Master Services Agreement — Hearth

Provider: Lamplight Technology Consulting LLC (d/b/a Lamplight Software)

Effective date: January 1, 2026 Last updated: June 8, 2026

This Master Services Agreement (this "Agreement") is between Lamplight Technology Consulting LLC, a Montana limited liability company doing business as Lamplight Software ("Provider," "Lamplight," "we," or "us"), and the customer that signs an Order Form referencing it or accesses the Services under it ("Customer," "you," or "your"). It governs Customer's use of Hearth, Lamplight's HR and payroll platform, and its AI assistant Ember. This Agreement is intended for negotiated and larger-account engagements; self-serve use of Hearth is governed by the online Terms of Service unless an Order Form provides otherwise.

1. Structure and order of precedence

1.1 Components. This Agreement consists of these master terms; one or more Order Forms; any Statement of Work ("SOW"); and any Exhibits, Addenda, or Policies incorporated by reference, which may include a Data Processing Addendum ("DPA"), Service Level Agreement ("SLA"), and product-specific terms. An "Order Form" is any ordering document under which Customer purchases the Services and that references this Agreement.

1.2 Order of precedence. In a conflict, the following controls as to the conflicting term, highest first: (a) the DPA, for data-protection matters; (b) a signed Order Form or SOW, but only for terms the parties expressly negotiated and identified as overriding; (c) these master terms; (d) other Exhibits and Policies. Pre-printed terms on a Customer purchase order have no effect.

2. Definitions

"Affiliate" — an entity controlling, controlled by, or under common control with a party. Provider's Affiliates include Lamplight Technology Holdings LLC and the entities it owns or controls.
"Authorized Users" — Customer's personnel whom Customer permits to use the Services.
"Customer Data" — data Customer or its Authorized Users submit to or generate in the Services, including Workforce Data, but excluding De-Identified Data and Usage Data.
"Workforce Data" — information about Customer's employees and contractors processed in Hearth, which may include Social Security or taxpayer identification numbers, bank account details, wages, hours, tax elections, and garnishment and work-authorization information.
"De-Identified Data" — data derived from Customer Data or use of the Services that does not identify, and cannot reasonably be used to identify, any individual or Customer.
"Usage Data" — data about the configuration, performance, and use of the Services that is not Customer Content.
"Services" — Hearth, Ember, and related services and Documentation made available under an Order Form.

3. The Services

3.1 Access grant. Subject to this Agreement and payment of fees, Provider grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Services for Customer's internal business purposes during the Subscription Term, up to the limits in the Order Form.

3.2 Provider responsibilities. Provider will make the Services available consistent with the Documentation and any SLA, provide the support described in the Order Form, and maintain the security measures in Section 9 and any DPA.

3.3 Ember and AI features. Ember proposes actions and presents each change for Customer's review before it takes effect; Customer's confirmation is required, and sensitive matters route to a person. Provider uses third-party AI providers to deliver these features and contractually restricts them from using Customer Data to train their own general-purpose models. AI output may be inaccurate and is not legal, tax, accounting, or HR advice; Customer is responsible for reviewing proposed actions before confirming them.

3.4 Changes and suspension. Provider may update the Services but will not materially degrade core functionality during a paid term. Provider may suspend access for material security or legal risk, material breach of Section 4 or 6, or fees more than 15 days overdue after notice, limiting any suspension in scope and duration where practicable.

4. Payroll, tax, and payment services

4.1 Appointment and authorization. For the payroll and tax features Customer enables, Customer appoints Provider and its banking and processing partners as its agent to: (a) originate ACH debits from Customer's designated account and ACH credits to Customer's workers and to taxing authorities; (b) calculate, withhold, deposit, and remit applicable federal, state, and local payroll taxes; and (c) prepare and file related returns and reports (such as W-2s, 1099s, 941s, and new-hire reports). Customer will sign any further authorizations reasonably required (including tax authority reporting-agent authorizations).

4.2 Customer responsibilities. Customer is the employer of its workers and is solely responsible for employment decisions and for: the accuracy and completeness of Workforce Data, hours, wages, and tax elections; classifying workers correctly; reviewing and approving each payroll run and filing; and maintaining sufficient, available funds in its designated account to cover payroll, taxes, and fees by the deadlines Provider communicates.

4.3 Funds, deadlines, and reversals. Provider and its partners will move funds and file as authorized after Customer approval. Insufficient or late funding may delay or prevent payroll and tax payments. Reversals and corrections are possible only before applicable processing cutoffs (such as the ACH cutoff). Provider may decline or delay processing where there is a funding, fraud, or compliance concern.

4.4 Allocation of tax liability. Provider is responsible for penalties and interest that result solely from Provider's error in calculating, depositing, or filing taxes for amounts properly and timely funded by Customer. Customer is responsible for all other tax liabilities, penalties, and interest, including those arising from inaccurate data, misclassification, insufficient or late funding, or instructions Customer approves. Provider's responsibility under this Section is subject to Section 11.

4.5 Not a bank or advisor. Provider is a software and payroll-processing provider, not a bank, money transmitter for Customer's own account, or tax, legal, or accounting advisor. Customer remains responsible for its own compliance.

5. Fees and payment

5.1 Fees. Customer will pay the fees in each Order Form (typically per active employee, per month). Except as expressly stated, fees are non-cancelable and non-refundable.

5.2 Invoicing. Provider will invoice as stated in the Order Form; undisputed amounts are due within 30 days of the invoice date. Overdue amounts may accrue interest at the lesser of 1.5% per month or the maximum allowed by law. Provider may debit fees together with payroll funding where the Order Form authorizes.

5.3 Taxes. Fees exclude taxes; Customer is responsible for applicable taxes other than taxes on Provider's net income.

5.4 Changes. Provider may change fees effective on renewal, or during a term on at least 30 days' notice where the Order Form permits.

6. Data rights, privacy, and AI

6.1 Ownership. As between the parties, Customer owns Customer Data, including Workforce Data.

6.2 License to Provider. Customer grants Provider and its Affiliates and service providers a worldwide, non-exclusive, royalty-free right to host, store, process, transmit, and display Customer Data as needed to provide, secure, support, and improve the Services, operate Ember, and exercise Provider's rights and perform its obligations under this Agreement.

6.3 Privacy and processing. Provider acts as Customer's service provider/processor for Workforce Data and processes it on Customer's documented instructions and under the Privacy Policy and any DPA, which controls on data-protection matters. Customer is responsible for providing required notices to, and obtaining any required consents from, its workers.

6.4 De-Identified Data. Provider may create De-Identified Data from Customer Data and use of the Services. As between the parties, Provider owns all De-Identified Data and may use, retain, reproduce, modify, distribute, and otherwise exploit it for any lawful purpose — including operating, analyzing, securing, benchmarking, and improving the Services, developing new products and services, and the AI activities below — during and after the Term. Provider will not attempt to re-identify De-Identified Data except as permitted by law to validate de-identification and will require recipients not to re-identify it.

6.5 Usage Data and Feedback. Provider owns Usage Data and may use it to operate, secure, analyze, and improve the Services. Customer grants Provider a perpetual, irrevocable, royalty-free license to use Feedback without restriction.

6.6 Product improvement and AI models. Provider may use Customer Data, Usage Data, De-Identified Data, and Feedback to operate, secure, and improve the Services and to develop, train, evaluate, and improve analytical, statistical, and artificial-intelligence models and features, primarily using De-Identified Data. Provider does not permit third-party AI providers to use Customer Data to train their general-purpose models.

6.7 Corporate-group and partner sharing. Provider may share Customer Data, Usage Data, and De-Identified Data with its Affiliates and with service providers and partners as needed to provide, support, secure, and improve the Services, under confidentiality and use restrictions consistent with this Agreement. Sharing of De-Identified Data is not restricted by this Section.

6.8 Return and deletion. For 30 days after termination, Provider will make Customer Data available for export in a commercially reasonable format. Thereafter Provider may delete Customer Data in the ordinary course, subject to legal and payroll-recordkeeping requirements and except for De-Identified Data, Usage Data, and routine backups.

7. Intellectual property

Provider and its licensors own all rights in the Services, Hearth, Ember, and all related software, technology, and materials, including all improvements and the intellectual property in De-Identified Data, Usage Data, and models. Except for the limited rights expressly granted, no rights are granted by implication. Customer retains all rights in Customer Data.

8. Confidentiality

Each party will use the other's Confidential Information only to perform under this Agreement, protect it with at least reasonable care, and disclose it only to personnel, Affiliates, and service providers bound by confidentiality obligations at least as protective. Customer Data is Customer's Confidential Information. These obligations do not apply to information that is public through no fault of the recipient, independently developed, or rightfully received from a third party, and either party may disclose Confidential Information if legally compelled, with reasonable notice where allowed.

9. Security

Provider will maintain a written information security program with administrative, technical, and physical safeguards designed to protect Customer Data appropriate to its sensitivity, including encryption in transit and at rest, US-only data residency, access controls, and tamper-evident audit logging. Provider is pursuing SOC 2 Type 2 attestation and will make its then-current report available to Customer under confidentiality where the Order Form provides. The DPA, if signed, governs personal-information processing.

10. Warranties and disclaimer

10.1 Mutual. Each party warrants it has authority to enter into this Agreement.

10.2 Service warranty. Provider warrants that during the Subscription Term the Services will perform materially in accordance with the Documentation. Customer's exclusive remedy for breach is for Provider to use commercially reasonable efforts to correct the non-conformity and, failing that within a reasonable time, to refund prepaid fees for the affected period.

10.3 Disclaimer. Except as expressly stated, the Services are provided "AS IS," and Provider disclaims all other warranties, express or implied, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty that the Services will be uninterrupted or error-free. Provider does not warrant the results of any AI-assisted feature and does not provide legal, tax, accounting, or HR advice.

11. Limitation of liability

11.1 Exclusion. Neither party will be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, goodwill, or data.

11.2 Cap. Except for the Excluded Claims, each party's total liability arising out of or relating to this Agreement will not exceed the fees paid or payable by Customer in the 12 months before the event giving rise to the liability.

11.3 Excluded Claims. The cap does not apply to (a) Customer's payment and payroll/tax funding obligations; (b) a party's indemnification obligations; (c) Customer's breach of Section 4.2 or the acceptable-use and license restrictions; or (d) a party's fraud or willful misconduct.

12. Indemnification

12.1 By Provider. Provider will defend Customer against third-party claims that the Services, as provided and used in accordance with this Agreement, infringe a US intellectual-property right, and will indemnify Customer for amounts finally awarded or agreed in settlement. Provider may procure the right to continue use, modify the Services, or terminate the affected Services and refund prepaid unused fees. This states Provider's entire liability for IP infringement.

12.2 By Customer. Customer will defend and indemnify Provider and its Affiliates against third-party claims arising from Customer Data, Customer's employment decisions and obligations as employer, Customer's failure to fund payroll or taxes, or Customer's use of the Services in breach of this Agreement or law.

12.3 Procedure. The indemnified party will give prompt notice, reasonable cooperation, and control of the defense to the indemnifying party, which will not settle in a way that imposes liability or admission on the indemnified party without consent.

13. Term and termination

13.1 Term. This Agreement starts on the Effective Date and continues while any Order Form is in effect. Each Order Form's Subscription Term is stated in it and, unless stated otherwise, automatically renews for successive periods of equal length unless either party gives at least 30 days' notice of non-renewal.

13.2 For cause. Either party may terminate for the other's material breach uncured for 30 days after notice, or immediately on the other's insolvency or bankruptcy.

13.3 Effect and transition. On termination, Customer's right to use the Services ends and Customer will pay amounts accrued before termination. Provider will provide reasonable transition assistance for outstanding tax filings and year-end forms attributable to the period of service, as described in the Order Form or at Provider's then-current rates. Section 6.8 governs data return and deletion.

13.4 Survival. Sections 4.4, 5 (accrued amounts), 6.4–6.7, 7, 8, 10.3, 11, 12, 13.3–13.4, and 14 survive termination.

14. General

14.1 Governing law and venue. This Agreement is governed by the laws of the State of Montana, without regard to conflict-of-laws rules. The parties consent to the exclusive jurisdiction of the state and federal courts located in Flathead County, Montana.

14.2 Publicity. Provider may identify Customer as a customer using Customer's name and logo, subject to Customer's reasonable brand guidelines.

14.3 Assignment. Neither party may assign this Agreement without the other's consent, except to an Affiliate or in connection with a merger, acquisition, or sale of substantially all assets, on notice.

14.4 Subcontractors and Affiliates. Provider may use Affiliates and subcontractors to provide the Services and remains responsible for their performance.

14.5 Force majeure. Neither party is liable for delay or failure due to causes beyond its reasonable control.

14.6 Notices. Legal notices must be in writing to the contacts on the Order Form and to Provider at [email protected], with a copy by mail to PO Box 3135, Columbia Falls, MT 59912. Notice is effective on receipt.

14.7 Independent contractors. The parties are independent contractors; nothing creates a partnership, agency (except the limited payroll/tax agency in Section 4), or joint venture.

14.8 Entire agreement; amendment. This Agreement is the entire agreement on its subject matter and supersedes prior discussions. Except where this Agreement permits Provider to update terms or the Services, changes must be in a signed writing (an Order Form referencing this Agreement satisfies this for the items it covers).

14.9 Severability and waiver. If a provision is unenforceable, the rest remains in effect; a failure to enforce is not a waiver.

15. Contact

Lamplight Technology Consulting LLC (d/b/a Lamplight Software) — Hearth Email: [email protected] · [email protected] Mail: PO Box 3135, Columbia Falls, MT 59912 Phone: 877-642-6627