Master Services Agreement

Effective date: April 29, 2025

1.1 — Definitions (Additions)

"Client Credentials" means any usernames, passwords, session tokens, API keys, OAuth grants, multi-factor codes, security questions, or other access mechanisms supplied or authorized by the Client to enable Zoca to access a Third-Party Platform on the Client's behalf.

"Customer-Authorized Integration" means any integration between the Services and a Third-Party Platform that is not a Partner Integration, including integrations effected through the Client's authorization for Zoca to use Client Credentials.

"Partner Integration" means an integration between the Services and a Third-Party Platform that Zoca operates under a formal partner-, developer-, or technology-program relationship with the Third-Party Platform, identified as such in Zoca's then-current documentation.

"Third-Party Platform" means any third-party booking, scheduling, calendar, point-of-sale, payment, customer-record, marketing, listing, messaging, social-media, or similar online platform that the Client connects to the Services, including without limitation Gloss Genius, Vagaro, Mindbody, Acuity Scheduling, Square Appointments, and Fresha.

"Third-Party Platform Terms" means the then-current terms of service, acceptable-use policy, developer terms, API terms, partner program terms, privacy policy, or other governing rules of any Third-Party Platform.

1.1(b)(vii) — Booking Platform Integrations

(A) Customer-Directed Integrations.

The Client may, at its sole option, direct Zoca's AI agents to interact
with one or more third-party booking, scheduling, point-of-sale, calendar, customer-record, or similar platforms (each, a "Third-Party Platform"), including but not limited to Gloss Genius, Vagaro, Mindbody, Acuity Scheduling, Square Appointments, and Fresha. Where Zoca has a formal partner- or developer-program relationship with a Third-Party Platform, that integration will be identified as a "Partner Integration"; all other integrations are "Customer-Authorized Integrations."‍

(B) Customer's Grant of Access.

For each Customer-Authorized Integration, the Client expressly authorizes Zoca and its AI agents to access, sign in to, retrieve data from, and perform actions on the Client's account with the relevant Third-Party Platform, using the Client's own credentials, session tokens, API keys, OAuth grants, or other access mechanisms supplied or authorized by the Client (collectively, "Client Credentials"). The Client's grant of access constitutes binding authorization for purposes of all applicable computer-access, anti-circumvention, and unauthorized-access laws, including the Computer Fraud and Abuse Act, 18 U.S.C. §1030, and equivalent state and foreign statutes.

(C) Customer-as-Principal Construct.

With respect to each Customer-Authorized Integration, Zoca acts solely as the Client's authorized technical agent. The Client is the principal in the relationship with the Third- Party Platform. All actions taken by Zoca's AI agents in respect of the Third-Party Platform are deemed to be actions of the Client, taken by the Client through Zoca as the Client's tool. Records created, modified, or deleted by Zoca's AI agents on the Third-Party Platform are the Client's records.

(D) Source of Truth.

The Third-Party Platform's record is the source of truth for booking data. Zoca
maintains an audit trail solely as evidence of the actions Zoca's AI agents took on the Client's behalf; such audit trail is not evidence of the resulting state of any Third-Party Platform record. In the event of a discrepancy between Zoca's audit trail and the Third-Party Platform's record, the Third-Party Platform's
record controls.

(E) No Warranty Regarding Third-Party Platforms.

Zoca makes no representation or warranty, express or
implied, that any Third-Party Platform permits Customer-Authorized Integration, that the integration will not result in suspension or termination of the Client's account with the Third-Party Platform, or that the integration is consistent with the Third-Party Platform's then-current terms of service, acceptable-use policy, developer terms, or other governing rules ("Third-Party Platform Terms"). Zoca's technical ability to integrate is not, and shall not be construed as, a representation that such integration is permitted by the Third-Party Platform.

(F) Suspension or Removal of Integrations.

Zoca may, at any time and without liability to the Client:

  1. suspend, modify, or discontinue any Customer-Authorized Integration;
  2. refuse to integrate, or cease integrating, with any Third-Party Platform; or
  3. require the Client to migrate to a Partner Integration or to Zoca's native booking. Zoca will use commercially reasonable efforts to give the Client thirty (30) days' advance notice of a planned discontinuation where feasible.

‍
1.3 — Access & Authorizations; Customer Credentials

(a) Grant of Agency.

To deliver the Services, the Client appoints Zoca as its limited technical agent for the purposes described in Sections 1.1, 1.3, and 6, and authorizes Zoca to act in the Client's name and on the Client's behalf in respect of those purposes. This authorization is a limited grant of agency and does not create a general power of attorney. The Client may revoke this authorization at any time by written notice, subject to Zoca's right to terminate the affected Services without refund.

(b) Customer Credentials.

Where the Services require Zoca to access a Third-Party Platform, the Client
may provide Zoca with Client Credentials. By providing Client Credentials, the Client:

  1. represents and warrants that the Client is the lawful holder of, or has full authority to use and to authorize Zoca's use of, each Client Credential, and that the underlying account is registered in the Client's name or in the name of an entity the Client is authorized to bind;
    ‍
  2. authorizes Zoca to use Client Credentials to sign in to, maintain a session on, retrieve information from, send information to, and take actions within the relevant Third-Party Platform, in each case for
    the purposes of delivering the Services;
    3. represents and warrants that such use does not, to the Client's knowledge after reasonable inquiry,
    violate the Third-Party Platform Terms or any applicable law, regulation, contract, or order binding on
    the Client;
    4. acknowledges that the Client remains responsible for ensuring that Client Credentials are accurate
    and current, for promptly revoking or rotating any compromised Client Credential, and for any
    consequence (including suspension, termination, enforcement action, or fee assessment by the Third-
    Party Platform) arising from Zoca's authorized use of Client Credentials; and
    5. bears the entire risk of loss arising from the use, misuse, interception, or compromise of Client
    Credentials, except to the extent caused by Zoca's gross negligence or willful misconduct.

‍
(c) Storage and Handling of Credentials.

Zoca will store Client Credentials encrypted at rest using industry-standard encryption. Zoca will limit access to Client Credentials to personnel and subprocessors with a need to know. Zoca's storage and handling obligations do not include any guarantee that the Third- Party Platform permits the storage of credentials by a third party, and the Client acknowledges that some
Third-Party Platform Terms may prohibit the storage of credentials by parties other than the account holder, in which event the Client (and not Zoca) is responsible for any consequence.

(d) Limited Authorizations.

The Client further authorizes Zoca to:

(i) create or update business listings on Google Business Profile, Apple Business Connect, and similar platforms on the Client's behalf;

(ii) post content to social-media accounts the Client expressly connects; and

(iii) provision and operate a virtual phone number for the Client through Zoca's telephony subprocessor. Zoca does not require, and will not request:

  1. The Client's direct calendar credentials (e.g., raw Google Calendar or iCloud passwords);
  2. The Client's telecommunications carrier credentials;
  3. The Client's email-server credentials; or
  4. Historical call recordings.

‍
(e) No General Power of Attorney.

Nothing in this Agreement creates a general power of attorney. Zoca will
not, and is not authorized to,

(i) execute legal documents on the Client's behalf;

(ii) bind the Client to third- party contracts outside the scope of operating the Services;

(iii) initiate financial transactions other than those necessary to operate the Services as configured by the Client; or

(iv) take any action that the Client has not authorized in the onboarding intake, in-app configuration, or in writing.

1.3A — Third-Party Platform Access; Customer's Sole Responsibility

(a) Customer Acknowledgment.

The Client expressly acknowledges and agrees that:

  1. Third-Party Platforms operate under their own Third-Party Platform Terms, which the Client is responsible for reading, understanding, and complying with;
  2. Third-Party Platform Terms may, and frequently do, prohibit, restrict, or condition automated access, programmatic use, third-party agent access, credential sharing, scraping, or use to power competing products;
    ‍
  3. The Client's authorization to Zoca under Section 1.3 directs Zoca to interact with the Third-Party Platform as the Client's agent using the Client's own access rights;
  4. The Client, as the principal account holder, is in the best position to determine whether such interaction is permitted under the Third-Party Platform Terms; and
  5. Zoca does not, and cannot reasonably be expected to, monitor or interpret the then-current terms of every Third-Party Platform on the Client's behalf.

‍
(b) Customer Representations and Warranties.

The Client represents, warrants, and covenants on a continuing basis that, for each Third-Party Platform the Client connects to the Services:

  1. The Client has independently reviewed the then-current Third-Party Platform Terms;
  2. The Client has determined, in its own commercial judgment, that authorizing Zoca's AI agents to access the Third-Party Platform as the Client's agent using Client Credentials is consistent with the Third-Party Platform Terms, or that the Client is willing to accept the risk if it is not;
  3. The Client has obtained any consents, approvals, or authorizations required by the Third-Party Platform Terms for Zoca's access on the Client's behalf;
  4. The Client will monitor for updates to the Third-Party Platform Terms and will promptly notify Zoca and disable the relevant integration if the Client determines that continued integration is no longer permitted;
  5. The Client will not use the Services to scrape, harvest, or extract data from a Third-Party Platform in violation of the Third-Party Platform's robot exclusion protocol, rate limits, API terms, or other technical access controls; and
  6. The Client will respect any opt-out, suspension, or cease-and-desist instruction issued by the Third-
    Party Platform to the Client.

‍
(c) Customer's Sole Responsibility.

As between Zoca and the Client, the Client is solely responsible for:

  1. Any breach of, or claim under, the Third-Party Platform Terms arising from Zoca's authorized access on the Client's behalf;
  2. Any suspension, termination, throttling, account closure, IP-block, fee assessment, or other enforcement action by a Third-Party Platform against the Client or, where the Third-Party Platform's enforcement action is directed at Zoca because of the Client's account, against Zoca;
  3. Any unfair-competition, tortious-interference, or breach-of-contract claim brought by a Third-Party Platform against the Client or against Zoca arising from Zoca's authorized access on the Client's behalf;
  4. Any claim, demand, or proceeding under the Computer Fraud and Abuse Act, 18 U.S.C. §1030, the California Comprehensive Computer Data Access and Fraud Act, Cal. Pen. Code §502, or analogous federal, state, or foreign computer-access or anti-circumvention statutes, where such claim alleges
    that Zoca's access to a Third-Party Platform exceeded the authorization granted by the Client (the Client being the authorizing party for purposes of such statutes); and
  5. Any data-protection, privacy, or other regulatory inquiry arising from data flowing between a Third- Party Platform and the Services as a result of the Client's authorization, to the extent such inquiry concerns the Client's lawful basis or legal authority to share data with Zoca.

‍
(d) Customer's Direction Controls.

Where Zoca takes any action against a Third-Party Platform pursuant to the Client's authorization or direction, that action is taken at the Client's direction and risk. The Client cannot use Zoca's role as the technical executor of the Client's direction to shift any consequence of that direction back to Zoca, except to the extent Zoca's gross negligence or willful misconduct in performing the direction independently caused the relevant loss.

(e) Survival.

The Client's representations, warranties, covenants, and indemnification obligations under this Section 1.3A survive termination or expiration of this Agreement for the maximum period permitted by
applicable law.

6.4 — Outbound Communications Obligations (Additional Paragraph)

The Client further represents, warrants, and covenants that any data the Client directs Zoca's AI agents to retrieve from a Third-Party Platform — including customer lists, booking histories, contact information, transaction records, and stored payment-instrument references — has been collected and is held by the Client in compliance with applicable law and with the relevant Third-Party Platform Terms, and that the Client has the right to share such data with Zoca for the purposes described in this Agreement. The Client further warrants that its onward use of such data (for outbound contact, retention campaigns, analytics, or otherwise) is permitted under the legal basis on which the data was originally collected and under any applicable consents.

8.5 — Third-Party Platform Representations

In addition to the representations and warranties set forth in Sections 1.3, 1.3A, and 6.4, the Client represents and warrants on a continuing basis that:

(a) the Client has, and will maintain throughout the term, all rights, licenses, consents, and authorizations necessary to:

  1. Hold an active account in good standing with each Third-Party Platform the Client connects to the Services;
  2. Authorize Zoca to access such Third-Party Platform on the Client's behalf using Client Credentials;
  3. Share with Zoca all data flowing between the Third-Party Platform and the Services as a result of the Client's authorization; and
  4. Permit Zoca's AI agents to create, modify, cancel, or delete records on the Third-Party Platform on the Client's behalf;

‍
(b) the Client has not received, and will promptly notify Zoca if the Client receives, any notice from a Third- Party Platform alleging a violation of the Third-Party Platform Terms, threatening suspension or termination of the Client's account, or demanding cessation of automated or third-party access; and
(c) the Client is not subject to any outstanding order, judgment, injunction, or settlement that prohibits or restricts the Client's use of any Third-Party Platform connected to the Services.

9.4 — Third-Party Platforms

Customer-Authorized Integrations (Disclaimer) Without limiting the generality of the foregoing disclaimers, Zoca expressly disclaims, and the Client expressly acknowledges that Zoca makes no representation, warranty, condition, or guarantee of any kind, express or implied, regarding:

(a) the legality, permissibility, or compliance with any Third-Party Platform Terms, of accessing the Third- Party Platform on the Client's behalf using Client Credentials;

(b) the continued availability, functionality, or stability of any Customer-Authorized Integration;

(c) any change to, suspension of, or termination of access to a Third-Party Platform by the Third-Party Platform itself, whether arising from a change in the Third-Party Platform's terms, a unilateral enforcement action, or otherwise;

(d) the accuracy, completeness, or freshness of data retrieved from a Third-Party Platform; or

(e) any consequence to the Client arising from the Third-Party Platform's awareness of Zoca's involvement, including but not limited to account suspension, fee assessment, account termination, or affirmative claim by the Third-Party Platform against the Client. The Client expressly assumes the risk of all of the foregoing.

11.2 — Customer Indemnity

The Client will defend, indemnify, and hold harmless Zoca and Zoca's officers, directors, employees, agents, affiliates, sub processors, and licensors (collectively, "Zoca Indemnified Parties") from and against any and all
third-party claims, suits, actions, proceedings, demands, losses, damages, costs, fines, penalties, settlements, and expenses (including reasonable attorneys' fees, expert fees, court costs, and the cost of any audit or investigation) arising out of or related to:

(a) the Client's breach of any representation, warranty, covenant, or obligation under this Agreement, including without limitation Sections 1.3, 1.3A, 6.4, and 8;

(b) the Client's use of, configuration of, or content supplied to the Services, including any business information, FAQ, script, instruction, campaign configuration, talk-track, or customer-contact list;

(c) any claim by a Third-Party Platform against any Zoca Indemnified Party arising from or related to

  1. The Client's authorization of Zoca's access to the Third-Party Platform on the Client's behalf;
  2. Any alleged violation of Third-Party Platform Terms arising from such authorized access; or
  3. The Client's account relationship with the Third-Party Platform;

‍
(d) any claim under the Computer Fraud and Abuse Act, the California Comprehensive Computer Data Access and Fraud Act, or any analogous federal, state, or foreign computer-access, anti-circumvention, or anti-scraping statute, where the claim concerns access to a Third-Party Platform pursuant to the Client's authorization;

(e) any tortious-interference, unfair-competition, breach-of-contract, or misappropriation claim brought by a Third-Party Platform against any Zoca Indemnified Party arising from or related to Zoca's access to the Third-Party Platform on the Client's behalf;

(f) the Client's breach of any Third-Party Platform Terms, regardless of whether the Client had actual knowledge of such breach;

(g) any claim arising from end-customer communications that the Client directed Zoca to send, including without limitation claims under TCPA, the Telemarketing Sales Rule, CAN-SPAM, state telemarketing or AI-
disclosure laws, or state recording-consent laws, except to the extent the claim arises from Zoca's failure to enforce a default control expressly described in Sections 1.1(b)(v) or 1.1(c)(iv); and

(h) the Client's violation of any applicable law or regulation in connection with the Client's use of the Services. The Zoca Indemnified Party will give the Client prompt written notice of any claim subject to indemnification, will tender control of the defense and settlement of the claim to the Client (with counsel reasonably acceptable to the Zoca Indemnified Party), and will provide reasonable cooperation at the Client's expense. The Client may not settle any claim without the Zoca Indemnified Party's prior written consent (which will not
be unreasonably withheld) if the settlement imposes any obligation, admission, or restriction on the Zoca Indemnified Party. Notwithstanding any other provision of this Agreement, the Client's indemnification obligations under
subsections (c), (d), (e), (f), and (g) above are not subject to the limitations of liability set forth in Section 12 (Limitation of Liability) and are uncapped.

12.3 — Limitation of Liability (Additional Carveout)

For clarity, none of the following constitute a "direct damage" of the Client for which Zoca has any liability under this Agreement, and all are expressly excluded from any cap or recovery against Zoca:

(a) the suspension, termination, throttling, account closure, IP-block, or other enforcement action by a Third- Party Platform against the Client's account, or any commercial consequence of such action, regardless of whether such action arises from Zoca's access to the Third-Party Platform on the Client's behalf;

(b) any fee, penalty, fine, or damages assessed against the Client by a Third-Party Platform;

(c) any cost the Client incurs to migrate from one Third-Party Platform to another, to acquire or train staff to use the Third-Party Platform manually, or to remediate the loss of a Customer-Authorized Integration;

(d) any reputational, goodwill, or relationship damages arising from the Client's account relationship with a Third-Party Platform; and

(e) any claim against Zoca by a Third-Party Platform that is the subject of indemnification by the Client under Section 11.2.

12.4 — No Zoca Liability for Third-Party Platform Behavior

Zoca shall not be liable to the Client for any act, omission, decision, delay, change of terms, change of pricing, downtime, data loss, suspension, termination, or other action or inaction of any Third-Party Platform, regardless of whether such action or inaction was foreseeable or arose from the Third-Party Platform's response to Zoca's access on the Client's behalf. The Client's sole and exclusive remedy with respect to any Third-Party Platform behavior is the Client's direct relationship with that Third-Party Platform.

‍

‍