Customer Agreement

Online order terms

These terms are the Order Form for customers who sign up and pay online at fieldpaysheet.com. They take the place of a signed Order Form, and the Master Subscription Agreement below governs them. Where they differ from the Agreement, these terms win.

Master Subscription Agreement

This Master Subscription Agreement (“Agreement”) is between Duran Technology LLC, an Ohio limited liability company (“Provider”), and the customer named on the Order Form (“Customer”). It takes effect on the date the first Order Form is signed (“Effective Date”).

1. Definitions

• Service means PaySheet, the hosted software at fieldpaysheet.com and its subdomains, including the web app, mobile web app, company admin site, API, emails and PDF invoices it produces, and related documentation.
• Order Form means an ordering document signed by both parties that references this Agreement.
• Users means Customer’s employees and contractors whom Customer allows to log in to the Service.
• Customer Data means data Customer or its Users put into the Service, including pay sheets, job records, pay items, prices, photos, PDFs, employee names and contact details, and billing contacts.
• Subscription Term means the period stated on the Order Form, including renewals.
• API Key means a secret code that Customer’s admins create in the Service so that Customer’s own systems can connect to the Service’s API.

2. The Service

2.1 Access. During the Subscription Term, Provider grants Customer a non-exclusive, non-transferable right for its Users to access and use the Service for Customer’s internal business purposes, within the limits on the Order Form.

2.2 Users and accounts. Customer is responsible for its Users, for keeping logins and two-factor codes confidential, and for anything done under its accounts. Customer will tell Provider promptly of any unauthorized use. Accounts may not be shared between people.

2.3 Changes. Provider may improve and change the Service. Provider will not materially reduce the core functions of the Service (recording pay sheets, attaching photos, approvals, and billing exports or emails) during a paid Subscription Term.

2.4 Restrictions. Customer will not (a) resell, sublicense or provide the Service to third parties other than its Users; (b) copy, modify or reverse engineer the Service, except as law allows; (c) use the Service to build a competing product; (d) get around security, usage limits or access controls; or (e) break the Acceptable Use Policy.

2.5 Support. Provider provides support as described in the Service Level Agreement.

2.6 Devices. Customer is responsible for the phones, tablets and computers its Users use with the Service. A pay sheet saved on a device while it has no signal stays on that device, visible only to the User who made it, until it is sent. A pay sheet that is not sent before a device is lost, reset or logged out may be lost.

2.7 Company admin site access. Customer’s company admin site opens only as chosen on the Order Form: from the office networks Customer lists, or from any network with two-factor codes required for every admin. For security reasons only Provider changes this setting, and only on a written request from an admin named on the Order Form that Provider confirms by calling that admin at the phone number on file.

2.8 API Keys. Customer’s admins may create API Keys. A read key can read Customer’s approved pay sheets. A job key can only add new jobs, never change existing ones, and works only from the network addresses Customer lists for it. Each key is shown once, when it is made, and Provider keeps only a scrambled copy that cannot be turned back into the key. Customer is responsible for keeping its keys secret, for everything done with them, and for data once its own systems have received it. When creating a key, Customer accepts the risk that anyone who holds the key can use it this way until it is revoked. Customer may revoke a key at any time. Customer may limit any key, including a read key, to network addresses it lists, and Provider recommends doing so for read keys. Provider may limit how often a key is used, and may suspend a key it believes is exposed or misused, telling Customer promptly.

2.9 Trials and demos. Provider may offer a free trial or a demo company before an Order Form is signed. By creating a trial or demo, Customer accepts this Agreement, and Sections 4 and 5 and the Data Processing Addendum apply to any data entered during it. Trials and demos are provided “as is”, without the Service Level Agreement or the warranty in Section 7.2, and Provider may end them at any time. A demo company holds sample data, closes after 7 days and is deleted 30 days after it closes; Customer should not put real data in it. If a trial does not become a paid subscription, Provider may delete its data 30 days after the trial ends.

3. Fees and payment

3.1 Fees. Customer will pay the fees on the Order Form. Unless the Order Form says otherwise, fees are billed monthly in advance, in US dollars, and are due 30 days from the invoice date.

3.2 User counts. If Customer has more active Users in a month than its Order Form includes, Provider may invoice the difference at the rates on the Order Form for the rest of the billing period.

3.3 Late payment. Overdue amounts accrue interest at 1.0% per month, unless the law requires a lower rate. If an amount is more than 15 days overdue, Provider may suspend the Service after giving 10 days’ notice. Suspension does not delete Customer Data.

3.4 Taxes. Fees do not include taxes. Customer pays any sales, use or similar taxes on its purchases, except taxes on Provider’s income.

3.5 Price changes. Provider may change fees for a renewal term by giving at least 60 days’ notice before the renewal date.

3.6 No refunds. Fees are non-refundable except as stated in Sections 7.2, 8.3 and 10.3, Section 3 of the Data Processing Addendum, and the Service Level Agreement.

4. Customer Data

4.1 Ownership. Customer owns Customer Data. Customer grants Provider a limited right to host, copy, process and display Customer Data only to provide, secure and support the Service and as Customer directs.

4.2 Customer responsibilities. Customer is responsible for the accuracy of Customer Data and for having the rights and notices needed to put it in the Service, including notices to its employees about photos and work records.

4.3 Pay and billing results. The Service records work and produces totals, exports and invoices from the items, quantities and prices Customer enters. Customer is responsible for reviewing approved pay sheets, payroll, wage-and-hour compliance and invoices before relying on them. The Service is not a payroll provider and does not calculate taxes or withholding.

4.4 Security. Provider will keep reasonable administrative, technical and physical safeguards for Customer Data, as described in the Data Processing Addendum. These include encryption in transit, two-factor login, separate data per company, limits on where admin sites can be opened, and backups.

4.5 Aggregate data. Provider may use de-identified, aggregated data about use of the Service to run and improve it, if that data does not identify Customer, its Users, or its customers.

4.6 Export and deletion. During the Subscription Term, Customer may export its data using the Service’s CSV, Excel and PDF exports, photo downloads and API. For 30 days after termination, Provider will provide an export on request. Provider will delete Customer Data from the live Service within 90 days after termination. Backups are overwritten on a rolling cycle, and Customer Data will be gone from all backups within 90 days after termination.

5. Confidentiality

Each party will keep the other’s non-public information confidential, use it only for this Agreement, and share it only with people who need it and are bound by similar duties. This does not cover information that is public, already known, independently developed, or rightfully received from someone else. A party may disclose information when required by law after giving the other party notice where allowed. If Provider receives a legal demand for Customer Data, it will tell Customer within 30 days unless the law forbids it. Customer Data is Customer’s confidential information.

6. Intellectual property

Provider owns the Service, its software, design, and documentation, and all improvements. Customer owns Customer Data and its logos. Customer allows Provider to show its logo in the Service for Customer’s own Users. If Customer gives suggestions, Provider may use them without obligation.

7. Warranties

7.1 Mutual. Each party has the authority to enter into this Agreement.

7.2 Provider. Provider warrants that the Service will perform materially as described in its documentation. If it does not, Customer must tell Provider in writing. Provider will try to fix it, and if Provider cannot fix it within 30 days, Customer may end the affected Order Form and get a refund of prepaid fees for the unused period. This is Customer’s only remedy for breach of this warranty.

7.3 Disclaimer. Except as stated in this Agreement, the Service is provided “as is.” Provider disclaims all other warranties, including merchantability, fitness for a particular purpose and non-infringement. Provider does not warrant that the Service will be uninterrupted or error-free.

8. Indemnification

8.1 By Provider. Provider will defend Customer against a third-party claim that the Service, as provided, infringes a US patent, copyright or trademark, and pay any resulting award or approved settlement.

8.2 By Customer. Customer will defend Provider against a third-party claim arising from Customer Data, from Customer’s breach of the Acceptable Use Policy, or from Customer’s pay, employment or billing decisions, and pay any resulting award or approved settlement.

8.3 Process and remedies. The party seeking defense must give prompt notice, let the other party control the defense, and cooperate. If the Service is or may be infringing, Provider may modify it, get a license, or end the Order Form and refund prepaid fees for the unused period. Section 8.1 does not apply to claims caused by Customer Data, Customer’s changes, or combinations Provider did not provide.

9. Limitation of liability

9.1 Cap. Each party’s total liability under this Agreement is limited to the fees Customer paid or owes in the 12 months before the event giving rise to the claim.

9.2 Excluded damages. Neither party is liable for lost profits, lost revenue, lost data beyond restoring from backups, or indirect, special, incidental or consequential damages, even if told they were possible.

9.3 Exceptions. The cap and exclusions do not apply to Customer’s payment obligations, either party’s indemnity obligations, or a party’s gross negligence, fraud or willful misconduct.

10. Term and termination

10.1 Term. This Agreement lasts while any Order Form is in effect. Each Order Form has an initial term of 12 months, unless it says otherwise, starting on its Start date. It then renews automatically for further 12-month terms unless either party gives written notice of non-renewal at least 30 days before the end of the current term. The Service then ends at the end of that term.

10.2 For breach. Either party may terminate this Agreement or an Order Form if the other party materially breaches it and does not cure the breach within 30 days of written notice.

10.3 Effect. On termination, Customer’s access ends and unpaid fees for the period before termination become due. If Customer terminates for Provider’s breach, Provider refunds prepaid fees for the unused period. Sections 3, 4.6, 5, 6, 8, 9, 10.3, 10.4 and 11 survive.

10.4 Early cancellation. Each term is a commitment for the whole term, even when fees are billed monthly. If Customer ends an Order Form or stops using the Service before the end of a term, other than under Section 7.2, 8.3 or 10.2, Section 3 of the Data Processing Addendum, or the Service Level Agreement, the fees for the rest of that term remain due and Provider may invoice them at once.

11. General

11.1 Governing law. This Agreement is governed by the laws of the State of Ohio, without regard to conflict-of-laws rules. The courts in Fairfield County, Ohio have exclusive jurisdiction.

11.2 Notices. Notices must be in writing and sent by email to the addresses on the Order Form. Provider’s notice address is contact@fieldpaysheet.com. Provider’s postal address, for anything that must go by mail, is Duran Technology LLC, PO Box 100, Amanda, OH 43102.

11.3 Assignment. Neither party may assign this Agreement without the other’s consent, except to a successor in a merger or sale of substantially all its business or assets.

11.4 Force majeure. Neither party is liable for delays caused by events beyond its reasonable control, such as power or internet outages at a provider, natural disasters, or government action. This does not excuse payment.

11.5 Independent parties. The parties are independent contractors. This Agreement creates no partnership, employment or agency.

11.6 Publicity. Provider may name Customer as a customer only if Customer allows it on the Order Form. Customer may change that choice at any time by writing to Provider.

11.7 Entire agreement. This Agreement, its attachments and Order Forms are the whole agreement and replace prior discussions. Purchase-order terms do not apply. Changes must be in writing and signed by both parties, except that Provider may update the Acceptable Use Policy and Service Level Agreement with 30 days’ notice if the update does not materially reduce Customer’s rights.

11.8 Order of precedence. If documents conflict, the Order Form controls, then this Agreement, then the Data Processing Addendum, Service Level Agreement and Acceptable Use Policy.

11.9 Severability and waiver. If a provision is unenforceable, the rest stays in effect. A failure to enforce is not a waiver.

11.10 Signatures. The parties may sign electronically and in counterparts.

Service Level Agreement

Provider targets 99.5% monthly uptime and gives service credits when it misses.

1. Availability

“Availability” is the percentage of minutes in a calendar month when Users can log in and open or save pay sheets, measured by Provider’s external monitoring. These do not count as downtime: scheduled maintenance, problems caused by Customer’s devices, networks or internet providers, Customer’s misuse, suspension under the Agreement, and force majeure events. If the app is already open on a device, its offline outbox keeps saving sheets during short outages and sends them when the connection returns.

2. Scheduled maintenance

Provider will give at least 48 hours’ notice by email or in the Service. Maintenance will usually happen between 10 pm and 5 am Eastern and total no more than 4 hours a month.

3. Service credits

Credits for any month never exceed 20% of that month’s fee. Customer must request a credit within 30 days after the month ends. Credits apply to the next invoice, are not paid in cash, and are Customer’s only remedy for unavailability. If Availability is under 95% for two months in a row, Customer may terminate and receive a refund of prepaid fees for the unused period.

4. Support

Support address: support@fieldpaysheet.com.

5. Severity

6. Backups

Provider backs up Customer Data at least every 6 hours to separate storage, tests restores monthly, and targets restoring the Service within 8 hours of a major failure, with at most 6 hours of data lost. These targets cover failures of the Service. Provider does not guarantee recovery of data that Customer or its Users delete or change by mistake, but will try to restore it from backups on Customer’s request.

Acceptable Use Policy

Customer and its Users may use PaySheet only for lawful business records of field work. Breaking this policy can lead to suspension under the Agreement.

Users must not:

1. Upload anything unlawful, infringing, threatening, harassing or sexually explicit, or photos of people taken where they expect privacy.
2. Upload malware, or files that are not job-related photos, PDFs or documents.
3. Record false work, hours or quantities to deceive an employer, customer or government agency.
4. Put in the Service government ID numbers, bank or card numbers, health information, or other sensitive data the Service does not ask for. PaySheet does not need Social Security numbers. If Provider finds such data, it may delete it and will tell Customer.
5. Share logins, get around two-factor login, or access another company’s data.
6. Probe, scan or test the Service’s security, or put an unreasonable load on it, including scripted or automated requests outside the published API and its rate limits, without written permission.
7. Copy, scrape or frame the Service, or use it to send spam. Billing and approval emails may go only to contacts who expect them.
8. Share API Keys outside Customer’s own systems, put them where others can read them (such as public code, shared documents or emails), or use one key for another company.

Report abuse or a security problem to contact@fieldpaysheet.com. Provider may remove content that breaks this policy or suspend the accounts involved, and will tell Customer when it does.

Data Processing Addendum

This Addendum is part of the Agreement. Customer is the controller (the business that decides why Customer Data is used) and Provider is the processor (it handles Customer Data only on Customer’s instructions). For California law, Provider is a “service provider” and will not sell or share personal information or use it outside the Agreement.

1. Scope

2. Provider’s duties

Provider will:

1. Process Customer Data only as the Agreement and Customer’s documented instructions require, unless the law requires otherwise.
2. Make sure everyone with access to Customer Data is bound by confidentiality.
3. Keep the security measures in Section 4.
4. Help Customer answer requests from people about their data, mostly through the Service’s admin tools.
5. Delete or return Customer Data at the end of the Agreement as Section 4.6 of the Agreement says, or sooner on Customer’s request.
6. Answer Customer’s reasonable security questionnaires once a year, and give the information Customer reasonably needs to show compliance.

3. Subprocessors

Customer approves the current subprocessors: SMTP2GO (email delivery) and Stripe (card payments, only if it receives Customer Data). Customer may object to a new subprocessor on reasonable data-protection grounds; if the parties cannot resolve it, Customer may end the affected Order Form and receive a refund of prepaid fees for the unused period. Provider stays responsible for its subprocessors.

4. Security measures

• HTTPS for every connection; signed, short-lived links for photo and PDF uploads and downloads.
• Passwords hashed with a modern, hardened hashing method; two-factor login required for managers, approvers and admins (configurable per company); login throttling.
• Each company in its own database schema and its own file storage; network rules that let Service components reach only what they need.
• Each company admin site opens only from the office networks Customer lists, or from any network with two-factor codes required for every admin, as chosen on the Order Form; only Provider changes this. The platform admin site opens only from Provider’s secure network, with two-factor login.
• API Keys shown once and stored only as a one-way hash; a per-key rate limit; job keys work only from the network addresses Customer lists.
• Pages with pay sheet data are not kept in browser caches; pay sheets waiting to be sent on a device are shown only to the User who made them.
• Intrusion blocking at the edge proxy and access logs kept for 90 days.
• Backups every 6 hours to separate storage, with read-only access and a monthly restore test.
• Automated tests of company isolation, and regular security and vulnerability scans.

5. Security incidents

Provider will tell Customer without undue delay, and within 72 hours, after Provider determines or reasonably believes that an unauthorized person accessed and acquired Customer Data. The notice will say what happened, what data was involved, and what Provider is doing. Provider will help Customer meet any legal duty to notify individuals, consumer reporting agencies or regulators, including under Ohio Revised Code 1349.19. Provider may delay notice while a law enforcement agency determines that notice would impede a criminal investigation, as that law permits.

6. Liability

This Addendum is subject to the limits in Section 9 of the Master Subscription Agreement.