Service Terms — JetSetGo LLC

Version 1.2 — Effective date: 2026-05-25 — Last updated: 2026-05-25

Entity: JetSetGo LLC, a New Mexico limited liability company.

About this document. JetSetGo does not offer online self-service sign-up. Customers are onboarded through a sales-led process that ends with a signed Master Services Agreement (the "MSA") between JetSetGo LLC and the customer ("Operator"). These Service Terms are incorporated by reference into the MSA. The published version of these Service Terms is informational for anyone reading them before signing — a prospect, a regulator, an operator's compliance team doing diligence — and contractual for any Operator who has signed the MSA, for the duration of the MSA.

1. Plain-English summary (read this first)

The five things you most want to know about doing business with us. Each is a real, enforceable clause — the section reference is right there.

1. You own your data — cancel anytime and export everything. Bookings, traveller details, configuration, custom reports. Self-serve CSV/JSON export from the admin console, 24/7, no support ticket, no fee. Read-only access stays live for 90 days after you leave. We will never withhold your data because you owe us money. See clause 7.1 and 11.4.

2. No minimum term, no auto-renewal, no setup fees, no monthly minimums. You pay 2.5% of each booking processed through the platform. A dormant account pays $0. You can cancel today, by email or in the admin console, no retention scripts, no exit fees. See clauses 5 and 11.

3. We don't claim rights to your bookings beyond providing the service. We do not market to your travellers. Your customer list is yours. We will never sell traveller data — not even de-identified — to any third party. See clauses 7.1, 7.8 and 8.

4. Sub-processors listed openly with 30-day notice and a costless objection right. We publish the full list of the vendors we use (AWS, Oracle, Stripe, Twilio, Cloudflare and the rest) on jetsetgo.world/sub-processors. If we add a new one and you don't like it, you can leave without penalty. See clause 10.2.

5. If we get acquired, the buyer takes the same commitments. You have a 90-day exit window with full data export. No surprise re-papering, no quiet rewrite of the deal. See clause 16.

Two more things worth knowing while you're here.

6. Strict uptime SLA — 99.9% on the sales channel. If we miss it, you get a credit on next month's booking fees. Below 95%, you can walk and we'll help you export. See clause 6.2 and 6.3.

7. 24/7 support — but honestly. We triage every issue 24/7. A P1 incident (your sales channel is down) gets a 30-minute response, any time of day or night. Lower priorities are business-hours. See clause 6.4.

8. Non-excludable consumer-protection and privacy rights are preserved. Nothing in these Service Terms or the MSA takes away rights you have under the consumer-protection or privacy law of your place of establishment that cannot be excluded by contract — including the Australian Consumer Law, the NZ Consumer Guarantees Act, the UK Consumer Rights Act, US state UDAP statutes, and equivalents. See clause 12.1.

2. Definitions

Plain English first, with the term in bold.

• Account data: information about your business and your team — your registered details, staff names and logins, billing information, support tickets, and how you use the platform. We act as the controller of this data.
• Acceptable Use Policy or AUP: the rules in clause 9 about what you can't do with the platform.
• Admin console: the web application your team logs into to configure products, manage bookings, run manifests, build reports and export data.
• Beta feature: any feature labelled in-product as "Beta", "Preview", "Experimental" or similar.
• Booking: a confirmed reservation made by a Traveller through the Platform.
• Booking fee: the 2.5% fee we charge on each Booking (clause 5.1).
• Business hours: 9:00am to 5:00pm Mountain Time (the time zone of JetSetGo LLC's place of incorporation), Monday to Friday, excluding US federal public holidays.
• Confidential information: non-public information one party shares with the other in connection with the MSA, including pricing, technical architecture, business plans, customer lists and personal information.
• DPA: the Data Processing Addendum published at jetsetgo.world/legal/dpa and incorporated into the MSA.
• Effective date: the date the MSA is signed (clause 3.3).
• Force majeure event: defined in clause 17.3.
• JetSetGo, we, us, our: JetSetGo LLC, a New Mexico limited liability company.
• MSA or Master Services Agreement: the signed agreement between JetSetGo LLC and the Operator into which these Service Terms, the Privacy Policy, the DPA, and the sub-processor list are incorporated by reference.
• Operator, you, your: the transport or tourism business that has signed the MSA with us and uses the Platform to take bookings from its Travellers. (Note: "Operator" in the JetSetGo context — our operator-customer — is a different term from "operator" as used in POPIA, where it refers to a processor. The DPA explains the overlap.)
• Operator data: everything you put into, configure on, or generate through the Platform — your products, pricing, schedules, brand assets, Traveller PII captured at your checkout, transaction records, customer database, custom reports and dashboards. You own all of it (clause 7.1).
• Platform: the JetSetGo software-as-a-service booking and reservation management platform, including the admin console, the sales channel, the mobile POS and check-in apps, the API, and all features and updates we make available from time to time.
• P1, P2, P3, P4: priority levels for support incidents (clause 6.4).
• Privacy Policy: our policy at jetsetgo.world/privacy.
• Sales channel: the booking engine, hosted checkout and booking API through which Travellers make bookings.
• Service Terms: this document, as incorporated by reference into the MSA.
• Stripe Connect: the Stripe payment service we integrate with so that you can take card payments. You hold your own Stripe account; we are not in the funds flow. The Stripe contracting entity for your end of the relationship varies by your jurisdiction (clause 5.2).
• Sub-processor: a third-party vendor that processes Operator data on our behalf. The current list is at jetsetgo.world/sub-processors.
• Traveller: a person who books a trip, tour, ferry crossing or other service with you through the Platform. Travellers are your customers — not ours.
• Traveller PII: personal information about Travellers that flows through the Platform. This is "Personal Data" for the purposes of the DPA and "Personal Information" for the purposes of CCPA / CPRA, in each case to the extent of the relevant law.

3. The agreement

3.1 Who this applies to

The MSA, and these Service Terms as incorporated into it, are between you (the Operator) and us (JetSetGo). Your travellers are not parties to the MSA; their contract for the trip or tour is with you.

If you sign the MSA on behalf of a business, you confirm you have authority to bind that business. The business is the Operator.

3.2 What you're getting

We grant you a non-exclusive, non-transferable right to use the Platform for the duration of the MSA, for your bona fide business purposes. That includes:

• All current features of the Platform.
• Access to our API.
• Free onboarding, in the scope described in clause 4.1.
• Updates and improvements we release.
• Support as described in clause 6.4.

3.3 How these Service Terms become binding on you

These Service Terms are incorporated by reference into the MSA. They become binding on you when you sign the MSA, and remain binding for the duration of the MSA. The Effective Date is the date the MSA is signed by both parties.

If the published version of these Service Terms is materially varied (clause 15) after the MSA is signed, the variation takes effect on the terms set out in clause 15 — your costless-exit right applies. We do not rely on "continued use of the Platform constitutes acceptance" as a basis for material variations.

The published version of these Service Terms is informational for anyone reading it before signing — a prospect, a regulator, an operator's compliance team doing diligence — and contractual for any Operator who has signed the MSA.

3.4 What the MSA includes

The full agreement between you and us is:

• The signed Master Services Agreement itself.
• These Service Terms (incorporated by reference).
• The Privacy Policy at jetsetgo.world/privacy.
• The Data Processing Addendum (DPA) at jetsetgo.world/legal/dpa.
• The sub-processor list at jetsetgo.world/sub-processors.

If there is a conflict between the documents that form the MSA, the order of precedence is: (1) the EU Standard Contractual Clauses and the UK IDTA Addendum (as incorporated by the DPA), to the extent of any conflict and as required by their own hierarchy clauses; (2) the DPA; (3) the body of the Privacy Policy; (4) the Master Services Agreement; (5) these Service Terms (where they extend, supplement or describe MSA provisions); (6) any subordinate document or notice. To avoid doubt, on any matter of data-protection law, the DPA prevails over these Service Terms.

4. Your account

4.1 Sign-up and onboarding

Onboarding is free. Free onboarding covers:

• Setting up your account, products, pricing, schedules and inventory configuration.
• Importing your existing customer and booking data from a supported source system (we maintain a published list of supported systems).
• Training your team on the admin console, POS app and check-in app.
• Going live on the Platform.

If you want bespoke work outside this scope — for example, building a custom ETL pipeline from a legacy system we don't support, or building a custom integration to your accounting platform — we'll quote that separately as a written statement of work. We will never invoice you for "setup fees" against the standard onboarding scope above.

No re-onboarding fee for returning operators. If you leave and later come back, you re-enter on the same free-onboarding terms. We do not charge a re-activation fee, a re-setup fee, or any other gate on returning.

4.2 Admin users and credentials

You are responsible for:

• The actions of any person you grant access to your admin console.
• Keeping login credentials confidential.
• Removing users promptly when they leave your business or change roles.
• Telling us promptly if you think credentials have been compromised.

We provide tools to help — role-based access controls, audit logging of admin actions, multi-factor authentication options. You configure them to suit your business.

4.3 Your warranties

By signing the MSA, you warrant that:

(a) Lawful operation. Your business is lawful in the jurisdictions where you operate and you hold the permits, licences and safety certifications your operation requires.

(b) Lawful collection of Traveller PII. You collect Traveller personal information lawfully under the privacy law that applies to you and your travellers.

(c) Privacy notice at checkout. You display, or arrange to display, a privacy notice at your booking checkout that complies with applicable privacy law and discloses that JetSetGo is your platform vendor and a processor / sub-processor of Traveller PII. We provide template language; you adapt it to your business.

(d) Children's data. Where Travellers are children, or where parental/guardian information is captured, you have obtained the consents required by applicable law (for example COPPA in the US, GDPR Article 8 in the EU, Quebec Law 25 in Canada). The Platform is not designed for direct use by children.

(e) Honest disclosure. Your cancellation policy, refund policy and any other Traveller-facing terms are accurate and disclosed to Travellers before they pay.

(f) Compliant marketing. Any commercial messages you send to Travellers using our marketing tooling comply with CAN-SPAM (US), the Spam Act 2003 (Cth) (Australia), CASL (Canada), GDPR / ePrivacy (EU/UK), and equivalent local law — including consent, sender identification and a working unsubscribe mechanism.

(g) Authority. You have authority to sign the MSA.

These warranties are the foundation of the MSA. We rely on them. Material breach is grounds for the indemnity at clause 13.1 and may be grounds for termination under clause 11.6.

5. Fees and payment

5.1 Our fee: 2.5% per Booking

We charge 2.5% of the gross booking value on each Booking processed through the Platform. The fee is collected as the application fee through Stripe Connect at settlement — we do not invoice you separately for it.

• No setup fees.
• No monthly minimums. A dormant account pays $0.
• No fixed term. No auto-renewal. No exit fees.
• No hidden floors. There is no "2.5% or $X, whichever is greater" clause.

The 2.5% applies to the gross booking value paid by the Traveller in the booking transaction. It does not apply to refunds you process back to a Traveller (you can release the corresponding portion of the fee through the admin console's refund flow).

5.2 Stripe Connect — you are the merchant of record

We use Stripe Connect (Standard). That means:

• You hold your own Stripe account. You sign Stripe's terms directly. Your relationship with Stripe is between you and Stripe. Stripe's contracting entity for your end of the Stripe Connect relationship varies by your jurisdiction (Stripe Payments Australia Pty Ltd for AU-resident Operators; Stripe Payments Europe Ltd for EU/UK; Stripe, Inc. for the US; the corresponding Stripe entity for other jurisdictions). JetSetGo LLC's platform-level relationship is with Stripe, Inc. (Delaware).
• You are the merchant of record for every Booking. The Traveller's payment is for your service, not ours.
• Funds settle to you, not us. Stripe pays you the booking amount, less Stripe's processing fees, less our 2.5% application fee.
• Chargebacks, refunds, fraud disputes, KYC, and AML obligations are between you and Stripe. We are not in the funds flow and we are not a payment processor for the purposes of any financial-services regulation.
• You must keep your Stripe account in good standing. If Stripe suspends or restricts your account, we may not be able to process bookings until Stripe lifts the restriction.

We will help where we can — for example by providing transaction evidence to support your chargeback responses — but the legal and commercial relationship with Stripe is yours.

5.3 Taxes

Fees are quoted exclusive of any sales tax, value-added tax, goods and services tax, withholding tax, or other tax imposed by a taxing authority on the supply of the Services. Where any such tax applies, JetSetGo will add it to the invoice and the Operator will pay it.

• AU-resident Operators. Where the supply is taxable under the GST Act, GST at the prevailing rate (currently 10%) is added to invoices.
• Operators outside Australia. Our supply may be a GST-free export of services under section 38-190 of the GST Act, or may attract reverse-charge VAT / sales tax / GST in the Operator's jurisdiction — the Operator is responsible for taxes payable in its own jurisdiction.
• Withholding. If your local law requires you to withhold tax on payments to us, you must gross up the payment so we receive the full agreed fee net of withholding.

Stripe processing fees, FX conversion fees, and any pass-through taxes are not "our" fees; they are charged by Stripe under your agreement with Stripe. We disclose this up front.

5.4 What "no setup fees / no monthly minimums" means in practice

• The standard onboarding scope at clause 4.1 is free.
• You are not billed for a month in which you process no bookings.
• You are not billed for users, API calls, dashboards, integrations, or any other "feature" beyond the 2.5% per booking.
• We do not invoice you "minimum platform fees", "subscription fees" or "licence fees" of any kind.

If we ever charge a separate fee for bespoke work (for example a custom integration), that fee will be set out in a written statement of work you sign separately. It is not part of the 2.5%.

5.5 Pricing changes

We may change our pricing — including the 2.5%, or by introducing carve-outs and surcharges — on these terms:

• 90 days' written notice to your account-owner email and via an in-product banner.
• 60-day costless-exit window from notice. Within 60 days of the notice, you may terminate the MSA without penalty.
• Old-price wind-down. If you terminate within the 60-day window, you keep the existing pricing through your 90-day wind-down (clause 11.3).
• Prospective only. Price changes apply only to Bookings made on or after the change's effective date. We never charge retroactively.
• Decreases. We may reduce pricing without notice and will apply the lower price automatically.

This clause is the only way we change the 2.5% (or introduce a new charge). There is no other clause anywhere in these Service Terms or the MSA that lets us change pricing.

5.6 Pass-throughs

The following are not our pricing and may change with the third party's notice:

• Stripe processing fees and Stripe FX conversion fees.
• Sales tax, GST, VAT and equivalent taxes set by law.
• Currency-conversion costs incurred outside the Platform.

We disclose these up front and we don't mark them up.

6. The service we deliver

6.1 What's included

All of the following, at no additional charge:

• The full Platform — admin console, sales channel, mobile POS app, check-in app, manifest tooling, customer database, marketing comms tooling, reporting.
• All features. No feature gating, no premium tiers, no "upgrade to unlock". If we have it, you have it. (See clause 6.5 for Beta features.)
• API access. Full read/write access to your data via our published API, subject to the fair-use limits in clause 9.2.
• Free onboarding (clause 4.1).
• 24/7 support with the priority matrix at clause 6.4.
• Updates and improvements to the Platform as we release them.

We reserve the right to package future features that materially increase our infrastructure cost separately (for example, AI features running heavy real-time inference). Where we do, existing customers get at least 90 days' notice and a transparent description of what's changing, on the same terms as a pricing change (clause 5.5).

6.2 Uptime SLA

We commit to the following monthly availability, measured calendar-month:

Availability is calculated as: (total minutes in the month − unavailable minutes) / total minutes in the month × 100.

What is excluded from "unavailable minutes":

• Scheduled maintenance announced at least 48 hours in advance. We aim for zero customer-visible scheduled maintenance on the sales channel through blue/green deployment, but we reserve the right.
• Force majeure events (clause 17.3), including outages at upstream cloud providers (such as AWS region or AZ failure), DNS root failures, undersea cable cuts, and government action.
• Operator-caused outages. Examples: you DDoS yourself; your team pastes broken JavaScript into a configurable field; a custom pricing rule you wrote enters an infinite loop; you exceed the API fair-use limits.
• Beta features (clause 6.5).

6.3 Service credits

If we miss the sales-channel SLA in a calendar month, you are entitled to the following credit, applied automatically against your next month's booking fees:

Service credits are the contractual remedy for missed uptime. They are calculated on your sales-channel performance only — admin console outages do not trigger credits but do count as material breach if persistent.

Service credits do not exclude rights under non-excludable consumer-protection law that cannot be excluded by contract. See clause 12.1.

You do not need to claim credits. We monitor SLA performance and apply them automatically. If you believe a credit is owed and has not been applied, contact support@jetsetgo.world within 30 days of the month-end.

6.4 24/7 support

We staff support 24 hours a day, 7 days a week, 365 days a year for triage. The response SLAs below describe what you can expect for each priority level. Priority is set initially by you in the support ticket; we may re-classify and will tell you if we do.

Business hours means 9:00am to 5:00pm Mountain Time (JetSetGo LLC's place of incorporation), Monday to Friday, excluding US federal public holidays.

The honest qualifier. 24/7 means we triage incidents 24/7 and respond to P1 within 30 minutes, every day of the year. P2/P3/P4 responses outside business hours go to the next business day. We will not pretend a P3 ticket lodged at 2am Saturday gets the same response as a P1 outage at 2am Saturday — because it does not, and we'd rather be straight about it than over-promise.

Support is delivered in English. Channels: in-app, support@jetsetgo.world, and a 24/7 P1 escalation phone line published in the admin console.

6.5 Beta features

From time to time we make features available labelled in-product as "Beta", "Preview", "Experimental" or similar. Those features are:

• Not covered by the SLA in clause 6.2.
• Provided as-is, without the warranties in the MSA.
• Subject to our liability only for gross negligence or wilful misconduct in respect of the Beta feature itself.

You can use Beta features or not — your choice. We may withdraw a Beta feature at any time, or replace it with a generally-available equivalent, on reasonable notice.

Nothing in this clause excludes rights under non-excludable consumer-protection law that cannot be excluded by contract. See clause 12.1.

7. Your data and your travellers' data

7.1 You own your data

This clause is quotable verbatim. It is the heart of the agreement.

You retain all rights, title and interest in Operator data. That means:

• Your account and configuration data — your business details, products, pricing rules, schedules, brand assets.
• Your customer database — every Traveller record captured through the Platform, including names, contact details and booking history.
• Your transaction records — every Booking, modification, cancellation, refund, payment event.
• Your custom reports and dashboards — anything you build in our reporting or BI tooling.

We do not claim ownership of your data. We never will. We hold no licence to your data beyond what is necessary to operate the Platform on your instructions and to do the limited de-identified analytics described in clause 7.7.

7.2 Data export — self-serve and on request

You can extract your data from the Platform at any time:

• Self-serve, 24/7. A full CSV/JSON export of your entire dataset is available from the admin console. No support ticket. No fee. No approval. Available throughout the term of the MSA.
• JSON schema. We publish a schema document describing the structure of the exported data so it can be imported elsewhere.
• SQL dump on request. If you need a full SQL dump (Postgres-compatible) we'll provide one within 14 days of a request. No fee for one request per quarter; reasonable cost-recovery for additional ad-hoc dumps.
• No proprietary formats. Exports are in industry-standard formats (CSV, JSON, optionally SQL). You will not need to use any JetSetGo tool to read your exported data.
• No ransom. We never withhold data export because of unpaid invoices or any other commercial dispute. If you owe us money, we pursue that separately.

7.3 Our role for Traveller data

For Traveller PII, you are the controller and we are the processor (or, in CCPA terms, you are the Business and we are a Service Provider). The detailed processor terms — Article 28 GDPR, CCPA section 1798.140(ag), the EU 2021 Standard Contractual Clauses (Module 2), the UK IDTA Addendum, and the equivalent commitments for AU, NZ, Canada and South Africa — are set out in the DPA at jetsetgo.world/legal/dpa, which is incorporated into the MSA.

In plain English: we hold and process your Travellers' data on your instructions, to provide the Platform. We do not use Traveller data for our own purposes except for the narrow, transparent uses in clauses 7.7 and 7.8.

The CCPA / CPRA service-provider obligations in the DPA (in particular, DPA §9) constitute our binding contractual prohibition on selling, sharing or otherwise using Traveller Personal Information outside the service-provider purpose, and our certification of compliance under CCPA / CPRA regulations §7053.

For the avoidance of doubt: the DPA controls in case of conflict on any data-protection-law matter, in accordance with the order of precedence in clause 3.4.

7.4 Privacy notice at checkout

You must display, or arrange to display, a privacy notice at your booking checkout that:

• Identifies you as the controller / business and the merchant for the Booking.
• Discloses JetSetGo as your platform vendor and processor / sub-processor / service provider, with a link to our Privacy Policy.
• Names the cross-border transfer fact (Traveller data may flow to and be stored in Australia, where our primary hosting region sits) where applicable.
• Includes any consents required by your local law.

We provide template language for the JetSetGo-disclosure portion. You adapt the rest to your business.

We maintain the JetSetGo-disclosure template language in current form, updated to reflect any material change to the sub-processor list, the cross-border transfer mechanism, or the Privacy Policy itself. We will notify Operators of material template-language updates via the same 30-day mechanism used for sub-processor changes (clause 10.2).

7.5 Marketing comms to Travellers — your responsibility

If you use the marketing-comms tooling in the Platform to send commercial messages to your Travellers, you are the sender and you must comply with:

• CAN-SPAM Act for US recipients.
• The Spam Act 2003 (Cth) for AU recipients.
• CASL for Canadian recipients.
• GDPR / ePrivacy / PECR for EU/UK recipients.
• NZ's Unsolicited Electronic Messages Act for NZ recipients.
• POPIA section 69 for South African recipients.
• Equivalent local rules for other jurisdictions.

That means consent (express or inferred from the trip relationship as the relevant law permits), accurate sender identification and a working unsubscribe in every commercial message. The Platform supports each of those requirements; configuring them correctly is yours.

You indemnify us under clause 13.1(d) for breach of these rules.

7.6 Children's data

The Platform is built for transport and tourism bookings made by adults, on behalf of themselves and their family parties. We do not knowingly process personal information collected directly from children.

Where you collect data about child Travellers as part of a family booking, you must comply with the children's-privacy rules of the Traveller's jurisdiction (for example COPPA — under 13 — in the US, GDPR Article 8 — typically under 16 — in the EU, Quebec Law 25 — under 14 — in Canada, NZ's age-appropriate-consent rules, POPIA section 34 for under-18s). If your business specifically targets children, additional obligations apply and you must tell us so we can support compliance.

You indemnify us under clause 13.1(c) for breach of these obligations.

7.7 Aggregated and de-identified analytics — what we reserve

We reserve a narrow right to use aggregated, statistically de-identified data drawn from across the Platform for:

(a) Platform improvement — understanding how features are used, identifying bugs, building better tools.

(b) Industry benchmarks — published statistics like "average load factor for whale-watching operators in May".

(c) AI / ML training for in-platform features — your operator's own data is used to train models that produce recommendations for that operator. Cross-operator training on data that has been rigorously de-identified to the k-anonymity ≥10 standard below does not require your opt-in: once de-identified to that standard, the data has ceased to identify any Operator or Traveller. Cross-operator AI training on identifiable Traveller data, by contrast, requires your explicit opt-in — the opt-in trigger applies only to identifiable cross-operator training.

(d) Anonymised industry reports — public reports about the transport / tourism sector.

Our standard for de-identification: k-anonymity ≥ 10 for any published benchmark. That means any datapoint we publish must reflect at least 10 operators (or, for traveller-level cohorts, 10 Travellers) so no individual operator or Traveller is identifiable.

Opt-out from published benchmarks. You can opt out of inclusion in our published industry benchmarks via the admin console. You cannot opt out of internal product-improvement uses of de-identified data — that is a condition of using the Platform.

7.8 No marketing to Travellers from JetSetGo. No sale of Traveller data.

Two hard rules.

(a) We do not market to your Travellers. Ever. We will never send a Traveller a commercial message in our own name. We will never approach a Traveller to sell them a service of ours or of another operator's. Their relationship is with you.

(b) We do not sell Traveller data. Not in identifiable form, not in de-identified form, not in aggregated form. Not to advertisers, data brokers, insurers, transport-sector competitors, or anyone else. There is no scenario in which Traveller data leaves our system as a commercial product.

These commitments survive termination of the MSA.

8. Intellectual property

8.1 The Platform is ours; your data is yours

• We own the Platform. All rights, title and interest in the JetSetGo software, source code, schemas, UI patterns, business-rule engine, configuration framework, documentation and all derivative works are and remain ours.
• You own your data. As described in clause 7.1.

You receive a non-exclusive, non-transferable right to use the Platform during the term of the MSA. You don't receive a copy of the source code, a perpetual licence, or any right to sub-license or resell.

8.2 The licence you grant us

You grant us a non-exclusive, royalty-free, worldwide licence to host, store, process, transmit, copy (for backup and redundancy), and display Operator data, solely for the purpose of:

(a) Operating the Platform and providing the service to you. (b) The narrow de-identified analytics described in clause 7.7. (c) Compliance with law.

That's the entire scope of the licence. It is not perpetual. It is not sublicensable. It is not for any other purpose. It ends when the MSA ends (subject only to the post-termination data-handling steps in clause 11.4).

We do not claim a "perpetual, irrevocable, worldwide, royalty-free, sublicensable" licence to your data. If a clause anywhere in the MSA appears to grant such a thing, this clause overrides it.

8.3 Your configuration is yours

Your specific configuration of the Platform — your pricing rules, packaging logic, inventory structure, business-rule engine setup — is Operator data. We don't claim a hybrid IP position in it. If you leave, you take it. If a competitor builds an identical configuration, that's between you and them; we are neutral.

8.4 Custom reports and dashboards

Custom reports and dashboards you build using our reporting or BI tools are Operator data. Export rights under clause 7.2 apply.

8.5 Feedback

If you give us suggestions, ideas, feature requests or feedback about the Platform, we may use them. You aren't obliged to give feedback; we aren't obliged to act on it. We don't pay for feedback and we don't claim any IP that you actually own. We're recording the fact, not claiming a windfall.

9. Acceptable Use Policy

9.1 What you can't do

The Platform exists to help legitimate transport and tourism operators run their businesses. You agree not to:

(a) Use the Platform unlawfully. No ticket scalping in jurisdictions where it's illegal. No fronting for a sanctioned entity. No money-laundering or terrorism-financing patterns.

(b) Spam your Travellers. No commercial messages without the consent and unsubscribe mechanics required by clause 7.5. No buying email lists. No sending commercial messages to people who never booked with you.

(c) Breach consumer-protection law in your dealings with Travellers. Cancellation terms, refund terms, total-price disclosure, accessibility-disclosure rules. We don't police these proactively, but if we receive a regulator notice or a pattern of chargebacks consistent with consumer-law breach, we'll require you to fix it.

(d) Process fraudulent bookings or engage in chargeback farming.

(e) Abuse the API. This includes:

• Scraping data belonging to other operators on the Platform.
• Training a competing platform on our schema, API contracts, or data structures.
• Reverse-engineering our pricing engine, business-rule engine, or core algorithms.
• Sustained traffic in excess of the published fair-use limits (clause 9.2).

(f) Resell the Platform. White-label resale to other operators requires a separate written agreement with us.

(g) Misuse our marketing-comms tooling. Sending commercial messages on behalf of someone other than your business. Using the customer database to email Travellers who booked with a different operator.

(h) Misuse our brand. Misrepresenting your relationship with us, using our marks without permission, falsely claiming endorsement or certification.

(i) Endanger the Platform. Penetration testing without coordination with us. Uploading malware. Attempting to bypass access controls. Deliberately overloading the system.

9.2 API fair use

API access is included with your account. Reasonable use is whatever a sensible operator running their business needs. Sustained traffic that materially impacts other operators on the Platform, or that looks like scraping rather than business use, is not fair use.

We publish current rate limits in the API documentation. If you need more than the published limit for a legitimate reason (a peak day, a one-off batch migration), contact us and we'll work with you.

9.3 Escalation: warning → cure → suspension → termination

If we believe you have breached the AUP:

1. Warning. We tell you what we've seen and what needs to change.
2. 14-day cure period. You have 14 days to fix it. (Some issues have an obvious quick fix; others may take negotiation about how to comply — we'll work with you.)
3. Suspension. If you have not cured within 14 days, or if the issue recurs after cure, we may suspend the Platform.
4. Termination. Continued or material breach may result in termination under clause 11.6.

AUP cures and the cures for breaches of the DPA follow the same 14-day cure period.

Immediate suspension is available without a cure period only for clear-cut illegality — for example, a regulator order directed to us, a confirmed sanctions-list hit, or a court order. Where we suspend immediately, we will:

• Tell you within 24 hours why we suspended.
• Preserve your data and your data-export rights (clause 14.2).
• Lift the suspension as soon as the issue is resolved, where lawful to do so.

10. Privacy and security

10.1 The Privacy Policy and DPA are part of the MSA

The Privacy Policy at jetsetgo.world/privacy, and the DPA at jetsetgo.world/legal/dpa, are incorporated into the MSA by reference.

The DPA contains the full processor / sub-processor / Service Provider terms required by GDPR Article 28, the UK GDPR, CCPA section 1798.140(ag), the Australian Privacy Act and APPs, NZ Privacy Act 2020, Quebec Law 25, PIPEDA and POPIA, including:

• Subject matter, nature, purpose and duration of processing.
• Categories of data subjects and types of personal data.
• Sub-processor general authorisation and the 30-day notice / objection mechanic.
• Cross-border transfer safeguards: the EU 2021 Standard Contractual Clauses (Module 2) and the UK IDTA Addendum.
• Audit rights (clause 10.6 of these Service Terms, and DPA §14).
• Breach notification SLA (clause 10.4 of these Service Terms, and DPA §11).
• Return and deletion of personal data on termination (clause 11.4 of these Service Terms, and DPA §12).

By signing the MSA you accept the DPA. No separate DPA signature is required, although a separately-signed counterpart of the DPA can be requested if your procurement process requires one — we will sign it without re-negotiating substance.

10.2 Sub-processors

We use sub-processors to provide the Platform — for hosting, the primary production database, authentication, payments, email and SMS, and edge networking. The current list is published at jetsetgo.world/sub-processors and reproduced in DPA §6, including the vendor name, role, data categories and country of hosting.

Changes to the sub-processor list.

• We give 30 days' notice of any new or replacement sub-processor by email to your account owner and an in-product banner, and we update the published list.
• Costless objection right. If you reasonably object to a new sub-processor on data-protection grounds within 30 days, you may terminate the MSA without penalty and exercise your data-export rights under clause 11.4. You may also terminate only for the affected service if termination of the whole MSA is disproportionate — we'll work with you on what's reasonable.
• No objection in 30 days = deemed authorisation. If you don't object within the 30-day window, the change is treated as authorised.

We require sub-processors to commit to data-protection terms substantially the same as ours and we remain accountable to you for their performance of sub-processed activities.

10.3 Security commitments

We follow security practices informed by the SOC 2 and ISO 27001 frameworks. We do not currently hold either certification and we will not claim certification until we do. At a minimum, we maintain:

• Encryption in transit for all customer data (TLS 1.2 or later).
• Encryption at rest for production databases and backups.
• Role-based access controls with least-privilege defaults and multi-factor authentication for staff with access to production data.
• Audit logging of access to personal information and to admin functions.
• Vendor due-diligence on sub-processors, with contractual flow-down of data-protection obligations.
• Personnel obligations — confidentiality, security training, background checks where lawful.
• Incident response procedures aligned with GDPR Article 33, the Australian Notifiable Data Breach scheme, and equivalent regimes.
• Logical separation of operator tenants — no operator can access another operator's data.

We test the Platform periodically (penetration testing, vulnerability scanning) and remediate findings. The full security overview is in the Privacy Policy and DPA Annex II.

10.4 Breach notification

If we become aware of an actual or reasonably-suspected breach involving personal data we hold for you, we will:

• Notify you within 24 hours of becoming aware. That notice will set out what we know about what happened, when, what data is involved, the categories of data subjects (estimate), mitigations underway, and a contact point for follow-up. Information available later is added as we get it.
• Where the breach affects only your Traveller data (for example because of an admin error in your account giving access to staff who should not have had it): you lead the regulator-notification process; we assist with forensics, evidence and parallel-notification where we are legally required to notify the relevant regulator as the holder.
• Where the breach affects multiple operators because of a Platform-side incident: we lead the regulator-notification process; we coordinate with you on the Traveller-individual notification piece because your voice is more appropriate than ours.
• Cost allocation. We bear notification costs for Platform-caused breaches. You bear notification costs for operator-caused breaches.
• Operator account data only. If a breach affects only your account / staff / billing data (not Traveller data), we are the controller; we notify you and the relevant regulators ourselves.

This SLA aligns with GDPR Article 33(2), UK GDPR, the AU Notifiable Data Breach scheme, NZ Privacy Act, PIPEDA, and POPIA.

10.5 Government and regulator requests

If we receive a request from a government agency, law-enforcement body or regulator for your data:

• Default: we notify you before disclosing data, so you can object or seek a protective order.
• Exception: where we are legally prohibited from notifying you (gag order, sealed warrant, statutory non-disclosure obligation), we'll comply with the law and notify you as soon as the prohibition lifts.
• Narrow construction. We construe requests narrowly and produce only what is lawfully required.
• Challenge. We will challenge over-broad or improper requests where it is lawful to do so.

We will publish an annual transparency report on the volume and types of government and law-enforcement requests we receive, once we have meaningful volume to report, in line with section 16 of the Privacy Policy. The report will not identify individual Operators or Travellers.

10.6 Audit

Sophisticated operators want to be able to verify our security and privacy posture. We accommodate that as follows:

• Third-party reports. When we hold them (SOC 2 Type II or equivalent — see clause 10.3), we make them available under NDA on reasonable request.
• Written questionnaire. We respond to a reasonable written security / privacy questionnaire once per calendar year.
• Remote audit. Once per calendar year, on at least 30 days' written notice, you may conduct a remote audit (video, screen-share, document review) of our security and data-protection controls relevant to your data, at your cost, subject to confidentiality and reasonable scope. Audit cannot disrupt other operators' service and is not conducted on-site at JetSetGo's premises or at our hosting providers' facilities (including AWS Sydney and Oracle Cloud Infrastructure Sydney).
• Breach-triggered audit. If we have notified you of a breach affecting your data, the once-per-year limit doesn't apply and we bear our own costs of co-operating with your investigation.
• Reasonable scope. Audits are scoped to your data, the Platform and our controls. They do not extend to other operators' configurations or data.

The full audit clauses are in DPA §14.

11. Term and termination

11.1 No fixed term

The MSA starts on the Effective Date (clause 3.3) and runs until either party terminates it. There is no fixed term. There is no auto-renewal because there is no renewal.

11.2 How you cancel — anytime

You can terminate the MSA at any time by:

• Clicking "Cancel my account" in the admin console; or
• Emailing support@jetsetgo.world with a termination request.

No phone calls required. No retention scripts. No exit interview. We will acknowledge your termination within 1 business day.

Effective date of your termination.

• Default: end of the current calendar month. This is usually what operators want — it keeps in-flight bookings clean.
• Immediate, at your option. You can also choose immediate effect. Tell us in the termination request.

11.3 90-day wind-down

For up to 90 days after the effective date of termination, at your option, we will keep your account operational on a read-only / fulfil-existing-bookings basis. During the wind-down:

• Travellers who already booked before the termination effective date can be served, checked in, refunded, and rebooked using the Platform.
• You can continue to export data.
• You can keep using the POS, check-in and manifest tools to fulfil in-flight bookings.
• New bookings are not accepted through the Platform (your sales channel is switched off unless you ask us to keep it on for a specific reason).
• Stripe Connect payouts continue to settle to your Stripe account in the normal way for any Bookings made before termination.

Booking fees on Bookings processed during wind-down are charged on the same terms as before termination. If you terminated in response to a price increase under clause 5.5, the old price applies through wind-down.

The wind-down is at your option. You can also walk away on day 1, export your data, and never come back.

11.4 Effect of termination — data export, deletion, and the deletion certificate

After termination:

• 90-day read-only access to the admin console for data export. Self-serve CSV/JSON; SQL dump on request within 14 days of request (clause 7.2).
• After 90 days, your production data is hard-deleted from production within 30 days.
• Backups age out over the following 12 months (rolling 12-month backup retention; nothing kept longer than 12 months from the last activity, except where law requires retention).
• Deletion certificate on request. When deletion is complete, you can request a written certificate confirming what was deleted and when. We provide it within 30 days of your request.
• No ransom. None of these steps depend on you having paid every invoice. If you owe us money, we pursue that separately.

11.5 Stripe Connect payouts continue

Termination of the MSA does not affect your Stripe account or interrupt payouts of funds already in the Stripe pipeline. You hold your own Stripe account; that relationship continues independently. We stop deducting our 2.5% application fee on new Bookings from the termination effective date.

We cannot influence Stripe's own account-management decisions. Stripe may suspend, restrict or terminate your Stripe account independently of the MSA (for fraud, KYC, AML or risk-review reasons). Where Stripe risk is material to your operation, you should maintain alternative payout arrangements; that risk sits between you and Stripe.

11.6 Termination for cause (by either party)

Either party may terminate the MSA immediately for cause if:

• The other party commits a material breach and does not cure it within 30 days of written notice of the breach.
• Non-payment. For operator non-payment of any undisputed amount, the cure period is 14 days from written notice. You may place an amount in dispute by written notice to legal@jetsetgo.world setting out the basis of dispute; while the amount is in good-faith dispute, it does not count toward the 14-day cure trigger.
• Insolvency. The other party becomes insolvent, makes an arrangement with creditors, has an administrator or liquidator appointed, or stops carrying on business in the ordinary course.

For the avoidance of doubt, where the breach is a material breach by us of the DPA and it has caused a regulator-notification obligation on you that cannot be addressed by cure within the regulator's notification deadline, you may, in addition to seeking cure under this clause, exercise any termination right available under the DPA or applicable data-protection law without waiting for the 30-day cure period to expire.

Immediate suspension by us, without a cure period, is available for clear-cut illegality (regulator order, confirmed sanctions hit, court order) under clause 9.3.

You may also terminate immediately under:

• Clause 5.5 (within 60 days of a pricing-change notice).
• Clause 6.3 (when sales-channel availability is below 95% in a calendar month).
• Clause 10.2 (within 30 days of a sub-processor change you object to).
• Clause 15 (within 30 days of a material variation we propose).
• Clause 16 (within 90 days of a change-of-control event we tell you about, if the successor does not adopt these terms).

11.7 Termination for convenience by us

We may terminate the MSA for convenience on 90 days' written notice to your account owner. During those 90 days:

• The Platform continues to operate normally.
• You can export your data at any time.
• After the termination effective date, the wind-down under clause 11.3 applies.

We don't anticipate needing this clause. It exists so we can wind down or restructure the business if commercially necessary. We will not use it as a back-door for "we changed our minds about your business" — material decisions about your individual account are made under clause 11.6 (for cause), not this clause.

11.8 Survival

The following clauses survive termination: clause 5 (in respect of fees accrued before termination), clauses 7.1 and 7.8 (your data, our hard rules), 8 (IP), 11.4 and 11.5 (post-termination data and Stripe), 12 (liability), 13 (indemnities), 17 (general) and any clause that by its nature should survive.

12. Liability

12.1 Non-excludable consumer-protection rights

Nothing in these Service Terms or the MSA excludes, restricts, or modifies any consumer guarantee, right, or remedy you may have under the consumer-protection law of your place of establishment that cannot be excluded by contract. Where Australian Consumer Law applies (Schedule 2 of the Competition and Consumer Act 2010 (Cth)) — that is, where the Operator acquires the Services in Australia and either the fees are under AUD 100,000 or the Services are of a kind ordinarily acquired for personal/domestic use — JetSetGo's liability for breach of a non-excludable guarantee on services is limited under section 64A of the ACL to (at JetSetGo's option) supplying the services again or the cost of having them re-supplied. Where the consumer-protection law of another jurisdiction applies and provides for analogous non-excludable rights (for example, the New Zealand Consumer Guarantees Act 1993, the UK Consumer Rights Act 2015 and B2B fairness norms, US state UDAP statutes), those rights are similarly preserved.

If any clause in these Service Terms or the MSA is inconsistent with a non-excludable right, that clause does not apply to the extent of the inconsistency.

12.2 Our liability cap

Subject to clause 12.1 and clause 12.4:

(a) General cap. Our total aggregate liability to you for all claims arising out of or in connection with the MSA in any 12-month period is limited to the greater of:

• the total fees paid by you to us in the 12 months immediately preceding the event giving rise to the claim; or
• USD $50,000.

(b) Data-breach cap. For claims arising out of or in connection with a breach of personal data (Traveller PII specifically), our liability is limited to the greater of:

• 2 × the total fees paid by you to us in the 12 months immediately preceding the event giving rise to the claim; or
• USD $250,000.

(c) Uncapped carve-outs. The caps in (a) and (b) do not apply to:

• Our wilful breach of confidentiality.
• Our infringement of a third party's intellectual property rights via the Platform itself (not via Operator content).
• Liability that cannot lawfully be excluded under non-excludable consumer-protection or privacy law.

These three carve-outs are the only categories that are uncapped. Indemnities, indirect or consequential loss, third-party traveller claims that do not trace to our wilful act, and statutory penalties imposed on you by your regulator are not uncapped.

Higher caps may be negotiated as part of the Master Services Agreement.

12.3 Your liability to us

Your liability to us for operator indemnity claims under clause 13.1 is uncapped to the extent the claim traces to your content, conduct or breach of warranty — because we cannot be on the hook for, for example, your selling tickets to a vessel without a safety certificate, or your unlawful collection of Traveller PII.

Your liability to us for other claims under the MSA (for example, breach of your AUP obligations that doesn't trigger indemnity) is subject to the same general cap in clause 12.2(a), with the same carve-outs adapted symmetrically.

12.4 No indirect or consequential loss

Subject to clauses 12.1 and 12.2(c), and to the maximum extent permitted by law, neither party is liable to the other for:

• Loss of profits.
• Loss of revenue (other than fees actually accrued and payable under the MSA).
• Loss of business opportunity.
• Loss of goodwill or reputation.
• Loss of anticipated savings.
• Indirect, special, consequential or punitive damages.

Service credits under clause 6.3 are the contractual remedy for missed SLA. You are not entitled to recover lost ticket revenue or other consequential loss in respect of a downtime event as direct damages. This clause does not exclude rights under non-excludable consumer-protection law that cannot be excluded by contract (clause 12.1).

12.5 Time bar

All claims under the MSA must be brought within 12 months of the event giving rise to the claim. Claims brought outside this window are barred to the maximum extent permitted by law.

This time bar does not apply where the relevant law gives a longer limitation period that cannot be shortened by contract.

13. Indemnities

13.1 Your indemnity to us

You will indemnify us, and our directors, employees and contractors, against losses, costs, fines, regulator penalties and reasonable legal costs we suffer arising out of or in connection with:

(a) Your IP or IP-licence breaches — your content (product descriptions, photos, brand assets, anything you put into the Platform) infringes a third party's IP rights or breaches a licence to which you were subject.

(b) Your unlawful use of the Platform — you breach clause 9 (AUP) or otherwise use the Platform in a way that is unlawful in the jurisdictions where you operate.

(c) Your breach of privacy or consumer-protection obligations to Travellers — including the warranties in clause 4.3 about lawful collection of Traveller PII, privacy notice at checkout, children's data consents, and honest disclosure of cancellation and refund policies.

(d) Your misuse of marketing-comms tooling — sending commercial messages that breach CAN-SPAM, the Spam Act 2003 (Cth), CASL, GDPR / ePrivacy, NZ's UEM Act, POPIA section 69, or equivalent law (clause 7.5).

(e) Your operation of the underlying transport, tour or hospitality service — to the extent the loss traces to that underlying service rather than to the Platform: Traveller injury caused by your vessel, vehicle or operation; safety, accessibility and licensing failures in your service; the accuracy of the trip information you publish; and the fitness of your staff and equipment. This bullet bites only where the loss is grounded in your underlying service. It does not bite where the loss traces to a defect in the Platform.

This indemnity is fully apportioned: reduced to the extent the loss was caused by our breach, our negligent or wilful act, or a defect in the Platform. Where the loss was caused jointly by Operator action and Platform defect, liability is apportioned between the parties on a comparative-fault basis.

13.2 Our indemnity to you

We will indemnify you, and your directors and employees, against losses, costs and reasonable legal costs you suffer arising out of or in connection with:

(a) A third-party claim that the Platform itself (not Operator data and not your configuration) infringes the third party's IP rights. If that happens, we will (at our option) defend the claim, modify the Platform to avoid infringement, secure a licence, or terminate the affected feature with reasonable transition support.

(b) Our wilful breach of confidentiality.

(c) Our material breach of the DPA that causes a regulator-imposed loss on you. For this category, our indemnity is subject to the data-breach cap in clause 12.2(b) where the claim is between us and you; statutory penalties imposed on you by your regulator are not subject to inter-party caps and we bear our own regulatory exposure rather than pushing it onto you.

This indemnity is reduced to the extent the loss was caused by your breach or by your negligent or wilful act.

13.3 How indemnities work

If a party is entitled to claim under an indemnity:

• Prompt notice. The indemnified party tells the indemnifying party promptly after becoming aware of the claim.
• Co-operation on defence. The parties will co-operate on the defence and settlement of the claim. The indemnifying party may participate in the defence and propose counsel; the indemnified party retains overall conduct of its own defence. Neither party will unilaterally settle the claim without the other's prior written consent (not to be unreasonably withheld or delayed). In particular, any settlement that imposes a non-monetary obligation on the indemnified party (an admission of liability, an injunction, a public apology) requires that party's prior written consent.
• Co-operation generally. The indemnified party co-operates reasonably with the defence at the indemnifying party's cost.
• Mitigation. The indemnified party takes reasonable steps to mitigate its loss.

14. Suspension

14.1 Grounds for suspension

We may suspend all or part of the Platform if:

• Non-payment. An undisputed invoice is more than 14 days past due (and we've given you written notice).
• AUP breach. You have breached clause 9 and have not cured within the relevant cure period.
• Clear-cut illegality (clause 9.3).
• Regulator order directed to us requiring suspension.
• Imminent risk to the Platform or other operators — for example, your account is the vector for an active attack on the Platform or compromised credentials are being used.
• Stripe restriction on your account that prevents us from processing bookings.

We will tell you why we are suspending, when we suspended, and what is required to lift the suspension, within 24 hours of suspending.

14.2 Effect on data

Suspension does not affect your data-export rights. Your data is preserved. You can still export your data under clause 7.2 during a suspension. You can still terminate under clause 11.2 during a suspension.

We do not use suspension as a hostage tactic. Suspension is a tool to stop active harm, not a way to extract payment or concessions.

15. Variation of these Service Terms

15.1 Material changes

We may change these Service Terms from time to time. For material changes (changes that materially affect your rights or obligations), we will:

• Give you at least 30 days' written notice by email to your account owner and an in-product banner.
• Publish the new version of these Service Terms with a clear "what changed" summary.

15.2 Your costless-exit right

If you object to a material change, you may terminate the MSA without penalty within 30 days of the notice, and exercise your data-export rights under clause 7.2 and your wind-down right under clause 11.3.

If you don't terminate within 30 days, the changes apply from the effective date stated in the notice.

15.3 Pricing changes

Pricing changes follow the longer notice in clause 5.5 (90 days' notice + 60-day costless-exit window + old-price wind-down). The 30-day notice in clause 15.1 does not apply to pricing.

15.4 Non-material changes

For non-material changes (clarifications, typo fixes, changes that don't affect your rights or obligations), we update the document, change the "last updated" date and post the change. No prior notice is required.

We do not have a "we may change these terms at any time at our sole discretion" clause. This clause 15 is the only way these Service Terms change.

15.5 Updates to the DPA

Material updates to the DPA are governed by DPA §18, which provides a 30-day notice and costless-exit mechanic analogous to clauses 15.1 and 15.2.

16. Change of control / acquisition

If we are acquired, or our business or substantially all of our assets are sold to another party, the same commitments in these Service Terms and the MSA go with the business. The buyer becomes "JetSetGo" for the purposes of your MSA, on the same terms.

If the buyer does not adopt these terms in substance, we will tell you within 30 days of the change-of-control event. You then have 90 days from our notice to terminate the MSA for convenience, with full data export under clause 7.2 and the 90-day wind-down under clause 11.3.

This clause is one of the five commitments highlighted on page 1. We are aware operators are nervous about being acquired and quietly re-papered onto worse terms. We are not signing up for that and neither are you.

17. General

17.1 Governing law and forum

The MSA, and these Service Terms as incorporated into it, are governed by the laws of the State of New Mexico, United States of America, except that:

• The DPA is governed in accordance with its own clause 17.
• The EU 2021 Standard Contractual Clauses and the UK IDTA Addendum incorporated by the DPA are governed in accordance with their own governing-law clauses (Ireland for the EU SCCs; England and Wales for the UK Addendum).

The parties submit to the non-exclusive jurisdiction of the state and federal courts located in New Mexico, except that the choice of forum for the EU SCCs is the courts of Ireland (Clause 18) and for the UK Addendum is the courts of England and Wales, in each case as incorporated by the DPA.

"Non-exclusive" means a party can bring proceedings in another forum where it is necessary (for example, to enforce a judgment against assets located elsewhere). The choice of New Mexico as governing law and primary forum stands regardless, subject to the carve-outs above.

Non-excludable rights preserved. Nothing in this clause 17 prevents you (or, where applicable, a Traveller as Data Subject) from asserting non-excludable consumer-protection rights or non-excludable privacy rights that apply under the law of your place of establishment or the place where the affected individual resides — those rights are preserved. Examples include the Australian Consumer Law and the Australian Privacy Principles for Operators or individuals in Australia; the NZ Consumer Guarantees Act and NZ Privacy Act for those in New Zealand; the UK Consumer Rights Act and UK GDPR for those in the United Kingdom; the GDPR for those in the EU/EEA; POPIA for those in South Africa; and US state consumer-protection and privacy statutes that cannot be excluded by contract.

17.2 Notices

• Notices from us to you: by email to the address registered on your account, or by an in-product banner where appropriate.
• Notices from you to us: by email to support@jetsetgo.world for operational matters and to legal@jetsetgo.world for legal notices.
• A notice is taken to be received on the business day after it is sent, where the sender has no reasonable indication of non-delivery (a bounce-back, an out-of-office that says the recipient has left, etc.).

17.3 Force majeure

Neither party is liable for failure to perform an obligation (other than payment) to the extent the failure is caused by an event beyond that party's reasonable control. Force majeure events include:

• Acts of God, natural disaster, fire, flood, earthquake, severe weather, pandemic.
• War, terrorism, civil unrest, riot, government action, sanctions.
• Cyber attack against third-party essential internet infrastructure outside JetSetGo's reasonable control (for example, a root DNS failure, undersea cable cut, or an attack on an upstream cloud-provider region that affects multiple operators on our hosting platform). A cyber attack against JetSetGo's own systems is not a force majeure event and is governed instead by clause 10.4 (breach notification) and DPA §11.
• Region-level cloud-provider outage that affects multiple operators in our hosting region.
• Strike or labour dispute outside the affected party's own workforce.

Force majeure does not include:

• Changes in market conditions, supply costs or business strategy.
• A party's own financial difficulty.
• A party's failure to maintain redundancy or backups within its own systems.
• Routine vendor service degradations that reasonable redundancy planning could have mitigated.

The affected party must notify the other promptly, mitigate where reasonable, and resume performance as soon as possible. If a force majeure event prevents performance for more than 60 consecutive days, either party may terminate.

17.4 Entire agreement

The MSA (together with these Service Terms, the Privacy Policy, the DPA, and the sub-processor list, all incorporated by reference) is the entire agreement between the parties about its subject matter. It replaces any earlier discussions or proposals (including anything in a sales call, a cold email or a marketing page) to the extent inconsistent. The public commitments on jetsetgo.world (2.5% per booking, no setup fees, no monthly minimums, no contracts, cancel anytime, you own your data, free onboarding, 24/7 support, all features included, API access included, strict uptime SLA) are honoured by, and are intended to be enforced through, the operative clauses of the MSA. To the extent of any difference, the operative clauses prevail.

17.5 Severability

If a clause of these Service Terms or the MSA is found by a court or competent authority to be invalid or unenforceable, it is severed to the extent of the invalidity. The remaining clauses continue in effect. The parties will work in good faith to replace the severed clause with one that achieves the same commercial outcome lawfully.

17.6 No waiver

If a party fails to enforce a right under the MSA, that is not a waiver of the right. Waivers must be in writing to be effective.

17.7 Assignment

• Us assigning. We may assign or transfer the MSA, or any of our rights or obligations, in connection with a change of control (clause 16), an internal restructure, or to a successor in business, on notice to you. Clause 16 protects you in those scenarios.
• You assigning. You may assign the MSA to a successor in your business (for example, on a sale of your business as a going concern) on prior written notice to us, provided the successor is not, as at the date of assignment, (i) a direct competitor of JetSetGo in the transport and tourism booking SaaS market, (ii) a sanctioned entity under the law of the United States or the successor's jurisdiction of incorporation, or (iii) a JetSetGo operator that has been terminated for cause in the preceding 24 months. Our consent to assignment is not to be unreasonably withheld or delayed, and any refusal must be communicated in writing within 30 days of notice with reasons.

17.8 No third-party beneficiaries

The MSA is between you and us. No third party (including Travellers) has rights under it, except:

(a) Where local law gives a Traveller, regulator or other person an independent statutory right that cannot be excluded by contract — those rights are unaffected.

(b) The third-party-beneficiary rights granted to Data Subjects by Clause 3 of the EU 2021 Standard Contractual Clauses, and the equivalent rights under the UK IDTA Addendum, as incorporated by the DPA — those rights are preserved and enforceable in accordance with the SCCs and the UK Addendum.

(c) The DPA is enforceable as between you and us; data-subject statutory rights against you as controller and against us as processor are governed by the applicable privacy law, not by this contract.

17.9 Counterparts and electronic signature

The MSA may be signed electronically and in counterparts. An electronic signature is binding.

18. How to contact us

18.1 Direct contact

• Operational support and account questions: support@jetsetgo.world
• Privacy questions and data-subject requests: privacy@jetsetgo.world
• Legal notices, including disputes: legal@jetsetgo.world
• Address: JetSetGo LLC, a New Mexico limited liability company. Full registered-agent address provided on request.

18.2 Escalation for unresolved disputes

We try to resolve every issue at the support level. If a dispute is not resolved within 30 days of you raising it through support@jetsetgo.world or legal@jetsetgo.world, you can ask for executive escalation by writing to legal@jetsetgo.world and requesting it. A senior member of the JetSetGo team will personally review the matter. A direct line for urgent escalations is published in the admin console.

18.3 Court process

If escalation under clause 18.2 doesn't resolve the dispute within a further 30 days, either party can bring proceedings in the state and federal courts located in New Mexico, under clause 17.1.

We do not require mandatory arbitration. We do not require waiver of class actions. We do not require the dispute to go to a forum that disadvantages you on cost or distance — escalation to a New Mexico court is the only mandatory forum, and it is non-exclusive (clause 17.1), and your non-excludable consumer-protection and privacy rights in your own jurisdiction are preserved.

End of Service Terms.

For the data-handling and privacy commitments referenced throughout — including the Data Processing Addendum, the sub-processor list, the EU Standard Contractual Clauses and the UK IDTA Addendum — see the DPA at jetsetgo.world/legal/dpa and the Privacy Policy at jetsetgo.world/privacy.