Plaid End Client Terms.
Connecting outside accounts.

Unless Plaid specifically agrees otherwise in writing, Adviser will not, and will not enable or assist any third party to: (i) attempt to reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid Services; (ii) modify, translate, or create derivative works based on the Plaid Services; (iii) make the Plaid Services or Plaid-Provided Data (or any derivative work thereof) available to, or use the Plaid Services or Plaid-Provided Data (or any derivative work thereof) for the benefit of, anyone other than Adviser or End Users; (iv) sell, resell, license, sublicense, distribute, rent, or lease any Plaid Services or Plaid-Provided Data (or any derivative work thereof) to any third party, or include any Plaid Services or Plaid-Provided Data (or any derivative work thereof) in a service bureau, time-sharing, or equivalent offering; (v) publicly disseminate information from any source regarding the performance of the Plaid Services or Plaid-Provided Data; or (vi) attempt to create a substitute or similar service through use of, or access to, the Plaid Services or Plaid-Provided Data. Adviser will use the Plaid Services and Plaid-Provided Data only in compliance with: (a) the application, use case, and other restrictions agreed between Plaid and Helmsted; (b) the Plaid developer policies (available at plaid.com/legal); (c) Plaid's applicable technical user documentation (available at plaid.com/docs); and (d) any agreements between Adviser and End Users, including any privacy policy or statement. Notwithstanding anything to the contrary, as between Plaid and Adviser, Adviser accepts and assumes all responsibility for complying with all applicable laws and regulations in connection with Adviser's activities involving any Plaid Services, Plaid-Provided Data, or End User data.

Adviser acknowledges and agrees that: (i) Plaid is neither a "consumer reporting agency" nor a "furnisher" of information to consumer reporting agencies under the Fair Credit Reporting Act ("FCRA"); and (ii) Plaid-Provided Data is not a "consumer report" under the FCRA. Adviser represents and warrants that it will not, and will not permit or enable any third party to, use the Plaid Services (including Plaid-Provided Data) as, or as part of, a "consumer report" as that term is defined in the FCRA, or otherwise use the Plaid Services or Plaid-Provided Data such that they would be deemed "consumer reports" under the FCRA.

Before any End User engages with products or services that include, are derived from, or incorporate the Plaid Services, Adviser warrants and will ensure that it provides all notices and obtains all consents required under applicable law to enable Plaid to process End User data in accordance with Plaid's privacy policy (available at plaid.com/privacy). Adviser will not: (i) make representations or other statements with respect to End User data that are contrary to or otherwise inconsistent with Plaid's privacy policy; or (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent.

THE PLAID SERVICES, PLAID-PROVIDED DATA, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES, AND MATERIALS PROVIDED BY PLAID ARE PROVIDED "AS IS." TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE PLAID SERVICES ARE FREE FROM DEFECTS OR UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH THE PLAID SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE. PLAID IS AN INTENDED THIRD-PARTY BENEFICIARY OF THIS AGREEMENT AND MAY DIRECTLY ENFORCE THIS AGREEMENT AGAINST ADVISER, WITHOUT HELMSTED'S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE PLAID-PROVIDED DATA (INCLUDING FI DATA) AND PLAID SERVICES PROVIDED BY PLAID TO HELMSTED OR ADVISER.

Through the platform or the Plaid Services, Adviser may have access to information about or of End Users provided to Plaid by a bank, financial institution, or other data source (each, as designated by Plaid, an "FI", and such information, "FI Data"). Adviser agrees to the following, and "Delete" means to permanently and securely delete using industry-standard means:

(a) End User Consents. Adviser will provide all notices to, and obtain all express consents from, each End User as required under applicable law in connection with Adviser's use, storage, and other processing of FI Data ("Express Consents"). Express Consents will be clear and conspicuous; will generally specify the categories of FI Data Adviser will receive and how Adviser will use, store, and otherwise process it; will be valid, enforceable, and expressly accepted by each End User; will identify any third parties or categories of third parties to whom Adviser may provide FI Data; will specify how End Users may revoke their Express Consent; and will include any other required disclosures under applicable law. Adviser will maintain records sufficient to demonstrate compliance and will promptly provide such records to Plaid upon request.

(b) Scope of Access. Adviser will access FI Data only pursuant to Express Consents and for the use case reviewed and permitted by Plaid in writing and consented to by the applicable End User. If Adviser possesses FI Data exceeding the scope of an End User's Express Consents, Adviser will Delete such FI Data except to the extent retention is required by applicable law. If Adviser becomes aware that data it receives from Plaid does not relate to the End User for whom it was requested, Adviser will promptly notify Plaid and Delete such data.

(c) Data Use and Disclosure. Adviser will use, store, and otherwise process FI Data solely in accordance with the End User's Express Consents and applicable law. Adviser will not disclose, transfer, syndicate, or distribute FI Data to any third party (including service providers) except with the End User's Express Consent and in accordance with applicable law, and Adviser will not sell FI Data.

(d) Data Deletion. Adviser will promptly Delete any FI Data upon request by the applicable End User, except that Adviser may retain copies solely to the extent required by applicable law (including, for the avoidance of doubt, records Adviser is required to retain under its books-and-records obligations as a registered investment adviser).

(e) No Attribution. Adviser will not charge End Users any fees attributable to an FI for access to FI Data or for use of an End User's FI account, and will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on Adviser's receipt of FI Data.

(f) No Other Access. Adviser will access FI Data only through the Plaid Services or another manner that uses the FI's authorized APIs. Adviser will not "screen scrape" data from FIs or collect End User log-on credentials for FI accounts, will immediately Delete any such credentials in its possession, and will not knowingly obtain from a third party FI Data originally sourced through screen scraping. Adviser will maintain records to demonstrate compliance.

(g) Compliance with Laws. Adviser will comply with all applicable privacy, security, and other laws pertaining to FI Data, including any obligations under Section 1033 of the Dodd-Frank Act, and will maintain a program designed to ensure such compliance, including appropriate personnel training.

(h) Information Security Program. Adviser will maintain a comprehensive written information security program approved by its senior management, including administrative, technical, and physical measures designed to ensure the security of FI Data, protect against unauthorized access to or use of FI Data and anticipated threats and hazards, and ensure proper disposal of FI Data. The program will be appropriate to Adviser's risk profile and activities and will meet or exceed applicable control objectives in industry standards such as the AICPA Trust Services Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable law. Adviser will use up-to-date antivirus and anti-malware tools on its systems.

(i) Security Breach Obligations. Adviser will notify Plaid promptly, and in any event within twelve (12) hours, via email to security@plaid.com, after becoming aware of any event that compromises Adviser's systems or that does or reasonably could compromise the security, integrity, or confidentiality of FI Data or result in its unauthorized use, disclosure, or loss (a "Security Breach"), providing a description of known facts, the types of End Users affected, and other information Plaid may reasonably request. Adviser will reasonably cooperate with Plaid in investigating and remediating Security Breaches and will be responsible for the costs of investigating, mitigating, and remediating a Security Breach of its systems. Adviser will also promptly notify Helmsted of any such Security Breach.

(j) FI Confidential Information; Oversight. Any confidential or proprietary materials of an FI disclosed to Adviser will be protected with no less than a reasonable standard of care and treated as FI Data, and will be Deleted promptly upon Plaid's request with written certification. Toward assessing Adviser's material compliance with these Plaid End Client Terms, Adviser will promptly provide reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI, and, where documentation is insufficient to demonstrate material compliance, will submit to a third-party audit as described in the Plaid flow-down terms. Plaid and FIs may conduct technical or operational assessments of Adviser on advance notice, not more than once per year unless legally required and materially different in scope. Plaid may share information related to Adviser's compliance (including its information security program) with an FI where required by, or relevant to, that FI.

(k) Insurance. Adviser will maintain insurance coverage appropriate to its risk profile and activities and the nature of the FI Data it receives, no less than industry standard, including cybersecurity liability insurance.

(l) Access Frequency; Marks. Adviser will comply with any written guidelines from Plaid (including via Helmsted) regarding the frequency of "batch" pulls of FI Data, which Plaid and Helmsted may enforce in accordance with Plaid's standard practices. Adviser grants Plaid and each FI (and their third-party service providers) a non-exclusive, non-transferable right and license to use Adviser's trademarks and service marks solely in connection with consent management activities, including End User-facing consent management portals operated by Plaid or an FI.

Plaid may suspend Adviser's access to the Plaid Services or FI Data, in whole or in part, if Plaid determines or reasonably believes that Adviser has breached these Plaid End Client Terms, that Adviser's use will or has materially violated an agreement between Plaid and an FI, or that Adviser's use poses a risk of material harm to End Users, an FI, or the Plaid Services. An FI may suspend Adviser's access to that FI's data.

Plaid will use commercially reasonable efforts to notify Helmsted before a suspension, discuss it with Helmsted in good faith, and resume access promptly after its basis is cured to Plaid’s and, where applicable, the FI’s reasonable satisfaction.

Adviser will indemnify, defend, and hold harmless each FI, Plaid, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of FI Data provided to Adviser; or (b) Adviser's unauthorized or improper use of FI Data (including any unauthorized sharing, transmission, access, display, storage, or loss). This Section B.7 is not subject to the limitations of liability set forth in the Agreement. Each FI is a third-party beneficiary of this Section B.7.

Continued access to data from certain FIs may require changes to the FI Data provisions of these terms. Plaid will use commercially reasonable efforts to notify Helmsted of the changes and their effective date. Adviser must accept the applicable changes to continue that FI’s services; if Adviser objects, its exclusive remedy is to stop accessing and using those services. Continued access or use after the effective date constitutes acceptance. The FI Data provisions, including related suspension, indemnity and modification provisions, prevail over conflicting provisions of the Agreement and survive its termination or expiration.

Where Enrich is used, Adviser must not use its output for any transaction other than the specific transaction for which it was provided, including similar future transactions, or download, cache or otherwise save merchant logos supplied through Enrich. These restrictions survive termination. Plaid processes Enrich input only to provide Enrich, as otherwise instructed by Helmsted or Adviser, or as permitted by applicable law, and does not retain, use or disclose it for other purposes.

If made available, Adviser may request disclosure of Plaid-Provided Data or services incorporating it ("Shared Data") to a third-party investor or purchaser of a financial product Adviser originated for an End User, with whom Plaid maintains a separate technical integration ("Secondary Investor"). Before disclosure, Adviser must provide all required notices and obtain all required consents, including those required by law. Adviser must enter binding written agreements with each Secondary Investor consistent with these terms and their restrictions. As between Plaid and Adviser, Adviser is solely responsible for its relationships with Helmsted and Secondary Investors, including billing, support and disputes, and remains responsible for Secondary Investors’ compliance with these terms. As between Plaid and Adviser, Adviser is fully liable for its breaches of this section, Secondary Investors’ acts or omissions, and disputes among Adviser, Helmsted, Secondary Investors or End Users concerning the contemplated disclosure or use. This provision does not represent that Helmsted currently offers this functionality.

Helmsted, Inc.

Questions about account aggregation or these terms?

legal@helmsted.ai

Helmsted provides technology and informational tools, not investment or other professional advice. Professionals remain responsible for their services and review of professional materials.