Field OP — Terms of Service

Version: 1.0-draft Published at: /terms and /terms/1.0-draft Effective: not in force. A version that is not a draft takes effect when it is published at the address above, and not before. This version's wording is frozen at that address all the same: a correction is the next version, never an edit of this one.

This version is engineering's, and it is not in force. It was corrected on 17 September 2026 by checking every sentence about what the platform does against the code that does it. No lawyer has reviewed it, nobody has been asked to accept it, and it stays a draft — the page carrying it says so before the text — until a version counsel has cleared replaces it.

1. Who you are contracting with

Field OP is a product of Gestalt Communications Inc., a corporation incorporated federally in Canada ("Gestalt", "we", "us"). Gestalt is the party you contract with, the party that invoices you, and the merchant of record on your card statement. Nobody else stands behind these terms.

"You" and "your organization" mean the campaign, party association, advocacy organization or other body that signs up for Field OP, and every person who uses Field OP under your organization's account.

Assignment. Gestalt may assign or novate this agreement to an affiliate, or to a successor that acquires the Field OP business, on written notice to you and without your further consent, provided the successor assumes these terms in full. You may not assign this agreement without our written consent, except to a successor organization of your own campaign or association.

2. What these terms cover

These terms govern your use of:

• the Field OP web console;
• the Field OP phone app (Android at launch — see section 10);
• printed walk sheets and paper entry produced by Field OP;
• any documentation, support and services we provide with them.

Together, the "Service".

Acceptance. You must accept these terms, the Acceptable Use Policy, the Data Processing Terms and the Privacy Notice before your organization is granted access to the Service. By creating an organization and paying, you accept them on behalf of your organization, and you confirm you are authorized to do so. The version you accepted is recorded, with the exact wording you were shown, and your administrators can read it back at any time.

3. Your licence to use Field OP

For as long as your subscription is paid and in good standing, we grant your organization a non-exclusive, non-transferable, revocable right to use the Service for your own political, electoral, advocacy or organizing work, within the limits of the plan you bought.

You may not: resell, sublicense or provide the Service to a third party as a service; copy, decompile or reverse-engineer it; use it to build a competing product; remove or obscure any notice in it; or exceed the plan limits by creating multiple organizations to avoid a cap.

White label and branding. If your plan includes branding options, they apply to what your volunteers and the public see, on the terms we publish for them. Removing or altering Field OP's own attribution where it is required is not permitted.

4. Accounts, users and administrators

Sign-in. Every account signs in with a single-use link sent to a verified email address, or another method we support. There are no shared accounts. An invitation is the only way into an organization — we do not add anybody to your organization except through your administrator's invitation, and neither does anybody else.

Your administrators are responsible for:

• who is invited, what role they hold, and removing people who leave;
• issuing and revoking capability grants, including the Restricted Data grant, which is the only way anybody reads a restricted field or an inferred label;
• the accuracy of what your organization records about people;
• the lawfulness of what your organization does with the Service.

Roles are a closed vocabulary. Your organization cannot invent a permission level. The roles, the capability grants and the scope rules are the platform's, and they are enforced in the database, not only in the interface. Some grants are dual-controlled: they name a second administrator, and the database itself refuses a grant that names the person who requested it or the person who receives it. Restricted Data is one of those. Naming that second administrator is not the same as asking them. Nobody is notified, there is no queue and nothing waits for an answer; the grant counts from the moment it is issued. We say this plainly because the word "approve" would suggest otherwise.

Dangerous acts need a recent sign-in. Exporting people, changing permissions and signing a destruction certificate each require a re-authentication less than five minutes old. Sessions expire absolutely at twelve hours. Two things a phone does are exempt, by name and for a reason: uploading the conversations recorded at doors, and reporting a safety event. A volunteer who cannot re-authenticate from a basement must not lose a day's work, and a person in trouble is never asked to sign in again.

Your responsibilities as an account holder. Keep your email account secure — a sign-in link is a key. Tell us promptly if you believe an account has been compromised. You are responsible for what your users do with the Service, including volunteers.

Volunteers. A volunteer is a user of your organization's account, not our customer. You decide what they may see. The platform enforces hard floors on top of your decision — for example, no restricted field and no inferred label ever reaches a phone or a walk sheet, by construction, whatever role you give somebody.

5. Your data, and what belongs to us

5.1 Your data stays yours

You keep your rights in Client Data — the records your organization loads, and everything your organization creates in the Service: people, households, interactions, surveys, tags, custom fields, consent and suppression records, universes, turfs, canvasses and the rest.

This is subject to three things that are not ours to waive: the rights of the individuals the data describes; the restrictions attached to the source it came from (a voters' list carries its own rules — section 8); and the limited licence you give us below so that we can actually run the Service for you.

5.2 The licence you give us

You grant us a limited, non-exclusive licence to host, copy, transmit, display and process Client Data only in order to:

• deliver, secure and support the Service;
• perform integrations you have asked for;
• comply with law and with this agreement;
• generate the telemetry described in our privacy notice;
• create de-identified aggregate operational benchmarks under the limits in section 5.4;
• train a per-tenant model for your organization's own use.

Nothing else. In particular:

• We do not sell Client Data, and we do not sell or share voter or contact data.
• We do not train general third-party models on your content. No content of yours is sent to a general-purpose AI provider for training.
• There is no automatic flow of your data to Gestalt's other products.
• We do no cross-site tracking, device or cookie identity linkage, or commercial data enrichment.

5.3 What belongs to Gestalt

We own the Field OP software, its design, its generic workflows, its documentation, its security architecture, its orchestration systems, and generic improvements to the product — including improvements we make after seeing how the Service is used in general.

Models, said precisely, because the line matters. A per-tenant model trained on your data is associated with your organization: we do not transfer it, reuse it for another customer, or sell it. The modelling method, the features, the pipelines, and platform-level models built on de-identified aggregates or licensed data are ours. The labelling model described in section 9 is a platform-level model of ours; the labels it writes about your people are Client Data.

5.4 Benchmarking

We may produce de-identified aggregate benchmarks so that customers can compare their operational performance against comparable organizations.

Benchmarks are computed only from operational telemetry — how the Service is used. Volunteer hours, shift completion, contacts per hour, sync and delivery metrics, survey completion rates and similar measures of activity. We do not compute benchmarks from the contents of voter or contact records, and we do not benchmark candidate support, opposition, individual characteristics, inferred labels or your strategy.

Your raw data stays bound to your organization.

[NOT YET BUILT — 17 Sep 2026] There is no benchmarking feature in the Service. Nothing computes a benchmark, nothing shows one, and there is no cohort and no floor. What follows is what binds us if we build one; it is a limit on us rather than a description of something running.

If we produce benchmarks, they will be produced under defined cohort rules: a minimum of ten organizations before a benchmark is shown; a cohort suppressed where one organization contributes an outsized share, or where the comparison could reasonably reveal a specific campaign; and where a cohort would be too small, the segment broadened rather than the small cohort exposed. The Data Processing Terms set this out in full.

5.5 Pooled calibration counts

One thing crosses the boundary between organizations, and it is better named here than discovered.

When the labelling model in section 9 records a guess about a person and that person then tells one of your volunteers the answer, the pair — what the model said, what the person said — is counted. These counts are integers. They carry no person, no name, no record identifier, and once pooled, no organization identifier.

By default the counts are pooled across every organization on the platform, so that the model's accuracy figures mean something. There is no minimum-contributor floor. While very few organizations are sharing, one of them could in principle subtract its own counts and infer something about what remains; nothing in the platform prevents that today. What bounds it is what a count can say, and a count says nothing about a person, about support, or about strategy. Your administrator can switch pooling off, and then your organization learns only from its own counts. Your administrator also chooses, in advance, whether your counts stay in the pool or are deleted if your organization is deleted.

6. Acceptable use

Your use of the Service is subject to our Acceptable Use Policy, published at /acceptable-use, which forms part of these terms and which you accept at sign-up. It sets out prohibited uses, the prohibitions specific to the intelligence features in section 9, our enforcement ladder, and your right to appeal a substantive enforcement decision. We may update it on notice.

Our posture. Field OP is politically neutral infrastructure, not an editorial publisher. We do not approve or reject political viewpoints, and we serve campaigns across the spectrum. We do enforce lawfulness, platform safety and the Acceptable Use Policy, and we keep commercial discretion to decline or end service where there is material legal, security, sanctions, conflict-of-interest or reputational risk.

7. Election-law compliance — what we do and what we do not do

Field OP is not your lawyer and is not automated legal counsel. Compliance features are aids. They do not make your campaign compliant, and a feature that lets you do something is not advice that you may lawfully do it.

What the Service actually does:

• Hard controls you cannot override: permission and organization boundaries, suppression and do-not-knock, expired missions, restricted-field access rules, and destruction controls.
• Controlled blocks an authorized administrator may override with a permission, a reason and an audit record, where that is legally appropriate.
• Warnings you acknowledge and proceed past, with the acknowledgement recorded.

Compliance is configuration. A jurisdiction pack carries identity and sponsor requirements, communication rules, voters'-list access and destruction rules, retention obligations and required acknowledgements. Ontario municipal rules are the pack that exists at launch.

You are responsible for choosing the right jurisdiction configuration, for registering where registration is required, for the content of what you send and say, and for the lawfulness of your contact, targeting and messaging — including the timing of contact, which the Service does not restrict.

8. Voters' lists: restricted handling and your destruction obligations

This section is the one most likely to be read by a returning officer, so it is written plainly.

A voters' list is not ordinary data and the Service treats it differently. When you import one:

• you classify the source and record its retention rule and its destruction date;
• you name a list custodian — the person in your organization accountable for that list and its copies;
• you sign a custody acknowledgement naming the source, the rule and the date, and that acknowledgement is kept permanently and cannot be edited or deleted;
• every copy taken from that source afterwards — every export, every printed walk sheet, every mission bundle sent to a phone — is recorded in a copies register with who received it, so you can count what is outstanding at any moment;
• restricted fields (date of birth, sex or gender) are held apart behind the Restricted Data grant and never reach a phone or a walk sheet;
• exports of people require a re-authentication within the last five minutes, and an exported file is fetchable once, by the person who asked for it, and expires after 24 hours — the record of the export outlives the file;
• a mission bundle on a volunteer's phone expires at the end of the canvass window or in 24 hours, whichever comes first, and the phone purges it 12 hours after that.

Your obligations, which we cannot discharge for you. You must comply with every restriction attached to the list by the authority that issued it: the permitted purposes, the limits on who may hold a copy, the retention rule, and the destruction deadline. You must destroy the list and its copies when required, and you must collect whatever confirmations the issuing authority requires from everyone who held a copy — including your volunteers' phones and every sheet of paper.

The honest limit

Field OP does not carry out destruction, and a destruction certificate from Field OP is not evidence that anything was destroyed. The platform records the undertaking, tracks every copy and derivative, and can produce a certificate stating what was outstanding and who held it at a given moment. The certificate says so on its face.

You acknowledge that you are solely responsible for destroying a voters' list and all copies and derivatives of it, and for collecting from every holder the written confirmation the issuing authority requires; that the Service records undertakings and tracks copies but does not carry out destruction; and that a certificate produced by the Service is not evidence that anything was destroyed.

Related and equally honest: records in the Service are soft-deleted. Hard deletion is revoked at the database for the application, deliberately, so that an application bug cannot erase evidence. Custody acknowledgements, destruction certificates and the audit trail are append-only and cannot be erased at all, because they are the accountability the rest of this section depends on.

9. Intelligence: name-based labelling, AI limits, and your responsibility

9.1 What the feature is

Field OP includes a model that reads a person's family name and records what it guesses about them. It is a guess from a name and nothing else — not from anything the person told you, and not from anything they did.

The characteristics the model guesses are a person's likely language, ethno-cultural community and religion, and the further characteristics set out in the Inferred Trait Schedule, which forms part of these terms.

[NOT YET BUILT — 17 Sep 2026] The Schedule and the Labelling Terms are addressed below as /terms/trait-schedule and /terms/labelling. Neither page exists: the console serves /terms, /privacy, /acceptable-use, /data-processing and /subprocessors, and nothing else. Both documents are real and are part of this set; they are not yet served at an address. We may add to or change the Schedule on notice to your administrators; a change to the categories named in this section is a change to these terms and is handled under section 16.3.

9.2 On by default, and you can switch it off

Labelling is on for a new organization by default outside Québec, as a matter of Field OP's platform policy. An organization that gives a Québec address when it signs up starts with labelling off and no characteristic enabled at all.

Your organization's settings row records the founding administrator as the person it was turned on by, and records that it was turned on at sign-up under the version of these terms that was accepted there — not under the Labelling Terms, which nobody had been shown at that point. The screen at Admin → Labelling says exactly that, and invites an administrator to turn the feature off and on again if they want their agreement recorded against the Labelling Terms themselves.

A tenant administrator may switch it off at any time, and labels stop being produced immediately. Turning it off and on again records that somebody agreed to the terms then in force. Labels already written stay on record, so that the decision can be audited and anything acted on can be found; they can be deleted, but only as a deliberate act.

Field OP does not represent that this feature is lawful in your jurisdiction, and you should take your own advice before relying on it.

9.3 What a label is never allowed to be

• A guess is never recorded as a fact. A label is stored apart from the person's record, marked as inferred, with the model, the model version, the evidence, the explanation and a date it stops being current. It is never written into a name field, a language field or anything else your organization holds as a fact.
• A trait a person states about themselves outranks the model's guess, always. If somebody tells your volunteer their language, that is what your organization holds; the guess does not overrule it and does not come back.
• No message is ever selected from an inferred trait. A script variant may select only on fields the mission bundle already carries plus the language a person stated; an inferred trait structurally cannot be one of them.
• No one is included in or excluded from contact on a score. The rule language that would let an organization build a target list from model output is switched off everywhere and matches nobody.
• A human can confirm, correct, reject or switch off any label, for any individual, and a label a human rejected is not produced again by the same version of the model. Low-confidence guesses are stored and never shown.
• Who can never see a label: no volunteer, no team captain, no candidate — not on a screen, not on a phone, not in an export, not on a printed walk sheet. Reading a label requires the Restricted Data grant, which is dual-controlled, expiring and separate from any role. This is enforced in the database, so it holds for software written later, and an export refuses an inferred class before any grant is considered.

9.4 The marker on every label

Every label carries a marker recording the platform policy, the model and the model version under which it was computed, so that any label can be traced to the rules and the wording in force when it was written.

9.5 How wrong it is

It is wrong often, and unevenly. On the synthetic test population the model is right about roughly 88% of names from one community and 62% from another — twenty-six points apart, where a single average would report seventy-eight percent and conceal both ends. The accuracy report is ordered worst-community-first for that reason, and your administrators can see it before and after switching the feature on.

Religion is the weakest. A name can suggest a community. It cannot tell you what somebody believes, or whether they believe anything. Field OP produces a religion label by applying a published assumption about a community to a person, and usually declines to name one answer and shows a spread instead. Treat it as the least reliable thing the platform will ever show you.

A name is weakest evidence precisely for the people most often misunderstood — adoptees, converts, people who married across a community, and families longest in the country.

On a real campaign the accuracy report cannot break down by community at all, because nobody knows anybody's actual community. Only a person's own correction can measure it, one at a time, after the fact.

9.6 Nothing is sent anywhere

The model runs inside Field OP on Canadian infrastructure. No name, and nothing else about any person, is sent to a third-party name-classification service, to a demographic-inference API, or to a general-purpose AI provider, for this feature or any part of it.

9.7 Human review, and your responsibility for what you decide

This applies to every AI feature in the Service, not only labelling.

• AI output is a suggestion, and a human confirms it. Import column mapping is proposed by a model and accepted, edited or rejected by a person, and the outcome is recorded. Anything a model produces about a person is an estimate.
• You are responsible for your targeting and messaging decisions, including decisions you make using model output. If you choose who to contact, what language to offer, or what to say on the basis of something Field OP inferred, that is your decision and your organization's responsibility, and you are responsible for it being lawful and non-discriminatory.
• You will use labels only for lawful, non-discriminatory purposes connected to your stated work — offering material in a language somebody is likely to read is the example the product gives. You will not use them to exclude anyone from contact, to target anyone on the basis of religion, or for any purpose that would be unlawful if the person had told you the same thing directly.
• If a person asks what your organization believes about them and why, that answer is yours to give. The platform can produce it — the label, its confidence, the model version, and the fact that it came from their name — and there is no self-service route for a member of the public. They come to you.

10. The phone app is Android only at launch

The Field OP phone app runs on Android at launch. There is no iPhone app.

This is a straightforward consequence of what is built: iOS needs a cloud build, an Apple Developer Program membership and App Store review, none of which is started. It is not a statement about which phones your volunteers ought to own.

A volunteer without an Android phone is not turned away. They canvass from a printed walk sheet, and the results are entered in the console through paper entry. Both are built, both work, and both go through the same custody and copies register as a phone bundle does — a walk sheet is a copy of people's data on paper and is tracked as one. Your volunteer onboarding material should say this rather than leaving anybody to discover it.

We may add an iOS app later. Nothing in these terms commits us to a date.

11. Third-party services

The services Field OP itself uses are listed in our Privacy Notice and in our sub-processor register, which is the authoritative list. Six of them process data outside Canada, and all six are disclosed by name:

None of these carries voter data. Everything else the platform runs on is in Canada. The two sign-in providers began operating on 17 September 2026; Microsoft is the only one of the six that is neither Google nor Stripe, and it has no Canadian-resident deployment available to us.

Sub-processor changes. We publish our sub-processor register, which is the authoritative list. We will give you at least thirty days' notice before a new sub-processor begins processing Client Data. You have no right to object to a new sub-processor; if a change is unacceptable to you, your remedy is to stop using the Service and cancel under section 13.

Integrations you enable. If we later offer integrations with services you choose, you are responsible for your relationship with that service, for what you authorize it to read or write, and for its terms. We are not responsible for a third-party service's availability or for what it does with data you direct us to send it. There are no customer-enabled third-party integrations in the Service today, and a public API is not part of this launch.

12. Fees, payment and taxes

A card at sign-up. Field OP is paid software. There is no free tier and no invoicing at sign-up: you give a card when you create your organization, and the subscription starts immediately.

How payment works. Payment is taken through Stripe. You are sent to Stripe's own hosted page to enter your card. Card details never reach Field OP — we keep Stripe's identifiers and a card fingerprint used to spot abuse, and nothing else. Stripe's own terms apply to your payment relationship with them; the merchant of record, and the name on your invoice, is Gestalt Communications Inc.

Plans and billing period. Plans are annual subscriptions and renew automatically unless cancelled. You can change plan, update your card and read your invoices through the billing screen and Stripe's customer portal. A campaign that has finished can downgrade to the between-cycle rate, which keeps your organization and its records alive between elections.

Taxes. Prices exclude tax. GST, HST, QST and provincial sales tax are calculated and added at checkout based on where you are. You are responsible for any tax registration of your own.

Plan limits. Your plan includes limits — contacts, active campaigns, support tier. Limits bind bulk operations and the creation of new things: a new campaign, an un-archive, an import. A limit never refuses a single record at a door or a stall. A resident standing in front of a volunteer is always recorded.

Fees are non-refundable. Except where we terminate for convenience, all fees are non-refundable and there are no refunds or credits for partial periods, unused capacity, or a term you cancel early. Cancellation takes effect at the end of your current term.

Price changes. We may change our prices on at least thirty days' notice before your renewal date. The new price applies from renewal. If you do not accept it, cancel before renewal.

If a payment fails, we will tell you and retry. After a grace period your organization moves to read-only: you can read, export and fix your billing, and you cannot write. Paying restores you.

We do not process political donations. Field OP bills your organization for software. It has no fundraising module and does not handle contributions.

13. Suspension, termination and closeout

You may cancel at any time, effective at the end of your current term, through the billing screen.

We may suspend or terminate for non-payment, for a breach of the Acceptable Use Policy, where the law requires it, or where continuing to serve you would create material legal, security or sanctions risk. Except where the situation is urgent or the law forbids it, we will tell you first and give you a chance to fix it.

What suspension actually means, because it is modelled rather than improvised:

• Read-only — you can read, export and manage billing. You cannot write. This is where a failed payment lands you, and the reason read-only still allows export is that your data is yours and you must be able to take it out.
• Suspended — billing and export. Nothing else.

Export remains available in both states. A campaign that cannot pay is still entitled to its own records, and may be under a statutory deadline to account for a voters' list.

[NOT YET BUILT — 17 Sep 2026] True of read-only standing, and not of suspended. A suspended organization can sign in and can pay — that much was built on 17 September 2026 — but the permission evaluator allows a suspended organization billing and nothing else, so an export is refused. The sentence is kept because it is what we intend and because a campaign holding a voters' list may be under a statutory deadline; it is marked because the platform does not do it today.

Suspension for cause is a decision a person takes with a reason recorded; it never happens automatically.

At closeout. For thirty days after your subscription ends you may export your Client Data. After that period we will delete or de-identify it within ninety days, except for records we are required or entitled to retain: the audit trail, custody acknowledgements, destruction certificates, billing records, and anything subject to a legal hold. Any per-tenant model trained on your data is destroyed at closeout and is not exportable.

[NOT YET BUILT — 17 Sep 2026] The thirty days and the ninety days are the intention, not a description. There is no wind-down path in the platform at all: nothing marks a subscription as ended, nothing opens an export window, and nothing deletes or de-identifies an organization's data when it closes. The export itself is built and works today. The promise is kept here because it is meant, and marked because the mechanism behind it does not exist.

Your obligations under section 8 — the voters' list, its copies and its destruction deadline — do not end when your subscription does.

14. Confidentiality and security

Confidentiality. Each of us will keep the other's confidential information in confidence and use it only for this agreement. Your Client Data is your confidential information. Our non-public documentation, pricing and security architecture are ours. Neither of us needs to keep confidential what is public, already known, independently developed, or required to be disclosed by law — with notice to the other where notice is lawful.

What we do. Stated conservatively, and each of these is enforced and tested:

• Organizations are isolated at the database. Row-level security means an application bug cannot read across organizations, because the database refuses — not because the code remembers to check.
• Roles are a closed vocabulary, and restricted classes need a separate, expiring, dual-controlled grant on top of a role.
• A phone never holds restricted data, by construction. A bundle carrying a forbidden field is refused and discarded by the app itself.
• Mission bundles are signed, and the app opens only bundles whose signature checks out.
• The audit trail is comprehensive, immutable, and cannot be used to read personal data. Every event records which record changed, by whom, and the shape of the change — identifiers, counts, timestamps, statuses and hashes — and never the content. Not a name, not a contact detail, not what somebody said at a door. This is checked in our build over every audit payload in the system and fails the build on any key that is content.
• Sessions expire absolutely at twelve hours, but for the two phone paths named in section 4; dangerous acts need a re-authentication within five minutes.
• Encryption in transit and at rest.

What we do not claim. We hold no SOC 2 or equivalent attestation. Do not read this section as one.

Security incidents. We will notify you without undue delay after becoming aware of a breach of security safeguards affecting your Client Data, and will give you the information you reasonably require to meet your own obligations. You are responsible for notifying the individuals whose information your organization holds, and for any report you are required to make to a regulator. Our notification to you is not an admission of fault or liability.

What you do. Keep your users' email accounts secure. Review your administrators and grants. Do not share accounts. Tell us promptly about a suspected compromise. Do not put data in the Service that you have no right to hold.

15. Availability, disclaimers, liability and indemnity

15.1 Availability

We aim to keep the Service available and we monitor it continuously, but we do not commit to a service level, an uptime percentage or a recovery time, and we offer no service credits. Support is one tier, business hours Eastern.

Election-critical periods and change freezes. We operate a change freeze around voting days and advance voting. During a freeze we ship only data-integrity fixes, with two-person approval.

Maintenance and changes. We may change, add to or remove features. We will not make a change that materially reduces the Service's core function without telling you. We may update these terms; see section 16.3.

15.2 Disclaimers

The Service is provided as it is. To the extent the law allows, we disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement.

We specifically do not warrant that:

• the Service makes you compliant with election or privacy law. It enforces rules and raises warnings; it is not legal advice and it is not a lawyer;
• any inference, score or model output is accurate. Section 9 says in numbers how wrong the labelling model is, and those numbers are measured on synthetic data that was built to be classifiable — a real population is read less accurately, not more;
• the Service destroys data on a schedule. It records who holds what and refuses to imply more (section 8);
• third-party services we depend on will be available.

15.3 Liability

(a) To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, lost data, loss of goodwill, or the cost of substitute services, whether in contract, tort (including negligence), or otherwise, and whether or not the party was advised such damages were possible.

(b) Each party's total aggregate liability arising out of or relating to these terms is limited to the fees you paid to us in the twelve months immediately preceding the event giving rise to the claim.

(c) Paragraphs (a) and (b) do not apply to: a party's fraud or wilful misconduct; your obligations under section 15.4; your breach of section 3 or of the Acceptable Use Policy; or your unpaid fees.

(d) Limitation period. Any claim arising out of or relating to these terms, or to the Service, must be commenced within one year after the day on which the claim was discovered, and is absolutely barred afterwards. This limitation period applies to all such claims, whether in contract, tort, statute or otherwise. The parties agree that this provision varies and excludes the basic limitation period in section 4, and any other limitation period that would otherwise apply, under the Limitations Act, 2002 (Ontario). These terms are a business agreement within the meaning of section 22 of that Act.

15.4 Indemnity

You indemnify us against claims arising from: data you loaded that you had no right to load; your use of the Service in breach of the Acceptable Use Policy or of section 7; your contact, targeting and messaging decisions, including decisions made using model output; and your handling or non-destruction of a voters' list.

We indemnify you against a third-party claim that the Service itself infringes an intellectual property right, other than where the claim arises from your data or your use of the Service in breach of these terms.

Procedure. The party seeking indemnity must give prompt written notice of the claim, allow the indemnifying party sole control of the defence and settlement, and provide reasonable cooperation at the indemnifying party's expense. The indemnifying party may not settle in a way that imposes a non-monetary obligation on, or admits fault by, the indemnified party without its consent, not to be unreasonably withheld. Failure to give prompt notice relieves the indemnifying party to the extent it is prejudiced.

Our remedy for an infringement claim. If the Service is held, or we believe it likely to be held, to infringe a third-party intellectual property right, we may at our option procure the right for you to continue using it, modify it so that it is non-infringing, or terminate your subscription and refund prepaid fees for the unused portion of your term. This is our sole liability and your exclusive remedy for any claim of infringement.

16. Governing law, notices, changes and precedence

16.1 Governing law and jurisdiction

These terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable in it, without regard to conflict-of-laws rules. The courts of Ontario have jurisdiction over any dispute arising out of or relating to these terms, and you attorn to the jurisdiction of those courts. This does not prevent us from seeking relief in any other court of competent jurisdiction.

16.2 Notices

We give notice to your administrators at the email addresses on your account, and by a notice in the console.

You give notice to us at legal@fieldop.ca, with a copy by registered mail to Gestalt Communications Inc., [registered office address], Attention: Legal.

A notice by email is effective on the business day after it is sent, unless the sender receives a delivery failure.

16.3 Changes to these terms

We may update these terms. Each version is published at its own address and is never edited: a change is a new version. Where a change is material we will tell your administrators and ask them to accept the new version; where it is not, we will publish it and note the date.

16.4 Order of precedence

If these documents conflict, the order is:

1. a signed written agreement between us (an enterprise or design-partner agreement);
2. the Data Processing Terms;
3. these Terms of Service;
4. the Acceptable Use Policy;
5. the Labelling Terms and the Inferred Trait Schedule;
6. the Privacy Notice;
7. product documentation and other in-product terms.

Two exceptions:

• Personal information. Where these terms and the Privacy Notice conflict on the handling of personal information, the Privacy Notice governs.
• Labelling. Section 9 of these terms and the Labelling Terms shown in the product are rendered from one source and are the same text. Where a difference nevertheless appears, the version recorded against your organization's settings at the time the label was written is the operative version.

Field OP is a product of Gestalt Communications Inc.