Terms of Use

1. Agreement and authority

These Terms govern access to and use of Railspike, including its hosted software, supported integrations, AI-assisted features, documentation and related services (the Service). The agreement is between Aurevus Innovations Inc., a Canadian corporation (Aurevus, we, us), and the organization identified in the accepted subscription order (Customer, you).

An Order means the subscription details expressly accepted at checkout or an order form accepted by both parties. It identifies the Customer, subscription, price, minimum commitment, billing interval, included allowances and any agreed scope exceptions. A quote or proposal is not an accepted Order by itself.

The person accepting this agreement represents that they are an adult with authority to bind the Customer. The Service is offered for business and organizational purposes. Individuals who access it for a Customer are Authorized Users and must comply with the applicable use restrictions. The Customer is responsible for their use within its account.

These Terms, the accepted Order and Schedule A form the agreement. An expressly negotiated provision of an Order overrides a conflicting provision of these Terms only for its identified subject. Schedule A controls conflicting provisions about processing Customer Personal Information. Mandatory law and applicable merchant-of-record purchase terms retain their effect. The Privacy Policy explains personal-information handling; it does not transfer ownership of personal information or replace an individual's legally required consent. Customer purchase-order boilerplate does not amend this agreement unless we expressly accept it.

2. Subscription and scope

During a valid subscription, Aurevus grants the Customer a limited, non-exclusive right to access the Service for the internal operations of its Covered Business, subject to this agreement. The subscription includes the standard suite identified in the Order and Authorized User access without a per-seat charge. Particular features may require supported data, configuration, permissions or third-party services.

The Covered Business is the operating business of the Customer identified in the Order, together with any affiliate whose operations the Customer operates through, connects to, or uses the Service to support. An affiliate is an entity controlling, controlled by or under common control with the Customer. The Customer must have authority to act for each included affiliate and remains responsible for its use. Common ownership alone does not automatically include an affiliate whose operations are separate from the Covered Business and are not served through the subscription.

The default subscription covers the Covered Business's entire qualifying residential portfolio. Selecting particular uploads, buildings, connectors or users does not create a narrower commercial scope. A limited-portfolio pilot or other exception exists only if the accepted Order expressly identifies its scope, exclusions and applicable restrictions. The Customer may not use a limited-scope subscription to support excluded operations.

Unless expressly included in the Order, the standard subscription does not include bespoke connectors, manual migration, dedicated infrastructure, consulting or a contractual service-level agreement. Product plans and roadmaps are not commitments to deliver future features.

3. Doors, minimum commitment and full-portfolio reporting

3.1 What is a door?

A Door is a distinct residential dwelling unit in the Covered Business's operating or construction portfolio. This includes occupied and vacant units owned for rental, operated or managed by the Covered Business, and individual residential units in projects for which the Covered Business has commenced active construction delivery or construction management. Units need not be physically complete, occupied, imported or regularly accessed to count.

A building or project containing 100 residential units contains 100 Doors. A physical unit counted in both construction and management counts once within the same Covered Business. Its transition between those stages does not create a new charge or remove it from the count. Common areas, parking stalls, storage spaces, equipment records and individual users are not additional Doors. Land holdings and speculative projects not yet in active construction delivery or construction management are not Doors under this definition. Non-residential portfolios and other unit types require an expressly agreed commercial measure before operational use of the Service for those assets.

A Billable Door is a Door in the Covered Business's portfolio that has not permanently left that scope. A unit ceases to qualify when it is genuinely sold out of the Covered Business with no continuing covered operation or management responsibility, the relevant management responsibility ends, or the unit is permanently removed from use and the covered construction/operating activity has ended. Vacancy, temporary inactivity, hiding a record, disabling a connector, or changing a database status does not by itself retire a Billable Door. Historical records may be retained after a genuine retirement without making the unit billable solely because those records still exist.

3.2 All qualifying doors must be declared

The Customer must accurately declare and maintain the complete number of Billable Doors in its Covered Business, including units not individually entered into Railspike. The declared quantity is a representation of the actual portfolio, not an option to purchase unrestricted organizational use at a smaller count.

Unless a different minimum is expressly accepted in the Order, the minimum subscription is 150 Doors. The monthly subscription quantity is the greater of 150 and the actual Billable Door count. At the standard rate of C$4 per Door per month, the minimum is C$600 per month, before applicable taxes and expressly purchased extras.

Example: a Covered Business with 1,000 Billable Doors owes C$4,000 per month at the standard rate. Paying the C$600 minimum does not authorize it to operate that business through Railspike while declaring only 150 Doors.

3.3 No evasion

The Customer must not understate or conceal Doors, mark active units as retired, rotate units through a smaller declared allocation, merge distinct units into a single record, or split operations across accounts, workspaces, affiliates, connectors or subscriptions to evade applicable fees or scope restrictions. Portfolio-level analysis, corporate reporting and automation for the Covered Business are subject to the same scope obligation as unit-level workflows.

This does not create duplicate charges for the same unit within an agreed covered subscription. Where separately contracted subscriptions are genuinely needed, the allocation must be documented so the correct units and obligations remain clear.

3.4 Updates and verification

The Customer must update its declaration before knowingly extending the Service to newly added operations or units, and promptly correct any discovered error. An authorized administrator must certify the starting count and, on reasonable request, confirm its continuing accuracy.

Aurevus may reconcile declarations against relevant unit, property, project and usage records already lawfully available within the Service. This right does not authorize access to an unconnected system, collection of unrelated resident details or bypassing a permission. Where a discrepancy reasonably requires further evidence, the Customer must provide an appropriate unit summary or suitably redacted supporting record. Aurevus will explain the discrepancy, use proportionate verification and protect the information as confidential.

We may require a limited independent verification on reasonable notice where a material discrepancy remains unresolved. Its scope must be confined to subscription compliance, avoid unnecessary personal information and minimize disruption. Aurevus bears its verification costs unless the parties separately agree otherwise or applicable law permits recovery following proven misconduct.

3.5 Corrections and remedies

If the Customer has underreported its scope, Aurevus may correct the recorded quantity and recover the subscription fees that should have been payable for the affected billing periods, using the rate and contractual scope applicable to those periods. We will provide an itemized explanation and a reasonable opportunity to question the calculation before seeking collection. Ordinary corrections are not subject to an invented penalty multiplier.

The Customer must pay undisputed amounts when due. If intentional evasion or a material discrepancy is not promptly resolved after notice and a reasonable opportunity to correct it, Aurevus may restrict new processing or suspend or terminate the affected use under section 14. Overpayments caused by our billing error will be corrected with an appropriate credit or refund. Nothing in this section permits retroactively applying a newly expanded scope obligation to an earlier, different agreement.

4. Accounts and administration

The Customer must maintain accurate account and billing information, protect credentials, assign individual accounts, use available security controls appropriately, and promptly remove access that is no longer authorized. Shared credentials and impersonation are prohibited. Notify concierge@aurevus.ai promptly of suspected compromise.

Customer administrators control invitations, roles, connected systems, available permissions and processing settings within the Service. A directory sign-in does not, by itself, authorize a person to join a workspace or access every record. The Customer is responsible for the authority it grants, including authority given to contractors and representatives.

5. AI, evidence and authorized actions

The Service may use multiple models, providers and processing methods for functions such as extraction, indexing, retrieval, drafting, research, forecasting and workflow assistance. Particular model brands or versions are not guaranteed unless expressly included in an Order. We may update the underlying technology subject to the agreed functionality, confidentiality, data-processing commitments and any required notice or consent.

AI outputs may be incomplete, inaccurate, outdated or unsuitable for a particular purpose. A citation identifies material to examine; it does not guarantee that the source is accurate or that an inference is correct. Outputs and forecasts may not be unique. The Customer must apply appropriate human judgment and verify material facts before relying on a result.

Railspike does not provide legal, engineering, building-code, accounting, tax, employment, financial or other regulated professional advice. The Customer remains responsible for qualified professional review, required inspections, permits, notices, safety duties and compliance decisions. The Service is not an emergency-response or life-safety system and must not be the sole basis for such functions.

Actions operate within available permissions and the governance settings authorized for the Customer. Those settings may allow specified automation and require approval for other actions. The Customer is responsible for setting suitable limits, approving the actions that require approval, and reviewing outcomes. A configuration change or instruction must not be used to evade applicable law or another person's rights. No contractual wording authorizes an action beyond the access and authority actually granted.

6. Customer data, outputs and platform ownership

Customer Data means content, records and other information supplied or connected by or for the Customer, together with customer-specific records and outputs generated from that information through the Service. As between the parties, the Customer retains its rights in Customer Data. Personal-information rights and third-party rights are not overridden by this allocation.

The Customer grants Aurevus a limited right to host, copy, transmit, index, transform and otherwise process Customer Data only to provide and secure the Service, carry out documented instructions, support the Customer, enforce legitimate subscription obligations and comply with law, as further limited by Schedule A and the Privacy Policy. This is not a right to sell Customer Data, expose it to other customers or use it for unrelated advertising.

Aurevus will not use Customer Data to train or fine-tune AI models for itself, its providers or other customers, and will require corresponding restrictions for processing on its behalf. Authorized indexing, retrieval and generation for the Customer do not authorize model training on Customer Data.

To the extent Aurevus obtains assignable intellectual-property rights in customer-specific AI outputs created for the Customer, Aurevus assigns those rights to the Customer. This does not transfer Aurevus's pre-existing software, models, templates, general methods or other platform technology; third-party material; or rights that do not legally exist. Where platform material is embedded in an output, the Customer may use that material as needed to use the output for its legitimate business purposes. Aurevus does not guarantee exclusivity, copyright protection or freedom from third-party claims for AI-generated material.

Aurevus and its licensors retain rights in the Service and its underlying technology. Customer feedback may be used to improve the Service without compensation, but feedback does not grant a license to disclose confidential Customer Data or personal information. Customer names and logos will not be used as endorsements without permission.

7. Confidentiality

Each party may receive non-public business, technical, security, financial or operational information from the other (Confidential Information). Customer Data is the Customer's Confidential Information. Information is excluded if the receiving party can establish that it is public through no breach, already lawfully known without restriction, lawfully received from another source without a duty of confidence, or independently developed without use of the disclosure.

The receiving party must use Confidential Information only for this agreement, protect it with reasonable care, and disclose it only to people and service providers who need it for an authorized purpose and are subject to appropriate confidentiality obligations. The receiving party remains responsible for its permitted recipients as required by this agreement and law.

A legally compelled disclosure must be limited to what is required, with advance notice and reasonable cooperation where lawful. Confidentiality obligations survive termination while the information remains confidential; trade secrets remain protected for as long as they qualify as trade secrets.

8. Customer responsibilities and acceptable use

The Customer must have the rights and lawful authority needed to supply and instruct processing of Customer Data, including required notices, consents and permissions concerning residents, employees, applicants, contractors and other individuals. A subscription does not itself provide those permissions.

The Customer and its Authorized Users must not:

• access another customer's information, bypass security or scope controls, defeat required approval, alter evidence to mislead, or interfere with the Service;
• introduce malicious code, abuse capacity, conduct unauthorized scanning, or use the Service for unlawful, deceptive, discriminatory or harmful activity;
• use outputs as the sole basis for legally significant decisions about individuals where human judgment, notice, explanation, appeal or other safeguards are required;
• disclose passwords, full payment-card data, government identifiers, health information, biometric information or other specially regulated information unless necessary, lawfully permitted and expressly supported for the agreed use;
• resell or sublicense the Service, operate it for an unrelated organization outside the agreed scope, or copy protected platform technology, except to the extent a restriction is prohibited by law;
• misrepresent outputs as verified facts, guaranteed professional advice or proof of an inspection or approval that did not occur;
• evade billing, trial eligibility, purchased processing limits or legitimate technical safeguards.

Nothing here prevents lawful interoperability, independently developed competing products or security reporting that does not violate access restrictions or applicable law.

9. Integrations and third-party services

Connecting a system authorizes the Service to access the data and perform the functions permitted by the connection and Customer instructions. The Customer is responsible for obtaining the system owner's authorization, maintaining any required licenses and subscriptions, and selecting appropriate permissions. Revoking a connection stops future authorized access but does not automatically erase data previously imported or records that must be retained.

Customer-selected third-party services are governed by their own terms. Aurevus does not control their availability, fees, accuracy or independent handling of information. Third-party changes may require a connector to be modified, restricted or discontinued. We will provide reasonable notice of a material impact when practicable. These provisions do not remove Aurevus's responsibilities for service providers it engages to process Customer Personal Information on its behalf.

10. Fees, allowances, taxes and collection

Fees, minimums and purchased allowances are those accepted in the Order. The standard subscription is C$4 per Billable Door per month with the 150-Door minimum described above, plus applicable taxes and expressly purchased extras. A dedicated deployment or expressly agreed service may have additional terms and fees. A self-service purchase limit, if displayed, is not permission to understate the portfolio to pass checkout.

After any trial, subscriptions renew automatically for successive monthly periods unless the Order specifies another period or the Customer cancels before renewal. Recurring fees are payable in advance. Genuine additions or retirements change the quantity for the next monthly renewal unless the Order expressly specifies a different, disclosed proration method. Fees already charged for a current period are not ordinarily prorated on a quantity reduction. Underreporting corrections remain governed by section 3.5.

Included AI processing and other resource allowances must be described in the Order or an incorporated allowance schedule available before purchase. That schedule must specify the measurement, pooling period, expiry or rollover rule, included processing types and what happens at the limit. A token allowance is not a guaranteed number of questions or completed tasks. Top-ups and automatic replenishment require the Customer's express authorization, with the price and any spending cap disclosed in advance. Technical safety and concurrency limits do not authorize us to silently reduce a purchased allowance.

The Customer authorizes the payment provider identified at checkout to collect agreed recurring amounts and properly disclosed adjustments using the authorized payment method, subject to law and the payment authorization. If an adjustment requires new authorization, we will obtain it. The Customer must keep its payment details current. We may retry failed payments and give notice before limiting service for non-payment. A subscription includes invoices or receipts for the Customer's records; this does not create a right to deferred-payment terms.

Where checkout identifies Stripe Managed Payments or its designated entity as merchant of record, that entity handles the sale's payment collection and applicable indirect taxes within its supported scope. Its applicable purchase, cancellation and refund terms also apply. Aurevus remains responsible for the Railspike product obligations in this agreement. Where an Order uses a different collection arrangement, the identified arrangement governs. Payment-method information is supplied to the payment provider; Aurevus receives the billing and transaction information needed to administer the subscription.

Raise a suspected billing error promptly at concierge@aurevus.ai. We will investigate and correct errors. Failure to contact us does not waive non-waivable statutory or payment-network rights. The Customer must continue paying undisputed amounts.

We may change future subscription rates or minimums with at least 30 days' advance notice, taking effect no earlier than the next renewal after that notice period and after any expressly agreed price-protection period. No lifetime rate protection is implied. A change to quantity under an existing rate is not a rate increase.

11. Trial

An eligible new Customer may receive the trial stated at checkout, ordinarily 14 days. Checkout must show the trial end, renewal amount or its calculation, and payment-method requirement before acceptance. No base subscription charge is due during the advertised free trial. Separately purchased extras require explicit agreement.

The trial converts to the paid subscription shown at checkout unless cancelled before its end. The Customer may not obtain repeated trials for the same Covered Business by changing users, workspaces, payment methods or affiliates. Trial limits must be disclosed. If a Railspike provisioning failure prevents access during the trial, contact support so the unused trial time can be addressed; a completed payment step must not be represented as a functioning workspace when provisioning has failed.

12. Cancellation and refunds

The Customer may cancel renewal through the subscription-management route provided with its purchase or by contacting concierge@aurevus.ai if that route is unavailable. A request must identify the subscription and come from an authorized person. Deleting a user or disconnecting an integration does not cancel the subscription.

Cancellation normally takes effect at the end of the paid subscription period, with access continuing until then unless a lawful suspension or immediate termination applies. Cancelling before the trial ends avoids the first base subscription charge. Cancellation of renewal does not itself request immediate deletion of Customer Data.

Fees for a started paid period are ordinarily non-refundable, except for an express refund right in this agreement or Order, billing errors, mandatory law, or the applicable merchant-of-record policy. A more restrictive provision here does not override Stripe Managed Payments' applicable refund authority or customer purchase protections. Payment support is also available through the route in the customer's payment receipt. Product support is provided through Aurevus.

13. Service changes, availability and limited warranty

Aurevus will use reasonable care and skill to provide the Service substantially in accordance with its current documentation for the purchased functions. We may maintain and improve the Service and address security, legal and provider requirements. We will not materially reduce core purchased functionality during a committed paid term without an appropriate remedy or the Customer's agreement. If a material failure is not corrected within a reasonable period after notice, the Customer may terminate the affected service and receive a refund of the unused prepaid portion.

No uptime, recovery-time, recovery-point or support-response commitment applies unless expressly accepted in an Order or service-level agreement. Maintenance, outages, network failures and third-party interruptions can occur. Preview or experimental features are identified as such and may change or be withdrawn; their use must not silently alter agreed privacy protections.

Except for express commitments in this agreement and rights that cannot lawfully be excluded, the Service and outputs are provided without other warranties, including implied warranties of merchantability, fitness for a particular purpose or non-infringement. We do not guarantee a business outcome, forecast, regulatory determination or uninterrupted or error-free operation.

14. Suspension and termination

Aurevus may proportionately restrict or suspend affected use to address a credible security threat, unlawful activity, material misuse, required legal or payment-provider action, unresolved non-payment, or a material breach of this agreement. We will ordinarily provide notice, explain the reason where lawful and allow a reasonable opportunity to remedy it. Immediate action may be necessary to protect people, information or systems or to comply with law. Restoration will follow resolution of the relevant condition.

Either party may terminate for a material breach not cured within 30 days after written notice, or sooner where the breach cannot reasonably be cured or law requires. The Customer may also cancel renewal under section 12. If Aurevus terminates paid service for convenience, or the Customer terminates for Aurevus's uncured material breach, Aurevus will refund the unused prepaid subscription portion, subject to the payment provider's applicable process.

Suspension does not automatically authorize destruction of Customer Data. We will preserve reasonable access needed to resolve billing or obtain an export where safe and lawful. Outstanding legitimate fees remain payable; termination does not excuse an earlier breach.

15. Export, deletion and records

Authorized administrators may use supported export facilities during the subscription. Following expiry or termination, the standard retrieval window is 30 days unless an Order specifies otherwise or law or a security restriction requires a different approach. Where ordinary access is restricted, the Customer may request an appropriate export through support. Request export before the window ends; restoring a workspace after deletion is not guaranteed.

After the retrieval window or an authenticated earlier deletion request, Aurevus will delete or de-identify Customer Data under its documented retention process, subject to legal holds and required retention. Deletion includes relevant derived indexes and active copies; isolated backups expire through their documented rotation rather than necessarily being edited immediately. Data retained for legal, security or financial obligations is restricted to those purposes. Auditability does not authorize indefinite retention of personal information.

The Privacy Policy and applicable processing arrangement explain retention categories. A Customer must not instruct deletion in violation of its own legal duties. Customer requests cannot require Aurevus or an independent merchant of record to destroy records that must lawfully be retained.

16. Third-party claims

The Customer will defend Aurevus against a third-party claim arising from Customer Data supplied without necessary rights, the Customer's unlawful instructions, or its intentional misuse of the Service, and pay resulting damages and reasonable settlement amounts. This obligation does not cover the extent a claim was caused by Aurevus's breach, negligence or unlawful conduct.

Aurevus will defend the Customer against a third-party claim that the unmodified Railspike software supplied by Aurevus infringes that party's Canadian or United States intellectual-property rights, and pay resulting damages and reasonable settlement amounts. This does not cover Customer Data, customer modifications, combinations not supplied or required by Aurevus, continued use after a reasonable non-infringing alternative is offered, or third-party/AI-generated material merely reproduced in an output. Aurevus may procure a right, modify or replace the affected software without materially reducing its function, or terminate the affected portion and refund its unused prepaid fees if those alternatives are not commercially reasonable.

The party seeking protection must give prompt notice, reasonable cooperation at the defending party's expense, and control of the defense, except where a conflict requires separate arrangements. A settlement cannot admit the other party's wrongdoing, impose non-monetary obligations on it or leave it liable without its consent. These obligations are subject to section 17.

17. Limits of liability

To the extent permitted by law, neither party is liable under this agreement for indirect, consequential, special, exemplary or punitive damages, or lost profits, revenue, goodwill or business opportunity. This does not exclude an otherwise recoverable direct cost merely because it relates to restoring data or responding to a security incident.

Each party's aggregate liability arising from or relating to the agreement is limited to the subscription fees paid or payable for the affected Service in the 12 months before the event first giving rise to the claim, with a C$600 minimum cap. For a party's breach of confidentiality or Schedule A, or its obligations under section 16, the aggregate cap is twice that amount. Payments to the designated merchant of record for Railspike count as subscription fees for this calculation, excluding taxes and refunded amounts.

These exclusions and caps do not limit the Customer's properly owed subscription fees, either party's fraud or wilful misconduct, or liability that cannot lawfully be excluded or limited. Related events do not create a new cap for each claim. The allocation applies regardless of legal theory, subject always to mandatory law.

18. Changes to the agreement

We may update these Terms prospectively. Material changes will receive at least 30 days' notice to the account's administrative contact or through another reasonably prominent direct notice, except where an earlier change is necessary to comply with law or address an urgent security threat. We will explain the timing in that case. Changes requiring affirmative agreement will not take effect merely because a page was updated.

If the Customer does not accept a material change, it may end the affected subscription before the change applies and receive an appropriate refund of unused prepaid fees where the change would otherwise affect its committed paid period. Routine corrections that do not materially change rights or obligations may take effect when posted. Changes do not retroactively resolve existing disputes or change an earlier accepted scope.

19. General provisions

Law and courts. Alberta law and applicable federal Canadian law govern this agreement, excluding conflict-of-laws rules. Subject to mandatory jurisdictional rights, the courts located in Alberta have exclusive jurisdiction. Either party may seek urgent protective relief in a court with appropriate jurisdiction.

Notices. Contract and service notices may be sent to the Customer's designated administrative or billing email and to Aurevus at concierge@aurevus.ai. The Customer must keep those contacts current. This does not replace legally prescribed service-of-process requirements.

Assignment. Neither party may transfer the agreement without the other's consent, not to be unreasonably withheld, except as part of a genuine merger, reorganization or sale of substantially all relevant assets where the successor assumes the obligations. A transfer does not authorize unrelated new uses of personal information, evade fees, or bypass required notices or consents.

Force majeure. Neither party is responsible for delay caused by events beyond its reasonable control while it uses reasonable efforts to mitigate them. This does not excuse fees already due, a failure to take agreed security measures or an obligation to provide legally required notices. A prolonged material interruption may permit termination of the affected service with a refund of unused prepaid fees.

Entire agreement; waiver; severability. This agreement replaces prior discussions about its subject. A failure to enforce a provision is not a waiver. An unenforceable provision will be limited or severed to the extent necessary without invalidating the remainder. Changes by agreement must be recorded in an accepted Order or other writing authorized by both parties.

Relationship and survival. The parties are independent contractors; neither may bind the other except as expressly authorized. There are no intended third-party beneficiaries. Provisions necessary to settle accrued rights or protect retained information survive termination, including fees owed, data rights, confidentiality, applicable processing obligations, liability limits and dispute provisions.

Export and lawful use. The Customer must comply with applicable sanctions, export restrictions and laws governing its use, without expanding a jurisdiction's requirements beyond their lawful application.

20. Contact

Aurevus Innovations Inc. Calgary, Alberta, Canada Support and contractual notices: concierge@aurevus.ai

---

Schedule A — Baseline data-processing terms

A1. Scope and roles

This Schedule applies to personal information contained in Customer Data that Aurevus processes on the Customer's behalf (Customer Personal Information). The Customer determines the lawful business purposes and instructions; Aurevus provides the instructed processing. Each party remains accountable for the obligations applicable to its actual role. Aurevus's own account administration, security and lawful business records, and independent merchant-of-record processing, are separately described in the Privacy Policy.

Processing lasts for the subscription and the applicable retrieval, deletion or legally required retention period. Its subject is provision of Railspike for the agreed Covered Business. Operations include authorized collection/import, storage, organization, retrieval, AI-assisted analysis and drafting, transmission for enabled functions, access control, logging, export and deletion. Individuals may include Customer personnel, residents, applicants, owners, trades, vendors and other people in lawfully supplied business records. Information may include identifiers, contact information, occupancy and service records, communications, work and approval records and related Customer Data. Specially regulated information is not automatically permitted; its use requires the safeguards and support required by section 8 and applicable law.

A2. Instructions and use restrictions

Aurevus will process Customer Personal Information only under documented lawful instructions in this agreement, the Order and authorized product settings, except where law requires otherwise. We will inform the Customer if we reasonably identify an instruction that would violate applicable data-protection law and may pause that processing while it is resolved. The Customer's instruction does not excuse Aurevus from its own obligations.

Aurevus will not sell Customer Personal Information, share it for cross-context behavioral advertising, use it to advertise to residents or employees, or use it to train or improve general-purpose AI models for Aurevus or another customer. Aurevus will use provider arrangements and settings that prohibit provider training on Customer Personal Information processed on our behalf. Authorized retrieval, indexing and generation for the Customer are distinct from training a general-purpose model.

Where applicable US state law treats Aurevus as a service provider or processor, Aurevus will process only for the specific contracted business purposes, provide the protection required for that role, refrain from prohibited retention, use, disclosure or combination with other-source personal information, and notify the Customer if unable to comply. The Customer may take reasonable steps to verify compliance and to stop and remediate unauthorized use. Applicable statutory exceptions remain available only within their permitted limits.

A3. Confidentiality, safeguards and incident cooperation

Aurevus will restrict access to authorized persons with a need to perform the permitted functions and appropriate confidentiality obligations. Aurevus will maintain reasonable administrative, technical and physical safeguards proportionate to the information and risk, including appropriate access controls, protection of transmitted and stored information and separation of customer access. No certification, specific isolation architecture or recovery target is implied unless expressly agreed and substantiated.

Aurevus will notify the Customer without undue delay after becoming aware of a security incident involving unauthorized access to, loss of, alteration of or disclosure of Customer Personal Information processed on its behalf. Notice may be supplemented as facts develop and will include reasonably available information needed to assess the event, mitigation and assistance. This Customer notice is not limited to the threshold for notifying individuals or regulators. Each party will carry out its own legally required reporting and cooperate on a coordinated response where appropriate.

A4. Service providers and international processing

The Customer authorizes Aurevus to use service providers for the contracted purposes, subject to appropriate written confidentiality, security and data-use obligations. Aurevus remains responsible for their processing on its behalf to the extent required by this agreement and applicable law. Customer-selected independent services are governed by their own arrangements and are not made Aurevus subprocessors merely by a connector.

Aurevus will maintain accessible information about relevant providers, their purposes and processing countries and will provide it through the Privacy Contact identified in the Privacy Policy or the agreed provider notice. Where law or an agreed processing arrangement requires advance notice of provider additions or replacements and an opportunity to object, Aurevus will provide them before the relevant processing begins. A routine model/version change is not itself a new provider, but must still respect the agreed purposes, countries, restrictions and protections.

Processing outside the Customer's jurisdiction must comply with applicable transfer requirements and agreed geographic restrictions. This Schedule does not itself create a transfer mechanism where specific legal instruments are required. Such instruments and any necessary additional terms must be completed before that restricted processing starts.

A5. Requests, accountability and end of processing

Aurevus will provide reasonable assistance with applicable individual-rights requests, assessments, regulator inquiries and security obligations relating to its processing, considering the nature of the Service and information available. Where appropriate, it will refer a request to the responsible Customer and assist rather than simply refuse it. Aurevus will not disclose another person's protected information in an unverified request.

Aurevus will make information reasonably necessary to demonstrate compliance available on request. A proportionate review may use existing documentation or independent reports; if insufficient, the parties will arrange a narrowly scoped audit protecting other customers' data and system security. Any cost allocation for exceptional assistance or an audit must be agreed in advance and cannot defeat a non-waivable right.

At the end of processing, Customer Personal Information will be returned or deleted as directed and provided in section 15, except for lawful retention. Retained copies remain protected and restricted; backups are removed through the documented lifecycle and deletion instructions must be reapplied following a restoration.