Legal

Terms & Conditions

Effective Date: October 14, 2026

1. Introduction and Acceptance

These Website and Service Terms and Conditions (these “Terms”) govern access to and use of:

• https://hedycyber.com and other websites that link to these Terms (collectively, the “Website”); and
• Hedy’s software and related services for building and operating private, encrypted overlay networks (“Mesh Networks”) over the network connections a customer already uses. The software includes features designed to make network traffic harder to analyze. The products and services including associated software, applications, portals, documentation, interfaces, support resources, and related services made available under these Terms (collectively, the “Services”), are described in further detail in Section 4.

These Terms form a legally binding agreement between Hedy Cyber, Inc., a Delaware corporation (“Hedy,” “we,” “us,” or “our”), and the person or organization accessing or using the Website or Services (“you” or “your”).

By accessing or using the Website or Services, creating an account, clicking to accept these Terms, or otherwise indicating acceptance, you agree to these Terms. If you do not agree, do not access or use the Website or Services.

Organizational users

If you access or use the Website or Services on behalf of a company, government agency, military department, government contractor, educational institution, or other organization, then:

1. "you" and "your" include that organization;
2. you represent that you have authority to bind the organization to these Terms; and
3. if you lack that authority, you may not accept these Terms on the organization's behalf.

If an authorized organization provides you access to the Services, your access is also subject to that organization’s agreements, policies, administrator instructions, and applicable laws and regulations.

2. Relationship to Customer and Government Agreements

These Terms establish baseline rules for the Website and use of Services when no more specific written agreement controls. They are not intended to replace a mutually executed master services agreement, government contract, subcontract, task or delivery order, purchase order, order form, end-user license agreement, data processing agreement, service-level agreement, statement of work, or other written agreement governing the Services (each, a “Customer Agreement”).

Order of precedence

If a conflict exists among applicable documents, the following order of precedence applies unless a Customer Agreement expressly states otherwise:

1. a binding government contract, subcontract, task or delivery order, or other procurement instrument, including applicable mandatory laws, regulations, and incorporated agency terms;
2. a mutually executed Customer Agreement;
3. an executed order form or statement of work under that Customer Agreement;
4. any policy or addendum expressly incorporated into the applicable Customer Agreement or order; and
5. these Terms.

The more specific provision controls over a more general provision regarding the same subject. These Terms do not amend a Customer Agreement unless the Customer Agreement expressly incorporates them for that purpose.

3. Eligibility and Authorized Users

You may use the Services only if:

• you are at least 21 years old and legally capable of entering into a binding agreement;
• you are authorized by the applicable customer or account administrator;
• your use is permitted under applicable law, regulation, contract, and organizational policy; and
• you are not prohibited from receiving the Services under applicable export-control, sanctions, or other trade-restriction laws.

An “Authorized User” is an individual whom Hedy or a customer has authorized to access the Services. Account access is personal to the Authorized User unless the applicable Customer Agreement expressly permits shared or non-human accounts.

Customer administrators may provision, manage, monitor, restrict, suspend, or terminate Authorized User accounts. When an account is organization-managed, the organization may have access to account information and Customer Content and may control retention, export, disclosure, and deletion.

4. Website and Services

As of the date of these Terms, Hedy provides the following Services through its deployment models as described below:

• Hedy Software. Hedy provides network software that its customers install on computers, servers, network appliances, virtual machines and end-user devices that Customer chooses (“Nodes”) that make up its network, and it encrypts traffic between those Nodes while routing communications according to the connectivity and access rules the Customer configures.
• Management Console. The Management Console is a web application the Customer designates to enroll and revoke Nodes, manage cryptographic keys, users, roles, groups, and routing, and monitor network status and performance, with optional support for single sign-on and programmatic access depending on the Customer’s license.
• Client Applications. Client software for the operating systems listed in the Documentation.
• Professional and Support Services. As set out in an applicable order form or agreement (“Order Form”), Hedy may provide professional and support services such as deployment and onboarding assistance, training, technical support, and Software updates.
• Website. The informational content and materials Hedy publishes at hedycyber.com.

The Software and Management Console run on infrastructure that Customer owns or controls. Hedy does not operate Customer’s Mesh Network, and Customer traffic does not pass through infrastructure Hedy operates. The Software does not connect to servers operated by Hedy, and license validation happens offline.

Features, functionality, availability, and technical requirements may vary by deployment, account type, location, customer configuration, and Customer Agreement. Descriptions on the Website are informational and do not create warranties or commitments unless expressly incorporated into a Customer Agreement.

Hedy may improve, modify, replace, or discontinue Website or Service features from time to time. Where a Customer Agreement applies, material changes to purchased Services will be governed by that agreement. Hedy does not undertake to provide any feature, integration, certification, authorization, or roadmap item unless expressly committed in a signed Customer Agreement.

5. Limited Right to Use the Services

Subject to these Terms and any applicable Customer Agreement, Hedy grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Website and Services:

• for your internal business or authorized governmental purposes;
• during the applicable subscription or authorized-use period;
• within the documented scope, capacity, and deployment; and
• in accordance with applicable documentation, laws, regulations, and organizational requirements.

No rights are granted by implication. Hedy and its licensors reserve all rights not expressly granted.

Any software delivered for installation or customer-managed deployment is licensed, not sold, and remains subject to the scope, term, usage limits, and other conditions in the applicable Customer Agreement or license documentation.

6. Accounts and Security

You must:

• provide accurate, current, and complete account information;
• maintain the confidentiality of credentials, authentication factors, keys, tokens, certificates, and account recovery information;
• use only accounts and credentials assigned or authorized for your use;
• comply with applicable identity, access-control, and authentication requirements;
• promptly revoke access for individuals who are no longer authorized;
• promptly notify Hedy at security@hedycyber.com of suspected account compromise, unauthorized access, or misuse; and
• cooperate reasonably with Hedy’s investigation and remediation of security incidents.

You may not share individual credentials, allow unauthorized access, or circumvent account controls. You are responsible for activity conducted through your account to the extent caused by your acts, omissions, or failure to protect credentials, except to the extent attributable to Hedy’s breach of an applicable obligation.

Hedy may require credential resets, additional authentication, access restrictions, or other protective measures when reasonably necessary to protect the Services, users, customers, or third parties.

7. Customer and User Responsibilities

You are responsible for:

• determining whether the Services are appropriate for your intended use;
• configuring and using the Services in accordance with applicable documentation;
• obtaining all rights, permissions, authorizations, and consents needed to submit and process Customer Content;
• the accuracy, quality, legality, and integrity of Customer Content;
• complying with agency, employer, customer, network, device, data-handling, and records-management rules;
• maintaining compatible systems, networks, devices, and security controls not supplied by Hedy;
• managing Authorized Users, roles, permissions, integrations, and administrative settings under your control;
• implementing appropriate backups and business-continuity measures unless a Customer Agreement assigns those responsibilities to Hedy; and
• complying with all applicable laws, regulations, contractual obligations, and third-party rights.

You may not represent that Hedy has certified, approved, authorized, endorsed, or validated your systems, security posture, regulatory compliance, or use of the Services unless Hedy has expressly agreed in writing.

8. Acceptable Use

You may not use the Website or Services to:

1. violate any law, regulation, court order, government requirement, contractual obligation, or third-party right;
2. access systems, accounts, data, devices, or networks without authorization;
3. impersonate another person or organization or misrepresent your identity, authority, affiliation, or purpose;
4. transmit unlawful, infringing, fraudulent, deceptive, defamatory, or malicious material;
5. distribute spam or conduct unauthorized surveillance, tracking, or interception;
6. expose Hedy, its customers, or third parties to avoidable security, legal, or operational risk;
7. exceed documented usage limits or use the Services in a manner that materially degrades availability for others;
8. remove, alter, or obscure proprietary notices;
9. use the Services for high-risk activities for which they are not expressly designed or authorized; or
10. assist another person or entity in doing any of the foregoing.

9. Cybersecurity-Specific Restrictions

Except to the extent expressly authorized in advance in writing by Hedy, permitted under a published Hedy security research policy, or protected by non-waivable law, you may not:

• scan, probe, test, or assess the vulnerability or security of the Website, Services, Hedy infrastructure, or another customer’s environment;
• conduct penetration testing, red-team activity, exploitation, lateral movement, or post-exploitation activity;
• attempt credential stuffing, password spraying, brute-force attacks, token theft, session hijacking, phishing, social engineering, or authentication bypass;
• introduce, execute, or distribute malware, ransomware, spyware, destructive code, unauthorized agents, or command-and-control mechanisms;
• interfere with, disrupt, overload, degrade, or deny service to systems, networks, accounts, or users;
• bypass, disable, defeat, or circumvent security, access, rate, usage, tenant-isolation, logging, monitoring, or technical controls;
• access or attempt to access source code, nonpublic APIs, administrative interfaces, systems, or data without authorization;
• reverse engineer, decompile, disassemble, decode, translate, or otherwise attempt to derive source code, underlying ideas, algorithms, models, protocols, structures, or nonpublic technical information, except where non-waivable law expressly permits the activity;
• modify, adapt, reproduce, or create derivative works of the Services except as expressly authorized;
• use automated means to scrape or extract nonpublic information;
• conduct competitive benchmarking or publish performance, security, or comparative test results without Hedy’s prior written consent; or
• use the Website, Services, documentation, outputs, or nonpublic information to develop, train, improve, validate, or commercialize a competing product or service.

Authorized security research

Security testing or research is permitted only when:

• Hedy has provided specific prior written authorization; or
• the activity strictly complies with Hedy’s then-current published security research or vulnerability disclosure policy, if any.

Authorization for one system, test, method, or time period does not authorize testing of any other system, customer environment, data, or period. Researchers must minimize access, avoid persistence and disruption, protect any information encountered, cease activity when requested, and report findings at security@hedycyber.com.

10. Customer Content

“Customer Content” means data, communications, files, records, configurations, materials, and other content submitted to or processed through the Services by or for you. Customer Content does not include Hedy technology, documentation, usage limits, system metadata owned by Hedy, or Feedback.

Ownership

As between Hedy and you, you retain your rights in Customer Content. These Terms do not transfer ownership of Customer Content to Hedy.

Limited processing authorization

You grant Hedy and its authorized service providers a limited right to host, copy, transmit, display, configure, process, and otherwise use Customer Content only as reasonably necessary to:

• provide, secure, maintain, support, and troubleshoot the Services;
• follow your documented instructions;
• prevent or address fraud, abuse, security threats, or technical problems;
• comply with applicable law and binding legal process; and
• perform obligations and exercise rights under the applicable Customer Agreement and these Terms.

This authorization lasts only as long as reasonably necessary for those purposes, subject to applicable retention requirements, backup cycles, legal holds, and Customer Agreements.

You represent that you have the rights and authority required for Hedy to process Customer Content as contemplated by the applicable agreement.

11. Government, Defense, and Regulated Information

No authorization through public Terms

Neither these Terms nor general access to the Website or Services authorizes you to submit, store, transmit, or process:

• classified information;
• Controlled Unclassified Information (“CUI”);
• Federal Contract Information (“FCI”);
• export-controlled technical data or defense articles;
• information subject to U.S.-person, nationality, location, or security-clearance restrictions;
• records maintained in or for a system of records subject to the Privacy Act;
• protected health information (“PHI”);
• criminal justice information, tax information, or similarly restricted government information; or
• other specially regulated, contractually restricted, or mission-sensitive information,

unless the applicable category of information is expressly authorized in a written Customer Agreement and is submitted only to the approved deployment, environment, account, workflow, and personnel.

Marketing statements, product demonstrations, trial access, or technical capability alone do not constitute authorization to process regulated information.

Customer and user obligations

Government, defense-industrial-base, contractor, and regulated-industry users must:

• follow applicable agency, command, program, contract, customer, data-marking, access-control, records-management, and security requirements;
• use only approved accounts, devices, networks, environments, and transfer methods;
• apply required markings and dissemination controls;
• ensure each user holds the required authorization, status, nationality, clearance, or need to know;
• avoid transferring information from an authorized environment into an unauthorized environment; and
• promptly report suspected spills, mishandling, incidents, or unauthorized disclosures through required channels.

Controlling requirements

Applicable Customer Agreements, government contracts and orders, agency instructions, security plans, data-processing terms, records schedules, incident-reporting requirements, and mandatory procurement provisions control over these Terms if inconsistent.

Records preservation, deletion, return, access, inspection, incident reporting, and notification will be handled as stated in the applicable written agreement and mandatory law. Hedy does not promise direct notification to an individual or end user where notice is prohibited, where a government agency or customer controls notification, or where applicable procedures require a different reporting channel.

Monitoring and no expectation of privacy

Government, employer, customer, or contractor systems may be monitored, inspected, recorded, retained, accessed, or disclosed by authorized personnel as permitted by applicable law, contract, policy, or system notice. Users of such systems should have no expectation of privacy to the extent stated in the applicable government or organizational notice.

Hedy may log, monitor, investigate, and restrict use of the Services as reasonably necessary to maintain security, comply with applicable agreements, and protect Hedy, its customers, users, and systems.

12. Confidentiality

Unless a controlling agreement provides otherwise, a recipient of information that is identified as confidential or that reasonably should be understood to be confidential must:

• use it only to exercise rights or perform obligations relating to the Services;
• protect it using reasonable care, and at least the care used for its own similar information;
• disclose it only to personnel and contractors who need to know it and are subject to appropriate confidentiality obligations; and
• not disclose it to third parties except as authorized or legally required.

Confidential information does not include information the recipient can demonstrate was lawfully known without restriction, independently developed without use of the confidential information, lawfully received from a third party without a duty of confidentiality, or made public through no breach by the recipient.

Legally compelled disclosure is permitted subject to applicable law and, where legally permitted and operationally appropriate, reasonable notice to the disclosing party. Government-specific disclosure, reporting, audit, and oversight rights remain subject to applicable law and contract.

13. Privacy

Hedy’s Privacy Notice (located here: https://hedycyber.com/privacy) describes how Hedy handles personal information in circumstances in which Hedy determines the purposes and means of processing.

When Hedy processes personal information on behalf of a customer, Hedy may act as a processor, service provider, contractor, or similar role. In those circumstances:

• the customer’s privacy notice and instructions generally govern the processing;
• requests concerning the information may need to be directed to the customer; and
• an applicable Customer Agreement or data processing agreement controls over the public Privacy Notice in the event of a conflict.

You must not submit personal information to the Services unless you are authorized to do so and the applicable environment is approved for that information.

14. Service Data, Telemetry, and De-Identified Information

Depending on the deployment model and applicable Customer Agreement, Hedy may collect limited technical, operational, usage, diagnostic, audit, performance, and security information concerning the operation and use of the Services (“Service Data”).

Hedy may use Service Data to:

• provide, maintain, secure, and support the Services;
• detect, investigate, and prevent threats, fraud, misuse, and technical failures;
• measure performance and reliability;
• administer accounts and enforce applicable usage limits; and
• meet legal, contractual, and security obligations.

Subject to the applicable Customer Agreement, Hedy may create aggregated or de-identified information that does not reasonably identify a customer, user, or individual. Hedy may use such information for lawful operational, security, analytical, and service-improvement purposes. Hedy will not attempt to re-identify de-identified personal information except to test de-identification safeguards or as otherwise permitted by law.

Nothing in this section authorizes Hedy to use classified information, CUI, FCI, export-controlled technical data, or other restricted Customer Content for general product development, model training, advertising, or unrelated commercial purposes.

15. Feedback

If you voluntarily provide suggestions, ideas, enhancement requests, or other feedback concerning the Website or Services (“Feedback”), you grant Hedy a perpetual, irrevocable, worldwide, royalty-free right to use, reproduce, modify, distribute, and otherwise exploit the Feedback without restriction or payment.

You are not required to provide Feedback. You must not include classified information, CUI, FCI, export-controlled information, personal information, Customer Content, or third-party confidential information in Feedback.

16. Hedy Intellectual Property

The Website, Services, documentation, software, interfaces, designs, visual elements, technology, methods, processes, and related intellectual property are owned by Hedy or its licensors and are protected by applicable intellectual-property laws.

“Hedy,” Hedy’s logos, and associated names and marks are trademarks of Hedy. You may not use Hedy’s names, logos, marks, customer relationships, or government relationships in publicity, marketing, press releases, or endorsements without prior written authorization.

No Customer Agreement, purchase order, funding source, suggestion, or participation in a pilot transfers Hedy intellectual property unless a signed agreement expressly provides otherwise.

17. U.S. Government Rights

To the extent the Services or related documentation qualify as commercial products, commercial services, commercial computer software, or commercial computer software documentation, rights granted to the United States are determined by the applicable government contract and applicable procurement law.

These Terms do not independently grant the government fewer rights than mandatory law requires or more rights than Hedy has expressly agreed to provide. Any specially negotiated license rights, technical-data rights, restricted-rights markings, government-purpose rights, unlimited rights, or similar rights must be established in the applicable government contract or other authorized written instrument.

If these Terms conflict with mandatory sovereign rights, procurement law, or an applicable government contract, the mandatory requirement or government contract controls.

18. Third-Party Services and Integrations

The Services may interoperate with third-party products, networks, platforms, identity providers, applications, data sources, or services (“Third-Party Services”). Your use of Third-Party Services is governed by the applicable third party’s terms and privacy practices.

Unless a Customer Agreement states otherwise:

• Hedy does not control or endorse Third-Party Services;
• Hedy is not responsible for their availability, security, functionality, or handling of data;
• you are responsible for authorizing integrations and configuring permissions appropriately; and
• Hedy may disable an integration that creates a security, legal, compliance, or operational risk.

Hedy remains responsible for its own obligations regarding service providers it engages to perform Hedy’s contractual obligations.

19. Fees, Billing, and Taxes

Fees, subscription periods, usage limits, invoicing, payment dates, and renewal terms, if applicable, will be stated in the applicable order form or Customer Agreement.

Unless the applicable agreement states otherwise:

• fees are exclusive of applicable sales, use, excise, value-added, and similar transaction taxes;
• you are responsible for applicable taxes other than taxes based on Hedy’s net income;
• purchase-order terms do not modify the parties’ agreement unless Hedy expressly accepts them in writing; and
• failure to pay undisputed amounts when due may result in suspension after appropriate notice and an opportunity to cure.

No automatic renewal, interest, collection-cost, or non-appropriation provision applies to a government customer except to the extent expressly authorized by applicable law and included in a valid Customer Agreement.

20. Support, Maintenance, and Availability

Support and maintenance, if included, will be provided pursuant to the applicable order form or Customer Agreement. Unless expressly stated in the applicable Customer Agreement:

• response or resolution times are targets, not guarantees;
• Hedy may perform scheduled or emergency maintenance;
• availability may be affected by customer-controlled systems, Third-Party Services, internet conditions, force majeure events, and security measures; and
• Hedy does not guarantee uninterrupted or error-free operation.

Hedy may deploy urgent security fixes or disable vulnerable functionality without advance notice when reasonably necessary to address a material threat.

21. Suspension

Hedy may suspend or restrict access to some or all of the Services when Hedy reasonably determines that:

• use is unauthorized or violates these Terms or a Customer Agreement;
• continued use threatens the confidentiality, integrity, availability, or security of the Services, Hedy, a customer, a government system, or a third party;
• an account or credential may be compromised;
• suspension is required by law, regulation, sanctions, export controls, court order, agency direction, or binding government instruction;
• continued processing could result in unauthorized handling of regulated information;
• undisputed fees are materially overdue; or
• suspension is necessary to prevent material harm.

Where practicable and legally permitted, Hedy will provide notice and a reasonable opportunity to remedy the issue. Hedy may act immediately where delay could increase risk, violate law, interfere with an investigation, or compromise security.

Hedy will limit a suspension in scope and duration where reasonably practicable. Government contracts and Customer Agreements control any additional suspension procedures.

22. Term and Termination

These Terms begin when you first accept them or access the Website or Services and continue while you use them.

You may stop using the Website at any time. Service subscriptions and Customer Agreements may be terminated only as provided in the applicable agreement.

Hedy may terminate access governed solely by these Terms if you materially breach them and fail to cure the breach within ten calendar days after notice, where a cure is possible. Hedy may terminate immediately for unlawful activity, material security threats, repeated violations, sanctions or export-control restrictions, or use that could cause substantial harm.

Upon termination:

• your right to access and use the affected Services ends;
• you must stop using and, where required, delete Hedy software and confidential materials;
• outstanding payment obligations remain due;
• Customer Content will be returned, exported, retained, or deleted as provided in the applicable Customer Agreement; and
• provisions that by their nature should survive will survive, including provisions concerning intellectual property, confidentiality, payment, disclaimers, limitations of liability, indemnification, disputes, and general terms.

23. Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT FOR ANY EXPRESS WARRANTIES IN AN APPLICABLE CUSTOMER AGREEMENT, THE WEBSITE, SERVICES, DOCUMENTATION, AND RELATED MATERIALS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” HEDY AND ITS LICENSORS DISCLAIM ALL EXPRESS, IMPLIED, STATUTORY, AND OTHER WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

HEDY DOES NOT WARRANT THAT THE WEBSITE OR SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, COMPLETELY SECURE, OR FREE FROM HARMFUL COMPONENTS; THAT EVERY THREAT, VULNERABILITY, ATTACK, OR UNAUTHORIZED COMMUNICATION WILL BE DETECTED, PREVENTED, OR REMEDIATED; OR THAT THE SERVICES WILL SATISFY EVERY LEGAL, REGULATORY, CONTRACTUAL, MISSION, OR SECURITY REQUIREMENT.

CYBERSECURITY AND SECURE-COMMUNICATIONS TECHNOLOGIES REDUCE CERTAIN RISKS BUT CANNOT ELIMINATE ALL RISKS. YOU REMAIN RESPONSIBLE FOR APPROPRIATE SECURITY GOVERNANCE, CONFIGURATION, ACCESS CONTROL, MONITORING, RESPONSE, REDUNDANCY, BACKUP, AND COMPLIANCE MEASURES WITHIN YOUR CONTROL.

Any limited warranty for paid Services, including its duration and exclusive remedy, will be stated in the applicable Customer Agreement.

Some jurisdictions do not allow certain warranty exclusions, so portions of this section may not apply to you.

24. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY NOR ITS AFFILIATES, LICENSORS, OR SUPPLIERS WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS OPPORTUNITY, GOODWILL, ANTICIPATED SAVINGS, OR DATA, ARISING OUT OF OR RELATING TO THE WEBSITE, SERVICES, OR THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HEDY’S AND ITS AFFILIATES’ AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE WEBSITE, SERVICES, OR THESE TERMS WILL NOT EXCEED THE FEES PAID OR PAYABLE TO HEDY FOR THE AFFECTED SERVICES DURING THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY.

The limitations in this section apply regardless of the form of action and even if a remedy fails of its essential purpose.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited. Limitations applicable to a government customer are subject to Section 32 and the applicable government contract.

25. Indemnification

To the extent permitted by law, you will defend, indemnify, and hold harmless Hedy and its affiliates, officers, directors, employees, and agents from third-party claims, damages, judgments, and reasonable costs arising from:

• Customer Content that infringes or misappropriates a third party’s rights;
• your unlawful or unauthorized use of the Website or Services;
• your material breach of Sections 6 through 11; or
• your intentional misconduct or violation of applicable law.

Hedy will provide reasonably prompt notice, permit you to control the defense and settlement, and provide reasonable cooperation at your expense. You may not settle a claim in a manner that admits wrongdoing by Hedy, imposes nonmonetary obligations on Hedy, or fails to provide Hedy a full release without Hedy’s prior written consent.

Any Hedy indemnification obligation, including an intellectual-property infringement indemnity, applies only if expressly included in a Customer Agreement.

This section does not require the United States, a government agency, or another government customer to provide indemnification except to the extent expressly authorized by law and validly included in the applicable government contract.

26. Equitable Relief

Unauthorized access to the Services, misuse of Hedy intellectual property, breach of confidentiality, or violation of cybersecurity restrictions may cause harm that cannot be adequately remedied through monetary damages alone. Subject to applicable law, either party may seek temporary, preliminary, or permanent injunctive or other equitable relief without waiving other remedies.

Nothing in this section waives sovereign immunity, creates jurisdiction, or alters statutory procedures applicable to a government customer.

27. Export Controls, Sanctions, and Access Restrictions

You must comply with applicable export-control, economic-sanctions, import, antiboycott, and trade-restriction laws.

You may not directly or indirectly access, export, reexport, release, transfer, or use the Website, Services, software, documentation, technical information, or related materials:

• in violation of applicable trade laws;
• in or for an embargoed destination or prohibited end use;
• for or on behalf of a sanctioned or restricted person; or
• where a required authorization has not been obtained.

Certain Services, technical information, environments, or support activities may be subject to applicable laws and regulations regarding export restrictions, cybersecurity, data privacy, supply chain, anti-corruption, and other matters. You must not provide access to any person who does not satisfy applicable requirements.

You will provide accurate information reasonably requested to evaluate trade-compliance obligations. Hedy may restrict or terminate access where necessary to comply with applicable law.

28. Anti-Corruption and Ethical Conduct

You must not use the Website or Services in connection with bribery, kickbacks, unlawful gratuities, money laundering, fraud, procurement misconduct, or other corrupt activity.

Neither party will offer, promise, authorize, request, or accept anything of value in violation of applicable anti-corruption laws. Users involved in government procurement must comply with applicable gift, ethics, conflict-of-interest, lobbying, and procurement-integrity requirements.

29. Changes to These Terms

Hedy may update these Terms from time to time. Hedy will post the updated version with a revised effective date and, for material changes, provide 15 days’ advance notice through the Website, Services, email, or another reasonable channel.

Changes will not retroactively reduce rights or increase obligations under an existing Customer Agreement unless that agreement permits the change or the parties agree in writing.

If you continue using Website features governed solely by these Terms after an updated version takes effect, you accept the updated Terms. If you do not agree, you must stop using those features.

30. Communications and Notices

You consent to receive operational, security, administrative, and legal communications electronically, including through email, account notifications, or postings within the Services. You are responsible for maintaining current contact information.

Legal notices to Hedy must be sent to:

Hedy Cyber, Inc.
Attn: Joe O’Brien
Email: notice@hedycyber.com

Notices to you may be sent to the account owner, contracting contact, administrator, or address identified in the applicable Customer Agreement. A Customer Agreement controls if it establishes different notice procedures.

31. Governing Law and Dispute Resolution

Commercial and non-government users

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-laws principles.

The state and federal courts located in New Castle County, Delaware will have exclusive jurisdiction over disputes arising out of these Terms, and each party consents to personal jurisdiction and venue there.

Government customers

The governing law, forum, claims process, and dispute procedures for a government customer will be determined by applicable sovereign law, procurement law, the Contract Disputes Act where applicable, and the relevant government contract. No government customer is required by these Terms to accept arbitration, waive sovereign immunity, waive statutory remedies, or consent to state-law venue.

32. Government-Customer Savings Clause

Notwithstanding anything to the contrary in these Terms, when the United States, a U.S. government agency, or another governmental entity is the customer or authorized user:

1. these Terms apply only to the extent consistent with applicable law and the governing government contract;
2. no provision requires the government to indemnify Hedy unless authorized by law;
3. no provision creates an automatic renewal or payment obligation contrary to appropriations law, fiscal law, or required funding procedures;
4. no provision binds the government to state governing law, private arbitration, a class-action waiver, attorneys' fees, or a particular venue where unenforceable;
5. no disclaimer or limitation restricts mandatory audit, oversight, records, disclosure, inspection, sovereign, procurement, or enforcement rights;
6. no provision waives sovereign immunity or creates a cause of action, remedy, or jurisdiction not otherwise available;
7. termination, suspension, data rights, records retention, incident reporting, and remedies are governed by the applicable contract and procurement law; and
8. mandatory laws, regulations, agency terms, and contract clauses control over conflicting language in these Terms.

If a provision is unenforceable against a government customer, it will be interpreted or severed only to the minimum extent necessary, without affecting its application to other users.

33. General Provisions

Assignment

You may not assign or transfer these Terms or your access rights without Hedy’s prior written consent, except as expressly permitted in a Customer Agreement. Hedy may assign these Terms in connection with a merger, reorganization, financing, sale of substantially all relevant assets, or transfer to an affiliate, subject to applicable procurement and Customer Agreement requirements.

Subcontractors

Hedy may use affiliates, service providers, and subcontractors to perform its obligations, subject to the applicable Customer Agreement. Hedy remains responsible for their performance to the extent required by that agreement.

Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, except for payment obligations already accrued. This provision does not excuse compliance with applicable continuity, security, disaster-recovery, or government-contract requirements.

No agency

These Terms do not create a partnership, joint venture, fiduciary, employment, franchise, or agency relationship. Neither party may bind the other except as expressly authorized.

No third-party beneficiaries

Unless an applicable Customer Agreement expressly states otherwise, these Terms do not create rights for third-party beneficiaries.

Waiver

A waiver must be in writing and signed by an authorized representative. Failure to enforce a provision is not a waiver of future enforcement.

Severability

If a provision is held unenforceable, it will be enforced to the maximum extent permitted, and the remaining provisions will remain effective.

Interpretation

Headings are for convenience only. “Including” means “including without limitation.” Any ambiguity will be interpreted according to its fair meaning and not automatically against either party as drafter.

Entire agreement

For matters governed solely by these Terms, these Terms and expressly incorporated policies constitute the entire agreement between you and Hedy concerning the Website and Services and supersede prior or contemporaneous communications on those matters.

For customers with a Customer Agreement, that agreement and its incorporated documents constitute the controlling agreement. Website statements, demonstrations, proposals, and informal communications do not amend a signed Customer Agreement.

Conflicting purchase-order terms

Terms included in a purchase order, supplier portal, onboarding system, or similar document do not modify these Terms or a Customer Agreement unless expressly accepted in a writing signed by Hedy’s authorized representative. This provision is subject to applicable government procurement requirements.

Survival

Provisions that by their nature are intended to survive expiration or termination will survive, including provisions relating to intellectual property, confidentiality, Customer Content, accrued payment obligations, disclaimers, liability limitations, indemnification, disputes, and general interpretation.

34. Contact Hedy

Questions about these Terms may be directed to:

Joe O’Brien
Hedy Cyber, Inc.
1010 Walnut Street, #1807
Cincinnati, Ohio 45202
Attn: Joe O’Brien
Email: job@hedycyber.com
notice@hedycyber.com
Website: https://hedycyber.com