Terms of Service

Last updated September 18, 2026

These Terms of Service ("Terms") are a binding agreement between you ("you", "Customer") and Legion Code Inc., a Delaware corporation doing business as OSPRY ("OSPRY", "we", "us"), governing your access to and use of the OSPRY platform, websites, APIs, tags and related services (the "Services").

By creating an account, installing our tag, or using the Services, you agree to these Terms. If you are agreeing on behalf of an organization, you represent that you have authority to bind that organization.

Read Section 5 carefully. It sets out obligations you must meet on your own website before using the Services. They are not optional, and failure to meet them is a breach of these Terms.

1. The Services

OSPRY identifies business visitors to your website and delivers the results to you through the OSPRY portal, integrations and APIs. Identification operates in two tiers:

• Company tier. Identifies the organization a visit came from. Available worldwide. Company data is powered by Demandbase.
• Person tier. Identifies an individual business contact. **Available only for visitors located in the United States.**

We do not operate our own identity-resolution engine. Identification is provided by third-party data partners, disclosed in our Sub-Processors list. We may change data partners, and we will update that list when we do.

We may modify, add to or discontinue features. We will not materially reduce the core functionality of a paid tier during a paid term without notice to you.

2. Accounts

You must provide accurate registration information and keep it current. You are responsible for all activity under your account and for the security of your credentials and API keys. Notify us promptly at security@legioncodeinc.com if you believe an account or key has been compromised.

You must be at least 18 and must not be barred from receiving services under applicable law.

3. Fees, credits and wallet

The plan tiers, prices, included volumes and overage rates are those shown at <https://www.ospry.ai/pricing> or in your order form.

• Subscription fees are billed in advance and are non-refundable except where required by law or expressly stated here.
• Each plan includes an allotment. Usage beyond it draws on your wallet balance at the overage rate for your plan.
• Wallet credit does not expire. Credit you purchase remains available until you use it. It has no cash value, is not redeemable for cash, and is not transferable.
• We may also issue promotional credit. Promotional credit is not purchased, has no cash value, and may be subject to the terms of the promotion under which it was issued.
• Automatic top-up. If you enable it, you authorize us to charge your saved payment method automatically whenever your wallet balance falls to or below the threshold you set, in the amount you set, up to the maximum balance shown in the portal. You can change the threshold and amount, or turn automatic top-up off, at any time in the portal.
• Plan changes. An upgrade takes effect immediately and is charged on a prorated basis at that time. A downgrade takes effect at the end of your current billing period, and no refund or credit is issued for the remainder of that period.
• We may change prices with at least 30 days' notice, effective at your next renewal.
• Overdue amounts may accrue interest and may result in suspension. We will give notice before suspending for non-payment.
• Fees exclude taxes. You are responsible for applicable taxes other than taxes on our income.

Payment is processed by Stripe. We do not store your card details.

4. Term, termination and off-boarding

These Terms run until terminated. Either party may terminate for convenience at the end of the then-current subscription period, or immediately for the other party's material breach that remains uncured 30 days after written notice.

On termination or downgrade:

• Your use of the Services ends at the end of the paid period. On that date we stop identifying visitors for you, stop enriching records, and stop delivering data to your connected destinations.
• Export access continues for 30 days after that date. During those 30 days you keep a limited sign-in to the portal and API for one purpose: exporting your data. No other functionality remains available in that window.
• At the end of those 30 days we return or delete your data at your election, in accordance with our Privacy Notice. If you make no election, we delete it.
• ABM destinations are unwound. Where you have enabled the ABM add-on, we run a final remove-all synchronization to each connected advertising destination, so audiences we pushed on your behalf are removed rather than left in place. This runs when the add-on is removed or disabled, not only on account closure.

5. Your obligations when deploying the Services

This section exists because the Services process personal information about people who have not interacted with OSPRY and, in most cases, have not interacted with you either. The controls below are what make that lawful. They are conditions of use, not recommendations.

You must, before and throughout your use of the Services:

1. Deploy a consent banner that blocks our tag until the visitor accepts. The tag must not fire on a visitor who has not consented. The OSPRY CMP is provided free with every plan and satisfies this requirement; you may use another consent platform that blocks equivalently.
2. Publish cookie-notice and privacy-policy language on your own site that describes the collection performed by our tag, the sharing of data with data partners, and the opt-out route. We provide recommended language in the portal; you remain responsible for its accuracy in your context.
3. Publish a "Your Privacy Choices" or "Do Not Sell or Share" link reachable from your site, pointing to the opt-out routes we provide.
4. **Deploy a consent management platform if you use the worldwide company tier.** This is mandatory for that tier, not best practice.
5. Honor and forward data-subject requests. If a person asks you to delete or stop processing their data, you must act on it in your own systems and route it to us at privacy@legioncodeinc.com or through the forms at <https://www.ospry.ai/opt-out>.

You must not deploy our tag on a website that is directed to children, that concerns health, sexual orientation, religion, political affiliation or other sensitive categories, or where identification of visitors would be unlawful or deceptive in your jurisdiction.

An opt-out is forward-looking. It stops future processing. It cannot retrieve data already delivered to you, which remains your responsibility under your own agreement with the individual concerned.

6. ABM add-on and advertising destinations

The ABM add-on is a paid add-on, not a tier feature. Where you enable it, we push audience memberships to advertising destinations you connect.

Before a destination is enabled you must attest that you hold the rights to use the data for that purpose under that platform's terms, including as applicable:

• LinkedIn's rights-to-data requirements
• Meta Custom Audiences Terms
• Google Customer Match policy
• Microsoft Advertising's equivalent policy

We record that attestation. It is your representation, not ours, and you remain responsible for compliance with each destination's terms.

Audience memberships are transmitted as hashed identifiers. Where an individual withdraws consent or opts out, we flag the membership for removal and the next reconciliation removes it from each connected destination.

7. Acceptable use

Schedule 1 to these Terms forms part of them and binds you. It carries the conditions our data provider places on its data, which we are required to pass on to every customer who receives it. Read it. Where Schedule 1 is stricter than this Section, Schedule 1 applies.

In addition to Schedule 1, you must not, and must not permit any third party to:

• use the Services to build a competing identity-resolution or data-broker product, or to resell the underlying data other than under a written reseller or agency agreement with us;
• attempt to re-identify, enrich or combine our output with other data in a way that circumvents the tier limits in Section 1, including attempting person-level identification outside the United States;
• use the output for credit, employment, housing, insurance or any other purpose regulated by the Fair Credit Reporting Act or an analogous law. **The Services are not a consumer report and must not be used as one.**
• use the output for harassment, stalking, doxxing, or to target an individual in their personal capacity rather than their business capacity;
• scrape, reverse-engineer, or circumvent rate limits, or probe the security of the Services other than under a written authorization from us;
• misrepresent the source of the data, including presenting our data partners' attestations or data as your own.

We may suspend access immediately where we reasonably believe continued use presents a legal or security risk, and will tell you why.

8. Your data, our data, and confidentiality

You retain ownership of the data you upload. You grant us a licence to process it to provide the Services.

We retain ownership of the Services, the platform and any aggregated or de-identified statistics derived from usage that do not identify you or any individual.

Each party will protect the other's confidential information with at least reasonable care and use it only to perform under these Terms.

Where we process personal information on your behalf, that processing is governed by a Data Processing Addendum. Where we have executed one with you, it is incorporated into these Terms and prevails over this Section to the extent of any conflict. If you require a Data Processing Addendum and do not have one, contact privacy@legioncodeinc.com.

9. Third-party attestations

We do not hold a SOC 2 attestation of our own. The SOC 2 report covering our identity-resolution partner is that partner's attestation, and we will not present it as ours. If you require a SOC 2 report from OSPRY as a vendor, ask us about current status before relying on one.

We hold no security attestation covering our identity-resolution supply chain. Our agreement with that provider neither grants us rights in its certifications nor permits us to make representations on its behalf, so we make none.

Company-tier data is powered by Demandbase and must be attributed accordingly where you redistribute it.

10. Warranties and disclaimers

Each party warrants it has authority to enter these Terms.

Identification is probabilistic. We do not warrant that any identification is accurate, complete or current, and you must not treat an identification as verified fact about a person. Match rates, resolution rates and coverage figures we publish are estimates and are not commitments.

Except as expressly stated, the Services are provided "as is", and we disclaim all implied warranties including merchantability, fitness for a particular purpose and non-infringement, to the fullest extent permitted by law.

11. Indemnity

You will defend and indemnify us against third-party claims arising from your breach of Section 5 (deployment obligations), Section 6 (destination attestations) or Section 7 (acceptable use), including claims by a website visitor or a regulator relating to your failure to obtain consent or to publish required disclosures.

We will defend and indemnify you against third-party claims that the Services, as provided by us and used in accordance with these Terms, infringe that third party's intellectual property rights.

12. Limitation of liability

Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits or revenue.

Each party's total liability under these Terms is capped at the greater of (a) the fees paid or payable in the 12 months preceding the event giving rise to the claim, and (b) $25,000.

These limits do not apply to your payment obligations, either party's indemnity obligations, or a party's fraud, wilful misconduct or gross negligence.

13. Changes

We may update these Terms. For material changes we will give notice by email or in-product at least 30 days in advance, and the change takes effect at your next renewal. Continued use after that constitutes acceptance.

14. General

Governing law and venue. Delaware law, without regard to conflicts principles. The state and federal courts located in Delaware have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each party submits to that jurisdiction and waives any objection to venue there.

Jury waiver. Each party waives any right to a trial by jury.

Assignment. Neither party may assign without the other's consent, except to a successor in a merger or sale of substantially all assets.

Entire agreement. These Terms, the DPA, the Privacy Notice and any order form are the entire agreement, superseding prior discussions. Where an order form conflicts with these Terms, the order form controls for that customer.

Severability. If a provision is unenforceable, the rest survives.

No waiver. A failure to enforce is not a waiver.

15. Contact

Legion Code Inc. 254 Chapman Rd, Ste 208 #27885 Newark, DE 19702 United States

General: hello@legioncodeinc.com Privacy: privacy@legioncodeinc.com Security: security@legioncodeinc.com

Schedule 1: Data Provider Restrictions

The data underlying the Services is licensed to us by a third-party data provider. That provider imposes conditions on how its data may be used, and requires that every customer who receives it be bound by them. This Schedule sets out those conditions. It forms part of these Terms, and Section 7 above is in addition to it, not instead of it.

Where this Schedule is stricter than anything else in these Terms, this Schedule applies.

1. How you may obtain the data

1. You may obtain the data only through the interfaces and APIs we provide. You must not use any other manual or automated means, including scraping, crawlers or bots, to access or extract it.
2. You must not access the Services, or extract data from them, in a way that exceeds the access we have granted you or circumvents any limit we have applied, whether that limit is technical or was communicated to you.
3. You must not reverse engineer, decompile or disassemble the Services, in whole or in part.
4. You must not remove any proprietary notice or label.

2. What you may not do with the data

1. No resale. You must not resell, redistribute, or otherwise disclose or make the data available to anyone else. This includes any version that is functionally equivalent to it. Reformatting or abbreviating a record does not make it a different record.
2. No use on behalf of others. You must not access or use the data on behalf of any other entity or organisation.
3. No derivative products. You must not use the data to develop any service, product, toolset, dataset or derivative work, whether aggregated or not, and whether identified or de-identified.
4. No competing product. You must not use, trial, review or rely on the Services to build anything that competes with them.

3. Purposes the data may never be used for

You must not use the data, or use the Services to send email, mail, SMS, push notifications, fax, phone or other communications:

1. For any purpose covered by the Fair Credit Reporting Act, including assessing or deciding creditworthiness, credit approval, eligibility for employment, or eligibility for insurance. **The data is not a consumer report and must never be used as one.** This restriction admits of no exception.
2. To advertise or promote anything illegal where it is offered or consumed.
3. To advertise or promote tobacco or marijuana products, firearms, ammunition or other weapons, counterfeit or pirated goods, adult content or services, unlicensed gambling, investment schemes, astrology or psychic services, lotteries, credit repair services, or payday loans.
4. To promote hate speech targeting any group.
5. To violate securities or commodities regulations.
6. In any manner that breaks applicable law, including marketing, data privacy and security law, or that would cause us or our data provider to break it. This includes the CAN-SPAM Act, Canada's CASL, the TCPA and the Telemarketing Sales Rules.
7. To defraud, deceive, mislead, discriminate against, harass, libel or defame any person, group or entity.
8. To infringe anyone's intellectual property rights.
9. To threaten, promote or commit violence or fraud.

4. If you use the Services to send email

1. Do not send from a group address such as hello@ or marketing@.
2. Include a working opt-out in every commercial message, and comply with applicable law on opt-outs and user choice.
3. Do not use a fictional identity, pseudonym or alias as the sender.
4. Do not send at a rate that produces an unacceptable level of bounces, spam reports or complaints.
5. Do not transmit anything containing or linking to a virus, worm, trojan or other harmful software.
6. Do not use the Services in connection with unsolicited or harassing messages of any kind.

5. Security obligations

1. Access the Services only over encrypted connections.
2. Keep operating systems patched and anti-malware active on any device used to connect to the Services.
3. Revoke a departing employee's access within 24 hours of their termination.
4. Tell us within 72 hours of any security incident that could affect the Services, including compromised credentials, lost or stolen devices with access, or malware, worm or ransomware on a connected network.
5. Keep your account credentials confidential and do not share them. You are responsible for everything done through your account.

6. Data you give us

If you upload your own data, for example a CRM export, you represent that:

1. You hold all rights and permissions necessary to give it to us and to let us use it as described in these Terms, and doing so breaks no contract you have signed and no law.
2. It is accurate, relates to living people, and contains no sensitive personal information and no information about anyone under 18.
3. It is not a list of patients or clients of an entity covered by HIPAA, such as a doctor, dentist, pharmacist or other health professional, and not a list of clients of an entity covered by the GLBA, such as a bank, hedge fund, investment adviser or insurer.
4. You will not deploy our tag, and will not enable us to deploy any tag, on any website subject to HIPAA.

7. Consents and notices are yours to obtain

You are solely responsible for your use of the data and for any communications you send using it.

Depending on where your visitors are, you may be required to give notice, obtain consent, or take some other step before the data may lawfully be processed or used for marketing. Neither we nor our data provider has obtained any consent, or given any notice, on your behalf. Section 5 of these Terms sets out the minimum steps we require of you; meeting them is your obligation, and it does not guarantee compliance in your particular circumstances. Take your own legal advice.

8. Suspension

If we confirm or reasonably suspect that you have breached this Schedule, or have used the Services abusively, fraudulently, or in a way designed to circumvent these restrictions, we may suspend or terminate your access immediately. On our written demand you must stop all use of the Services and of the data.

If you become aware of or suspect a breach of this Schedule, by you or anyone else, tell us at support@legioncodeinc.com.