Terms of Service

Effective Date: July 15, 2026

Welcome to Duplocate.com. Duplocate.com is owned and operated by Duplocate Inc. (“Duplocate”, “we”, “us”, or “our”). By accessing or using our duplicate-payment detection service (the “Service”), you agree to these Terms of Service. If you do not agree, do not use the Service.

1. Our Commitment to Privacy and Security, and Data Protection

Duplocate is designed for environments where confidentiality, data minimization, and secure temporary processing are essential. We operate with:

• Zero Persistent Storage — Uploaded data exists only during processing and is deleted immediately afterward.
• 15‑Minute Report Window — Reports are available for up to 15 minutes before automatic deletion.
• Encryption in Transit — All uploads and downloads use TLS 1.2+.
• No Selling or Sharing — Data is never sold or shared with third parties.

2. Data Security

We employ commercially reasonable, technical and organizational security measures designed to protect Uploaded Data during the short processing window, including encryption in transit (TLS 1.2+), isolated and ephemeral processing environments, access controls, and automated deletion of data upon completion of processing. However, no method of transmission over the internet, or of electronic storage or processing, is completely secure. WHILE WE STRIVE TO PROTECT YOUR DATA USING COMMERCIALLY ACCEPTABLE MEANS, WE CANNOT GUARANTEE ITS ABSOLUTE SECURITY, AND ANY TRANSMISSION OF DATA TO OR FROM THE SERVICE IS AT YOUR OWN RISK. If we become aware of a security incident affecting Personal Data processed on your behalf, we will address it in accordance with the DPA.

3. Definitions

• "Service" — The Duplocate web-based duplicate‑payment detection platform, including all software, algorithms, reports, and related functionality provided through our website.
• "User" — Any individual or entity using the Service, including any person who uploads data to the Service, or any person who receives a report from the Service.
• "Uploaded Data" — Any file or dataset submitted for processing.
• "Report" — The downloadable output generated by the Service summarizing potential duplicate‑payment findings.
• "Personal Data" — Any information relating to an identified or identifiable natural person, and any information that constitutes “personal data,” “personal information,” or an equivalent term under applicable data protection laws.
• "Processing" — Any operation performed on Uploaded Data, including analyzing, scanning, transforming, or generating a Report.
• "Temporary Processing Environment" — The isolated, ephemeral runtime environment used to process Uploaded Data, which is automatically deleted upon completion.
• "Anonymized Patterns" — Fully de‑identified mathematical structures, heuristics, or statistical fingerprints derived from Uploaded Data that cannot be used to identify any user, company, vendor, or transaction.
• "DPA" — The Data Processing Addendum incorporated into these Terms, governing the handling of Personal Data (if any).
• "We,” “Us,” or “Our" — Duplocate Inc., the legal entity operating Duplocate and providing the Service.
• "Duplocate Parties" — Duplocate Inc., its affiliates, and each of their respective directors, officers, employees, contractors, and agents.
• "You” or “Your" — The User accessing or using the Service.

4. Acceptance of Terms

By clicking “I agree” (where presented), or by accessing or using the Service, including by uploading any file, you (“User”, “you”, or “your”) agree to be bound by these Terms of Service (“Terms”), the attached Data Processing Addendum (“DPA”), and our Privacy Policy. If you do not agree to these Terms, do not use the Service.

5. Description of the Service

The Service is a free, web-based tool that allows users to upload an accounts payable (AP) register file via HTTPS. Documents are analyzed in secure, temporary runtime environments with no human access. The Service is intended and made available solely for business and commercial use in connection with a user's or organization's accounts payable functions, and is not directed to consumers for personal, family, or household purposes.

We process the file solely to identify potential duplicate payments and generate a downloadable report. Key operational and technical details of the Service include:

• No user accounts or registration required.
• We collect your name and email address to: (a) provide the Service and make Reports available to you; (b) facilitate report audits; (c) notify you if we become aware of security incidents affecting Personal Data processed on your behalf; (d) administer these Terms and, where necessary, exercise or enforce our rights and remedies under them; (e) respond to your inquiries and provide support; (f) detect, prevent, investigate, and address fraud, abuse, security issues, or other misuse of the Service; and (g) comply with applicable legal, regulatory, and record-keeping obligations.
• We retain your name and email address only for as long as necessary to fulfil the purposes described above and to meet our legal, regulatory, and record-keeping obligations, after which it is securely deleted or de-identified.
• Uploaded files are processed using secure temporary file handling and are permanently deleted immediately upon completion of processing.
• Generated reports are available for download for a maximum of 15 minutes, after which they are automatically and permanently deleted via automated cleanup processes.
• We may retain only fully anonymized, aggregated, and de-identified mathematical patterns and heuristics derived from processed data (such as invoice number structures, vendor name variation patterns, string-similarity fingerprints, duplicate-payment heuristics, and statistical anomaly distributions) solely to improve the accuracy and effectiveness of the duplicate detection algorithms. No original data, vendor names, amounts, or any personally identifiable information is retained or used for this purpose.

6. Eligibility and User Responsibilities

You represent and warrant that:

• You are at least 18 years of age and have full legal authority to upload the data and use the Service.
• You either own the AP register data you upload or are authorized by the owner of that data to upload it to, and have it Processed by the Service under these Terms, and you have obtained all rights, consents, permissions, and authorizations necessary to do so.
• If you upload data on behalf of an employer or any other person or entity, you represent and warrant that you are duly authorized to act on that person's or entity's behalf and to bind them to these Terms.
• Your upload of the data, and our Processing of it in accordance with these Terms, will not breach or conflict with any confidentiality, privacy, non-disclosure, or other contractual or legal obligation that you or the owner of the data owes to any third party.
• You agree not to upload illegal, harmful, or infringing material.
• The data you upload does not violate any applicable law or the rights of any third party, including, without limitation, any privacy, data protection, confidentiality, intellectual property, copyright, trade secret, contractual, or other proprietary rights of any third party.
• You acknowledge that the Service is provided on an “as-is” basis and that duplicate detection results are probabilistic, solely for informational purposes only, and may contain errors or omissions.
• You must not attempt to reverse-engineer, overload, or interfere with the Service.
• You are solely responsible for the accuracy, completeness, and legality of any data you upload and for your use of any report generated by the Service.

YOU AGREE TO INDEMNIFY, DEFEND, AND HOLD HARMLESS THE DUPLOCATE PARTIES FROM AND AGAINST ANY AND ALL CLAIMS, DEMANDS, ACTIONS, PROCEEDINGS, DAMAGES, LOSSES, LIABILITIES, FINES, PENALTIES, COSTS, AND EXPENSES (INCLUDING LEGAL FEES AND DISBURSEMENTS ON A FULL-INDEMNITY, SOLICITOR-CLIENT BASIS) ARISING OUT OF OR RELATING TO ANY BREACH OR INACCURACY OF ANY OF YOUR REPRESENTATIONS, WARRANTIES, COVENANTS, OR OBLIGATIONS SET OUT IN THIS SECTION 6, WHETHER SUCH CLAIM, DAMAGE, LOSS, LIABILITY, COST, OR EXPENSE IS INCURRED OR SUFFERED DIRECTLY BY A DUPLOCATE PARTY OR ARISES FROM A CLAIM, DEMAND, OR PROCEEDING BROUGHT BY A THIRD PARTY. THIS INDEMNITY IS IN ADDITION TO, AND DOES NOT LIMIT, THE INDEMNITY SET OUT IN SECTION 10, AND SURVIVES ANY TERMINATION OF THESE TERMS.

7. License Grant

By uploading data to the Service, you grant us a non-exclusive, royalty-free, worldwide license to process the uploaded data solely as necessary to provide the Service and for the limited service-improvement purposes described in Section 5.

8. Service Provided “AS IS” – Disclaimer of Warranties

THE SERVICE AND ALL REPORTS ARE PROVIDED STRICTLY ON AN “AS IS” AND “AS AVAILABLE” BASIS WITHOUT ANY WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT.

We do not warrant that:

• The Service will be uninterrupted, timely, secure, or error-free.
• Any report will be accurate, complete, timely, or suitable for your business purposes; or
• The Service will detect all duplicates or avoid false positives.

We may suspend the service for maintenance, updates, or technical issues.

9. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE DUPLOCATE PARTIES SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES (INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, REVENUE, BUSINESS OPPORTUNITY, OR GOODWILL) ARISING OUT OF OR IN ANY WAY RELATED TO YOUR USE OF THE SERVICE OR ANY REPORT, REGARDLESS OF THE CAUSE OF ACTION OR THE THEORY OF LIABILITY, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

BECAUSE THE SERVICE IS PROVIDED FREE OF CHARGE, OUR TOTAL AGGREGATE LIABILITY TO YOU FOR ANY AND ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED FIVE HUNDRED CANADIAN DOLLARS (CAD $500).

NOTHING IN THESE TERMS EXCLUDES OR LIMITS OUR LIABILITY FOR FRAUD OR FRAUDULENT MISREPRESENTATION, GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR ANY OTHER LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW. TO THE EXTENT ANY JURISDICTION DOES NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN TYPES OF DAMAGES, OUR LIABILITY SHALL BE LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW.

10. Indemnification

YOU AGREE TO INDEMNIFY, DEFEND, AND HOLD HARMLESS THE DUPLOCATE PARTIES FROM AND AGAINST ANY AND ALL CLAIMS, DAMAGES, LOSSES, LIABILITIES, COSTS, AND EXPENSES (INCLUDING REASONABLE ATTORNEYS’ FEES) ARISING OUT OF OR RELATING TO:

• YOUR USE OF THE SERVICE OR ANY REPORT;
• ANY DATA YOU UPLOAD;
• YOUR VIOLATION OF THESE TERMS; OR
• ANY CLAIM THAT YOUR UPLOADED DATA OR YOUR USE OF A REPORT INFRINGES OR VIOLATES THE RIGHTS OF ANY THIRD PARTY.

11. Intellectual Property

We retain all right, title, and interest in and to the Service, including all software, algorithms, and the anonymized mathematical patterns and heuristics described in Section 5. As between you and us, you (or, where the uploaded data is owned by another person or entity, that owner) retain all right, title, and interest in and to the original uploaded data, subject to the limited license granted in Section 7.

12. Termination

We may suspend or terminate your access to the Service at any time, for any reason, without notice. These Terms shall survive any termination.

13. Governing Law and Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict of laws principles.

Any dispute arising out of or relating to these Terms shall be resolved by binding arbitration administered by the ADR Institute of Canada, Inc. (ADRIC) in accordance with its Arbitration Rules. The arbitration shall take place in the Province of Alberta, sitting in Calgary. You agree to waive any right to a jury trial or to participate in a class action lawsuit.

Nothing in this Section 13 applies to the extent prohibited by, or operates to deprive you of the protection of, any applicable law that cannot be excluded or overridden by agreement. Where applicable law prohibits or restricts mandatory arbitration, a class action waiver, a jury trial waiver, or a mandatory choice of governing law or forum, that provision shall not apply to you to the extent of the prohibition or restriction, and any dispute so affected may be brought in a court of competent jurisdiction to the extent required by that law.

14. Changes to Terms

We may modify these Terms at any time upon prior notice to you, or revision to these Terms in any subsequent instance of your use of the Service. Your continued use of the Service after any changes constitutes acceptance of the updated Terms.

15. Contact

If you have any questions about these Terms, please contact us at: support@duplocate.com

16. General

• Entire Agreement. These Terms, together with the DPA and our Privacy Policy, constitute the entire agreement between you and us regarding the Service and supersede all prior or contemporaneous understandings on that subject.
• Severability. If any provision of these Terms is held to be invalid, illegal, or unenforceable, that provision shall be enforced to the maximum extent permissible, and the remaining provisions shall remain in full force and effect.
• Waiver. Our failure to enforce any provision of these Terms is not a waiver of our right to enforce it later, and no waiver is effective unless made in writing.
• Assignment. You may not assign or transfer these Terms without our prior written consent. We may assign these Terms, in whole or in part, without restriction, including in connection with a merger, acquisition, reorganization, or sale of assets.
• Notices. We may provide notices to you by email or by posting within the Service. You may contact us as set out in Section 15.
• Force Majeure. We are not liable for any failure or delay in performance caused by events beyond our reasonable control.
• Survival. Any provision that by its nature should survive termination — including Sections 6, 8, 9, 10, 11, and this Section 16 — survives termination of these Terms.
• Headings. Headings are for convenience only and do not affect interpretation of these Terms.

---

Data Processing Addendum (DPA)

(Exhibit A – Incorporated into the Terms of Service)

This Data Processing Addendum (“DPA”) forms part of the Terms of Service and applies when we process Personal Data on your behalf in connection with the Service.

1. Definitions

“Personal Data” - Any information relating to an identified or identifiable natural person, and any information that constitutes “personal data,” “personal information,” or an equivalent term under applicable data protection laws. “You” act as the Data Controller. We act as the Data Processor.

2. Scope and Instructions

We will process Personal Data only:

• To the extent necessary to provide the Service (duplicate detection and report generation);
• In accordance with the Terms set forth in the Terms of Service; and
• For the limited service-improvement purpose described in Section 5 of the Terms of Service (fully anonymized mathematical patterns only).
• We will not sell, rent, or use Personal Data for any purpose other than those described above.

3. Data Minimization

We apply data minimization principles at all times.

4. Security

We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include the use of encryption in transit (HTTPS), secure temporary file handling, access controls, and automated deletion processes.

5. Retention and Deletion

• Raw uploaded data: Processed using secure temporary file handling and permanently deleted immediately upon completion of processing.
• Generated reports: Automatically and permanently deleted after a maximum of 15 minutes via automated cleanup processes.
• Anonymized patterns: Only fully de-identified mathematical patterns and heuristics may be retained indefinitely for service improvement. No original data is retained.

Upon your written request (to the extent technically and legally feasible), we will delete any remaining Personal Data we process on your behalf.

6. Sub‑processors

We may engage third-party infrastructure and hosting providers as sub-processors to operate the Temporary Processing Environment and otherwise provide the Service. We remain responsible for the acts and omissions of our sub-processors to the same extent as for our own, and we will ensure that each sub-processor is bound by data protection obligations no less protective than those in this DPA. We will make available a current list of our sub-processors on request and will give you advance notice of any new sub-processor, giving you a reasonable opportunity to object on reasonable data protection grounds. We do not sell or rent Personal Data, and we do not disclose it to any third party except to sub-processors as described above or as required by law.

7. Data Subject Rights

To the extent we are reasonably able, we will assist you in responding to requests from data subjects to exercise their rights under applicable data protection laws.

8. Security Incidents

We will notify you without undue delay upon becoming aware of any security incident affecting Personal Data processed on your behalf.

9. Audit

You may request reasonable information regarding our data processing practices. Given the scale of the Service, physical on-site audits are not required or feasible.

10. Termination

Upon termination of the Terms of Service or upon your request, we will delete Personal Data in accordance with Section 5 of this DPA.

11. Controller Responsibilities

As Data Controller, you represent, warrant, and undertake that: (a) you have a valid legal basis to collect the Personal Data contained in the Uploaded Data and to disclose it to us for Processing under these Terms; (b) you have provided all notices and obtained all consents, authorizations, and permissions required under applicable data protection laws for such Processing, including where the Uploaded Data contains Personal Data relating to individuals other than you; (c) your instructions to us for the Processing of Personal Data comply with applicable law; and (d) where you upload data on behalf of an employer or other organization, you are authorized to act as, or on behalf of, the Data Controller and to bind that organization to this DPA. You are solely responsible for the accuracy, quality, and legality of the Personal Data and the means by which you acquired it.

12. International Data Transfers

Depending on where our infrastructure and sub-processors operate, Personal Data contained in Uploaded Data may be Processed in, or transferred to, a jurisdiction other than the one in which it was collected. Where such a transfer is subject to applicable data protection laws, we will implement a lawful transfer mechanism and appropriate safeguards as required, which may include the standard contractual clauses adopted under the GDPR, a transfer impact or privacy impact assessment (including as contemplated by Quebec's Law 25), and equivalent measures under PIPEDA, applicable provincial privacy laws, and applicable U.S. state privacy laws (such as the California Consumer Privacy Act). You are responsible for determining whether any such transfer is permitted under the laws applicable to you before uploading Personal Data.