Effective 2 September 2026 · Version 1.1 · Print / Save PDF

GARUNA GROUP — Enhanced Due Diligence (EDD)

Terms of Service / Master Services Agreement

Provider: Garuna Group ("Garuna", "Provider", "we", "us") — Garuna Inc., a corporation incorporated under the laws of the Province of Ontario and operating as "Garuna Group", with registered office at 10 Thornmount Drive, Toronto, Ontario M1B 3J4, Canada Effective date / Last updated: 2026-09-02 Version: 1.3 Governing law: Province of Ontario and the federal laws of Canada applicable therein

Early Access (membership-based). The Service is currently provided on an early-access basis. Access is account-gated (controlled by a garunagroup.com account login) and is sold by monthly membership; every membership covers individual, entity and cryptocurrency searches. Accounts may be opened through the self-serve membership door, through an operator invitation, or as part of a One Horizon corporate or public-sector membership. Every account holder warrants that they have a documented lawful purpose for each query and that each search is conducted for a legitimate business, legal, or compliance purpose, and a holder who relies on a professional licence (for example as a licensed Ontario private investigator under the Private Security and Investigative Services Act, 2005, a lawyer licensed by the Law Society of Ontario, or an authorised compliance / fraud professional) warrants that it is current. Garuna does not verify any licence number in-app; access is gated by account login and the foregoing warranties. Warranties are limited accordingly (see clause 12), and this early-access framing is in addition to, and does not limit or weaken, any disclaimer of warranties, limitation of liability, or indemnity in these Terms.

Master agreement. This Terms of Service / Master Services Agreement (the "Terms") is the master agreement governing access to and use of the Service. The Acceptable Use Policy, Privacy Policy, Data Processing Addendum, Disclaimers & Legal Notices, and Sub-processor List are each incorporated into and form part of these Terms by reference. In the event of conflict on matters of personal-data processing, the Data Processing Addendum ("DPA") prevails over the body of these Terms; otherwise the body of these Terms prevails over the incorporated policies. Where an executed order form is in place, the precedence of these documents is as set out in clause 24.1.

1. Parties & Acceptance

1.1 These Terms form a binding agreement between Garuna and the organisation that accepts them (the "Client", "you"). They take effect on the earlier of (a) the date the Client first accepts them, whether by clicking "I agree" or an equivalent control, by executing an order or order form referencing them, or by accessing or using the Service; or (b) the Effective date stated above where an executed agreement so provides.

1.2 Authority to bind. The individual accepting these Terms represents and warrants that they are duly authorised to enter into these Terms on behalf of the Client and to bind the Client to them. If you do not have such authority, or if the Client does not agree to these Terms, you must not accept them and must not access or use the Service.

1.3 Business / non-consumer status. The Client represents and warrants that it is a business, organisation, or other commercial entity (or an individual or sole proprietor acting in the course of a trade, business, craft, or profession), that it is entering into these Terms and accessing the Service solely for purposes within that commercial activity, and that it is not a "consumer" within the meaning of the Ontario Consumer Protection Act, 2002 or any other applicable consumer-protection law. Access to and use of the Service are conditioned on this representation being and remaining true. This clause 1.3 operates without prejudice to clauses 12.4 and 13.5.

1.4 Click-through. Where the Service presents these Terms (or any incorporated policy) through a click-through, gate, or acknowledgement at sign-up or at runtime, acceptance through that mechanism constitutes the Client's and the relevant Authorised User's agreement to be bound, in addition to and consistent with these Terms.

1.5 The Client's Authorised Users must also comply with these Terms, the Acceptable Use Policy, and the in-app acknowledgements. The Client is responsible for its Authorised Users' acts and omissions in connection with the Service as if they were the Client's own.

2. Definitions

Capitalised terms have the meanings set out below. These definitions apply throughout the Terms and, except where separately defined, throughout each incorporated document.

2.1 "Garuna", "Provider", "we", "us" means Garuna Inc., a corporation incorporated under the laws of the Province of Ontario and operating as "Garuna Group", with registered office at 10 Thornmount Drive, Toronto, Ontario M1B 3J4, Canada, provider of the Service.

2.2 "Service" means the Enhanced Due Diligence (EDD) web application and all related software, APIs, and outputs made available by Garuna.

2.3 "Client", "you" means the organisation that enters into these Terms and is authorised to access the Service.

2.4 "Authorised User" means an individual analyst, investigator, or employee or contractor whom the Client authorises to access and operate the Service on the Client's behalf.

2.5 "Sweep" means one investigation of one Subject initiated through the Service (the unit of processing).

2.6 "Subject" means the third-party person or entity that is the object of a Sweep, identified by the Client through inputs such as legal full name, optional jurisdiction, email, phone, alias or username, domain, and free-text context. The Subject is a third party, is not the user, and is generally unaware of the Sweep.

2.7 "Subject Inputs" means the identifiers and context the Client or Authorised User submits to define the Subject.

2.8 "Report" means the streamed, sectioned output of a Sweep (findings, identity-resolution disclosure, confidence breakdown, gaps list, and risk score), delivered to the requesting Client in-browser and optionally exportable by the Client as JSON.

2.9 "Personal Data" or "Personal Information" means information about an identifiable individual; "Personal Information" in the PIPEDA sense and "personal data" in the GDPR / UK GDPR sense, used interchangeably and covering Subject Inputs, collected source material about a Subject, and any Personal Data within a Report.

2.10 "Controller" means the party that determines the purposes and means of processing Personal Data. In respect of Subject Personal Data, the Client is the Controller (see clause 8.1 for the limited respects in which Garuna acts as controller of Client and Authorised-User account data).

2.11 "Processor" or "Service Provider" means the party that processes Personal Data on behalf of and on the documented instructions of the Controller. In respect of Subject Personal Data, Garuna is the Processor / Service Provider (subject to clause 8.1).

2.12 "Sub-processor" means a third party engaged by Garuna that processes Personal Data on Garuna's behalf in delivering the Service.

2.13 "Independent Source" or "Public Source" means a third-party public-record, registry, or open-source service that Garuna queries with Subject identifiers, and that acts as an independent controller of its own data (not a Sub-processor of Garuna).

2.14 "Investigation Session" means an authenticated browser session that an Authorised User establishes by signing in themselves to their own or a duly authorised investigation ("burner") account on a supported platform — being X, Instagram, LinkedIn, Facebook, or Reddit — which the Service then reuses (a) to read a Subject's public engagement graph (currently on X and Instagram only) and (b) to retrieve a Subject's authenticated public profile photo on any connected platform (including LinkedIn). The Service never cracks, guesses, or bypasses authentication. The Client and Authorised User acknowledge that some platforms — notably LinkedIn and the Meta properties (Facebook and Instagram) — prohibit automated access and the use of investigation or "burner" accounts in their terms of service, so that the use of an Investigation Session on those platforms may breach those terms (see clause 5).

2.15 "Session State" means the captured browser storage_state (authentication cookies) of an Investigation Session; held in process memory only, never written to disk, never logged (beyond a cookie count), and never serialised into a Report or export. For clarity, Session State as so defined does not include the separate authenticated account-lookup credential used by the optional authenticated account-surface lookup described in clause 3.6 (the analyst's own credential, not Subject data), which credential persists on disk; the in-memory-only invariant in this clause 2.15 and clause 5.4 applies to Investigation Session cookies only.

2.16 "Documented Instructions" means the Client's written instructions to Garuna regarding processing of Personal Data, comprising these Terms, the DPA, the Client's configuration of the Service, and each Sweep the Client initiates.

2.17 "Deep Mode" means the optional Sweep mode that additionally engages a cloud AI synthesis & verification provider (a Tier-1 cloud large language model) and independent claim verification; in default / fast mode, synthesis stays on-device.

2.18 "Output" or "Findings" means the intelligence contained in a Report; provided to inform human judgement, "as is".

2.19 "AUP" means the Acceptable Use Policy incorporated by reference under clause 6.

2.20 "DPA" means the Data Processing Addendum incorporated by reference under clause 8.

3. The Service & Licence Grant

3.1 Service description. Enhanced Due Diligence (EDD) is a business-to-business web application that helps an authorised investigator compile an open-source due-diligence Report on a third-party Subject (a person or entity). For each Sweep, the Service disambiguates the Subject's identity, collects publicly available information from open web sources and public-record / registry APIs, discovers publicly visible online accounts and digital footprint, grades and clusters findings to the correct individual (excluding same-name strangers), optionally augments public social-engagement data through an Investigation Session that the Authorised User signs into themselves, verifies finding links, computes a keyword-weighted risk score, and produces a citation-enforced synthesis. The Report is streamed to the requesting Client in their browser and may be exported by the Client; completed Reports are retained on Garuna's servers for a limited period (currently thirty days) so the Client can retrieve them, and are then deleted; the retention of Subject data is described in the Privacy Policy and the DPA. The Service is provided on an early-access basis by monthly membership (see the head of these Terms); warranties are limited accordingly (see clause 12) and this framing does not limit or weaken any disclaimer of warranties, limitation of liability, or indemnity in these Terms.

3.2 Licence grant. Subject to the Client's continuing compliance with these Terms and payment of applicable fees, Garuna grants the Client a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to access and use the Service, solely for the Client's own internal business purposes and solely through its Authorised Users, during the Term.

3.2A Account-gated access; membership. Access to the Service is account-gated, controlled by a garunagroup.com account login, and is sold by monthly membership (clause 10). Every membership covers individual, entity and cryptocurrency searches. Accounts may be opened through the self-serve membership door, through an operator invitation, or as part of a One Horizon corporate or public-sector membership. As a condition of access, the Client and each Authorised User represent and warrant that they have a documented lawful purpose for each query and that each search is conducted for a legitimate business, legal, or compliance purpose in compliance with applicable law; a Client that holds itself out as a licensed private investigator, lawyer, or compliance professional further warrants that the relevant licence or authorisation is current. Garuna does not verify any licence number in-app; access is gated by account login and the foregoing warranties, and Garuna may suspend or terminate access where it has reason to believe any such warranty is untrue.

3.3 Restrictions. Except as expressly permitted, the Client and its Authorised Users must not, and must not permit any third party to: (a) copy, modify, translate, or create derivative works of the Service; (b) reverse engineer, decompile, or disassemble the Service, or attempt to derive its source code, except to the extent such restriction is prohibited by applicable law; (c) rent, lease, lend, sell, sublicense, distribute, or otherwise make the Service available to any third party, or operate the Service as a service bureau for the benefit of third parties; (d) circumvent or disable any access controls, usage limits, security features, or the authentication design of any Investigation Session; (e) use the Service to build a competing product or service; (f) access or use the Service other than through interfaces and methods made available by Garuna; or (g) use the Service in violation of these Terms, the AUP, or applicable law.

3.4 Configuration and modes. The Service's behaviour, including which search backends, Sub-processors, and Independent Sources are engaged and whether Deep Mode is used, depends on configuration. The Client acknowledges that a fully-local configuration minimises third-party transfer and that engaging Deep Mode or external backends results in transfer of data to third parties as described in the Privacy Policy and Sub-processor List.

3.5 Account-discovery and identifier probes. The Service may submit the Subject's identifiers to third-party account-discovery tooling and validation probes, which query many third-party sites and registries directly. These include, without limitation, account-existence discovery tooling (open-source techniques querying target sites directly) that submits the Subject's email, the Subject's username, and the Subject's phone number (checking for accounts on a range of consumer platforms), together with structured probes that submit the Subject's email and/or phone to breach-presence services, the Subject's domain to registration-lookup services, and the Subject's name to court, registry, sanctions, trademark, and news/adverse-media sources. The recipients and cross-border nature of these transfers are described in the Privacy Policy and Sub-processor List, which are incorporated by reference.

3.6 Authenticated account-surface lookup. Where configured and authenticated, the Service may perform an optional authenticated account lookup against a major email/account provider that submits the Subject's email to that provider to determine the existence and public profile surface of an account (for example, an account identifier, profile name and photo, enabled services, and public review counts). This lookup operates only after the operator completes a one-time sign-in, and the resulting authenticated-lookup credential (the analyst's own credential, not Subject data) persists on disk in the Service's operating environment; this is a deliberate exception to the in-memory-only treatment of Investigation Session cookies under clauses 2.15 and 5.4. The Privacy Policy and Sub-processor List describe this transfer to the account provider and the on-disk credential storage. Where this lookup is not configured or not authenticated, it does not run.

3.7 Changes to the Service. Garuna may modify, enhance, or discontinue features of the Service from time to time, provided that Garuna will not materially degrade the core functionality of the Service during a paid Term without notice. Garuna will not make a factual claim about the Service in marketing or documentation that is inconsistent with its actual operation.

3.8 No private-investigation services. Garuna is not providing, and the Service does not constitute, private investigation services within the meaning of the Private Security and Investigative Services Act, 2005 (Ontario) or any equivalent licensing legislation. The Service is an information-research tool that the Client and its Authorised Users operate on their own behalf. Garuna does not conduct investigations for the Client, and the Client and each Authorised User remain solely responsible for holding and maintaining any licence, registration, or authorisation required for their own activities and use of the Service and the Output.

4. Client Accounts & Security

4.1 Account provisioning. The Client is responsible for designating its Authorised Users and for managing their access to the Service. Each Authorised User's credentials are personal to that Authorised User and must not be shared.

4.2 Credential security. The Client is responsible for maintaining the confidentiality of all account credentials and for all activity occurring under its accounts and those of its Authorised Users, whether or not authorised by the Client.

4.3 Notification. The Client must notify Garuna promptly at [email protected] upon becoming aware of any unauthorised access to or use of the Service, any compromise of credentials, or any other security incident affecting the Client's use of the Service.

4.4 Authorised User compliance. The Client must ensure that each Authorised User complies with these Terms, the AUP, and the in-app acknowledgements, and must promptly disable access for any Authorised User who breaches them.

5. Investigation Sessions & Third-Party Platform Terms

5.1 The Service never cracks, guesses, or bypasses authentication. An Investigation Session reuses only a session that an Authorised User created by signing in themselves to an account.

5.2 Supported platforms. The Service supports Investigation Sessions on X, Instagram, LinkedIn, Facebook, and Reddit. A connected session may be reused both for public engagement-graph reads (currently on X and Instagram only) and for authenticated public profile-photo retrieval on any connected platform (including LinkedIn). The Authorised User is responsible for whichever platform the Authorised User connects.

5.3 Sole responsibility. The Authorised User is solely responsible for ensuring that any account used in an Investigation Session is the Authorised User's own or is duly authorised for the Authorised User's use, and for compliance with the terms of service and other terms, policies, and applicable law of the relevant third-party platform (including, without limitation, X, Instagram, LinkedIn, Facebook, and Reddit). The Client is responsible for its Authorised Users' compliance with this clause.

5.4 Platform-ToS risk allocation. The use of an Investigation Session may breach the terms of service of the relevant platform. The Client and Authorised User acknowledge in particular that LinkedIn and the Meta properties (Facebook and Instagram) prohibit automated access and the use of investigation or "burner" accounts in their terms, so that use of an Investigation Session on those platforms may breach those terms. Garuna does not authorise, endorse, or warrant any such use, makes no representation that any such use complies with any platform's terms, and disclaims all liability arising from the Client's or any Authorised User's use of an Investigation Session. This allocation of responsibility is acknowledged at the in-app Investigation Session gate, which the Authorised User must accept for whichever platform the Authorised User connects.

5.5 Session State is held in process memory only and is never written to disk, logged (beyond a cookie count), or serialised into any Report or export. An Authorised User may disconnect an Investigation Session at any time. The on-disk credential storage of the separate, optional authenticated account-surface lookup (clause 3.6) is not Session State and is addressed in the Privacy Policy.

6. Acceptable Use

6.1 Incorporation of AUP. The Client and its Authorised Users must comply with the Acceptable Use Policy, which is incorporated into these Terms by reference and forms part of them.

6.2 Authorised purpose only. The Service may be used only for lawful due diligence, comprising: KYC / KYB / AML; vendor, counterparty, and third-party risk assessment; fraud and integrity investigations; litigation support; and pre-employment screening only where independently lawful and not via this tool as a consumer report.

6.3 Prohibited uses. Without limiting the AUP, the Client and its Authorised Users must not use the Service: (a) for stalking, harassment, doxxing, intimidation, or unlawful surveillance; (b) to make or support any decision that violates human-rights, anti-discrimination, or equality law; (c) as a "consumer report" or for any decision regulated by the U.S. Fair Credit Reporting Act (FCRA) or by any Canadian provincial consumer-reporting or credit-reporting legislation (including the Ontario Consumer Reporting Act), or for any credit, employment, insurance, housing or tenancy, or other eligibility determination; (d) to make any solely-automated decision producing legal or similarly significant effects without meaningful human review; or (e) for any other unlawful purpose or in any manner that breaches these Terms or the AUP.

6.4 Subject-data discipline. The Client must hold a lawful basis or authority for each Subject and each Sweep (see clause 7) and must not conduct bulk or indiscriminate Sweeps without such basis.

7. Client Warranties & Responsibilities

This clause 7 is central to these Terms. The Client represents, warrants, and undertakes, on a continuing basis, as follows.

7.1 Controller and lawful basis. The Client is the Controller in respect of all Subject Personal Data it submits to or processes through the Service. The Client has, and will maintain for the duration of each Sweep and any downstream use, a valid lawful basis and all authority necessary to instruct each Sweep and to process each Subject's Personal Data, including (as applicable):

   (a) under PIPEDA, reliance on the business-contact, investigation, fraud-prevention, due-diligence, or business-transaction provisions (including, as applicable, sections 7(1)–7(3)) for collection, use, or disclosure without the Subject's consent; and

   (b) for any Subject in the European Union or the United Kingdom, an appropriate GDPR / UK GDPR lawful basis, which will typically be Article 6(1)(f) legitimate interests supported by a documented legitimate-interests / balancing assessment, with due consideration of Article 9 where special-category data may arise and of the Controller's transparency obligations (including Article 14) and their exemptions.

Garuna processes solely on the Client's Documented Instructions and does not determine and does not warrant the Client's lawful basis or authority for any Sweep or Subject.

7.2 No consumer-report or eligibility use. The Client will not use, and will not permit any Authorised User or recipient to use, any Output (a) as a "consumer report"; (b) for any FCRA-regulated decision; (c) for any decision governed by Canadian provincial consumer-reporting or credit-reporting legislation; or (d) for any credit, employment, insurance, housing or tenancy, or other eligibility determination. The Client acknowledges that Garuna is not a consumer reporting agency and that the Service is not designed or permitted for any such use.

7.3 Investigation Sessions. For each Investigation Session, the Authorised User will use only their own or a duly authorised account and is solely responsible for compliance with the relevant third-party platform's terms of service and applicable law, as set out in clause 5, in respect of whichever of X, Instagram, LinkedIn, Facebook, or Reddit the Authorised User connects. The Client is responsible for ensuring its Authorised Users meet this requirement.

7.4 Human review. The Client will ensure that a qualified human reviews and independently verifies the Output before it is relied upon, and that no decision producing legal or similarly significant effects in respect of any Subject is made solely on the basis of the Output without meaningful human review.

7.5 Compliance with law. The Client will comply, and will ensure its Authorised Users comply, with all applicable laws in connection with its use of the Service and the Output, including privacy and data-protection law, anti-discrimination and human-rights law, consumer-reporting law, and sanctions and anti-money-laundering law.

7.6 Accurate inputs. The Subject Inputs the Client submits will be accurate to the best of the Client's knowledge, and the Client will not submit inputs it is not authorised to provide.

7.7 Sanctions screening. The Client acknowledges that the Service's sanctions screening is name-based and indicative only, may produce false positives and false negatives, and is not a substitute for a regulated sanctions / AML compliance screening programme, on which the Client must independently rely.

7.8 No advice. The Client acknowledges that the Output is intelligence to inform human judgement and is not legal, compliance, financial, or other professional advice, and that the Client is responsible for verifying the Output and for any decision it makes.

7.9 Independent-verification duty; lead-generation only. The Client acknowledges and agrees that the Output is investigative lead-generation only — it identifies leads, sources, and possible connections for further inquiry — and is not a finding of fact or a verified conclusion. The Client and its Authorised Users will independently corroborate any item of Output against primary or authoritative sources before relying on it or acting on it, consistent with the disclaimers in clause 12 and the incorporated Disclaimers & Legal Notices. This clause 7.9 supplements, and does not limit, the human-review requirement in clause 7.4.

8. Data Protection & DPA

8.1 Allocation of roles. As between the parties, the Client is the Controller and Garuna is the Processor / Service Provider in respect of Subject Personal Data processed through the Service. Garuna processes Subject Personal Data only on the Client's Documented Instructions and does not use Subject Personal Data for its own purposes. For clarity, and consistent with the Privacy Policy, Garuna is the controller of Client and Authorised-User account, contact, authentication, and billing data, which it processes to provide, secure, administer, and bill for the Service; the controller/processor allocation in this clause and in the DPA concerning Subject Personal Data does not apply to that account data.

8.2 Incorporation of DPA. The Data Processing Addendum is incorporated into these Terms by reference and forms part of them. The DPA prevails over the body of these Terms on matters of personal-data processing. The DPA addresses, among other things, Documented Instructions, confidentiality, security measures, Sub-processors, international transfers (including Standard Contractual Clauses and the UK International Data Transfer Agreement), assistance to the Controller, breach notification, and return or deletion on termination.

8.3 Sub-processors and Independent Sources. Garuna's Sub-processors are listed in the Sub-processor List, which is incorporated by reference and which may change in accordance with the change-notice mechanism in the DPA. Independent Sources queried with Subject identifiers are independent controllers of their own data and are listed for transparency and cross-border-transfer disclosure, not as Sub-processors. Cross-border transfer occurs only when the relevant backends or sources are used; a fully-local configuration minimises such transfer. The Sub-processor List and Privacy Policy reflect the recipients identified in clauses 3.5 and 3.6 (including account-discovery and identifier probes, the authenticated account-surface lookup, and the Investigation Session platforms).

8.4 Privacy Policy. The Privacy Policy, incorporated by reference, describes how Personal Data is processed, including the ephemerality of Subject data, caches, operational logging, transfers, and the routing of data-subject rights requests.

9. Intellectual Property

9.1 Garuna IP. Garuna and its licensors own and retain all right, title, and interest in and to the Service, including all software, models, methods, user interfaces, documentation, and all intellectual-property rights therein. Except for the limited licence in clause 3.2, no rights are granted to the Client by implication, estoppel, or otherwise.

9.2 Client inputs and Reports. As between the parties, the Client owns its Subject Inputs and the Reports it exports, and any decisions or work product the Client derives from the Output. Garuna claims no ownership of the Client's inputs or exported Reports. The Client grants Garuna a limited licence to process the Client's inputs solely to provide the Service in accordance with these Terms and the DPA.

9.3 Feedback. If the Client or an Authorised User provides Garuna with suggestions or feedback about the Service, Garuna may use that feedback for any purpose without obligation or attribution, provided Garuna does not identify the Client as the source.

9.4 Aggregated / de-identified data. Garuna may generate and use aggregated and de-identified operational and statistical data that does not identify the Client, any Authorised User, or any Subject, to operate, secure, and improve the Service.

9.5 Garuna IP-infringement indemnity. Garuna will defend the Client against any third-party claim alleging that the Service, as provided by Garuna and used in accordance with these Terms, infringes that third party's patent, copyright, trade-mark, or trade-secret rights, and will indemnify the Client against damages and reasonable legal fees finally awarded against the Client (or agreed in settlement by Garuna) in respect of such a claim. If the Service becomes, or in Garuna's reasonable opinion is likely to become, the subject of such a claim, Garuna may at its option and expense (a) procure for the Client the right to continue using the Service, (b) modify or replace the Service so that it becomes non-infringing while materially preserving its functionality, or (c) if neither (a) nor (b) is reasonably available, terminate the affected portion of the Service and refund any pre-paid fees for the unused portion of the Term. This clause 9.5 does not apply to, and Garuna has no obligation in respect of, any claim to the extent arising from (i) the Client's or an Authorised User's use of the Service in breach of these Terms or applicable law; (ii) Subject Inputs, the Output, or any data obtained from Independent Sources or third-party platforms; (iii) any combination of the Service with products, services, or data not provided by Garuna, where the claim would not have arisen but for the combination; (iv) any modification of the Service not made by Garuna; or (v) the Client's continued use of an allegedly infringing version after Garuna has made a non-infringing version available. This clause 9.5 states the Client's sole and exclusive remedy, and Garuna's entire liability, for any claim of intellectual-property infringement by the Service. The defence procedure in clause 14.2 applies to claims under this clause 9.5 with the roles of indemnitor and indemnitee reversed (Garuna controlling the defence).

10. Fees & Payment

10.1 Subscription plans and search allowances. Use of the Service is sold as a monthly subscription. Each plan includes a monthly allowance of searches consumed when a Sweep is run: an individual-subject Sweep uses one (1) search; an entity or cryptocurrency Sweep uses two (2); deep verification uses one (1) additional search. The current plans, their monthly prices, and their allowances are displayed in the Service (in Canadian dollars unless stated otherwise), and payment is collected through an established third-party payment processor.

(a) Automatic renewal. Each subscription renews automatically every month, and the plan fee is charged to the payment method on file at each renewal, until the subscription is cancelled. By subscribing, the Client authorises these recurring charges.

(b) Cancellation. The Client may cancel at any time — in the Service or by writing to [email protected] — and cancellation takes effect at the end of the then-current billing period: access and the remaining monthly allowance continue to the end of the period already paid for, and no further renewals are charged. Amounts already paid are not refunded on a pro-rata or any other basis, except where a refund is required by applicable law.

(c) Allowance reset — no rollover. The monthly allowance resets at the start of each billing period. Unused allowance expires at the end of the billing period and does not roll over, has no cash value, is non-transferable, and may not be redeemed for money.

(d) Top-up searches. Accounts with an active subscription may purchase top-up searches at the prices displayed in the Service. Top-up searches do not expire, are consumed only after the monthly allowance is exhausted, have no cash value, are non-transferable, and — whether consumed or unconsumed — are non-refundable once issued, except where a refund is required by applicable law.

(e) Rush priority fee. Where reports are queued for delivery, the Service may offer a one-time rush-priority fee (at the price displayed at the time — currently CAD $50) to move a single queued report to the front of the delivery queue, with a secure link emailed on delivery. The fee applies to one report only, is charged at the time of purchase, and is non-refundable once the priority has been applied; if the underlying Sweep fails and is refunded, the rush fee will also be refunded on request.

(f) Price and plan changes. Garuna may change plan prices, allowances, or the plan line-up on at least thirty (30) days' notice (given in the Service or by email to the account address). Changes take effect at the Client's next renewal after the notice period; continued use of the Service after that renewal constitutes acceptance. The Client's remedy is to cancel under clause 10.1(b) before the change takes effect.

(g) Complimentary searches. Garuna may, at its discretion, grant complimentary searches to particular accounts (for example on an operator invitation or a One Horizon client membership); complimentary searches have no cash value, are non-transferable, may not be redeemed for money, and lapse when the account is closed or access is terminated.

(h) Add-ons. The white-label add-on is non-refundable once activated, except where a refund is required by applicable law. The Practice plan includes white-label report branding only while that plan is active.

(h) Search units. Every search of any subject type — individual, entity or cryptocurrency — uses one search from the monthly allowance (or, once the allowance is exhausted, one top-up search); a search run with deep verification uses two; a self-search uses two.

This no-refund policy is stated in the Service at the point of purchase and on each receipt. Any separately negotiated or enterprise use of the Service will be governed by the fees, billing model, and currency set out in an order form or order agreed in writing by the parties. The Early Access Terms govern the commercial basis of Early Access and, for the Early Access Period and the matters they expressly address, prevail over this clause 10.

10.2 Invoicing and payment terms. Where fees become payable under an order form after the Early Access Period, Garuna will invoice the Client on the billing cycle and by the method stated in that order form, and the Client will pay each undisputed invoice within thirty (30) days of the invoice date unless the order form states otherwise. General billing enquiries may be directed to [email protected].

10.3 Taxes. Fees are exclusive of applicable taxes. The Client is responsible for all sales, use, value-added, goods-and-services, harmonized sales, and similar taxes, except for taxes on Garuna's net income.

10.4 Late payment. Where fees are payable under an order form, Garuna may charge interest on overdue undisputed amounts at the lesser of 1.5% per month (19.56% per annum) and the maximum rate permitted by applicable law, from the due date until paid, and may suspend the Service in accordance with clause 16 for non-payment of undisputed amounts that remain overdue after notice.

11. Confidentiality

11.1 Confidential Information. "Confidential Information" means non-public information disclosed by one party (the "discloser") to the other (the "recipient") that is designated as confidential or that a reasonable person would understand to be confidential, including the Service's non-public features and the parties' commercial terms. It does not include information that is or becomes public other than through the recipient's breach, was lawfully known to the recipient without confidentiality obligation, is independently developed by the recipient, or is lawfully received from a third party without restriction.

11.2 Obligations. The recipient will use the discloser's Confidential Information only to exercise its rights and perform its obligations under these Terms, will protect it with at least reasonable care, and will not disclose it except to its personnel, advisers, and contractors who need to know it and are bound by confidentiality obligations no less protective than these.

11.3 Compelled disclosure. The recipient may disclose Confidential Information to the extent required by law or legal process, provided that, where lawful, it gives the discloser reasonable prior notice and reasonable assistance to seek protective treatment.

11.4 Personal Data. Processing of Personal Data is governed by clause 8 and the DPA; this clause 11 does not reduce those protections.

12. Disclaimer of Warranties

12.1 As is. Except as expressly stated in these Terms, the Service and all Output are provided "as is" and "as available", and Garuna disclaims all warranties, conditions, and representations of any kind, whether express, implied, statutory, or otherwise, including any implied warranties or conditions of merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade, to the maximum extent permitted by applicable law.

12.2 Accuracy. The Client acknowledges that the Output is compiled from open sources and may be incomplete, outdated, or mis-attributed (including same-name risk, which is real and disclosed in-product), and may contain AI errors despite the Service's citation-gating design. The Service's sanctions screening is name-based and indicative only, as set out in clause 7.7. Garuna does not warrant the accuracy, completeness, currency, or fitness of any Output and does not control or warrant data obtained from Independent Sources or third-party platforms.

12.3 Incorporation of Disclaimers. The Disclaimers & Legal Notices document is incorporated by reference and forms part of these Terms. In the event of any inconsistency between this clause 12 and the Disclaimers & Legal Notices on the scope of disclaimed warranties, the broader disclaimer permitted by applicable law applies.

12.4 Non-excludable rights. Nothing in these Terms excludes, restricts, or modifies any guarantee, warranty, right, or remedy that applies to the Client under applicable law and cannot lawfully be excluded, restricted, or modified. Where such a right cannot be excluded but can be limited, Garuna's liability is limited as permitted by that law.

13. Limitation of Liability

13.1 Exclusion of indirect damages. To the maximum extent permitted by applicable law, neither party will be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, goodwill, business, anticipated savings, or data, however caused and on any theory of liability, whether or not the party was advised of the possibility of such damages.

13.2 Cap on Garuna's liability. To the maximum extent permitted by applicable law, Garuna's total aggregate liability arising out of or related to these Terms and the Service will not exceed the greater of (a) the total fees paid by the Client to Garuna under these Terms in the twelve (12) months immediately preceding the event giving rise to the liability; or (b) CAD $50,000 (or, for the Early Access Period, the lower aggregate amount stated in clause 9 of the Early Access Terms, which prevails during the Early Access Period). This cap is a single, aggregate cap and is not multiplied by the number of claims, Sweeps, Subjects, or Authorised Users.

13.3 Client liability. The cap in clause 13.2 does not limit the Client's payment obligations under clause 10 or the Client's indemnification obligations under clause 14, which are not subject to any cap under these Terms.

13.4 Carve-outs. The exclusions in clause 13.1 and the cap in clause 13.2 do not apply to: (a) either party's breach of the other's intellectual-property rights; (b) a party's breach of its confidentiality obligations under clause 11 (other than relating to Personal Data, which is governed by the DPA); or (c) liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation. For the avoidance of doubt, Garuna's indemnity under clause 9.5 is subject to the cap in clause 13.2.

13.5 Allocation of risk. The Client acknowledges that the Output is intelligence to inform human judgement, that the Client is responsible for verifying it and for any decision it makes, and that the limitations in this clause 13 reflect a reasonable, commercially negotiated allocation of risk that is directly reflected in the price of the Service and is an essential basis of the bargain between the parties.

13.6 Consumer-law savings. If and to the extent the Client is entitled to any non-excludable statutory rights or remedies under applicable consumer-protection law, nothing in this clause 13 operates to exclude or limit those rights or remedies, and this clause 13 applies subject to them.

14. Indemnity

14.1 Client indemnity. The Client will defend, indemnify, and hold harmless Garuna and its affiliates, and their respective directors, officers, employees, and agents (each a "Garuna Indemnitee"), from and against any third-party claim, demand, action, or proceeding, and any resulting losses, damages, liabilities, fines, penalties, costs, and reasonable legal fees, to the extent arising out of or related to: (a) the Client's or any Authorised User's unlawful or unauthorised use of the Service or the Output; (b) the Client's breach of its warranties or responsibilities under clause 7 or its obligations under the AUP; (c) the absence of a lawful basis or authority for any Sweep or Subject; (d) any third-party platform terms-of-service breach or privacy, defamation, or other claim by or relating to a Subject or third party arising from the Client's instructions, Subject Inputs, Investigation Sessions, or use of the Output; or (e) any use of the Output as a consumer report or for an eligibility decision in breach of these Terms.

14.2 Procedure. The party seeking indemnification (the "Indemnitee") will (a) promptly notify the indemnifying party (the "Indemnitor") of the claim (provided that failure to do so will relieve the Indemnitor only to the extent it is materially prejudiced); (b) subject to clause 14.3, give the Indemnitor control of the defence and settlement; and (c) provide reasonable cooperation at the Indemnitor's expense. The Indemnitor may not settle any claim in a manner that imposes any liability, payment, admission of fault, injunction, or other non-monetary obligation on, or that releases or compromises any right of, the Indemnitee without the Indemnitee's prior written consent (not to be unreasonably withheld). The Indemnitee may participate in the defence with its own counsel at its own expense.

14.3 Garuna's right to control its own defence. Notwithstanding clause 14.2, where a claim indemnified by the Client under clause 14.1 names a Garuna Indemnitee as a party, alleges wrongdoing by Garuna, or implicates the design, operation, or reputation of the Service, Garuna may, by notice to the Client, elect to assume sole control (or, at its option, joint control) of the defence and settlement of that claim with counsel of its choosing, at the Client's reasonable expense, in which case the Client will provide reasonable cooperation and will not settle the claim without Garuna's prior written consent. Garuna's election under this clause 14.3 does not relieve the Client of its indemnification obligations under clause 14.1.

15. Term & Termination

15.1 Term. These Terms commence on acceptance and continue until terminated in accordance with this clause 15 (the "Term"). The Service is currently provided on an early-access basis by monthly membership; during the Early Access Period, the duration of the Client's access and its termination are governed by the Early Access Terms and by clause 10.1 (cancellation at period end), and Garuna may modify, suspend, or discontinue features during Early Access. After the Early Access Period, any continued use will be for the subscription term, renewal, and non-renewal notice period set out in an order form agreed by the parties.

15.2 Termination for cause. Either party may terminate these Terms on written notice if the other party materially breaches them and fails to cure the breach within thirty (30) days after written notice (or immediately, where the breach is incapable of cure), or if the other party becomes insolvent or subject to bankruptcy or similar proceedings.

15.3 Termination for unlawful use. Garuna may terminate these Terms immediately on notice if the Client or any Authorised User uses the Service for any unlawful purpose, breaches clause 6 or 7, or uses the Output as a consumer report or for an eligibility decision in breach of these Terms.

15.4 Effect of termination. On termination or expiry, the Client's licence and access to the Service end, and the Client must cease using the Service. Reports retained on Garuna's servers under the limited retention period described in the Privacy Policy are deleted on expiry of that period (or earlier on the Client's request); other transient operational data is handled as described in the DPA and Privacy Policy. Reports the Client has exported remain under the Client's control and responsibility.

15.5 Survival. Clauses that by their nature should survive termination survive, including clauses 1.3, 1.5, 2 (Definitions), 3.3 (restrictions), 5 (to the extent relating to past Investigation Sessions and Output the Client retains), 6 and 7 (to the extent the Client retains any exported Output), 8, 9, 10 (for amounts accrued), 11, 12 (including the incorporated Disclaimers & Legal Notices), 13, 14, 15.4, 15.5, and 17–24.

16. Suspension

16.1 Garuna may suspend the Client's or any Authorised User's access to the Service, in whole or in part, with notice where reasonably practicable, if: (a) Garuna reasonably believes the Service is being used for an unlawful purpose or in breach of clause 6 or 7; (b) continued use poses a security, legal, or operational risk to Garuna, the Service, a Subject, or a third party; (c) required by law or by a third-party platform or Sub-processor; or (d) the Client fails to pay undisputed amounts that remain overdue after notice. Garuna will restore access promptly once the cause of suspension is resolved. Suspension does not relieve the Client of its payment obligations for the period before suspension.

17. Changes to These Terms

17.1 Garuna may update these Terms and the incorporated policies from time to time. Garuna will provide notice of material changes by a reasonable means (for example, by email to the Client's administrative contact or by notice within the Service) and will update the version and Effective date. Changes take effect on the date stated in the notice; the Client's continued use of the Service after that date constitutes acceptance. If the Client does not agree to a material change, the Client's sole remedy is to stop using and terminate the Service before the change takes effect. Changes to Sub-processors are governed by the change-notice mechanism in the DPA and Sub-processor List.

18. Force Majeure

18.1 Neither party is liable for any delay or failure to perform (other than the Client's payment obligations) to the extent caused by events beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, labour disputes, governmental action, internet or telecommunications failures, power failures, and failures or changes of third-party services, Sub-processors, or Independent Sources. The affected party will use reasonable efforts to mitigate and resume performance.

19. Governing Law & Venue

19.1 These Terms are governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles.

19.2 The parties submit to the exclusive jurisdiction of the courts of the Province of Ontario, sitting in Toronto, and waive any objection to that venue, except that either party may seek injunctive or equitable relief in any court of competent jurisdiction. This clause 19.2 is the authoritative source of the forum/venue election for the Terms and the DPA.

19.3 The United Nations Convention on Contracts for the International Sale of Goods does not apply to these Terms.

20. Notices

20.1 Notices to Garuna. Legal notices to Garuna must be in writing and sent to [email protected] and, where an address is required, to Garuna Inc. (operating as "Garuna Group") at its registered office, 10 Thornmount Drive, Toronto, Ontario M1B 3J4, Canada. Data-protection and privacy matters may be directed to [email protected]; general and billing matters to [email protected].

20.2 Notices to the Client. Notices to the Client may be given to the administrative or billing contact the Client designates, including by email or by notice within the Service.

20.3 Notices are deemed received on delivery if by email (absent a delivery-failure notice) or on actual receipt if by other means.

21. Assignment

21.1 The Client may not assign or transfer these Terms or any rights or obligations under them, by operation of law or otherwise, without Garuna's prior written consent. Garuna may assign these Terms to an affiliate or in connection with a merger, acquisition, reorganisation, or sale of all or substantially all of its assets, on notice to the Client. Any purported assignment in breach of this clause is void. These Terms bind and benefit the parties and their permitted successors and assigns.

22. Relationship of the Parties

22.1 The parties are independent contractors. Nothing in these Terms creates any partnership, joint venture, agency, fiduciary, or employment relationship between them. Neither party may bind the other.

23. Third-Party Rights

23.1 Except for the Garuna Indemnitees referenced in clauses 9.5 and 14 (who may enforce those clauses), a person who is not a party to these Terms has no right to enforce any of their provisions.

24. General; Entire Agreement & Severability

24.1 Entire agreement and order of precedence. These Terms, together with the incorporated documents (the AUP, Privacy Policy, DPA, Disclaimers & Legal Notices, and Sub-processor List) and any order form, constitute the entire agreement between the parties regarding the Service and supersede all prior or contemporaneous understandings on that subject. In the event of conflict, the order of precedence is: (1) the DPA, on matters of personal-data processing; (2) the body of these Terms; (3) an executed order form, except where it expressly overrides these Terms on a specific commercial point, in which case that order form prevails on that point; and (4) the other incorporated policies. This precedence is consistent with the master-agreement statement in the header and with clause 8.2; an order form affects precedence only as stated in this clause 24.1.

24.2 Severability. If any provision of these Terms is held invalid or unenforceable, that provision will be limited or severed to the minimum extent necessary, and the remaining provisions remain in full force and effect.

24.3 Waiver. No failure or delay in exercising any right is a waiver of it, and no waiver is effective unless in writing.

24.4 No reliance. The Client acknowledges that, in entering into these Terms, it has not relied on any statement, representation, or warranty not expressly set out in these Terms.

24.5 Counterparts and electronic acceptance. These Terms may be accepted electronically or executed in counterparts, each of which is an original and all of which together constitute one agreement.

Garuna Group — Enhanced Due Diligence (EDD). Terms of Service / Master Services Agreement, Version 1.3, effective 2026-09-02. Master agreement: the AUP, Privacy Policy, DPA, Disclaimers & Legal Notices, and Sub-processor List are incorporated by reference and form part of these Terms.