RSVPify Acceptable Use Policy

This RSVPify Acceptable Use Policy (this “AUP“) applies to all persons and entities that access or use the RSVPify software-as-a-service platform and related services (the “RSVPify Services“), whether under the RSVPify Terms of Service available at https://rsvpify.com/tos, an executed RSVPify Master Subscription Agreement, an Order Form, or otherwise. In this AUP, “CUSTOMER” means any such person or entity, whether an individual self-service user or an organization operating under an executed enterprise agreement with RSVPify. For clarity, references in this AUP to “CUSTOMER” include, and are equivalent to, any “User” or “you” as those terms are defined or used in the RSVPify Terms of Service.

This AUP forms part of CUSTOMER’s agreement with RSVPify Inc. (“RSVPify“). Capitalized terms not defined in this AUP have the meanings given in the RSVPify Terms of Service, the RSVPify Master Subscription Agreement, the RSVPify Enterprise Terms of Use, or the applicable Order Form, as applicable to CUSTOMER’s use of the RSVPify Services.

SCOPE AND PURPOSE

This AUP establishes the rules and restrictions governing CUSTOMER’s, its Authorized Users’, and its event guests’ use of the RSVPify Services. CUSTOMER is responsible for ensuring that its Authorized Users comply with this AUP and, to the extent applicable, that its event guests and other end users of the RSVPify Services do not use the RSVPify Services in a manner that violates this AUP.

PROHIBITED CONTENT

CUSTOMER shall not use the RSVPify Services to submit, upload, post, transmit, or otherwise make available any content that:

(a) is unlawful, fraudulent, or violates any applicable law or regulation;

(b) infringes, misappropriates, or otherwise violates any intellectual property right of any third party, including copyright, trademark, patent, trade secret, right of publicity, or right of privacy;

(c) is defamatory, libelous, obscene, pornographic, harassing, threatening, discriminatory, or otherwise objectionable, or that promotes violence, hatred, or discrimination on the basis of race, ethnicity, national origin, religion, gender, sexual orientation, gender identity, disability, age, or other protected characteristic;

(d) exploits or harms minors in any way, or contains sexually explicit material involving minors;

(e) constitutes child sexual abuse material or is otherwise unlawful in relation to minors;

(f) contains malware, viruses, worms, trojans, ransomware, spyware, or other malicious code;

(g) constitutes personal information, financial account information, government-issued identification numbers, protected health information, or other sensitive information that CUSTOMER is not authorized to collect or process under applicable law;

(h) is designed to phish, harvest, or otherwise unlawfully collect information from any third party;

(i) is or includes AI-generated, synthetic, or manipulated media (including deepfakes, voice clones, or AI-generated images, video, or audio) that impersonates or depicts any real person without such person’s demonstrable consent, or that is designed to deceive recipients about the identity, endorsement, or affiliation of any real person, brand, organization, or event;

(j) promotes, glorifies, celebrates, or incites terrorism, mass violence, or violent extremism, or includes symbols, imagery, slogans, insignia, or other content commonly associated with terrorist organizations, violent extremist movements, or hate groups (including, without limitation, organizations or movements designated by the U.S. Department of State, the U.S. Department of the Treasury Office of Foreign Assets Control, the European Union, His Majesty’s Treasury of the United Kingdom, or other applicable governmental authority);

(k) discloses, publishes, aggregates, or makes accessible personal, contact, location, employment, family, financial, medical, or other identifying information about any individual without such individual’s consent, or in a manner intended or reasonably likely to expose such individual to harassment, stalking, intimidation, discrimination, or harm (commonly known as “doxxing“);

(l) impersonates, or falsely represents an affiliation with or endorsement by, any individual, brand, organization, government, or event, whether by use of names, likenesses, credentials, official titles, insignia, or other identifiers, and whether or not such impersonation involves AI-generated or synthetic media (which is separately prohibited under Section 2(i)); or

(m) violates any RSVPify content policy communicated to CUSTOMER from time to time.

Reporting of Illegal Content. RSVPify complies with 18 U.S.C. § 2258A and reports apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) CyberTipline as required by applicable law. RSVPify may also, at its discretion, report other violations of this AUP or of applicable law to appropriate law enforcement, regulatory, or self-regulatory authorities.

PROHIBITED USES

CUSTOMER shall not, and shall ensure that its Authorized Users do not, use the RSVPify Services to:

(a) engage in any activity that violates applicable law or regulation, including telecommunications, marketing, consumer protection, data protection, and anti-money-laundering laws;

(b) send unsolicited communications in violation of applicable law, including the Telephone Consumer Protection Act (TCPA), CAN-SPAM Act, state telemarketing and telephone solicitation laws (including, for example, the Florida Telephone Solicitation Act), Canada’s Anti-Spam Legislation (CASL), the General Data Protection Regulation (GDPR), the UK GDPR, or comparable laws of other jurisdictions;

(c) send communications for which CUSTOMER has not obtained legally required consents from recipients, including communications to any contact list that was purchased, rented, borrowed, shared, or otherwise obtained from a third party; recipient consent may not be bought, sold, rented, or transferred and applies only to the party to which it was given;

(d) circumvent, disable, or otherwise interfere with security-related features of the RSVPify Services, or attempt to gain unauthorized access to the RSVPify Services, other CUSTOMERs’ accounts, or any related systems or networks (subject to the security-research safe harbor in Section 9);

(e) reverse engineer, decompile, disassemble, or otherwise attempt to derive source code, algorithms, or trade secrets from the RSVPify Services, except to the limited extent applicable law prohibits this restriction;

(f) use the RSVPify Services to build a product or service that competes with the RSVPify Services, to benchmark the RSVPify Services against a competing product or service for the purpose of developing or marketing a competing product, or to substantially reproduce the RSVPify Services;

(g) sell, resell, license, sublicense, distribute, rent, lease, or otherwise commercially exploit the RSVPify Services, except as expressly authorized by RSVPify in writing;

(h) impose, or attempt to impose, an unreasonable or disproportionate load on the RSVPify Services or the infrastructure that supports them;

(i) circumvent or exceed any usage limits, quotas, or access controls applicable to CUSTOMER’s account;

(j) engage in any activity intended to disrupt, degrade, or interfere with the availability of the RSVPify Services for other customers;

(k) use the RSVPify Services for or in connection with any of the following categories of content, use, or events, all of which are prohibited on the RSVPify Services: (i) escort, adult, or sexually explicit content or services; (ii) gambling, casino promotion, or unlicensed gaming services; (iii) academic fraud, contract cheating, or essay mill services; (iv) piracy, unlicensed media distribution, or copyright infringement; (v) malware, phishing, or deceptive pages; (vi) drug sales or promotion of controlled substances; (vii) retail sale, direct commercial promotion, or unlawful distribution of alcohol, tobacco, cannabis, firearms, or other regulated products or controlled substances, or events whose primary purpose is such retail sale, promotion, or distribution (for clarity, this clause does not prohibit events that incidentally serve alcohol as an ancillary amenity, such as receptions, galas, or weddings); or (viii) spam, unsolicited bulk messaging, or search engine optimization manipulation. For clarity, the categories in this Section 3(k) are subject to case-by-case exception under the Exceptions provisions below; CUSTOMERs operating under an executed Master Subscription Agreement or Order Form may negotiate specific carve-outs to be expressly identified in the applicable Order Form;

(l) include links to external registration or payment processors, or otherwise encourage recipients of CUSTOMER’s events to submit registration information or payments to CUSTOMER outside the RSVPify Services registration and payment functionality;

(m) use the RSVPify Services in violation of the applicable agreement between CUSTOMER and RSVPify (whether the RSVPify Terms of Service, the RSVPify Enterprise Terms of Use, the RSVPify Master Subscription Agreement, or an Order Form), this AUP, or any other applicable RSVPify policy communicated to CUSTOMER from time to time;

(n) access, monitor, index, copy, harvest, or collect any content or data from the RSVPify Services by any automated means (including scraping, crawling, data mining, spidering, web harvesting, or use of bots, scripts, or headless browsers), except through interfaces and endpoints expressly authorized by RSVPify in writing; use any automated system to submit registrations, communications, form entries, or other data to the RSVPify Services, except through interfaces and endpoints expressly authorized by RSVPify in writing; engage in credential stuffing, account enumeration, or similar automated access attempts; or attempt to interfere with, probe, or test the vulnerability of the RSVPify Services or any related network or system without RSVPify’s prior written authorization (subject to the security-research safe harbor in Section 9); or

(o) use artificial intelligence, machine learning, or other automated systems to (i) generate or send communications that materially misrepresent the human or AI origin of the communication where such misrepresentation would deceive a reasonable recipient; (ii) generate or submit fictitious, synthetic, or fraudulent registrations, RSVPs, attendee data, or event content; or (iii) impersonate any real person, brand, organization, or event without demonstrable authorization from the person or entity being impersonated.

Exceptions. Notwithstanding the restrictions in this Section 3 and in Section 2 (Prohibited Content) above, RSVPify may from time to time grant exceptions to specific restrictions in this AUP for CUSTOMER or for specific events. For CUSTOMERs operating under an executed Master Subscription Agreement or Order Form, any such exception shall be expressly identified in the applicable Order Form (or in a written amendment to the applicable agreement executed by both parties). For CUSTOMERs operating under the RSVPify Terms of Service or other self-service agreement, exceptions require prior written authorization from an authorized RSVPify representative, are granted at RSVPify’s sole discretion, and are not entitlements. In all cases, CUSTOMER’s use of the RSVPify Services in reliance on any such exception shall be subject to any additional conditions RSVPify imposes (including any age-gating, verification, safe-harbor, indemnification, insurance, or compliance requirements).

EVENT INTEGRITY

CUSTOMER shall not, and shall ensure that its Authorized Users do not, use the RSVPify Services to:

(a) create, publish, or promote events that do not actually exist as described, that are designed to defraud registrants or attendees, or that clone or materially imitate another organizer’s event with the intent to divert registrations;

(b) engage in, facilitate, or knowingly benefit from ticket scalping, bot-driven ticket or registration purchasing, or automated reservation of event capacity, in violation of applicable law (including the federal Better Online Ticket Sales Act of 2016 (BOTS Act)) or in violation of the terms of the applicable event;

(c) sell, transfer, license, or otherwise disclose attendee, registrant, or event guest data collected through the RSVPify Services to any third party, except (i) as necessary to deliver the event, (ii) as expressly consented to by the applicable attendee, registrant, or event guest at the time of collection, (iii) with the express consent of the affected individuals and as permitted under applicable data protection or privacy laws, or (iv) as expressly authorized in the applicable Order Form;

(d) create, publish, or promote events that falsely claim the participation, endorsement, or sponsorship of any person, brand, or organization, or that misrepresent the identity or affiliation of any host, speaker, presenter, performer, or sponsor; or

(e) sell, offer to sell, or purport to authorize the sale of tickets, registrations, or admissions to any event without the demonstrable authority of the event organizer, venue, or applicable rights holder.

COMMUNICATIONS COMPLIANCE

Where CUSTOMER uses the RSVPify Services to send communications (including email, SMS, MMS, and push notifications) to event attendees, registrants, guests, or other recipients, CUSTOMER is solely responsible for:

(a) obtaining all legally required consents from recipients prior to sending such communications, including prior express written consent where required by applicable law (such as for marketing or promotional communications);

(b) providing all legally required notices, including privacy notices under applicable data protection laws;

(c) honoring recipient opt-out requests and honoring standard reply keywords (including STOP, HELP, and similar keywords for SMS communications) as required by applicable law or industry rules;

(d) maintaining sender identity accuracy and complying with sender identification requirements under applicable law;

(e) complying with all applicable rules of telecommunications carriers, industry associations (including the CTIA and equivalent bodies in other jurisdictions), and messaging network operators; and

(f) maintaining records sufficient to demonstrate compliance with the foregoing, for at least four (4) years or such longer period as required by applicable law.

CUSTOMER shall not engage in any practice designed to evade messaging abuse detection or content filtering, including intentionally misspelled words or non-standard opt-out phrasing intended to evade detection, obscuring or interfering with recipients’ ability to opt out, or distributing similar or identical messages across multiple sender numbers or identities to evade detection or filtering (commonly known as “snowshoeing”).

RSVPify may suspend or restrict CUSTOMER’s ability to send communications through the RSVPify Services where RSVPify reasonably determines that CUSTOMER is not complying with the requirements of this Section, where excessive bounces or complaints result from CUSTOMER’s communications, or where continued communications pose a risk to the security, reputation, or operational integrity of the RSVPify Services or its infrastructure. RSVPify and its messaging service providers may also filter, block, or decline to transmit any message where required or recommended by telecommunications carriers, messaging network operators, or applicable industry rules. Neither RSVPify nor its providers shall have any liability for messages that are blocked, filtered, or not delivered (including false positives), and no such filtering or blocking relieves CUSTOMER of its obligations under this Section.

THIRD-PARTY SERVICES

CUSTOMER shall not connect the RSVPify Services to, or use the RSVPify Services with, any third-party service, application, or integration that:

(a) circumvents the RSVPify Services’ registration, payment, ticketing, check-in, or communications functionality;

(b) accesses the RSVPify Services in a manner not authorized by the applicable agreement between CUSTOMER and RSVPify or the applicable Documentation;

(c) processes or transmits Customer Data in a manner that violates applicable law or this AUP;

(d) receives, aggregates, enriches, or resells attendee, registrant, or event guest data (including Personal Data) collected through the RSVPify Services for purposes beyond delivery of CUSTOMER’s specific event, including any transfer of such data to data brokers, audience-enrichment services, marketing data aggregators, ad networks, or similar third parties, without the affected individuals’ informed consent and disclosures required by applicable law;

(e) drops, embeds, injects, or operates advertising trackers, retargeting pixels, cookies, fingerprinting scripts, session-replay tools, or similar tracking technologies on RSVPify-hosted event pages, registration forms, ticketing flows, or communications for advertising, retargeting, cross-site profiling, or third-party analytics purposes without the affected individuals’ informed consent and disclosures required by applicable law; or

(f) impersonates, mimics, or spoofs RSVPify’s registration, ticketing, check-in, or communications functionality in a manner intended or reasonably likely to deceive CUSTOMER’s event attendees, registrants, or event guests.

For clarity, this Section 6 does not prohibit CUSTOMER’s use of third-party integrations that RSVPify makes generally available or supports as part of the RSVPify Services (as identified from time to time in RSVPify’s then-current Documentation), provided such use complies with this AUP and applicable law.

INTELLECTUAL PROPERTY NOTICES AND DMCA

7.1 Respect for Intellectual Property. RSVPify respects the intellectual property rights of others and expects CUSTOMER and its Authorized Users to do the same. RSVPify complies with the Digital Millennium Copyright Act (the “DMCA“) and other applicable intellectual property laws, and will respond to properly submitted notices of alleged copyright infringement in accordance with such laws.

7.2 Designated Agent for DMCA Notices. RSVPify has designated an agent to receive notifications of claimed copyright infringement in accordance with 17 U.S.C. § 512(c)(2). RSVPify’s designated agent is:

Legal and Compliance Operations RSVPify Inc. 4803 N. Milwaukee Ave., Suite B #325 Chicago, IL 60630 Telephone: 405-633-3274 Email: [email protected] U.S. Copyright Office Registration Number: DMCA-1075598

7.3 Elements of a Valid DMCA Takedown Notice. To submit a notification of claimed copyright infringement under 17 U.S.C. § 512(c)(3), the written notice must include substantially the following:

(a) a physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed;

(b) identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works;

(c) identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit RSVPify to locate the material;

(d) information reasonably sufficient to permit RSVPify to contact the complaining party, such as an address, telephone number, and email address;

(e) a statement that the complaining party has a good-faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and

(f) a statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

Notifications that do not substantially comply with all of the foregoing requirements may not be effective.

7.4 Counter-Notification Procedure. If CUSTOMER or an Authorized User believes that material has been removed or disabled as a result of mistake or misidentification, CUSTOMER may submit a counter-notification under 17 U.S.C. § 512(g)(3) to RSVPify’s designated agent identified in Section 7.2. A valid counter-notification must include substantially the following:

(a) a physical or electronic signature of the subscriber;

(b) identification of the material that has been removed or to which access has been disabled, and the location at which the material appeared before it was removed or access to it was disabled;

(c) a statement under penalty of perjury that the subscriber has a good-faith belief that the material was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled; and

(d) the subscriber’s name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of the United States District Court for the judicial district in which the subscriber’s address is located (or, if the subscriber’s address is outside the United States, for any judicial district in which RSVPify may be found), and that the subscriber will accept service of process from the person who provided the original notification or an agent of such person.

Upon receipt of a valid counter-notification, RSVPify will promptly provide the person who submitted the original notification with a copy of the counter-notification and will inform that person that RSVPify will replace the removed material or cease disabling access to it not less than ten (10) nor more than fourteen (14) business days following receipt of the counter-notification, unless RSVPify first receives notice from the person who submitted the original notification that such person has filed an action seeking a court order to restrain the alleged infringing activity.

7.5 Repeat-Infringer Policy. In accordance with the DMCA and other applicable law, RSVPify has adopted and will reasonably implement a policy of terminating, in appropriate circumstances and at RSVPify’s discretion, the accounts of CUSTOMERs, Authorized Users, or event guests who are determined to be repeat infringers of copyright or other intellectual property rights. RSVPify may also, at its discretion, limit access to the RSVPify Services or terminate the account of any person who infringes intellectual property rights, whether or not the infringement is repeated.

7.6 Trademark and Other Intellectual Property Claims. Complaints regarding alleged trademark infringement, right-of-publicity violations, or other intellectual property claims (other than copyright) may also be submitted to RSVPify’s designated agent identified in Section 7.2. RSVPify will evaluate such claims on a case-by-case basis and, where appropriate, may take similar action, including removal of the allegedly infringing content and, in the case of repeated violations, account termination.

REPORTING VIOLATIONS

CUSTOMER shall promptly notify RSVPify of any known or reasonably suspected violation of this AUP by CUSTOMER, any Authorized User, or any third party using CUSTOMER’s account. Any person may report suspected violations of this AUP through the RSVPify abuse reporting form at https://rsvpify.com/abuse/ or through such other channel as RSVPify may designate from time to time.

SECURITY RESEARCH SAFE HARBOR

RSVPify welcomes good-faith security research and will not treat activity that complies with this Section 9 as a violation of this AUP or of any applicable agreement between the person conducting the research (or such person’s principal, employer, or engaging party) and RSVPify (including the RSVPify Terms of Service, the RSVPify Enterprise Terms of Use, or the RSVPify Master Subscription Agreement, as applicable).

Activities requiring prior written authorization. The following categories of testing are outside the scope of this safe harbor and require RSVPify’s prior express written authorization:

(i) any form of load testing, stress testing, capacity testing, or performance testing;

(ii) any testing designed to trigger, verify, quantify, or explore a suspected data exposure by receiving, retaining, extracting, transmitting, or persisting Customer Data or third-party data beyond what is minimally necessary to demonstrate the existence of a vulnerability;

(iii) any denial-of-service or distributed-denial-of-service testing, or any activity intended or reasonably likely to reduce the availability of the RSVPify Services; and

(iv) any testing that a reasonable person would understand is likely to degrade the availability or integrity of the RSVPify Services, cause harm to any customer, Authorized User, event guest, or third party, or bring the RSVPify Services offline.

Any activity described in clauses (i) through (iv) that is conducted without RSVPify’s prior express written authorization is not protected by this safe harbor and is a violation of this AUP.

Safe harbor conditions. A person conducting security research qualifies for the safe harbor in this Section 9 if such person:

(a) submits a report of the vulnerability to [email protected] promptly upon discovery and provides RSVPify with a reasonable opportunity (not less than ninety (90) days from the date of report, or such other period as the parties agree in writing) to investigate and remediate the vulnerability before any public disclosure of the vulnerability;

(b) makes a good-faith effort to avoid privacy violations, degradation of the RSVPify Services, destruction, alteration, or corruption of data, and interruption or harm to RSVPify, its customers, Authorized Users, event guests, or third parties;

(c) does not access, retain, exfiltrate, or transmit any data belonging to any RSVPify customer, Authorized User, event guest, or third party beyond what is minimally necessary to demonstrate the existence of the vulnerability, and promptly deletes any such data upon reporting the vulnerability to RSVPify;

(d) does not exploit the vulnerability for any purpose other than reporting it to RSVPify;

(e) does not conduct any activity identified in clauses (i) through (iv) above without RSVPify’s prior express written authorization; and

(f) complies with all applicable laws, including computer fraud and abuse laws, data protection laws, and export control laws, in conducting the research.

Exclusions. This safe harbor does not extend to, and does not authorize, (i) violations of applicable law; (ii) disclosure of RSVPify’s Confidential Information or Customer Data; (iii) physical intrusion into RSVPify’s premises or those of its personnel, customers, or vendors; (iv) social engineering, phishing, or similar activity targeting RSVPify’s personnel, customers, or vendors; (v) any activity requiring prior written authorization under this Section 9 that is conducted without such authorization; or (vi) any activity that materially degrades the operation of the RSVPify Services or that harms or attempts to harm any customer, Authorized User, event guest, or third party.

Requesting authorization. To request authorization for activity that is outside the scope of the safe harbor, submit a written request to [email protected] identifying the person or entity seeking authorization, the scope and nature of the proposed activity, the proposed methodology and timeline, the reason for the activity, and contact information for coordinated communication. RSVPify will respond in its reasonable discretion and may grant, deny, or condition authorization on additional terms.

No waiver; RSVPify discretion. Nothing in this Section 9 constitutes a waiver of any right of RSVPify or grants any license to the RSVPify Services or to any intellectual property of RSVPify. RSVPify reserves the right, in its reasonable discretion, to determine whether particular activity qualifies for this safe harbor and to grant, deny, revoke, or modify any authorization for activity outside the scope of the safe harbor.

ENFORCEMENT

Enforcement of this AUP is governed by the applicable agreement between CUSTOMER and RSVPify (whether the RSVPify Terms of Service, the RSVPify Enterprise Terms of Use, or the RSVPify Master Subscription Agreement, together with any applicable Order Form). In summary:

Notice and cure. Where RSVPify reasonably believes that CUSTOMER or an Authorized User has breached this AUP, RSVPify may require CUSTOMER to remedy the breach within a reasonable period specified by RSVPify. If CUSTOMER fails to remedy the breach within such period, RSVPify may suspend CUSTOMER’s access to the affected RSVPify Services or terminate CUSTOMER’s account or the applicable agreement in accordance with the applicable agreement between CUSTOMER and RSVPify.

Immediate suspension. RSVPify may suspend access to the RSVPify Services immediately (with notice as soon as practicable thereafter) where reasonably necessary to (a) address a material security risk, (b) comply with applicable law or the direction of a governmental or regulatory authority, or (c) prevent imminent harm to RSVPify, its other customers, or any third party.

Additional termination rights. Nothing in this AUP limits RSVPify’s rights under the applicable agreement between CUSTOMER and RSVPify (whether the RSVPify Terms of Service, the RSVPify Enterprise Terms of Use, or the RSVPify Master Subscription Agreement) to suspend or terminate CUSTOMER’s access to the RSVPify Services for non-payment, regulatory or law-enforcement action, imminent security or harm risk, or other permitted grounds.

CHANGES TO THIS AUP

Changes to this AUP will be posted at the URL where this AUP is made available. For CUSTOMERs operating under the RSVPify Terms of Service or other self-service agreement, changes take effect upon posting or as otherwise specified in the RSVPify Terms of Service. For CUSTOMERs operating under an executed Master Subscription Agreement, changes are additionally subject to the change management provisions of the applicable Master Subscription Agreement (currently Section 4 of the RSVPify Master Subscription Agreement).

*This AUP is effective as of the date last updated above. For CUSTOMERs operating under the RSVPify Terms of Service or other self-service agreement, the current version of this AUP applies to all use of the RSVPify Services. For CUSTOMERs operating under an executed Master Subscription Agreement or Order Form, this AUP applies to Order Forms executed on or after that date, and prior versions of this AUP continue to govern Order Forms executed under those versions unless the parties agree in writing to migrate to a newer version.*

Last Updated: July 16, 2026