1. Parties, acceptance and start dates
This agreement is between Dominic Spinnato, an individual providing services under the Catch the Bait name ("Provider"), and the customer identified in the accepted Order Summary ("Client"). Catch the Bait is a service name; this agreement does not identify it as an LLC or corporation. Formation of a future entity does not automatically transfer this agreement or release Dominic from existing obligations. Any transfer requires written agreement with Client.
The Order Summary identifies Client's legal name, authorized representative, plan, prices, billing dates, service dates, contacts and approved case channels. A representative accepting for an organization confirms authority to bind it. Employees, residents and other authorized users are not automatically individual contracting parties. Client cannot waive an independent third party's rights.
Acceptance requires a signed Order Summary or an exchange of clear written or electronic assent that identifies this agreement's version and the completed Order Summary. Both parties receive a copy they can save and print. Browsing the site, sending a discovery request or making payment alone is not acceptance. These terms do not retroactively replace an existing client's agreement.
The agreement begins on acceptance. Billing begins on the agreed billing-start date. Case intake begins only after onboarding, acceptance, payment arrangements and approved contacts/channels are confirmed in writing. Provider will not charge subscription fees for a period before the agreed case-intake start date; an earlier collected subscription payment is credited to that period or refunded. If the parties do not accept an order, unused advance payments are refunded within 10 business days.
2. What the Scam Desk provides
The desk reviews suspicious messages supplied by authorized users and gives a reasoned opinion about warning signs, missing information and a practical next step. Examples include suspicious invoices, payment-change requests, vendor or executive impersonation, phishing, account-recovery messages and tech-support approaches. Guidance can be "Suspicious," "Verify first," "Insufficient evidence," or "No indicators in the material reviewed."
An outcome concerns only the material reviewed. It does not authenticate a sender, bank account, link, document, voice or video, or approve a payment. A "No indicators" response does not mean a message is safe. Client remains responsible for independent verification through previously known contact details, internal approvals and its decision to act or not act.
Onboarding includes one remote setup conversation of approximately 45 minutes, approved contacts and submission routes, client-specific checking rules ("House Rules") and a response sheet. Included education and reporting depend on the selected plan below. Scheduling is arranged with Client; an included session missed by Provider is rescheduled or its undelivered value credited by agreement.
When Client specifically authorizes it under sections 9 and 16, Provider may use the identified AI service to organize necessary business context, identify possible warning signs and prepare draft responses. Dominic Spinnato reviews the submitted material and the proposed assessment before a client response is sent. AI output can be inaccurate, incomplete or misleading; it is an aid to that review and does not expand the service into authentication, payment approval, monitoring or automated decision-making. Provider remains responsible for the service commitments in this agreement. Without that authorization, Provider uses a manual review process within the agreed scope and allowance, with no AI opt-out surcharge.
3. Plans and shared allowances
All prices are in U.S. dollars. A "month" for allowances means the subscription billing cycle, not the calendar month. Allowances are shared across the entire subscribing organization, including its authorized users. They reset on renewal and do not roll over, convert to cash or become separate allowances for every employee or resident.
Business Core: $149/month; up to 15 staff; 4 cases or 40 active review minutes per cycle, whichever is reached first. Includes House Rules and response sheet, a monthly staff lesson/handout and owner record, and a quarterly recorded refresher.
Business Plus: $249/month; up to 40 staff; 8 cases or 80 active review minutes per cycle, whichever is reached first. Includes Core materials, with a live quarterly Zoom refresher and new-hire orientation by arrangement. Orientation scope and scheduling must be confirmed; it is not unlimited individual coaching.
Community: $249/month; up to 500 households; 6 cases or 60 active review minutes per cycle, whichever is reached first. Includes office House Rules and response sheet, a monthly resident bulletin and board record, and a quarterly remote talk or recording, agreed at onboarding.
Community Plus: $399/month; up to 1,500 households; 12 cases or 120 active review minutes per cycle, whichever is reached first. Includes Community services, two additional Zoom talks per 12 months of continuous service, and a digital new-resident kit. Extra talks are scheduled at onboarding and not all due in the first month. No annual commitment is required.
Standard onboarding is a one-time $350 charge. An accepted founding offer for Business Core or Community is $99/month for the first three billing cycles, onboarding waived, then $149/month for Core or $249/month for Community from cycle four. Eligibility and exact renewal dates must appear in the Order Summary. The offer is limited to the first five accepted clients of each eligible plan and does not apply to Plus plans. No extra work, plan upgrade, additional seat charge or overage is automatic; a separate written scope and price require Client's approval first.
4. What counts as a case and as review time
One case is one suspicious request, transaction or incident reviewed for one Client. A forwarded email, its screenshot, related text messages and replies about the same invoice are one case. Several employees reporting the same incident are consolidated. A separate invoice transaction, unrelated sender/request or new incident is a new case. Provider will identify a proposed new case before starting work on it.
A case counts when substantive review begins, not merely when a message arrives. Duplicates, spam, billing/scheduling questions, unreviewed submissions and matters declined as outside scope consume neither a case nor review minutes. An assessment that finds insufficient evidence does count if substantive review occurred. Provider records the case identifier, date and time used and can explain the count on request.
Related follow-up received within five business days after the latest substantive reply remains the same case. After that, the case is closed; reopening requires notice and Client's agreement to count a new case before work begins. A case can also be closed earlier by agreement. A case crossing renewal is counted only in the cycle when its review began; review minutes are charged to the cycle in which the work occurs.
Active review time includes reading submitted material, assessing context, researching the particular warning signs, preparing advice and substantive follow-up on that case. Only actual active human work is counted; unattended AI processing or waiting is not separately charged as review time. Time is accumulated and rounded up once to the nearest whole minute per case per billing cycle, not separately for every message. Waiting for a reply, ordinary administration, onboarding, included education and standard monthly records do not use review minutes.
When either limit is reached, new case work pauses until renewal unless an additional written scope and price is approved. Provider will tell Client when the limit is approaching or reached and before any paid extra work. If the time limit is reached mid-case, Provider supplies findings so far and the unresolved questions or next verification step. A case allowance is not a promise to resolve an incident regardless of time. Timely related follow-up on an already counted case can continue while review minutes remain; no new case can begin after the case limit is reached.
5. Response window and availability
Service hours are 9 a.m. to 5 p.m., Monday through Friday, Eastern Time (America/New_York, including daylight-saving changes), excluding U.S. federal holidays on their observed dates. A "business day" in this agreement uses that calendar.
A complete, in-scope request received through an approved channel by 12 noon Eastern on a business day receives a substantive reply by 5 p.m. that same day. A request received after noon, on a weekend or on a holiday receives a reply by 5 p.m. the next business day. For example, Tuesday at 11:45 a.m. is due Tuesday at 5 p.m.; Friday at 1 p.m. is due Monday at 5 p.m., or Tuesday if Monday is an observed federal holiday. A request before 9 a.m. on a business day qualifies for that day's noon cutoff.
A substantive reply gives an assessment and next step, or identifies material missing information and an interim precaution. It is not necessarily a completed investigation or resolution. For incomplete requests, Provider identifies missing information by the ordinary reply deadline; the deadline for the resulting assessment runs from receipt of the information reasonably needed to review it. Provider cannot restart the clock merely by acknowledging or opening a complete request. New substantive follow-up follows the same cutoff.
This window applies to active, onboarded accounts within their available allowance. Provider acknowledges an exhausted allowance and explains options; it does not create free extra reviews. Public forms, social-media comments, unapproved personal messages and voicemail are not case-intake channels. Automated acknowledgments are not substantive replies.
Provider will give advance notice of planned unavailability and agree an alternative arrangement or a prorated credit for unavailable service days. Unexpected disruption is communicated as soon as reasonably possible; unprovided service time is credited on the same basis. A notice alone does not cancel the promised response window. An isolated missed deadline will be explained and addressed promptly; these credits do not guarantee reimbursement of a scam loss or waive nonwaivable rights.
The desk is not an emergency or 24/7 service. If money has moved, access may be compromised or harm is developing, contact the bank, payment provider, established IT provider, account support or emergency services as appropriate immediately. Do not wait for a desk reply.
6. Explicit exclusions and Client responsibilities
Excluded services include monitoring inboxes/accounts; filtering email; logging into systems; handling passwords or authentication codes; approving or executing payments; changing vendor records; identity, bank-ownership or deepfake authentication; penetration testing; malware removal; forensic investigation; incident containment or recovery; recovery of stolen money; legal, tax, investment, medical or insurance advice; compliance audits/certification; and acting as a managed IT or security department. Provider does not contact a suspected scammer or impersonate Client to investigate. An additional presentation or procedure project does not expand these boundaries unless explicitly agreed and appropriate.
Client supplies accurate, reasonably complete information, keeps an authorized contact current, informs users of the submission rules, and maintains its own banking controls, account security, backups, IT support, legal obligations and reporting procedures. Client decides whether and how to use advice and must not describe the desk's response as an authorization to pay. Provider may decline unsafe attachments, prohibited information or work outside competence, explaining an appropriate referral or next step when possible.
7. Advice, no guarantee and allocation of risk
PROVIDER GIVES AN ADVISORY OPINION, NOT A GUARANTEE OF AUTHENTICITY, SAFETY OR FRAUD PREVENTION. Scams change; genuine messages can look suspicious, and fraudulent messages can appear genuine. Incomplete, altered or withheld context may change an assessment. Provider does not promise to catch every scam, prevent a loss or ensure an employee follows a procedure.
Client controls its decisions and actions. To the fullest extent permitted by law, Client releases Provider from claims for financial or other loss caused by a scam, an undetected scam, or Client's reliance on or decision to follow or disregard desk advice, INCLUDING CLAIMS ARISING FROM PROVIDER'S ORDINARY NEGLIGENCE IN ASSESSING SUBMITTED MATERIAL OR GIVING THAT ADVICE. This limited release is intended to allocate those advisory risks; it does not release gross negligence, willful misconduct, fraud, nonwaivable statutory duties or liability that law does not permit to be released. It does not purport to release independent claims of nonparties.
Provider remains responsible for the express service commitments in this agreement, subject to its lawful limitations. Nothing here makes an unlawful term enforceable or eliminates a right or remedy that cannot legally be waived.
8. Limitation of liability
TO THE FULLEST EXTENT PERMITTED BY LAW, PROVIDER'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING FROM THIS AGREEMENT OR THE SERVICES IS LIMITED TO THE FEES CLIENT ACTUALLY PAID PROVIDER UNDER THE AFFECTED ORDER DURING THE THREE MONTHS IMMEDIATELY BEFORE THE FIRST EVENT GIVING RISE TO THE CLAIMS. This includes an onboarding fee paid within that period. If service has run for less than three months, the cap is all fees actually paid under that order to that point. For an event first occurring after termination, use fees paid for the final three months of service. Related acts and claims are treated as one series beginning with its first event; the cap is not multiplied by case, user or legal theory.
Subject to the same legal limits, neither party is liable to the other for indirect, special, consequential, exemplary or punitive damages, or lost profits, lost revenue, lost business opportunities or reputational harm arising from the service, even if advised that such losses were possible. This does not excuse Client's agreed payment obligations.
The release, cap and damage exclusions do not apply to fraud, willful misconduct, gross negligence or liability that cannot lawfully be limited, and do not cap refunds or credits expressly owed under this agreement. They do not excuse legally required security, breach-notification or disposal duties. Sections 7 and 8 are material pricing and risk-allocation terms; their enforceability depends on applicable law and the circumstances.
9. Confidentiality and permitted handling
Each party will protect nonpublic information received from the other with reasonable care and use it only to provide/receive the service, administer the relationship, comply with law or establish/defend legal rights. Access is limited to people and service providers with a legitimate need and appropriate confidentiality obligations or applicable service terms. Exclusions are information already lawfully known, independently developed, lawfully received without a duty of confidence, or public through no breach. Legally compelled disclosure is limited to what is required, with advance notice when legally permitted.
Provider will not publish Client's cases, screenshots, name, logo, testimonial or identifiable customer/resident details without separate permission. General lessons can be reused only after removing information that could reasonably identify the people or organization. AI processing is a separate choice, not permission for publicity or model training.
Provider may submit Client's nonpublic business context and minimized case content to an AI service only after the authorized representative specifically agrees in writing to the completed AI Disclosure and Choice in section 16, or an equivalent mutually accepted disclosure identifying the provider, product/workspace, purpose, data categories and material retention/access limits. A blank choice, payment, ordinary service acceptance or a forwarded case is not AI authorization. Only the named approved environment may be used. The standard proposed environment is OpenAI ChatGPT Business in Provider's dedicated business workspace; it is not represented as activated or authorized merely because it appears in this agreement. Personal/consumer accounts, other providers, or materially different handling require a new specific written authorization before use.
Provider will not use Client information to train or fine-tune an AI model, opt into provider model-training programs for it, or submit it through optional product-feedback channels. Provider must confirm that the selected product and settings support this restriction before any upload. Only the necessary approved profile, checking rules and redacted case material are supplied; passwords, codes and other prohibited information in section 10 are excluded. Provider restricts access, avoids public sharing, keeps customers' operational records separate, and does not intentionally enable cross-client memory or broad connected-account searches for case work. These controls reduce exposure; AI and project organization do not guarantee accuracy or absolute isolation.
Client may decline AI or withdraw authorization at any time by written notice to desk@catchthebait.com. Provider stops new AI submissions and processing for Client upon receipt, acknowledges within five business days, and continues manual review within the existing scope, allowance and response window without a surcharge. Withdrawal does not itself cancel the subscription or reverse processing already completed. Provider removes the Client's working information from controlled active AI locations within 30 calendar days of receipt, subject to the limited legal-hold and processor-residual rules in section 10. Information still needed to provide the manual service may remain in approved non-AI working storage under the ordinary retention rules. Changing the service itself requires mutual written agreement or the termination procedure; withdrawal alone does not authorize a price or scope change.
Community case details are private by default. Board/manager records use de-identified themes and usage totals; identifiable resident sharing requires the resident's permission or another lawful basis such as a legal obligation. Client's subscription does not grant unrestricted access to another person's correspondence. Confidentiality survives termination for as long as the information remains nonpublic.
10. Personal information, security and deletion
Client may forward information about employees, residents, vendors or customers. Client is responsible for having authority and a lawful basis to disclose it, for giving required notices, and for minimizing/redacting it. Send only what is needed: remove unnecessary names, addresses, account details and private attachments. Do not send passwords, one-time codes, full payment-card/bank numbers, Social Security numbers, identity documents, health records or other highly sensitive files. This service is not a regulated health-record repository or secure document vault. These instructions do not remove Provider's duties if sensitive information is nevertheless received.
Provider will use reasonable administrative and technical safeguards appropriate to this service, including restricted account/device access, multifactor authentication on service email and administration accounts where available, and protected devices. Ordinary email cannot be guaranteed end-to-end confidential. The current delivery chain uses Cloudflare to forward desk@catchthebait.com to Dominic's Gmail; replies may come from dominicspinn@gmail.com. Stripe processes payments and keeps payment-card data outside the website. Zoom is used for agreed remote sessions; sessions are not recorded without participants' advance agreement. If authorized under section 16, the identified AI provider also processes the minimum information supplied to it. The signed disclosure identifies the actual environment and relevant privacy information. These providers process information under their applicable terms; authorization to use one does not authorize unrelated connected apps. Provider does not sell submitted personal information.
Raw case messages, screenshots, attachments, AI inputs/outputs, case-specific chats, drafts and working copies are deleted from Provider-controlled active email, sent folders, downloads and other working storage, including applicable AI conversations, separate file libraries, project attachments, exports and local copies within 30 calendar days after the case closes, or within 30 days of an earlier verified deletion request or service termination, unless a documented legal hold or legal requirement applies. Provider empties controlled trash/deleted-item storage as part of that process. A case normally closes five business days after the last substantive reply, as described in section 4. Client should retain its own originals and any advice it needs before deletion. Deleting or archiving one chat is not treated as deletion of separately stored files, saved memories or other working copies; Provider checks the applicable locations and removes inadvertently retained case material from them.
Current Client Profiles, trusted work-contact details and House Rules are maintained only as needed to provide the service, corrected when approved changes are received, and removed from controlled active working storage within 30 calendar days of service termination or an earlier verified deletion request, subject to documented legal requirements. Superseded working copies are removed within 30 days after replacement unless a limited documented need applies. Case narratives are not retained indefinitely by copying them into a profile or monthly record. The separate AI-withdrawal rule in section 9 applies even while manual service continues.
Minimal administrative case records (case ID, organization/account identifier, dates, time used and a non-sensitive outcome category, without source content or unnecessary individual identifiers) are retained for up to 12 months after case closure for service administration. Accepted agreements, AI choices/withdrawals, invoices, payment/refund records and notices may identify the contracting parties and are retained for up to seven years after the relationship ends for accounting and legitimate legal-record needs; this is a retention policy, not a claim that every record legally requires seven years. Unconverted discovery/call-request details are deleted after 90 days without an active conversation unless the person agrees otherwise.
Provider cannot delete copies held by Client, recipients outside Provider's control, or a processor's inaccessible backup immediately. AI service deletion is a request through the product's available controls; Provider does not promise instant erasure from all provider systems or zero data retention. Processor residual copies, including inaccessible backups and hosted execution snapshots where applicable, follow the processor's published deletion cycles and lawful security/retention exceptions; they are not intentionally restored for ordinary use. If controlled data is restored, the deletion is reapplied. Legal holds retain only what is reasonably necessary with restricted access, and end when the reason ends. Required retention and known limits will be explained on request when permitted by law.
For access, correction, a copy or deletion, contact desk@catchthebait.com. Provider will verify authority using proportionate information, acknowledge within five business days, and respond within 30 calendar days unless a shorter legal deadline applies. Requests do not require new sensitive identity documents by default. Records may be withheld only for a lawful reason, explained where permitted.
Provider will notify Client of a suspected or confirmed security incident affecting its submitted information without unreasonable delay as facts become available, cooperate with reasonable response efforts and preserve necessary evidence. Where Provider is a third-party agent under Florida Statutes section 501.171, notice to the covered entity will be made as expeditiously as practicable and no later than 10 days after determining, or having reason to believe, a covered breach occurred; any shorter applicable legal deadline controls. Client retains its own legal notification duties. Neither party may delay a mandatory notice pending the other's permission.
11. Payment, onboarding and failed charges
Subscription fees are billed monthly in advance through the payment method Client authorizes. The Order Summary states the billing date, monthly price, introductory period, later price and any applicable taxes disclosed before acceptance. A card processor may retry an authorized failed charge; Provider will not add an unapproved product or charge an automatic case overage. Price increases require at least 30 days' written notice and Client's affirmative acceptance; silence is not consent to an increase.
The $350 onboarding fee, when applicable, pays for reserved setup time and client-specific preparation. It is non-refundable once the order is accepted and Provider has reserved the setup appointment or begun preparation, even if Client later cancels. It is not charged for a waived founding order. If Provider declines the order, cannot supply onboarding, or no reservation/preparation has begun, an advance onboarding payment is refunded within 10 business days. Mandatory refund rights still apply. Unused case capacity is not refundable merely because Client did not use it.
After a failed payment, Provider sends written notice identifying the amount and a secure way to update payment. Client has seven calendar days from that notice to cure; normal service continues within the plan allowance during that grace period. If unpaid after seven days, Provider may pause service after notifying Client. If still unpaid 14 days after the first notice, Provider may terminate for nonpayment. No late fee or penalty interest is added under this agreement.
Subscription fees do not accrue for days of a payment suspension; Provider reconciles any full charge or invoice to credit those days and stops future recurring charges while suspended. Fees for service made available before suspension remain due. Restarting requires confirmation of payment, the start date and an updated billing period; no retroactive charge is made for unavailable days. Provider administers these adjustments; the Stripe portal is not represented as automatically applying every rule here.
12. Monthly term, cancellation and termination
The service renews month to month. Either party may end it without cause on 30 calendar days' written notice to the other's designated email. Client can give notice to desk@catchthebait.com at any time; a phone request is effective when confirmed in writing. Notice is effective on receipt, not on Provider's later acknowledgment. Provider will acknowledge the end date within two business days. Keep a copy and follow up by phone if delivery fails.
Service continues through the effective termination date while payments are current. The final partial billing period is prorated by calendar days at that period's applicable monthly rate. A full automated renewal collected during the notice period is adjusted so Client pays only through the termination date; any excess is refunded within 10 business days after that date. No additional full month is owed solely because the notice overlaps a renewal. For example, if a $149 monthly period has 30 days and service ends after 10 of those days, that period costs $49.67.
If the customer portal confirms an earlier cancellation date, Provider honors that earlier date and waives the remaining notice requirement. The confirmation governs whether service ends immediately or at the paid-period end; unused days after an immediate end are reconciled under the same proration rule. Provider's own without-cause cancellation also refunds unused prepaid service. Non-refundable onboarding is addressed separately in section 11.
Either party may terminate for a material breach not cured within 10 calendar days after written notice describing it. Nonpayment uses section 11 instead. Provider may immediately pause unsafe/illegal submissions or abusive conduct and may terminate for serious illegality, threats or an incurable material breach, giving written reasons when lawful. Unearned subscription fees are reconciled; this is not a right to retain unearned fees as a penalty. Confidentiality, privacy/retention, accrued payment obligations, IP rights and lawful liability limits survive as applicable.
13. Independent contractor and materials
Provider is an independent contractor, not Client's employee, agent, fiduciary, IT department, managed service provider, insurer or payment approver. Provider controls the manner of performing the agreed service, handles Provider's own business expenses and taxes, and has no authority to bind Client or act in its accounts. The arrangement is nonexclusive.
Client retains rights in its submitted material. Provider retains ownership of pre-existing and general educational materials, methods and templates. Upon payment, Client receives a nonexclusive license to use delivered guidance and materials internally with its authorized staff or residents, including after cancellation, but not to resell them or claim authorship. Public guides remain subject to their published availability. This license does not authorize disclosure of another person's confidential information or imply that old advice stays current indefinitely.
14. Notices, disputes and complete agreement
Service, billing, privacy and cancellation notices go to desk@catchthebait.com for Provider and the Client contact in the Order Summary. Each party keeps its address current. Telephone assistance is available at (941) 529-7863, but a phone discussion does not change contract terms without written confirmation.
Florida law governs, subject to mandatory law that cannot be displaced. The parties will first attempt in good faith to resolve a dispute through their designated contacts for up to 30 days, without delaying urgent relief, required notices or legal filing deadlines. An unresolved dispute may be brought in a court with proper jurisdiction and venue in Florida, subject to mandatory venue rights. This agreement does not require arbitration or waive a jury trial.
The accepted Order Summary, completed AI Disclosure and Choice if any, and this identified version form the entire service agreement. A specifically identified, mutually accepted written variation in the Order Summary controls over a conflicting general term; a liability/privacy change must expressly identify the provision changed. Marketing pages do not override the accepted agreement. Material changes require advance written notice and mutual acceptance, not merely a website update. If a provision is unenforceable, the remainder continues to the extent lawful; a court may limit an overbroad provision only as law permits. Failure to enforce a provision once does not waive it permanently.
15. Client Order Summary and acceptance
Complete this summary before service starts. A completed, separately saved summary or equivalent written order must accompany this version. Blank lines are not permission to charge or to begin case intake.
Provider: Dominic Spinnato, operating under the Catch the Bait name. Contact: desk@catchthebait.com | (941) 529-7863.
Client legal name and billing address:
Authorized representative, title and email:
Billing contact/email (if different):
Plan, staff/household size and shared case/minute allowance:
Monthly price; onboarding fee or waiver; disclosed taxes:
Introductory price/cycles; standard renewal price and first full-price date:
Acceptance date; onboarding date; case-intake and billing-start dates:
Monthly renewal date; included session format/schedule:
Approved case channels and authorized users/contact list:
Designated billing, privacy and cancellation contact:
Any specifically agreed variations/additional services and prices:
AI Disclosure and Choice completed / authorization record reference, or manual review:
Agreement incorporated: CTB-SA-2026-09-24 v1.1, including sections 7 and 8 (advisory risk, release and liability limits), sections 9, 10 and 16 (AI choice and information handling) and sections 11-12 (recurring payments and cancellation). Each signer confirms authority, has received a retainable copy, and accepts the completed Order Summary and this agreement. No signature is supplied by the website.
Client authorized signature / printed name / date:
Provider signature / date:
16. AI Disclosure and Choice
Complete this section before any nonpublic Client information enters an AI service, including onboarding context. It is part of the identified agreement only when completed and accepted. Signing the general Order Summary alone does not select YES. Client retains a copy. Neither choice grants permission for model training, publicity, payment approval or automated customer replies.
Client legal name / client ID:
Approved AI provider and product:
Workspace name or identifier / account type:
Purpose: help organize necessary business context, assess supplied warning signs and draft advisory replies for Dominic's review. Permitted data: minimum business profile, work-contact/verification procedures, redacted suspicious messages or screenshots, relevant case facts, prompts and drafts. Exclusions in section 10 still apply. Client confirms authority and required notices or lawful basis for the information it supplies; this choice cannot waive another person's independent rights.
Access and controls: Provider limits access to Dominic and specifically authorized service personnel, restricts sharing and connected tools, and does not opt into model training or feedback use of Client material. The named AI service and its authorized personnel/subprocessors may process information under its applicable service/privacy terms. The service is not an exclusively local or offline analysis system. No particular country-only processing, zero-retention arrangement or regulatory certification is promised unless separately documented and agreed.
Privacy and retention disclosure supplied to Client / version or date:
For the proposed OpenAI ChatGPT Business environment, the current workspace security and retention explanation is available at https://learn.chatgpt.com/docs/enterprise/chatgpt-work-cloud-security . Business data is not used for model training by default; Provider must keep any opt-in disabled. Product controls and terms must be checked for the actual environment before use. Client can request a retainable copy of the relevant disclosure. A change of provider, personal/consumer account use or materially changed purpose/handling requires new written authorization.
Retention: Provider deletes controlled active case records, including relevant AI chats/files and drafts, within 30 calendar days after closure or an earlier verified deletion request/service end, subject to section 10. Current operating profiles remain while needed for service and are removed within 30 days of termination/earlier verified request. On AI withdrawal, controlled active Client AI information is removed within 30 days even if manual service continues. AI-provider residual copies can persist beyond Provider's deletion action under published deletion cycles and lawful exceptions; conversation deletion alone may not remove separate files, memories or execution records. Provider checks each controlled location. Accepted consent/withdrawal records are stored separately for up to seven years after the relationship ends.
Choose exactly one and initial it. If neither or both are selected, AI use is not authorized until clarified in writing.
[ ] YES. I specifically authorize the described AI processing in the completed environment, subject to this agreement. Client initials:
[ ] NO. Use manual review without submitting our nonpublic business or case information to AI. Client initials:
Withdrawal: email desk@catchthebait.com at any time. New AI processing stops on receipt. Manual service continues under the same scope, allowance and response window without an opt-out surcharge; withdrawal alone does not cancel the subscription. See sections 9 and 10 for deletion and limited exceptions.
Client authorized name / role / signature / date:
Provider name / signature / date:
Provider activation record: actual workspace and no-training setting verified; access, memory, connectors and deletion locations checked by / date:
Activation requires both specific Client authorization and completed Provider checks. Do not upload Client information while either is missing.