Please read the following carefully. These Terms of Use (these "Terms") govern your access to and use of xFigura, Inc.'s ("xFigura," "we," "us," "our") website at https://xfigura.ai (the "Site") and the products and services provided by xFigura (collectively, the "Service").

PLEASE READ THESE TERMS CAREFULLY BEFORE USING THE SERVICE. IF YOU DO NOT AGREE TO THESE TERMS, YOU ARE NOT AUTHORIZED TO USE THE SERVICE AND YOU MUST PROMPTLY CEASE USING IT.

By agreeing to these Terms, you expressly agree to the arbitration of all Disputes as further described in Section 20 below. The parties agree to arbitrate solely on an individual basis, and that these Terms do not permit class arbitration, or any claims brought as a plaintiff or class member in any class or representative arbitration proceeding.

• Your Access to the Service
• Permitted Use and Restrictions
• Privacy
• Artificial Intelligence
• No Professional Services or Advice
• User Accounts and Security
• Terms of Sale and Payments
• Subscriptions
• Submitted Content
• Idea Submissions
• Intellectual Property Rights
• DMCA Notice
• Third-Party Sites and Services
• Indemnity
• Warranty Disclaimer
• Limitation of Liability
• Termination
• Communication Between Us
• Governing Law
• Dispute Resolution
• Notice for California Residents
• Notice for New Jersey Residents
• Additional Important Terms
• Changes to These Terms
• Contact Information
• Data Processing Addendum

1. Your Access to the Service

1.1 Internet Access

When using the Service on your mobile, laptop, desktop, or other device ("Device"), you acknowledge and agree that you are responsible for: (i) maintaining Internet access for your Device; and (ii) any Internet connection and telecommunications fees and charges that you incur.

1.2 Your Device

xFigura is not responsible for the operation of your Device. You are responsible for ensuring the system functions of your Device are in working order when accessing the Service, including, but not limited to screen display operation features of your Device.

1.3 No Guarantee

Access to the Service may be suspended temporarily and without notice: (i) in the event of a system failure; (ii) for maintenance or repair; (iii) where we reasonably suspect there has been a breach of these Terms; (iv) for reasons reasonably beyond our control; or (v) as otherwise explained in these Terms.

2. Permitted Use and Restrictions

2.1 License Grant

Subject to the terms and conditions of these Terms, xFigura hereby grants you a limited, non-exclusive, personal, non-transferrable, non-sublicensable, non-assignable license to access and use the Service (including updates and upgrades that replace or supplement it in any respect and are not distributed with a separate license, and any documentation) solely for your personal use on a Device that you own or control. We reserve all other rights that are not granted in these Terms.

2.2 Use Restrictions

You may not access or use the Service in any way that is not expressly permitted by these Terms. You may not: (i) cause, permit or authorize the modification, copying, creation of derivative works, translation, reverse engineering, decomplication, disassembly, or hacking of the Service; (ii) sell, assign, rent, lease, or grant rights in the Service, including, without limitation, through sublicense, to any other person or entity; or (iii) use the Service for any unlawful, prohibited, abnormal, or unusual activity as determined by xFigura in its sole discretion.

2.3 Export Controls and Sanctions

You may not use the Service or any AI Services in violation of applicable export control or sanctions laws, including by using the Service in any prohibited jurisdiction or for any prohibited end use.

2.4 Eligibility

The Service may not be used by anyone under the age of 18 except as described in this Section. By accessing or using the Service, you represent and warrant that you are at least 18 years of age (or the age of legal majority under applicable law), or, if not, that you: (i) have reviewed these Terms with your parent or legal guardian and that they have agreed to be bound by these Terms; or (ii) are accessing the Service as a permitted user of an account created and managed by a teacher, school, or school district in connection with an educational program.

2.5 Investigations

We may, but are not obligated to, monitor, or review the Service at any time. If we become aware of any possible violations by you of these Terms, we reserve the right to investigate such violations, and we may, at our sole discretion, immediately terminate your license to use the Service pursuant to Section 17 (Termination) below.

2.6 Violation of these Terms

You must not use (or permit a third-party to use) the Service: (i) in any unlawful manner, for any unlawful purpose, or to act fraudulently or maliciously, for example, by hacking into or inserting malicious code, including viruses, or harmful data, into the Service or any operating system used by the Service; (ii) in a way that could damage, disable, overburden, impair or compromise our systems or security, or interfere with other users; (iii) to collect or harvest any information or data from the Service or our systems or attempt to decipher any transmissions to or from the servers running the Service; (iv) via use of a robot, spider, or other automated device to monitor or copy the Service or any information provided by the Service, other than as permitted by the robots.txt file for the Site; (v) to send, knowingly receive, upload, download, use or re-use any material which does not comply with these Terms; or (vi) to transmit, or procure the sending of, any unsolicited or unauthorized advertising or promotional material or any other form of similar solicitation (spam). You acknowledge and agree that you are solely responsible, and xFigura has no responsibility or liability to you or any other person or entity for, any breach by you of these Terms or for the consequences of any such breach.

3. Privacy

These Terms also incorporate the terms of our Privacy Policy (as updated from time-to-time). Our Privacy Policy explains how your personal information will be collected and used as well as other information regarding your privacy. By agreeing to these Terms, you acknowledge that you have reviewed the Privacy Policy and understand that your personal information will be handled in accordance with the Privacy Policy.

4. Artificial Intelligence

The Service may provide users with access to artificial intelligence image generation technologies and models (collectively, "AI Services"). By using any AI Services through the Service, you acknowledge and agree to be bound by the terms of this Section 4 (Artificial Intelligence).

Certain AI Services are made available directly by xFigura as part of the Service (the "Enterprise Models"). A current list of Enterprise Models is available at https://xfigura.notion.site/.

In addition, the Service may permit you to connect and use image generation models or services provided by third parties ("Third-Party Models"). Your use of any Third-Party Model is subject to your separate agreement with the applicable provider and remains subject to these Terms. xFigura does not control, operate, endorse, or assume any responsibility for any Third-Party Model, and makes no representations or warranties with respect to any Third-Party Model or any AI Output generated thereby.

4.1 Definitions

The following terms shall have the meanings set forth below:

"AI Content" means, collectively, AI Input and AI Output.

"AI Input" means information, data, materials, text, prompts, images, or other content that is (i) input, entered, posted, uploaded, submitted, transferred, transmitted, or otherwise provided or made available for processing by or through AI Technology, or (ii) collected, downloaded or otherwise received by AI Technology.

"AI Output" means information, data, materials, text, images, or other content (including numbers, images, photos, graphics, video, audio, or computer code) generated, produced, or otherwise output by AI Technology.

"AI Technology" means any and all machine learning, deep learning, and other artificial intelligence ("AI") technologies, including statistical learning algorithms, models (including large language models ("LLMs")), neural networks, and other AI tools or methodologies, all implementation of any of the foregoing, and related hardware or equipment capable of generating various types of content (including text, images, video, audio, or computer code) based on user-supplied prompts ("Generative AI Tools").

4.2 Your AI Content

You may provide AI Input into the Service and receive AI Output generated in response to your AI Input through the applicable AI Technology. You are responsible for ensuring that your use of any AI Technology, including the contents of your AI Input, complies with all applicable laws and these Terms.

You represent and warrant that you have all necessary rights, licenses, and permissions to provide your AI Input and to use any resulting AI Output in connection with the Service.

4.3 Ownership of AI Content

As between you and xFigura, and as permitted by applicable law, you retain ownership of your AI Input and any AI Output generated through Enterprise Models in response to your AI Input.

With respect to AI Output generated through any Third-Party Model, ownership, usage, and license rights, if any, are determined by your agreement with the applicable third-party provider. Your use of any such AI Output through the Service remains subject to these Terms, including all applicable use restrictions, prohibitions, and compliance obligations. xFigura makes no representations or warranties regarding the ownership, originality, or permitted uses of any AI Output generated through a Third-Party Model.

4.4 Similarity of AI Content

Due to the nature of AI Technology, AI Output may not be unique, and other users may receive similar or identical outputs in response to similar or different inputs. xFigura does not guarantee the uniqueness of any AI Output.

4.5 Our Use of AI Content

Notwithstanding anything to the contrary herein, xFigura may store and use AI Content generated through Enterprise Models to provide, maintain, develop, and improve the Service, comply with legal obligations, enforce these Terms and other policies, and ensure the safety and integrity of the Service.

By submitting AI Input to, or receiving AI Output from, any Enterprise Model, you grant xFigura a worldwide, royalty-free, transferable, sublicensable, and assignable license to use your AI Content for the foregoing purposes in accordance with these Terms and our Privacy Policy.

With respect to AI Content processed through any Third-Party Model, you grant xFigura a limited, non-exclusive, royalty-free license to host, store, reproduce, display, transmit, and otherwise process such AI Content solely as necessary to provide, operate, and support the Service and facilitate your use of such Third-Party Model. xFigura shall not use any such AI Content to train, fine-tune, or improve any AI models and shall not use such AI Content for any purpose other than providing the Service, except as permitted by these Terms or required by law.

Except as expressly set forth above, xFigura does not acquire any ownership or other rights in or to any AI Content processed through a Third-Party Model.

4.6 Accuracy and Limitations

AI and machine learning technologies are probabilistic and may produce inaccurate, incomplete, or misleading results. When using any AI Technology, you acknowledge and agree that:

• AI Output may not be accurate or reliable;
• AI Output should not be relied upon as a substitute for professional judgment or advice; and
• You are responsible for independently reviewing and validating AI Output before using or sharing it.

4.7 No Rights Clearance or Legal Advice

xFigura does not provide legal, intellectual property, or rights clearance services and does not represent or warrant that any AI Output may be lawfully used for any particular purpose. xFigura does not determine, and does not advise you regarding, whether you have the right to use, reproduce, modify, distribute, publicly display, or otherwise exploit any AI Output.

You are solely responsible for determining whether your use of any AI Output requires permission, licenses, releases, or other rights from any third party, and for obtaining any such permissions or rights prior to any use of such AI Output. Without limiting the foregoing, you are solely responsible for ensuring that your use of any AI Output complies with applicable law and does not infringe, misappropriate, or otherwise violate the rights of any third party.

4.8 Use Restrictions

You agree not to use any AI Technology made available or accessible through the Service, including any Enterprise Models or Third-Party Models, to:

• Violate applicable law or the rights of any third party;
• Violate these Terms or our Privacy Policy;
• Submit AI input that is unlawful, infringing, defamatory, abusive, harassing, discriminatory, or otherwise objectionable;
• Reverse engineer, decompile, or attempt to discover the underlying models, algorithms, or source code;
• Abuse, disrupt, or interfere with the Service or any AI Technology; or
• Develop or train competing models or services using the Service or Enterprise Models.

4.9 Prohibited Use of Service Data with Other AI Technologies

For the avoidance of doubt, you may not use any data, content, materials, or information obtained from or through the Service, or provided by xFigura, as AI Input to train, fine-tune, validate, or improve any AI Technology (including any Third-Party Model) without xFigura's prior written consent. Any violation of this Section constitutes a material breach of these Terms.

5. No Professional Services or Advice

The Service and any AI Output are provided for general informational and creative purposes only and do not constitute professional, architectural, engineering, or design advice. xFigura does not provide professional services and does not assume any responsibility for compliance with building codes, safety requirements, engineering standards, or professional obligations. You are solely responsible for any professional judgment and for ensuring that any use of AI Output complies with applicable laws, regulations, and professional standards.

6. User Accounts and Security

6.1 User Accounts

To use certain features of the Service, you may be required to create an account and provide us with your name, email address, password, and certain other information about yourself. In certain educational contexts, an account may be created and managed by a teacher, school, or school district, and students or other individuals may be permitted to access and use the Service through such account.

You are solely responsible for the information associated with your account and anything that happens related to your account, including any access to or use of the Service by permitted users. You agree to provide true, accurate, current, and complete information as requested by any forms and maintain and update such information to keep it true, accurate, current, and complete. Your failure to maintain true, accurate, current, and complete account information may result in your inability to access or use the Service.

6.2 Account Security

Maintaining account security is very important. You are solely responsible for maintaining the confidentiality of your account passwords. You agree to notify us immediately if you become aware of any unauthorized use of your password or your account at info@xfigura.ai.

6.3 Account Sharing or Transfers

Accounts are registered to the individual or entity that created the account and may not be sold, traded, gifted, or otherwise transferred at any time under any circumstances. Except as expressly permitted for authorized or permitted users under a teacher-, school-, or district-managed account, you may not share your account with, or disclose your password or other authentication credentials to, anyone else.

6.4 Fees

You agree to pay all fees and taxes incurred by you or anyone using your account. YOU ACKNOWLEDGE THAT YOU ARE FULLY LIABLE FOR ALL CHARGES TO YOUR ACCOUNT, INCLUDING ANY UNAUTHORIZED CHARGES.

6.5 Account Deletion by You

You may delete your account at any time by contacting us as described in Section 25 (Contact Information) below.

6.6 Account Deletion by Us

xFigura may terminate your account at any time for any reason or no reason, including if: (a) xFigura determines that you are (i) in breach of or otherwise acting inconsistently with these Terms or (ii) engaging in fraudulent or illegal activities or other conduct that may result in liability to xFigura; (b) xFigura determines it is required by law to terminate your account; or (c) xFigura decides to stop providing the Service or critical portions of the Service. When terminating your account, xFigura may delete your account and the information in it. You have no ownership rights to your account.

7. Terms of Sale and Payments

7.1 Billing Policies

If you choose, at your sole discretion, to purchase products or services, you acknowledge that you will be required to provide a current, valid, accepted method of payment ("Payment Method") and you agree that we may charge your Payment Method. xFigura uses authorized third parties for the purposes of processing your transactions and credit card authorizations. By submitting Payment Method details to us or our third-party processors, you grant (or otherwise authorize) xFigura the right to store and process your information with such third parties. You agree to immediately notify xFigura of any change in your billing address or the Payment Method used for payment hereunder. You agree that xFigura will not be responsible for any failures of such third parties to adequately protect your information.

You shall be responsible for all charges incurred through your account as well as for paying any applicable taxes and possible transaction fees. By providing xFigura with your Payment Method, you agree that xFigura (or its third party service providers) is authorized to immediately charge your Payment Method for all fees and charges due and payable to xFigura as a result of your order, including but not limited to service fees, Subscription Fees (defined below), transaction fees, overdraft fees, or any other fee or charge associated with your access to the Service and/or purchase of products.

7.2 Currency

All prices are listed in US dollars and all payments must be made in US dollars. xFigura will not be responsible for any exchange rates or fees incurred by you from your chosen Payment Method.

7.3 Product and Service Availability

We cannot guarantee the availability of a particular product or service at any particular time, and we reserve the right to change and/or cancel our product and service offerings through the Service, without notice, at any time. All prices displayed through the Service are exclusive of taxes, if any. All orders are subject to acceptance and availability. In certain circumstances, products or services may become unavailable after an order has been placed. In such a case, we will either notify you that we are unable to process your order, or a refund will be issued to you for the amount paid.

7.4 Personal Use

All products and services sold by or received from xFigura are provided for your internal personal, educational, or professional use, as applicable, and may not be sold, resold, sublicensed, distributed, or otherwise commercially exploited except as expressly permitted by these Terms or by xFigura in writing. xFigura reserves the right, with or without notice, to cancel any order that may result in a violation of these Terms, as determined by xFigura in its sole discretion.

7.5 Virtual Credits

The Service may make available virtual credits ("Credits") that can be used solely within the Service to access the AI Services. Credits are not legal tender, are not a currency or stored value, have no monetary value outside the Service, and do not constitute money, property, or any other tangible or intangible asset.

Credits are licensed to you, not sold, and represent only a limited, revocable, non-exclusive, non-transferable right to access certain features of the Service in accordance with these Terms. Credits may be obtained as part of a subscription plan or through separate purchases solely to enable use of the Service.

Credits may not be redeemed for cash or any cash equivalent, may not be transferred, traded, sold, gifted, or exchanged between users, and may not be used outside the Service.

Except as expressly required by applicable law, all purchases of Credits are final and non-refundable, and Credits have no expiration date unless otherwise specified at the time of issuance or in connection with a particular subscription plan. xFigura reserves the right, in its sole discretion, to modify, eliminate suspend, or limit the availability, functionality, or usage of Credits at any time, with or without notice.

Upon termination or expiration of your account or Subscription for any reason, any unused Credits will be forfeited without compensation or refund, except as required by applicable law.

8. Subscriptions

8.1 Subscription

Some parts of the Service are available only with a paid subscription (a "Subscription"). Current Subscription plans, pricing, and related terms are described on our pricing page, available at https://xfigura.ai/pricing. If you enroll in a Subscription, you agree to pay the then-current fees for the applicable Subscription plan, plus any applicable taxes and other charges (the "Subscription Fee") at the beginning of the applicable billing period and on each renewal thereafter, unless you cancel in accordance with these Terms. Subscription prices, fees, or other charges are subject to change with or without notice and may affect your Subscription Fee from one billing period to the next.

8.2 Payment Method

To enroll in a Subscription, you may be required to provide a current, valid, accepted Payment Method. You authorize us to charge any Payment Method associated with your account in case your primary Payment Method is declined or no longer available to us for payment. You remain responsible for any uncollected amounts. xFigura uses authorized third parties for the purpose of processing your transactions and credit card authorization. By submitting Payment Method details to us or our third-party processors, you grant (or otherwise authorize) xFigura the right to store and process your information with such third parties. You agree that xFigura will not be responsible for any failures of such third parties to adequately protect your information. If a payment is not successfully settled—for example, due to expiration of a credit card, insufficient funds, or otherwise—we may suspend your Subscription until we have successfully charged a valid Payment Method. For some Payment Methods, the issuer may charge you certain fees. Check with your Payment Method service provider for details.

WHEN YOU ENROLL IN A SUBSCRIPTION PLAN, WE MAY SUBMIT PERIODIC CHARGES WITHOUT FURTHER AUTHORIZATION FROM YOU, UNTIL YOU PROVIDE PRIOR NOTICE (RECEIPT OF WHICH IS CONFIRMED BY US) THAT YOU HAVE TERMINATED THIS AUTHORIZATION OR WISH TO CHANGE YOUR PAYMENT METHOD (AS DESCRIBED BELOW). SUCH NOTICE WILL NOT AFFECT ANY CHARGES SUBMITTED BEFORE WE COULD REASONABLY ACT TO TERMINATE YOUR AUTHORIZATION OR TO CHANGE YOUR PAYMENT METHOD OR THE SUBSCRIPTION.

8.3 Updating Your Payment Method

If you want to use a different Payment Method or if there is a change in your Payment Method validity or expiration date, you may edit your information by accessing your account settings page. We may also update your Payment Method using information provided by Payment Method service providers. Following any update to your Payment Method, you authorize us to continue to charge the applicable Payment Method(s). If your Payment Method reaches its expiration date, your continued use of the Service constitutes your authorization for us to continue billing that Payment Method and you remain responsible for any uncollected amounts. It is your responsibility to keep your contact information and payment information current and updated.

8.4 Refunds and Cancellation

Your Subscription will continue in effect unless and until you cancel your Subscription, or we terminate it. You can cancel or make changes to your Subscription at any time by logging into your account. You may also cancel your Subscription by contacting us as described in Section 25 (Contact Information). You must cancel your Subscription before it renews for the next billing period in order to avoid being charged for the next billing period's Subscription Fee.

You may cancel your Subscription at any time, however, there are no refunds for cancellation. If you cancel before the end of your current billing cycle, you will have access to your account for the remainder of the current billing cycle. In the event that xFigura suspends or terminates your account or these Terms for your breach of these Terms, you understand and agree that you shall receive no refund or exchange for any unused time on the current billing cycle, any license or Subscription Fees for any portion of the Subscription service, any content or data associated with your account, or for anything else.

8.5 Special Offers

xFigura may enable special offers for certain eligible groups. If you qualify and subscribe through a special offer, you will be billed the advertised special rate for the advertised period of time and automatically renewed at the regular Subscription Fee after that.

8.6 Changes to the Subscription Plan or Price

We reserve the right to change the Subscription or adjust the Subscription Fees or discounts for the Subscription or any components thereof in any manner at any time as we may determine in our sole and absolute discretion. Except as otherwise expressly provided for in these Terms, any Subscription Fee changes will take effect following notice to you.

8.7 Notice to Residents of the United Kingdom

(a) Right to Cancel

You have the right to cancel your Subscription contract within 14 days without giving any reason. The cancellation period will expire after 14 days from the conclusion of the Subscription contract.

To exercise the right to cancel, you must inform us of your decision to cancel your Subscription contract by a clear statement (e.g., a letter sent by post, fax or email). You may use the model cancellation form located at the end of these Terms, but it is not obligatory.

(b) Effects of Cancellation

If you cancel your Subscription contract within the cancellation period, we will reimburse all payments received from you. We will make the reimbursement without undue delay, and not later than 14 days after the day on which we receive notice of your decision to cancel your Subscription contract. We will make the reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of the reimbursement.

9. Submitted Content

xFigura is not the source of, does not verify or endorse, and takes no responsibility for the content of communications or any material submitted or made available through the Service via any function that allows a user to upload or share content, or communicate with other users (the "Submitted Content"). Submitted Content is entirely the responsibility of the person from whom such content originated. You therefore may be exposed to content that is offensive, unlawful, harmful to minors, obscene, indecent, or otherwise objectionable. Submitted Content may be protected by intellectual property rights owned by third parties. You are responsible for the content you choose to communicate and access using the Service. In particular, you are responsible for ensuring that you do not submit material that (i) is protected by copyright, contains trade secrets or otherwise is subject to third party proprietary rights, including privacy and publicity rights, unless you are the owner of such rights or have permission from the rightful owner; (ii) is false or is a misrepresentation; (iii) is offensive, unlawful, harmful to minors, obscene, defamatory, libelous, threatening, pornographic, harassing, hateful, racially or ethnically offensive, or that encourages conduct that would be considered a criminal offense, gives rise to civil liability, violates any law, or is otherwise objectionable; or (iv) impersonates another person. xFigura may in its sole discretion block, prevent delivery of, or otherwise remove the content of communications as part of its effort to protect the Service or its users, or otherwise to enforce these Terms. Further, xFigura may in its sole discretion remove or decline to publish such content on the Service and terminate your account if you submit any content that is in breach of these Terms.

9.1 Submitted Content Restrictions

In addition to any other prohibited activities described in these Terms, when posting Submitted Content and media through the Service, you must not:

• Post anything that interferes with or disrupts the Service or the operation thereof, including files that contain malicious code, viruses, corrupted files, or any other similar software or programs that may damage the operation of another's computer, network or the Service;
• Post statements or materials that are libelous or defame, harass, abuse, stalk, threaten, intimidate or in any way infringe on the rights of others;
• Post statements or materials that violate other contractual or fiduciary rights, duties or agreements;
• Post or upload personal information, pictures, videos or any other media of another person without their express permission;
• Delete or revise any material posted by another person or entity;
• Post statements or materials that are bigoted, hateful, racially offensive, vulgar, obscene, pornographic, profane, defamatory, or otherwise objectionable, including language or images that typically would not be considered socially or professionally responsible or appropriate in person;
• Post statements or materials that violate applicable law, encourage criminal conduct or discrimination based on race, sex, gender, religion, nationality, disability, sexual orientation or age, or that would give rise to civil or criminal liability or otherwise violate any law or regulation in any jurisdiction;
• Post statements or materials that in any way harm minors;
• Post statements or materials that impersonate any other person or entity, whether actual or fictitious, including without limitation, employees and representatives of xFigura;
• Post statements or materials that misrepresent your affiliation with any entity and/or xFigura;
• Post anything that violates the privacy or publicity rights of any other person, including, without limitation, addresses, phone numbers, email addresses, Social Security numbers, credit or debit card numbers or any trade secrets or information for which you have any obligation of confidentiality;
• Post statements or materials that constitute junk mail, spam or unauthorized advertising or promotional materials, including without limitation, links to commercial products or services or any political campaigning;
• Post material that in the sole judgment of xFigura is objectionable or restricts or inhibits any person or entity from using or enjoying any interactive features or other portions of the Service, or which may expose xFigura or its users to harm or liability of any nature; or
• Post material that infringes, or that may infringe, any patent, trademark, trade secret, copyright or other intellectual or proprietary right of any party, or that you otherwise do not have the right to make available, without the express permission of the owner of the copyright, trademark, patent or other proprietary right. xFigura does not have any express burden of responsibility to provide any member or user with indications, markings or anything else that may aid any member or user in determining whether the material in question is copyrighted or trademarked. Members and users shall be solely liable for any damage resulting from infringements of copyrights, trademarks, patents, proprietary rights or any other harm resulting from such submission

9.2 Submitted Content License

xFigura does not claim ownership of any of your Submitted Content. With respect to all of your Submitted Content, you grant xFigura a perpetual, irrevocable, non-terminable, transferable, worldwide, royalty-free, sublicensable, fully paid-up, and non-exclusive license to use, reproduce, distribute, prepare derivative works of, display, modify, copy and perform the Submitted Content or any part of the Submitted Content in connection with the Service and xFigura's (and its successors' and affiliates') business, including without limitation for promoting and redistributing part or all of the Service (and derivative works thereof) in any and all media formats and through any and all media channels. You also hereby grant each user of the Service a non-exclusive license to access your Submitted Content through the Service while the Submitted Content is made available through the Service. You hereby represent, warrant, and covenant that any Submitted Content you provide does not include anything (including, but not limited to, text, images, music, or video) to which you do not have the full right to grant the license specified in this Section 9 (Submitted Content).

9.3 Disclaimer

xFigura expressly disclaims all responsibility and endorsement and makes no representation as to the validity of any image, opinion, advice, information or statement made or displayed through the Service by third parties, nor is xFigura responsible for any errors or omissions in such postings. Under no circumstances will xFigura, or its licensors, affiliates, suppliers, or agents be liable for any loss or damage caused by your reliance on information obtained from third parties. Any opinions expressed through the Service are solely the opinions of the participants, and do not reflect the opinions of xFigura, its licensors or any of their subsidiaries or affiliates.

9.4 User Acknowledgement

You acknowledge and agree that: (i) by using the Service, you may be exposed to content that you may find offensive or indecent and you do so at your own risk; (ii) you are solely responsible for, and xFigura has no responsibility to you or any third party for any Submitted Content that you create, submit, post or publish on or through the Service; (iii) xFigura does not guarantee any confidentiality with respect to your Submitted Content; (iv) xFigura is not responsible for any Submitted Content provided by third parties that you may have access to through your use of the Service and all Submitted Content is the responsibility of the person from whom such Submitted Content originated. You acknowledge and agree that: (y) xFigura has no control over and is not responsible for the use of Submitted Content by its users, including any user that has downloaded Submitted Content to a personal device; and (z) xFigura may not be able to remove Submitted Content that is downloaded onto a user's Device. xFigura does not endorse any Submitted Content, or any opinion, recommendation, or advice expressed therein, and expressly disclaims any and all liability in connection with Submitted Content.

You acknowledge that your Submitted Content is your sole responsibility. You agree that, under no circumstances, will xFigura be liable in any way for any Submitted Content, including, but not limited to, any errors or omissions in any Submitted Content, or any loss or damage of any kind incurred as a result of the use or distribution of any Submitted Content transmitted or otherwise made available via the Service.

9.5 Removal

xFigura and its licensors have no obligation whatsoever to monitor any of the Submitted Content made available through the Service. Notwithstanding the foregoing, you acknowledge that xFigura has the right to pre-screen your Submitted Content but has no obligation to do so. At xFigura's sole discretion, any Submitted Content may be included in the Service in whole or in part in modified form. In addition, xFigura and its designees shall have the right, but not the obligation, in their sole discretion, to refuse or remove any Submitted Content that is available via the Service that violates these Terms or is otherwise objectionable including, but not limited to, being unlawful, offensive, threatening, libelous, defamatory, pornographic, obscene, or violating any party's intellectual property. xFigura may disclose such materials and the circumstances surrounding their transmission to any third party in order to satisfy any applicable law, regulation, legal process or governmental request and to protect itself, its clients, sponsors, users, and visitors. xFigura further reserves the right to contact users to inform them of policies, hide users' Submitted Content or delete users' accounts without warning or advance notice, for any reason, including but not limited to the violation of these Terms.

9.6 Size Limitations

Materials posted and/or uploaded through the Service may be subject to size and usage limitations. You are responsible for adhering to such limitations.

10. Idea Submissions

We welcome feedback from our users and appreciate your comments regarding the Service. However, our policy does not permit us to accept or consider ideas, suggestions, proposals, or materials ("Submissions") that we have not specifically requested. This policy is intended to help us, and our customers avoid future misunderstandings when new products or services developed internally by our employees might be similar or even identical to a customer's idea.

If, despite our request that you not send us your ideas, you still submit them, then regardless of any conditions you may have attempted to place on your Submission, the following terms shall apply to your Submission: you acknowledge and agree that: (i) such Submissions will be considered non-confidential and non-proprietary; (ii) we have the right (subject to our Privacy Policy), without limit in time and without payment to you, to use, copy, distribute, adapt, and disclose it via the Service or otherwise to third parties for any purpose, in any way, and in any media worldwide now known or later discovered, including, without limitation, the right to create derivative works, make improvements, perform (including through digital performance), and transmit (including through digital transmissions) such Submissions, and the right to transfer or sublicense such rights; (iii) we may have something similar to the Submissions already under consideration or in development; and (iv) you are not entitled to any compensation or reimbursement of any kind from us in connection with the Submissions under any circumstances.

11. Intellectual Property Rights

11.1 Trademarks

The xFigura name and logo are trademarks and service marks of xFigura. You do not have the right to use any of our trademarks, service marks, or logos, and your unauthorized use of any of these may be a violation of federal and state trademark laws.

11.2 Ownership

You acknowledge that all intellectual property rights in the Service, whether registered or unregistered, including but not limited to rights in graphics, logos, "look and feel," trade dress, structure, organization, code, and all other content in the Service and compilation thereof, anywhere in the world, belong to us or our licensors and are valuable trade secrets and confidential information of xFigura, and are protected by intellectual property laws. Except for your Submitted Content, you acknowledge and agree that xFigura, and/or its licensors, own all right, title, and interest in and to the Service, including all intellectual property, industrial property, and proprietary rights recognized anywhere in the world at any time and that the Service is protected by U.S. and international copyright laws. Further, you acknowledge the Service may contain information that xFigura has designated as confidential, and you agree not to disclose such information without xFigura's prior written consent. Nothing posted on the Service grants a license to any xFigura trademarks, copyrights, or other intellectual property rights, whether by implication, estoppel or otherwise. You should assume that everything you see or read through accessing the Service is proprietary information protected by copyright or trademark unless otherwise noted and may not be used except with the written permission of xFigura. When accessing the Service, you agree to obey the law and to respect the intellectual property rights of others. Your use of the Service is at all times governed by and subject to laws regarding copyright ownership and use of intellectual property.

12. DMCA Notice

12.1 DMCA Policy

xFigura has adopted a policy that provides for the suspension and/or termination of any user who is found to have infringed on the rights of xFigura or of a third party, or otherwise violated any intellectual property laws or regulations. xFigura's policy is to investigate any allegations of copyright infringement brought to its attention.

12.2 Take-Down Notice

If you have evidence, know, or have a good faith belief that your rights or the rights of a third party have been violated and you want xFigura to delete, edit, or disable the material in question, you must provide xFigura with all of the following information (as required by the Online Copyright Infringement Liability Limitation Act of the Digital Millenium Copyright Act) to our designated copyright agent (the "Designated Agent") set forth below:

• A physical or electronic signature of the copyright owner or the person authorized to act on behalf of the owner of an exclusive copyright that is allegedly infringed;
• Identification of the copyrighted work (or works) claimed to have been infringed;
• Identification of the material that is claimed to be infringing and information reasonably sufficient to permit xFigura to locate the material (providing URLs in the content of an email is the best way to help us locate content quickly);
• Information reasonably sufficient to permit xFigura to contact you, including your address, telephone number, and e-mail address at which you may be contacted;
• A statement that you have a good faith belief that use of the material in the manner complained of is not authorized by you, or your agent, or the law;
• A statement made under penalty of perjury, that the above information in your notice is accurate and that you are the copyright owner or are authorized to act on the copyright owner's behalf.

See 17 U.S.C. § 512(c)(3) for further information.

For this notification to be effective, you must provide it to our Designated Agent by email at info@xfigura.ai. You may also mail your DMCA request to:

Attn: Copyright Manager xFigura, Inc. 20 Fisher Avenue 02120, Boston, MA, USA

Mailing DMCA notices may delay the processing of your request. Only copyright complaints should be sent to the Designated Agent. No other communications will be accepted or responded to.

If you fail to comply with each requirement above, your DMCA notice may not be valid and may not be acknowledged. Once proper notice is received by the Designated Agent, it is xFigura's policy to investigate the claim and notify the alleged infringer of your claim. If we determine that you have raised a legitimate copyright claim, we will remove or disable access to the infringing material and notify the content provider, member, or user that we have removed or disabled access to the material. In addition, repeat offenders will have the infringing material removed from the system and xFigura will terminate such content provider's or user's access to the Service.

12.3 Counter Notice

If you believe that the material that was removed or to which access has been disabled is either not infringing, or you believe that you have the right to post and use such material from the copyright owner, the copyright owner's agent, or pursuant to the law, you must send a counter-notice containing the following information to the Designated Agent:

• Your physical or electronic signature;
• Identification of the material that has been removed or to which access has been disabled and the location at which the material appeared before it was removed or access to it was disabled;
• A statement under penalty of perjury that you have a good faith belief that the material was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled;
• Your name, address, and telephone number; and
• A statement that you consent to the jurisdiction of federal court in the judicial district in which your address is located, or if your address is outside of the United States, for any judicial district in which you may be found, and that you will accept service of process from the person who provided the initial notification of alleged infringement.

If counter-notice is received by the Designated Agent, xFigura may send a copy of the counter-notice to the original complaining party informing that person that it may replace the removed material or cease disabling it in 10 business days. Unless the copyright owner files an action seeking a court order against the content provider, member, or user, the removed material may be replaced or access to it restored in 10 to 14 business days or more after receipt of the counter-notice, at xFigura's discretion.

13. Third-Party Sites and Services

The Service may contain links to allow you to share content directly with other third-party websites ("Third-Party Sites"). You acknowledge that we have no control over the Third-Party Sites and are not responsible for their contents and/or availability. We do not assume any liability for your use of any of the foregoing, which use you acknowledge and agree shall be at your own risk.

These links are provided to you for convenience only and do not constitute an endorsement or approval by us of the organizations that operate such websites, the content, or other material contained in the Third-Party Sites, and we have no association with their operators. Your use of the Third-Party Sites will be governed by their terms and conditions and privacy policies (if any) ("Third-Party Terms"). It is your responsibility to read and comply with the Third-Party Terms.

14. Indemnity

You agree to indemnify and hold us and our affiliates, and their respective business partners, licensees, licensors, officers, directors, members, employees, and agents (the "Indemnified Parties") harmless from and against any and all claims, demands, losses, damages, liabilities, costs, and expenses (including, without limitation, reasonable attorneys' fees and costs) arising out of or in connection with: (i) your use of the Service; (ii) your breach or violation of any of these Terms; (iii) your violation of the rights of any third party; (iv) any AI Input you submit, any AI Output you generate, use, distribute, or rely upon, or any allegation that any such AI Input or AI Output infringes, misappropriates, or otherwise violates the intellectual property, privacy, publicity, or other rights of any person or entity; or (v) your use of any Enterprise Model or Third-Party Model in violation of these Terms, the applicable provider's terms, or applicable law, including any claim brought by a provider of an Enterprise Model or a Third-Party Model arising from or related to your use of such model. We reserve the right to assume the exclusive defense and control of any matter subject to indemnification by you, which shall not excuse your indemnity obligations. In such event, you shall provide the Indemnified Parties with such cooperation as they may reasonably request.

15. Warranty Disclaimer

WE PROVIDE THE SERVICE ON AN "AS IS" AND "AS AVAILABLE" BASIS. WE MAKE NO GUARANTEE THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR FREE, OR FREE FROM VIRUSES OR OTHER HARMFUL COMPONENTS. WE HAVE NO OBLIGATION TO CORRECT ANY BUGS, DEFECTS OR ERRORS IN THE SERVICE OR TO OTHERWISE SUPPORT, DEVELOP OR MAINTAIN THE SERVICE. While we take reasonable precautions to prevent the existence of computer viruses and/or other malicious programs, we accept no liability for them.

WE MAKE NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESEPCT TO ANY AI INPUT, AI OUTPUT, OR OTHER CONTENT GENERATED, ACCESSED, OR USED THROUGH THE SERVICE, INCLUIDNG THROUGH ANY ENTERPRISE MODEL OR THIRD-PARTY MODEL. WITHOUT LIMITING THE FOREGOING: (I) WE DO NOT REPRESENT OR WARRANT THAT ANY AI OUTPUT WILL BE ACCURATE, COMPLETE, ORIGINAL, NON-INFRINGING, OR FIT FOR ANY PARTICULAR PURPOSE, OR THAT YOU WILL HAVE ANY RIGHTS TO USE ANY SUCH AI OUTPUT; AND (II) WE MAKE NO REPRESENTATIONS OR WARRANTIES REGARDING ANY AI OUTPUT OR THE LEGALITY, OWNERSHIP, ORIGINALITY, OR PERMITTED USE OF ANY SUCH AI OUTPUT, AND XFIGURA DOES NOT PROVIDE ANY RIGHTS CLEARANCE OR LEGAL ADVICE WITH RESPECT TO ANY AI OUTPUT.TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE EXCLUDE ALL CONDITIONS, WARRANTIES, REPRESENTATIONS AND OTHER TERMS, WHICH MAY APPLY TO THE SERVICE (INCLUDING OUR PRODUCTS) WHETHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT OF THE RIGHTS OF THIRD PARTIES WITH RESPECT TO THE SERVICE (INCLUDING OUR PRODUCTS) AND ALL INFORMATION AND CONTENT PROVIDED THROUGH THE SERVICE.

WITHOUT LIMITING THE FOREGOING, XFIGURA DISCLAIMS ALL WARRANTIES WITH RESPECT TO ANY ENTERPRISE MODEL, ANY THIRD-PARTY MODEL, AND ANY AI OUTPUT GENERATED THEREBY, INCLUDING ANY WARRANTIES REGARDING OWNERSHIP, LICENSING, LEGALITY, OR PERMITTED USE OF SUCH AI OUTPUT.

No information or advice obtained through the Service, or affirmation by us, by words or actions, shall constitute a warranty.

Because some states or jurisdictions do not allow the disclaimer of implied warranties, the foregoing disclaimers may not apply to you.

16. Limitation of Liability

IN NO EVENT SHALL THE INDEMNIFIED PARTIES BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES (INCLUDING LOST PROFITS, ANY BREACH OF SECURITY OR ANY DAMAGE TO YOUR DEVICE, LOST DATA, PERSONAL INJURY, PROPERTY DAMAGE, OR LOSSES ARISING OUT OF YOUR USE OF OR RELIANCE ON THE SERVICE OR YOUR INABILITY TO ACCESS OR USE THE SERVICE) ARISING FROM, RELATING TO, OR IN ANY WAY CONNECTED WITH THE USE OR THE PERFORMANCE OF THE SERVICE (INCLUDING OUR PRODUCTS) OR THESE TERMS, ARISING AND WHETHER FRAMED IN CONTRACT OR TORT, REGARDLESS OF THE NEGLIGENCE (EITHER ACTIVE, AFFIRMATIVE, SOLE, OR CONCURRENT) OF XFIGURA, EVEN IF WE HAVE BEEN ADVISED OF THE POSIBILITY OF SUCH DAMAGES.

WITHOUT LIMINTING THE FOREGOING, IN NO EVENT SHALL THE INDEMNIFIED PARTIES BE LIABLE FOR ANY CLAIMS, DAMAGES, OR LOSSES ARISING FROM OR RELATED TO (A) ANY AI INPUT, (B) ANY AI OUTPUT, (C) YOUR USE OF OR RELIANCE ON ANY AI OUTPUT, OR (D) ANY ALLEGATION THAT ANY AI OUTPUT INFRINGES, MISAPPROPRIATES, OR OTHERWISE VIOLATES THE RIGHTS OF ANY THIRD PARTY.

IN NO EVENT SHALL XFIGURA BE LIABLE FOR ANY CLAIMS BROUGHT BY ANY PROVIDER OF AN ENTERPRISE MOEDEL OR ANY THIRD-PARTY MODEL ARISING FROM OR RELATED TO YOUR USE OF SUCH MODEL OR ANY VIOLATION OF THE APPLICABLE PROVIDER'S TERMS OR APPLICABLE LAW.

Your sole remedy for dissatisfaction with the Service including, without limitation, content provided through the Service, is to stop using the Service (including our products). Such limitation shall also apply with respect to damages incurred by reason of services or products received through or advertised in connection with the Service or any links on the Service, as well as by reason of any information or advice received through or advertised in connection with the Service or any links on the Service. Such limitation shall also apply with respect to damages incurred by reason of any content posted by a third-party or conduct of a third-party on the Service.

WITHOUT LIMINTING THE FOREGOING, SUCH LIMITATION SHALL APPLY WITH FULL FORCE TO ANY DAMAGES OR LOSSES ARISING FROM OR RELATED TO ANY ENTERPRISE MODEL OR ANY THIRD-PARTY MODEL, INCLUDING THE AVAILABILITY, FUNCTIONALITY, OUTPUTS, OR LEGAL STATUS OF ANY SUCH MODEL OR AI OUTPUT.

In the event the foregoing exclusion of liability is determined, in whole or in part, to be invalid or unenforceable, then the Indemnified Parties' liability arising in connection with the Service or under these Terms whether in contract, tort (including negligence) or otherwise, shall not exceed, under any circumstances, the greater of: (i) the total amount paid for goods or services purchased through the Service in the preceding 30 days; or (ii) One Hundred Dollars ($100).

You agree that any claim or cause of action arising under these Terms or the performance or non-performance of the Service must be brought within one year after such claim or cause of action arises or be forever barred.

THE LIMITATIONS AND DISCLAIMER IN THIS SECTION DO NOT PURPORT TO LIMIT LIABILITY OR ALTER YOUR RIGHTS AS A CONSUMER THAT CANNOT BE EXCLUDED UNDER APPLICABLE LAW. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF OR THE LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, IN SUCH STATES OR JURISDICTIONS, XFIGURA'S LIABILITY SHALL BE LIMITED TO THE EXTENT PERMITTED BY LAW. THIS PROVISION SHALL HAVE NO EFFECT ON XFIGURA'S GOVERNING LAW PROVISION SET FORTH BELOW.

IF YOU ARE A CALIFORNIA RESIDENT, YOU WAIVE CALIFORNIA CIVIL CODE SECTION 1542, WHICH STATES: "A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS THAT THE CREDITOR OR RELEASING PARTY DOES NOT KNOW OR SUSPECT TO EXIST IN HIS OR HER FAVOR AT THE TIME OF EXECUTING THE RELEASE AND THAT, IF KNOWN BY HIM OR HER WOULD HAVE MATERIALLY AFFECTED HIS OR HER SETTLEMENT WITH THE DEBTOR OR RELEASED PARTY."

17. Termination

We may terminate these Terms and/or terminate your permission to use the Service immediately, without prior notice or liability, if: (i) you commit any breach of these Terms; (ii) we discontinue the Service; or (iii) we are prevented from providing the Service for any reason.

Furthermore, we reserve the right to change, edit, suspend, delete, and/or cancel any part of the Service and/or your access to it at any time with or without notice to you: (a) if required by law; or (b) due to an event beyond our control.

On termination of these Terms for any reason: (x) all rights granted to you under these Terms will cease immediately; (y) you must immediately cease all activities authorized by these Terms (including your use of the Service); and (z) you acknowledge that we may restrict your access to the Service. Sections 3-5, 9-12, and 14-23 will survive any termination or expiration of these Terms.

18. Communication Between Us

If you wish to contact us in writing, or if any condition in these Terms requires you to give us notice in writing, you can send this to us as indicated in Section 25 (Contact Information) at the bottom of these Terms. If we have to contact you or give you notice in writing, we may do so by email or using any other contact details you provide to us.

19. Governing Law

These Terms and any matter arising out of or relating to these Terms, and any claim, cause of action, controversy, or matter in dispute between you and us, whether sounding in contract, tort, statute, regulation, or otherwise, shall be governed by the internal laws of the State of Delaware in the United States, consistent with the Federal Arbitration Act, without regard to any choice or conflict of laws principles (whether of the State of Delaware or any other jurisdiction).

20. Dispute Resolution

20.1 User Concerns

Most user concerns can be resolved quickly and to the user's satisfaction by contacting us at the contact details in Section 25 (Contact Information) below.

20.2 Disputes

By agreeing to these Terms, you expressly agree to the arbitration of all Disputes. Any controversy, allegation, or claim that arises out of or relates to the Service, these Terms, or any additional terms, whether heretofore or hereafter arising (collectively, a "Dispute"), except for any controversy, allegation or claim that arises out of or relates to our actual or alleged intellectual property rights (an "Excluded Dispute"), shall be finally resolved by arbitration. The parties agree to arbitrate solely on an individual basis, and that these Terms do not permit class arbitration, or any claims brought as a plaintiff or class member in any class or representative arbitration proceeding. The arbitrator or arbitral panel may not consolidate more than one person's claims and may not otherwise preside over any form of a representative or class proceeding. In the event the prohibition on class arbitration is deemed invalid or unenforceable, the remaining portions of the arbitration provisions will remain in force.

20.3 Arbitration Procedures

In the event your concern cannot be resolved informally, you and xFigura agree that, except as provided in Section 20.6 below, all Disputes, (each a "Claim"), shall be finally and exclusively resolved by binding arbitration, which may be initiated by either party by sending a written notice requesting arbitration to the other party. Any election to arbitrate by one party shall be final and binding on the other. The arbitration will be conducted under the Streamlined Arbitration Rules and Procedures of JAMS that are in effect at the time the arbitration is initiated (the "JAMS Rules") and under the terms set forth in these Terms. In the event of a conflict between the terms set forth in this Section 20 (Dispute Resolution) and the JAMS Rules, the terms in this Section will control and prevail.

Except as otherwise set forth in Section 20.6 below, you may seek any remedies available to you under federal, state, or local laws in an arbitration action. As part of the arbitration, both you and xFigura will have the opportunity for discovery of non-privileged information that is relevant to the Claim. The arbitrator will provide a written statement of the arbitrator's decision regarding the Claim, the award given, and the arbitrator's findings and conclusions on which the arbitrator's decision is based. The determination of whether a Claim is subject to arbitration shall be governed by the Federal Arbitration Act and determined by a court rather than an arbitrator. Except as otherwise provided in these Terms: (i) you and xFigura may litigate in court to compel arbitration, stay proceedings pending arbitration, or confirm, modify, vacate, or enter judgment on the award entered by the arbitrator; and (ii) the arbitrator's decision shall be final, binding on all parties and enforceable in any court that has jurisdiction, provided that any award may be challenged if the arbitrator fails to follow applicable law.

IN THE CASE OF ARBITRATION AND WHERE PERMITTED BY LAW, YOU ARE AGREEING TO GIVE UP YOUR RIGHT TO GO TO COURT TO ASSERT OR DEFEND YOUR RIGHTS. YOUR RIGHTS WILL BE DETERMINED BY A NEUTRAL ARBITRATOR AND NOT A JUDGE OR JURY. YOU ARE ENTITLED TO A FAIR HEARING, BUT THE ARBITRATION PROCEDURES ARE SIMPLER AND MORE LIMITED THAN RULES APPLICABLE IN COURT. ARBITRATOR DECISIONS ARE ENFORCEABLE AS ANY COURT ORDER AND ARE SUBJECT TO VERY LIMITED REVIEW BY A COURT.

20.4 Location

The arbitration will take place in Suffolk County, Massachusetts, United States of America, unless the parties agree to video, phone, or internet connection appearances.

20.5 Limitations

You and xFigura agree that any arbitration shall be limited to the Claim between xFigura and you individually. YOU AND XFIGURA AGREE THAT: (i) THERE IS NO RIGHT OR AUTHORITY FOR ANY DISPUTE TO BE ARBITRATED ON A CLASS-ACTION BASIS OR TO UTILIZE CLASS ACTION PROCEDURES; (ii) THERE IS NO RIGHT OR AUTHORITY FOR ANY DISPUTE TO BE BROUGHT IN A PURPORTED REPRESENTATIVE CAPACITY OR AS A PRIVATE ATTORNEY GENERAL; AND (iii) NO ARBITRATION SHALL BE JOINED WITH ANY OTHER ARBITRATION.

20.6 Exceptions to Arbitration

You and xFigura agree that the following Claims are not subject to the above provisions concerning binding arbitration: (i) any Excluded Dispute; (ii) any Claim related to, or arising from, allegations of theft, piracy, invasion of privacy, or unauthorized use; and (iii) any claim for equitable relief. In addition to the foregoing, either party may assert an individual action in small claims court for Claims that are within the scope of such court's jurisdiction in lieu of arbitration.

20.7 Arbitration Fees

If you initiate arbitration for a Claim, you will need to pay the JAMS arbitration initiation fee. If we initiate arbitration for a Claim, we will pay the costs charged by JAMS for initiating the arbitration. All other fees and costs of the arbitration will be charged pursuant to the JAMS Rules.

20.8 Severability

You and xFigura agree that if any portion of this Section is found illegal or unenforceable (except any portion of Section 20.6), that portion shall be severed and the remainder of the Section shall be given full force and effect. If Section 20.6 is found to be illegal or unenforceable then neither you nor xFigura will elect to arbitrate any Claim falling within that portion of Section 20.6 found to be illegal or unenforceable and such Claim shall be exclusively decided by a court of competent jurisdiction within Suffolk County, Massachusetts, United States of America, and you and xFigura agree to submit to the personal jurisdiction of that court.

21. Notice for California Residents

In accordance with California Civil Code §1789.3, you may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by contacting them in writing at 1625 North Market Blvd, Ste N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

22. Notice for New Jersey Residents

If you are a consumer residing in New Jersey, the following provisions of these Terms do not apply to you: Section 15 (Warranty Disclaimer), Section 16 (Limitation of Liability), and the Delaware governing law provision of Section 19 (Governing Law) above (for example, to the extent that your rights as a consumer residing in New Jersey are required to be governed by New Jersey law).

23. Additional Important Terms

23.1 Assignment

The rights granted to you under these Terms may not be assigned without xFigura's prior written consent, and any attempted unauthorized assignment by you shall be null and void.

23.2 Severability

Except as otherwise provided in Section 20.8, if any part of these Terms is determined to be invalid or unenforceable, then that portion shall be severed, and the remainder of the Terms shall be given full force and effect.

23.3 Attorneys' Fees

In the event any litigation or arbitration is brought by either party in connection with these Terms, except as otherwise provided in Section 20.7, the prevailing party shall be entitled to recover from the other party all the reasonable costs, attorneys' fees and other expenses incurred by such prevailing party in any legal action relating to these Terms.

23.4 No Waiver

Our failure to enforce any provision of these Terms shall in no way be construed to be a waiver of such provision, nor in any way affect our right to enforce the same provision at a later time. An express waiver by xFigura of any provision, condition, or requirement of these Terms shall not be understood as a waiver of your obligation to comply with the same provision, condition, or requirement at a later time.

23.5 Equitable Remedies

You acknowledge and agree that xFigura would be irreparably damaged if the terms of these Terms were not specifically enforced, and therefore you agree that we shall be entitled, without bond, other security, or proof of damages, to appropriate equitable remedies with respect to any breach of these Terms, in addition to such other remedies as we may otherwise have available to us under applicable laws.

23.6 Entire Agreement

These Terms, including the documents referenced in these Terms, constitutes the entire agreement between you and xFigura with respect to the Service and supersedes any and all prior agreements between you and xFigura relating to the Service.

23.7 Transfer

We may transfer our rights and obligations under these Terms to another organization but this will not affect your rights or our obligation sunder these Terms.

24. Changes to These Terms

We reserve the right, at our sole discretion, to amend these Terms at any time. As applicable, we will notify you of material changes to these Terms when you next access the Service (we may also email you about any material changes to these Terms). We reserve the right at any time and from time-to-time to modify or discontinue, temporarily or permanently, the Service (or any part of it) with or without notice.

25. Contact Information

If you have any questions or comments relating to the Service or these Terms, please contact us at: info@xfigura.ai.

DATA PROCESSING ADDENDUM

1. Purpose and Scope

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the SaaS and Platform Agreement between Company and Client governing Client's access to and use of the Platform. This DPA applies solely to the extent Company Processes Client Personal Information on behalf of Client in connection with the provision of the Services under the SaaS and Platform Agreement, and only as required by Data Protection Laws.

This DPA supplements the SaaS and Platform Agreement and sets forth the additional terms, requirements, and conditions applicable to Company's Processing of Client Personal Information solely in its capacity as a "processor," "service provider," or equivalent role acting on behalf of Client, and only where and to the extent such role is required by Data Protection Laws. Nothing in this DPA is intended to, or shall be construed to, create a joint controller, joint venture, agency, fiduciary, or partnership relationship between Company and Client or to expand Company's obligations beyond those required under Data Protection Laws.

Except as expressly set forth in this DPA, Company acts as an independent controller with respect to any Personal Information it Processes for its own purposes, including to operate, secure, support, and improve the Services, or as otherwise permitted under the SaaS and Platform Agreement and Data Protection Laws and subject to the limitations and allocations of responsibility set forth therein.

This DPA becomes binding upon Client's execution of the SaaS and Platform Agreement or continued use of the Services, whichever occurs first. Company may update this DPA from time to time as necessary to comply with Data Protection Laws, subject to the notice and modification provisions of the SaaS and Platform Agreement; provided that any such updates shall not materially diminish Client's rights under this DPA except as required by Data Protection Laws.

2. Definitions

Capitalized terms not defined in this DPA shall have the meanings set forth in the SaaS and Platform Agreement. Additionally, the following capitalized terms shall be defined as follows whenever used in this DPA:

2.1 "Affiliate" means in relation to a party, any entity which (directly or indirectly) controls, is controlled by and/or under common control with that party, where "control" means ownership of more than fifty percent (50%) of the voting securities or other ownership interests of such entity, or the power to direct its management or policies;

2.2 "Client Personal Information" means any Personal Information that Client discloses, provides or otherwise makes available to Company through its use of the Services;

2.3 "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Information under the SaaS and Platform Agreement, including, as applicable: (a) Regulation (EU) 2016/679 (the "GDPR"); (b) the GDPR as retained in United Kingdom law pursuant to the European Union (Withdrawal) Act 2018 (the "UK GDPR"), and the UK Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection; (d) other U.S. federal, state, and local privacy, data protection, and data security laws and regulations; and (e) any amendments, replacements, successors, or implementing regulations to the foregoing, together with any binding guidance, rules, or codes of practice issued by a competent Supervisory Authority, in each case to the extent applicable to the Processing of Personal Information under the SaaS and Platform Agreement;

2.4 "ex-EEA Transfer" means a transfer of Personal Information subject to the GDPR from the European Economic Area ("EEA") to a recipient located in a country outside the EEA that is not the subject of an adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR.

2.5 "ex-UK Transfer" means any transfer of Personal Information subject to the UK GDPR from the United Kingdom ("UK") to a recipient located in a country outside the UK that is not the subject of an adequacy regulation adopted by the UK Secretary of State.

2.6 "Personal Information" means any information (a) relating to an identified or identifiable natural person or (b) defined as "personal data," "personally identifiable information," "personal information," or similar terms, as such terms are defined under Data Protection Laws;

2.7 "Personal Information Breach" means any accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, Client Personal Information;

2.8 "Process," "Processing," or "Processed" means any operation or set of operations which is performed upon Client Personal Information whether or not by automatic means, including collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using, disclosing, making available, aligning, combining, blocking, erasing and destroying Client Personal Information;

2.9 "SaaS and Platform Agreement" means the SaaS and Platform Agreement entered into between Company and Client governing Client's access to and use of the Platform, as amended from time to time;

2.10 "Services" means any services provided by Company to Client under the SaaS and Platform Agreement that involves the Processing of Personal Information, including the provision, operation, maintenance, and support of the Platform and any related Professional Services or ancillary services necessary to operate and support the Platform, as described in the SaaS and Platform Agreement;

2.11 "Standard Contractual Clauses" means, as applicable, (a) the standard contractual clauses for the transfer of Personal Information to third countries approved by the European Commission pursuant to Article 46 of the GDPR (including Decision (EU) 2021/914, as amended or replaced from time to time (the "EU SCCs")); (b) the International Data Transfer Addendum to such clauses issued by the UK Information Commissioner's Office (the "UK Addendum"); (c) any Swiss adaptations or equivalents thereto; and (d) any other standard contractual clauses, international data transfer addenda, or mandatory contractual mechanisms adopted pursuant to Data Protection Laws for the lawful transfer of Personal Information across international borders, in each case as amended, replaced, or superseded from time to time, and incorporated into this DPA by reference where applicable; and

2.12 "Supervisory Authority" means the relevant supervisory or regulatory authority with responsibility for privacy or data protection matters in the jurisdiction of Client.

3. Role of the Parties

3.1 Roles Under Data Protection Laws

Each Party may Process Client Personal Information in connection with the Services. The Parties acknowledge that their respective roles with respect to such Processing are determined by the factual circumstances and Data Protection Laws. Except as expressly set forth in this DPA or the SaaS and Platform Agreement, Client acts as the Controller of Client Personal Information and Company acts as a Processor Processing Client Personal Information on Client's behalf solely for the purpose of providing the Services.

3.2 Client Responsibilities

Client represents and warrants that it will, in its use of the Services and provision of instructions to Company, comply with all applicable Data Protection Laws. Client has sole responsibility for: (a) the accuracy, quality, and legality of Client Personal Information; (b) the means by which Client acquired Client Personal Information; and (c) providing all required notices and obtaining all required consents or other valid legal bases for Processing Client Personal Information under Data Protection Laws.

3.3 Independent Processing

Nothing in this DPA or the SaaS and Platform Agreement is intended to create, or shall be construed as creating, a joint controllership, partnership, or agency relationship between the Parties. To the extent Company Processes Personal Information outside the scope of Client's instructions (including for compliance with applicable law, security, fraud prevention, or internal operations consistent with the SaaS and Platform Agreement), Company acts as an independent controller with respect to such Processing and such Processing is subject to the applicable provisions of the SaaS and Platform Agreement and Data Protection Laws.

4. Processing Requirements

4.1

Company shall Process Client Personal Information only on documented instructions from Client unless Company is required to do otherwise by applicable law, in which case Company shall, unless legally prohibited from doing so, inform Client of such legal requirement. The Parties agree that the SaaS and Platform Agreement and this DPA constitute such documented instructions. Any disclosure of Client Personal Information required by applicable law or by proper legal or governmental authority will be handled in accordance with the notice, cooperation, and disclosure provisions of this DPA and the SaaS and Platform Agreement, as applicable.

4.2

Company shall comply with Data Protection Laws, to the extent applicable to Company in its role as a Processor (or service provider, contractor, or equivalent role) with respect to its Processing of Client Personal Information.

4.3

Company shall provide reasonable assistance to Client, taking into account the nature of the Processing and the information available to Company, and at Client's expense, with the fulfillment of Client's obligations under Data Protection Laws to respond to requests for exercising individuals' rights, together with Client's obligations regarding data security, notification by Client of Personal Information Breaches to the applicable Supervisory Authority, communication by Client of Personal Information Breaches to the affected individuals, data protection impact assessments, and prior consultation with the applicable Supervisory Authority, in each case to the extent such assistance is required by Data Protection Laws and relates to Company's Processing of Client Personal Information. Company shall not be required to take any action that would cause it to violate applicable law or materially disrupt its business operations. Any assistance provided pursuant to this Section 4.3 shall be subject to the limitations of liability and exclusions set forth in the SaaS and Platform Agreement.

5. Company Personnel

Company shall ensure that persons authorized by it to Process Client Personal Information are subject to appropriate obligations of confidentiality.

6. Processing and Storage Locations

6.1

The Parties agree that Company may transfer Client Personal Information Processed under this DPA outside of its country of origin including, without limitation, the EEA, the UK, or Switzerland as necessary to provide the Services. Client acknowledges that Company's primary Processing operations take place in the United States, and that the transfer of Client's Personal Information to the United States is necessary for the provision of the Services to Client. If Company transfers Client Personal Information protected under this DPA to a jurisdiction for which the relevant governmental authority has not issued an adequacy decision, Company will ensure that appropriate safeguards have been implemented for the transfer of Client Personal Information in accordance with Data Protection Laws.

6.2 Ex-EEA Transfers

The Parties agree that ex-EEA Transfers are made pursuant to the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of Personal Information to countries not otherwise recognized as offering an adequate level of protection for Personal Information by the European Commission (as amended and updated from time to time) (the "EU SCCs"), which are incorporated into this DPA by reference and deemed entered into and completed as follows: (a) Applicable Modules: (i) Module One (Controller to Controller) of the EU SCCs applies when Company is Processing Client Personal Information as a controller other than on behalf of Client, including where Company Processes Client Personal Information for its own business purposes as permitted under the SaaS and Platform Agreement and Data Protection Laws. (ii) Module Two (Controller to Processor) of the EU SCCs applies when Client is a controller and Company is Processing Client Personal Information on behalf of Client as a processor pursuant to this DPA. (b) For each applicable module: (i) The optional docking clause in Clause 7 does not apply. (ii) In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be as set forth in Section 8.1 of this DPA. (iii) In Clause 11, the optional language does not apply. (iv) In Clause 17 (Option 1), the EU SCCs will be governed by the laws of Ireland. (v) In Clause 18(b), disputes will be resolved before the courts of Ireland. (vi) Attachment 1 to this DPA contains the information required in Annexes I through III of the EU SCCs.

6.3 Ex-UK Transfers

The Parties agree that ex-UK Transfers are made pursuant to the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office (the "UK Addendum"), which is incorporated into this DPA by reference and applies to the EU SCCs as completed above. Attachment 1 to this DPA contains the information required in Annex 1A, Annex 1B, and Annex 2 of the UK Addendum.

6.4 Transfers from Switzerland

With respect to Client Personal Information transferred from Switzerland and subject exclusively to the Swiss Federal Act on Data Protection ("FADP"), the EU SCCs shall apply as the applicable transfer mechanism and shall be deemed modified as follows, to the extent required by the FADP: (a) References in the EU SCCs to the "General Data Protection" or "Regulation (EU) 2016/679" shall be understood as references to the FADP solely with respect to transfers governed by the FADP and not the GDPR. (b) The term "EU Member State" as used in the EU SCCs shall not be interpreted in a manner that would prevent data subjects in Switzerland from exercising their rights or bringing claims in their place of habitual residence, in accordance with Clause 18(c) of the EU SCCs. (c) For purposes of Annex I(C) (Competent Supervisory Authority) of the EU SCCs: (i) Where a transfer is subject exclusively to the FADP, the competent Supervisory Authority shall be the Swiss Federal Data Protection and Information Commissioner; and (ii) Where a transfer is subject to both the FADP and the GDPR, the Swiss Federal Data Protection and Information Commissioner shall be the competent authority to the extent the transfer is governed by the FADP, and the competent authority designated under the EU SCCs shall apply to the extent the transfer is governed by the GDPR.

6.5 Supplementary Measures

(a) To the extent required by Data Protection Laws, Company represents that, as of the effective date of this DPA, it has not received any formal legal requests from government intelligence or security agencies for access to Personal Information processed on behalf of its clients in connection with the Services. This statement is provided solely for purposes of satisfying Data Protection Laws and shall not be deemed a warranty or give rise to liability beyond that set forth in the SaaS and Platform Agreement. (b) If Company receives any legally binding request for disclosure of Client Personal Information from a governmental authority, Company shall, to the extent permitted by law, provide Client with reasonable notice and cooperate with Client's efforts to seek a protective order or other appropriate remedy. (c) If a Supervisory Authority requires suspension or modification of a transfer mechanism relied upon under this Section 6, Company may implement alternative lawful transfer mechanisms or suspend the affected transfers as required by Data Protection Laws.

7. Security of Personal Information

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, Company shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Data Protection Laws. Company shall ensure that any individuals authorized by Company to Process Client Personal Information are subject to appropriate confidentiality obligations and shall process such Client Personal Information only on Company's documented instructions, unless required to do otherwise by applicable law.

8. Sub-Processors

8.1

Client hereby provides its general written authorization for Company to engage sub-processors, including Company's Affiliates and third parties, to carry out Processing activities on behalf of Client as necessary to provide the Services. Company shall maintain a list of its current sub-processors, which may be made available to Client via a website or other reasonable means and may be updated by Company from time to time. Company shall provide reasonable advance notice of any material changes to such list and give Client the opportunity to object on reasonable data protection grounds.

8.2

Where Company engages a sub-processor for carrying out specific Processing activities on behalf of Client, Company shall enter into a written agreement with such sub-processor that imposes data protection obligations on the sub-processor that are no less protective than those set forth in this DPA, including, where required by Data Protection Laws, obligations sufficient to satisfy the requirements of (a) the Standard Contractual Clauses or other applicable international data transfer mechanisms, and (b) any "service provider," "processor," or "contractor" requirements under Data Protection Laws. Company shall remain responsible for the performance of such sub-processor's data protection obligations under the applicable written agreement, subject to the limitations and exclusions of liability set forth in the SaaS and Platform Agreement.

8.3

Client acknowledges and agrees that Company is authorized to subcontract and outsource Processing of Personal Information to its sub-processors identified in accordance with Section 8.1, including those engaged to provide infrastructure, hosting, analytics, security, support, and other services necessary to operate and support the Services.

8.4

If Client reasonably objects to the engagement of a new sub-processor on data protection grounds and Company cannot provide a commercially reasonable alternative within a reasonable period of time, Client may discontinue use of the affected portion of the Services by written notice to Company, without prejudice to any fees accrued prior to such discontinuation.

8.5

For purposes of any applicable Standard Contractual Clauses or similar mandatory transfer mechanisms, this Section 8 constitutes Client's prior written authorization for the engagement of sub-processors to the extent such authorization is required thereunder.

9. Breach Notification

9.1 Notification

Unless prohibited by applicable law, Company shall notify Client without undue delay after becoming aware of a Personal Information Breach involving Client Personal Information. Such notice shall include, to the extent known or reasonably available to Company at the time, information sufficient to enable Client to comply with its notification and reporting obligations under Data Protection Laws, provided that Company's obligation is limited to information reasonably available to Company at the time and shall not require Company to conduct forensic analysis or make legal determinations on Client's behalf.

9.2 Cooperation and Mitigation

Taking into account the nature of the Processing and the information available to Company, Company shall provide reasonable cooperation and assistance to Client, at Client's expense, as necessary to enable Client to: (a) notify the applicable Supervisory Authority or other governmental authority; and (b) communicate with affected individuals, in each case as required under Data Protection Laws. Company shall take reasonable measures to contain, investigate, and remediate the Personal Information Breach to the extent such measures are within Company's reasonable control, and consistent with Company's incident response procedures.

9.3 No Admission; Client-Caused Breaches

Company's notification of or response to a Personal Information Breach pursuant to this Section 9 shall not be construed as an acknowledgement of fault, liability, or wrongdoing by Company. The obligations in this Section 9 shall not apply to the extent the Personal Information Breach results from Client's or its Authorized User's acts or omissions, including Client's instructions, configuration choices, integrations, or failure to comply with Data Protection Laws. For the avoidance of doubt, all liability arising from or relating to a Personal Information Breach shall be governed exclusively by the liability, limitation of liability, and exclusion provisions of the SaaS and Platform Agreement, and nothing in this DPA creates any separate or additional indemnification or liability obligations.

10. Audit Rights

10.1 Records and Compliance Information

Company shall maintain appropriate records sufficient to demonstrate its compliance with its obligations under this DPA and shall, upon Client's reasonable written request, make available to Client information reasonably necessary to demonstrate such compliance, including copies of relevant certifications, summaries of audit reports, or other documentation customarily made available to Clients for this purpose, subject to reasonable confidentiality restrictions and provided that such information does not disclose Company confidential information unrelated to Client or Personal Information.

10.2 Audits

To the extent required by Data Protection Laws or Standard Contractual Clauses, Client (or an independent third-party auditor selected by Client and reasonably acceptable to Company) may conduct an audit of Company's compliance with this DPA, provided that: (a) such audit is limited in scope to matters relevant to Company's Processing of Client Personal Information under this DPA; (b) Client provides at least thirty (30) days' prior written notice; (c) audits occur no more than once in any twelve (12) month period, unless required by a competent Supervisory Authority or following a documented Personal Information Breach attributable to Company's Processing of Client Personal Information; (d) audits are conducted during Company's normal business hours and in a manner designed to minimize disruption to Company's business operations; (e) Client bears all costs and expenses of the audit, including reasonable reimbursement of Company's time and resources; (f) no access is provided to Company's confidential information unrelated to Client, including information relating to Company's other Clients, internal financial data, or proprietary systems; and (g) any third-party auditor enters into confidentiality obligations with Company that are reasonably acceptable to Company.

10.3 Alternative Measures

Where the provision of certifications, third-party audit reports, or other compliance documentation reasonably satisfies Client's audit requirements under Data Protection Laws or Standard Contractual Clauses, Client agrees not to exercise on-site audit rights unless otherwise required by a competent Supervisory Authority.

10.4 Standard Contractual Clause

To the extent the parties have entered into Standard Contractual Clauses pursuant to this DPA, the audit rights described in such Standard Contractual Clauses shall be exercised in accordance with this Section 10 and subject to the procedural limitations set forth herein, to the extent permitted by Data Protection Laws.

11. Deletion of Personal Information

Company shall, upon Client's request and at the choice of Client, delete or return all Client Personal Information that is Processed on Client's behalf following termination or expiration of the Services involving the Processing of such data, and delete existing copies thereof, in each case unless retention of such Client Personal Information is required or permitted by applicable law or expressly permitted under the SaaS and Platform Agreement. If return or deletion of Client Personal Information is impracticable or prohibited by applicable law, rule, or regulation, Company shall take commercially reasonable measures to restrict further Processing of such Client Personal Information (except to the extent required for its continued retention or Processing as required by applicable law) and shall continue to protect such Client Personal Information in accordance with this DPA for so long as it is retained. Any such retained Client Personal Information shall remain subject to the confidentiality, security, and use limitations set forth in this DPA. To the extent the Standard Contractual Clauses apply to the Processing of Client Personal Information, Company shall, upon Client's written request, provide certification of deletion as required under the applicable Standard Contractual Clauses and subject to the limitations of liability set forth in the SaaS and Platform Agreement.

12. Term

This DPA shall commence on the date it becomes effective pursuant to the SaaS and Platform Agreement and shall continue in full force and effect until the later of (a) the termination or expiration of the SaaS and Platform Agreement, or (b) completion of the last of the Services to be performed pursuant to the SaaS and Platform Agreement, and thereafter solely for so long as Company continues to Process Client Personal Information on Client's behalf.

13. Limitation of Liability; No Independent Obligations

13.1 Limitation of Liability

Except to the extent expressly prohibited by Data Protection Laws, all claims, liabilities, damages, losses, costs, and expenses arising out of or relating to this DPA (including any alleged failure to comply with Data Protection Laws) shall be subject to the limitations of liability, exclusions of damages, and allocation of risk set forth in the SaaS and Platform Agreement.

13.2 No Separate Liability Regime

This DPA does not create any additional liability, indemnification, or damages obligations beyond those expressly set forth in the SaaS and Platform Agreement.

14. Governing Law

This DPA shall be governed by and construed in accordance with the governing law and forum provisions set forth in the SaaS and Platform Agreement, which are incorporated herein by reference and shall apply equally to this DPA, unless and solely to the extent required otherwise by Data Protection Laws.

Attachment 1

The following includes the information required by Annex I and Annex III of the EU SCCs, and Table 1, Annex 1A, and Annex 1B of the UK Addendum.

ANNEX I

A. LIST OF PARTIES

Data exporter(s): Names and Addresses: As set forth in the SaaS and Platform Agreement or applicable Order. Contact details: As set forth in the notice provisions of the SaaS and Platform Agreement or Client account records. Execution: Not required; this Annex is deemed completed and incorporated by reference pursuant to the DPA and SaaS and Platform Agreement. Activities relevant to the data transferred under these Clauses: Described in Annex I.B. Role: Controller or Processor, as applicable, in accordance with the DPA and Data Protection Laws.

Data importer(s): Names and Addresses: Client name and address as set forth in the SaaS and Platform Agreement or applicable Order. Contact details: As set forth in the notice provisions of the SaaS and Platform Agreement. Execution: Not required, this Annex is deemed completed and incorporated by reference pursuant to the DPA and SaaS and Platform Agreement. Role: Controller or Processor, as applicable, in accordance with the DPA and Data Protection Laws.

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose Personal Information is transferred: Client's Authorized Users, end users, employees, contractors, and other individuals whose Personal Information is processed in connection with the Services.

Categories of Personal Information transferred: Identifiers, contact information, account information, usage data, and other Personal Information submitted to or generated through use of the Services, as determined by Client.

Sensitive data transferred (if applicable) and applied restrictions or safeguards: None, unless expressly agreed in writing by the Parties. The Services are not intended for the processing of special categories of Personal Information.

The frequency of the transfer: Continuous.

Nature of the processing: Collection, storage, hosting, transmission, retrieval, use, and deletion of Personal Information as necessary to provide, maintain, and support the Services in accordance with the SaaS and Platform Agreement and DPA.

Purpose(s) of the data transfer and further processing: Provision, operation, maintenance, security, and improvement of the Services, and related business operations, as instructed by Client.

The period for which the Personal Information will be retained: For the duration of the Services and thereafter in accordance with the data retention and deletion provisions of the DPA and SaaS and Platform Agreement.

For transfers to Sub-Processors, also specify subject matter, nature and duration of the processing: Subject Matter (Personal Information elements): The same categories of Personal Information described above. Nature of processing: Processing as necessary to support the Services in accordance with written agreements imposing data protection obligations consistent with this DPA.

C. COMPETENT SUPERVISORY AUTHORITY

The Supervisory Authority shall be the Supervisory Authority of the Data Exporter, as determined in accordance with Clause 13 of the Standard Contractual Clauses.

ANNEX III – List of Sub-Processors

• Amazon Web Services (AWS) — United States / global regions — Cloud hosting and storage
• Stripe, Inc. — United States — Payment processing
• PostHog, Inc. — United States / EU regions — Product analytics
• Clerk, Inc. — United States / EU regions — Authentication & SSO

ANNEX II – Technical and Organisational Measures

The following includes the information required by Annex II of the EU SCCs and Annex II of the UK Addendum. Company implements technical and organizational measures intended to protect Client Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the nature of the processing and the risks involved. These measures include the following:

• Encryption of Client Personal Information during transmission over public networks and while stored, using industry-standard encryption mechanisms.
• Multi-factor authentication for administrative access to systems that process or store Client Personal Information.
• Logical access controls, including role-based access and least-privilege access restrictions, to limit access to Client Personal Information to personnel with a legitimate operational need.
• Monitoring and logging of system activity and security-relevant events, including the use of vulnerability detection or management tools.
• Data backup mechanisms and tested restoration capabilities designed to support availability and integrity of Client Personal Information in the event of system failure or data loss.
• Personnel confidentiality obligations, including confidentiality commitments applicable to individuals with access to Client Personal Information and security-related training provided as part of onboarding or ongoing employment.
• Physical and environmental security controls implemented by third-party hosting or cloud service providers where Client Personal Information is stored or processed, such as controlled facility access and environmental safeguards.
• Periodic review of security controls, including updates to technical safeguards where reasonably necessary in light of evolving security risks or platform changes.

Company may rely on security features and controls provided by its hosting, cloud infrastructure, or other service providers as part of the measures described above.

MODEL CANCELLATION FORM

(Complete and return this form only if you wish to withdraw from the contract)

To:

xFigura, Inc. 20 Fisher Avenue, 02120, Boston, MA, USA info@xfigura.ai

I/We hereby give notice that I/We cancel our contract of sale for the supply of the following service:

________________________________________________________________________________________________________________________________________

________________________________________________________________________________________________________________________________________

________________________________________________________________________________________________________________________________________

Ordered on (date): Name of consumer(s): Address of consumer(s): Signature of consumer(s) (only if this form is notified on paper): Date:

• Scope of This Policy

• Agreement to Terms

• Information We Collect

• Cookies

• Children's Privacy

• Our Use of Personal Information

• Our Disclosure of Personal Information

• Your Privacy Choices

• Security

• Additional Disclosures for Residents of the European Union (EU), United Kingdom (UK), and Switzerland

• Additional Information for International Users

• Links to Other Websites

• Effective Date and Changes to This Privacy Policy

• How to Contact Us

Scope of This Policy

xFigura, Inc. ("xFigura," "we," "us," "our") respects your privacy and values your trust. The purpose of this Privacy Policy is to inform you of the treatment and handling of personal information that we may learn about you when you visit our website at https://xfigura.ai (the "Site"), purchase or inquire about our products and services, engage with our content, or otherwise access or use of any of our services (collectively, the "Service"). If you have any questions regarding this information or our privacy practices, please contact us via the methods set out in the How to Contact Us section at the end of this Privacy Policy.

Agreement to Terms

By using or accessing the Service in any manner, you acknowledge that you agree to be bound by this Privacy Policy and our Terms of Use, which together govern your access to and use of the Service. If you do not agree with the terms of this Privacy Policy and our Terms of Use, then you should immediately discontinue use of the Service without providing us with any personal information.

Information We Collect

We may collect the following categories of personal information (i) directly from you (such as when you create an account or contact us), (ii) from third-parties such as when you access the Service using third-party login or authentication credentials or connect a Third-Party Model (defined below) to your account, (iii) from the device and browser that you use to access the Service, and (iv) from cookies and similar technologies.

Identifiers

We may collect your first name, last name, email address, account password.

Professional and/or Employment Information

If you apply for, interview for, and/or accept employment with us, we may collect personal information related to your candidacy and employment, such as contact information, resume and work history, education, references, and information required to administer compensation, benefits, and comply with applicable legal obligations.

Financial and Transactional Information

We may collect your payment details (such as bank account or credit/debit card information), billing address, and order history.

User-generated Content

We may collect personal information that you choose to include in your AI Input (defined below) or text or images added to boards you create, including content you share publicly or with collaborators through the Service.

Demographics and Characteristics

We may collect your age if you choose to provide this information in connection with your application for employment.

Device Information

We may collect device information when you visit our Site. Device information may include your device type, browser type, online and/or unique identifiers, IP address, and geolocation information.

Internet Activity

We may collect information concerning your interaction with the Site, including when you access the Site and your browsing activity on the Site (such as which pages you visit, in what order, and for how long). This may also include "traffic data" or tracking information provided by the Site's host or similar providers (e.g., Google Analytics) that may be helpful for marketing purposes or for improving the Site.

You are not required to provide all personal information identified in this Privacy Policy to use our Service or to interact with us, but certain features or functionality may not be available if you choose not to provide specific information. For example, if you do not provide certain personal information, we may not be able to register your account or respond to your requests.

Cookies

We store certain information that gets collected automatically at our end through cookies and other similar technologies. A cookie is a small string of information that a website that you visit transfers to your browser for identification purposes. Cookies can be used to follow your activity while using a website or across websites, and that information helps companies understand your preferences and tendencies, as well as improve and personalize your website experience. Cookies on the Site are generally divided into the following categories:

Strictly Necessary Cookies. These are required for the operation of the Site. They include, for example, cookies that enable you to log into password-protected portions of the Site. These cookies are session cookies that are erased when you close your browser.

Analytical/Performance Cookies. These allow us to recognize and count the number of visitors to the Site and understand how such users navigate through the Site and interact with its features (e.g., when and which pages are visited, in what order the pages are visited, and where a user is located).

We also use Google Analytics for part of this process. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. Google provides users with the ability to prevent their data from being used by Google Analytics—learn more by going to https://tools.google.com/dlpage/gaoptout.

Functional Cookies. These improve the functional performance of the Site and make it easier for you to use. For example, cookies are used to remember that you have previously visited the Site and asked to remain logged into it (e.g., this saves your username). These cookies qualify as persistent cookies because they remain on your device for use during your next visit to the Site. You can delete these cookies as detailed below.

In addition to the cookies described above, we may use third-party services that set cookies in connection with specific features of the Service, such as scheduling tools (e.g., Calendly), and customer support and live chat functionality (e.g., Tawk.to), which may use cookies or similar technologies in accordance with their own privacy policies.

You can also prevent the use of certain cookies by modifying your Internet browser settings, typically under the sections "Help," "Internet Options," or "Settings." If you disable or delete certain cookies in your Internet browser settings, you may still access our Site, however, you might not be able to access or use important functions or features of our Site, and you may, for example, be required to re-enter your log-in details.

Do-Not-Track Signals

At this time, we do not recognize automated "do-not-track" browser signals.

Children's Privacy

This section describes xFigura's collection, treatment, and handling of information that we may learn from children under 13 through their use of the Service.

The Service is made available to students under 13 only through accounts created and controlled by teachers, schools, or school districts. Students do not create individual accounts with xFigura, and, as a result, we generally do not collect or maintain information that identifies individual students.

In general, any information generated through student use of the Service is associated with and attributed to the applicable teacher, school, or district account, and not to any individual student.

Collection of Information

xFigura collects and processes information associated with student use of the Service only where that student's school, district and/or teacher has contracted with xFigura and consented to such use. xFigura collects and uses information associated with student use of the Service solely for the educational purposes authorized by the school, district, or teacher, and not for any other commercial purpose.

xFigura does not intentionally collect or maintain personal information that directly identifies individual students. To the extent information is generated through student use of the Service, such information is processed in connection with the applicable teacher, school, or school district account and is not used to identify or profile individual students.

xFigura also collects certain information from the device that is used to access the Site or Service. This may include device type, browser type, online and/or unique identifiers, IP address, and geolocation information. We collect this information solely to operate, maintain, secure, and support the Service and not to identify individual students.

Such device and technical information is collected at the account or session level and is not used to identify individual students.

Sharing of Information

xFigura uses service providers, including companies that host and operate the Site and Service, cloud infrastructure and storage providers, security and fraud-prevention providers, customer support providers, analytics providers, and providers of AI and related technical services. xFigura may share information associated with student use of the Service with these service providers in connection with the services they provide, and we contractually prohibit the service providers from retaining, using, or disclosing such information other than as is required to provide the services.

Any such information is shared only at the account or service level and is not disclosed for the purpose of identifying or profiling individual students.

Information associated with student use of the Service is not made publicly available and is not disclosed to other users except as enabled by the teacher, school, or district through the Service.

In the event of a change to the control or financial status of the company, including a corporate restructuring, sale, acquisition, financing, reorganization, bankruptcy, receivership, transfer, assignment of assets, or business merger or divestiture, information associated with student use of the Service may be shared in the diligence process with counterparties and others assisting with the transaction and transferred to a successor or affiliate as part of that transaction. The counterparty will be required to honor the commitments we have made in this Privacy Policy and if the counterparty seeks to alter the use or sharing of such information in a manner that is materially inconsistent with this policy, you will be provided notice of, and provided an opportunity to consent to, the new or changed practice.

We may also share information associated with student use of the Service with government bodies, dispute resolution organizations, law enforcement agencies, or third parties in connection with a lawful request for information, as part of our cooperation in a law enforcement or similar investigation, or otherwise to protect our rights, as applicable.

Review, Access and Retention of Information

xFigura will delete information associated with student use of the Service upon request from the applicable teacher, school, or district.

xFigura allows teachers, schools, and/or districts to review and delete information associated with student use of the Service If you are a parent and/or legal guardian and wish to review or delete information associated with your child's use of the service, please contact your child's teacher, school, or school district, which controls access to the Service and can submit requests to us on your behalf.

Because students do not maintain individual accounts with xFigura, requests to review, access, or delete information must be submitted to the applicable teacher, school, or district that controls the account through which the Service is accessed.

In limited cases where we are able to associate information with a particular student, we will work with the school or district to respond to such requests in accordance with applicable law.

If we learn we have collected personal information directly from a student under 13 other than pursuant to this section, or if we learn that a student under 13 has provided us personal information beyond what we requested from him or her, we will delete that information as quickly as possible. If you believe that a student under 13 may have provided personal information to us in violation of this section, please contact us at info@xfigura.ai.

Our Use of Personal Information

We collect and use your personal information for the following purposes:

• Providing the Service to you and providing products or services requested by, or reasonably anticipated within the context of our relationship with, you;

• Managing our relationship with you, and responding to your inquires or requests, and requesting feedback;

• Evaluating your eligibility for employment;

• Providing relevant promotional materials and other marketing;

• Administering promotions, events, or surveys;

• Keeping track of login names and passwords;

• Keeping track of click stream data;

• Analyzing use of the Site;

• Detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible; and

• Complying with legal and regulatory obligations.

Our Disclosure of Personal Information

We may share your personal information with the following third parties:

Service providers, including vendors that provide web hosting, cloud infrastructure, security, analytics, customer support, payment processing, and similar services, as well as providers that support AI-powered features made available through the Service. In some instances, service providers will be directly responsible to you for their use of your personal information. They may be obliged by law to provide you with additional information regarding the personal information that they hold about you and how and why they process that information. Further information may be provided to you in a separate notice or may be obtained from such service providers directly, for example, via their websites.

Third-Party Services and Integrations. The Service may allow you to connect third-party services or accounts, including third-party AI image generation tools, that are not operated or controlled by xFigura. If you choose to connect a third-party service, information may be shared with that service at your direction in order to enable the requested functionality. Your use of any connected third-party service is subject to that service's own terms and privacy practices, and we are not responsible for how such third parties collect, use, or disclose information.

Other users, such as when you share a board with specific collaborators or make a board publicly viewable through the Service.

Advisers and financial institutions, including auditors, notaries, business continuity support service providers, and legal, tax, and risk and compliance advisors.

With third parties in connection with a change to the control or financial status of the company, including a corporate restructuring, sale, acquisition, financing, reorganization, bankruptcy, receivership, transfer, assignment of assets, or business merger or divestiture. Personal information and other information may be shared in the diligence process with counterparties and others assisting with the transaction and transferred to a successor or affiliate as part of that transaction.

Government bodies, dispute resolution organizations, law enforcement agencies, or third parties in connection with: (i) responding to a subpoena, search warrant, or other lawful request for information that we receive; (ii) cooperating in a law enforcement or similar investigation; or (iii) otherwise protecting our rights, as applicable.

Your Privacy Choices

If you no longer want to receive our newsletter, emails, or other marketing communications, you may unsubscribe at any time by clicking the "unsubscribe" link in our marketing emails.

Please note that you cannot unsubscribe from certain correspondence from us, including messages relating directly to your account or purchases placed through the Site.

If you would like to request access to, correction of, or deletion of your personal information, please contact us at info@xfigura.ai. If you are located in the European Economic Area, the United Kingdom, or Switzerland, please refer to the section below titled Additional Disclosures for Residents of the European Union (EU), United Kingdom (UK), and Switzerland for additional information about your rights and how to exercise them.

Security

We maintain reasonable technical and organizational measures to protect personal information from loss, misuse, alteration, or unintentional destruction. We have implemented various security measures to protect both the personal information and the general information that we receive from you through the Service. Whenever you give out personal information online there is a risk that third parties may intercept and use that information. Although we seek to protect your personal information and privacy, we cannot guarantee the security of any information you disclose online. To the extent permitted under applicable law, we assume no liability or responsibility for disclosure of your information due to errors in transmission, unauthorized access by third parties, or other causes beyond our control.

You play an important role in keeping your information secure. You should not share your username or password with anyone. If you have reason to believe that your account is no longer secure, please contact us immediately at info@xfigura.ai.

Additional Disclosures for Residents of the European Union (EU), United Kingdom (UK), and Switzerland

This section provides additional information for residents of the EU, UK, and Switzerland.

Data Transfers

As a US company, most of our operations are conducted in the United States and in order to provide the Service, personal information will be processed in the United States, where laws regarding processing of personal information may be less stringent than the laws in your country. We provide appropriate protections for cross-border transfers as required by applicable law for international data transfers. With respect to transfers originating from the EU, UK, and/or Switzerland, we implement the standard contractual clauses approved by the respective data protection authorities.

Retention of Your Personal Information

We retain personal information for as long as necessary to fulfill the purposes for which the information was collected; as needed to address tax, corporate compliance, employment, litigation, and other legal rights and obligations; and as otherwise permitted by law.

Legal Basis for Processing Your Personal Information

Where required, we have several different legal grounds on which we collect and process your personal information for the purposes set out in the Our Use of Personal Information section above, including: (i) as may be necessary to perform a contract with you; (ii) as necessary to comply with a legal obligation; (iii) consent (where consent has been provided as appropriate under applicable law); and (iv) as necessary for our legitimate interests (such as when we act to maintain our business generally, including maintaining the safety and security of the Service).

Automated Decision-Making

We do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or that otherwise significantly affects you.

Your Rights

As available and except as limited under applicable law, individuals in the EU, UK, and Switzerland have the rights described below:

Access. You have the right to request a copy of the personal information we are processing about you, which we will provide to you in electronic form.

Rectification. You have the right to require that any incomplete or inaccurate personal information that we process about you is amended.

Deletion. You have the right to request that we delete personal information that we process about you, unless, for example, we are required to retain such information to comply with a legal obligation or to establish, exercise, or defend a legal claim.

Restriction. You have the right to request that we restrict our processing of your personal information where: (i) you believe such data to be inaccurate; (ii) our processing is unlawful; or (iii) we no longer need to process such data for a particular purpose, but where we are not able to delete the data due to a legal or other obligation or because you do not want us to delete it.

Portability. You have the right to request that we transmit the personal information we hold with respect to you to another data controller.

Objection. Where the legal justification for our processing of your personal information is our legitimate interest, you have the right to object to such processing on grounds relating to your situation. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data to establish, exercise, or defend a legal claim.

Withdrawing Consent. If you have consented to our processing of your personal information, you have the right to withdraw your consent at any time, free of charge. Please note that if you withdraw your consent, this will not affect the lawfulness of our use and processing of your information based on your consent before the point in time when you withdraw your consent or processing of your information based on other legal bases.

Some rights may be limited, and we may need to retain certain personal information, as required or permitted by applicable law. To inquire about or exercise the rights listed above, at any time, contact us at info@xfigura.ai with the subject line "Europe Privacy Request" so that we can get your email to the right team. We will respond to your request consistent with applicable law.

If you feel that your request or concern was not satisfactorily resolved by us, you have the right to lodge a complaint with your local data protection authority.

Additional Information for International Users

The Service is operated from the United States. If you access or use the Service from outside the United States, you acknowledge and agree that your personal information may be transferred to, stored in, and processed in the United States and other jurisdictions where we or our service providers maintain facilities.

We may process personal information in accordance with this Privacy Policy and applicable United States law. Certain jurisdictions outside the United States provide individuals with specific rights regarding their personal information under local data protection or privacy laws. Where such laws apply to our processing of your personal information, we will respond to requests from individuals to exercise their rights as required by applicable law.

Without limiting the foregoing, where required by applicable law, we implement reasonable technical and organizational safeguards designed to protect personal information transferred across borders.

If you believe that you are entitled to exercise rights under applicable data protection or privacy laws, you may submit a request by contacting us at info@xfigura.ai. We will review and respond to your request in accordance with applicable law.

Links to Other Websites

For your convenience, we may link to third-party sites and services, or otherwise display third-party content through our Site to provide increased value to our visitors. We have no control over these linked sites, each of which has separate privacy and data collection policies and practices independent from us. As such we have no responsibility or liability for these independent policies or actions and are not responsible for the privacy practices or the content of any such websites. Please note that these other sites may send their own cookies to users, collect data, or solicit personal information, and we encourage you to review their policies before engaging with these third-party sites.

Effective Date and Changes to This Privacy Policy

This Privacy Policy is effective as of the date at the top of this policy. xFigura has the discretion to update this Privacy Policy at any time. When we do, we will revise the effective date at the top of this page. We encourage users to frequently check this page for any changes and to stay informed about how we are helping to protect the personal information we collect, especially before you provide information, and particularly personal information, directly to us through the Service. In the event of a material change to this Privacy Policy, we will provide a message through our website or via email informing you of the change.

How to Contact Us

If you have any questions about this Privacy Policy or our Service, please contact us at info@xfigura.ai.

Contact: hello@xfigura.org

Address: xFigura, Inc., 20 Fisher Avenue, Boston, MA 02120

Reference: This Addendum supplements and forms an integral part of the xFigura Terms of Service

1. Scope

1.1 This Addendum applies where xFigura processes Customer Personal Data in connection with providing the Services under the Agreement.

1.2 Customer is the Controller and determines the purposes and means of processing. xFigura is the Processor and will process Customer Personal Data only on documented instructions from Customer, unless required by law.

1.3 Capitalized terms not defined here have the meanings in the Agreement or Applicable Data Protection Laws.

2. Definitions

• "Applicable Data Protection Laws" means all data protection and privacy laws that apply to the processing, including the GDPR, UK GDPR, and FADP.
• "Customer Personal Data" means personal data processed by xFigura on behalf of Customer under the Agreement.
• "SCCs" means the European Commission Standard Contractual Clauses adopted by Decision 2021/914.
• "Subprocessor" means a third party engaged by xFigura to process Customer Personal Data on its behalf.

3. Nature, Purpose, and Duration

3.1 Purpose: xFigura processes Customer Personal Data solely to operate and provide the Services, including account administration, collaboration and visualization features, AI-assisted content generation at Customer's direction, support, security, and legal compliance.

3.2 Duration: Processing lasts for the term of the Agreement unless otherwise required by law.

3.3 Categories: Described in Exhibit B.

3.4 Prohibited Data: Customer will not submit any special categories of personal data, biometric identifiers, government IDs, or personal data of children under 16, unless expressly agreed in writing and subject to additional safeguards.

4. Processing and Compliance

4.1 xFigura will process Customer Personal Data only on documented instructions from Customer, including transfers, unless required by law.

4.2 Each party will comply with its obligations under Applicable Data Protection Laws. Customer is responsible for the lawfulness of its instructions and for obtaining necessary consents.

4.3 xFigura will not use Customer Personal Data to train or fine-tune AI models.

4A. Records of Processing

xFigura will maintain records of processing activities for Customer Personal Data as required by Applicable Data Protection Laws and will make such information available to Customer upon reasonable request.

5. Confidentiality and Personnel

xFigura ensures that personnel authorized to process Customer Personal Data are bound by confidentiality and receive data-protection training. Reasonable steps are taken to ensure reliability of such personnel.

6. Security

xFigura implements technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

These measures include encryption at rest and in transit, multi-factor authentication, access control, vulnerability management, logging, monitoring, and backups. Details appear in **Appendix A**.

7. Breach Notification

xFigura will notify Customer without undue delay and no later than 72 hours after becoming aware of a personal data breach.

The notice will include, to the extent known:

• nature of the breach;
• categories and approximate number of data subjects and records;
• likely consequences;
• measures taken or proposed; and
• a contact point for follow-up.

xFigura will update Customer as additional information becomes available and cooperate reasonably in investigations.

8. Subprocessors

8.1 Authorization: Customer authorizes xFigura to use Subprocessors to deliver the Services.

8.2 Notice and Objection: xFigura will notify Customer at least 21 days in advance of new or replacement Subprocessors. Customer may object on reasonable data-protection grounds. If unresolved within 30 days, Customer may terminate the affected Services and xFigura will refund unused prepaid fees.

8.3 Liability: xFigura remains responsible for its Subprocessors' acts and omissions.

8.4 **Current Subprocessors** are listed in Exhibit A.

9. Data Subject Requests and Assistance

xFigura will assist Customer in responding to data-subject requests (access, rectification, erasure, restriction, portability, and objection) where such requests relate to the Services and Customer cannot fulfill them directly.

xFigura will also provide reasonable assistance with data-protection impact assessments and regulator consultations related to the Services.

9A. Data Transfer Impact Assessments and Regulator Cooperation

xFigura will assist Customer in completing transfer impact assessments and cooperate with competent supervisory authorities on matters related to xFigura's processing of Customer Personal Data.

10. Government and Legal Requests

If xFigura receives a request from a government authority for Customer Personal Data, it will, unless prohibited by law, promptly notify Customer and redirect the authority to request the data from Customer.

xFigura will challenge unlawful or overbroad requests where legally feasible and disclose only what is legally required.

11. International Data Transfers

xFigura may process Customer Personal Data in countries where xFigura or its Subprocessors operate, subject to lawful transfer mechanisms.

Where Customer Personal Data is transferred from:

• EEA: the SCCs apply as set in Exhibit C Part 1.
• UK: the UK Addendum issued by the ICO (March 2022) applies per Exhibit C Part 2.
• Switzerland: the clause below applies.

SCC Addendum – Data Transfer Switzerland 07/2024

With respect to Customer Personal Data transferred from Switzerland for which Swiss law (and not the law in any European Economic Area jurisdiction) governs the international nature of the transfer, the EU SCCs will apply and will be deemed to have the following differences to the extent required by the Swiss Federal Act on Data Protection ("FADP"):

References to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR.

The term "member state" in the EU SCCs will not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs.

Under Annex I(C) of the EU SCCs (Competent supervisory authority): where the transfer is subject exclusively to the FADP and not the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and where the transfer is subject to both the FADP and the GDPR, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner insofar as the transfer is governed by the FADP, and the supervisory authority is as set forth in the EU SCCs insofar as the transfer is governed by the GDPR.

12. Return and Deletion

Upon termination or expiry of the Agreement, and upon Customer's written instruction, xFigura will delete or return Customer Personal Data within 30 days.

Encrypted backups containing such data will be purged within 35 days unless retention is legally required.

xFigura will confirm completion upon request.

13. Liability, Notices, and Miscellaneous

14.1 Each party's liability under this Addendum is subject to the Agreement's limitations.

14.2 In case of conflict, this Addendum prevails over the Agreement concerning data-protection matters.

14.3 Governing law and venue follow the Agreement; for SCCs, the laws and courts set forth in Exhibit C apply.

14.4 Notices: Privacy or legal notices to xFigura must be sent to **hello@xfigura.org** or by post to **xFigura, Inc., 20 Fisher Avenue, Boston, MA 02120.**

14.5 Survival: Sections 5–14 and all Exhibits/Appendices survive termination.

Exhibit A – Subprocessors

• Amazon Web Services (AWS) — United States / global regions — Cloud hosting and storage
• Stripe, Inc. — United States — Payment processing
• PostHog, Inc. — United States / EU regions — Product analytics
• Clerk, Inc. — United States / EU regions — Authentication & SSO

Exhibit B – Details of Processing

• Subject matter & duration: Provision of Services for the Agreement term.
• Nature & purpose: Hosting, authentication, collaboration, AI-assisted design generation, support, and operations.
• Data subjects: Customer's employees, contractors, students, or end-users authorized to use the Services.
• Personal data: Identifiers (name, email, account ID, authentication data, IP logs, usage metadata), and user-submitted content.
• Special categories: Not expected.
• Frequency: Continuous during the Agreement term.

Exhibit C – Cross-Border Transfers

Part 1 – EEA Transfers

SCC Modules 2 and 3 apply; governing law and courts: Ireland.

Other standard SCC provisions per Decision 2021/914.

Clause 7 Docking Clause does not apply.

Clause 9 Option 2 General Written Authorization applies, with a 21-day notice period as set in Section 8.2.

Clause 11 optional language does not apply.

Part 2 – UK Transfers

The parties adopt the UK ICO Addendum (March 2022). Governing law and forum: England and Wales. Competent authority: Information Commissioner.

The UK Addendum Part 1 tables are completed by reference to the parties and processing details in this Addendum and Exhibit B. The Approved EU SCCs are the SCCs referenced in Exhibit C Part 1.

Part 3 – Additional Safeguards

xFigura maintains encryption and security measures to prevent interception, will resist bulk or unlawful surveillance requests where lawful to do so, and will disclose only when legally required.

Upon written request once per year, xFigura will summarize any binding disclosure demands received, to the extent permitted by law.

Appendix A – Security Measures

xFigura maintains an information-security program designed to protect Customer Personal Data from accidental or unauthorized loss, destruction, alteration, disclosure, or access. Measures include:

• Encryption of data in transit and at rest.
• Multi-factor authentication for administrative access.
• Logical access controls and least-privilege policies.
• Continuous monitoring, logging, and vulnerability management.
• Regular backups and tested restoration procedures.
• Employee security training and confidentiality agreements.
• Physical and environmental protections in hosting facilities.
• Review and update of security controls at least annually.