Mendiola Platform Agreement

Updated: November 14, 2026

This Mendiola Platform Agreement sets the terms on which accounting firms use Mendiola to serve their own clients. Mendiola is sold only to accounting and bookkeeping firms. It is not offered to the firms' clients directly.

If you accept this Agreement for a firm or other organisation, you confirm that you have authority to bind it. If you don't have that authority, you accept it personally.

1. Definitions

"Agreement" means these terms, the Data Processing Agreement in Annex 1, every Order Form that refers to these terms, and any written usage policies we give you for the Mendiola Platform.

"AI Output" means any proposal, match, classification, draft entry, draft journal, computed figure, tax position, summary or other content that the Mendiola Platform generates using automated or machine-learning methods, including large language models.

"Bank Connection" means a connection between a Client's bank or card account and the Mendiola Platform, made through Plaid.

"Client" means a business or individual that you serve using the Mendiola Platform.

"Client Data" means all data that you, your Users, a Client or anyone acting for you or a Client puts into the Mendiola Platform, or that the Mendiola Platform receives for you from a Third-Party Service (including Jaz and Plaid). Client Data includes the Activity Log entries about your Clients.

"Client User" means an employee or contractor of a Client whom you invite to use the client-facing features of the Mendiola Platform.

"Data Processing Agreement" or "DPA" means the agreement in Annex 1.

"Activity Log" means the append-only record kept by the Mendiola Platform of changes made in it, and who or what made each one (a User or the Mendiola Platform's automated features).

"Documentation" means the user guides, help articles, checklists, specifications and other material about the Mendiola Platform that we make available to you, as updated from time to time.

"Force Majeure" means an event beyond a party's reasonable control, such as a natural disaster, epidemic, war, terrorism, civil unrest, government action, or an outage of a utility, internet or hosting provider that the party could not reasonably have avoided.

"Intellectual Property Rights" means patents, copyrights, moral rights, trade marks, service marks, trade secrets, know-how, design rights, database rights, domain names and all similar rights anywhere in the world.

"Jaz" means the third-party accounting platform on which Clients' books are kept, operated by its provider. In the Philippines Jaz is offered as Juan. Jaz is a Third-Party Service.

"Jurisdiction Setting" means the jurisdiction (currently the United States or the Philippines) selected for your firm in the Mendiola Platform, which determines which tax, currency and regulatory features are switched on.

"Mendiola Data" means data about the configuration, performance and use of the Mendiola Platform, the Documentation, and other information we make available to you through the Mendiola Platform, but not Client Data.

"Mendiola Platform" or "Mendiola" means the websites at mendiola.io and app.mendiola.io, the cloud software, AI features, workflows (including the firm queue, month-end close, invoice vouching and the Bank module), integrations, the Activity Log, and the related technology and materials we provide under this Agreement.

"Order Form" means an ordering document or online order, signed or accepted by both parties, that sets out the subscription, Fees and term.

"Plaid" means Plaid Inc. and its affiliates, which provide the service that connects Clients' bank and card accounts. Plaid is a Third-Party Service.

"Privacy Policy" means the Double Rule LLC Privacy Policy at mendiola.io/privacy (the same policy is served on doublerule.com), as updated from time to time.

"Third-Party Service" means any software, data source, cloud service, integration or professional service provided by someone other than us, including Jaz and Plaid. Its provider is a "Third-Party Provider".

"User" means a person to whom you, or we at your request, have issued credentials for the Mendiola Platform. Users are either your own staff and contractors ("Your Users") or Client Users.

"we", "us" or "our" means Double Rule LLC, 5555 Corporate Ave., Suite 200, Cypress, CA 90630, USA.

"you", "your" or "Customer" means the firm named in the Order Form.

Other capitalised words have the meanings given where they first appear.

2. The Mendiola Platform

2.1 Access and Client licences. While this Agreement is in force and you are paid up, we grant:

• (a) Your Users a non-exclusive, non-transferable, non-sublicensable right to access and use the Mendiola Platform and Documentation, only to serve your Clients; and
• (b) Client Users a right to use the client-facing features of the Mendiola Platform.

Client licences are bought for the term stated in the Order Form. If a Client stops working with you, you may reassign its licence to another Client for the rest of that term. Client licences can't be cancelled or refunded during their term, except where you end this Agreement because of our uncured material breach. A Client licence covers one Client organisation in Jaz.

2.2 Availability. We will use commercially reasonable efforts to keep the Mendiola Platform available, apart from planned maintenance, Force Majeure events and outages of Third-Party Services. We will try to schedule planned maintenance outside normal working hours. We don't offer an uptime commitment or service credits.

2.3 Data security. We will run and keep up to date a written information security program to protect Client Data. It will include reasonable administrative, technical and physical safeguards designed to:

• (a) protect the confidentiality, integrity and availability of Client Data;
• (b) restore access to Client Data in a reasonable time after a physical or technical incident; and
• (c) dispose of Client Data securely when it is no longer needed.

Our current measures are described on the Mendiola Security page (mendiola.io/security). We may change them, but we won't materially reduce the overall protection of Client Data during your subscription. We will notify you of a security incident affecting Client Data as set out in section 6 of the DPA.

2.4 Your responsibilities. You are responsible for:

• (a) onboarding your Clients, using the training and Documentation we provide;
• (b) setting up roles, permissions and internal procedures so the Mendiola Platform is used safely;
• (c) keeping the credentials of Your Users confidential, and having Your Users use the multi-factor sign-in the Mendiola Platform offers;
• (d) everything Users do in the Mendiola Platform, and their compliance with this Agreement;
• (e) choosing and maintaining the right Jurisdiction Setting for your firm; and
• (f) reviewing AI Output as section 2.8 requires.

If a Client can't be onboarded for reasons outside our control (for example, because the Client won't move its books to Jaz or won't authorise a Bank Connection), we are not responsible for that and owe no refund. Tell us promptly if you know or suspect that a User account has been compromised.

2.5 Jaz and other Third-Party Services. The Mendiola Platform works on Clients' books kept in Jaz organisations, and with no other ledger.

• (a) Your Jaz access. You need a Jaz organisation for each Client you serve on Mendiola, and you or the Client must hold the right to connect it. You or the Client contract with Jaz directly; Jaz access is not part of the Mendiola subscription.
• (b) Third-Party terms. Your use of Jaz, Plaid and any other Third-Party Service is governed by that provider's own terms and privacy policy, not by this Agreement. We don't control Third-Party Services and aren't responsible for their availability, security, accuracy or changes, or for the data they hold.
• (c) Data in Jaz. Client books written to Jaz through the Mendiola Platform are stored in Jaz. Ending this Agreement doesn't delete them from Jaz; your and your Clients' arrangements with Jaz govern that.
• (d) If a Third-Party Service changes. If a Third-Party Provider stops offering, changes or restricts its service in a way that stops a Mendiola feature working, we will tell you and work on a reasonable alternative. If none is available and the loss is material, either party may end the affected Order Form, and we will refund prepaid Fees for the unused period.

2.6 Bank Connections.

• (a) Bank Connections are available only where your Jurisdiction Setting is the United States, and only once we have made them available to your firm.
• (b) A Client authorises each Bank Connection itself, through Plaid's own interface, and under Plaid's terms. You are responsible for obtaining that authorisation and any consent the Client needs to give you.
• (c) Bank Connections are read-only. They bring account details, balances and posted transactions into the Mendiola Platform for you to view and export; they don't write to Jaz, and they can't be used to move money. The Client signs in to its bank through Plaid: we never see or store its bank sign-in credentials, and we don't receive full account or routing numbers.
• (d) Your firm's admins may disconnect a Bank Connection at any time in the Mendiola Platform, and a Client may ask you to do so. A disconnection is final; connecting again means a new authorisation.
• (e) You must use bank data received through Plaid only to provide your services to that Client.

2.7 The Activity Log. The Mendiola Platform records, in the Activity Log, changes made in it and who or what made each one, whether a User or an automated feature. Entries can't be edited or deleted by Users once written. Your firm's admins can view it while this Agreement is in force. The Activity Log is a working record to support your review. It is not a substitute for your own working papers or for any record that law or professional standards require you to keep.

2.8 AI Output and human review. The Mendiola Platform proposes work; your firm decides.

• (a) You must have a qualified member of your staff review AI Output before relying on it, giving it to a Client, posting it, or filing it with any tax authority or regulator.
• (b) Some features act on a schedule or without a click from a User, but only where you switch them on for a company. For example, the automated close checks a company's books on its schedule and proposes bank matches and accrual drafts, which are posted only when a User approves them; and a company may be set to send documents to Jaz automatically. If you switch on any automatic mode, you are instructing us to let the Mendiola Platform take those actions for you, and you remain responsible for reviewing the results.
• (c) AI Output can be wrong, incomplete or out of date, including about tax rules.

2.9 Restrictions. Unless we agree in writing beforehand, you and Users must not:

• (a) make the Mendiola Platform or Documentation available to anyone other than Users, run it as a service bureau for other firms, or get around any usage limit;
• (b) reverse engineer it, try to derive its source code or models, or scan, probe or test it for vulnerabilities (except good-faith security research reported to connect@mendiola.io before anything is disclosed);
• (c) copy, modify or create derivative works of it or the Documentation;
• (d) remove proprietary notices;
• (e) frame or mirror any part of it;
• (f) use it in a way that harms its security, integrity or availability, including by automated scraping or by sending excessive requests;
• (g) use it to send spam or unsolicited messages in breach of law;
• (h) enter government identification numbers (such as US Social Security numbers or Philippine TINs), full bank or card numbers or other sensitive data anywhere other than the fields designed for them;
• (i) upload material that infringes anyone's rights, or that contains malicious code; or
• (j) use it for anything unlawful.

You must not knowingly help anyone else do any of these things.

2.10 Support and training. We will give Your Users reasonable training on onboarding Clients and using the Mendiola Platform, and reasonable support during business hours in the Philippines and the United States, through connect@mendiola.io. We don't have to support Third-Party Services, or build or support customisations, unless an Order Form says so.

3. Professional standards and conduct

3.1 Your practice is yours. You alone are responsible for your professional services to your Clients. That includes:

• (a) holding every licence, registration, permit and accreditation you need wherever you practise, for example with a state board of accountancy, the IRS (PTIN or other credentials), the Philippine Professional Regulation Commission or the Bureau of Internal Revenue;
• (b) meeting the professional, ethical and quality standards that apply to you;
• (c) your engagement letters with Clients, which should describe your use of technology providers such as Mendiola, Jaz and Plaid where the law or your professional rules require it;
• (d) obtaining any Client consent you need, including consent to disclose or use tax return information where IRC §7216 or similar rules apply; and
• (e) every return, report, statement or filing you prepare or submit.

3.2 Your conduct. You agree to:

• (a) serve your Clients with due care and in line with the standards of your profession;
• (b) tell us promptly about problems Users find in the Mendiola Platform or Documentation;
• (c) not make false or misleading statements about us or the Mendiola Platform; and
• (d) not promise Clients or others anything about the Mendiola Platform's features, security or performance beyond what this Agreement and our written materials say.

3.3 Our promise not to compete for your Clients.

We run our own bookkeeping and accounting practice, which serves small businesses that could also be your Clients. To keep that practice separate from Mendiola, we promise that:

• (a) we will not use Client Data, Mendiola Data about your firm, or anything we learn by operating the Mendiola Platform for you, to identify, market to, solicit or onboard any of your Clients for our own practice or anyone else's;
• (b) we will not knowingly solicit any of your Clients for bookkeeping, accounting, payroll, tax or advisory services while this Agreement is in force and for 12 months after it ends;
• (c) we will not market Mendiola to your Clients or contact them about Mendiola, except as needed to provide support or a Bank Connection to Client Users at your request;
• (d) our own practice uses the Mendiola Platform as a separate firm and, like any other firm, can't see your firm's data through it; and
• (e) Client Data will never be used to train, tune or evaluate anything for our own practice's marketing.

This doesn't stop us from general advertising that isn't aimed at your Clients, or from serving a business that comes to us on its own initiative without any solicitation by us. A breach of this section 3.3 is a material breach of this Agreement.

4. Trials

We may give you, and some of your Clients, free or temporary access to the Mendiola Platform for evaluation or a pilot (a "Trial"). A Trial ends on the earliest of: the end date we give you; the start of a paid subscription covering it; or, for a free Trial, when either party ends it by notice.

Client Data entered during a Trial will be deleted after the Trial ends unless you buy a subscription that covers it or export it before the Trial ends. Entries already written to Jaz stay in Jaz. During a Trial, the Mendiola Platform is provided "as is", without any warranty, indemnity or liability on our part, to the extent the law allows. Our duties of confidentiality (section 7) and under the DPA still apply during a Trial.

5. Fees

5.1 Fees. You will pay the fees in each Order Form ("Fees"). Unless the Order Form says otherwise:

• (a) Fees are invoiced monthly in advance and due within 30 days of invoice;
• (b) Fees are in US dollars where your Jurisdiction Setting is the United States and in Philippine pesos where it is the Philippines, and exclude taxes, which you pay (other than taxes on our income);
• (c) Fees already paid are non-refundable and non-creditable, except where this Agreement says otherwise; and
• (d) renewals are at our list price at the time, and discounts don't carry over to a renewal.

5.2 Third-Party costs. Each party pays its own Third-Party costs. In particular, you are responsible for any fees Jaz charges for your Clients' organisations. Plaid's charges for Bank Connections are ours.

5.3 Non-payment. Failing to pay amounts due is a material breach. If an amount is 30 or more days overdue, we may suspend access after giving you 10 days' written notice. During any suspension, you can still export Client Data on request.

6. Proprietary rights and data

6.1 The Mendiola Platform. As between us, we own all rights, including Intellectual Property Rights, in the Mendiola Platform, the Documentation and Mendiola Data. We keep every right not expressly granted to you.

6.2 Feedback. If you or your Users give us ideas, suggestions or other feedback about the Mendiola Platform, we may use it for any purpose, without obligation to you, under a worldwide, perpetual, irrevocable, royalty-free licence. We won't name you as the source without your consent.

6.3 Client Data. As between us, you (or your Client) own Client Data. You grant us a limited right to host, copy, process, transmit and display Client Data only to provide, secure and support the Mendiola Platform for you, to meet our obligations under this Agreement and the law, and as your instructions direct. We will handle Client Data as set out in this Agreement, the DPA and the Privacy Policy. If this Agreement or the DPA conflicts with the Privacy Policy about Client Data, this Agreement and the DPA prevail.

6.4 AI and Client Data.

• (a) The Mendiola Platform sends parts of Client Data to the large language model providers listed in the DPA so that it can generate AI Output for you.
• (b) We don't use Client Data to train or fine-tune AI models.
• (c) What the Mendiola Platform learns from your firm's work, such as lessons your admins publish and spreadsheet layouts it learns, stays within your firm. Only guidance we publish ourselves is shared across firms, and it carries no Client Data.

6.5 Usage data. We may collect technical and usage information from the operation of the Mendiola Platform, such as metadata, performance figures and feature usage ("Usage Data"), and use it to run, secure, support, bill for and improve the Mendiola Platform. Usage Data doesn't include the content of Client Data. Except to provide the Mendiola Platform, calculate Fees, administer Third-Party Services or comply with law, we will disclose Usage Data outside Double Rule LLC only in aggregated form that doesn't identify you, any User, any Client or any other person. Section 3.3 also applies to Usage Data.

6.6 Privacy. Each party will comply with the DPA. References in the DPA to "the Agreement" mean this Agreement.

7. Confidentiality

7.1 What is confidential. "Confidential Information" means information one party (the "Discloser") gives the other (the "Recipient") that is marked confidential, or that a reasonable person would understand to be confidential. The Mendiola Platform, Documentation, Mendiola Data and the terms of any Order Form are our Confidential Information. Client Data is your Confidential Information.

7.2 What isn't. Confidential Information doesn't include information that the Recipient:

• (a) already knew without a duty of confidence;
• (b) that is or becomes public through no fault of the Recipient;
• (c) receives lawfully from a third party free to disclose it;
• (d) develops independently without using the Discloser's information; or
• (e) is authorised in writing by the Discloser to release.

7.3 How it is protected. The Recipient will protect the Discloser's Confidential Information with at least the care it uses for its own similar information, and never less than reasonable care. It will use that information only for this Agreement. It may share it only with its employees, contractors and service providers (including subprocessors under the DPA) who need it for this Agreement and are bound by confidentiality duties at least as protective as these. The Recipient is responsible for their compliance.

7.4 Legally required disclosure. The Recipient may disclose Confidential Information if a law, regulator, subpoena or court order requires it. Where the law allows, it will first tell the Discloser and give reasonable help, at the Discloser's cost, to seek a protective order or limit the disclosure. Where the request is for Client Data, we will first try to redirect the requester to you, including where a tax authority (such as the IRS or the BIR) makes the request.

7.5 Injunctive relief. A breach of this section 7 may cause harm that money can't fix. The Discloser may seek an injunction or other equitable relief without proving actual damages or posting a bond, in addition to any other remedy.

8. Term, termination and wind-down

8.1 Term. This Agreement starts when you first accept it or sign an Order Form, and continues while any Order Form is in effect. Unless an Order Form says otherwise, each subscription runs for one month and renews automatically for one month at a time unless either party gives notice of non-renewal before the end of the current month.

8.2 Termination. Either party may end this Agreement or an Order Form by written notice:

• (a) by giving notice of non-renewal under section 8.1;
• (b) if the other party materially breaches this Agreement and, where the breach can be fixed, doesn't fix it within 30 days of receiving notice describing it;
• (c) if the other party becomes insolvent, enters bankruptcy, receivership, liquidation or a similar proceeding, or makes an assignment for the benefit of creditors; or
• (d) if you are an individual practitioner, on your death or a disability that permanently prevents you from practising.

We may also end this Agreement on notice if Fees are 30 or more days overdue.

8.3 Effect of termination. When this Agreement or an Order Form ends:

• (a) the rights granted under it end, and Users lose access, except for the export access in section 8.5;
• (b) if you ended it for our uncured material breach, or under section 2.5(d), we will refund prepaid Fees for the unused period;
• (c) rights, duties (including payment duties) and liabilities that arose before it ended are unaffected;
• (d) we will disconnect your Clients' Bank Connections and delete the Jaz API keys we hold for your Clients; and
• (e) each party will, on the other's request, return or destroy the other's Confidential Information.

A party may keep Confidential Information (other than Client Data, which section 8.5 and the DPA govern) where the law requires, or in routine backups until they are overwritten in the normal course. Retained information stays confidential while it is kept.

8.4 Survival. These survive the end of this Agreement:

• the DPA, for as long as we hold Client Data;
• sections 1, 3.3 (for the period stated there), 5 (for amounts owed), 6, 7, 8.3 to 8.5, and 9 to 12.

When this Agreement ends, you must stop using our trade marks, and remove any Mendiola logos and marketing material we gave you from places you control.

8.5 Wind-down, export and deletion.

• (a) Cooperation. The parties will cooperate reasonably to wind down the relationship in an orderly way.
• (b) Export window. For 90 days after this Agreement ends, you may export Client Data held in the Mendiola Platform, in the formats it offers (such as CSV), or ask us to export it for you. Client books held in Jaz stay in Jaz and are not affected.
• (c) Deletion. We will delete Client Data held in the Mendiola Platform within 30 days after the export window ends, except where the law requires us to keep it, and as section 8 of the DPA describes for backups.
• (d) After deletion. After that, we have no duty to keep or provide Client Data.

9. Warranties and disclaimers

9.1 Authority. Each party confirms that it has the authority to enter into and perform this Agreement.

9.2 Right to practise. You confirm that you and Your Users hold all licences, registrations and permits needed to serve your Clients where you operate.

9.3 Platform warranty. We warrant that, during your subscription, the Mendiola Platform will perform materially as described in the Documentation. If it doesn't, and you tell us in writing, we will use reasonable efforts to correct the failure. If we can't do so within 30 days, either party may end the affected Order Form, and we will refund prepaid Fees for the unused period. That is your only remedy for breach of this warranty.

9.4 AI Output. We use commercially reasonable methods to produce AI Output, but we don't warrant that it is accurate, complete or fit for any purpose. AI Output doesn't replace the review section 2.8 requires, or your professional judgment.

9.5 No professional advice. We provide software. We don't provide accounting, audit, bookkeeping, tax, financial, investment or legal advice or services to you, your Clients or anyone else through the Mendiola Platform. That includes the Philippine tax features (such as BIR computations and exposure checks) and any US tax features. Our own bookkeeping practice doesn't act for your Clients because you use Mendiola, and we have no professional relationship with your Clients.

9.6 Disclaimer. EXCEPT AS THIS AGREEMENT EXPRESSLY STATES, AND TO THE FULLEST EXTENT THE LAW ALLOWS:

• (a) THE MENDIOLA PLATFORM, DOCUMENTATION, AI OUTPUT AND ANY SERVICES WE PROVIDE ARE PROVIDED "AS IS" AND "AS AVAILABLE", FOR YOUR INTERNAL BUSINESS USE;
• (b) WE, AND OUR LICENSORS AND SUPPLIERS, DISCLAIM ALL OTHER WARRANTIES, CONDITIONS AND REPRESENTATIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE;
• (c) WE DON'T WARRANT THAT THE MENDIOLA PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT IT OR ANY AI OUTPUT WILL MEET YOUR REQUIREMENTS OR PRODUCE ANY PARTICULAR RESULT; AND
• (d) WE ARE NOT RESPONSIBLE FOR PROBLEMS CAUSED BY CLIENT DATA, THIRD-PARTY SERVICES (INCLUDING JAZ AND PLAID), OR THIRD-PARTY PROVIDERS.

10. Indemnification

10.1 Our indemnity. We will defend you, and your officers, directors, employees and agents, against any third-party claim that the Mendiola Platform, as we provide it, infringes or misappropriates that third party's Intellectual Property Rights. We will pay any settlement we agree to and any damages finally awarded against you on that claim.

We have no obligation to the extent the claim arises from:

• (a) a change to the Mendiola Platform not made by us, or made at your direction;
• (b) its combination with anything we didn't supply (including Third-Party Services), where the claim relates to that combination;
• (c) Client Data; or
• (d) use that breaches this Agreement or the Documentation.

If the Mendiola Platform is, or we think it may be, subject to such a claim, we may:

• obtain the right for you to continue using it;
• modify it so it doesn't infringe, without materially reducing its function; or
• if neither is reasonably possible, end the affected Order Form and refund prepaid Fees for the unused period.

10.2 Your indemnity. You will defend us, and our officers, directors, employees and agents, against any third-party claim, including a claim by a Client or a regulator's investigation, arising from:

• (a) your services to your Clients, including any return, filing, report or advice;
• (b) a breach of law by you, your Clients or your Users;
• (c) your failure to obtain a consent or authorisation that section 2.6 or 3.1 makes your responsibility; or
• (d) your marketing or description of the Mendiola Platform in breach of this Agreement.

You will pay any settlement you agree to and any damages finally awarded against us on that claim.

10.3 Procedure. The party seeking defence must:

• (a) tell the defending party promptly in writing about the claim (a delay only reduces the defending party's duties to the extent it is prejudiced);
• (b) give the defending party sole control of the defence and settlement; and
• (c) give reasonable help, at the defending party's cost.

The defending party may not settle in a way that admits fault for, or places duties on, the other party without that party's written consent, which it won't unreasonably withhold. The other party may join with its own counsel at its own cost.

11. Limitation of liability

11.1 Excluded damages. TO THE FULLEST EXTENT THE LAW ALLOWS, AND EXCEPT FOR THE EXCLUSIONS IN SECTION 11.3, NEITHER PARTY IS LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL OR DATA, HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, EVEN IF IT WAS TOLD THEY WERE POSSIBLE.

11.2 Cap. TO THE FULLEST EXTENT THE LAW ALLOWS, AND EXCEPT FOR THE EXCLUSIONS IN SECTION 11.3, EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID AND PAYABLE TO US UNDER THIS AGREEMENT IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. IF THE EVENT OCCURS IN THE FIRST 12 MONTHS, THE CAP IS THE FEES PAID AND PAYABLE FOR THAT PERIOD.

11.3 Exclusions. Sections 11.1 and 11.2 don't limit:

• (a) either party's defence and payment duties under section 10;
• (b) your duty to pay Fees;
• (c) your breach of section 2.9 or of our Confidential Information; or
• (d) liability that the law doesn't allow to be limited, such as liability for fraud.

11.4 Scope. These limits apply to every kind of claim, whether in contract, tort (including negligence), breach of statutory duty or otherwise. The Fees reflect this allocation of risk. A party can't avoid these limits, or recover twice, by bringing several claims.

12. General

12.1 Sanctions and anti-corruption. Each party will comply with applicable sanctions, export control, anti-bribery, anti-corruption and anti-tax-evasion laws, including those administered by the US Office of Foreign Assets Control (OFAC). Each party confirms that it isn't on any sanctions or denied-party list. You won't let Users access the Mendiola Platform from any country or region subject to comprehensive US sanctions. A breach of this section is a material breach.

12.2 Regulated data. The Mendiola Platform isn't designed for protected health information, and we don't represent that it meets the requirements of the US Health Insurance Portability and Accountability Act (HIPAA). Don't put protected health information into it unless we have first agreed in writing to the terms the law requires. If HIPAA applies to you, tell us before you accept this Agreement, or within 30 days of it starting to apply.

12.3 Unfair competition. You won't use the Mendiola Platform, Documentation or our Confidential Information to build or help build a competing product, or to benchmark Mendiola against another product for publication, without our written consent.

12.4 Governing law and disputes.

• (a) Governing law. California law governs this Agreement, without regard to its conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods doesn't apply.
• (b) Arbitration. Any dispute arising out of or relating to this Agreement will be resolved by final and binding arbitration before a single arbitrator, administered by JAMS, seated in Orange County, California, under its Comprehensive Arbitration Rules and Procedures, with their Expedited Procedures.
• (c) No representative actions. Each party brings claims only individually and not in any class, collective or representative proceeding.
• (d) Arbitrability. The arbitrator decides questions of arbitrability.
• (e) Enforcement. Judgment on the award may be entered in any court with jurisdiction.
• (f) Court relief. Either party may seek injunctive or other urgent relief in court. For that purpose, the parties submit to the exclusive jurisdiction of the state and federal courts in Orange County, California.
• (g) Every firm. This section 12.4 applies to every firm, whatever its Jurisdiction Setting.

12.5 Notices.

• (a) Notices from us. We may send you notices by email to the address on your account, or in the Mendiola Platform. Keep that address current.
• (b) Notices to us. Send legal notices to connect@mendiola.io, with a copy by post or courier to Double Rule LLC, 5555 Corporate Ave., Suite 200, Cypress, CA 90630, USA.
• (c) When notices take effect. Unless this Agreement says otherwise, notices must be in writing. A notice is received:
  • (i) by post, 72 hours after posting (or 7 days for international post);
  • (ii) by courier, on delivery; and
  • (iii) by email, at 9 a.m. in the recipient's time zone on the next business day after sending, or earlier if the recipient confirms receipt.

12.6 Changes to these terms.

• (a) How we change them. We may update these terms from time to time. We will tell you about material changes by email or in the Mendiola Platform before they take effect. If you keep using the Mendiola Platform after that, you accept the updated terms.
• (b) Objecting. If a change materially harms you, you may object in writing to connect@mendiola.io within 30 days of our notice.
• (c) If we can't accommodate the objection. The previous terms will continue to apply to you until the end of your current subscription term. Renewals are on the terms current at the time.

12.7 Miscellaneous.

• (a) Assignment. You may not assign or transfer this Agreement, or any right or claim under it, without our prior written consent. Any attempt to do so is void. We may assign this Agreement on written notice to an affiliate or to a successor to the Mendiola business, provided the assignee takes on our duties under this Agreement, including section 3.3 and the DPA.
• (b) Entire agreement. This Agreement is the parties' whole agreement on its subject and replaces all earlier agreements, proposals and discussions about it. Terms in your purchase orders or similar documents (other than Order Forms) have no effect. Neither party relies on any statement not set out in this Agreement, but nothing limits liability for fraud.
• (c) Order of precedence. If documents conflict, this order applies:
  1. the Order Form;
  2. the DPA;
  3. these terms;
  4. the Documentation.
• (d) Severability. If a court or arbitrator holds a provision unenforceable, it will be enforced to the maximum extent possible, and the rest of this Agreement stays in effect.
• (e) Independence. The parties are independent contractors. Neither is the other's agent, partner, joint venturer, franchisee or employee, and neither can bind the other.
• (f) Waiver. Failing to enforce a right isn't a waiver. A waiver must be in writing.
• (g) Third parties. No one other than the parties may enforce this Agreement.
• (h) Force Majeure. Neither party is liable for a delay or failure caused by Force Majeure, other than a failure to pay.
• (i) Publicity. While you have paying Clients on the Mendiola Platform, we may name you as a customer and show your logo in our marketing, in a way that doesn't suggest you endorse us. You can withdraw this permission by email at any time.
• (j) Interpretation. Headings are for convenience only. "Including" and "such as" mean "without limitation". This Agreement won't be read against the party that drafted it.

---

Annex 1: Data Processing Agreement (Mendiola Platform)

This Data Processing Agreement ("DPA") forms part of the Mendiola Platform Agreement between Double Rule LLC ("we") and the Customer ("you"). It applies whenever we process personal information contained in Client Data for you. Each party will act reasonably and in good faith under it.

1. Definitions

Capitalised words not defined here have the meanings given in the Agreement.

"Applicable Data Protection Law" means every law that applies to the processing of Client Personal Data under the Agreement, including:

• (a) the CCPA and other US state privacy laws that require contract terms between a business or controller and its service provider or processor (together, "US Privacy Laws");
• (b) the Philippine Data Privacy Act;
• (c) the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, to the extent they apply to you; and
• (d) other laws on the security of personal information or notification of breaches.

"CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended (including by the California Privacy Rights Act of 2020), and its regulations.

"Client Personal Data" means any personal information (as the CCPA defines it) or personal data or personal information (as the Philippine Data Privacy Act or other Applicable Data Protection Law defines it) that is part of Client Data.

"FTC Safeguards Rule" means the Standards for Safeguarding Customer Information, 16 CFR Part 314.

"Personal Information Controller" and "Personal Information Processor" have the meanings given in the Philippine Data Privacy Act.

"Philippine Data Privacy Act" means the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the circulars and other issuances of the National Privacy Commission ("NPC").

"Process" (and its variants) means any operation performed on data, by automated means or not, such as collection, recording, organisation, storage, retrieval, use, disclosure, transfer, combination, restriction, erasure or destruction.

"Security Incident" means a breach of security that leads, or is reasonably likely to have led, to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data while it is held by us or our Subprocessors.

"Service Provider", "Business", "Business Purpose", "Sell" and "Share" have the meanings given in the CCPA.

"Subprocessor" means a third party we engage that Processes Client Personal Data on our behalf to provide the Mendiola Platform.

2. Roles and scope

2.1 Roles.

• (a) For Client Personal Data, you are the Business, controller or Personal Information Controller, or you act as the Service Provider, processor or Personal Information Processor of your Client.
• (b) We act as your Service Provider, processor and Personal Information Processor. Where you act for your Client, we are your sub-processor, or sub-contracted Personal Information Processor.

2.2 Details of processing. Appendix A describes the subject matter, nature, purpose and duration of the processing, the kinds of personal information, and the people it concerns.

2.3 Your instructions. We will Process Client Personal Data only:

• to provide the Mendiola Platform under the Agreement;
• on your documented instructions; or
• where the law requires (in which case we will tell you first, unless the law forbids it).

The Agreement, your configuration of the Mendiola Platform (including the Jurisdiction Setting and any automatic modes you switch on), and actions your Users take in it are your documented instructions. If we believe an instruction breaks Applicable Data Protection Law, we will tell you, and we may decline to follow it.

2.4 Your obligations. You are responsible for:

• (a) having a lawful basis, and all notices and consents required, for us to Process Client Personal Data under the Agreement, including telling your Clients that you use technology providers such as Mendiola, Jaz and Plaid where the law requires it;
• (b) the accuracy of Client Personal Data and the lawfulness of your instructions; and
• (c) your own compliance with Applicable Data Protection Law, including any duties you owe your Clients as their service provider or processor.

3. United States: CCPA service-provider terms

To the extent US Privacy Laws apply to Client Personal Data, we:

• (a) will not Sell or Share Client Personal Data;
• (b) will not retain, use or disclose Client Personal Data for any purpose (including any commercial purpose) other than the Business Purposes in Appendix A, or as the CCPA otherwise allows a Service Provider;
• (c) will not retain, use or disclose Client Personal Data outside our direct business relationship with you;
• (d) will not combine Client Personal Data with personal information we receive from or for anyone else, or collect from our own interactions with consumers, except as the CCPA allows a Service Provider. In particular, we will never combine it with data held by our own bookkeeping practice (see section 3.3 of the Agreement);
• (e) will comply with the duties that US Privacy Laws place on Service Providers and processors, and give Client Personal Data the level of privacy protection they require;
• (f) will tell you within 5 business days if we determine that we can no longer meet our obligations under US Privacy Laws;
• (g) agree that you may take reasonable and appropriate steps to make sure we use Client Personal Data consistently with your obligations under US Privacy Laws, and, on notice, to stop and remediate any unauthorised use; and
• (h) certify that we understand and will comply with the restrictions in this section 3.

This section 3 also serves as the processor contract required by other US state privacy laws, such as Virginia's Consumer Data Protection Act, to the extent they apply.

4. Philippines: Personal Information Processor terms

To the extent the Philippine Data Privacy Act applies to Client Personal Data, we will, as your Personal Information Processor:

• (a) Process Client Personal Data only on your documented instructions, as section 2.3 describes;
• (b) make sure everyone we authorise to Process it is bound by confidentiality;
• (c) apply the organisational, physical and technical security measures described in section 6 and Appendix B;
• (d) engage Subprocessors only as section 5 allows, and on terms that give at least the same protection as this DPA;
• (e) help you, as far as reasonably possible, to respond to requests from people exercising their rights as data subjects;
• (f) help you meet your duties on security, breach notification and privacy impact assessments, taking into account the information available to us;
• (g) at your choice, delete or return Client Personal Data when the Agreement ends, as section 8 describes;
• (h) make available the information reasonably needed to show compliance with this section 4, and allow reasonable audits as section 9 describes; and
• (i) tell you straight away if we believe an instruction from you breaches the Philippine Data Privacy Act.

5. Subprocessors

5.1 Authorisation. You authorise us to use the Subprocessors listed in Appendix C. We will:

• (a) have a written contract with each Subprocessor that requires protection of Client Personal Data at least as strong as this DPA, as far as relevant to its service; and
• (b) remain responsible to you for each Subprocessor's performance of those duties.

5.2 Changes. We will tell you at least 30 days before adding or replacing a Subprocessor, by email or by updating Appendix C. You may object on reasonable data-protection grounds within that period. If we can't reasonably address the objection, you may end the affected Order Form on written notice, and we will refund prepaid Fees for the unused period.

5.3 Third-Party Services you choose. You or your Client contract with Jaz directly, so Jaz acts under its own terms with you or the Client, as an independent Third-Party Provider, not as our Subprocessor. Plaid connects Bank Connections for us and is listed in Appendix C; a Client's authorisation of a Bank Connection is also governed by Plaid's own terms.

6. Security and Security Incidents

6.1 Security measures. We will keep in place the security measures described in section 2.3 of the Agreement and Appendix B. They are designed to:

• (a) meet the standards of Applicable Data Protection Law; and
• (b) where you are a financial institution under the FTC Safeguards Rule, let you oversee us as your service provider as 16 CFR 314.4(f) requires.

6.2 Notice to you. If we become aware of a Security Incident, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it.

• (a) Where we send it. We will notify the account owner and any security contact you give us.
• (b) What we tell you. As far as we know at the time, we will include:
  • a description of the incident;
  • the kinds of data and the approximate number of Clients and individuals affected;
  • the likely consequences;
  • what we have done and propose to do; and
  • a contact for more information.
• (c) Updates. We will send updates as we learn more.

6.3 Supporting your obligations. We will cooperate with you and give you the information you reasonably need to meet your own notification and reporting duties. Depending on who is affected, these may include:

• (a) notice to the FTC under the FTC Safeguards Rule (16 CFR 314.4(j));
• (b) notices to individuals and state attorneys general under state breach-notification laws, such as Cal. Civ. Code § 1798.82;
• (c) notices to the NPC and affected data subjects under the Philippine Data Privacy Act; and
• (d) notices to tax authorities, such as the IRS, where tax information is involved.

Unless the law requires us to, or you ask us in writing, we will not notify your Clients, affected individuals or regulators about a Security Incident affecting Client Personal Data. Where we must notify, we will tell you first if the law allows.

6.4 Not an admission. Notifying you of, or responding to, a Security Incident is not an admission of fault or liability.

7. Requests from individuals and authorities

7.1 Requests from individuals. If we receive a request from an individual about Client Personal Data (for example, to access, correct or delete it), we will:

• (a) refer the request to you within 5 business days, unless the law requires otherwise; and
• (b) not respond to it ourselves, except to say it has been passed to you.

We will give you reasonable help, through the Mendiola Platform's features or otherwise, to respond within the times the law sets. For example, the CCPA requires a response within 45 days, extendable once with notice.

7.2 Requests from authorities. If a government authority or regulator asks us for Client Personal Data, section 7.4 of the Agreement applies.

8. Return and deletion

8.1 Return. During the export window in section 8.5 of the Agreement, you may export Client Personal Data held in the Mendiola Platform.

8.2 Deletion. We will delete Client Personal Data held in the Mendiola Platform within 30 days after the export window in section 8.5 of the Agreement ends, and confirm in writing if you ask.

• (a) Backups. Copies in backups will be overwritten or deleted on our normal backup cycle. Until then, they stay protected under this DPA and won't be actively used.
• (b) Data in Jaz. Client Personal Data stored in Jaz or held by Plaid is not deleted by this section. Your and your Clients' arrangements with those providers govern it.
• (c) Legal holds. We may keep Client Personal Data where the law requires, only for as long as required. It stays subject to this DPA while we keep it.

8.3 Data you delete during the term. When a User deletes a document that the Mendiola Platform has already processed, it is archived, not erased: the record is kept because it records what was written to a Client's books, and it stops the same file being processed again. Archived records are no longer shown in lists, and they are deleted with the rest of Client Data under section 8.2. If an individual's request requires their details to be erased sooner, ask us and we will help you meet it.

8.4 The Activity Log. Activity Log entries are append-only during the term. When the Agreement ends, they are deleted together with other Client Data under section 8.2.

9. Information and audits

9.1 Information on request. We will answer your reasonable written security and privacy questionnaires, up to once a year, unless there has been a Security Incident or a regulator requires more.

9.2 Audits. If a regulator requires it, or the answers don't reasonably show our compliance, you (or an independent auditor bound by confidentiality) may audit our compliance with this DPA, at your cost. You must give at least 30 days' notice, and the audit must be at a mutually agreed time, without unreasonable disruption, and no more than once a year.

9.3 No certification claim. We don't hold SOC 2 or ISO 27001 certification or attestation. Our information security program maps to those frameworks but has not been audited against them.

10. International transfers

10.1 Where data is processed.

• (a) Hosting. Client Personal Data is hosted in Singapore: the application runs on Vercel (region sin1) and the database on Supabase (AWS ap-southeast-1). Background jobs run in the United States on Trigger.dev (us-east-1).
• (b) Our staff. Our staff in the United States and in the Philippines (Clark Freeport, Pampanga) may access it to provide and support the Mendiola Platform.
• (c) Subprocessors. Subprocessors may process it in the locations listed in Appendix C.

10.2 Safeguards. Wherever Client Personal Data is processed, we will protect it as this DPA requires. For Philippine firms, we remain accountable under the Philippine Data Privacy Act for personal data we transfer to Subprocessors outside the Philippines, and we use contracts and other reasonable means to give it comparable protection. For US firms, this means Client Personal Data is hosted outside the United States, in Singapore, and you agree to that when you accept the Agreement.

11. Future amendments to privacy law

If Applicable Data Protection Law changes, or a new law starts to apply to the Processing under the Agreement, the parties will negotiate in good faith to amend or supplement this DPA as needed to comply.

12. Term

This DPA takes effect with the Agreement. It continues until the later of:

• (a) the end of the Agreement; and
• (b) the date we no longer hold any Client Personal Data.

13. Conflicts

If this DPA conflicts with the rest of the Agreement about the Processing of Client Personal Data, this DPA prevails. An Order Form prevails over this DPA only where it expressly says so.

---

Appendix A: Details of processing

Appendix B: Security measures

Our security measures are described on the Mendiola Security page (mendiola.io/security) and in our information security program. In summary, as at the date of this DPA:

• Sign-in. Users sign in to the Mendiola Platform with an emailed one-time code (valid for 10 minutes; a browser may be trusted for 30 days) or with a passkey or security key.
• Encryption in transit. The Mendiola Platform is served only over HTTPS.
• Encryption at rest. Our database provider encrypts stored data. Bank access tokens and Users' personal Jaz API keys are also encrypted field by field with AES-256-GCM.
• Access. Every query is bounded by the firm a User belongs to and the companies they may open. Our policy is to review staff access every quarter and to remove a departing employee's access on their last day.
• Records of changes. The Activity Log records who or what made each change.

Appendix C: Subprocessors

Checked against the application's code on 2026-11-13. The application and database are hosted in Singapore, and background jobs run in the United States (DPA section 10.1). The other Subprocessors may process data in the United States or in other countries where they operate.

Jaz is not a Subprocessor: you or your Client contract with it directly (DPA section 5.3).