Master Terms of Service

Last Updated: August 12, 2026

These Master Terms of Service (this “Agreement”) explain the agreement between SpareBox Technologies, LLC, a Delaware limited liability company with offices located at 7887 E Belleview Ave, Suite 650, Greenwood Village, CO 80111 (“Provider”), and you, a self-storage facility owner or operator (“Operator”). Provider and Operator may be referred to herein collectively as the “Parties” or individually as a “Party.”

1. Background. Provider offers a suite of web-based and mobile, remote self-storage management solutions for self-storage facility owners and operators, which may include: (a) SpareBox BigFoot™, a tool that helps Operator optimize its SpareFoot bidding strategy; (b) SpareBox Prophet™, AI-powered revenue management software; and (c) SpareBox RaFA™, a self-storage property management field app, together with its web interface, SpareBox Snapshot (each, a “Service”, and collectively, the “Services”). Subject to and in accordance with the provisions of this Agreement, Operator desires to obtain, and Provider desires to provide, access to one or more of the Services through Provider’s website and/or web-based and mobile application(s), as more specifically set forth in the Sales Order Form or, during a free trial, the Free Trial Terms.
2. Definitions. Capitalized terms used in this Agreement have the meanings set out below or where otherwise defined herein.
   1. “Aggregated User Data” means data and information related to Authorized Users’ use of the Services that is used by Provider in an aggregate and anonymized manner, including to compile statistical and performance information related to the provision and operation of the Services.
   2. “Authorized User” means Operator’s employees, consultants, contractors, and agents (i) who are authorized by Operator to access and use the Services under the rights granted to Operator pursuant to this Agreement and (ii) for whom access to the Services has been purchased or otherwise provisioned hereunder.
   3. “BigFoot” means SpareBox BigFoot™, a tool that helps Operator optimize its SpareFoot bidding strategy, as further described in Section 4(a).
   4. “De-Identified Data” means data and information from which Personal Information has been removed or altered such that it neither identifies nor can reasonably be linked to a particular individual, Operator, or Authorized User. De-Identified Data is deemed Aggregated User Data under this Agreement.
   5. “Device” means a tablet, phone, or similar mobile device used to access RaFA. “Loaner Device” means a Device provided by Provider to Operator under the Loaner Device Attachment. “Device Attachment” means the BYOD Attachment or the Loaner Device Attachment, as elected by Operator in the Free Trial Terms or Sales Order Form.
   6. “Documentation” means Provider’s user manuals, handbooks, and guides relating to the Services provided by Provider to Operator.
   7. “Data Processing Addendum” or “DPA” means the SpareBox Data Processing Addendum incorporated into this Agreement, which governs Provider’s processing of Operator Customer Data on Operator’s behalf.
   8. “Facility” means a self-storage facility owned or operated by Operator and enrolled in the Services.
   9. “Fees” means the amounts payable by Operator for the Services as set forth in the Sales Order Form.
   10. “Free Trial” means the provision of access to one or more Services at no charge for evaluation purposes, as described in the Free Trial Terms. “Free Trial Period” means the period stated in the Free Trial Terms, which is thirty (30) days unless otherwise specified. “Free Trial Terms” means the click-accept terms governing a Free Trial.
   11. “Login Credentials” means the username and password each Authorized User creates and maintains to access the Services.
   12. “Model” means any artificial intelligence or machine-learning model, algorithm, or script used by Provider in or to provide a Service, including the RaFA application and the Prophet revenue Models.
   13. “Operator Customer Data” means the “personally identifiable information”, or any other information that is subject to consumer data privacy laws, that is provided by Operator’s customers in connection with Operator’s use of the Services.
   14. “Operator Data” means, other than Aggregated User Data, information, data, and other content related to Operator’s Business in any form or medium that is submitted, posted, derived or otherwise transmitted by or on behalf of Operator or an Authorized User through the Services.
   15. “Personal Information” means “personally identifiable information” or any other information that is subject to applicable consumer data privacy laws.
   16. “PMS” or “Property Management System” means the third-party property management software used by Operator with which the Prophet and RaFA Services integrate, which constitutes a Third-Party Product.
   17. “Prophet” means SpareBox Prophet™, AI-powered revenue management software, as further described in Section 4(b).
   18. “Provider IP” means the Services, the Documentation, the Models, and any and all intellectual property provided to Operator or any Authorized User in connection with the foregoing. For the avoidance of doubt, Provider IP includes Aggregated User Data and any information, data, or other content derived from Provider’s monitoring of Authorized Users’ access to or use of the Services, but does not include Operator Data, Operator Customer Data, or Third-Party Operator Data.
   19. “RaFA” means SpareBox RaFA™, a self-storage property management field app, together with its web interface, “Snapshot”, as further described in Section 4(c).
   20. “Sales Order Form” means the Services and business terms related thereto, including Fees, payment, term, Facility count, and Device Attachment election, selected by Operator on Provider’s web-based order form, which document triggers the application of this Agreement.
   21. “SpareFoot” means SpareFoot, Inc., a Delaware corporation and/or SpareFoot LLC, a Delaware limited liability company, owners and operators of a web-based self-storage unit marketplace.
   22. “Third-Party Operator Data” means Operator Data that is stored and maintained by or on behalf of third-party service providers (e.g., SpareFoot).
   23. “Third-Party Products” means any third-party products incorporated into or integrated with the Services, including the Property Management System.
3. Access and Use.
   1. Provision of Access to Services. Subject to and conditioned on Operator’s payment of the Fees applicable to a Service and compliance with all other terms and conditions of this Agreement, Provider hereby grants Operator a non-exclusive, non-transferable (except in compliance with Section 16(g)) right to access and use the Services during the Term, solely for use by Authorized Users in accordance with the terms and conditions herein. Such use is limited to Operator’s internal use. Provider shall provide to Operator the necessary user IDs, passwords and network links or connections to allow Operator to initially access the Services. Thereafter, each Authorized User will create, maintain, and is required to use, a separate username and password (“Login Credentials”) to access the Services. Each Authorized User will keep their Login Credentials strictly confidential and shall not permit any other person to use the Services using their Login Credentials.
   2. Limited Display License. Subject to the terms and conditions contained in this Agreement, Provider hereby grants to Operator a non-exclusive, non-sublicensable, non-transferable (except in compliance with Section 16(g)) license to (i) display the screens and any visual output from the underlying software and/or web-based and mobile applications and (ii) display and utilize the Documentation, in each case during the Term and solely for Operator’s business purposes in connection with its use of the Services.
   3. Use Restrictions. Operator shall not use the Services for any purposes beyond the scope of the access granted in this Agreement. Operator shall not at any time, directly or indirectly, and shall not permit any Authorized Users to: (i) copy, modify, distribute or create derivative works of the Services or Documentation, in whole or in part; (ii) rent, lease, lend, sell, license, sublicense, assign, publish, transfer, or otherwise make available the Services or Documentation; (iii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any software component of the Services or Documentation, in whole or in part; (iv) remove any proprietary notices from the Services or Documentation; or (v) use the Services or Documentation in any manner or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right or other right of any person, or that violates any applicable law.
   4. Reservation of Rights. Provider reserves all rights not expressly granted to Operator in this Agreement. Except for the limited rights and licenses expressly granted under this Agreement, nothing in this Agreement grants, by implication, waiver, estoppel, or otherwise, to Operator or any third party any intellectual property rights or other right, title, or interest in or to the Provider IP.
   5. Suspension. Notwithstanding anything to the contrary in this Agreement, Provider may temporarily suspend Operator’s and any Authorized User’s access to any portion or all of the Services if: (i) Provider reasonably determines that (A) there is a threat or attack on any of the Provider IP; (B) Operator’s or any Authorized User’s use of the Provider IP disrupts or poses a security risk to the Provider IP or to any other Operator or vendor of Provider; (C) Operator, or any Authorized User, is using the Provider IP for fraudulent or illegal activities; (D) subject to applicable law, Operator has ceased to continue its business in the ordinary course, made an assignment for the benefit of creditors or similar disposition of its assets, or become the subject of any bankruptcy, reorganization, liquidation, dissolution, or similar proceeding; or (E) Provider’s provision of the Services to Operator or any Authorized User is prohibited by applicable law; (ii) any vendor of Provider has suspended or terminated Provider’s access to or use of any third-party services or products required to enable Operator to access the Services; or (iii) in accordance with Section 7 (a “Service Suspension”). Provider shall use commercially reasonable efforts to provide written notice of any Service Suspension to Operator and to provide updates regarding resumption of access to the Services following any Service Suspension. Provider shall use commercially reasonable efforts to resume providing access to the Services as soon as reasonably possible after the event giving rise to the Service Suspension is cured. Provider will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Operator or any Authorized User may incur as a result of a Service Suspension.
   6. Aggregated User Data. Notwithstanding anything to the contrary contained in this Agreement, Provider may monitor Operator’s use of the Services and collect and compile Aggregated User Data. As between Provider and Operator, all right, title, and interest in Aggregated User Data, and all intellectual property rights therein, belong to and are retained solely by Provider. Operator acknowledges that Provider may compile Aggregated User Data based on Operator Data and Third-Party Operator Data input into the Services. Operator agrees that Provider may (i) make Aggregated User Data publicly available in compliance with applicable law, and (ii) use Aggregated User Data to the extent and in the manner permitted under applicable law; provided that such Aggregated User Data do not identify Operator, any Authorized User or Operator’s Confidential Information.
4. Product-Specific Terms. The following terms apply to each Service to the extent Operator subscribes to or is provided access to that Service. In the event of a conflict between this Section 4 and the general terms of this Agreement with respect to a particular Service, this Section 4 controls for that Service.
   1. BigFoot. BigFoot is provided as a web-based application that operates in connection with SpareFoot to help Operator optimize its SpareFoot bidding strategy. Operator’s access to and use of SpareFoot remains subject to SpareFoot’s own terms, and SpareFoot is a Third-Party Product. Operator Data made available to BigFoot through SpareFoot constitutes Third-Party Operator Data.
   2. Prophet. Prophet is provided as a web-based application that integrates with Operator’s Property Management System. Prophet’s street-rate and existing-customer rate-increase outputs are recommendations only, are provided for Operator’s consideration, and do not constitute a guarantee of any result; Operator is solely responsible for all pricing and other decisions it makes in reliance on Prophet.
   3. RaFA and Snapshot. RaFA is provided as a mobile application, and Snapshot as its web-based interface, each of which operates in connection with Operator’s Property Management System. RaFA utilizes a Provider-maintained, standalone database to track and communicate with the Property Management System. Where Operator accesses RaFA, the Device Attachment elected by Operator in the Free Trial Terms or Sales Order Form (bring-your-own-device or Loaner Device) applies. Any photographs, videos, or other content uploaded through RaFA or Snapshot are used solely to provide the features Operator chooses to engage. Operator acknowledges that the Models used in RaFA and Snapshot learn on the basis of Operator’s own portfolio, subject to Section 8.
5. Integrations.
   1. Property Management System. Certain Services integrate with Operator’s Property Management System. Provider integrates with the property management systems Provider then supports and, where a required integration is not yet available, Provider will build the integration necessary for Operator to use the applicable Service as part of onboarding at no additional charge. Provider is not obligated to develop, expand, or maintain additional or enhanced integrations except as the Parties may agree, which agreement may be set out in the Sales Order Form or a Statement of Work and may be subject to additional fees.
   2. Operator Cooperation. Operator shall cooperate with Provider and Third-Party Product providers to the extent necessary for Provider to access Third-Party Operator Data and connect it to the Services.
   3. Third-Party Products. Operator’s use of any Third-Party Product, including the Property Management System and SpareFoot, is subject to the applicable third party’s terms. Provider disclaims all warranties and liability with respect to Third-Party Products as set forth in Sections 12 and 14.
6. Operator Responsibilities. Operator is responsible and liable for all uses of the Services and Documentation resulting from access provided by Operator, directly or indirectly, whether such access or use is permitted by or in violation of this Agreement. Without limiting the generality of the foregoing, Operator is responsible for all acts and omissions of Authorized Users, and any act or omission by an Authorized User that would constitute a breach of this Agreement if taken by Operator will be deemed a breach of this Agreement by Operator. Operator shall use reasonable efforts to make all Authorized Users aware of this Agreement’s provisions as applicable to such Authorized User’s use of the Services and shall cause Authorized Users to comply with such provisions. Operator shall promptly report to Provider all bugs and errors related to the Service(s) of which Operator becomes aware.
7. Fees and Payment.
   1. Fees. Operator shall pay Provider the fees, as they may be modified from time to time by Provider (“Fees”), as set forth in the Sales Order Form, without offset or deduction. Operator shall make all payments hereunder in US dollars on or before the due date set forth in the Sales Order Form. If Operator fails to make any payment when due, without limiting Provider’s other rights and remedies: (i) Provider may charge interest on the past due amount at the rate of one percent (1.0%) per month, calculated daily and compounded monthly or, if lower, the highest rate permitted under applicable law; (ii) Operator shall reimburse Provider for all collection costs incurred in connection with Operator’s late payment; and (iii) if such failure continues for fifteen (15) days or more, Provider may suspend Operator’s and its Authorized Users’ access to all or any portion of the Services until such amounts are paid in full.
   2. Payment. Unless otherwise specified in the Sales Order Form, all Fees shall be paid to Provider by Operator in advance (i) via check or ACH, or (ii) automatic debit, debit card or credit card, to be set up by Operator with Provider’s payment processing service. Provider may, in the event that automatic payment fails, directly invoice Operator for any applicable fees incurred by Operator from time to time in connection with the provision of Services. All fees are exclusive of applicable sales, excise, or use taxes, which shall be the sole responsibility of Operator.
   3. Annual Increase. At the commencement of each Renewal Term, the Fees shall increase by six percent (6%), as set forth in the Sales Order Form.
8. Data, Privacy and AI.
   1. Security. Provider shall use commercially available security software for authentication and encryption of the Operator Data, the Third-Party Operator Data, and any Operator Customer Data (if and to the extent any of the foregoing data is stored or transmitted by Provider) and will take such other security measures as may be required by regulatory authorities with jurisdiction over the Services. Operator acknowledges that transmission of data over the Internet may not be secure, even after such reasonable security measures have been taken, and Operator will hold Provider harmless from the dissemination, misappropriation, loss or corruption of data caused by third parties, provided Operator meets its covenants in this Section 8(a).
   2. Data Privacy. The following apply with respect to data privacy:
      1. Operator shall not include within any Operator Data, and represents and warrants that the Third-Party Operator Data does not include, any “personally identifiable information,” or information that is otherwise private, sensitive and/or protected by consumer data privacy laws, except for Operator Customer Data provided in connection with Operator’s use of the Services.
      2. Except in connection with Provider’s provision of the Services to Operator, Provider shall not utilize, monetize, or otherwise share or disseminate to third parties the Operator Data, the Third-Party Operator Data, or any Operator Customer Data, as further set forth in the DPA.
      3. To the extent Provider processes Operator Customer Data on Operator’s behalf, Provider acts as a “service provider” or “processor” (as such terms are defined under applicable United States state consumer data privacy laws), and such processing is governed by the DPA, which is attached to this Agreement as Exhibit A and incorporated herein. Provider and Operator each represent and warrant that they will comply with applicable consumer data privacy laws with respect to Operator Customer Data. In the event of a conflict between this Section 8 and the DPA with respect to Operator Customer Data, the DPA controls.
      4. Provider may de-identify, anonymize, and aggregate Operator Data and Operator Customer Data such that it does not identify Operator, any Authorized User, or any individual, and may use the resulting De-Identifie
      6. d Data and Aggregated User Data to operate, improve, enhance, and develop the Services and Provider’s products generally, including to train and improve the Models. Provider will not attempt to re-identify any De-Identified Data, and will not sell Personal Information.
      7. The Models may learn from Operator’s portfolio in order to provide the Services to Operator. Notwithstanding anything to the contrary, Provider shall not use Operator Data, Operator Customer Data, or Operator’s identifiable portfolio information to obtain a competitive advantage against Operator, to solicit Operator’s tenants or customers, or to provide insights derived from such data to any competitor of Operator. This restriction does not apply to De-Identified Data or Aggregated User Data used in accordance with this Section 8. As between the Parties, all Models and all improvements thereto are Provider IP.
      8. Operator Data, Operator Customer Data, and Third-Party Operator Data will be returned or deleted upon expiration or termination of this Agreement in accordance with Section 15(c).
   3. Support. The access rights granted hereunder entitle Operator to support services in accordance with Provider’s standard support policy during the Term. Any support services required by Operator that are in addition to or beyond the scope of the standard support policy may be subject to an additional fee, to be agreed upon by the Parties in the Sales Order Form prior to the provision of any such additional or expanded support services.
9. Confidential Information. From time to time during the Term, either Party may disclose or make available to the other Party information about its business affairs, products, confidential intellectual property, trade secrets, third-party confidential information, and other sensitive or proprietary information, whether orally or in written, electronic, or other form or media, whether or not marked, designated, or otherwise identified as “confidential” (collectively, “Confidential Information”). Confidential Information does not include information that, at the time of disclosure is: (a) in the public domain; (b) known to the receiving Party at the time of disclosure; (c) rightfully obtained by the receiving Party on a non-confidential basis from a third party; or (d) independently developed by the receiving Party. The receiving Party shall not disclose the disclosing Party’s Confidential Information to any person or entity, except to the receiving Party’s employees who have a need to know the Confidential Information for the receiving Party to exercise its rights or perform its obligations hereunder. Notwithstanding the foregoing, each Party may disclose Confidential Information to the limited extent required (i) in order to comply with the order of a court or other governmental body, or as otherwise necessary to comply with applicable law, provided that the Party making the disclosure pursuant to the order shall first have given written notice to the other Party and made a reasonable effort to obtain a protective order; or (ii) to establish a Party’s rights under this Agreement, including to make required court filings. On the expiration or termination of the Agreement, the receiving Party shall promptly return to the disclosing Party all copies, whether in written, electronic, or other form or media, of the disclosing Party’s Confidential Information, or destroy all such copies and certify in writing to the disclosing Party that such Confidential Information has been destroyed. Each Party’s obligations of non-disclosure with regard to Confidential Information are effective as of the Effective Date (as defined in the Sales Order Form) and will expire five (5) years from the date first disclosed to the receiving Party; provided, however, with respect to any Confidential Information that constitutes a trade secret (as determined under applicable law), such obligations of non-disclosure will survive the termination or expiration of this Agreement for as long as such Confidential Information remains subject to trade secret protection under applicable law.
10. Intellectual Property Ownership; Feedback.
    1. Operator Data and Third-Party Operator Data. Provider acknowledges that, as between Provider and Operator, Operator owns all right, title, and interest, including all intellectual property rights, in and to the Operator Data, the Operator Customer Data, and the Third-Party Operator Data. Operator hereby grants to Provider a non-exclusive, royalty-free, worldwide license to reproduce, distribute, and otherwise use and display the Operator Data, the Operator Customer Data, and the Third-Party Operator Data and perform all acts with respect to the foregoing as may be necessary for Provider (i) to provide the Services to Operator and (ii) to reproduce, distribute, modify, and otherwise use and display the Aggregated User Data and De-Identified Data.
    2. Provider IP. Operator acknowledges that, as between Operator and Provider, Provider owns all right, title, and interest, including all intellectual property rights, in and to the Provider IP and, with respect to Third-Party Products, the applicable third-party providers own all right, title, and interest, including all intellectual property rights, in and to the Third-Party Products.
    3. Feedback. If Operator or any of its employees or contractors sends or transmits any communications or materials to Provider by mail, email, telephone, or otherwise, suggesting or recommending changes to the Provider IP, including without limitation, suggestions or requests for new features or functionality relating thereto, or any comments, questions or the like (“Feedback”), Provider is free to use, and incorporate within subsequent versions of the Provider IP, such Feedback. Operator hereby assigns to Provider, on Operator’s behalf and on behalf of its Authorized Users, all right, title, and interest in, and Provider is free to use, without any attribution or compensation to any party, any ideas, know-how, concepts, techniques, or other intellectual property rights contained in the Feedback, for any purpose whatsoever, although Provider is not required to use any Feedback.
11. Custom Development; Statements of Work.
    1. Statements of Work. From time to time during the Term, either Party may propose that Provider develop custom modifications, enhancements, new features, or other custom work to the Services for Operator (“Custom Development”). Provider has no obligation to perform any Custom Development unless and until a written Statement of Work, substantially in the form attached as Exhibit B, is agreed to and executed by both Parties. Each Statement of Work shall set forth the scope of work, deliverables, timeline, fees, acceptance criteria, and any other terms applicable to the Custom Development.
    2. Fees for Custom Development. Operator shall pay Provider the fees specified in each Statement of Work, which are separate from and in addition to the Fees set forth in the Sales Order Form.
    3. Ownership and Use of Custom Development. Unless otherwise expressly provided in the applicable Statement of Work: (i) Provider shall retain all right, title, and interest (including all intellectual property rights) in and to all Custom Development, including any code, algorithms, designs, inventions, and other work product created in connection with the Custom Development; and (ii) Provider shall have the right to incorporate Custom Development into the Services and to make such Custom Development available to its other customers and for its general business purposes, including use in future versions or products, unless a Statement of Work expressly restricts such use with respect to specific Custom Development identified therein.
    4. Incorporation. Each Statement of Work, upon execution by both Parties, shall be incorporated into and form a part of this Agreement, and the terms and conditions of this Agreement shall apply to each Statement of Work, except to the extent the Statement of Work expressly provides otherwise.
12. Limited Warranty and Warranty Disclaimer.
    1. Limited Warranty. Provider warrants that the Services: (i) will conform in all material respects to the service levels set forth in the Sales Order Form when accessed and used in accordance with the Documentation; (ii) will be provided to Operator free of viruses, Trojan horses, worms, spyware, or other malicious code or components; and (iii) do not infringe or violate any valid copyright, patent, or non-disclosure agreement to which Provider is a party. The remedies set forth in Section 13 hereof are Operator’s sole remedies and Provider’s sole liability under the limited warranty set forth in this Section 12(a). THE FOREGOING WARRANTY DOES NOT APPLY, AND PROVIDER STRICTLY DISCLAIMS ALL WARRANTIES, WITH RESPECT TO ANY THIRD-PARTY PRODUCTS.
    2. EXCEPT FOR THE LIMITED WARRANTY SET FORTH IN SECTION 12(a), THE SERVICES AND THE PROVIDER IP ARE PROVIDED “AS IS” AND PROVIDER HEREBY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. PROVIDER SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ALL WARRANTIES ARISING FROM COURSE OF DEALING, USAGE, OR TRADE PRACTICE. EXCEPT FOR THE LIMITED WARRANTY SET FORTH IN SECTION 12(a), PROVIDER MAKES NO WARRANTY OF ANY KIND THAT THE SERVICES AND THE PROVIDER IP, OR ANY PRODUCTS OR RESULTS OF THE USE THEREOF, WILL MEET OPERATOR’S OR ANY OTHER PERSON’S REQUIREMENTS, OPERATE WITHOUT INTERRUPTION, ACHIEVE ANY INTENDED RESULT, BE COMPATIBLE OR WORK WITH ANY SOFTWARE, SYSTEM, OR OTHER SERVICES, OR BE SECURE, ACCURATE, COMPLETE, FREE OF HARMFUL CODE, OR ERROR FREE. PROVIDER DOES NOT MAKE ANY REPRESENTATIONS OR GUARANTEES REGARDING UPTIME OR AVAILABILITY OF THE SERVICES.
13. Indemnification.
    1. Provider Indemnification.
       1. Provider shall indemnify, defend, and hold harmless Operator from and against any and all losses, damages, liabilities, costs (including reasonable attorneys’ fees) (“Losses”) incurred by Operator resulting from any third-party claim, suit, action, or proceeding (“Third-Party Claim”) that the Services, or any use of the Services in accordance with this Agreement, infringes or misappropriates such third party’s US intellectual property rights, US patents, copyrights, or trade secrets, provided that Operator promptly notifies Provider in writing of such Third-Party Claim, cooperates with Provider, and allows Provider sole authority to control the defense and settlement of such Third-Party Claim.
       2. If a Third-Party Claim is made or appears possible, Operator agrees to permit Provider, at Provider’s sole discretion, to (A) modify or replace the Services, or component or part thereof, to make it non-infringing, or (B) obtain the right for Operator to continue to use the Services. If Provider determines that neither alternative is reasonably available, Provider may terminate this Agreement, in its entirety or with respect to the affected component or part, effective immediately on written notice to Operator.
       3. This Section 13(a) will not apply to the extent that the alleged infringement arises from: (A) use of the Services in combination with data, software, hardware, equipment, or technology not provided by Provider or authorized by Provider in writing; (B) modifications to the Services not made by Provider; (C) Operator Data; (D) Third-Party Products; or (E) Third-Party Operator Data.
    2. Operator Indemnification. Operator shall indemnify, hold harmless, and, at Provider’s option, defend Provider from and against: (i) Losses resulting from any Third-Party Claim that the Operator Data, or any use of the Operator Data in accordance with this Agreement, infringes or misappropriates such third party’s US intellectual property rights; and (ii) any Losses to Provider resulting from Operator’s or any Authorized User’s (A) negligence or willful misconduct; (B) use of the Services in a manner not authorized by this Agreement; (C) use of the Services in combination with data, software, hardware, equipment, or technology not provided by Provider or authorized by Provider in writing; or (D) modifications to the Services not made by Provider, provided that Operator may not settle any Third-Party Claim against Provider unless Provider consents to such settlement, and further provided that Provider will have the right, at its option, to defend itself against any such Third-Party Claim or to participate in the defense thereof by counsel of its own choice.
    3. Sole Remedy. THIS SECTION 13 SETS FORTH OPERATOR’S SOLE REMEDIES AND PROVIDER’S SOLE LIABILITY AND OBLIGATION FOR ANY ACTUAL, THREATENED, OR ALLEGED CLAIMS THAT THE SERVICES INFRINGE, MISAPPROPRIATE, OR OTHERWISE VIOLATE ANY INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY. IN NO EVENT WILL PROVIDER’S LIABILITY UNDER THIS SECTION 13 EXCEED $5,000.
14. Limitation of Liability. IN NO EVENT WILL PROVIDER BE LIABLE UNDER OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE, FOR ANY: (a) CONSEQUENTIAL, INCIDENTAL, INDIRECT, EXEMPLARY, SPECIAL, ENHANCED, OR PUNITIVE DAMAGES; (b) INCREASED COSTS, DIMINUTION IN VALUE OR LOST BUSINESS, PRODUCTION, REVENUES, OR PROFITS; (c) LOSS OF GOODWILL OR REPUTATION; (d) USE, INABILITY TO USE, LOSS, INTERRUPTION, DELAY, OR RECOVERY OF ANY DATA, OR BREACH OF DATA OR SYSTEM SECURITY; OR (e) COST OF REPLACEMENT GOODS OR SERVICES, IN EACH CASE REGARDLESS OF WHETHER PROVIDER WAS ADVISED OF THE POSSIBILITY OF SUCH LOSSES OR DAMAGES OR SUCH LOSSES OR DAMAGES WERE OTHERWISE FORESEEABLE. IN NO EVENT WILL PROVIDER’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, AND OTHERWISE EXCEED THE TOTAL AMOUNTS PAID TO PROVIDER UNDER THIS AGREEMENT IN THE 12-MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE CLAIM OR $5,000, WHICHEVER IS LESS.
15. Term, Renewal, and Termination.
    1. Term. The initial term of this Agreement shall as set forth on the Sales Order Form (the “Initial Term”), which shall automatically renew for successive twelve (12) month periods (each such 12-month period being a “Renewal Term” and, together with the Initial Term, collectively, the “Term”), unless (i) Operator provides Provider with not less than thirty (30) days’ written notice of its intent not to renew prior to the expiration of the Initial Term or any Renewal Term, as applicable, or (ii) the Agreement is terminated by one of the Parties in accordance with the provisions of Section 15(b). Any free trial of the Services is governed by the separately accepted Free Trial Terms and precedes and is separate from the Initial Term.
    2. Termination. In addition to any other express termination right set forth in this Agreement:
       1. Provider may terminate this Agreement upon thirty (30) days’ written notice to Operator.
       2. Operator may terminate this Agreement, at any time, upon: (A) thirty (30) days’ prior written notice to Provider and (B) payment by Operator of an early termination fee equal to one hundred percent (100%) of the Fees due to Provider for the remainder of the Term.
       3. Provider may terminate this Agreement, effective on written notice to Operator, if Operator: (A) fails to pay any amount when due hereunder, and such failure continues more than fifteen (15) days after Provider’s delivery of written notice thereof; or (B) breaches any of its obligations under Section 3(c) or Section 9.
       4. Either Party may terminate this Agreement, effective on written notice to the other Party, if the other Party breaches this Agreement, and such breach: (A) is incapable of cure; or (B) being capable of cure, remains uncured thirty (30) days after the non-breaching Party provides the breaching Party with written notice of such breach.
       5. Either Party may terminate this Agreement, effective immediately upon written notice to the other Party, if the other Party: (A) becomes insolvent or is generally unable to pay, or fails to pay, its debts as they become due; (B) files or has filed against it, a petition for voluntary or involuntary bankruptcy or otherwise becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency law; (C) makes or seeks to make a general assignment for the benefit of its creditors; or (D) applies for or has appointed a receiver, trustee, custodian, or similar agent appointed by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business.
    3. Effect of Expiration or Termination.
       1. Upon expiration or earlier termination of this Agreement, Operator shall discontinue use of the Provider IP and, without limiting Operator’s obligations under Section 9, Operator shall delete, destroy, or return all copies of the Provider IP and certify in writing to Provider that the Provider IP has been deleted or destroyed. No expiration or termination will affect Operator’s obligation to pay all Fees that may have become due before such expiration or termination or entitle Operator to any refund.
       2. Upon expiration or earlier termination of this Agreement, Provider shall (A) discontinue use of the Operator Data, the Operator Customer Data, and the Third-Party Operator Data and (B) if requested by Operator, at Operator’s sole cost and expense, reasonably cooperate with Operator, and use commercially reasonable efforts, to migrate the Operator Data to a third-party service provider.
    4. Survival. This Section 15(d) and Sections 2, 8, 9, 10, 11(c), 13, 14, and 16 survive any termination or expiration of this Agreement. No other provisions of this Agreement survive the expiration or earlier termination of this Agreement.
16. Miscellaneous.
    1. Entire Agreement. This Agreement, together with the Free Trial Terms or Sales Order Form (as the case may be), the Data Processing Addendum, any executed Statement of Work, any elected Device Attachment, and all other documents incorporated herein by reference, constitutes the sole and entire agreement of the Parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous understandings, agreements, and representations and warranties, both written and oral, with respect to such subject matter. In the event of any inconsistency between the statements made in the body of this Agreement and any other documents or electronic inputs incorporated herein by reference, the terms of this Agreement shall control unless explicitly stated otherwise in such other documents or electronic inputs.
    2. Notices. All notices, requests, consents, claims, demands, waivers, and other communications hereunder (each, a “Notice”) must be in writing and addressed to the Parties at the addresses set forth in the Sales Order Form (or to such other address that may be designated by the Party giving Notice from time to time in accordance with this Section). All Notices must be delivered by personal delivery, nationally recognized overnight courier (with all fees pre-paid), facsimile or email (with confirmation of transmission), or certified or registered mail (in each case, return receipt requested, postage pre-paid). Except as otherwise provided in this Agreement, a Notice is effective only: (i) upon receipt by the receiving Party; and (ii) if the Party giving the Notice has complied with the requirements of this Section 16(b).
    3. Force Majeure. In no event shall Provider be liable to Operator, or be deemed to have breached this Agreement, for any failure or delay in performing its obligations under this Agreement, if and to the extent such failure or delay is caused by any circumstances beyond Provider’s reasonable control, including but not limited to acts of God, flood, fire, earthquake, other potential disaster(s) or catastrophe(s), such as epidemics, pandemics, explosion, war, terrorism, invasion, riot or other civil unrest, strikes, labor stoppages or slowdowns or other industrial disturbances, or passage of law or any action taken by a governmental or public authority, including imposing an embargo.
    4. Amendment and Modification; Waiver. No amendment to or modification of this Agreement is effective unless it is in writing and signed by an authorized representative of each Party. Notwithstanding the foregoing, Provider may, from time to time, upon not less than fourteen (14) days’ written notice, publish revisions to this Agreement which will be binding on all of its customers, including Operator. No waiver by any Party of any of the provisions hereof will be effective unless explicitly set forth in writing and signed by the Party so waiving. Except as otherwise set forth in this Agreement, (i) no failure to exercise, or delay in exercising, any right, remedy, power, or privilege arising from this Agreement will operate or be construed as a waiver thereof, and (ii) no single or partial exercise of any right, remedy, power, or privilege hereunder will preclude any other or further exercise thereof or the exercise of any other right, remedy, power, or privilege.
    5. Severability. If any provision of this Agreement is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability will not affect any other term or provision of this Agreement or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon such determination that any term or other provision is invalid, illegal, or unenforceable, the Parties shall negotiate in good faith to modify this Agreement so as to effect their original intent as closely as possible in a mutually acceptable manner in order that the transactions contemplated hereby be consummated as originally contemplated to the greatest extent possible.
    6. Governing Law; Submission to Jurisdiction. This Agreement is governed by and construed in accordance with the internal laws of the State of Delaware without giving effect to any choice or conflict of law provision or rule that would require or permit the application of the laws of any jurisdiction other than those of the State of Delaware. Any legal suit, action, or proceeding arising out of or related to this Agreement or the licenses granted hereunder will be instituted exclusively in the federal courts of the United States or the courts of the State of Delaware in each case located in the city of Wilmington and County of New Castle, and each Party irrevocably submits to the exclusive jurisdiction of such courts in any such suit, action, or proceeding.
    7. Assignment. Provider may assign all its rights and obligations under this Agreement upon written notice to Operator. Operator may not assign any of its rights or delegate any of its obligations hereunder, in each case whether voluntarily, involuntarily, by operation of law or otherwise, without the prior written consent of Provider, which consent shall not be unreasonably withheld, conditioned, or delayed, except in connection with a transaction involving the sale of all or substantially all of the assets or ownership interests of Operator, in which case any proposed assignment shall take effect upon not less than thirty (30) days’ written notice from Operator to Provider. Any purported assignment or delegation in violation of this Section will be null and void. No assignment or delegation will relieve the assigning or delegating Party of any of its obligations hereunder. This Agreement is binding upon and inures to the benefit of the Parties and their respective permitted successors and assigns.
    8. Export Regulation. Operator shall comply with all applicable federal laws, regulations, and rules, and complete all required undertakings (including obtaining any necessary export license or other governmental approval), that prohibit or restrict the export or re-export of the Services or any Operator Data outside the US.
    9. Equitable Relief. Each Party acknowledges and agrees that a breach or threatened breach by such Party of any of its obligations under Section 9 or, in the case of Operator, Section 3(c), would cause the other Party irreparable harm for which monetary damages would not be an adequate remedy and agrees that, in the event of such breach or threatened breach, the other Party will be entitled to equitable relief, including a restraining order, an injunction, specific performance, and any other relief that may be available from any court, without any requirement to post a bond or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are not exclusive and are in addition to all other remedies that may be available at law, in equity, or otherwise.

---

Exhibit A — SpareBox Data Processing Addendum

Addendum to the SpareBox Master Terms of Service

This Data Processing Addendum (this “DPA”) supplements and is incorporated into the SpareBox Master Terms of Service (the “Master Terms”) between SpareBox Technologies, LLC (“Provider”) and the Operator that has accepted the Master Terms through a Sales Order Form or the Free Trial Terms. This DPA applies to Provider’s Processing of Operator Customer Data on Operator’s behalf in connection with the Services. Capitalized terms used but not defined herein have the meanings given in the Master Terms. In the event of a conflict between this DPA and the Master Terms with respect to the Processing of Operator Customer Data, this DPA controls.

1. Definitions.
   1. “Business” or “Controller” means the entity that determines the purposes and means of the Processing of Personal Information. As between the Parties, Operator is the Business or Controller with respect to Operator Customer Data.
   2. “Consumer” means a natural person who is a resident of a U.S. state and to whom Operator Customer Data relates, including Operator’s customers and tenants.
   3. “Consumer Request” means a request from a Consumer to exercise a right under State Privacy Laws, such as the right to access, delete, correct, or obtain a portable copy of Personal Information, or to opt out of its sale or sharing.
   4. “Operator Customer Data” has the meaning given in the Master Terms and, for purposes of this DPA, constitutes the Personal Information Processed by Provider on Operator’s behalf.
   5. “Process” or “Processing” means any operation performed on Personal Information, whether or not by automated means, including collecting, using, storing, disclosing, or deleting it.
   6. “Security Incident” means a breach of Provider’s security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Operator Customer Data Processed by Provider.
   7. “Sell” and “Share” have the meanings given under applicable State Privacy Laws.
   8. “Service Provider” or “Processor” means the entity that Processes Personal Information on behalf of the Business or Controller. As between the Parties, Provider is the Service Provider or Processor with respect to Operator Customer Data.
   9. “State Privacy Laws” means the U.S. state consumer data privacy laws applicable to the Processing of Operator Customer Data, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, and similar laws of other states as and when they become effective.
   10. “Subprocessor” means a third party engaged by Provider to Process Operator Customer Data in connection with providing the Services.
2. Roles of the Parties; Instructions. With respect to Operator Customer Data, Operator is the Business or Controller and Provider is the Service Provider or Processor. Provider shall Process Operator Customer Data only on Operator’s documented instructions. The Master Terms, the Sales Order Form, this DPA, and Operator’s configuration and use of the Services constitute Operator’s complete and documented instructions to Provider for the Processing of Operator Customer Data. Provider shall notify Operator if, in Provider’s opinion, an instruction infringes applicable law, unless prohibited from doing so by law.
3. Scope and Purpose of Processing. Provider shall Process Operator Customer Data only to provide and support the Services and for the business purposes described in Schedule 1, and for no other purpose. The subject matter, duration, nature and purpose of the Processing, the types of Operator Customer Data, and the categories of Consumers are set out in Schedule 1.
4. Service Provider and Processor Obligations. Provider shall not:
   1. Sell or Share Operator Customer Data;
   2. retain, use, or disclose Operator Customer Data for any purpose other than the business purposes specified in Schedule 1, including retaining, using, or disclosing it outside the direct business relationship between Provider and Operator, except as permitted by State Privacy Laws;
   3. combine Operator Customer Data with Personal Information that Provider receives from, or on behalf of, another person, or collects from its own interaction with a Consumer, except as permitted for a Service Provider under State Privacy Laws; or
   4. Process Operator Customer Data in any manner that would cause a transfer of such data from Operator to Provider to constitute a Sale or Share, the Parties intending that no such transfer constitutes a Sale or Share and that no monetary or other valuable consideration is exchanged for Operator Customer Data.

5. Confidentiality. Provider shall ensure that personnel authorized to Process Operator Customer Data are subject to obligations of confidentiality with respect to such data.
6. Security. Provider shall implement and maintain appropriate technical and organizational measures designed to protect Operator Customer Data against a Security Incident, consistent with Section 8(a) of the Master Terms and the measures described in Schedule 2.
7. Security Incident Notification. Provider shall notify Operator without undue delay after becoming aware of a Security Incident affecting Operator Customer Data, and shall provide Operator with information reasonably available to Provider to assist Operator in meeting its obligations under State Privacy Laws, including any obligation to notify affected Consumers or regulators. Provider shall take reasonable steps to contain and remediate the Security Incident. Provider’s notification of or response to a Security Incident is not an acknowledgment by Provider of any fault or liability.
8. Subprocessors. Operator provides general authorization for Provider to engage Subprocessors to Process Operator Customer Data in connection with the Services. Provider shall: (a) enter into a written agreement with each Subprocessor imposing data-protection obligations no less protective than those in this DPA; (b) remain responsible for each Subprocessor’s performance of its obligations; (c) maintain a list of Subprocessors (the current list of which is set out in or made available pursuant to Schedule 2); and (d) provide Operator with notice of any intended addition or replacement of a Subprocessor, and a reasonable opportunity to object on reasonable data-protection grounds. If Operator reasonably objects and the Parties cannot resolve the objection, Operator’s sole remedy is to terminate the affected Services in accordance with the Master Terms.
9. Assistance with Consumer Requests. Taking into account the nature of the Processing, Provider shall provide reasonable assistance to enable Operator to respond to Consumer Requests, through appropriate technical and organizational measures, insofar as possible. If Provider receives a Consumer Request directly relating to Operator Customer Data, Provider shall not respond to the request other than to acknowledge receipt and direct the Consumer to Operator, unless otherwise required by law or authorized by Operator.
10. Data Protection Assessments. Provider shall make available to Operator information reasonably necessary to enable Operator to conduct and document any data protection assessment required by State Privacy Laws, to the extent the assessment relates to Provider’s Processing of Operator Customer Data.
11. De-Identified and Aggregated Data. Provider may create and use De-Identified Data and Aggregated User Data from Operator Customer Data as permitted by the Master Terms and State Privacy Laws. With respect to De-Identified Data, Provider shall take reasonable measures to ensure the data cannot be associated with a Consumer, publicly commit to maintain and use the data in de-identified form, and not attempt to re-identify it except as permitted by law.
12. Return or Deletion of Operator Customer Data. Upon expiration or termination of the Master Terms, Provider shall delete or return Operator Customer Data in accordance with Section 15(c) of the Master Terms, except to the extent retention is required by applicable law and except for De-Identified Data and Aggregated User Data. Provider shall, upon Operator’s written request, certify deletion.
13. Audits and Information. Provider shall make available to Operator information reasonably necessary to demonstrate Provider’s compliance with this DPA. No more than once per twelve (12) month period (except as required by State Privacy Laws or following a Security Incident), and subject to reasonable advance written notice and confidentiality obligations, Provider shall allow for and contribute to a reasonable assessment of its Processing of Operator Customer Data, which Provider may satisfy by making available a then-current third-party audit report or attestation.
14. Operator Responsibilities. Operator is the Business or Controller with respect to Operator Customer Data and is responsible for the accuracy, quality, and lawfulness of Operator Customer Data and the means by which it was acquired. Operator shall provide all notices to, and obtain all consents and authorizations from, its Consumers required under State Privacy Laws for Provider to Process Operator Customer Data as contemplated by the Master Terms and this DPA, and shall not instruct Provider to Process Operator Customer Data in violation of applicable law.
15. Term; Conflict; Miscellaneous. This DPA is part of, and has the same term as, the Master Terms, and is governed by the governing-law and other miscellaneous provisions of the Master Terms. This DPA applies only to Provider’s Processing of Operator Customer Data; it does not apply to Aggregated User Data, De-Identified Data, Operator Data that is not Operator Customer Data, or other Provider IP. In the event of a conflict between this DPA and the Master Terms with respect to the Processing of Operator Customer Data, this DPA controls; in all other respects, the Master Terms govern. Sections 4, 11, and 12 and this Section 15 survive termination or expiration to the extent necessary to give them effect.

Schedule 1 — Details of Processing

Item	Detail
Nature and purpose of Processing	Providing, maintaining, securing, and supporting the Services for Operator, as described in the Master Terms
Duration of Processing	The term of the Master Terms, plus any period required for return or deletion under Section 12
Categories of Consumers	Operator’s customers and tenants whose information is provided in connection with Operator’s use of the Services
Types of Operator Customer Data	Customer name, contact details, unit and lease/account information, and other information Operators submit through the Services
Business purposes	Account management, communications, and related self-storage management functions
Sensitive Personal Information	Customer first name, last name, and phone number

Schedule 2 — Security Measures and Authorized Subprocessors

Security Measures. Encryption at rest/in transit, access controls (SSO/MFA), network security, vulnerability management, logging & monitoring, backup/DR.

Authorized Subprocessors. The current Subprocessors engaged to Process Operator Customer Data are listed below:

Subprocessor	Processing Activity / Service	Location
Amazon Web Services	Cloud hosting	United States
Sentry	Application performance monitoring	United States
Twilio	SMS service platform	United States