AI Connections (MCP) Service Terms

Scope. These AI Connections Service Terms (“AI Terms“) govern Company’s use of NMI’s Model Context Protocol (“MCP“) servers to connect third-party AI assistants, agents or applications (“AI Providers“) to the Services (“AI Connections“). These AI Terms supplement the Agreement. Capitalized terms not defined here have the meanings given in the Agreement.

1. AI Connections and Data Sharing

1.1. Functionality. AI Connections allow Company and its authorized users (“Users“) to access data and perform functions within the Services through an AI Provider selected by Company or its Users. Access is limited to the permissions granted to the relevant User and the functionality made available by NMI.

1.2. Authorization. Company authorizes NMI to disclose data accessible through an AI Connection, including Merchant, transaction and Personal Data (“Connection Data“), to the selected AI Provider at the direction of Company or its Users. Such disclosure is permitted under the Agreement, including its confidentiality and data-use restrictions, notwithstanding any provision that would otherwise prohibit such disclosure or the authorized use of AI Connections.

1.3. Restrictions. Company may not use AI Connections to circumvent access controls, permissions or security measures, access unauthorized data, or extract data in bulk to develop a competing product or service. All other restrictions under the Agreement continue to apply.

2. Third-Party AI Providers

2.1. AI Providers are independent third parties selected by Company or its Users and are not engaged by NMI to process data on its behalf. Their use is subject to their own terms, privacy policies and security practices.

2.2. Once Connection Data is disclosed to an AI Provider, its subsequent processing, use, retention and disclosure, including any use for AI model training, are governed by that AI Provider’s terms and practices. NMI does not control such processing and is not responsible for the acts or omissions of AI Providers.

2.3. NMI makes no representations or warranties regarding any AI Provider, including its security, availability or compliance with applicable Laws or Rules.

3. Company’s Responsibilities

3.1. Company is responsible for:

3.1.1 ensuring it has all necessary rights, authorizations, notices and consents to disclose Connection Data to its selected AI Providers, including under applicable Laws, and Rules;

3.1.2 assessing the AI Provider’s terms, security practices, data retention and training settings, and ensuring its use complies with applicable legal, regulatory and contractual requirements, including PCI DSS and data protection requirements;

3.1.3 managing Users’ access, credentials and AI Connections, including promptly revoking access where appropriate; and

3.1.4 all activities conducted through AI Connections by its Users or AI Providers acting on their behalf.

3.2. Company must promptly disconnect any compromised AI Connection and notify NMI of any actual or suspected security incident in accordance with the Agreement.

4. AI Actions and Outputs

4.1. Any instruction, request or transaction submitted through an AI Connection will be treated as authorized by Company, and NMI may rely on it accordingly.

4.2. AI-generated responses, recommendations and actions (“AI Output“) may be inaccurate, incomplete or unreliable. Company is responsible for reviewing and verifying AI Output before relying on it or taking any action based on it. Where AI Output conflicts with the records maintained in the Services, Services records will prevail.

4.3. NMI makes no warranties regarding AI Output and, to the maximum extent permitted by applicable law, is not liable for losses arising from AI Output or actions taken in reliance on it, subject to the limitations and exclusions set out in the Agreement.

5. NMI Controls

5.1. NMI may, at its sole discretion, introduce, modify, restrict, suspend or discontinue any AI Connection or its functionality, including access to data, tools and transaction capabilities.

5.2. NMI may apply security controls, data filtering and logging to AI Connections and maintain records relating to their authorization and use in accordance with the Agreement and applicable Laws.

5.3. Company or its Users may disconnect an AI Connection at any time. Disconnection prevents further access through that connection but does not affect data previously disclosed to an AI Provider.

6. General

6.1. These AI Terms apply for as long as Company uses AI Connections and terminate automatically upon termination of the applicable Agreement or Services.

6.2. NMI may amend these AI Terms in accordance with the Agreement and may require renewed acceptance where appropriate.

6.3. Except as expressly modified by these AI Terms, all provisions of the Agreement remain in full force and effect.