Master Service Agreement

In this Master Service Agreement ("MSA"), the following terms have the meanings given below. Capitalized terms used in the Terms of Service (Appendix A) and other Appendices have the same meaning as in this Section unless separately defined.

• "Service" means the ANQA RMS OS revenue-management software platform, including the web application, forecasting and pricing engines, competitor-intelligence features, and related APIs, as made available by ANQA on a subscription basis. The Service is hosted and operated by ANQA on infrastructure ANQA controls (see Section 3 and Section 13) — it is not software delivered for installation on Subscriber's own servers.
• "Subscriber" means the hotel, hospitality group, or other legal entity that has agreed to this MSA (whether by signing an Order Form, checking the acceptance box at signup, or otherwise), together with its Authorized Users.
• "Authorized User" means an individual employee, contractor, or agent of Subscriber who is granted a login to the Service under Subscriber's account.
• "Data" means all information Subscriber or its Authorized Users upload to, or connect through, the Service, including PMS exports, reservation and guest data, rates, budgets, and forecasts derived from that information.
• "Confidential Information" has the meaning given in Section 11.
• "Force Majeure" means any event beyond a party's reasonable control, including natural disaster, war, terrorism, civil unrest, pandemic, governmental action, internet or power infrastructure failure, or failure of a third-party provider listed in Appendix B.
• "Intellectual Property" means all patent, copyright, trademark, trade secret, database, and other proprietary rights, in each case whether registered or unregistered.

Interpretation. Section headings are for convenience only and do not affect interpretation. Words in the singular include the plural and vice versa. Sections 9 (Limitation of Liability), 10 (Indemnification), 11 (Confidentiality), 12 (Intellectual Property), and 18 (Dispute Resolution) survive termination of this MSA, along with any definitions needed to interpret them.

Governing law. Unless the parties agree otherwise in writing (e.g. an Order Form naming a different jurisdiction for a Saudi Arabia or Bangladesh Subscriber), this MSA is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. See Section 18.

Subject to payment of the applicable fees and compliance with this MSA, ANQA grants Subscriber a non-exclusive, non-transferable, worldwide license to access and use the Service, for the term of the subscription, solely for Subscriber's own internal hotel-operations business.

Restrictions. Subscriber shall not, and shall not permit any Authorized User or third party to: (a) reverse-engineer, decompile, or attempt to derive the source code, algorithms, or models underlying the Service; (b) sublicense, resell, rent, or offer the Service (or access to it) to any third party as a service; (c) modify, copy, or create derivative works of the Service, except to the extent an open-source component's own license expressly permits; or (d) use the Service to build a competing product.

Open-source components. The Service incorporates open-source software, including (without limitation) Next.js, Prisma ORM, and the Supabase client libraries, each under its own respective open-source license (MIT or similar permissive licenses at the time of writing — see the Service's published dependency manifest for the current list). Subscriber acknowledges that these components are governed by their own license terms, which permit use, modification, and redistribution under stated conditions independent of this MSA. ANQA is not responsible for a third party's compliance with an open-source license it did not author; Subscriber is responsible for its own compliance if it independently redistributes any open-source component outside the Service.

Usage limits. The license granted here is for Subscriber's internal business use only. Subscriber may not resell, distribute, white-label, or offer the Service (or its outputs, in bulk or systematized form) to third parties as a service of its own.

Ownership.

• Hotel Data (PMS exports, reservation data, guest information, rates, budgets): owned by Subscriber. ANQA processes this Data solely as a data processor, on Subscriber's instructions, to provide the Service.
• Competitor and market data sourced from Lighthouse, SerpApi, or OTA integrations: aggregate, non-personal market data licensed to ANQA by those providers; ANQA may use and display it within the Service as part of providing competitor intelligence to Subscriber.
• Output data (forecasts, recommendations, analytics generated for Subscriber's hotel): owned by Subscriber. ANQA retains a right to use de-identified, aggregated data derived from Output data (with no Subscriber- or guest-identifying information) to develop and improve the Service, including training and validating its forecasting and pricing models.

Data residency. Hotel Data is stored on ANQA's managed database infrastructure (Supabase, running on AWS). As of 2026-07-27, that infrastructure is hosted in the AWS Asia-Pacific (Seoul) region, not within the UAE. ANQA is evaluating migration to a UAE or GCC-region data center ahead of go-live for UAE/KSA Subscribers with in-region residency requirements; until that migration is complete and confirmed in writing, ANQA does not represent that Hotel Data is stored within the UAE, and any UAE-specific regulatory residency commitment (e.g. under an ADISA engagement, see Section 15) must be confirmed in the applicable Order Form rather than assumed from this MSA. Backups are retained within the same region as primary storage unless otherwise agreed in writing.

Data retention. Subscriber may request deletion of its personal data within 30 days of termination. ANQA may retain de-identified, aggregated forecasting-model data (containing no personal information) for up to 12 months after termination for product-improvement purposes.

Data accuracy. Subscriber warrants that the PMS data, reservation data, and other information it uploads or connects to the Service is accurate, complete, and lawfully authorized for processing. Subscriber is responsible for the accuracy of the underlying data feeding any rate recommendation.

Account security. Subscriber is responsible for: (a) keeping Authorized User login credentials confidential; (b) promptly deactivating Authorized Users who leave Subscriber's organization; (c) managing which Authorized Users hold which role within the Service's own role-based access controls; and (d) notifying ANQA promptly of any suspected unauthorized access to Subscriber's account.

Compliance. Subscriber warrants compliance with all laws applicable to its own operations and to its use of the Service, including data protection law applicable to any guest personal data it processes (e.g. GDPR for EU guests, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the Abu Dhabi Global Market / ADISA regime where applicable), consumer protection law, and competition law.

Usage restrictions. Subscriber shall not: (a) use the Service for any unlawful purpose; (b) attempt to access any part of the Service or its infrastructure it is not authorized to access; (c) attempt to reverse-engineer or extract ANQA's underlying algorithms or models; or (d) resell ANQA's recommendations, forecasts, or competitor data as a standalone data service to third parties.

Pricing. Current published subscription fees are: Starter — AED 1,499/month; Growth — AED 2,899/month; Enterprise — from AED 4,500/month (custom quote). Fees are charged in AED on the payment gateway; amounts shown in other currencies are display-only conversions of the AED price. Fees exclude VAT and any other applicable tax, which Subscriber shall pay in addition where applicable.

Onboarding fee. A one-time onboarding fee of AED 3,500 — covering data migration, competitive-set setup, and training — is charged on Subscriber's first paid invoice, in addition to the recurring subscription fee. The onboarding fee is non-refundable once onboarding work has begun.

Billing cycle. Fees are billed monthly (or annually, if Subscriber elects an annual plan) in advance, by credit/debit card via Stripe or another method agreed in writing. Annual plans are billed for 10 months of the year (2 months free) prepaid. New hotels receive a 90-day free trial at Growth-tier feature access from account creation; no card is required to start the trial.

Automatic renewal. Paid subscriptions renew automatically each billing period unless Subscriber cancels through the in-app billing settings, or by written notice, before the next renewal date. No refunds are given for a partial billing period.

Price increases. ANQA may increase fees with at least 60 days' written notice. If Subscriber objects, it may cancel within 30 days of the notice for a pro-rated refund of any pre-paid, unused period at the old price.

Late/failed payment. If a renewal charge fails, Subscriber's plan is kept active through the paid-through date plus a 14-day grace period while the gateway retries. If payment is not resolved within that window, the account is stepped down to the restricted Free tier rather than having data access revoked outright; Hotel Data is not deleted for non-payment alone (see Section 6 for termination and data-deletion timelines).

Taxes. Subscriber is responsible for all taxes, duties, and levies on the fees payable under this MSA, other than taxes on ANQA's net income.

Term. This MSA takes effect on the date Subscriber accepts it (electronically, as described in Section 19) and continues for as long as Subscriber maintains an active subscription, plus any survival periods stated elsewhere in this MSA.

Termination for convenience. Subscriber may cancel its subscription at any time from the in-app billing settings, or by 30 days' written notice. Cancellation takes effect at the end of the then-current billing period; no refund is given for the unused portion of that period.

Termination for cause by ANQA. ANQA may suspend or terminate Subscriber's account if: (a) Subscriber breaches Section 4 (Obligations) and fails to cure within 14 days of notice; (b) Subscriber uses the Service unlawfully or fraudulently; or (c) payment remains unresolved beyond the grace period in Section 5.

Termination for cause by Subscriber. Subscriber may terminate immediately if ANQA materially breaches this MSA and fails to cure within 30 days of written notice.

Effect of termination. On termination: (a) Authorized User access is revoked; (b) Subscriber has 30 days to export its Hotel Data through the Service's self-service export tools; (c) Hotel Data is deleted from ANQA's production systems after that 30-day window, subject to the retention terms in Section 3 and Section 13; and (d) Subscriber remains liable for fees accrued through the end of the then-current billing period.

Uptime. ANQA targets 99.5% monthly uptime, measured in UTC. Uptime excludes scheduled maintenance (up to 4 hours/month, with at least 48 hours' notice) and outages caused by a third-party provider listed in Appendix B, Subscriber's own network, or Subscriber's browser/device.

Maintenance window. Routine maintenance is scheduled for Sundays 02:00–04:00 UTC. Emergency maintenance may occur without advance notice where needed to protect security or data integrity.

Support response targets. Critical (Service down): initial response within 4 hours, target restoration within 8 hours. High (degraded performance): response within 24 hours. Medium/Low: response within 72 hours. These are targets, not guarantees, given the Service is currently operated by a small team; Enterprise Order Forms may specify contractual response times.

Uptime credits. If monthly uptime falls below 99.5%: 99.0–99.4% uptime → 10% of that month's fee credited; 98.0–98.9% → 25%; below 98% → 50%. Credits are applied to the next invoice and are Subscriber's sole and exclusive remedy for an uptime shortfall.

ANQA is not liable for outages caused by a Sub-processor listed in Appendix B, including Supabase, Stripe, Lighthouse, SerpApi, or an OTA/PMS provider's API.

Limited warranty. ANQA warrants that: (a) the Service will be provided in a professional and workmanlike manner; (b) ANQA has the right to license the Service as described in Section 2; and (c) the Service does not, to ANQA's knowledge, infringe a third party's Intellectual Property.

Data accuracy disclaimer. Competitor pricing data sourced from Lighthouse and SerpApi is approximate and may be stale (up to 24 hours old). ANQA does not warrant the accuracy, completeness, or timeliness of third-party competitor data. Subscriber is responsible for validating recommendations against real-time market conditions before acting on them.

As-is. Except as expressly stated in this Section, the Service is provided "as is" without warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement.

ANQA SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST REVENUE, LOST PROFITS, LOST BOOKINGS, LOST DATA, OR BUSINESS INTERRUPTION, EVEN IF ANQA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Exceptions. The cap above does not apply to: (a) breach of confidentiality obligations (Section 11); (b) a party's indemnification obligations (Section 10); or (c) a party's gross negligence or willful misconduct.

By ANQA. ANQA will defend and indemnify Subscriber against a third-party claim that the Service, as provided by ANQA and used in accordance with this MSA, infringes that third party's Intellectual Property, and will pay damages finally awarded (or agreed in settlement). ANQA's sole obligation, at its option, is to: (a) modify the Service to be non-infringing; (b) obtain a license for Subscriber's continued use; or (c) terminate the Service and refund prepaid, unused fees.

By Subscriber. Subscriber will defend and indemnify ANQA against a third-party claim arising from: (a) Subscriber's use of the Service in violation of this MSA or applicable law; (b) Subscriber's PMS data or hotel operations; or (c) Subscriber's violation of a third party's Intellectual Property or privacy rights in connection with its use of competitor data obtained through the Service.

Definition. "Confidential Information" means source code, algorithms, pricing, customer lists, and any non-public information disclosed by one party to the other that is marked confidential or would reasonably be understood as confidential given its nature and the circumstances of disclosure.

Obligations. Each party will: (a) protect the other's Confidential Information with reasonable security measures, at least as protective as it uses for its own similar information; (b) limit access to personnel with a need to know; and (c) not disclose it to any third party without the disclosing party's written consent, except as permitted below.

Exceptions. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was rightfully known to the receiving party before disclosure; (c) is rightfully received from a third party without a confidentiality obligation; or (d) must be disclosed under law or court order — in which case the disclosing party will give prompt notice, where legally permitted, so the other party may seek a protective order.

Duration. Confidentiality obligations survive termination of this MSA for 3 years, or longer where required by law.

ANQA IP. ANQA retains all right, title, and interest in the Service, including its software, forecasting and pricing algorithms, databases, UI/UX, and documentation, along with any derivative works. Subscriber's subscription grants only the license in Section 2 — no ownership of ANQA's Intellectual Property.

Open-source. As described in Section 2, the Service incorporates open-source components governed by their own licenses, which remain outside ANQA's proprietary Intellectual Property.

Feedback. If Subscriber provides suggestions, feature requests, or bug reports, ANQA may use that feedback to improve the Service without obligation or compensation to Subscriber.

Security measures. ANQA encrypts Data in transit (TLS 1.2+) and at rest, restricts access by Authorized-User role and by hotel (row-level and application-level tenant isolation), maintains audit logging of privileged actions, and applies field-level encryption to selected sensitive guest fields (e.g. phone number, nationality). ANQA does not warrant absolute security — no system is unbreachable. Subscriber remains responsible for its own Authorized User account hygiene (Section 4).

Breach notification. If ANQA discovers unauthorized access to Subscriber's Data, it will: (a) notify Subscriber within 72 hours of confirming the incident; (b) describe the nature of the breach, the Data affected, and remediation steps taken; and (c) reasonably cooperate with Subscriber's own investigation. Notification may be delayed if law enforcement requests a delay in writing.

Limitations. ANQA is not liable for a breach caused by: (a) compromise of an Authorized User's own credentials; (b) Subscriber's misconfiguration of its own in-app access controls; or (c) a breach at a Sub-processor listed in Appendix B.

The Service relies on the Sub-processors listed in Appendix B (currently: Supabase for database hosting, Stripe for payments, Lighthouse and SerpApi for competitor/market data, relevant OTA and PMS APIs Subscriber connects, and a hosting provider for the application itself). ANQA is not liable for a Sub-processor's outage, data breach, or service failure beyond its obligations under Section 13; Subscriber's direct recourse for a Sub-processor's own failure lies with that Sub-processor.

Data transfers. By using the Service, Subscriber consents to Data being processed by Sub-processors in the countries where they operate, which may be outside the UAE/GCC region (see the residency note in Section 3). Sub-processors are bound by their own contractual data-protection commitments; a Data Processing Agreement is available on request (Appendix C).

UAE data protection. ANQA will process Hotel Data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data to the extent it applies to ANQA's processing activities. A UAE-specific data-residency commitment (e.g. for an Abu Dhabi Subscriber requiring ADISA-aligned handling) is available only where confirmed in writing on an Order Form once the infrastructure migration described in Section 3 is complete — it is not a standing commitment of this MSA as of 2026-07-27.

GDPR. If Subscriber processes personal data of EU residents (e.g. EU guests staying at the hotel) through the Service, Subscriber is the data controller and ANQA is the data processor for that data. The parties will enter into a separate Data Processing Agreement (Appendix C) covering GDPR-specific obligations on request.

PCI-DSS. Payment processing is handled by Stripe. Stripe, not ANQA, maintains PCI-DSS compliance for card data; ANQA does not store cardholder data.

Consumer protection. Subscriber warrants its own compliance with applicable consumer-protection law in the markets where it operates, including accurate rate advertising and required customer disclosures.

Competition law. Subscriber warrants that its use of the Service, including any pricing decision made using ANQA's recommendations, does not involve unlawful coordination with competitors (e.g. price-fixing).

ANQA shall obtain and maintain, once commercially available at the stage of the business described in this MSA: (a) Errors & Omissions insurance with minimum coverage of AED 500,000; (b) cyber liability insurance with minimum coverage of AED 250,000; and (c) general liability insurance with minimum coverage of AED 250,000. Certificates are available to Subscriber on request. As of 2026-07-27, ANQA has not yet bound these policies — see the founder's pre-launch checklist. Insurance does not cover, and ANQA is not liable for, losses resulting from Subscriber's own business decisions made using ANQA's recommendations — those remain Subscriber's business risk under Section 8.

Notices under this MSA are sent by email to the notice address on file for each party (for ANQA: legal@anqaos.com, or the founder's registered contact email until a dedicated legal inbox is set up), or by other written means agreed by the parties. Notices are effective on receipt.

Governing law. This MSA is governed by the laws of the United Arab Emirates as applied in Dubai, without regard to conflict-of-law principles, unless the parties' Order Form specifies otherwise (relevant for Saudi Arabia- or Bangladesh-based Subscribers).

Escalation. Before initiating a formal dispute, the parties will attempt in good faith to resolve the matter through negotiation between designated representatives within 30 days of one party's written notice of the dispute.

Arbitration. If negotiation fails, the dispute will be resolved by binding arbitration under the Rules of the Dubai International Arbitration Centre (DIAC): one arbitrator for claims under AED 500,000, otherwise three; seat and hearing in Dubai; language English.

Exclusion. Disputes concerning Intellectual Property infringement or breach of confidentiality may instead be litigated in the competent courts of the Dubai International Financial Centre (DIFC), at the electing party's option.

Costs. The prevailing party may recover its reasonable legal fees and arbitration costs, subject to the arbitrator's or court's discretion.

Entire agreement. This MSA, the Terms of Service (Appendix A), and any signed Order Form constitute the entire agreement between the parties regarding the Service and supersede all prior discussions or agreements on the subject.

Amendment. ANQA may update the Terms of Service or this MSA's Appendices with at least 30 days' written notice (e.g. by email and an in-app notice); continued use of the Service after the notice period constitutes acceptance. Material changes to this MSA itself require a new signature from Subscriber.

Electronic signature. Subscriber's acceptance of this MSA by checking the acceptance box and typing its authorized representative's full legal name at signup constitutes a valid electronic signature, binding on Subscriber to the same extent as a handwritten signature, recorded together with the signer's name, the document version, a timestamp, and the originating IP address for evidentiary purposes.

Severability. If a provision of this MSA is held invalid or unenforceable, it will be severed and the remainder of the MSA remains in effect.

Relationship of parties. The parties are independent contractors. Nothing in this MSA creates a partnership, joint venture, or employment relationship.

Assignment. Subscriber may not assign this MSA without ANQA's written consent, not to be unreasonably withheld. ANQA may assign this MSA to an affiliate or successor on notice.

Survival. Sections 9, 10, 11, 12, and 18, together with any accrued payment obligations, survive termination of this MSA.

• Supabase — primary database and authentication hosting, on AWS infrastructure (currently Asia-Pacific / Seoul region — see Section 3 residency note).
• Vercel — application hosting.
• Stripe — payment processing (US-based, PCI-DSS compliant).
• Lighthouse — competitor rate intelligence.
• SerpApi — Google Hotels rate data.
• OTA and PMS integrations Subscriber connects (e.g. Booking.com, Agoda, Ctrip, MakeMyTrip, Expedia, Opera, Apaleo) — used only to the extent Subscriber configures each integration.
• OpenRouter — underlying LLM provider for the AI copilot and upload-mapping features, when configured.
• Resend — transactional email, when configured.

Where Subscriber processes personal data subject to GDPR or UAE data protection law through the Service, ANQA acts as processor and Subscriber as controller. A full-form Data Processing Agreement — covering data categories, processing purposes, the Sub-processor list in Appendix B, data-subject rights handling, and incident response timelines consistent with Section 13 — is available on request pending legal review, and will be executed as a standalone document rather than restated here.

See MSA Section 7 for the current uptime commitment, maintenance window, support response targets, and uptime-credit schedule. This Appendix exists as a stable reference point for support tooling; the terms themselves live in Section 7 to avoid drift between two copies of the same commitment.

Subscriber and its Authorized Users shall not use the Service to: (a) violate any applicable law; (b) commit or facilitate fraud; (c) attempt to reverse-engineer, scrape, or extract the Service's underlying algorithms or data at scale; (d) resell or redistribute the Service or its outputs to a third party as a service; (e) attempt to access another Subscriber's hotel data or account; or (f) interfere with or disrupt the Service's infrastructure.

Enforcement. A violation may result in suspension or termination under Section 6. Subscriber may appeal a suspension by written notice to legal@anqaos.com; ANQA will review and respond within 10 business days.

Security measures. Encryption in transit (TLS 1.2+); encryption at rest for the database and for selected sensitive guest fields; role-based access control scoped per hotel; audit logging of privileged administrative actions; periodic review of dependency and infrastructure security advisories.

Breach notification. As described in Section 13 — notification within 72 hours of confirming an incident, with a description of the breach, Data affected, and remediation steps.

Forensics & cooperation. ANQA will reasonably cooperate with a Subscriber-led investigation into an incident affecting that Subscriber's Data, including providing relevant audit-log excerpts scoped to that Subscriber's hotel.

Remediation. ANQA will remediate a confirmed vulnerability on a timeline proportionate to its severity, prioritizing any issue with active exploitation or exposure of guest personal data.