.]

You can disable or uninstall the extension at any time. Doing so stops all data capture immediately.

Supported chatbot interfaces: [PLACEHOLDER — list e.g. chat.openai.com, gemini.google.com — CONFIRM WITH ENGINEERING]

---

3. Your Account

You need an account to use the extension. You must provide accurate information and keep it current. You are responsible for your account and anything that happens under it.

Minimum age: 16 years old. Do not create an account if you are under 16. If we become aware of an account belonging to someone under 16, we will delete it.

---

4. Your Data

Your memories are yours. We don't own them. We don't sell them. We don't train AI models on them.

What we store: The text you type into supported chatbots while the extension is active, stored as structured memory objects in your personal namespace.

What we never do with it:

• Sell it to anyone
• Share it with advertisers or data brokers
• Use it to train our AI models (or anyone else's)
• Share it across accounts or with other users
• Use it for purposes beyond providing the memory service to you

Deleting your memories: You can delete individual memories, all memories, or your entire account at any time from your account settings. When you delete, we remove your data from live systems promptly and purge backups within 30 days.

Exporting your memories: You can download all your stored memories in JSON format at any time from your account settings.

For full details on how we handle your data, see our Privacy Policy at mpalo.com/privacy.

---

5. What We Expect From You

We ask you not to use the extension or your account to:

• Do anything illegal
• Harm, harass, or exploit other people
• Attempt to access anyone else's memories or account
• Interfere with or attack Mpalo's infrastructure
• Misrepresent who you are when creating an account

We may suspend or close your account if you do any of these things.

---

6. Our Commitment to You

6.1 We will not exploit you

This is a promise, not a clause. We designed Palo Bloom so that memory makes your experience better — not so that we can use what you've shared to manipulate, monetise, or exploit you. Specifically, Mpalo commits that we will never:

• Use your memories to target you with advertising
• Use your memories to manipulate your emotions, behaviour, or decisions for our commercial benefit
• Use your stored memories to build profiles of you for sale to third parties
• Use information about your vulnerabilities, distress, or sensitive personal circumstances to influence what you see or what you're charged
• Design features to trap you, create false dependency, or make it deliberately difficult to leave

If we ever wanted to do any of these things, our PBC charter prevents it. If we tried anyway, you could hold us to this clause.

6.2 We will be transparent

• We will tell you clearly what the extension captures and how
• We will give you at least 30 days' notice before any material change to these Terms, by email
• We maintain a full public changelog of all policy changes at mind.mpalo.com/legal/changelog
• We will not change how we use your data in ways that go beyond what you agreed to without asking you first

6.3 We will protect your data

• Your memories are encrypted at rest and in transit
• We will notify you in the event of a data breach affecting your data within the timeframes required by law
• We will never retain your data longer than necessary

---

7. Third-Party Chatbot Services

The extension works alongside third-party chatbot services (e.g. ChatGPT, Gemini). We are not affiliated with these services. When you send messages to a chatbot, that interaction is governed by the chatbot provider's own terms and privacy policy — not ours. We are only responsible for the memory layer we add, not for what the chatbot does with your messages.

---

8. Our Liability to You

We provide the extension and Services in good faith and with reasonable care. However:

We are not liable for:

• Inaccurate memory retrievals, or decisions you make based on memory outputs
• Interruptions or bugs in the service
• The behaviour of third-party chatbot services
• Data loss caused by events outside our reasonable control

We are liable for:

• Our own negligence or fraud
• Any losses caused by our breach of these Terms
• Any liability that cannot be excluded by law

Your EU consumer rights are not affected. If you are based in the EU or EEA, you retain all mandatory consumer protection rights under applicable law, regardless of anything in these Terms. Nothing here limits rights you have under EU consumer law, the Consumer Rights Directive, or applicable national consumer protection legislation.

---

9. Governing Law and Disputes

If you are based in the EU or EEA: These Terms are governed by the laws of Ireland. Any dispute that cannot be resolved informally will be referred to the courts of Ireland, or the courts of your country of residence at your option. You also retain the right to refer disputes to your national consumer protection authority or an alternative dispute resolution (ADR) body under EU Directive 2013/11/EU.

If you are based outside the EU/EEA: These Terms are governed by the laws of the State of Delaware. Disputes will first go through a 30-day good-faith resolution process. If unresolved, either party may bring a claim in the state or federal courts of Delaware.

No mandatory arbitration for consumers. We do not require you to arbitrate disputes or waive your right to participate in a class action. You have the right to take us to court.

---

10. Changes and Termination

Changes. We'll email you at least 30 days before any material change to these Terms. If you don't agree with a change, you can close your account before the change takes effect. Continuing to use the extension after the effective date means you accept the updated Terms.

Closing your account. You can close your account at any time in settings. We'll delete your data within 30 days of account closure.

If we need to close your account. We might need to close your account if you've violated these Terms or if we stop offering the consumer product. We'll give you at least 30 days' notice where possible, and always give you time to export your data first.

---

11. Contact

Questions about these Terms or your account: privacy@mpalo.com

For EU/EEA data protection concerns: contact the supervisory authority in your country of residence. [CONFIRM WITH COUNSEL — insert the correct lead supervisory authority, pending PE resolution.]

---