# SARSTREAM Agency Agreement

*Version 1.1 · Effective 2026-10-17*

## Summary in plain English

This summary helps you read the Agreement. It is not a substitute for it, and it never promises more than the Agreement does. If they differ, the Agreement controls.

- **SARTech LLC provides SARSTREAM — nobody else.**
- **It is free, and it is a beta.** No fees, no uptime promise, and it may change or stop.
- **DO NOT RELY ON SARSTREAM IN AN EMERGENCY.** It supplements your radios, dispatch, maps and incident command. It can fail or be wrong at the worst moment. Your people make the decisions.
- **You take the risk and give up claims** against SARTech, BES and their people, as far as Colorado law allows (Part B §2). Liability is limited to $100.
- **Detect is an aid.** It will miss people and flag things that aren't people. An empty lead list does not mean an area is clear.
- **Flying is your responsibility**, and so is your data: you own it, and you are responsible for every law about it. Never store CJIS data or health records.
- **SARTech (and its service providers acting for it) may use your data to test and improve SARSTREAM**, including training Detect, unless you opt out (Part B §9.2). SARTech never sells it.
- **Public agencies** (counties, sheriffs) get the changes Colorado law requires (Part B §12): no indemnity, no waiver of governmental immunity, your own county's court.
- **Your agency's acceptance covers everyone you let in.** Share the User Notice with them.

# Part A — Acceptance

**This Agreement is between SARTech LLC and the agency that accepts it (the "Agency").** It consists of this Part A and the Terms in Part B. An authorized administrator accepts it for the Agency in SARSTREAM by ticking the three boxes, typing their name and title, and clicking Accept (a Public Agency may instead accept through its own approval process — Part B §12.1). Acceptance covers the whole Agreement (Parts A and B), in the version shown at the top of this document, published at https://sarstream.org/legal/agreement. Boulder Emergency Squad is not a party to this Agreement and has no responsibility for SARSTREAM.

## KEY SAFETY TERMS

**PLEASE READ CAREFULLY. BY ACCEPTING, THE AGENCY GIVES UP LEGAL RIGHTS, INCLUDING THE RIGHT TO SUE FOR NEGLIGENCE.**

- **SARSTREAM IS NOT FOR EMERGENCY RELIANCE.** It is not 911, dispatch, a responder-tracking system or a flight reference. It can fail, freeze, lag, show old video that looks live, show wrong positions, or lose data, without warning, during a live search. **People could be hurt or die if it is relied on.**
- **The Agency will never rely on SARSTREAM alone** for any decision affecting anyone's safety, and keeps independent means of communication, command, navigation and accountability. Its own qualified people make every operational decision.
- **ASSUMPTION OF RISK.** The Agency uses SARSTREAM entirely at its own risk and assumes all risks of using and relying on it, including mission failure, loss of data, property damage, personal injury and death.
- **RELEASE.** To the fullest extent permitted by law, the Agency releases SARTech LLC, Boulder Emergency Squad and their people from all claims arising out of or related to SARSTREAM, **including claims based on their negligence** or on breach of warranty, and including claims for injury or death. Gross negligence, willful and wanton or reckless conduct, fraud, and anything else the law does not allow to be released are not released.

These Key Safety Terms are set out in full in Part B §2. If the wording here and in Part B §2 ever differs, Part B §2 controls.

# Part B — Terms

## 1. Parties, definitions and acceptance

1.1 **Provider.** SARSTREAM (the "**Service**") is provided and operated solely by SARTech LLC, a Colorado limited liability company (Colorado Secretary of State ID 20268074224) doing business as SARSTREAM ("**SARTech**", "**we**"). No individual person who works for SARTech is a party. A SARTech member who also volunteers for an agency (for example, BES) acts for SARTech only when providing the Service and for that agency only when volunteering for it.

1.2 **Boulder Emergency Squad is not a provider.** Boulder Emergency Squad ("**BES**") is an independent Colorado nonprofit. BES is not a provider, operator, developer, sponsor, partner, licensor or party to the Service or this Agreement, and has no responsibility for the Service. BES uses the Service as one agency on the same terms as every other agency. The Service having first been tested with BES does not mean BES makes any promise about it.

1.3 **Definitions.**

- "**Agency Data**" means everything the Agency or its Users put into or create in the Service: live and recorded video and audio, photos, drone, device and phone positions and telemetry, Detect leads, mission names and notes, map data sent to or from the Agency's own mapping accounts, and similar content.
- "**User**" means any individual the Agency allows to use the Service, by any method (email sign-in, join code, share link, publish key or controller pairing).
- "**SARTech Parties**" means SARTech LLC and its current and former members, managers, employees, contractors, agents and volunteers. "**BES Parties**" means BES and its current and former directors, officers, members and volunteers. "**Protected Parties**" means both.
- "**Public Agency**" means an Agency that is a Colorado public entity under C.R.S. 24-10-103 (including a county or sheriff's office) or any other governmental body.
- "**User Notice**" means the SARSTREAM User Notice & Privacy published at https://sarstream.org/legal/notice.

1.4 **Acceptance and electronic signature.** The person who accepts for the Agency represents that they are authorized to bind the Agency. An in-Service acceptance (three ticked boxes, typed name and title, and Accept) is the Agency's electronic signature under the federal E-SIGN Act and the Colorado Uniform Electronic Transactions Act. SARTech records each acceptance: the version and a fingerprint of this Agreement's exact text, the box wording, the date and time, the typed name and title, and technical details such as IP address and browser. The Agency can download a receipt.

1.5 **Users.** The Agency accepts this Agreement for itself and on behalf of everyone it allows to use the Service. SARTech does not ask individual Users to click anything. The Agency will make the User Notice available to its Users (for example, by sharing its link), will make sure its Users follow this Agreement and its own policies, and is responsible for its Users' use of the Service to the extent permitted by law.

1.6 **Consideration.** In exchange for access to the Service without charge, the Agency agrees to this Agreement, including the assumption of risk, release and limitation of liability.

## 2. KEY SAFETY TERMS — PLEASE READ CAREFULLY

**THIS SECTION CONTAINS AN ASSUMPTION OF RISK AND A RELEASE OF CLAIMS, INCLUDING CLAIMS FOR NEGLIGENCE. BY ACCEPTING THIS AGREEMENT, THE AGENCY GIVES UP LEGAL RIGHTS.**

2.1 **What SARSTREAM is.** SARSTREAM is a free, optional, experimental beta tool for sharing drone and camera video and positions with the Agency's own people. It **supplements** the Agency's radios, dispatch, maps, incident command system and procedures. It replaces none of them. Other ways of doing everything SARSTREAM does exist, and the Agency remains free to use them instead. SARSTREAM is offered only to agencies SARTech agrees to onboard, not to the public.

2.2 **WHAT IT IS NOT.** SARSTREAM IS NOT A 911 SERVICE, A DISPATCH OR COMPUTER-AIDED DISPATCH (CAD) SYSTEM, A RESPONDER-TRACKING OR ACCOUNTABILITY SYSTEM, A NAVIGATION, FLIGHT-CONTROL OR COLLISION-AVOIDANCE TOOL, OR A SYSTEM OF RECORD. IT IS NOT DESIGNED, TESTED OR CERTIFIED FOR LIFE-SAFETY USE.

2.3 **IT CAN FAIL OR BE WRONG — AT THE WORST POSSIBLE MOMENT.** At any time and without warning, including during a live search:

- the whole Service can be down, slow or unreachable;
- video can freeze, lag, drop out, or show an old picture that looks live;
- a feed can be labelled with the wrong drone, camera or person;
- positions, telemetry, camera footprints, map overlays and Detect leads can be wrong, late or missing;
- timestamps can be wrong;
- alerts, sign-in links, codes and emails can be late or never arrive;
- recordings, photos, tracks and notes can be lost or incomplete;
- cellular, satellite and other networks, and the drones, controllers, phones, browsers and companies SARSTREAM depends on, can fail or change in ways SARTech does not control.

2.4 **PEOPLE COULD BE HURT OR DIE.** IF THE AGENCY RELIES ON SARSTREAM AND IT FAILS OR IS WRONG, A SEARCH COULD BE DELAYED OR SENT TO THE WRONG PLACE, A SUBJECT MIGHT NOT BE FOUND IN TIME, AND RESPONDERS, SUBJECTS OR OTHERS COULD BE INJURED OR KILLED. PROPERTY COULD BE DAMAGED OR LOST.

2.5 **What the Agency promises.**

- **THE AGENCY WILL NEVER RELY ON SARSTREAM AS ITS ONLY OR MAIN SOURCE OF INFORMATION FOR ANY DECISION THAT AFFECTS ANYONE'S SAFETY.**
- The Agency will always keep independent ways to communicate, command, navigate and account for its people.
- All operational decisions remain with the Agency's own qualified people — its incident commanders, pilots and responders. SARSTREAM does not make operational decisions.
- The Agency will make sure its people understand this Section 2.

2.6 **No duty to rescue.** Nothing in this Agreement or in the Service creates any duty by SARTech or BES to search for, rescue or protect anyone, or any duty to the Agency beyond what this Agreement expressly says.

2.7 **ASSUMPTION OF RISK.** THE AGENCY USES SARSTREAM ENTIRELY AT ITS OWN RISK. THE AGENCY KNOWINGLY AND VOLUNTARILY ASSUMES ALL RISKS OF USING AND RELYING ON SARSTREAM, WHETHER KNOWN OR UNKNOWN, INCLUDING THE RISKS DESCRIBED IN THIS SECTION 2, AND INCLUDING THE RISK OF MISSION FAILURE, LOSS OF DATA, PROPERTY DAMAGE, PERSONAL INJURY AND DEATH.

2.8 **RELEASE.** TO THE FULLEST EXTENT PERMITTED BY LAW, THE AGENCY, FOR ITSELF AND ANYONE CLAIMING THROUGH IT, RELEASES, FOREVER DISCHARGES AND WILL NOT SUE ANY PROTECTED PARTY — SARTECH LLC AND ITS MEMBERS, MANAGERS, EMPLOYEES, CONTRACTORS, AGENTS AND VOLUNTEERS, AND BOULDER EMERGENCY SQUAD AND ITS DIRECTORS, OFFICERS, MEMBERS AND VOLUNTEERS — FOR ANY CLAIM, DEMAND, LOSS OR LIABILITY ARISING OUT OF OR RELATED TO SARSTREAM OR THIS AGREEMENT, **INCLUDING CLAIMS BASED ON A PROTECTED PARTY'S NEGLIGENCE OR ON BREACH OF WARRANTY**, AND INCLUDING CLAIMS FOR MISSION FAILURE, LOSS OF DATA, PROPERTY DAMAGE, PERSONAL INJURY OR DEATH.

2.9 **What is not released.** Nothing in this Agreement releases or limits liability for gross negligence, willful and wanton or reckless conduct, fraud, a claim based on a statutory or regulatory duty that the law does not allow to be released, or any other liability that cannot lawfully be released or limited. Any provision that would go further is limited only as much as necessary, and the rest still applies.

2.10 **Separate and independent.** The assumption of risk (2.7) and the release (2.8) are separate. If either is not enforced in any respect, the other still applies.

2.11 **Who is not bound.** This Section does not bind people who have not agreed to it, such as search subjects or the public, and gives them no rights. If the Agency is a Public Agency, Section 12 applies, and nothing here waives its protections under the Colorado Governmental Immunity Act.

2.12 **Why the Agency agrees.** The Agency receives the Service without charge, as an optional beta, in exchange for accepting this Section and the rest of this Agreement. The Agency confirms that it has read and understands this Section.

## 3. The Service — a free beta

3.1 **What it is.** The Service lets agencies share live drone and camera video, positions and related information among their own people, record it, and review it later.

3.2 **Free.** There are no fees. Any future fee would apply only under a separate written agreement the Agency signs (and, for a Public Agency, any required appropriation).

3.3 **Beta; no service levels.** The whole Service is a beta, and some features are more experimental than others (for example, phone streaming, Detect, automatic mission start and end, camera footprints, retention rules and mapping sync). **There is no service-level agreement**: no commitment about availability, uptime, latency, video quality, delivery of alerts or emails, support hours or fix times. Support, if any, is best-effort from a very small team.

3.4 **Changes and ending.** SARTech may change, suspend or end the Service or any feature at any time. Before a planned permanent shutdown, SARTech will try to give at least 30 days' email notice and a chance to request export (Section 9.9). An unplanned shutdown (for example, a provider failure or security incident) may happen without notice. SARTech may decline to onboard an agency.

3.5 **No reliance on the future.** The Agency does not rely on the Service continuing, improving, being supported or becoming a commercial product, or on any statement about future features.

## 4. Detect and other automated features

4.1 **What Detect does.** Detect automatically looks for possible people and heat signatures in drone video (by colour and thermal analysis) and shows them as "leads" for a person to check. Camera footprints, position overlays and other computed features work the same way: they are estimates.

4.2 **AN AID, NOT AN ANSWER.** DETECT WILL MISS PEOPLE AND WILL FLAG THINGS THAT ARE NOT PEOPLE. **AN EMPTY LEAD LIST DOES NOT MEAN AN AREA IS CLEAR**, AND A LEAD DOES NOT MEAN A PERSON IS THERE. A trained person must watch the video and check every lead.

4.3 **Never on Detect alone.** The Agency will never clear a search area, reduce search effort, or send people into danger based on Detect, a camera footprint or any other automated output alone. SARTech makes Detect available to the Agency; the Agency's people decide whether to turn it on for a mission, and the Agency can ask SARTech to make it unavailable.

4.4 **What Detect does not do.** Detect makes no decision about any individual. It does not identify people, does no facial recognition and creates no biometric identifiers. Section 9.2 describes how SARTech may use Agency Data to improve Detect.

4.5 **AI hint.** Where SARTech has turned it on, a User can ask for an AI hint on one lead: images of that lead are sent to an outside AI model (listed in the User Notice), which describes in words what it might be. The hint is a computer-written guess and can be wrong; check it against the video.

## 5. Agency responsibilities

5.1 **Lawful purposes.** The Agency will use the Service only for lawful search, rescue, emergency response, training, exercises and closely related public-safety work, in compliance with every law that applies to it and to Agency Data.

5.2 **Users and credentials.** The Agency decides who may use the Service on its behalf and at what level. It is responsible for adding and removing Users promptly (including former members), for keeping join codes, sign-in links, publish keys and controller pairings confidential, for rotating them when they may have leaked, and for everything done with its credentials.

5.3 **Minors.** Users must be at least 18, unless the Agency has the written consent of the User's parent or guardian under its own youth-membership policies before giving access. The Agency is responsible for that consent and for any parental release it wants under C.R.S. 13-22-107.

5.4 **Equipment and connectivity.** The Agency is responsible for its own drones, controllers, encoders, phones, computers, networks and cellular and satellite service, and for their configuration and security.

5.5 **Insurance.** The Agency will maintain, or self-insure through a public-entity pool, insurance appropriate to its operations, including aviation or drone liability insurance where it flies. SARTech is not an insurer of the Agency, its Users or anyone else.

## 6. Flight operations

6.1 **THE AGENCY AND ITS PILOTS ARE SOLELY RESPONSIBLE FOR THE SAFETY, LEGALITY AND CONDUCT OF ALL AIRCRAFT OPERATIONS**, including any operation whose video or data passes through SARSTREAM. SARTech does not operate, direct, supervise or control any aircraft and has no role in any decision to fly. The Agency accepts this Section for itself and for the pilots, visual observers and crew who fly for it.

6.2 **Aviation rules.** The Agency is responsible for compliance with all aviation laws and authorizations, including, as applicable: FAA Part 107 (or public aircraft operations under a Certificate of Waiver or Authorization) and any waivers; airspace authorizations and Special Governmental Interest or other approval for Temporary Flight Restrictions (14 CFR 91.137); Remote ID (14 CFR Part 89); coordination with manned aircraft and incident air operations; state, local, park and land-manager drone rules; and pilot qualification, training, currency and fitness.

6.3 **Never a flight reference.** The aircraft's own controller and app, visual observation and the Agency's procedures are the only flight references. Positions, heights, headings, footprints and maps in SARSTREAM are approximate and may be late or wrong. Pilots should not watch SARSTREAM in place of their controller.

6.4 **Equipment and funding rules change often.** SARSTREAM working with a brand of equipment (for example, DJI) is not a statement that it is permitted under any FCC, procurement, grant or federal-funding rule (for example, the FCC Covered List or limits on federally funded use of covered foreign-made drones). The Agency checks its own obligations.

6.5 **Crashes, injuries and damage.** The Agency is responsible for any accident, injury, death or property damage arising from its aircraft operations. Sections 2 and 11 (including, for non-public agencies, the indemnity in Section 11.4) apply to any such claim against a Protected Party.

## 7. Acceptable use

The Agency and its Users will not use the Service to:

- record, stream or share anyone in a way that violates the law or the Agency's policies — including filming into homes or other private spaces without lawful authority, or recording conversations in violation of eavesdropping laws;
- harass, stalk, surveil or track any person for any purpose other than an authorized mission;
- share images or video of victims, deceased persons, minors or medical situations outside the Agency's authorized channels;
- upload or stream unlawful, sexually explicit, hateful or infringing material;
- store the prohibited data listed in Section 9.4, or perform facial recognition;
- use the AI hint (Section 4.5) to identify, locate or follow a suspect or any other person for a law-enforcement investigation;
- share sign-in links, join codes, administrator access, publish keys or controller pairings with anyone the Agency has not authorized, or forward mission emails or viewer links outside the Agency except as Section 8 allows;
- access another agency's data, or any data or function the Agency has not been given;
- probe, scan or test the Service for vulnerabilities, or bypass any security or access control, without SARTech's written permission (please report security problems to support@sarstream.org instead);
- overload the Service, send automated traffic other than through SARSTREAM's own apps and documented interfaces, or interfere with other users; or
- copy, reverse engineer, resell or build a competing service from the Service, except as the law expressly allows.

## 8. Sharing with other agencies

8.1 **The sharing agency decides.** When the Agency gives people from another organization access to its streams, maps, recordings or data (by viewer link, join code, administrator link, email, an external link interface, or by adding them as Users), that is the Agency's decision and responsibility. It decides what to share, with whom and for how long, confirms the sharing is lawful and consistent with its policies, and revokes access when the need ends. Those people use the Service as the Agency's Users.

8.2 **Each agency bears its own risk.** Each agency is responsible for its own people, operations and decisions, including any decision made using another agency's feed. **No agency should rely on another agency's feed for a life-safety decision**, any more than on its own. SARTech and BES are protected under Sections 2 and 11 whichever agency's feed is involved. Agencies may allocate responsibility between themselves in their own mutual-aid agreements; SARTech is not a party to them.

## 9. Agency Data

9.1 **Ownership.** As between the Agency and SARTech, the Agency owns all Agency Data. SARTech claims no ownership of it.

9.2 **SARTech's limited licence.** The Agency grants SARTech a non-exclusive, royalty-free licence to host, store, copy, transmit, process and display Agency Data only as needed to provide, secure, back up, support, fix and improve the Service, to follow the Agency's instructions, and to comply with law. Improving the Service includes testing it and training or tuning models used only in the Service (for example, Detect) with Agency Data, within SARTech and its service providers acting for it. SARTech will not sell Agency Data, use it for advertising, disclose it or any dataset or model made from it except to its service providers acting for it, as the Agency directs or as Section 9.12 allows, or use it in marketing or publicity without the Agency's written permission (Section 13.3). The Agency may opt out of this improvement use at any time by email to support@sarstream.org. Within 30 days SARTech will then stop that use and remove the Agency's data from its development, test and training copies; copies left in backups, with providers or in source-code history are kept only as described in Section 9.8 and the User Notice and are not used for further improvement. SARTech need not retrain models already built.

9.3 **Roles.** Apart from the improvement use in Section 9.2, the Agency alone decides why and how Agency Data is collected, used, shared, retained and deleted. It is the owner and controller of Agency Data, the "covered entity" or "governmental entity" for Colorado data-security and breach-notice purposes, and the custodian of Agency Data for open-records purposes. SARTech maintains and processes Agency Data on the Agency's behalf as its service provider. Settings the Agency chooses (recording, Detect, public listing, sharing links, mapping integration, and any retention period it asks SARTech to set) are the Agency's instructions.

9.4 **The Agency's legal duties; prohibited data.** The Agency is solely responsible for complying with every law, policy and agreement that applies to Agency Data — privacy and surveillance laws, recording of audio (including Colorado's eavesdropping laws) by phones and body cameras, notices to and consents from the people it records and from its own Users, open-records and criminal-justice-records laws, records-retention schedules, litigation holds and evidence duties, and its own policies on recording victims, the deceased, minors and private property. The Agency will limit sensitive content to what its mission requires. The Agency will not put into the Service, and will promptly remove if put in by mistake:

- **criminal justice information** subject to the FBI CJIS Security Policy (for example NCIC or CCIC results or criminal history) — SARTech is not a CJIS-vetted vendor;
- **protected health information** on behalf of a HIPAA covered entity — SARTech does not sign business associate agreements;
- **biometric identifiers**; or
- payment-card data, Social Security numbers or other government identification numbers.

9.5 **NOT AN EVIDENCE SYSTEM.** The Service has no tamper-evident storage, file hashing, chain-of-custody log or guaranteed clock, and recordings may be segmented, stitched, have gaps, be deleted by administrators or retention settings, or be incomplete. **SARTECH DOES NOT WARRANT THAT ANY AGENCY DATA IS COMPLETE, ACCURATE, UNALTERED OR ADMISSIBLE.** The Service is not a backup or archive. If the Agency may need Agency Data as evidence or as a record, it must export it promptly and keep it under its own procedures.

9.6 **Retention.** Recordings and photos are kept until the Agency deletes them or until a retention period the Agency asks SARTech to set passes. Other Agency Data is kept until the Agency's data is deleted under Section 9.8. The Agency is responsible for choosing a period that meets its records-retention obligations. The current retention schedule for each kind of data is published in the User Notice.

9.7 **Holds.** If the Agency sends SARTech a written request to preserve named missions or data, SARTech will make reasonable efforts to suspend deletion of that data (including automatic retention) until the Agency withdraws the request. The Agency remains responsible for exporting and preserving what it needs.

9.8 **Deletion of all Agency Data.** On a written request from an authorized administrator to support@sarstream.org, confirmed by SARTech with the Agency, SARTech will first offer an export and then, **within 30 days**, delete the Agency's recordings, photos and database records from the Service's live systems and the Agency's data from SARTech's development, test and training copies, and confirm in writing. Copies then remain only as follows:

- **Off-site backups.** SARTech's automatic encrypted off-site backups are kept for one year, so they expire **within 13 months after the deletion**. They are used only to recover the Service from a disaster; if a recovery brings back any of the Agency's deleted data, SARTech deletes it again, and it is never disclosed from them except as the law requires (Section 9.12).
- **Operational records.** System and web-server logs and the raw capture of messages from drones and controllers mix the activity of several agencies and cannot be separated per agency. SARTech keeps them as encrypted or access-restricted operational records, used only to run, secure, troubleshoot and fix the Service.
- **Other operational copies.** Safety copies made before software updates and SARTech's encrypted workstation backups expire on their own schedules **within 12 months**. Copies of emails SARSTREAM sent stay in SARTech's access-restricted sending mailbox, and a few small test images cut from agency video may remain in the history of SARTech's private source-code repository. SARTech will delete any of these sooner on request where reasonably practical.
- **The final export.** The export prepared before the deletion is kept, encrypted, until the Agency asks SARTech to delete it.

Deletion does not reach copies outside SARTech's control (downloads, delivered emails, the Agency's own CalTopo or DJI accounts, or data shared with others), or models already built (Section 9.2). SARTech keeps the Agency's name and identifier, records of its acceptance of this Agreement, agency-level audit records and the usage totals recorded in its deletion confirmation as its own business records.

9.9 **Export.** On a written request from an authorized administrator, SARTech will provide, **within 30 days**, a copy of the Agency's database records in a structured format and its recordings and photos in their stored formats, by secure download link or by copying to storage the Agency controls. After the Service or the Agency's participation ends, the Agency may request export for at least 30 days, unless that ability has been lost through circumstances beyond SARTech's control.

9.10 **Security.** SARTech will maintain reasonable security procedures and practices appropriate to the nature of Agency Data and to the nature and size of SARTech's business (C.R.S. 6-1-713.5 and 24-73-102). **NO SYSTEM IS PERFECTLY SECURE, AND SARTECH DOES NOT GUARANTEE THAT AGENCY DATA WILL NOT BE ACCESSED, DISCLOSED, ALTERED OR LOST.** SARTech holds no formal certification (such as SOC 2, CJIS, HIPAA or FedRAMP). Its current practices are described in the User Notice.

9.11 **Security incidents.** If SARTech confirms unauthorized access to, or acquisition, disclosure or loss of, Agency Data or Agency account credentials held by SARTech, it will notify the Agency's administrators by email without unreasonable delay, and **in any event within 72 hours after confirming it**, with what it knows at the time, will update the Agency as it learns more, and will cooperate reasonably with the Agency's investigation, at no charge. The Agency decides whether and how to notify individuals, the Colorado Attorney General or others (for example, under C.R.S. 6-1-716 or 24-73-103). A notice is not an admission of fault. The Agency will tell SARTech promptly at support@sarstream.org if it suspects a compromise.

9.12 **Records requests, subpoenas and law enforcement.** Agency Data belongs to the Agency. SARTech will disclose it to anyone else only (a) with the Agency's written authorization, (b) when compelled by valid legal process properly served on SARTech LLC, or (c) in an emergency, if SARTech believes in good faith that disclosure without delay is necessary to prevent death or serious physical injury. For any request, SARTech will ask the requester to go to the Agency, notify the Agency's administrators within 2 business days and before disclosing (unless the law forbids notice or notice would risk death or serious injury, in which case it will notify once that reason ends), may object to an overbroad or invalid request, and will disclose only what it is required to. SARTech is not a public body and does not answer open-records (CORA or Criminal Justice Records Act) requests for any agency; it forwards them to the Agency, and helps retrieve records at the Agency's written direction. SARTech does not comment to the media about any agency's missions or data. An Agency's own access to its own data is not a request under this Section.

9.13 **Service providers.** SARTech uses a small number of providers (hosting, storage, email, maps and development tools) to run and improve the Service; they are listed in the User Notice. Providers for Detect's AI hint and the airspace overlay receive data from an Agency's missions only when that feature is on for the Agency. SARTech will email the Agency's administrators at least 30 days before adding a provider that would receive mission video or location data (or as soon as possible if a change is urgent, for example to replace a failing provider). If the Agency objects, it may stop using the Service and request export and deletion.

9.14 **Responsibility for Agency Data claims.** As between the Agency and the Protected Parties, the Agency is responsible for any claim that Agency Data, or the Agency's collection, use or sharing of it, violates any law or anyone's rights (Section 11.4 applies to non-public agencies; Section 12 to Public Agencies).

## 10. Third-party services

The Service depends on products, services and networks SARTech does not control — drones, controllers and their apps, firmware and clouds (for example DJI); mapping (the Agency's own CalTopo/SARTopo account, Google Maps, public elevation data); hosting, storage, DNS, email and certificate providers; cellular, satellite and radio networks; and phones, computers, operating systems and browsers. They can fail, change or end without notice, and when they do the Service may stop working or give wrong results. SARTech is not responsible for them, their terms or how they handle data. The Agency's use of its own third-party accounts is governed by its agreements with those providers. SARSTREAM working with a third-party product is not an endorsement of it and not a statement that it meets any legal, procurement, grant or security requirement. Sections 2 and 11 apply to any failure, error or change in a third-party service.

## 11. Disclaimers, limitation of liability and indemnity

11.1 **DISCLAIMER OF WARRANTIES.** TO THE FULLEST EXTENT PERMITTED BY LAW, THE SERVICE, ALL AGENCY DATA AS PROCESSED BY IT, AND ALL DOCUMENTATION, TRAINING, ADVICE AND SUPPORT ARE PROVIDED "**AS IS**" AND "**AS AVAILABLE**", WITH ALL FAULTS. SARTECH, FOR ITSELF AND ALL PROTECTED PARTIES, DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY IMPLIED WARRANTIES OF **MERCHANTABILITY**, **FITNESS FOR A PARTICULAR PURPOSE**, TITLE, NON-INFRINGEMENT AND ACCURACY, AND ANY WARRANTY THAT THE SERVICE WILL BE AVAILABLE, TIMELY, UNINTERRUPTED, SECURE OR ERROR-FREE, OR THAT ANY VIDEO, POSITION, TELEMETRY, MAP, DETECT LEAD, TIMESTAMP, ALERT OR RECORDING WILL BE ACCURATE, CURRENT OR COMPLETE. ANY HELP SARTECH GIVES IS A COURTESY; THE AGENCY DECIDES FOR ITSELF WHETHER TO ACT ON IT. BES MAKES NO REPRESENTATION OR WARRANTY OF ANY KIND ABOUT THE SERVICE.

11.2 **NO INDIRECT DAMAGES.** TO THE FULLEST EXTENT PERMITTED BY LAW, NO PROTECTED PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOSS OF DATA, LOSS OF USE, MISSION FAILURE, COST OF SUBSTITUTE SERVICES OR LOSS OF GOODWILL, HOWEVER CAUSED AND UNDER ANY THEORY, EVEN IF ADVISED OF THE POSSIBILITY.

11.3 **$100 TOTAL CAP.** TO THE FULLEST EXTENT PERMITTED BY LAW, THE TOTAL LIABILITY OF ALL PROTECTED PARTIES TOGETHER, FOR ALL CLAIMS OF ANY KIND ARISING OUT OF OR RELATED TO THE SERVICE OR THIS AGREEMENT, WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US $100). The Agency agrees these limits are reasonable because the Service is free, optional and experimental, the Agency keeps operational control and independent means of communication, and SARTech is not an insurer. Section 2.9 applies to this Section 11.

11.4 **Agency indemnity (non-public agencies only).** To the fullest extent permitted by law, an Agency that is not a Public Agency will defend, indemnify and hold harmless each Protected Party from any third-party claim, demand, loss, liability, damage, fine, cost and expense (including reasonable attorneys' fees) arising out of or related to: (a) the Agency's or its Users' use of the Service; (b) Agency Data; (c) the Agency's drone or other operations in which the Service is used, including any search, rescue or training activity; (d) a breach of this Agreement by the Agency or its Users; or (e) the Agency's or its Users' violation of law. **This indemnity applies even if the claim alleges that a Protected Party was negligent**, but not to the extent a claim is finally determined to have been caused by that Protected Party's gross negligence or willful and wanton conduct. The Protected Party will give prompt notice (a delay excuses the Agency only to the extent it is actually prejudiced), reasonable cooperation at the Agency's cost, and control of the defense, except that the Agency may not settle in a way that admits fault by, or imposes an obligation on, a Protected Party without its written consent. A Public Agency gives no indemnity (Section 12).

11.5 **Protected Parties.** Each Protected Party is an intended third-party beneficiary of Sections 2, 4, 6, 9.5, 10, 11 and 15.1, and may enforce them directly. No one else is a third-party beneficiary of this Agreement; in particular, it gives no right to any search subject, their family, a bystander, another agency or the public. The Agency will not bring any claim against any BES Party arising out of or related to the Service. The $100 cap is a single cap shared by all Protected Parties.

11.6 **No personal liability.** To the fullest extent permitted by law, the Agency will look only to SARTech LLC, and not to any of its individual members, managers, employees, contractors, agents or volunteers personally, for any claim arising out of or related to the Service or this Agreement, except for an individual's gross negligence, willful and wanton conduct or fraud.

## 12. Public Agencies

This Section applies automatically when the Agency is a Public Agency, and controls over the rest of this Agreement where they conflict.

12.1 **Approval.** A Public Agency accepts through whatever approval process its law and policies require (for example, approval or delegation by its board of county commissioners). SARTech may accept the Public Agency's own signed approval of this Agreement instead of an in-Service acceptance. A volunteer team that works with a sheriff's office but is a separate legal entity (for example, a nonprofit search and rescue team) is not a Public Agency, and its acceptance does not bind the county or sheriff's office.

12.2 **No indemnity.** The Public Agency gives no indemnity, hold-harmless or defense obligation under Section 11.4 or anywhere else in this Agreement.

12.3 **Own acts; no waiver of immunity.** Each party is responsible for its own acts and omissions and those of its officers, employees and agents, to the extent provided by law. Nothing in this Agreement waives, or will be interpreted as waiving, any immunity, right, limitation, notice requirement or other protection of the Colorado Governmental Immunity Act, C.R.S. 24-10-101 et seq., or any other immunity available to the Public Agency or its officers, employees or volunteers.

12.4 **Release and limits only as far as lawful.** The assumption of risk, release, disclaimers and limitation of liability apply to the Public Agency to the fullest extent it may lawfully agree to them. If a law applicable to the Public Agency makes a provision void or unenforceable as to it (for example, a limit on a contractor's liability), that provision does not apply to it to that extent, and everything else remains in effect.

12.5 **No cost; appropriation.** The Service is free, and nothing in this Agreement creates any financial obligation of the Public Agency. Any future fee would require a separate written agreement and would be subject to annual appropriation (C.R.S. 29-1-110; Colo. Const. art. X, §20).

12.6 **Open records.** The Public Agency may disclose any records subject to public release under the Colorado Open Records Act or the Criminal Justice Records Act, including this Agreement.

12.7 **Law and venue.** Colorado law governs. Any lawsuit between SARTech and the Public Agency will be brought in the district court for the county in which the Public Agency is located (or, for a state agency, the City and County of Denver). Nothing requires the Public Agency to arbitrate.

12.8 **Insurance.** The Public Agency may meet Section 5.5 through commercial insurance or self-insurance, including a public-entity risk pool.

12.9 **Changes.** A new version of this Agreement applies to the Public Agency only when it accepts it through its own approval process; until then, the version it last accepted continues to apply.

12.10 **Termination.** The Public Agency may stop using the Service and end this Agreement at any time by notice, without penalty.

## 13. Ownership, marks, feedback and publicity

13.1 **The Service.** SARTech and its licensors own the Service, its software, designs and documentation. The Agency receives a limited, revocable, non-exclusive, non-transferable right to use the Service under this Agreement while it is in effect.

13.2 **Agency marks; feedback.** The Agency keeps all rights in its name, logo and insignia and lets SARTech display them within the Service to the Agency's own Users (and, if the Agency opts in, on the public agency list). SARTech may freely use suggestions and ideas about the Service; feedback never includes Agency Data.

13.3 **Publicity.** SARTech will not use the Agency's name, logo, insignia, mission information or Agency Data in any presentation, marketing, publicity or public demonstration without the Agency's prior written permission (email is enough), which the Agency may withdraw at any time for future uses.

## 14. Changes, suspension and termination

14.1 **Changes to this Agreement.** For a material change, SARTech will give the Agency at least 30 days' notice by email to its administrators and in the Service, with a summary of what changed. A new version applies to the Agency when the Agency accepts it in the Service or in writing; changes apply only going forward and never to a dispute that arose before the change. If the Agency does not want to accept a new version, it may stop using the Service and request export. Non-material changes (corrections, clarifications, updated contact details) take effect when posted. SARTech will not stop or restrict any User, mission or live video because an Agency has not yet accepted a new version.

14.2 **The User Notice.** SARTech may update the User Notice (including its provider list, security description and retention schedule) by posting a new dated version. Updates to the User Notice do not change this Agreement; the commitments in this Agreement (including Sections 9.8–9.13) control.

14.3 **Suspension.** SARTech may suspend the Agency's or any User's access, revoke credentials or remove content if SARTech believes it is needed to protect the Service, other agencies, any person or Agency Data (for example, leaked credentials or misuse), to investigate a breach of this Agreement, or to comply with law. SARTech will try not to interrupt an active mission and to give notice, but is not required to.

14.4 **Termination.** Either party may end this Agreement at any time by notice. SARTech may also end the Service for everyone (Section 3.4). After termination, the Agency may request export (Section 9.9) and deletion (Section 9.8).

14.5 **Survival.** Sections 2, 4, 9, 11, 12, 15 and any other terms that by their nature should survive, survive termination.

## 15. General

15.1 **Law and courts.** This Agreement is governed by Colorado law, without regard to conflict-of-laws rules. Any lawsuit arising out of or related to the Service or this Agreement will be brought only in the state courts for Boulder County, Colorado, or the United States District Court for the District of Colorado (for a Public Agency, see Section 12.7), and each party consents to their jurisdiction. Before filing any claim, the party with the dispute will notify the other in writing and both will try in good faith to resolve it for at least 30 days, except where urgent relief is needed or a deadline would otherwise pass.

15.2 **Entire agreement; order of precedence.** This Agreement (Parts A and B) is the entire agreement about the Service and replaces any earlier understandings and drafts. The User Notice is information for Users and is not part of this Agreement. If parts of this Agreement conflict: (1) Section 12 controls for a Public Agency; then (2) Part B Section 2; then (3) the rest of Part B; then (4) Part A. A plain-English summary never controls.

15.3 **Severability.** If any provision is held invalid or unenforceable, it will be enforced to the maximum extent permitted and interpreted to come as close as lawfully possible to its intent, and the rest of this Agreement remains in effect.

15.4 **Assignment.** The Agency may not assign this Agreement without SARTech's written consent. SARTech may assign it in connection with a merger, reorganization or sale of all or substantially all of the business or assets of the Service, after at least 30 days' notice, during which the Agency may request export and deletion.

15.5 **Notices.** Notices to SARTech go by email to **support@sarstream.org** and by mail to SARTech LLC, 1035 Pearl St Ste 400, Boulder, CO 80302 (also the address for service of process, along with SARTech's registered agent on file with the Colorado Secretary of State). Notices to the Agency may be sent by email to any of its administrators listed in the Service, or by mail to the address it gives. Email notice is effective when sent unless the sender learns it was not delivered.

15.6 **Force majeure.** SARTech is not responsible for any failure or delay caused by events beyond its reasonable control, including outages of hosting, storage, email, mapping, DNS or internet providers, cellular, satellite or radio networks, drone or controller platforms, power, wildfire, severe weather, natural disasters, pandemics, cyberattacks or acts of government.

15.7 **Other terms.** A failure to enforce a provision is not a waiver of it. The parties are independent contractors; nothing creates a partnership, joint venture, agency, employment or fiduciary relationship. Headings are for convenience, and "including" means "including without limitation". Questions: **support@sarstream.org**.