Product-Specific Terms for Iterable Platform and Services

By using or otherwise accessing Data Sync, Customer consents to the appointment of Prequel as a sub-processor as identified on Iterable’s list of Sub-processors: https://iterable.com/legal/iterable-sub-processors/. Customer is responsible for (a) providing and maintaining accurate configuration details for its designated destination, including connection credentials, endpoint addresses, and access permissions; (b) the security, availability, and maintenance of its destination environment; (c) all handling, storage, and processing of data after delivery by Iterable to the designated destination; (d) ensuring compatibility between its destination environment and Iterable’s output format and schema as described in the related product documentation; (e) promptly updating connection credentials within the Iterable platform upon any rotation, expiration, or revocation; and (f) ensuring that its designated destination complies with applicable data protection laws, including any restrictions on cross-border data transfers. Data Sync is available for Iterable-supported destination types only, as listed in the product documentation, and Iterable may add or deprecate supported destination types at its discretion upon reasonable notice. Any applicable service level commitments apply to Iterable’s processing and transmission of data and do not extend to availability or performance of Customer’s destination environment. Iterable shall have no liability for any data loss, unauthorized access, delivery failure, or processing failure arising from Customer’s destination environment, misconfiguration, or invalid or expired credentials.

1. Sub-Processor. Integrations Hub uses Prismatic as an embedded integration runtime. By using or otherwise accessing Integrations Hub, Customer consents to the appointment of Prismatic as a sub-processor as identified on Iterable’s list of Sub-processors: https://iterable.com/legal/iterable-sub-processors/.

2. Third-Party Systems. Integrations Hub enables Customer to establish connections between the Iterable Platform and third-party systems selected by Customer (“Connected Systems”). Customer is solely responsible for: (a) evaluating whether a Connected System is appropriate for Customer’s intended use and compliance requirements; (b) providing and maintaining accurate connection credentials, authentication tokens, and access permissions for each Connected System; (c) configuring data mappings, event triggers, and synchronization settings within Integrations Hub; (d) promptly updating or revoking credentials within the Iterable Platform upon any rotation, expiration, or compromise; and (e) ensuring that Customer’s use of each Connected System, including any data transferred to or from the Iterable Platform, complies with applicable laws, the Agreement, and any terms governing the Connected System.

3. Data Flows. Customer acknowledges that use of Integrations Hub may result in the transfer of Customer Content between the Iterable Platform and Connected Systems, including cross-border transfers. Iterable’s obligations with respect to Customer Content apply to data while it is within the Iterable Platform and during transmission by Iterable to a Connected System. Once data is delivered to a Connected System, or once data from a Connected System is processed outside the Iterable Platform, responsibility for that data is governed by Customer’s agreement with the applicable third-party provider.

4. Availability. Integrations Hub supports the Connected Systems listed in the Documentation, and Iterable may add or deprecate supported Connected Systems at its discretion upon reasonable notice. Any applicable service-level commitments apply to the Iterable Platform’s processing and transmission of data and do not extend to the availability or performance of any Connected System.

5. Limitation of Liability. Iterable shall have no liability for any data loss, unauthorized access, delivery failure, or processing failure arising from: (a) a Connected System’s environment, downtime, or API changes; (b) Customer’s misconfiguration of Integrations Hub; or (c) invalid, expired, or compromised credentials.

1. Applicability. This section applies to Customer’s use of Iterable’s AI-powered features and capabilities that are delivered through, or powered by, Iterable’s Nova orchestration layer (collectively, the “Nova Suite”). The Nova Suite includes, without limitation, Nova Agent (Iterable’s conversational AI assistant) and any other AI Features that Iterable designates as part of the Nova Suite in the Documentation.

2. AI Interaction Data. In the course of Customer’s use of the Nova Suite, Iterable collects the inputs submitted by Authorized Users and the corresponding outputs generated by the Nova Suite (collectively, “AI Interaction Data”). AI Interaction Data is Customer Content for purposes of the Agreement.

3. Permitted Use. Iterable may process AI Interaction Data to create data that is aggregated or de-identified such that it no longer reasonably identifies or is linkable to Customer or any individual (“De-Identified Interaction Data”). Iterable may retain, analyze, and use De-Identified Interaction Data to evaluate, improve, and develop the Nova Suite, including by analyzing usage patterns and curating evaluation datasets. For clarity, Iterable’s use of De-Identified Interaction Data under this section does not constitute use of Customer Content to train, improve, or develop generalized artificial intelligence or machine learning models made available to other Iterable customers or third parties within the meaning of Section 3.9 (or an equivalent section) of the Agreement.

1. Message Storage Service

1.1. Customer Responsibilities for Data Retention and Compliance. Customer acknowledges and agrees that upon transfer and storage of messages within Customer’s designated private cloud storage infrastructure, Customer shall be solely responsible for:

1.1.a. implementing and maintaining appropriate data retention policies and timeframes in accordance with applicable laws and regulations;

1.1.b. ensuring compliance with all applicable privacy laws, data protection regulations, and industry standards relating to the stored messages; and

1.1.c.implementing appropriate access controls, security measures, and audit procedures for all stored message data.

1.2. Message Storage Service Limitations. Iterable’s obligations and responsibilities under any applicable privacy laws or regulations with respect to messages shall cease upon successful transmission of such messages to Customer’s designated private cloud storage destination. Following such transmission, Customer assumes full responsibility for all privacy law compliance obligations relating to the stored messages.

1.3. GDPR Endpoint Exclusion. Customer acknowledges and agrees that Iterable’s GDPR endpoint and related data subject rights processing capabilities do not apply to messages stored within Customer’s designated private cloud storage infrastructure. Customer shall be solely responsible for complying with all requests under relevant privacy laws, including but not limited to data subject access requests, deletion requests, and rectification requests, relating to messages stored within Customer’s private cloud storage environment.

2. Customer Credential And Storage Bucket Responsibility

2.1. Customer Credential Responsibility. Customer shall provide Iterable with accurate and current private cloud storage bucket credentials and destination information. Customer acknowledges and agrees that Customer bears sole responsibility for:

2.1.a. ensuring the accuracy and appropriateness of all provided credentials and destination information;

2.1.b. any consequences arising from incorrect, outdated, or inappropriate credential information provided to Iterable; and

2.1.c. any unauthorised access to personally identifiable information or other sensitive data resulting from Customer’s provision of incorrect destination information.

2.2. Bucket Provision Requirement. Customer must provide Iterable with access to a private cloud storage bucket designated for message storage purposes. Customer acknowledges that Iterable will transfer copies of all messages for selected channels to the designated private cloud storage bucket.

2.3. Public Accessibility Risk. Customer acknowledges that whilst Iterable shall make a good faith effort to confirm Customer’s ownership of the designated storage bucket, it remains possible for Customer to provide credentials to a bucket that is publicly accessible or otherwise inadequately secured. Customer assumes full responsibility for any data breaches, data exposure, data loss, unauthorised disclosure, security incident or unauthorised access resulting from the provision of credentials to publicly accessible or inadequately secured storage destinations.

2.4. Iterable Validation Efforts. Whilst Iterable shall make good faith efforts to validate Customer’s ownership of designated storage destinations, Customer acknowledges that such validation efforts are limited in scope and Customer remains ultimately responsible for the accuracy and appropriateness of all provided credential and destination information.

3. Message Storage Retry Limitations And Outage Risks

3.1. Retry Period. Iterable shall attempt to retry failed message storage attempts for a maximum period of seven (7) days (retried at eight (8) hour intervals) from the initial failed attempt. Customer acknowledges that:

3.1.a. Iterable’s retry obligations are limited to this seven (7) day period;

3.1.b. messages that cannot be stored due to storage connectivity issues, credential failures, or other technical impediments may be permanently lost after this retry period expires; and

3.1.c. Customer may be unable to produce messages sent during any storage outage period for audit, compliance, or regulatory purposes.

3.2. Prolonged Outage Risk. Customer acknowledges that instances of prolonged system outages, extended connectivity failures, or other technical disruptions may result in messages failing to be saved and being lost permanently. In such circumstances, Customer may be unable to produce such messages if subsequently required for audit, compliance, regulatory, or legal purposes.

3.3 Customer Risk Assumption. Customer expressly assumes all risks associated with potential non-compliance, audit failures, or regulatory violations that may result from Iterable’s inability to store messages within the designated retry period or during prolonged outages as described in this clause 3.

4. Storage Cost. Customer acknowledges and agrees that all cloud storage costs, including but not limited to write operations, storage fees, and data transfer charges, shall be borne solely by Customer as storage occurs within their private cloud storage instance.