Recovea Export Control & Sanctions Policy
Last updated: 2026-07-25
1. Purpose, Scope & Status of This Policy
1.1 Purpose. This Export Control & Sanctions Policy (this "Policy") describes how Recovea, Inc., a Delaware corporation ("Recovea," "we," "us," or "our"), administers compliance with United States economic sanctions and export control laws in connection with the Service, and the corresponding commitments and covenants that apply to every Customer and Authorized User. Recovea is a bootstrap-funded U.S. company; nothing in this Policy concerns investment or securities.
1.2 The laws this Policy addresses. This Policy addresses, collectively, the "Trade Laws," meaning the export control, economic sanctions, embargo, anti-boycott, and related import laws of the United States that apply to Recovea and to the Service, including without limitation:
(a) the economic sanctions and embargo programs administered and enforced by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), including the regulations at 31 C.F.R. Chapter V, the Specially Designated Nationals and Blocked Persons List (the "SDN List"), the Consolidated Sanctions List, and OFAC's Sectoral Sanctions Identifications and other non-SDN lists (collectively with the lists named below, "Restricted Party Lists");
(b) the Export Administration Regulations administered by the U.S. Department of Commerce, Bureau of Industry and Security ("BIS"), at 15 C.F.R. Parts 730–774 (the "EAR"), including the Commerce Control List ("CCL"), the Entity List, the Denied Persons List, the Military End User ("MEU") List, and the Unverified List;
(c) the U.S. anti-boycott provisions administered by BIS (15 C.F.R. Part 760) and the U.S. Department of the Treasury (Section 999 of the Internal Revenue Code); and
(d) for the avoidance of doubt and as addressed in Section 5 below, the International Traffic in Arms Regulations administered by the U.S. Department of State (22 C.F.R. Parts 120–130, the "ITAR"), which Recovea has determined do not apply to the Service.
1.3 Defined terms; incorporation. Capitalized terms used but not defined in this Policy have the meanings given to them in the Recovea Terms of Service, the Master Subscription Agreement (where executed), the Acceptable Use Policy ("AUP"), the BYO-Key Addendum, and the Data Processing Addendum ("DPA") (collectively with this Policy and any applicable Order Form, the "Agreement"). This Policy is incorporated into and forms part of the Agreement. Without limitation: "Service" means the Recovea-hosted instrument family and related offerings described in the Agreement, an umbrella covering metering and observability, optimization and routing, spend control, reporting and analytics, data ingestion and connectors, software development kits and application programming interfaces, and related managed services, together with any optimization, additional features and capabilities Recovea may offer Recovea may make available (each such capability governed by the terms in effect when Recovea makes it available and not active or licensed under this Policy unless Recovea expressly states otherwise), and any features, alternative pricing or billing models, software, documentation, websites, and command-line and verifier tooling Recovea makes available; "Customer" means the business entity that subscribes to or uses the Service; "Authorized User" means an individual the Customer permits to access the Service; "Provider" means a third-party model or inference provider (for example, OpenAI, Anthropic, or OpenRouter); "Provider Keys" means the Customer's own credentials and accounts with a Provider; "Inference Content" means the request and response payloads that traverse the Service in-path; "Usage Data" means the metering and operational metadata Recovea processes about the Service's use; "Customer Personal Data" means personal data within Inference Content or otherwise provided by or on behalf of the Customer that Recovea Processes on the Customer's behalf; and "in-path" means traffic the Customer routes through Recovea's gateway to the Customer's Providers on the Customer's own Provider Keys.
1.4 Order of precedence. In the event of a conflict, the order of precedence set out in the Agreement controls: a signed Order Form (where it so states) prevails over the Master Subscription Agreement, which supersedes the click-through Terms of Service for matters it covers, which prevails over the DPA (which controls for Processing of personal data), which prevails over the BYO-Key Addendum (which controls only on Provider Key handling, Provider Terms, Provider Charges, and runaway-spend allocation), which prevails over incorporated policies including this Policy, which prevail over the Terms of Service body. Notwithstanding the foregoing, this Policy controls over any other component of the Agreement solely with respect to the subject matter of Trade-Law compliance, screening, Embargoed-Jurisdiction restrictions, Restricted-Party restrictions, and blocked-funds treatment, except where another document contains a Customer-protective provision more restrictive on Recovea as to that subject matter, in which case that Customer-protective provision applies. Nothing in this Policy displaces the DPA or the liability, indemnity, or limitation-of-liability architecture of the Agreement.
1.5 U.S.-only operating posture. The Service is hosted in the United States (Amazon Web Services, U.S. region) and is offered to business customers only, for business use, by Authorized Users who are 18 years of age or older. The Service is not intended for personal, family, or household use. Recovea does not market, sell, or knowingly provision the Service in or to Embargoed Jurisdictions or to Restricted Parties.
2. The BYO-Key, In-Path Conduit Model and Why It Frames This Policy
2.1 Recovea is a neutral conduit, not a reseller. The Service operates on a "bring-your-own-key" basis. The Customer brings and owns its Provider accounts, relationships, and Provider Keys, and pays each Provider directly. Recovea proxies the Customer's in-path traffic to the Customer's chosen Providers on the Customer's own Provider Keys. Recovea never resells, marks up, sponsors, funds, or takes custody of Provider tokens or Provider spend. Each Customer's Providers are the Customer's own processors, recipients, or independent controllers — they are not Recovea sub-processors. Recovea is not a party to, and assumes no obligations under, the Customer's agreements with its Providers.
2.2 Consequences for Trade-Law allocation. Because Recovea does not transact in, fund, or take custody of Provider spend, and because the Customer alone directs where its inference traffic is sent and on whose credentials, the Customer is the party that controls the destination, recipient, and content of the in-path traffic. Accordingly, while Recovea maintains the screening and geo-blocking posture described below at its own control points, the Customer bears primary responsibility for ensuring that its own use of the Service, its Provider relationships, its Authorized Users, its end users, and its inference destinations comply with the Trade Laws. This allocation is structural and is stated identically across the Agreement.
2.3 What the Service is, for export-classification purposes. The Service is U.S.-origin commercial software made available as a hosted service. It is an infrastructure, observability, cost-management, and routing conduit. It is not a defense article and not a general-purpose AI model. Recovea is not a developer, deployer, or Provider of the AI models reached through the Service, and Recovea does not itself synthesize model output; any cached response returned by the Service is a byte-identical copy of a prior Provider response.
3. OFAC Sanctions Compliance Posture
3.1 Commitment. Recovea is committed to full compliance with all U.S. economic sanctions administered by OFAC. Recovea does not knowingly provide the Service to, accept payment from, or facilitate transactions for or on behalf of any person, entity, or jurisdiction that is the target of U.S. sanctions, and Recovea will not knowingly use, or permit the Service to be used, to facilitate any transaction prohibited by the Trade Laws.
3.2 Embargoed and comprehensively sanctioned jurisdictions. Recovea does not offer, sell, or knowingly make the Service available in or to any country or territory that is the target of comprehensive U.S. sanctions or embargoes, or any region designated as a covered region under U.S. sanctions authorities (each, an "Embargoed Jurisdiction"). The set of Embargoed Jurisdictions is determined by the Trade Laws in effect from time to time and updates by operation of law without amendment of this Policy. By way of non-exhaustive illustration as of the date of this Policy, Embargoed Jurisdictions include Cuba, Iran, and North Korea, together with the Crimea region and the Russian-occupied "Covered Regions" of Ukraine designated under Executive Order 14065 and successor authorities (including the Donetsk, Luhansk, Kherson, and Zaporizhzhia regions of Ukraine), and any other country, territory, or region designated for comprehensive sanctions or covered-region treatment from time to time. This enumeration is illustrative, may not reflect the most recent program changes, and does not narrow the operative standard, which is the current scope of the Trade Laws. Recovea reserves the right to treat additional jurisdictions as Embargoed Jurisdictions, and to restrict the Service accordingly, as program scope changes. This Section 3.2 is the only place in the Recovea policy pack where Embargoed Jurisdictions are enumerated: other Recovea documents that turn on the term — including the Vulnerability Disclosure Policy §1A — cross-reference this Section rather than restate the list, so the two can never drift apart.
3.3 Restricted parties; the OFAC 50 Percent Rule and the BIS Affiliates Rule. Recovea does not knowingly provide the Service to any person on the SDN List, the Consolidated Sanctions List, any other Restricted Party List, the BIS Entity List, the Denied Persons List, the MEU List, the Unverified List, or any analogous list maintained under the Trade Laws (each, a "Restricted Party"). Consistent with OFAC's "50 Percent Rule," any entity that is owned, in the aggregate, fifty percent (50%) or more, directly or indirectly, by one or more blocked persons is itself treated as a Restricted Party even if it is not separately named on a list. In parallel, consistent with the BIS "Affiliates Rule" (the 2025 amendments to the EAR extending license requirements to entities owned 50% or more, individually or in the aggregate, by one or more parties on the Entity List or by MEU-listed parties), Recovea treats any such 50%-or-more-owned affiliate as a Restricted Party under the EAR even if that affiliate is not separately listed. Recovea applies the same prohibition to entities a Restricted Party otherwise controls where required or prudent under applicable guidance.
3.4 Self-screening of the Recovea relationship. Before and during the provision of the Service, Recovea screens, on a risk-based basis, the parties with which it has a direct commercial relationship — including the Customer, its billing identity, and, where reasonably ascertainable, its beneficial owners and signatories — against the applicable Restricted Party Lists, and screens the jurisdictions from which the Customer represents it operates and accesses the Service against the Embargoed-Jurisdiction restrictions. Screening at the Recovea control point is conducted against the Customer's account, billing, and access metadata; Recovea does not, as part of sanctions screening, inspect the substantive content of Inference Content, and nothing in this Policy obligates Recovea to monitor, moderate, or inspect the content of the Customer's traffic.
3.5 No facilitation; no unauthorized license reliance. Recovea will not knowingly engage in or facilitate any dealing that a U.S. person is prohibited from engaging in or facilitating under the Trade Laws, including approving, financing, guaranteeing, or otherwise facilitating a transaction by a non-U.S. person that a U.S. person could not directly perform. Where a transaction would require an OFAC or BIS license or would rely on a general license or exception, Recovea will not proceed absent confirmation that the authorization is available and its conditions are satisfied.
4. Export Classification (EAR / ECCN)
4.1 Jurisdiction. The Service and its software components are subject to the EAR and are not subject to the ITAR (see Section 5).
4.2 Classification. The Service consists of, or makes available, U.S.-origin commercial software. Recovea's classification of the Service and its distributable software components, including any command-line, SDK, ledger, and verifier tooling Recovea makes available, is as follows:
(a) components that do not incorporate or call encryption functionality are designated EAR99 (subject to the EAR but not listed on the CCL); and
(b) components that incorporate or call mass-market encryption functionality are classified as mass-market encryption software under Export Control Classification Number ("ECCN") 5D992.c, with associated technology classified 5E992 and any standalone encryption commodity components classified 5A992.c. These mass-market components are eligible for export under the mass-market provisions of the EAR (15 C.F.R. §742.15(b)); to the extent a self-classification report or mass-market notification is required for any such component, Recovea submits it to BIS and the ENC Encryption Request Coordinator (NSA) as a condition of relying on that treatment.
The mass-market pathway and License Exception ENC are distinct legal authorities and Recovea does not conflate them. License Exception ENC (15 C.F.R. §740.17) is reserved solely for any components classified 5D002 (or related ECNs), if any such components exist; for the avoidance of doubt, no component is treated as ENC-eligible by reason of its mass-market 5D992.c classification.
4.3 Encryption. The Service employs standard, widely available, publicly known cryptographic functionality (including AES-256-GCM at rest) to protect data, and does not contain proprietary or non-standard cryptography developed for controlled end uses. This functionality supports the Service's data-protection objectives and is incidental to its primary cost-management, observability, and routing function.
4.4 Prohibited end uses and end users. Regardless of classification or the availability of any license exception, neither the Service nor any software, technology, or technical data provided through it may be exported, re-exported, transferred (in-country), or used, directly or indirectly, in connection with any prohibited end use under the EAR, including the nuclear, missile, chemical, biological, military, military-intelligence, and certain advanced-computing, semiconductor, or "supercomputer" end uses described in 15 C.F.R. Part 744, or by any prohibited end user, including any party on the Entity List, the Denied Persons List, the MEU List, or the Unverified List, any entity treated as a Restricted Party under the OFAC 50 Percent Rule or the BIS Affiliates Rule, or any military or military-intelligence end user where a license is required.
4.5 No deemed export of controlled technology. Recovea does not, through the ordinary provision of the Service, knowingly release controlled technology or source code requiring a license to foreign persons. The Service's general documentation and APIs are made publicly available and are not controlled technology.
5. ITAR — Not Applicable
The Service is commercial, dual-use software subject to the EAR. It is not a "defense article," "defense service," or "technical data" within the meaning of the ITAR or the United States Munitions List (22 C.F.R. Part 121), and Recovea is not a manufacturer, exporter, or broker required to register with the U.S. Department of State's Directorate of Defense Trade Controls. The Customer must not use the Service to develop, produce, handle, or transmit any item, service, data, or information subject to the ITAR, and must not submit ITAR-controlled technical data into the Service, including as Inference Content. The Customer is solely responsible for any ITAR-controlled material it nonetheless introduces in breach of this Policy.
6. SaaS Gateway Routing & Screening Posture (Recovea-Specific)
6.1 What Recovea screens, and where. Because Recovea is an in-path conduit on the Customer's own Provider Keys, Recovea's Trade-Law control points are: (a) account onboarding and billing — Recovea screens the Customer relationship, billing identity, and (where reasonably ascertainable) associated persons as described in Section 3.4; and (b) access geography — Recovea may use signals such as billing country, declared place of business, and network-origin (IP) information to identify and restrict access associated with Embargoed Jurisdictions or Restricted Parties.
6.2 What Recovea does not screen. Recovea does not, and has no obligation to, inspect, classify, or screen the substantive content of the Customer's Inference Content for Trade-Law purposes, identify the ultimate human end users the Customer serves, or evaluate whether the Customer's own downstream customers are Restricted Parties. The Customer alone selects which Provider receives its traffic, on which Provider Key, and to which Provider region or endpoint. Recovea does not control, and makes no representation regarding, the geographic location at which any Provider processes the Customer's traffic; that is governed by the Customer's own agreements and configuration with its Providers.
6.3 Routing is at the Customer's direction. The Service's routing of in-path traffic to the Customer's designated Provider on the Customer's credentials is performed at the Customer's direction. The Customer is responsible for ensuring that its choice of Provider, Provider account, Provider region, and any model fallback is consistent with the Trade Laws. Any routing or optimization functionality Recovea may make available does not change the Provider account on whose credentials traffic is sent without the Customer's configuration, and Recovea never claims mid-stream failover; the Service is designed to fail open before the first token, and once tokens stream a failure surfaces as a clean error rather than a silent splice.
6.4 Geo-block enforcement points. Recovea's geo-blocking and access-restriction measures may be enforced at one or more of the following layers, as Recovea determines appropriate on a risk-based basis: account creation and verification; payment authorization (including controls applied through Recovea's payment processor); authentication and session issuance; the gateway request edge; and administrative review. These measures are designed to deter and prevent access from Embargoed Jurisdictions and by Restricted Parties. As with the Service generally, geo-blocking is provided on a designed-to, best-effort basis and is not warranted to be complete, error-free, or impervious to circumvention (for example, by anonymizing networks, virtual private networks, or misrepresented location), and the Customer must not attempt to circumvent it.
6.5 Blocked funds; no refund of blocked or rejected payments. If any payment, account, or funds connected to the Customer become subject to blocking, freezing, or rejection under the Trade Laws, Recovea will comply with the applicable Trade Laws, which may require Recovea to block or reject the funds, suspend or terminate the Service, and report the matter to OFAC or other authorities. In any such case, and to the maximum extent permitted by law, Recovea will not refund, return, credit, or release blocked, frozen, or rejected funds except as expressly authorized by OFAC or the relevant authority (including pursuant to a specific license or unblocking authorization), and any subscription Fees attributable to a period during which the Service is lawfully suspended or terminated for Trade-Law reasons are non-refundable. This Section 6.5 operates as an exception to, and controls over, any refund provision elsewhere in the Agreement. Recovea will cooperate with lawful instructions concerning the disposition of blocked or rejected funds and may place such funds in a blocked, interest-bearing account where required.
6.6 Provider charges remain the Customer's. Because the Customer pays its Providers directly on its own Provider Keys, any blocking, rejection, suspension, or dispute concerning the Customer's Provider spend is a matter between the Customer and its Provider under the BYO-Key Addendum and the Customer's Provider agreements. Recovea has no liability for Provider Charges or for any Provider's Trade-Law determinations.
7. Customer Covenants and Representations
7.1 Eligibility representations. The Customer represents, warrants, and covenants, on its own behalf and on behalf of each of its Authorized Users, continuously throughout the term of the Agreement, that:
(a) it, its Authorized Users, its parent, and its controlling owners are not a Restricted Party, are not located, organized, or ordinarily resident in an Embargoed Jurisdiction, and are not owned or controlled by, or acting on behalf of, any Restricted Party (including under the OFAC 50 Percent Rule or the BIS Affiliates Rule);
(b) it will not access or use the Service from, or provision access to or use of the Service in or for the benefit of any person in, an Embargoed Jurisdiction;
(c) it will not, and will not permit any Authorized User or any third party to, export, re-export, transfer, or otherwise use the Service, or any direct product, software, technology, or technical data of the Service, in violation of the Trade Laws, including for or in connection with any prohibited end use or to any prohibited end user described in Section 4.4;
(d) it will not use the Service to facilitate, route, broker, finance, or otherwise support any transaction, dealing, or service involving a Restricted Party or an Embargoed Jurisdiction, or any activity that would cause Recovea to violate or be exposed to penalty under the Trade Laws;
(e) it will not submit ITAR-controlled material into the Service and will not use the Service for any ITAR-controlled activity;
(f) it will not take any action with respect to the Service that violates U.S. anti-boycott laws, and it will promptly report to Recovea any boycott-related request it receives in connection with the Service where a report to Recovea is appropriate;
(g) it is solely responsible for screening its own end users and counterparties, for classifying any of its own content or technology it introduces into the Service, and for obtaining any license, authorization, or exception its own use may require;
(h) it will not attempt to circumvent, disable, or defeat any geo-blocking, screening, or access-restriction measure Recovea applies; and
(i) access to or use of the Service by its foreign-person Authorized Users does not require a deemed-export authorization under the EAR, and the Customer will not permit any foreign-person Authorized User to access the Service where doing so would require a deemed-export or other license under the Trade Laws (including in connection with advanced-computing or Part 744 controls); the Customer is solely responsible for obtaining any such authorization that its own access arrangements require.
7.2 Notice and cooperation. The Customer will promptly notify Recovea in writing at legal@recovea.ai if it learns that any of the representations in Section 7.1 has become inaccurate, that it or any Authorized User has been listed as a Restricted Party, or that any Trade-Law issue has arisen in connection with the Service, and will reasonably cooperate with Recovea in responding to any government inquiry concerning the Service.
7.3 Authorized-User and downstream flow-down. The Customer will ensure that its Authorized Users and any party to whom it makes the Service available comply with this Policy and the Trade Laws, and remains responsible for their acts and omissions as if they were the Customer's own.
8. Screening Implementation, Recordkeeping & Remedies
8.1 Risk-based program. Recovea maintains a risk-based Trade-Law compliance program proportionate to its size, business model, and risk profile as a single-region, U.S.-hosted, BYO-Key conduit. The program includes onboarding and periodic Restricted-Party and Embargoed-Jurisdiction screening of Recovea's direct counterparties against current U.S. government list sources, geo-based access controls, escalation and review procedures, and this Policy. Recovea may engage third-party screening or payment tools to support these functions and refreshes its list sources on a risk-based cadence.
8.2 Recordkeeping. Recovea retains records relevant to its Trade-Law compliance — including screening results, license or authorization determinations, geo-block events, and decisions to suspend, terminate, or report — for at least ten (10) years (OFAC) and five (5) years (EAR), i.e., the longer applicable period, or such longer period as the applicable Trade Laws otherwise require. This retention period reflects the extended OFAC recordkeeping and statute-of-limitations period established by the 2024 amendments to the OFAC regulations. These records are retained consistent with the Agreement's data-retention and security provisions and, where they include Customer Personal Data, the DPA and Privacy Policy. The immutable-Ledger integrity carve-out and erasure mechanics described in the Agreement and the DPA continue to apply; Recovea retains a content-free integrity record (tombstone with the customer identifier severed to null) as permitted by law even where other data is erased.
8.3 Suspension, blocking, termination, and reporting. Without limiting any other right or remedy, and notwithstanding any cure period elsewhere in the Agreement, Recovea may, immediately and without liability, suspend, restrict, geo-block, withhold, or terminate the Service, any account, any access, or any transaction, and may block or reject funds, if Recovea determines in good faith that continued provision would or may violate the Trade Laws, that the Customer or an Authorized User is or has become a Restricted Party or is associated with an Embargoed Jurisdiction, or that any representation in Section 7 is or has become untrue. Recovea may make any report to OFAC, BIS, or other authority that the Trade Laws require or that Recovea reasonably believes is appropriate, and may decline to disclose the existence or content of such a report to the extent disclosure is restricted by law. Suspension or termination under this Section is a permitted exercise of Recovea's rights and is not a breach by Recovea.
8.4 Effect on Fees. Fees for any period during which the Service is lawfully suspended or terminated under this Policy are non-refundable, consistent with Section 6.5 and the Agreement's refund terms.
9. Fees, Billing & Reservation of Rights
9.1 Pricing optionality preserved. Nothing in this Policy alters Recovea's pricing or billing model. Recovea may offer subscription, usage-based, and savings- or outcome-based pricing models; any savings- or outcome-based model applies only on the Customer's separate, affirmative election and as set out in the Agreement and any Order Form. Recovea reserves the right to offer and to change features and pricing at its discretion. Trade-Law compliance is a condition of the Service and is not itself a chargeable item. Any amounts are governed by the applicable Order Form; no price, percentage, or dollar figure is stated in this Policy.
9.2 No savings, output, or availability guarantee. Recovea makes no guarantee of cost savings, output quality, or availability except as expressly stated in an applicable service-level commitment or Order Form. Any savings, cost, or efficiency figures are estimates unless Recovea expressly designates them "verified" in writing. The Service is provided on a fail-open, best-effort basis. This Policy does not modify those limits.
10. Disclaimers; No Trade-Law Advice
10.1 As-is. THE SERVICE, INCLUDING ALL SCREENING, GEO-BLOCKING, AND TRADE-LAW COMPLIANCE FUNCTIONALITY, IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, RECOVEA DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. RECOVEA DOES NOT WARRANT THAT ITS SCREENING OR GEO-BLOCKING WILL DETECT OR PREVENT EVERY PROHIBITED PARTY, JURISDICTION, END USE, OR TRANSACTION, OR THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE. RECOVEA'S SCREENING AND GEO-BLOCKING ARE DESIGNED-TO, BEST-EFFORT MEASURES AND ARE NOT A GUARANTEE.
10.2 Not legal advice; Customer's independent duty. This Policy and any screening, geo-blocking, or compliance function Recovea performs are for Recovea's own compliance and are not legal advice to the Customer and do not relieve the Customer of, or substitute for, the Customer's own independent obligation to comply with the Trade Laws and to maintain its own export-control and sanctions compliance program. The Customer must not rely on Recovea's screening as satisfying the Customer's obligations.
11. Limitation of Liability
The limitation-of-liability provisions of the Agreement apply to this Policy and are incorporated by reference. Without limiting those provisions: (i) neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data, even if advised of the possibility; (ii) each party's aggregate liability is capped at the greater of (a) the total Fees paid by the Customer to Recovea in the twelve (12) months before the event giving rise to the claim and (b) US $25,000, with an enhanced cap of two (2) times that amount applying to breaches of confidentiality and breaches of data-protection or security obligations; and (iii) the cap does not apply to a party's indemnification obligations, the Customer's payment obligations, the Customer's breach of the license, Acceptable Use, or IP-ownership terms, or a party's fraud or willful misconduct (to the extent not waivable); a party's liability for gross negligence remains subject to the caps to the fullest extent permitted by applicable law, and where, and only to the extent, that law does not permit it to be so limited, such liability is limited to the maximum extent that law permits. These limitations apply notwithstanding any failure of essential purpose of any limited remedy and form part of the basis of the bargain. Without limiting the foregoing, and to the maximum extent permitted by law, Recovea will have no liability for: (a) any Customer or Authorized User violation of the Trade Laws; (b) any blocking, freezing, rejection, suspension, termination, or government action arising from the Trade Laws; (c) the non-refund of blocked, frozen, or rejected funds; or (d) any failure of screening or geo-blocking to detect or prevent a prohibited party, jurisdiction, end use, or transaction.
12. Indemnification
The Customer will defend, indemnify, and hold harmless Recovea and its officers, directors, employees, and agents from and against any and all claims, demands, actions, investigations, penalties, fines, losses, liabilities, damages, and expenses (including reasonable attorneys' fees and the costs of responding to any government inquiry) arising out of or relating to: (a) the Customer's or any Authorized User's breach of this Policy or the Trade Laws; (b) the Customer's introduction of ITAR-controlled or prohibited-end-use material into the Service; (c) the Customer's circumvention of, or attempt to circumvent, any screening or geo-blocking measure; or (d) any third-party or governmental claim that the Customer's use of the Service violated the Trade Laws. The Customer's indemnification obligations under this Section 12 survive termination and are NOT subject to, and are expressly excluded from, the Customer's liability cap (and any other limitation of liability) in the Agreement; the incorporated limitation of liability does not reduce, cap, or otherwise limit the Customer's obligation to indemnify Recovea for Trade-Law penalties, fines, and related losses under this Section. This indemnity is in addition to, and not in limitation of, the indemnification provisions of the Agreement. Recovea will provide prompt notice of any claim for which it seeks indemnification, the Customer will have sole control of the defense (subject to Recovea's right to participate with its own counsel and to approve any settlement that imposes any obligation or admission on Recovea), and Recovea will reasonably cooperate at the Customer's expense.
13. Intellectual Property & Confidentiality Cross-References
13.1 IP. Nothing in this Policy grants any license to Recovea's intellectual property beyond the limited right to use the Service granted in the Agreement. "RECOVEA" is asserted as a common-law mark until any registration issues, and Recovea's other marks, names, and logos are reserved. All rights are reserved. The Customer will not use the Service's outputs, the Ledger, or any other Service data to train, fine-tune, or develop any machine-learning model, and will not otherwise use them except as expressly permitted by the Agreement.
13.2 Confidentiality. Screening results, government inquiries, and Trade-Law determinations may constitute Confidential Information under the Agreement and are subject to its confidentiality provisions, except that Recovea may disclose such information to the extent required by the Trade Laws or compelled by lawful authority, and may withhold from the Customer any information whose disclosure to the Customer is restricted by law (for example, the existence or content of certain reports to OFAC). The confidentiality survival, trade-secret, and Customer-Data/Inference-Content carve-outs of the Agreement apply.
14. Data, Privacy & Security Cross-References
Recovea's handling of personal data in connection with screening and recordkeeping is governed by the Recovea Privacy Policy and the DPA. Where Recovea Processes Customer Personal Data on the Customer's behalf, the DPA is automatically incorporated into and forms part of the Agreement. Recovea is the controller of its own account, billing, and compliance records and acts as a processor (service provider) of Customer Personal Data within Inference Content (with the Customer as controller). Screening is performed against account, billing, and access metadata, not against the substance of Inference Content. Security measures, including AES-256-GCM encryption at rest under live AWS KMS envelope encryption (customer-managed keys, BYO-CMK, are planned and are not represented as live), are as described in the Recovea Security Statement, which is the conservative anchor for all security representations; nothing in this Policy may be read to exceed it. The Customer must not submit protected health information, payment-card cardholder data, biometric identifiers, government identifiers, children's data, or other special-category or regulated data through the Service unless separately agreed in a signed writing; Recovea is not a HIPAA Business Associate and the Service is not HIPAA- or PCI-validated. The immutable-Ledger integrity and erasure carve-out described in the Agreement and the DPA applies to records retained under this Policy.
15. Term, Termination & Survival
This Policy is effective for so long as the Customer has access to or uses the Service and survives termination of the Agreement with respect to any matter arising during the term or required by the Trade Laws (including recordkeeping, post-termination cooperation, blocked-funds treatment, the BYO-key conduit allocation and fail-open disclaimers, indemnification, limitation of liability, confidentiality, and dispute resolution). Recovea's right to suspend or terminate for Trade-Law reasons is as set out in Section 8.3 and is in addition to any termination right in the Agreement.
16. Dispute Resolution; Governing Law; Venue
16.1 Governing law. This Policy is governed by the laws of the State of Delaware, excluding its conflict-of-laws rules, and by applicable U.S. federal law (including the Trade Laws). The United Nations Convention on Contracts for the International Sale of Goods does not apply.
16.2 Arbitration; class-action waiver. Except for the carve-outs below, any dispute arising out of or relating to this Policy will be resolved consistent with the dispute-resolution provisions of the Agreement, which provide for binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules, by one (1) arbitrator, seated in Wilmington, Delaware; judgment on the award may be entered in any court of competent jurisdiction. The arbitration is conducted on an individual basis only, and the parties waive any right to participate in a class, collective, or representative action. Each party bears its own fees as provided by the AAA Commercial Arbitration Rules; the parties intend the AAA Commercial Arbitration Rules to apply, subject to the Agreement's Consumer-Rules fallback and mass-arbitration protocol (Terms of Service §24.2 and §24.7 / MSA §23.2 and §23.6): if the AAA or a court of competent jurisdiction determines that the AAA Consumer Arbitration Rules apply to a dispute involving an individual, those rules govern that dispute and Recovea pays the filing, administrative, and arbitrator fees the AAA consumer fee schedule assigns to the business (this is a business-to-business, business-property service). The following are carved out of arbitration and may be brought in the state or federal courts located in Wilmington, Delaware, to which the parties consent to personal jurisdiction and venue: (a) claims for injunctive or other equitable relief for actual or threatened infringement or misuse of intellectual property or breach of confidentiality; and (b) matters within the jurisdiction of a small-claims court.
16.3 Non-party and government forum carve-out. Any governmental authority, and any non-contracting third party, is outside any arbitration agreement, and disputes involving such persons are subject to the state or federal courts located in Wilmington, Delaware. Nothing in this Section limits a government authority's enforcement of the Trade Laws.
17. General Provisions
17.1 Assignment. The Customer may not assign or transfer this Policy or the Agreement except as permitted by the Agreement. Recovea may assign this Policy in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets.
17.2 Force majeure. Neither party is liable for any failure or delay in performance due to causes beyond its reasonable control; however, neither a party's obligation to comply with the Trade Laws nor Recovea's right to suspend, block, or terminate for Trade-Law reasons is excused or limited by force majeure, and compliance with a government order, sanction, or embargo is not a breach by Recovea.
17.3 Notices. Notices to Recovea under this Policy must be sent to legal@recovea.ai and to Recovea's notice address: 2810 N Church St STE 89986, Wilmington, DE 19802. Recovea may give notice to the Customer by email to the Customer's account contact or by posting within the Service.
17.4 Electronic acceptance. The Customer's acceptance of the Agreement, or its access to or use of the Service, constitutes acceptance of this Policy by electronic means, and the parties consent to electronic records and signatures under the U.S. E-SIGN Act and applicable state law.
17.5 Entire agreement; precedence. This Policy, together with the rest of the Agreement, constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior or contemporaneous understandings on that subject. The order of precedence in Section 1.4 governs conflicts.
17.6 Severability. If any provision of this Policy is held unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, or if it cannot be so modified, severed, and the remaining provisions will continue in full force and effect.
17.7 Modification. Recovea may update this Policy from time to time, including to reflect changes in the Trade Laws or its compliance program. Changes are effective upon posting or as otherwise stated in the Agreement; changes required to comply with the Trade Laws are effective immediately. The Customer's continued use of the Service after a change constitutes acceptance.
17.8 No waiver; independent obligations. No failure or delay by Recovea in exercising any right under this Policy operates as a waiver. The Customer's Trade-Law obligations are independent of, and not conditioned upon, Recovea's performance.
17.9 Headings. Headings are for convenience only and do not affect interpretation.
18. Contact
Questions about this Policy, or notices required under it, may be directed to legal@recovea.ai. Trade-Law compliance concerns may also be directed there. Recovea will route inquiries internally as appropriate.
End of Recovea Export Control & Sanctions Policy.