Terms of Service

Last updated November 3, 2026

These Terms of Service (the “Agreement”) govern access to and use of the Mona platform and related services (the “Service”) provided by Mona Legal Technologies, Inc., a Delaware corporation (“Mona”, “we”, or “us”), to the law firm or attorney that creates an account (“Customer” or “you”). By creating an account or using the Service, Customer agrees to this Agreement, including the Data Processing Agreement attached as Exhibit A (the “DPA”), which is incorporated into this Agreement by reference. In the event of any conflict between the body of this Agreement and the DPA with respect to the processing or protection of Customer Data, the DPA controls.

1. Definitions

“Customer Data” means all documents, files, information, and other content submitted to the Service by or on behalf of Customer, together with all analyses, reports, extractions, findings, and other outputs generated by the Service from such submissions. Customer Data includes Counterparty Data.

“Counterparty Data” means Customer Data containing information about persons other than Customer or Customer’s client, including opposing parties in litigation, obtained by Customer through voluntary disclosure, compulsory financial disclosure, discovery, subpoena, or other lawful process.

“Matter” means a discrete case, engagement, or file created by Customer within the Service to which Customer Data is associated.

“Subprocessor” means any third party engaged by Mona to process Customer Data in connection with providing the Service, as further described in the DPA.

2. The Service; Accounts; Attorney Attestation

2.1 The Service. Mona provides an AI-assisted forensic financial analysis platform for legal professionals. The Service reads and analyzes financial documents submitted by Customer, extracts and cross-references financial data, and generates analyses and findings for Customer’s review. The Service is a litigation support and document analysis tool that operates under Customer’s direction and supervision.

2.2 Attorney Attestation. By creating an account, Customer, and each individual who accepts this Agreement on Customer’s behalf, represents and warrants that:

  • (a) Customer is an attorney in good standing admitted to practice in at least one U.S. jurisdiction, or a law firm comprising such attorneys, and each individual user of the account is such an attorney or an employee or agent acting under the supervision of such an attorney;
  • (b) Customer will use the Service solely in connection with the legal representation of clients or Customer’s own internal legal work;
  • (c) all documents and information Customer submits to the Service have been obtained lawfully in the course of such representation, including through voluntary client disclosure, compulsory financial disclosure, discovery, subpoena, or other lawful process; and
  • (d) Customer’s use of the Service complies with the rules of professional conduct of each jurisdiction in which Customer practices, including Customer’s obligations regarding client confidentiality and the supervision of nonlawyer assistance.

2.3 Accounts. Customer is responsible for maintaining the confidentiality of its account credentials and for all activity under its account. Customer will promptly notify Mona of any unauthorized use of its account.

3. Customer Data; Ownership; License

3.1 Ownership. As between the parties, Customer retains all right, title, and interest in and to Customer Data. Mona acquires no rights in Customer Data other than the limited license in Section 3.2. To the extent Mona obtains any right, title, or interest in outputs generated by the Service, Mona hereby assigns such right, title, and interest to Customer.

3.2 License to Provide the Service. Customer grants Mona a limited, non-exclusive, non-transferable license to host, process, transmit, and display Customer Data solely as necessary to (a) provide the Service to Customer; (b) maintain, support, and secure the Service, including diagnosing and remediating defects as described in Section 4.3; and (c) comply with applicable law. This license terminates upon deletion of the applicable Customer Data.

3.3 Analysis Is the Service. For the avoidance of doubt, the processing of Customer Data — including Counterparty Data — through Mona’s analytical systems, including artificial intelligence models operated by Mona’s Subprocessors, in order to generate analyses, extractions, and findings for Customer, is the core function of the Service and is expressly permitted under this Agreement. Such processing does not constitute training as prohibited by Section 5.

4. Third-Party and Counterparty Data

4.1 Acknowledgment. Customer may submit documents containing information about persons other than Customer’s client, including opposing parties, obtained through lawful disclosure or discovery. Mona processes Counterparty Data under the heightened restrictions of this Section 4, which apply regardless of whether the Counterparty Data would qualify as personal information under any privacy statute.

4.2 Restrictions. Mona will process Counterparty Data subject to the following restrictions:

  • (a) Counterparty Data is processed solely to provide the Service to Customer for the Matter in which it was submitted, including the analysis described in Section 3.3;
  • (b) Counterparty Data is never used to train, fine-tune, or improve any artificial intelligence or machine learning model, in accordance with Section 5;
  • (c) Counterparty Data is never aggregated, cross-referenced, or matched against data from any other Matter or any other customer’s account;
  • (d) Counterparty Data is deleted in accordance with Section 9 and the DPA, including upon deletion of the associated Matter; and
  • (e) Mona will not use Counterparty Data for analytics, product development, marketing, or any purpose other than delivering the Service to Customer, except as expressly permitted by Section 4.3.

4.3 Service Maintenance Exception. Notwithstanding Sections 4.2(e) and 3.2, Mona may access and use Customer Data, including Counterparty Data, solely as necessary to diagnose, reproduce, and remediate a defect, error, or security incident in the Service, or to respond to a support request initiated by Customer. Any such access will be (a) limited to personnel who need it for that purpose and who are bound by confidentiality obligations at least as protective as those in this Agreement; (b) limited in scope and duration to what the diagnosis or remediation requires; (c) logged; and (d) where reasonably practicable, performed on de-identified data. Data accessed under this Section 4.3 remains Customer Data subject to all restrictions of this Agreement, including Section 5.

5. No-Training Covenant

5.1 Covenant. Mona will not use Customer Data, including Counterparty Data, to train, fine-tune, or otherwise improve any machine learning or artificial intelligence model, whether operated by Mona or by any Subprocessor.

5.2 Subprocessor Flow-Down. Mona’s agreements with its artificial intelligence model Subprocessors prohibit those Subprocessors from using Customer Data to train their models, and Mona will not engage any artificial intelligence Subprocessor whose terms do not include such a prohibition. As of the date of this Agreement, Mona’s artificial intelligence model Subprocessor is Anthropic, PBC, whose Commercial Terms of Service provide that it may not train models on customer content submitted through its commercial services (verified against Anthropic’s published Commercial Terms of Service as of July 26, 2026).

5.3 Survival. This Section 5 survives termination of this Agreement and applies to Customer Data for so long as it is in Mona’s or any Subprocessor’s possession or control.

6. Confidentiality

6.1 Customer Data Is Confidential. All Customer Data is Customer’s Confidential Information. Mona will (a) hold Customer Data in strict confidence; (b) not disclose Customer Data to any third party other than Subprocessors bound by written obligations at least as protective as this Agreement; (c) use Customer Data solely as permitted by Sections 3, 4, and 5; and (d) protect Customer Data using at least the safeguards described in the DPA. Mona acknowledges that Customer Data may include information protected by the attorney-client privilege, the work-product doctrine, and Customer’s duty of confidentiality under applicable rules of professional conduct, and that the parties intend that submission of Customer Data to the Service preserve, and not waive, all such protections.

6.2 Compelled Disclosure. If Mona is compelled by law, regulation, or legal process to disclose Customer Data, Mona will, unless legally prohibited, promptly notify Customer before disclosure so that Customer may seek a protective order or other remedy, and will disclose only the portion of Customer Data legally required and will use reasonable efforts to ensure it is treated confidentially.

6.3 Mutual Confidentiality. Each party will protect the other party’s non-public business, technical, and financial information disclosed in connection with this Agreement with the same care it uses for its own similar information, and no less than reasonable care, and will use such information only in connection with this Agreement.

7. Professional Responsibility; Attorney Review; No Legal Advice

7.1 Attorney in the Loop. The Service is a nonlawyer assistant within the meaning of ABA Model Rule 5.3 and its state analogues. All analyses, findings, flags, and outputs of the Service are drafts prepared for Customer’s review and require independent verification by Customer before any use in a proceeding, filing, negotiation, or client communication. The Service does not file, send, or transmit anything to any court, party, or third person except through Customer’s action.

7.2 No Legal Advice. Mona is not a law firm and does not provide legal advice. The Service provides document analysis and litigation support at Customer’s direction. Customer remains solely responsible for all professional judgments, all work product, and all obligations to Customer’s clients and to tribunals.

7.3 Output Accuracy. Customer acknowledges that outputs generated by artificial intelligence systems may contain errors or omissions and must not be relied upon without independent verification against the underlying source documents, which the Service identifies for each finding where available.

8. Fees and Payment

8.1 Fees. Fees, billing, and payment terms are stated in Customer’s order form, which is incorporated into this Agreement by reference.

9. Term; Termination; Data Deletion

9.1 Term. This Agreement begins when Customer creates an account and continues until terminated as provided herein.

9.2 Termination. Customer may terminate this Agreement at any time by closing its account. Either party may terminate for material breach uncured within thirty (30) days of written notice. Mona may suspend the Service immediately for a violation of Section 2.2 or a threat to the security or integrity of the Service, with notice to Customer.

9.3 Deletion on Demand. Customer may delete any Matter at any time through the Service, and may have its entire account deleted on written request to Mona. Deletion of a Matter deletes all Customer Data associated with that Matter, including Counterparty Data. Deleted Customer Data is removed from the Service’s active systems promptly and from backup systems in the ordinary rotation of such backups, not to exceed 30 days.

9.4 Retention Default; Account Closure. Customer Data associated with an active account persists until Customer deletes it. Upon closure of Customer’s account for any reason, Mona will delete all Customer Data within thirty (30) days, subject to Section 9.3’s backup-rotation period. Customer is responsible for exporting any Customer Data it wishes to retain before deletion, consistent with Customer’s own file-retention obligations under applicable rules of professional conduct; the Service lets Customer download the documents it has submitted for this purpose.

9.5 Survival. Sections 3.1, 4, 5, 6, 7, 9.3–9.5, 10, 11, 12, and 13, and the DPA’s deletion and confidentiality provisions, survive termination.

10. Warranties; Disclaimers

10.1 Mutual Warranties. Each party represents and warrants that it has the legal power and authority to enter into this Agreement.

10.2 Mona Warranties. Mona warrants that (a) it will provide the Service in material conformity with its documentation; (b) it will comply with Sections 4, 5, and 6 and the DPA; and (c) it will provide the Service in compliance with applicable law.

10.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE SERVICE IS PROVIDED “AS IS” AND MONA DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. MONA DOES NOT WARRANT THAT OUTPUTS WILL BE ERROR-FREE OR COMPLETE. THIS DISCLAIMER DOES NOT LIMIT THE WARRANTIES IN SECTION 10.2 OR MONA’S OBLIGATIONS UNDER SECTIONS 4, 5, AND 6 AND THE DPA.

11. Limitation of Liability

11.1 Cap. EXCEPT AS PROVIDED IN SECTION 11.3, EACH PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO MONA IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY.

11.2 Exclusion of Consequential Damages. EXCEPT AS PROVIDED IN SECTION 11.3, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS OR REVENUES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

11.3 Carve-Outs. The limitations in Sections 11.1 and 11.2 do not apply to (a) Mona’s breach of Section 5 (No-Training Covenant); (b) either party’s breach of Section 6 (Confidentiality) or Mona’s breach of the DPA; (c) either party’s indemnification obligations under Section 12; (d) Customer’s payment obligations; or (e) either party’s gross negligence, willful misconduct, or fraud.

12. Indemnification

12.1 By Mona. Mona will defend and indemnify Customer against third-party claims alleging that the Service, as provided by Mona and used as permitted by this Agreement, infringes a third party’s intellectual property rights, and will pay resulting damages finally awarded or agreed in settlement.

12.2 By Customer. Customer will defend and indemnify Mona against third-party claims arising from (a) a breach of Customer’s representations in Section 2.2, including the submission of documents not lawfully obtained; or (b) Customer’s use of Service outputs in violation of Section 7.

12.3 Procedure. The indemnified party will give prompt notice of the claim, tender sole control of the defense and settlement to the indemnifying party (provided any settlement releasing the indemnified party requires no admission or payment by it), and provide reasonable cooperation.

13. Governing Law; Forum

13.1 Governing Law. This Agreement is governed by the laws of the State of New York, without regard to its conflict of laws principles.

13.2 Forum. The state and federal courts sitting in Nassau County, New York (including, for federal actions, the United States District Court for the Eastern District of New York) have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and each party consents to personal jurisdiction and venue there and waives any objection of inconvenient forum.

14. General Provisions

14.1 Amendments. Mona may update this Agreement prospectively by posting a revised version and notifying Customer at least thirty (30) days before it takes effect; provided that no amendment may weaken Sections 4, 5, or 6 or the DPA with respect to Customer Data already submitted without Customer’s express consent. Customer’s continued use after the effective date constitutes acceptance.

14.2 Assignment. Neither party may assign this Agreement without the other’s consent, except to a successor in a merger, acquisition, or sale of substantially all assets, provided the successor assumes all obligations under this Agreement, including Sections 4, 5, and 6 and the DPA.

14.3 Notices. Notices must be in writing and are effective when sent to the email address associated with Customer’s account (for Customer) or to gordonliu1106@gmail.com (for Mona).

14.4 Miscellaneous. This Agreement, including the DPA, is the entire agreement between the parties regarding its subject matter and supersedes all prior discussions. If any provision is unenforceable, it will be modified to the minimum extent necessary and the remainder will continue in effect. Failure to enforce a provision is not a waiver. The parties are independent contractors. There are no third-party beneficiaries, except that Customer’s clients’ confidentiality protections under Section 6 are intended for their benefit but enforceable only by Customer.

Exhibit A

Data Processing Agreement

Last updated November 3, 2026

This Data Processing Agreement (“DPA”) forms part of the Mona Terms of Service between Mona and Customer (the “Agreement”) and governs Mona’s processing of Customer Data. Capitalized terms not defined here have the meanings in the Agreement. In the event of conflict between this DPA and the body of the Agreement with respect to the processing or protection of Customer Data, this DPA controls.

A-1. Scope and Roles

A-1.1 Roles. Customer determines the purposes and means of processing Customer Data in connection with its legal representations; Mona processes Customer Data solely on Customer’s behalf and documented instructions, which consist of the Agreement, this DPA, and Customer’s use of the Service’s features. Where data protection law applies, Customer is the controller (or a processor acting for its clients) and Mona is a processor (or subprocessor).

A-1.2 Nature and Purpose of Processing. Mona processes Customer Data to provide AI-assisted forensic financial analysis of documents submitted by Customer in connection with legal matters, including extraction, cross-referencing, reconciliation, and reporting, together with hosting, support, and security incident response. The duration of processing is the term of the Agreement plus the deletion periods in Section A-6. The categories of data subjects may include Customer’s clients, opposing parties, and third parties appearing in financial records; the categories of data may include financial account information, income and asset information, and identifying details appearing in legal and financial documents.

A-2. Processing Restrictions

A-2.1 Instructions Only. Mona will process Customer Data only as necessary to provide the Service and as otherwise instructed by Customer through the Service, and not for any other purpose. Mona will not sell Customer Data, use it for advertising, or disclose it except as permitted by the Agreement.

A-2.2 No Training. Mona will not use Customer Data to train, fine-tune, or improve any machine learning or artificial intelligence model, and will contractually require the same of every Subprocessor that operates such models, as set forth in Section 5 of the Agreement, which is incorporated into this DPA.

A-2.3 Counterparty Data. Mona will process Counterparty Data subject to the heightened restrictions in Section 4 of the Agreement, which is incorporated into this DPA.

A-2.4 Personnel. Mona will limit access to Customer Data to personnel who need it to provide the Service and who are bound by written confidentiality obligations.

A-3. Security

A-3.1 Safeguards. Mona will implement and maintain appropriate technical and organizational measures to protect Customer Data against unauthorized access, disclosure, alteration, and destruction, including at minimum: (a) encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent); (b) role-based access controls and unique authenticated accounts for personnel; (c) logging of access to production systems containing Customer Data; (d) logical separation of each customer’s data; (e) secure development and deployment practices; and (f) periodic review of these measures.

A-4. Subprocessors

A-4.1 Authorized Subprocessors. Customer authorizes Mona to engage the Subprocessors listed in Mona’s Privacy Policy, which as of the date of this DPA consists of: (a) Anthropic, PBC (AI model inference and web search; no-training flow-down verified July 26, 2026); (b) Vercel Inc. (application hosting); (c) Supabase, Inc. (database, file storage, and sign-in); and (d) AssemblyAI, Inc. (interview transcription). Mona will impose on each Subprocessor written data protection obligations at least as protective as this DPA and remains responsible for each Subprocessor’s performance.

A-4.2 Changes; Notice and Objection. Mona will notify Customer at least thirty (30) days before adding or replacing a Subprocessor. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the Agreement and receive a pro rata refund of prepaid fees, and Mona will delete Customer Data per Section A-6.

A-5. Breach Notification

A-5.1 Notification. Mona will notify Customer without undue delay, and in any event within seventy-two (72) hours of confirming a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data. The notice will describe, to the extent then known, the nature of the incident, the Customer Data affected, the measures taken or proposed, and a contact point, and Mona will supplement the notice as information develops.

A-5.2 Cooperation. Mona will take reasonable steps to contain and remediate the incident and will reasonably cooperate with Customer’s own notification obligations, including obligations Customer may have to clients, courts, or bar authorities.

A-6. Deletion and Return

A-6.1 Deletion on Demand. Customer may delete any Matter at any time through the Service, and its account on written request, with the effects stated in Section 9.3 of the Agreement.

A-6.2 Deletion on Termination. Upon account closure, Mona will delete all Customer Data within thirty (30) days, subject to removal from backups in the ordinary rotation not to exceed 30 additional days. Upon Customer’s written request, Mona will confirm deletion in writing.

A-6.3 Export First. The Service lets Customer download the documents it has submitted so that Customer can retain copies of Customer Data consistent with Customer’s own retention obligations before deletion. Deletion is Customer’s decision; Mona does not delete Customer Data from an active account except at Customer’s direction.

A-6.4 Legal Holds. If Mona is legally required to retain specific Customer Data beyond these periods, it will retain only what the law requires, protect it under this DPA, and delete it when the requirement ends.

A-7. Transparency and Audit

A-7.1 Visibility. The Service provides Customer with visibility into the documents and Matters Mona holds for Customer’s account at any time.

A-7.2 Information Requests. Upon Customer’s reasonable written request, no more than once annually, Mona will make available information reasonably necessary to demonstrate compliance with this DPA, such as its then-current security overview and Subprocessor List, and will respond to reasonable written security questionnaires. This Section is intended to satisfy the vendor due diligence described in applicable bar ethics opinions.

A-8. General

A-8.1 Order of Precedence; Survival. This DPA controls over the body of the Agreement as to processing and protection of Customer Data. Sections A-2, A-5, and A-6 survive termination for so long as Mona holds Customer Data.