Terms of Service

1. Definitions

"Authorized Users" means the individuals permitted by Customer to access and use the Platform under Customer's account, subject to the user limits of the applicable Service Plan.

"Client Data" means all data, documents, files, communications, notes, records, and information that Customer or its Authorized Users upload, create, store, transmit, or process through the Platform relating to Customer's clients, cases, matters, and legal practice. Client Data includes, without limitation, personally identifiable information (PII), protected health information (PHI), attorney-client privileged communications, work product, financial records, and case files.

"AI Features" means the artificial intelligence-powered capabilities of the Platform, including but not limited to the AI Legal Assistant, AI Intake Agent, Contract Analysis, Contract Generation, Legal Research, AI Case Preparation, Communications Agent, Collections Agent, and any AI-powered document generation or analysis tools.

"Service Plan" means the plan selected by Customer — Free, Pay-As-You-Go, or Committed — as described in Section 5.

"Organization" means the law firm, legal practice, or other entity that Customer establishes on the Platform, under which all Client Data, Authorized Users, and account settings are organized.

"Third-Party Services" means external services integrated with the Platform, including payment processing (Stripe), calendar providers (Google Calendar, Microsoft 365, Calendly), e-signature providers (DocuSign, HelloSign), and our infrastructure, authentication, communications, AI processing, and legal research data providers.

2. Platform Description and Intended Use

2.1 Nature of the Platform

Nimbus Law is an AI operations layer for personal injury law firms, designed for solo attorneys and small firms. The Platform provides AI-assisted intake, contract review, case preparation, demand letter drafting, collections follow-up, document management, calendar scheduling, automation workflows, and related tools. It sits in front of the practice management system a firm already uses and does not replace it. Every output is a draft until an attorney reviews and adopts it.

2.2 The Platform Is a Technology Tool, Not a Legal Advisor

2.3 AI Output Requires Attorney Review

All content generated by AI Features — including contract analyses, legal research summaries, document drafts, demand letters, case preparation materials, intake qualification assessments, and communications drafts — is provided as preliminary output that requires independent review, verification, and approval by a licensed attorney before use. AI-generated content may contain errors, omissions, or inaccuracies, including fabricated citations ("hallucinations"). Ethical compliance, professional judgment, and all obligations under applicable rules of professional conduct remain the sole responsibility of the attorney.

2.4 Not a Substitute for Professional Services

The Platform is not a substitute for Westlaw, LexisNexis, or other legal research services for purposes of comprehensive legal research. Attorneys must independently verify all citations, holdings, and legal conclusions before reliance in any matter, filing, or client communication.

3. Account Registration and Security

3.1 Account Creation

To access the Platform, you must create an account by providing accurate, current, and complete registration information. Each Organization is a separate tenant on the Platform, and all Client Data is isolated to the Organization that created it.

3.2 Account Security

You are responsible for maintaining the confidentiality of all login credentials and for all activity that occurs under your account. You agree to immediately notify us of any unauthorized use of your account. We strongly recommend enabling multi-factor authentication (MFA), which is available on all Service Plans.

3.3 Authorized Users

Customer shall not exceed the maximum number of Authorized Users permitted under its Service Plan. Each Authorized User must have a unique account; credential sharing is prohibited. Customer is responsible for de-provisioning access for individuals who are no longer authorized.

3.4 Role-Based Access

The Platform provides role-based access control (RBAC) with roles including Admin, Attorney, Paralegal, and Staff. Customer is responsible for assigning appropriate roles consistent with applicable ethical obligations regarding supervision of nonlawyer assistants under ABA Model Rule 5.3 and corresponding state rules.

4. Data Ownership, Processing, and Protection

4.1 Customer Owns Its Data

Customer retains all right, title, and interest in and to all Client Data. Nimbus Law does not acquire any ownership rights in Client Data. Customer grants Nimbus Law a limited, non-exclusive, non-transferable license to process Client Data solely for the purpose of providing and improving the Platform services.

4.2 No Use of Client Data for AI Model Training

4.3 Enterprise-Grade Data Isolation

The Platform employs multi-tenant architecture with strict logical data isolation. Every database query is filtered by Organization identifier, ensuring no Customer can access another Customer's data. All Client Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256-GCM encryption.

4.4 Data Retention and Deletion

Customer may configure data retention policies through the Platform's Data Retention module. Upon termination of this Agreement, Nimbus Law will make Client Data available for export for thirty (30) days. After this period, Client Data will be securely destroyed using methods compliant with NIST SP 800-88 guidelines and DOD 5220.22-M standards. Customer may request a Certificate of Destruction.

4.5 Data Portability

In accordance with ABA Model Rule 1.16(d), the Platform supports data export in multiple formats (JSON, CSV, PDF, and ZIP archive). Customer may export complete client files at any time during the term of this Agreement. The Platform also supports successor counsel transfers with transmittal letter generation and file inventory.

4.6 Subprocessors

A current list of subprocessor identities is available to Customers under an executed Data Processing Agreement, subject to confidentiality. Contact privacy@nimbusai.biz.

4.7 Data Processing Agreement

For Customers requiring a formal Data Processing Agreement (DPA) for GDPR, CCPA, or other regulatory compliance, Nimbus Law will execute a DPA upon request. Contact privacy@nimbusai.biz.

5. Service Plans, Pricing, and Payment

5.1 Service Plans

Nimbus Law offers three plans: (a) FREE — core CRM and practice-management features (client and case management, calendaring, document storage within plan limits) at no charge; AI work products are not included; (b) PAY-AS-YOU-GO — all Free features plus AI-assisted work products billed at flat, published per-unit list rates with no monthly commitment and no minimum; (c) COMMITTED — all Pay-As-You-Go features at discounted per-unit rates, subject to a monthly minimum commitment of $500. Current per-unit rates are published on the Platform and in Customer's order form or tier agreement.

5.2 Per-Unit Work Model

Paid services are delivered and billed as defined units of completed work (for example: a qualified client intake, a demand letter draft, a contract review, case preparation materials, or collections support communications). Each unit has a flat price. The applicable rate is recorded at the time the unit is delivered, and rate changes never apply retroactively to delivered work. All AI-assisted work products are delivered for review, verification, and approval by Customer's licensed attorneys as described in Sections 2 and 7. THERE ARE NO PREPAID CREDITS. Fees are charged only for work actually delivered.

5.3 Billing

Usage is invoiced monthly in arrears through Stripe for the preceding billing period. For Committed plan Customers: if delivered usage in a billing period is less than the monthly minimum, the invoice is trued up to the minimum; usage above the minimum is billed at Customer's committed per-unit rates. The monthly minimum is a billing floor, not a prepaid balance — it does not roll over, convert to credits, or expire, because nothing is prepaid.

5.4 Flat Fees Only

All fees are flat per-unit or fixed monthly amounts. Nimbus Law's fees are never contingent on the outcome of any legal matter and are never calculated as a percentage of any settlement, judgment, or recovery.

5.5 Price Changes

Nimbus Law may modify published rates with thirty (30) days' written notice to existing Customers, effective at the start of the next billing period. Committed Customers' rates are governed by their tier agreement for its stated term.

5.6 Late Payment

If any payment is not received within ten (10) days of the due date, Nimbus Law may suspend access to the Platform until all outstanding amounts are paid. Nimbus Law will provide at least seven (7) days' written notice before suspension.

5.7 Refunds

Fees for delivered work units are non-refundable. If a delivered work product is materially defective, Customer's remedy is redelivery of a corrected work product at no additional charge, requested within thirty (30) days of delivery. Monthly minimum charges for a completed billing period are non-refundable.

6. Permitted Use and Restrictions

6.1 Permitted Use

Customer may use the Platform solely for the lawful management of its legal practice in compliance with all applicable laws and rules of professional conduct.

6.2 Restrictions

Customer shall not, and shall not permit any Authorized User to:

• Use the Platform for any purpose other than the management of a lawful legal practice
• Sublicense, resell, distribute, or make the Platform available to any third party other than Authorized Users
• Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Platform
• Remove, alter, or obscure any proprietary notices, labels, or markings on the Platform
• Use the Platform to store, transmit, or process any content that is unlawful, harmful, threatening, abusive, harassing, defamatory, or otherwise objectionable
• Use the Platform in any manner that could damage, disable, overburden, or impair the Platform or interfere with any other party's use
• Attempt to gain unauthorized access to any portion of the Platform, other accounts, computer systems, or networks connected to the Platform
• Use any automated means (bots, scrapers, crawlers) to access or collect data from the Platform, except as expressly permitted by our API documentation
• Use AI Features to generate content for purposes unrelated to Customer's legal practice
• Circumvent or manipulate usage limits or any other metering or access controls
• Use the Platform to engage in the unauthorized practice of law

6.3 Compliance with Professional Conduct Rules

Customer is solely responsible for ensuring that its use of the Platform complies with all applicable rules of professional conduct, including ABA Model Rules 1.1 (Competence), 1.4 (Communication), 1.5 (Fees), 1.6 (Confidentiality), 1.15 (Safekeeping Property), 3.3 (Candor), 5.1 and 5.3 (Supervisory Responsibilities), and any corresponding state-specific rules.

7. AI Features — Specific Terms

7.1 AI Governance and Client Consent

The Platform provides organization-level AI governance controls allowing Customer to enable or disable AI Features globally and per-matter, configure data classification levels, require client consent before AI processes client data, mandate human review of AI outputs, and set jurisdiction-specific restrictions. Customer is responsible for configuring these controls in accordance with applicable ethical obligations, including ABA Formal Opinion 512 (2024). All AI-assisted work products are produced under a supervision model in which Customer's licensed attorneys review and approve outputs before client-facing use.

7.2 Client Consent for AI Processing

Certain jurisdictions (including California, Florida, and Illinois) require or recommend that attorneys obtain informed client consent before using AI tools to process client data. The Platform provides client consent tracking, customizable consent templates, and consent audit trails. Customer is solely responsible for determining whether consent is required and for obtaining such consent.

7.3 AI Disclosure for Court Filings

Certain jurisdictions require disclosure of AI use in court filings or prohibit AI-generated filings entirely. The Platform provides AI disclosure certification generation and jurisdiction-specific warnings. Customer is solely responsible for complying with all applicable court rules regarding AI disclosure.

7.4 Accuracy of AI Outputs

7.5 AI Billing Transparency

In compliance with ABA Formal Opinion 512 and applicable state ethics opinions, the Platform tracks AI usage per matter and provides AI usage reports. Customer acknowledges that billing clients for AI usage must comply with applicable fee rules. Efficiencies gained from AI must be reflected in billing.

8. Client Funds

9. Privacy and Regulatory Compliance

9.1 Privacy Policy

Our collection and use of personal information is governed by our Privacy Policy, which is incorporated into these Terms by reference.

9.2 HIPAA

For Customers handling protected health information (PHI), the Platform provides PHI tracking flags, authorized user access controls, HIPAA-compliant session timeouts (15-minute idle timeout for PHI contexts), and BAA tracking. Customers requiring a Business Associate Agreement may request one at privacy@nimbusai.biz.

9.3 GDPR

For Customers subject to the EU General Data Protection Regulation (GDPR), the Platform provides cookie consent management, data subject access request (DSAR) workflows, right to erasure (Article 17) processing with identity verification, data portability (Article 20) export capabilities, and consent history audit trails.

9.4 CCPA

For Customers subject to the California Consumer Privacy Act (CCPA), the Platform provides consumer rights request workflows (right to know, right to delete, right to opt-out, right to correct, right to limit), identity verification, 10-business-day acknowledgment tracking, and 24-month record retention.

9.5 Breach Notification

In the event of a data breach affecting Client Data, Nimbus Law will notify affected Customers within seventy-two (72) hours of becoming aware of the breach, including details regarding the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken to address the breach.

9.6 Text Messaging

Certain Platform features send SMS/text messages to end users who have opted in by requesting them (for example, a caller requesting a scheduling link during an intake call). Message frequency varies; message and data rates may apply; end users may opt out at any time by replying STOP or get help by replying HELP. Mobile numbers and SMS consent data are never shared with or sold to third parties for marketing purposes.

10. Intellectual Property

10.1 Platform Ownership

Nimbus Law retains all right, title, and interest in and to the Platform, including all software, code, algorithms, designs, interfaces, documentation, and intellectual property therein.

10.2 Customer Content

Customer retains all ownership rights in Client Data. Customer grants Nimbus Law a limited license to use Client Data solely to provide the Platform services.

10.3 Feedback

If Customer provides suggestions, feature requests, bug reports, or other feedback, Customer grants Nimbus Law a worldwide, perpetual, irrevocable, royalty-free license to use, modify, and incorporate such Feedback into the Platform without obligation to Customer.

11. Confidentiality

11.1 Mutual Confidentiality

Each party agrees to treat the other party's confidential information with the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.

11.2 Attorney-Client Privilege Preservation

Nimbus Law acknowledges that Client Data may include attorney-client privileged communications, attorney work product, and attorney mental impressions. Nimbus Law's access to Client Data for the purpose of providing the Platform services is not intended to and does not waive any applicable privilege or work product protection. Nimbus Law maintains contractual confidentiality obligations that survive termination, does not use Client Data for model training, maintains enterprise-grade data isolation, and provides configurable data retention with zero-retention options.

11.3 Survival

The confidentiality obligations in this Section survive termination or expiration of this Agreement for a period of five (5) years, except with respect to trade secrets, which shall be protected for so long as they remain trade secrets.

12. Representations and Warranties

12.1 Mutual Representations

Each party represents and warrants that it has the legal power and authority to enter into this Agreement, that this Agreement constitutes a valid and binding obligation, and that its performance will not violate any applicable law or regulation.

12.2 Nimbus Law Warranties

Nimbus Law warrants that the Platform will perform materially in accordance with its published documentation during the term of Customer's subscription, that it will maintain commercially reasonable safeguards for the protection of Client Data, and that it will not knowingly introduce viruses, malware, or other harmful code into the Platform.

12.3 Disclaimer

13. Limitation of Liability

13.1 Exclusion of Consequential Damages

13.2 Cap on Liability

To the maximum extent permitted by applicable law, the aggregate liability of Nimbus Law arising out of or related to this Agreement shall not exceed the total fees paid by Customer to Nimbus Law for the Platform during the twelve (12) months immediately preceding the event giving rise to the claim, or five hundred dollars ($500), whichever is greater.

13.3 Exceptions

The limitations in Sections 13.1 and 13.2 do not apply to either party's indemnification obligations, either party's breach of confidentiality obligations, Customer's payment obligations, or liability arising from a party's gross negligence or willful misconduct.

13.4 Specific AI Liability Exclusion

Nimbus Law shall not be liable for any malpractice claims, sanctions, court penalties, bar disciplinary actions, or other professional consequences arising from Customer's reliance on AI-generated content. Customer acknowledges that AI Features are tools to assist, not replace, professional legal judgment.

14. Indemnification

14.1 Customer Indemnification

Customer shall indemnify, defend, and hold harmless Nimbus Law and its officers, directors, employees, agents, and affiliates from and against any third-party claims, damages, losses, liabilities, and expenses (including reasonable attorneys' fees) arising from or related to:

• Customer's use of the Platform
• Customer's breach of these Terms
• Any claim that Customer's Client Data infringes or misappropriates any third-party right
• Any malpractice claim, disciplinary action, or sanction arising from Customer's professional activities using the Platform
• Customer's violation of any applicable law or rule of professional conduct

14.2 Nimbus Law Indemnification

Nimbus Law shall indemnify, defend, and hold harmless Customer from and against any third-party claims that the Platform (exclusive of Client Data) infringes any United States patent, copyright, or trademark, provided that Customer promptly notifies Nimbus Law of the claim, grants Nimbus Law sole control of the defense, and provides reasonable assistance at Nimbus Law's expense.

15. Term and Termination

15.1 Term

This Agreement commences on the date Customer first accesses the Platform and continues for the duration of Customer's subscription, unless earlier terminated in accordance with this Section.

15.2 Termination for Convenience

Either party may terminate this Agreement for convenience by providing thirty (30) days' written notice. For monthly subscriptions, termination is effective at the end of the current billing period. For annual subscriptions, see the refund provisions in Section 5.6.

15.3 Termination for Cause

Either party may terminate this Agreement immediately upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days of receiving written notice, or if the other party becomes the subject of a bankruptcy petition, insolvency proceeding, or similar proceeding.

15.4 Effect of Termination

Upon termination, Customer's right to access the Platform immediately ceases (subject to the 30-day data export window). All outstanding payment obligations survive termination. Sections 4, 10, 11, 12.3, 13, 14, and 17 survive termination.

15.5 Data Upon Termination

Nimbus Law will preserve Client Data for thirty (30) days following termination. Customer may request a complete data export in ZIP format. After the 30-day period, Nimbus Law will securely destroy all Client Data. Customer may request a Certificate of Destruction.

16. Third-Party Services

The Platform integrates with Third-Party Services to provide certain functionality. Customer's use of Third-Party Services is subject to the respective terms and privacy policies of those services. Nimbus Law is not responsible for the availability, accuracy, security, or performance of any Third-Party Service.

For payment processing through Stripe, Customer agrees to Stripe's Connected Account Agreement and Stripe Services Agreement, as applicable. Credit card information is processed and stored exclusively by Stripe and is never stored on Nimbus Law's servers.

17. Dispute Resolution

17.1 Informal Resolution

Before initiating any formal dispute resolution proceeding, the parties shall attempt to resolve the dispute informally by negotiating in good faith for a period of thirty (30) days.

17.2 Arbitration

Any dispute that cannot be resolved informally shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules. The arbitration shall be conducted in Houston, Texas, by a single arbitrator. The arbitrator's decision shall be final and binding.

17.3 Class Action Waiver

17.4 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict of laws principles.

18. General Provisions

18.1 Entire Agreement

This Agreement, together with the Privacy Policy, Data Processing Agreement (if executed), Business Associate Agreement (if executed), and any Order Forms, constitutes the entire agreement between the parties and supersedes all prior and contemporaneous agreements, representations, and understandings.

18.2 Amendments

Nimbus Law may update these Terms by posting the revised Terms on the Platform and notifying Customer by email at least thirty (30) days before the changes take effect. Customer's continued use of the Platform after the effective date constitutes acceptance.

18.3 Severability

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

18.4 Waiver

No failure or delay by either party in exercising any right or remedy shall operate as a waiver of that right or remedy. No single or partial exercise of any right or remedy shall preclude further exercise.

18.5 Assignment

Customer may not assign this Agreement without the prior written consent of Nimbus Law. Nimbus Law may assign this Agreement in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets.

18.6 Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations caused by events beyond the party's reasonable control, including natural disasters, acts of government, pandemics, labor disputes, internet service failures, or third-party service outages.

18.7 Notices

All notices under this Agreement shall be sent to the email address associated with Customer's account (for notices to Customer) or to legal@nimbusai.biz (for notices to Nimbus Law).

18.8 Independent Contractors

The parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship between the parties.

18.9 Export Compliance

Customer shall not export, re-export, or transfer the Platform or any data in violation of applicable export control laws and regulations, including the U.S. Export Administration Regulations.

19. Audit and Compliance

19.1 Security Audit Documentation

Upon reasonable request and subject to appropriate confidentiality protections, Nimbus Law will make available documentation demonstrating compliance with the security commitments in this Agreement, including SOC 2 readiness documentation, encryption specifications, access control policies, and incident response procedures.

19.2 Audit Logging

The Platform maintains comprehensive audit logs of all user actions, including data access (CREATE, UPDATE, DELETE, VIEW, and EXPORT), authentication events, and administrative changes. Audit logs are tamper-evident through cryptographic hash chaining. Retention periods by plan:

20. Contact Information