COVU OS Lite — Existing Tenant Acceptance and Data Processing Confirmation
This Confirmation is between COVU Inc., a Delaware corporation (“COVU”), and the insurance agency identified below (the “Agency”). It documents the Agency's acceptance of the agreements governing its use of COVU OS Lite, including for the period before this Confirmation was accepted.
- Agency legal name: [AGENCY LEGAL NAME]
- State of organization / business address: [STATE] / [ADDRESS]
- COVU Agency account ID: [AGENCY ID]
- Accepting owner or administrator: [NAME / TITLE / BUSINESS EMAIL]
- Coverage Start Date (Section 3): [EARLIER OF FIRST ACCESS OR FIRST DATA SUBMISSION]
- Documents accepted (title, version, hash): [TERMS / DPA / SECURITY EXHIBIT - VERSION + SHA-256]
- Privacy Notice acknowledged (version, hash): [VERSION + SHA-256]
- Acceptance date: [DATE]
1. Background
The Agency has been using OS Lite and has submitted or connected Agency Customer Data. COVU has processed that data to provide OS Lite to the Agency. No acceptance of the OS Lite Terms of Service by or for the Agency was recorded. The parties are documenting the terms that governed and will govern that use and processing.
2. Acceptance
The Agency, through the authorized owner or administrator identified above, accepts on the Agency's behalf:
- the OS Lite Terms of Service (the “Terms”) at the version identified above;
- the Data Processing Addendum (the “DPA”) and the Security Exhibit, each incorporated through the Terms; and
- acknowledges the OS Lite Privacy Notice.
The individual accepting also accepts the individual User obligations in the Terms — account security, acceptable use, human review of AI-assisted output, and electronic records. Every other User of the Agency's account accepts those individual obligations separately.
3. Period covered
The Terms, DPA, and Security Exhibit apply to the Agency's use of OS Lite and to COVU's processing of Agency Customer Data from the Coverage Start Date identified above, and continue until terminated under the Terms.
The Agency confirms that COVU's processing of Agency Customer Data between the Coverage Start Date and the acceptance date was performed at the Agency's direction and for the Agency's benefit, and the Agency ratifies and adopts that processing as processing under the DPA, as if the DPA had been in effect from the Coverage Start Date. Nothing in this Section creates an obligation the Agency did not have, or waives any right the Agency holds under applicable law.
> Counsel gate. The reach-back in this Section documents and ratifies past processing. It does not itself establish that past processing complied with applicable law, and it does not waive any statutory right of any individual. Counsel must assess, for each tenant, whether any notification, remediation, or regulator-facing step is required independently of this Confirmation, and whether a countersigned instrument should be required instead of clickwrap for the reach-back to be effective.
4. Agency confirmations
For Agency Customer Data already submitted and for data submitted going forward, the Agency confirms that it:
- is the business or controller of that data and COVU is its service provider or processor;
- had and has the rights, notices, consents, and permissions required to submit that data and to connect the systems it connected, including under applicable insurance-privacy, GLBA, and state privacy law;
- gave and will give lawful instructions; and
- retains its own recordkeeping, notice, and supervision obligations.
5. COVU confirmations
For the period from the Coverage Start Date, COVU confirms that it:
- processed Agency Customer Data only to provide, secure, support, administer, and improve OS Lite for the Agency, on the Agency's instructions, and as required by law;
- did not sell that data, or share it for cross-context behavioral advertising;
- did not use identifiable Agency Data or Agency confidential content to train a general or cross-customer AI model;
- limited access to personnel and providers with a need to know, under confidentiality obligations; and
- will honor the DPA in full going forward, including the deletion and return terms and the security-incident notification commitments.
6. What this Confirmation does not do
Accepting this Confirmation does not:
- create any charge, subscription, fee, or payment obligation, or capture a payment method;
- enable any paid Additional Module, which requires a separate Module Order and payment authorization;
- enable Service Network work, which requires the Service Network Services Agreement and a Service Order before the first task;
- authorize a sensitive connection such as Gmail, Outlook, attachment review, or messaging, each of which requires a separate Feature-Specific Consent; or
- authorize any act requiring an insurance license, or transfer the Agency's customers, book of business, carrier relationships, or producer authority.
7. Deletion and return
The DPA governs return and deletion. The Agency may request deletion or return of Agency Customer Data at any time through the in-product request control or by emailing dataprotection@covu.com. COVU will apply the verified process and period stated in the then-published DPA and deletion disclosure. This Confirmation does not independently promise a fixed active-system or backup-expiry period. No fixed period may be inserted or relied upon until ALI-649 is accepted and licensed counsel approves the retained-record categories.
8. Disputes; fresh opt-out
The governing-law, arbitration, class-waiver, and jury-waiver provisions of the Terms apply. Because these dispute terms are new to the Agency, the Agency and each of its Users may opt out of the arbitration provision within thirty (30) days after accepting this Confirmation, using the in-product opt-out control or by emailing hello@covu.com. COVU will confirm receipt in writing.
9. Acceptance
> I represent that I am a current owner or administrator authorized to bind [AGENCY LEGAL NAME]. On the Agency's behalf I accept the OS Lite Terms of Service, the Data Processing Addendum, and the Security Exhibit at the versions shown, acknowledge the Privacy Notice, and confirm the matters in Sections 3 and 4 — including that these agreements apply from the Coverage Start Date shown above. I understand that this does not create any charge and does not enable any paid module, Service Network work, or sensitive connection.
Required checkbox (not preselected):
> I am authorized to accept these documents for the Agency, and I confirm the coverage period shown.
Button:
> Accept and continue
Where counsel requires a countersigned instrument rather than clickwrap:
COVU INC. — By: __________________ Name: Ali Safavi Title: Chief Executive Officer Date: __________
[AGENCY LEGAL NAME] — By: __________________ Name: __________ Title: __________ Date: __________
10. Record
COVU will preserve in the agreement ledger: the Agency legal name and account ID; the accepter's identity, title, email, User ID, role, and authority representation; each document title, version, effective date, immutable URL, and SHA-256; the Coverage Start Date and the basis for it; the exact disclosure, checkbox, and button text displayed; UTC timestamp and acceptance event ID; the opt-out window and any opt-out received; and a downloadable copy delivered to the Agency account and the administrator email of record. IP address and user-agent/device evidence may be retained only under the Security- and Privacy-approved evidence-retention policy.
*Attorney-reviewable first draft; not legal advice. Licensed counsel must clear Section 3, determine whether click-through is sufficient or countersignature is required for each affected tenant, and assess any independent notice, remediation, or regulatory obligation before first use.*