Terms of Service

Last updated: 30 October 2026

These Terms of Service govern the Services provided by Nolt Software Inc., of 6D - 7398 Yonge St Unit # 320, Thornhill, Ontario L4J 8J2, Canada ("Nolt", "we", "us" or "our").

1. Agreement and Scope

These Terms govern access to Nolt's websites, hosted products, embedded features, integrations and related services (the "Services"). "Customer", "you" and "your" mean the individual or organisation purchasing or administering the Services. "Authorised Users" are people you authorise to administer or use your subscription. "End Users" include people who submit feedback, answer surveys, receive communications, use a knowledge base or interact with your other customer-facing features.

You enter into the agreement by accepting these Terms through an acceptance option, checkout or signed order that incorporates them. Anyone accepting for an organisation represents that they have authority to bind it. If you do not agree, do not purchase, register for or use the Services. Applicable use rules also govern people who use interactive features after these Terms have been made available to them; receiving a message or having information included in the Services does not, by itself, make someone a subscribing Customer.

Your accepted checkout details, order form or other written purchase agreement (an "Order") identify your purchased Services, plan, fees and additional commitments. A separately negotiated agreement governs where it expressly replaces these Terms. Otherwise, an Order prevails over conflicting commercial provisions of these Terms.

Our Data Processing Agreement (the "DPA") governs our processing of personal information on your behalf. The applicable regional form, either the EU and United Kingdom version or the USA and Canada version, is identified in your Order, checkout or other acceptance documents and made available for your review and retention before acceptance, by a supplied copy or a link. By accepting these Terms with that DPA expressly incorporated, you also accept the DPA, which binds both parties without a separate request or signature. The binding version is the version supplied or linked for that acceptance, together with amendments validly made under the DPA and Section 23. The regional form does not itself select your hosting environment.

You may request a copy of the applicable regional DPA, a customised DPA or amendments at hello@nolt.io. Any separate DPA or amendment takes effect when signed by authorised representatives of both parties, or on another effective date expressly agreed by them, and replaces or supplements the incorporated DPA only to the extent expressly agreed. Unless and until such an agreement takes effect, the incorporated DPA continues to apply. References in these Terms to the "DPA" include any such signed modifications or replacement.

The applicable DPA prevails over conflicting provisions of these Terms concerning personal information processed on your behalf. Mandatory terms of applicable international-transfer instruments take precedence. All legally required processing terms and transfer safeguards must be effective before the relevant processing begins.

Our Privacy Policy at Nolt Privacy Policy explains our handling of personal information. These Terms do not supply consent on behalf of another person, replace a required privacy notice or limit statutory privacy rights. Our accessibility information is available at Nolt Accessibility Statement.

2. Eligibility and Accounts

The Services are not directed to children under 13. You must be at least 13 to create an account or use interactive features, and the Customer purchasing a subscription must have legal capacity to contract. Where a permitted younger user lacks contractual capacity, an adult or organisation legally able to contract must authorise and take responsibility for that access as required by law. Do not direct the Services to children under 13 or knowingly permit them to submit personal information through your deployment.

Businesses, agencies and individuals may subscribe. If you operate the Services for a client or another organisation, you must have authority to administer its information, configure its features and give the relevant instructions. An agency's appointment does not remove obligations owed to the people whose information is processed.

Provide accurate account and billing information, keep it current and protect your authentication methods, access links, API keys and other credentials. Use only access methods you are authorised to use. Organisational administrators may manage users, permissions, settings and content within their authority.

You are responsible for your Authorised Users' compliance and for selecting appropriate End User permissions. Notify us promptly at hello@nolt.io of suspected unauthorised access. We will reasonably cooperate to secure the account. Your account responsibilities do not excuse a security failure attributable to us.

3. The Services and Access Rights

Nolt provides tools for collecting feedback and managing customer information and communications. Depending on the products, plan and features available to you, the Services may include feedback boards, voting, comments, roadmaps, changelogs, knowledge bases and AI question answering, email campaigns, surveys and Net Promoter Score tools, live chat, and inbox or mail functions where offered. Features may be embedded in your website or product.

Availability, regional options, included usage and supported integrations depend on your plan and the applicable Order. A description of a feature in these Terms sets the conditions for using it when available. It does not promise the release of a planned feature or include every product in every subscription. Purchase based on the functionality and commitments included in your Order.

During the applicable subscription or trial, we grant you a limited, non-exclusive right to access and use the Services and supplied widgets or interfaces for your permitted activities. This includes making enabled customer-facing features available to your End Users. It does not transfer ownership of our software or allow resale of a stand-alone Nolt service unless we agree otherwise.

You provide suitable devices, connectivity, domain permissions and authorised access to connected systems. Follow the technical requirements and API limits made available for the features you use. References to unlimited users or content do not permit attacks, abusive automation or interference with the Services; they do not authorise undisclosed retrospective usage charges either.

4. Publication Communications and Lawful Use

4.1 Boards Knowledge Bases and Visibility

You control the content, audience and available privacy settings of your deployment. Feedback boards are public by default unless you configure an available restriction. Information published publicly may be accessed, indexed, copied or shared by others. Do not publish confidential or personal information without the necessary authority and notices. Public availability does not eliminate anyone's intellectual property or privacy rights.

Private boards, internal fields and restricted knowledge resources must be configured appropriately. Review access permissions, administrator roles, embedded features and connected services before making information available. Changing a setting cannot recall copies already obtained by others or guarantee immediate removal from search engines and external caches. We remain responsible for access controls and confidentiality obligations that apply to us.

You may allow anonymous participation where the feature is available. An anonymous display name or accountless action does not necessarily mean that no technical information is processed. Do not describe a board, survey or conversation as anonymous or confidential unless that description accurately reflects its settings and operation.

4.2 Campaigns and Other Messages

If you use campaigns, notifications, chat or mail features, you must have lawful authority to provide the recipient information and send the communications. Establish and keep evidence of the permissions or other legal grounds required by applicable marketing, anti-spam, privacy and communications laws. A subscription, survey response or previous support conversation is not automatically permission for unrelated marketing.

Identify the sender accurately, use truthful routing information and subject lines, and include required contact details and disclosures. Provide a functioning unsubscribe method where required, honour opt-outs within applicable deadlines and maintain necessary suppression records. Do not send marketing to suppressed recipients, bypass an unsubscribe mechanism or reimport contacts to evade their preferences.

Do not use purchased, scraped or otherwise acquired contact lists without the lawful authority required for their intended use. Do not send phishing, deceptive or unlawful messages, impersonate another sender, or use our infrastructure to circumvent another provider's anti-abuse restrictions. Authenticate domains and accounts where the relevant feature requires it.

We may restrict or suspend affected sending to address suspected unlawful campaigns, excessive abuse complaints or a material threat to delivery infrastructure. We may request information reasonably necessary to verify compliance and will apply these measures proportionately. Your duties do not remove our own legal obligations. Delivery, inbox placement, open rates and recipient responses depend on factors we do not fully control and are not guaranteed.

4.3 Surveys and Customer Conversations

You determine the purposes, questions, recipients and notices for surveys and other information collection. Give respondents accurate information about the organisation collecting their data, its uses, optional or required answers, applicable tracking and available choices. Obtain any additional permissions needed for sensitive information or information about children. Do not use forms or surveys to steal credentials or obtain information deceptively.

Survey and NPS results reflect the responses and methods involved. We do not warrant that they are representative, statistically valid or sufficient for a particular decision. You remain responsible for interpreting the results and any conclusions you communicate.

For live chat and any available connected inbox or mail function, you must be authorised to access the relevant account, receive the communications and permit team access. Give notices and obtain permissions required for storage, sharing and AI processing of conversations. The Services are not an emergency communications service and do not promise that a human will monitor or answer every message.

4.4 General Processing Responsibilities

Before uploading, importing, connecting or collecting information, ensure that you have the necessary rights and a lawful basis for the processing you instruct. Limit unnecessary personal information, respect confidentiality and intellectual property, and honour applicable objections and withdrawals of consent. Agree any additional contractual safeguards needed for specially regulated information before using the Services for it. These responsibilities do not exclude obligations that apply independently to Nolt. The restricted categories in Section 2.6 of the DPA require Nolt's prior written agreement before submission or processing: special categories of personal data, personal data of children below the age at which consent is valid under applicable law, payment-card data subject to PCI-DSS, and protected health information subject to HIPAA. General account eligibility or an individual's consent does not replace that agreement.

5. Customer Content and Permitted Processing

"Customer Content" means information submitted, collected or made available through your use of the Services. Depending on the features used, it includes posts, votes, comments, attachments, knowledge articles, contact lists, campaign material, survey questions and responses, conversations, connected records, prompts and related AI results ("Outputs"). It may include content supplied by End Users and people who do not hold a Nolt account.

As between you and us, you retain your rights in the Customer Content you supply. Other contributors retain their respective rights; operating a board does not automatically transfer their intellectual property to you. You are responsible for obtaining the permissions needed for your intended reuse, publication or implementation of their contributions.

You grant us the limited rights necessary to host, reproduce, organise, transmit and otherwise process Customer Content to provide, secure and support the Services, carry out authorised instructions and meet applicable legal duties. This includes delivery to audiences and connected services you select and processing by providers we engage under appropriate safeguards. It does not authorise unrelated commercial exploitation of private content.

That permission lasts only for those purposes and permitted retention periods. We do not sell Customer Content, provide one customer's private content as another customer's context, or use Customer Content to train or fine-tune Nolt's own AI models. For AI processing we engage, we use commercial API arrangements and endpoints or settings under which provider training on Customer Content is disabled. We do not authorise providers to train or fine-tune their models on it. Model selection within Nolt does not waive this commitment.

The training restriction does not mean that all provider processing has zero retention or no security or abuse review. Applicable provider handling, retention and international-transfer arrangements remain subject to our contractual obligations, the Privacy Policy and any applicable DPA. Independently connected services selected by you, including external AI assistants, are also governed by the arrangements you make with them.

6. AI Outputs and Human Oversight

AI features may generate or summarise content, answer questions using knowledge materials, or help assess submissions for moderation. Where model preferences are available, you select from the options offered and are responsible for choosing a configuration suitable for your use. Model availability and behaviour can vary; different selections may have disclosed usage or pricing consequences.

Where AI moderation is enabled, it scores submissions for risk and applies the board's configured thresholds: rejection prevents submission, holding keeps content unpublished pending a moderator's approval, and flagging leaves it visible for review. With manual moderation enabled, every new post and comment requires approval; AI highlights higher-risk submissions in that queue rather than rejecting them automatically. Board owners, administrators and moderators review queued or flagged submissions. AI checks can misclassify lawful content or miss prohibited content; Section 16 explains how to seek review of a restriction.

AI can produce inaccurate, incomplete, misleading, inappropriate or fabricated results, including incorrect statements about your products or people. A response based on a knowledge base is not guaranteed to reproduce or interpret its sources correctly. Outputs may resemble other users' results, may contain third-party material and may not qualify for intellectual property protection.

To the extent we hold assignable intellectual property rights in Outputs generated for you, we assign those rights to you. This does not transfer ownership of our underlying technology or another person's material, guarantee exclusivity or establish rights that the law does not recognise.

Evaluate the suitability of AI features before enabling them. Keep source material accurate and appropriately restricted, test the configuration and maintain human oversight proportionate to the context. Review drafts before publication where the workflow permits. For features that answer End Users automatically, monitor their use and provide an appropriate route to correction or human assistance; these Terms do not imply that each response receives human approval before delivery.

Do not present an AI-generated response as a guaranteed fact, a human statement or an authorised contractual commitment without appropriate verification. Provide AI interaction notices or labelling where required and do not remove notices or safeguards supplied for that purpose. We remain responsible for transparency requirements that apply to our own role.

The Services do not provide regulated professional advice and must not be relied on as the sole basis for medical, legal, financial, safety-critical or other decisions requiring qualified judgment or legally mandated human involvement. You remain responsible for your decisions, published representations and communications using Outputs. AI risk statements do not exclude our express privacy, confidentiality, security or other obligations, or liability that cannot lawfully be excluded.

7. Integrations and Authorised Actions

You must have authority to connect an external service, import its information or grant permissions to an integration, API client, webhook or MCP-connected assistant. Review the information accessible and the actions permitted before authorising a connection. Protect keys, tokens and export links and remove access when it is no longer authorised.

An authorised connection may disclose Customer Content or perform actions within the permissions you grant, such as creating or updating posts, comments, issues or other connected records. You are responsible for your instructions and for reviewing actions taken on your behalf. A connection does not authorise access beyond the permissions actually granted.

Independently chosen services have their own terms, availability and information practices. Disabling a connection does not necessarily erase previously imported data or copies already delivered to that service. Give appropriate deletion instructions and manage the separate service as needed. This does not remove our responsibility for Nolt-provided integration functions or providers we appoint to perform our obligations.

8. Acceptable Use

Use the Services lawfully and for their intended purposes. Do not infringe copyright, privacy, confidentiality or other rights; engage in fraud, unlawful discrimination or harassment; distribute malware; facilitate exploitation; or publish unlawful threats or other illegal material. Do not manipulate votes, impersonate other people or submit content deceptively.

Do not gain unauthorized access, bypass authentication or technical limits, interfere with another customer's information, disrupt infrastructure or extract protected information through abusive automation. Legitimate use of supported APIs and integrations remains permitted within their documented permissions and limits. Security research must remain within applicable law and any agreed testing scope.

Do not copy, resell or reverse engineer Nolt's software, remove required proprietary notices or misrepresent our branding except as we authorise or applicable law permits. Your plan and any agreed branding options determine permitted changes to displayed attribution. These restrictions do not prevent lawful use of your own Customer Content and Outputs.

Feedback boards must remain relevant to the customer or community they serve. Using a feedback board primarily for legitimate search visibility requires a paid plan; spam, manipulative backlinks and deceptive search-ranking schemes remain prohibited on every plan. Ordinary publication of relevant knowledge articles or other supported content remains subject to these same anti-abuse rules.

Comply with applicable sanctions and export controls.

Boards use automated bot blocking and, where enabled, profanity filtering that masks words or rejects submissions. Board owners, administrators and moderators may remove posts or comments and ban users; a ban can leave a user's contributions visible only to that user. User reports send content for review without automatically hiding it. Customers configure and operate their board rules and available moderation tools, subject to these Terms and applicable law. Nolt may investigate suspected violations or reports and take proportionate action under Section 16. We do not routinely carry out human review of every submission, and automated tools do not detect all prohibited content. Further operational details appear in our content moderation guidance.

9. Privacy Security and Processing Locations

Processing roles depend on the activity. We generally process personal information in Customer Content on the relevant customer's instructions, while determining purposes for our own account administration, business operations, service protection and marketing attribution. The Privacy Policy and applicable DPA explain those roles and relevant information uses, including Nolt's own signup attribution in connection with end-user registrations on customer boards. Customer-directed processing remains subject to the DPA; acceptance of these Terms does not supply an individual's consent to Nolt's marketing processing.

We maintain appropriate technical and organisational safeguards, including encryption in transit and at rest and restricted access. We will notify an affected Customer without undue delay after becoming aware of a personal-data breach affecting personal information processed on its behalf, provide available material information and follow-up updates, and give assistance required by law or the applicable DPA. Any stricter binding notification obligation remains effective. No system can guarantee absolute security.

Global Nolt uses core hosting in the United States. For the EU service, core storage, including its databases, backups and logs, is maintained in the EU. Nolt-appointed AI API requests use EU endpoints for EU Nolt and US endpoints for Global Nolt. Endpoint selection does not determine every provider's storage, retention, onward-processing or remote-access location. Authorised staff may access remotely from other countries, and customer-enabled external services can involve processing outside the selected region. An EU selection therefore does not itself establish that every processing activity is confined to the EU. Specific agreed residency commitments apply within their stated scope.

Required lawful safeguards must cover restricted international transfers, including relevant onward processing and remote access. Accepting these Terms or selecting a region does not replace those safeguards. We will meet the duties that apply to us independently of whether a customer has requested additional negotiated terms.

10. Confidentiality 

Each party must protect the other's non-public information that is identified as confidential or reasonably should be understood to be confidential. Customer Content is protected to that extent, including private conversations, restricted knowledge materials and internal records. Information you lawfully publish to the public is not confidential merely because it is hosted by Nolt.

The receiving party must use reasonable care, use confidential information only to perform or exercise rights under the agreement, and disclose it only to people or providers who need it for those purposes and are bound by appropriate confidentiality duties. The permission to operate public features does not authorize disclosure of private content for promotion.

These restrictions do not apply to information the recipient can demonstrate was lawfully known without restriction, independently developed, lawfully received from another source or made public without breach. Legally required disclosure is permitted to the extent required; where lawful, the receiving party must give reasonable advance notice and cooperate with reasonable protective steps. Privacy and DPA duties apply independently. Confidentiality continues while the information remains confidential, including for retained copies after termination.

11. Fees Usage and Payment

11.1 Plans and Charges

Your accepted checkout or Order specifies the products, included features, billing cycle, currency, fees and applicable taxes. Subscriptions may be monthly or annual and are ordinarily prepaid. If optional AI usage, additional products or other services incur separate charges, the applicable rates and measurement method must be disclosed before you authorise them. Do not assume an unreleased or separately priced product is included in an existing board subscription.

Plan changes between Essential and Pro are prorated according to the applicable billing cycle and checkout information. Features and technical limits follow the plan selected. A change of plan does not itself authorise publication of private content or a change to your privacy settings.

11.2 Billing and Disputes

Paddle is the merchant of record for Nolt orders and handles the payment transaction, billing and applicable purchase processes under the checkout terms presented to you. Approved Enterprise arrangements may provide payment by invoice. Your Order states any different payment schedule or agreed commercial terms. Product support remains available from Nolt at hello@nolt.io.

Authorising a purchase authorises the disclosed charges and recurring arrangement. Keep payment details current and pay properly due fees and taxes, excluding taxes on our income. We provide or require the disclosures, confirmations and consents mandated for the relevant transaction. Tell us or the designated billing contact promptly about suspected errors; this does not shorten statutory dispute periods or require payment of an incorrect charge.

11.3 Fee Changes

We will give advance notice of increases to recurring charges through your account contact or another durable notice. Increases apply prospectively from a renewal after the notice period, subject to any longer period or additional consent required by law or your Order. A newly selected optional product or model is charged only on the terms disclosed before selection. You may cancel before an increase applies.

12. Renewal Cancellation and Refunds

12.1 Renewal and Trials

Subscriptions renew automatically for the selected monthly or annual period unless cancelled under the applicable purchase arrangements. Renewal charges and required notices are governed by the accepted checkout, Order and applicable law.

New feedback boards currently receive a ten-day Pro trial without a credit card. Other trial or promotional conditions, including any conversion to a paid subscription, must be disclosed with the offer. We will not start a paid recurring subscription without the disclosures and authorisation required by law. When a trial ends without a subscription, access to the affected board and content ends as described in Section 14.

12.2 Immediate Cancellation

You may cancel through the subscription controls provided or contact hello@nolt.io for assistance. Unless your Order expressly provides otherwise, cancellation takes effect immediately and ends access to the affected board and content for you and your End Users. Export information you wish to keep before ordinary cancellation. Statutory switching and retrieval rights under Section 15 take precedence where applicable.

Cancellation stops future subscription renewal but does not, by itself, delete Customer Content or waive charges already properly incurred. A board's attached subscription must be cancelled before the board can be deleted. Stopping use alone does not cancel a subscription. Deletion requests and retention are addressed in Section 14.

12.3 Refunds

Except where applicable law, your Order or an express remedy in these Terms requires otherwise, cancellation does not entitle you to a refund for an already-paid billing period, unused time or unused included features. This includes access surrendered by immediate cancellation. Billing errors, mandatory consumer cancellation rights and remedies for our failure to provide the contracted Services remain unaffected.

13. Availability Support and Changes to the Services

We will provide the Services with reasonable care and skill and use reasonable efforts to maintain their availability. Support is available at hello@nolt.io. Applicable Enterprise uptime, priority support and service-credit commitments are governed by the relevant SLA and Order; a general disclaimer does not override those express commitments.

Maintenance, security work, third-party failures and other incidents may interrupt access. We will give reasonable notice of planned material interruptions where practicable and take reasonable steps to address incidents. No additional response time, certification or uptime guarantee is created beyond an express agreement or mandatory law.

We may update features for reasonable product, security, operational or legal reasons. If a change materially reduces the principal functionality of a paid Service, we will give reasonable advance notice where practicable and explain available options. If we cannot remedy the material reduction or discontinue the contracted Service during a prepaid period for reasons not attributable to your material breach, you may end the affected Service and receive a proportionate refund for the unused period. Mandatory remedies remain available.

14. Retention Export and Deletion

14.1 Subscription Content and Loss of Access

Customer Content ordinarily has no preset expiry during an active subscription, subject to deletion instructions, lawful retention requirements and any agreed settings. You can use the available exports, including asynchronous CSV board exports offered across pricing plans. Real-time export functions depend on the applicable plan.

Expiry, cancellation or loss of the relevant subscription makes the affected board and content inaccessible to you and your End Users. Upgrading or resuming an eligible subscription may restore access if the information is still retained. We do not promise permanent archiving or guaranteed recoverability. Ordinary loss of access does not override Section 15 or a binding DPA.

14.2 Retention After Cancellation

Cancellation does not automatically erase information. For personal information processed on your behalf, the applicable DPA requires return or secure deletion, at your choice, within ninety (90) days after termination or expiry, except for backup or archival copies deleted in accordance with the ordinary backup-retention cycle. Shorter mandatory periods, legally required retention and applicable return, switching or retrieval arrangements remain effective. Any retention for possible reactivation is limited by those requirements and a lawful, identified purpose; reactivation or permanent archiving is not guaranteed. We may not retain information indefinitely merely because no further deletion request has been made.

14.3 Requested Deletion

You may request deletion at hello@nolt.io or use available deletion controls. We give effect to valid deletion requests and lawful instructions in accordance with applicable data-protection law, the DPA and agreed processing instructions. The ninety (90) day ordinary end-of-contract period in Section 14.2 does not extend a shorter applicable legal deadline or delay deletion required by law. Lawful preservation to complete an applicable return, switch or retrieval remains subject to its permitted purpose and period.

An individual's request concerns that person's information and does not necessarily authorize deletion of an entire customer board. We will handle requests according to our role, applicable law and the relevant customer's lawful instructions. Reasonable verification may be necessary. We will require our processing providers to implement applicable deletion duties under their agreements and the DPA.

14.4 Remaining Copies and Exceptions

Backup or archival copies awaiting their ordinary backup-retention cycle remain protected and unavailable for ordinary use, and may be used only as necessary for permitted recovery, security or lawful retention. Backup restoration must give effect to outstanding deletion instructions. Lawfully retained billing, security, support and legal records remain protected and limited to the relevant purposes, and are deleted when their permitted retention ends. Copies independently exported, republished or held by customer-selected services are subject to those recipients' obligations; Nolt cannot guarantee deletion of public copies it does not control.

15. Data Export and Switching

15.1 Applicable Switching Rights

Nothing in these Terms restricts mandatory portability, switching or retrieval rights. Where Chapter VI of the EU Data Act applies to the relevant Services and customer relationship, this Section governs switching to another provider or your own infrastructure, and erasure requests under that process. It takes precedence over conflicting ordinary cancellation, access, retention and deletion provisions, regardless of the selected hosting region.

Send your request to hello@nolt.io, identifying the affected Services and your intended destination or erasure instruction. We will cooperate in good faith and provide the information and reasonable assistance required to plan and carry out the switch. We will not require a new paid subscription solely to obtain data or access to which the applicable switching rules entitle you.

15.2 Exportable Data and Assets

For the affected Services, exportable data and digital assets comprise all input and output data, including relevant metadata, directly or indirectly generated or co-generated by your use of those Services, together with transferable digital assets to which you have rights independently of your subscription. The following is the exhaustive category specification. Each category applies to records actually held for the Services you use; it does not promise an unreleased feature or require creation of information never recorded.

• Account and participant records: organisation, contact, profile and user-attribute information, membership records, roles, permissions and participation preferences.
• Feedback and workflow records: boards, posts, comments, votes, subscriptions, internal notes, statuses, custom-field definitions and values, assignments, roadmaps, changelogs and associated history.
• Knowledge and published content: articles, pages, text, customer templates, content organisation, drafts, published versions and associated source material and metadata.
• Campaign and recipient records: contact and distribution lists, message content, customer templates, permission and suppression records, subscription choices, and delivery and interaction records.
• Survey and NPS records: survey questions and configuration, responses, scores, respondent details, and associated participation and result records.
• Chat and inbox records: messages, conversation threads, participants, assignments, labels, shared-inbox organisation and related connected-account references.
• AI records: stored customer inputs, prompts and supplied context, generated responses and summaries, moderation results, and customer-specific instructions and model preferences.
• Configuration and connection records: customer-controlled settings, branding, domain configuration, widgets, integrations, routing and workflow rules, and import or export mappings.
• Files and transferable assets: Customer Content files, including uploads, attachments, images and other media or documents supplied by you or your End Users, together with stored file names, identifiers and links to associated records.
• Service-use metadata: identifiers, timestamps, authorship, record relationships, activity and access events, usage records and other metadata generated through your use, subject only to the exclusions below.

The exhaustive categories of Nolt-internal information excluded where disclosure would risk revealing our trade secrets are: our platform source or object code, internal algorithms, model weights and non-customer-specific designs; internal infrastructure configurations, service credentials, encryption secrets and private network topology; and confidential internal threat-detection rules, security investigation methods and diagnostic material revealing those protected mechanisms. Exclusion applies only to the protected part and only as law permits, including Article 25(2)(f) and Article 30(6) of the EU Data Act.

These exclusions do not remove export rights in Customer Content, Outputs, customer-specific configuration or service-use metadata merely because they are stored alongside internal information. We will provide separable exportable records and must not use an exclusion to obstruct or delay switching. Other customers' information is not part of your export; any disclosure restriction must preserve your lawful access rights.

We will make legally required open interfaces and their documentation available without charge. Existing Nolt technology, third-party rights and security protections remain effective to the extent permitted by law. Another provider may require adaptation and need not reproduce Nolt's functionality. The formats, structures and delivery arrangements appear in Section 15.4.

15.3 Transition Retrieval and Erasure

Any required notice or preparation period will not exceed two months. The ordinary transition period will not exceed 30 calendar days after that period. We will maintain the continuity and assistance required during transition. If switching within 30 calendar days is technically infeasible, we will notify you within 14 working days of the request and explain and justify an alternative transitional period, which will not exceed seven months in total. You may extend the transitional period once for a period you consider appropriate for your purposes.

The affected contract terminates on successful completion of switching, or at the end of the applicable notice period if you request erasure instead, and we will notify you. Necessary retrieval and deletion duties survive that termination. Renewal charges will not continue for Services after their contract has ended; properly accrued charges remain subject to applicable law.

After the transition, you will have at least 30 calendar days to retrieve exportable data. At the end of the agreed retrieval period, we will erase the affected exportable data and digital assets as required, subject to legally required retention. We will confirm completion of the applicable process and deletion where required. A request for erasure without switching follows the applicable statutory process.

We do not charge a separate fee for the standard exports or switching assistance that we are legally required to provide under this Section. Ordinary subscription charges for Services continuing during the process remain payable where lawful. Any optional additional work requires a separate agreement and may not be used to circumvent statutory limits on switching charges.

15.4 Formats Structures and Switching Procedures

This subsection is Nolt's formats and structures register, hosted within these Terms at https://nolt.io/help/terms. Together with the linked Nolt interface schemas below, it identifies the formats and structures used for the categories in Section 15.2. We will update the register and relevant schemas before offering new structures or formats. Updates must preserve agreed export rights and follow Section 23 where it applies.

CSV: tabular board records can be exported as comma-separated text. The ordinary board CSV interface places related comment and vote records in additional rows when those records are selected. For an assisted export, related tabular records may be supplied in separate files connected by identifiers, with column descriptions sufficient to interpret them.

JSON: structured records can be supplied as objects and arrays, preserving nested records, custom attributes and relationships. JSON is the ordinary board-export alternative where related comments or votes need nested representation. The public GraphQL interface exchanges JSON and exposes the documented board, post, comment, vote, changelog, user and status structures.

Files and media: required assisted exports include the stored files in their original retained formats, accompanied by a CSV or JSON manifest linking each file to its associated record. A reference URL alone does not replace delivery of an exportable file unless you request that form of delivery. The applicable file type remains the format supplied or retained for the relevant file.

For all Section 15.2 categories not completely covered by an ordinary export or API, we will provide the required supplementary records through an assisted CSV and/or JSON export, with files delivered as described above. We will use JSON or linked tables where flattening would lose relationships, and provide a data dictionary identifying field meanings, identifiers, relationships and relevant time formats. These are assisted switching commitments, not a statement that every feature has a self-service export button.

For assisted exports, the category-level structures are linked profile, membership and permission records for accounts; content records with authorship, workflow and parent/child links for feedback and knowledge material; message, recipient, permission and delivery records for campaigns; question, respondent and response records for surveys; threads with ordered messages for chat and inboxes; linked input, context, result and moderation records for AI; named properties and rule objects for settings and integrations; manifest records linking files to content; and timestamped records linked to the affected account, user or content for service events. We will preserve every exportable field actually retained for each record, subject to Section 15.2, and provide any identifier mapping needed to preserve relationships.

The current board CSV/JSON formats and selection options are documented at https://nolt.io/help/export-apis. The public interface structures, authentication, pagination and limits are documented at https://nolt.io/docs/publicapi/. The format families are CSV and JSON, with the published GraphQL schema for that interface; we will apply any additional interoperability specifications or standards required by applicable law.

Ordinary asynchronous CSV board exports are available on all plans. Real-time export APIs ordinarily require Pro or above. Ordinary exports may omit comments or votes unless included in the request and may not include underlying file copies or every category above. Authentication, appropriate permissions, pagination and published interface limits apply. Plan restrictions, ordinary defaults or API limits must not prevent the complete exports and interfaces legally required under this Section.

Send a switching request to hello@nolt.io with the affected Services and destination or erasure instruction. We will verify authority proportionately, identify relevant formats, restrictions and known continuity risks, and agree secure delivery within Section 15.3's periods. Destination compatibility and reconfiguration of credentials or integrations may require work by you or the destination provider. We will not require disclosure of credentials to an unauthorized recipient or recreate data already lawfully erased.

15.5 Core Hosting and Governmental Access

This subsection describes our core hosting arrangements and general safeguards concerning governmental access to data. It forms part of these Terms and is available at https://nolt.io/help/terms.

• Global Nolt core infrastructure: United States.
• EU Nolt core infrastructure: European Union.

EU core databases, backups and logs remain in the EU, and Global core hosting is in the United States. Nolt Software Inc. is incorporated in Canada. A provider's corporate or contractual jurisdiction may differ from the storage country. The relevant appointed providers, entities and processing arrangements are governed by the DPA; an EU hosting choice does not establish that every external processing or authorised remote-access activity remains in the EU.

Our technical safeguards include encryption in transit and at rest and restricted infrastructure and administrative access. Contractual safeguards include confidentiality, purpose and disclosure restrictions binding authorised personnel and appointed processing providers. We require the agreed hosting and onward-processing protections to remain effective and assess legally binding requests before disclosure.

For a non-EU governmental request involving non-personal data held in the EU, we will assess the applicable jurisdiction, any recognised international agreement and the conditions in Article 32 of the EU Data Act before granting access or transferring data. We will take legally required protective steps, including challenging incompatible demands where required, limiting any lawful disclosure to what is necessary, and notifying the affected customer where legally permitted. No request or contract term authorises a disclosure that the applicable law prohibits.

16. Suspension and Termination

We may suspend affected functions or access where reasonably necessary to address a material breach, unlawful content or communications, a serious security threat, binding legal requirements or properly due fees that remain unpaid for at least seven days after their due date. A different signed payment arrangement or mandatory notice requirement prevails. We may contact you to resolve a payment failure; a genuine dispute will be considered in good faith.

Where practicable and legally permitted, we will provide a reasonable opportunity to remedy the issue. Immediate action may be necessary to prevent harm or comply with law. Measures must be proportionate and applied objectively, with due regard to affected rights; we will restore access when the relevant grounds are resolved. We may remove or restrict illegal content and material that reasonably violates applicable use rules, without undertaking to monitor every submission. Where the law requires a statement of reasons, we will provide it to the affected recipient no later than when the restriction takes effect, identifying the grounds, scope and, where applicable, duration, relevant use of automated tools and available redress.

Either party may terminate for an uncured material breach after written notice and a reasonable opportunity to remedy it. We may terminate immediately where the breach cannot reasonably be remedied or continued performance would be unlawful. We may end a Service or decline renewal for legitimate operational reasons with reasonable notice where practicable. If we end a prepaid Service for reasons not attributable to your material breach, we will refund the unused prepaid period proportionately, subject to any additional mandatory remedy.

To report content you believe is illegal or violates these Terms, including copyright, privacy or other abuse, email hello@nolt.io with its exact location (such as a URL), an explanation and relevant supporting information. Include any contact details and good-faith declaration required by applicable law. We may request details needed to assess the report and will acknowledge it and communicate our decision as required by law.

To challenge a restriction imposed by Nolt, email the same address with the decision reference, if available, and why it should be reconsidered. Appropriate personnel will review the relevant circumstances, consider any additional information and communicate the outcome; review decisions will not be based solely on automated means. For a restriction imposed by a customer's board team, contact that team; this does not prevent a direct report of illegal content to Nolt or limit any statutory complaint or redress right.

We may reclaim inactive board addresses after reasonable notice to the account contact where practicable, subject to active subscription rights, required retrieval periods and appropriate protection against exposing a former customer's information. A board address does not confer permanent ownership of a Nolt subdomain.

When the agreement ends, access rights end except for agreed or legally required transition and retrieval. Accrued charges, confidentiality, ownership, permitted retention, applicable indemnities, liability limits and dispute provisions continue as their nature requires. Termination is distinct from completed deletion.

17. Our Intellectual Property and Feedback 

Nolt and its licensors retain rights in the Services, software, documentation, branding and underlying technology. Nothing here transfers ownership of Customer Content to Nolt or expands a contributor's rights beyond those they lawfully hold.

If you voluntarily give suggestions about Nolt's own products, you permit us to use those suggestions without payment or an obligation to implement them. This does not authorise disclosure of confidential information or reuse of customer-board contributions for unrelated purposes.

Neither party may use the other's name, logo or trademarks for publicity without permission, except as otherwise lawfully permitted. Agreed branding displayed within an enabled product remains governed by your plan and the rights granted for operating that product.

18. Warranties and Limitations of the Services

Each party represents that it has authority to enter into and perform the agreement. You must have the rights required for the content, communications and instructions you supply. Our express commitments and obligation to provide reasonable care and skill remain effective.

Subject to those commitments and mandatory law, we do not warrant uninterrupted or error-free availability, perfect moderation, accurate or unique AI Outputs, successful message delivery, representative survey results or any particular business outcome. Assess suitability for your intended use and maintain appropriate independent records.

To the extent lawfully permitted, implied warranties are excluded only where they are not expressly provided and may validly be excluded. These provisions do not exclude mandatory service-quality requirements, consumer guarantees or other nonwaivable rights. They do not relieve us of responsibility for providers we engage where law or the DPA makes us responsible.

19. Business Customer Indemnity

19.1 Covered Third Party Claims

For Customers contracting for business purposes, and only to the extent permitted by law, you will defend and indemnify Nolt against third-party claims caused by infringement through content you supply, unlawful communications or information collection you instruct, or materially unlawful use of the Services by you or your Authorised Users. This includes reasonable defence costs, final court awards and settlements you approve.

The obligation does not cover loss to the extent caused by our breach, negligence or wrongful conduct, or a claim based solely on Nolt's underlying technology or independently generated Output rather than your supplied material or unlawful use. An End User does not incur a business-customer indemnity merely by receiving a message or responding to a survey.

19.2 Claims Procedure

We must give prompt notice; a delay reduces your obligation only to the extent it materially prejudices the defence. You may control the defence with reasonably suitable counsel, with our reasonable cooperation at your expense. Neither party may agree a settlement imposing liability, an admission or a nonmonetary obligation on the other without that party's reasonable consent. Covered liability counts within the applicable aggregate limit in Section 20, unless a separately agreed contract expressly provides otherwise. Any indemnity separately set out in the applicable DPA is governed by that DPA and the order of precedence in Section 1. This Section does not replace or narrow that indemnity.

20. Limitation of Liability

20.1 Mandatory Exceptions

Nothing excludes or limits liability that applicable law prohibits excluding or limiting, including applicable liability for fraud, fraudulent misrepresentation or death or personal injury caused by negligence. Mandatory consumer rights, individuals' privacy rights and regulators' powers remain effective. Mandatory provisions of applicable transfer instruments also prevail.

20.2 Excluded Losses

Subject to Section 20.1, for business Customers, neither party is liable to the other for indirect, consequential, special or punitive loss arising from the agreement. This does not remove amounts properly payable to third parties under an applicable indemnity, which remain subject to its terms and any lawful aggregate cap.

20.3 Aggregate Cap

Subject to Section 20.1, each party's combined liability for claims arising from the affected Services is limited to the subscription fees actually paid by the Customer for those Services under the applicable subscription. Related claims and different legal theories do not multiply the limit. The limit includes indemnities and DPA claims between the parties unless a separately agreed DPA or Order expressly sets a different applicable limit.

Any limit affecting a Customer entitled to consumer or other mandatory statutory protections applies only to the extent those protections permit. No limit reduces fees properly due, refunds expressly required by the agreement or a nonwaivable remedy. This allocation does not restrict an individual's statutory claim against a party where the law does not permit that restriction.

21. Mandatory Local Rights        

Each party must comply with laws applicable to its own activities. Nothing excludes or limits any right, guarantee, remedy or liability that cannot lawfully be excluded or limited, including applicable consumer, digital-service, data-protection and switching rights.

Where a consumer purchase is subject to mandatory disclosure, cooling-off, cancellation or refund rights, those rights prevail over conflicting contract terms, including immediate cancellation and ordinary nonrefundability. Providing access does not itself establish that every statutory withdrawal right has been waived. We provide or obtain any legally required notices, agreements and confirmations through the relevant purchase process.

22. Governing Law and Disputes  

Unless a separately agreed customer contract provides otherwise, Ontario law and applicable Canadian federal law govern the agreement. This choice does not deprive you of mandatory protections that otherwise apply.

Subject to mandatory rights to bring proceedings elsewhere, the courts of Ontario, Canada have exclusive jurisdiction over contractual disputes. Mandatory law and forum provisions of applicable data-transfer instruments prevail for matters they govern.

You may contact hello@nolt.io to seek an informal resolution. This does not delay legal rights, urgent relief or a regulatory complaint. These Terms do not impose compulsory arbitration or waive rights to participate in proceedings that applicable law protects.

23. Changes to These Terms    

We may update these Terms for reasonable legal, security, operational or product reasons. We will identify the revised version and give reasonable advance notice of material changes, normally by email or another durable account notice. Material changes ordinarily apply at the next renewal following that notice, unless an earlier change is necessary to comply with law or address an urgent security issue.

We will explain an earlier change and give as much notice as practicable. If you do not agree, you may cancel before a material change applies. If an earlier change materially disadvantages you during a prepaid period, you may end the affected Services and receive a proportionate refund for the unused period. Required consent or statutory notice periods remain applicable.

Updates do not retrospectively change accrued claims or agreed charges. Changes to the DPA must follow its amendment provisions and this Section, with any conflicting DPA-specific amendment provisions taking precedence. Publishing a replacement on our website does not, by itself, amend the version binding the parties. Changes must preserve mandatory data-protection requirements and comply with applicable transfer instruments. A separately negotiated agreement may be amended only under its own amendment procedure. A revised Privacy Policy does not, by itself, supply consent for processing that legally requires it.

24. General Terms   

We may send contractual and service notices to your registered contact details. Keep them current. Notices requiring a particular form or method will be provided as law requires. Send notices to Nolt through Section 25.

You may assign the agreement with our consent, not to be unreasonably withheld, and may make authorised account or board transfers through the relevant process. We may assign it in a merger, reorganization or transfer of the relevant business if the successor assumes our obligations and the assignment does not remove mandatory rights. We will notify you of an assignment affecting your account where required or reasonably appropriate.

Neither party is liable for delay caused by circumstances genuinely beyond its reasonable control to the extent the effects could not reasonably be prevented or mitigated. The affected party must take reasonable steps to limit disruption. This does not excuse accrued charges, required data safeguards or mandatory remedies. A prolonged material inability to provide paid Services remains subject to Section 13 and applicable law.

If a term is unenforceable, it will be limited or severed only as law permits; the remainder continues where legally possible. Failure to enforce a term immediately is not a waiver. The parties are independent contractors, and neither may bind the other as agent or partner.

The agreement consists of these Terms, applicable Orders, the DPA incorporated under Section 1 and expressly incorporated additional terms. It replaces previous agreements on the same subject without excluding fraud or mandatory rights concerning pre-contract representations. No third-party rights are created except as required by law or expressly provided in an applicable agreement; individuals' statutory rights remain unaffected.

25. Contact

Contracting entity: Nolt Software Inc.

Address: 6D - 7398 Yonge St Unit # 320, Thornhill, Ontario L4J 8J2, Canada

General legal billing and support enquiries: hello@nolt.io

Privacy officer: Jason Kim, Nolt Software Inc., at hello@nolt.io

Security reports: security@nolt.io

Privacy Policy: https://nolt.io/help/privacy

Accessibility Statement: https://nolt.io/help/accessibility-statement

Data Processing Agreement: the applicable regional version identified and supplied or linked under Section 1; copies and custom terms: hello@nolt.io.