Terms and Conditions

1. General Provisions

1.1. Definitions. The following definitions apply to this EULA:

“Affiliate” means, for any entity, any other entity that, directly or indirectly, Controls, is Controlled by, or is under common Control with, such entity. For purposes of allocating obligations, liability, risk, disclaimers, indemnities, warranties, and responsibility under the Agreement, references to Corpfolio.ai or its Affiliates do not include the Fulfillment Partner, any Local Agent, or their respective successors, assigns, purchasers, joint-venture vehicles, replacements, subcontractors, or other transferees, and will not be construed to make Corpfolio.ai responsible for any of them. This allocation is ownership-neutral and applies whether the Fulfillment Partner is, at any time, under common Control with Corpfolio.ai, partially owned or operated through a joint venture, wholly sold or transferred, independent, replaced, or otherwise affiliated or unaffiliated. Nothing in any past, current, or future ownership, Control, management, branding, commercial arrangement, sale, change of Control, or replacement of the Fulfillment Partner expands Corpfolio.ai’s obligations for Fulfillment Services or makes Corpfolio.ai responsible for the acts or omissions of the Fulfillment Partner or any Local Agent.

“Agreement” means this EULA together with each Order Form, the Data Processing Agreement attached as Exhibit A (the “DPA”), the Support & Service Targets attached as Exhibit B, any Category Addendum applicable to Customer (Exhibit C or Exhibit D), and any other exhibits, addenda, or policies expressly incorporated by reference.

“AI Provider” means a third-party provider of artificial-intelligence models or services used to power the AI Capabilities, as described in Section 9.4.

“Authorized User” means a named individual who is authorized by Customer (or, where permitted under a Category Addendum, by an End-Client) to access the Platform under Customer’s account and who has been issued active login credentials. Each Authorized User occupies one “Seat”.

“Content” means all text, templates, forms, jurisdiction and entity-type descriptions, structure visualizations, guidance, and other information or materials made available to users through the Platform or in connection with the Services, excluding Customer Data.

“Control” means, with respect to any entity, the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of such entity, whether through the ownership of voting securities (or other ownership interest), by contract or otherwise.

“Corporate Action” means a discrete entity-management workflow initiated through the Platform in respect of an Entity, including, without limitation, a change of director, officer, or shareholder; the preparation of board or shareholder resolutions; a share issuance or transfer; a change of registered address; an annual return, beneficial-ownership, or economic-substance filing; or support for a bank account opening. To the extent a Corporate Action requires a filing, lodgment, registered-office act, professional review, bank action, or other regulated or third-party act, the Platform only prepares, routes, coordinates, or records the workflow; the act itself is performed by Customer, the Fulfillment Partner, the applicable Local Agent, a registry, a financial institution, or another third party, as applicable.

“Customer Data” means all data, documents, information, and materials submitted to the Platform by or on behalf of Customer or its Authorized Users or End-Clients, together with all data generated on Customer’s behalf through use of the Services, including entity records, cap tables, registers, KYC Materials, and documents stored in the Platform’s document vault; provided that Customer Data does not include De-Identified Data, Usage Data, or Feedback.

“De-Identified Data” means data derived from Customer Data that has been aggregated or de-identified such that it does not identify, and cannot reasonably be used to identify or re-identify, Customer, any Entity, any End-Client, or any individual (including any ultimate beneficial owner).

“End-Client” means a client of an Intermediary or of a White-Label Operator (a) whose Entities are managed on the Platform by such Intermediary or White-Label Operator, or (b) who is granted access to a dashboard view or portal in respect of such Entities pursuant to the applicable Category Addendum.

“Entity” means a legal entity that is ordered through, or onboarded to, the Platform. A “Managed Entity” is an Entity that relies on the Fulfillment Partner and the Local Agent network for its maintenance and Corporate Actions and is in active status (i.e., not struck off, dissolved, or archived by the user). A “Self-Managed Entity” is an Entity onboarded to the Platform for record-keeping and workflow purposes that does not rely on the Local Agent network for its maintenance.

“Feedback” means any ideas, concepts, feedback, reviews, ratings, suggestions, questions, and know-how that any user makes available to us in connection with the Platform or Services.

“Fulfillment Partner” means Otonomos LLC, a Wyoming limited liability company with business address at 3350 Virginia Street, Floor 2, Miami FL 33133, as it may be renamed, reorganized, converted, contributed to or operated through a joint venture, partially or wholly sold, transferred, or otherwise succeeded, and any entity or person that Corpfolio.ai designates or engages from time to time as the operational fulfillment partner for orders placed through the Platform, including any assignee, purchaser, joint-venture vehicle, successor, subcontractor, replacement, or other transferee of the otonomos.com business or its fulfillment operations. The Fulfillment Partner may be an entity under common Control with Corpfolio.ai, a partially owned or joint-venture vehicle, an independent purchaser or assignee, or a successor or replacement provider.

“Fulfillment Services” means the regulated and operational corporate services performed by the Fulfillment Partner or Local Agents, including incorporation and registration filings, registered agent and registered office services, corporate secretarial acts, nominee services, filing and lodgment of Corporate Actions with in-country registries, and maintenance of Entities in good standing. Fulfillment Services are not part of the Services and are not performed by Corpfolio.ai.

“Intellectual Property Rights” means any and all intellectual property rights, including registered or unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patents, utility models, rights in designs, copyrights, moral rights, topography rights, database rights, trade secrets, trademarks, service marks, trade names, domain name rights, know-how, rights of confidence, or other intellectual property rights, and all rights and forms of protection of a similar nature or having equivalent or similar effect to any of these anywhere in the world from time to time.

“Intermediary” means a Customer that is a law firm, accounting firm, corporate services firm, family-office adviser, or other professional-services provider using the Platform to manage Entities on behalf of its own End-Clients, as further described in the Professional Intermediary Addendum (Exhibit C).

“KYC Materials” means identity documents, government-issued identification, proof-of-address materials, corporate documents, beneficial-ownership declarations, source-of-funds information, sanctions and watchlist screening information, selfie/liveness or biometric verification data where required by the designated verification provider, and other know-your-customer (“KYC”), anti-money-laundering (“AML”), and counter-terrorist-financing information and documentation submitted through the Platform or otherwise required for an Entity, order, Corporate Action, or payment.

“Law” means any applicable statute, regulation, rule, ordinance, or other requirement of a governmental or judicial authority, including AML, sanctions, export-control, data-protection, and beneficial-ownership disclosure requirements.

“Local Agent” means a corporate services provider, registered agent, or equivalent licensed person in a given jurisdiction, engaged by the Fulfillment Partner to perform Fulfillment Services in that jurisdiction under its own license and terms of engagement.

“Local Agent Terms” means the jurisdiction-specific terms of engagement, disclosures, and requirements of a Local Agent applicable to an Entity, an order, or a Corporate Action, as presented, linked, or otherwise made available through the Platform or in connection with the applicable order.

“Order Form” means an ordering document, online order flow, or statement of work entered into between Customer and Corpfolio.ai that references this EULA and sets out commercial terms (including, for White-Label Operators, the negotiated platform access fees and any revenue-sharing arrangements).

“Corpfolio Agent” means the AI-powered corporate-services workflow agent made available as part of the Platform that, acting on natural-language instructions from Customer, drafts documents (such as charters, resolutions, share issuances, and KYC packs), prepares workflow materials, coordinates signature requests, prepares renewal and filing packages for submission through the Fulfillment Partner and Local Agent network, monitors deadlines, and performs other Corporate Action workflows, with escalation to human review as described in Section 9. Corpfolio Agent does not itself make registry filings, act as a registered agent or corporate secretary, provide legal or professional advice, or approve any Binding Act (as defined in Section 9.2).

“Corpfolio Core” means the cloud-hosted entity-management workbench made available as part of the Platform, including multi-client and multi-entity workspaces, organizational-chart views, cap tables and registers, the document vault and e-signature workflows, the compliance calendar, KYC status monitoring, audit-trail logging, and collaborative access controls.

“Platform” means the multi-tenant, cloud-hosted software platform made available by Corpfolio.ai at corpfolio.ai (or a successor or white-label domain), including Corpfolio Core and Corpfolio Agent and all updates, upgrades, and successor versions thereof.

“Pricing Schedule” means Corpfolio.ai’s then-current schedule of subscription tiers, entity and Seat thresholds, and fees, made available via an Order Form or in the Customer’s login section of the Platform, as updated by Corpfolio.ai from time to time.

“Public Tools” means any public-facing, pre-login demo, calculator, structure-visualization, AI chat, or similar feature made available through an Corpfolio.ai website or white-label domain outside an authenticated account or paid Subscription.

“Services” means (i) our provision of the Platform, including any Public Tools, (ii) our provision and management of user accounts, Customer Data, and Content on the Platform, and (iii) the support services described in Exhibit B. For the avoidance of doubt, the Services are limited to the software and technology layer and expressly exclude the Fulfillment Services and any legal, tax, accounting, corporate-secretarial, fiduciary, investment, securities, fund-administration, banking, or other professional or regulated services.

“Subscription” means Customer’s recurring right of access to the Platform on a per-Entity (and, where applicable, per-Seat) basis, in the annual or monthly cadence described in Section 6.2, together with any Order Form-based access right for White-Label Operators.

“Super-User” means a Customer that is a direct enterprise user of the Platform, such as a family office, holding group, IP group, or multi-jurisdictional operating group, managing its own Entities without intermediation.

“Third-Party Service” mean any service, software, and infrastructure provided by a third party and used in connection with the Platform, including those identified in Section 12.

“Usage Data” means usage and operations data generated and collected in connection with the use of the Platform or Services (including service requests, logs, metadata, and usage durations and times), excluding the content of Customer Data.

“White-Label Operator” means a Customer that licenses the Platform for full rebranding and resale to its End-Clients under its own identity pursuant to the White-Label Operator Addendum (Exhibit D) and an Order Form.

1.2. User Categories; Category Addenda. The Platform serves three categories of Customer: (a) Super-Users; (b) Intermediaries; and (c) White-Label Operators. This EULA applies to all Customers. If Customer is an Intermediary, the Professional Intermediary Addendum (Exhibit C) also applies. If Customer is a White-Label Operator, the White-Label Operator Addendum (Exhibit D) and an executed Order Form also apply, and Customer may not operate on a white-label basis without an executed Order Form. Customer’s category is determined by the capacity indicated at registration or in an Order Form; Corpfolio.ai may recategorize Customer (with notice) if Customer’s actual use corresponds to a different category.

1.3. Order of Precedence. In the event of a conflict among the documents comprising the Agreement, the following order of precedence applies (highest first): (i) the Order Form; (ii) the applicable Category Addendum; (iii) the DPA (as to the subject matter of data protection); (iv) the body of this EULA; and (v) any other document incorporated by reference.

1.4. Updates to this EULA. We may update this EULA at any time and may notify you of the updated EULA by any reasonable means, including by posting the revised EULA to the Platform. The updated EULA will apply to your use of the Platform and the Services after the date on which we have posted the updated EULA or otherwise notified you of the changes; provided that, during a then-current paid Subscription period, we will not apply a material adverse change to the core commercial terms of that Subscription before the next renewal unless the change is required by Law, a regulator, a Local Agent, the Fulfillment Partner, a Third-Party Service, security considerations, or a change in the Platform or Fulfillment Services. Material adverse changes not falling within the preceding sentence will take effect no earlier than 30 days after notice. By continuing to use the Services or accessing the Platform after we notify you of revisions to the EULA, you accept the revised EULA. If you do not agree to a revised EULA, your sole remedy is to stop using the Platform and terminate under Section 7.3; if the revised EULA materially reduces your paid Subscription during its then-current term and is not required for one of the reasons above, you may terminate the affected Subscription and receive a pro-rata refund of prepaid, unused Subscription fees as your sole remedy. The “Last Updated” legend at the end of this EULA indicates the date on which this EULA was last updated.

1.5. End-Client Users. If you access an Corpfolio.ai-branded or co-branded portion of the Platform because an Intermediary has granted you access as its End-Client, then, as between you and Corpfolio.ai, this EULA governs your access, and you acknowledge and agree that: (a) the Intermediary administering your access may access, use, control, restrict, retain, and remove your account and the Customer Data within it; (b) Corpfolio.ai may act on the instructions of that Intermediary in respect of your account and Entities and may share your information (including account and Entity information) with it; (c) you may have separate agreements with that Intermediary, and Corpfolio.ai is not responsible or liable for its acts, omissions, advice, or obligations; and (d) to the extent of a conflict between this EULA and any such separate agreement, the provision more protective of Corpfolio.ai’s rights will control as between you and Corpfolio.ai. If you access the Platform solely through a White-Label Operator’s fully rebranded portal, your access is governed by that Operator’s end-user terms rather than a direct contract with Corpfolio.ai, except that Corpfolio.ai is an intended third-party beneficiary of the protections required by Exhibit D and may process Customer Data, transmit instructions, suspend access, or take other steps as necessary to operate the underlying Platform, comply with Law, enforce flow-down restrictions, and support Fulfillment Services. In all cases, an End-Client, Entity, or other relevant person may be required to accept Local Agent Terms, KYC provider notices or consents, Payment Processor terms, or other third-party terms directly.

2. The Platform and the Services

2.1. Corpfolio Core. Subject to the terms of the Agreement and payment of the applicable fees, Corpfolio.ai will make Corpfolio Core available to Customer as a cloud-hosted service accessible through a supported web browser. No software installation is required, and Corpfolio.ai imposes no on-premise hardware or network infrastructure requirements beyond a modern web browser and internet connection.

2.2. Corpfolio Agent. Corpfolio Agent is an optional, AI-powered workflow feature layered on Corpfolio Core that performs Corporate Action workflows on Customer’s natural-language instructions, subject at all times to Section 9 (Artificial Intelligence Capabilities; Corpfolio Agent). Every Corpfolio Agent workflow action is logged in the account audit trail and is reviewable by Customer. References on the Platform or in marketing materials to a “licensed human” reviewing a Binding Act mean, unless an Order Form expressly states otherwise, a qualified person within Customer’s or its Intermediary’s organization; Corpfolio.ai does not supply legal, tax, accounting, fiduciary, corporate-secretarial, fund-administration, or other licensed review.

2.3. Modifications. We may, at our sole discretion, add, remove, or modify features or functionality of the Platform or Services, provided that we will not materially degrade the core entity-management functionality of Corpfolio Core during a paid Subscription period without providing Customer notice and, where the degradation is material and uncured, the right to terminate the affected Subscription and receive a pro-rata refund of prepaid, unused Subscription fees as Customer’s sole and exclusive remedy.

2.4. Support; Maintenance. Corpfolio.ai provides the support described in Exhibit B (Support & Service Targets). Updates and upgrades to the Platform that Corpfolio.ai makes generally available to its customers at no additional charge are included in the Subscription; new features, tiers, or modules may be subject to additional fees.

2.5. Public Tools. Public Tools are provided for demonstration, informational, and pre-sale workflow purposes only. They may be available without account creation, two-factor authentication (“2FA”), a paid Subscription, or the account-level security, retention, export, and audit-trail features that apply within Corpfolio Core. Customer and users should not submit sensitive personal data, KYC Materials, confidential legal or tax analysis, or production Entity data into Public Tools unless the applicable tool expressly indicates that such submission is intended and protected. Public Tool outputs are Content or AI Capability outputs, not professional advice, and are subject to the disclaimers and use restrictions in this EULA.

2.6. APIs, SSO, and Custom Integrations. API access, SSO, advanced permissions, custom integrations, dedicated implementation, custom jurisdictions, priority support, dedicated support, and any committed SLA are not included unless expressly enabled in the Platform tier, Order Form, or a written addendum. Any API access is subject to the documentation, rate limits, authentication requirements, and use restrictions made available by Corpfolio.ai, and Corpfolio.ai may suspend API credentials that present security, operational, legal, or regulatory risk.

2.7. Beta and Early-Access Features. Corpfolio.ai may make alpha, beta, preview, pilot, or early-access features available (including new Corpfolio Agent capabilities, jurisdictions, integrations, or Public Tools), identified as such on the Platform or in an Order Form (“Beta Features”). BETA FEATURES ARE PROVIDED “AS-IS”, ARE EXCLUDED FROM THE SUPPORT TARGETS IN EXHIBIT B AND FROM ANY OTHER COMMITMENT IN THE AGREEMENT, MAY CONTAIN ERRORS, MAY BE MODIFIED, SUSPENDED, OR DISCONTINUED AT ANY TIME WITHOUT NOTICE, AND SHOULD NOT BE RELIED ON FOR PRODUCTION ENTITIES OR TIME-SENSITIVE CORPORATE ACTIONS. TO THE MAXIMUM EXTENT PERMITTED BY LAW, CORPFOLIO.AI HAS NO LIABILITY ARISING FROM BETA FEATURES.

3. Platform-Only Role; Fulfillment Structure; No Professional Advice

3.1. Corpfolio.ai Is Not a Corporate Services Provider. Corpfolio.ai is a software and technology company. Corpfolio.ai is not a licensed corporate services provider, registered agent, trust or company service provider, fiduciary, law firm, accounting firm, or tax advisor in any jurisdiction, and does not itself perform any activity requiring such a license. Corpfolio.ai’s obligations under the Agreement are limited exclusively to the provision of the Platform and the Services — that is, the software and technology layer. Corpfolio.ai does not incorporate companies, make filings with any registry, act as registered agent or registered office, execute corporate secretarial acts, or perform any other Fulfillment Services, and nothing in the Agreement will be construed as an undertaking by Corpfolio.ai to perform any regulated activity.

3.2. Fulfillment Structure. Customer acknowledges that orders placed through the Platform for incorporation, maintenance, or Corporate Actions in respect of Managed Entities are fulfilled through the following chain: Customer to the Platform to the Fulfillment Partner to the applicable Local Agent(s) to the in-country registry. Fulfillment Services are performed by the Fulfillment Partner and the Local Agents under their own terms, engagement letters, and licenses, including the applicable Local Agent Terms, and not by Corpfolio.ai. By placing an order through the Platform, Customer (for itself and, where applicable, on behalf of the relevant Entity and End-Client): (a) instructs and authorizes Corpfolio.ai to transmit the order and the related Customer Data to the Fulfillment Partner and the applicable Local Agents; (b) agrees to, and agrees to cause the relevant Entity and End-Client to agree to, the applicable Local Agent Terms, which may create a direct engagement, agency appointment, or third-party-beneficiary relationship between Customer (or the relevant Entity or End-Client) and the applicable Local Agent, as required by local Law and the Local Agent’s engagement model; and (c) acknowledges that Corpfolio.ai is not a party to the Local Agent Terms and has no responsibility or liability for the performance or non-performance of Fulfillment Services.

3.3. No Legal, Tax, Accounting, Securities, Investment, Banking, or Professional Advice. The Platform, the Services, Corpfolio Agent outputs, and all content made available through the Platform (including jurisdiction descriptions, entity-type descriptions, templates, structure visualizations, compliance calendars, deadline reminders, and Public Tools) are provided for general informational and workflow purposes only, do not constitute legal, tax, accounting, securities, investment, banking, fund-administration, fiduciary, or other professional advice, and are not a substitute for the advice of a qualified attorney, accountant, tax advisor, investment professional, bank, fund administrator, or other licensed provider. Customer is solely responsible for determining the suitability, regulatory status, and lawfulness of any entity structure, jurisdiction, fund, decentralized autonomous organization (“DAO”) or protocol wrapper, nominee arrangement, bank-account request, tax position, or Corporate Action for its (or its End-Client’s) purposes, and should consult its own professional advisers. Any Platform or marketing reference to “optimizing” legal or tax structures, “avoiding” penalties, “banking” support, or similar outcomes is descriptive of workflow support only and is not advice, a recommendation, or a guaranteed outcome.

3.4. Fulfillment Partner Dependency; Continuity. Customer acknowledges that the Fulfillment Partner is a critical operational dependency of the Platform: all incorporation orders and ongoing Fulfillment Services for Managed Entities are processed through the Fulfillment Partner and its Local Agent network under separate inter-company or other commercial arrangements between Corpfolio.ai and the Fulfillment Partner. Any change in ownership, Control, governance, name, assets, or contractual status of the Fulfillment Partner, including a partial sale, contribution to or operation through a joint venture, sale of the otonomos.com business, or replacement of the Fulfillment Partner, does not alter the allocation of responsibility, disclaimers, liability limitations, indemnities, agency disclaimers, or third-party status described in this Agreement and does not make Corpfolio.ai responsible for Fulfillment Services or for the acts or omissions of the Fulfillment Partner or Local Agents. If Corpfolio.ai designates a successor or replacement Fulfillment Partner, references to the Fulfillment Partner in this Agreement apply to that successor or replacement from the effective date of designation, and Customer authorizes Corpfolio.ai to transmit order information and Customer Data to that successor or replacement as reasonably necessary to transition or continue Fulfillment Services, subject to Section 8 and the DPA. Any material disruption to the Fulfillment Partner’s operations, whether due to regulatory action, insolvency, force majeure, a sale, change of Control, joint venture or other ownership transition affecting the Fulfillment Partner, a transition to a successor or replacement Fulfillment Partner, or the termination or suspension of the inter-company arrangements, would directly affect Corpfolio.ai’s ability to route and complete orders (a “Fulfillment Disruption”). In the event of a Fulfillment Disruption, Corpfolio.ai will use commercially reasonable efforts to (a) notify affected Customers without undue delay and identify and onboard alternative fulfillment arrangements, and (b) where a paid order cannot be completed within 60 days of the commencement of the Fulfillment Disruption, refund the amounts paid for the unfulfilled portion of that order (or issue an equivalent company credit at Customer’s election) in accordance with Section 6.11. A Fulfillment Disruption is a Force Majeure Event for purposes of Section 17, and the remedies in this Section 3.4 are Customer’s sole and exclusive remedies for a Fulfillment Disruption. Corpfolio.ai does not guarantee continuity of Fulfillment Services.

3.5. Registry and Local Agent Timelines. Incorporation timelines, filing acceptance, and Corporate Action completion depend on in-country registries and the availability and responsiveness of Local Agents, and are outside Corpfolio.ai’s control. Any timelines displayed on the Platform (e.g., estimated business days to incorporate) are estimates only. Corpfolio.ai will communicate known delays through the Platform but does not guarantee any filing or completion timeline, and no delay by a registry, the Fulfillment Partner, or a Local Agent will constitute a breach of the Agreement by Corpfolio.ai.

3.6. Marketing Terminology Regarding Filing and Fulfillment. Customer acknowledges that phrases on the Platform, website, or marketing materials such as “we file,” “Corpfolio Agent files,” “drafts and files,” “connects to registries,” “registrar filings built in,” “we handle the infrastructure,” or similar shorthand refer only to the Platform’s workflow routing and coordination of Fulfillment Services through the Fulfillment Partner and Local Agents. Those phrases do not expand Corpfolio.ai’s obligations, make Corpfolio.ai a registered agent or corporate services provider, or create any warranty regarding the outcome or timing of a filing, registry action, bank-account opening, or other third-party process.

4. Eligibility; Accounts; Access Security

4.1. Eligibility. The Platform is intended for business and professional use only and is not offered to consumers acting for personal, family, or household purposes or to minors. As a condition to using the Platform or Services, you represent and warrant that: (a) you have the legal power and authority to agree to this EULA and are at or above the age of majority in your jurisdiction of residence; (b) if you are accepting on behalf of an entity, you are authorized to bind that entity; (c) you have neither falsely identified yourself nor provided any false information to gain access to the Platform or Services or to create an account; (d) neither you nor any Entity, director, shareholder, ultimate beneficial owner, payor, payee, or other relevant party submitted by you is (i) identified on any applicable sanctions list (including those maintained by Office of Foreign Asset Control (“OFAC”), the UN Security Council, the European Union, or the United Kingdom), (ii) located, organized, or resident in a comprehensively sanctioned country or region, or (iii) otherwise prohibited by applicable Law, Local Agent Terms, Payment Processor terms, or AI Provider terms from using the Platform; and (e) if you are an Intermediary or White-Label Operator, you will not offer access to the Platform to consumers or minors without Corpfolio.ai’s prior written approval and any additional terms required by Corpfolio.ai.

4.2. Accounts; Access Credentials. You must create an account and be logged in to use the Platform. You are solely responsible for maintaining the confidentiality of the credentials for each account created by you and for all activity occurring under your account. Two-factor authentication (2FA) is required and must be maintained on all Authorized User accounts. You may not use anyone else’s credentials or permit others to use yours. You must notify us immediately at [email protected] of any suspected unauthorized use of your account or any inaccuracy in your registration information. If you provide any information that is untrue, inaccurate, not current, or incomplete, fail to update such information, or we have reasonable grounds to suspect the same, we may suspend or terminate your account. We reserve the right to accept or reject any account registration at our sole discretion, including where KYC verification cannot be completed.

4.3. Authorized Users; Seats; Collaborators. Customer controls which individuals within its organization are granted access and at what permission level, subject to the Platform’s domain-validation rule (only users sharing the account’s registered email domain may be added as collaborators, except as the Platform otherwise permits for End-Client access under a Category Addendum). Customer is responsible for: (a) ensuring each Authorized User complies with this EULA; (b) promptly revoking access for departing or unauthorized personnel; and (c) all acts and omissions of its Authorized Users, which are deemed Customer’s acts and omissions. Seats are for named individuals and may not be shared; a Seat may be reassigned to a replacement individual.

4.4. Audit Trail. All Corporate Actions and user activity within an account are logged with a full audit trail, including which user performed each action and when. The audit trail is accessible to account administrators and is maintained for compliance and dispute-resolution purposes.

5. Customer Responsibilities; KYC/AML; Compliance Flow-Downs

5.1. KYC/AML Verification; Platform Gate. All individuals and entities required to be verified under applicable AML and KYC requirements, including directors, shareholders, and ultimate beneficial owners, must complete identity verification through the Platform’s designated verification provider (currently SumSub) before an incorporation can proceed or a Corporate Action can be executed. This is a mandatory platform gate, not a discretionary requirement. Customer is responsible for ensuring that all such persons complete verification in a timely manner; delays in KYC completion will delay or block orders and Corporate Actions, and Corpfolio.ai will have no liability for the consequences of any such delay or block.

5.2. Accuracy of Information. Customer must ensure that all information and documentation submitted through the Platform, including Entity details, officer appointments, shareholder information, ultimate beneficial owner (“UBO”) declarations, and KYC Materials, is accurate, complete, and kept up to date, and must promptly submit through the Platform any changes (including changes of directors, shareholders, registered addresses, or UBO structures) that require filing. Corpfolio.ai, the Fulfillment Partner, and the Local Agents act on the information Customer provides; responsibility and liability for errors, rejected filings, penalties, or losses arising from inaccurate, incomplete, or outdated Customer-supplied information rest solely with Customer. Submission of false or misleading information may result in immediate suspension of the Services and will be flagged to the relevant Local Agent for action under its licensing obligations and to competent authorities where required by Law.

5.3. Ongoing AML Monitoring; Requests for Information. All orders and payments are subject to AML and sanctions monitoring in accordance with the obligations of the Fulfillment Partner and the Local Agent network. Customer agrees to provide, and to cause its End-Clients and the relevant individuals to provide, additional KYC Materials promptly upon request at any time where required by applicable Law, a Local Agent, or the Fulfillment Partner. Corpfolio.ai may suspend some or all of the Services (including pending orders and Corpfolio Agent tasks) pending completion of any AML or sanctions review, without liability.

5.4. Upstream Obligations; Flow-Down. Customer acknowledges that the Fulfillment Partner, the Local Agents, and the providers of Third-Party Services are subject to Laws, licensing conditions, and contractual requirements, including AML, counter-terrorist financing, sanctions, KYC, and beneficial-ownership disclosure requirements, that vary across the multiple jurisdictions served by the Platform and change over time, and that certain of those requirements must be passed through to, and bind, users of the Platform. Accordingly, and without Corpfolio.ai being required to enumerate such requirements jurisdiction by jurisdiction, Customer agrees to comply, and to cause its Authorized Users, Entities, and End-Clients to comply, with: (a) all KYC, AML, sanctions, and beneficial-ownership requirements applicable to any Entity, order, or Corporate Action, as notified through the Platform or otherwise; (b) the applicable Local Agent Terms; (c) the flow-down requirements of the Third-Party Services identified in Section 12 and in the Platform documentation, including the AI-provider restrictions in Section 9.5 and the payment-provider restrictions in Section 6.5; and (d) any additional jurisdiction-specific requirements notified by Corpfolio.ai from time to time. Where a requirement under this Section 5.4 is imposed or changed by Law, a regulator, a Local Agent, the Fulfillment Partner, or a Third-Party Service, Corpfolio.ai may update the applicable requirements by notice (including via the Platform), and such updates take effect upon notice notwithstanding Section 1.4. Failure to comply with this Section 5.4 is a material breach of the Agreement.

5.5. Legal Compliance; Export; Regulated Activities. Customer will use the Platform and Services in compliance with all applicable Laws, including data-protection, AML, anti-corruption, sanctions, export-control, securities, commodities, investment-adviser, fund, banking, money-transmission, tax, beneficial-ownership, and professional-responsibility Laws, and is solely responsible for the lawfulness of its (and its End-Clients’) entity structures, activities, regulated status, disclosures, filings, tax positions, and professional services. Customer will not use the Platform or Services to evade tax, sanctions, AML/KYC, beneficial-ownership, economic-substance, securities, investment, fund, banking, money-transmission, or other regulatory obligations.

5.6. General Responsibilities. Other than payment, Customer’s primary responsibilities are those set out in this Section 5 and in Sections 4 (accounts and access security), 6.4 (payment authorization), 9 (review of AI outputs), and, if applicable, the Category Addendum (responsibility for End-Clients).

5.7. Compliance Calendars; Deadline Monitoring. Compliance calendars, renewal reminders, deadline monitoring, and similar Platform features are workflow aids only. Customer remains solely responsible for monitoring and satisfying all filing, renewal, tax, beneficial-ownership, economic-substance, corporate-record, and other legal deadlines for its Entities and End-Clients, including by timely providing instructions, information, signatures, KYC Materials, and payment. Corpfolio.ai has no liability for penalties, fines, strike-off, dissolution, loss of good standing, missed deadlines, or other consequences arising from Customer’s failure to act, pay, approve, sign, or provide accurate information, or from any delay or failure by a registry, Fulfillment Partner, Local Agent, Payment Processor, bank, or other third party.

5.8. Authority; E-Signatures. Customer is responsible for ensuring that each person who signs, approves, instructs, or submits a document or Corporate Action through the Platform has authority to do so on behalf of the relevant Customer, Entity, End-Client, shareholder, director, officer, manager, or other person. Corpfolio.ai is not a notary, witness, escrow agent, corporate secretary, or legal adviser. Customer is solely responsible for the legal validity, enforceability, and filing suitability of electronic signatures and electronically approved documents in the applicable jurisdiction.

6. Fees; Payment; Refunds

6.1. Fees Generally. Customer will pay the fees set out on the Platform, in the applicable price list, or in an Order Form, comprising the applicable components of Corpfolio.ai’s hybrid model: (a) Subscription fees (Section 6.2); (b) entity ordering fees, charged at the time of order when a new Entity is ordered through the Platform, varying by jurisdiction and entity type; (c) Corporate Action fees, charged per discrete task performed on an Entity, whether performed by Customer through the Platform or executed by Corpfolio Agent on Customer’s behalf (Section 6.4); and (d) any Corpfolio Agent routine-tier fees, task allowances, overage fees, implementation fees, API/integration fees, support fees, or other fees stated in the applicable tier, price list, or Order Form. All fees are stated and payable in USD unless the Platform or Order Form states otherwise. Except as expressly stated in Section 6.11 or elsewhere in the Agreement, all fees are non-refundable. White-Label Operators are priced on a separately negotiated basis per their Order Form.

6.2. Subscriptions; Tiers; Included Task Allowances. Subscription fees are charged as stated on the Platform, in the applicable price list, or in an Order Form. The current commercial model may include (a) Managed Entities billed annually per Entity; (b) Self-Managed Entities billed monthly on a tiered basis with the applicable tiers, entity and Seat thresholds, and fees as set out on the then-current published Pricing Schedule or Order Form and subject to change under Section 6.3; (c) website or negotiated packages such as Starter, Growth, and Enterprise tiers with specified limits on active Entities, jurisdictions, Seats, Corpfolio Agent tasks, support level, SSO, API access, or implementation support; and (d) per-Seat charges based on the number of Authorized Users with dashboard access, if not bundled into the applicable tier. Public pricing pages and marketing tier descriptions are indicative only; the applicable Order Form, online checkout, or in-Platform price confirmation controls for the Customer’s Subscription. Free-tier access is provided “AS-IS”, may be subject to feature, storage, Seat, and support limitations, and may be modified, suspended, or discontinued at any time. Where a plan includes a monthly or annual Corpfolio Agent task allowance, unused included tasks expire at the end of the applicable period and do not roll over, carry forward, or convert to credits unless the Order Form expressly states otherwise; excess or out-of-scope tasks are charged at the then-current rates. Corpfolio.ai tracks the number of active Entities, Seats, and included/excess tasks per account for tier-compliance purposes; where usage exceeds a tier threshold or task allowance, Corpfolio.ai may notify Customer and upgrade the account or charge overages effective at the next billing cycle or as otherwise stated in the Order Form.

6.3. Fee Changes. We may change our fees from time to time with notice to you; changed Subscription fees apply from the start of the next Subscription period (annual or monthly, as applicable), and changed transaction fees apply to orders and Corporate Actions initiated after the change takes effect.

6.4. Corpfolio Agent Task Fees; Card-on-File Pre-Authorization. Use of Corpfolio Agent is conditioned on Customer (a) maintaining a valid payment method on file with our Payment Processor (currently Stripe), and (b) affirmatively pre-authorizing, before a task begins, the charge that will be triggered upon confirmed completion of that task (or category of tasks, where Customer enables standing authorization), subject to any included task allowance in the applicable tier or Order Form. The applicable fee (or the basis for calculating it) will be displayed before Customer confirms the instruction. Corpfolio.ai may place an authorization hold when a task begins or when completion is confirmed. Upon confirmed completion of an Corpfolio Agent task, Corpfolio.ai will notify Customer via email or the dashboard that the task has been completed and that the applicable fee will be captured or charged unless Customer disputes in good faith whether the task was executed as instructed within five business days after the completion notification; if the Payment Processor or the applicable payment method requires immediate capture, Corpfolio.ai may charge upon completion and the same five-business-day dispute window will apply as a credit or reversal process. Disputes will be reviewed and, where a task was not executed as instructed, the charge will be reversed or credited. If a charge fails, Corpfolio.ai may withhold the task output, retry the charge for up to 10 business days, and suspend Corpfolio Agent or the account until payment is made.

6.5. Payment Processors. Card and automated billing payments are processed by Stripe, and crypto payments are processed by Radom (each a “Payment Processor”). You authorize us and the applicable Payment Processor to charge your payment method for all fees due. Your use of a Payment Processor is subject to its terms and privacy policy, and you must not use the Platform in connection with any business or activity that is a prohibited or restricted business under the applicable Payment Processor’s terms. CORPFOLIO.AI IS NOT RESPONSIBLE FOR, AND DISCLAIMS ALL LIABILITY ARISING FROM, A PAYMENT PROCESSOR DECLINING, REVERSING, OR FREEZING A TRANSACTION, OR SUSPENDING PAYMENT SERVICES, INCLUDING WHERE YOUR BUSINESS FALLS WITHIN A PROHIBITED CATEGORY; ANY RESULTING INABILITY TO COMPLETE ORDERS OR OTOAGENT TASKS IS NOT A BREACH BY CORPFOLIO.AI. Your access to the Services may be suspended, or you may incur additional charges, if your billing information is incorrect or not kept up to date. Customer agrees to use the dispute and refund processes in Sections 6.4 and 6.11 before initiating any chargeback or payment reversal; if Customer initiates a chargeback in bad faith or in breach of those processes, Corpfolio.ai may suspend the account, recover the disputed amounts and associated chargeback fees, and treat the chargeback as a payment default.

6.6. Crypto Payments. Where you pay in cryptocurrency: (a) the amount due is fixed in USD and the crypto amount is calculated at the exchange rate quoted at checkout; (b) network and transaction fees are your responsibility; (c) a payment is received only upon sufficient on-chain confirmation; and (d) refunds of crypto payments are subject to Section 6.11 (including the original-wallet rule).

6.7. Taxes. All fees are exclusive of taxes, levies, and duties imposed on your purchase or use of the Services (including sales, use, VAT, GST, and withholding taxes), which you agree to pay; provided that you are not liable for taxes based on our gross revenues or net income. If you are required by Law to withhold any amount, the fees will be grossed up so that we receive the amount we would have received absent the withholding.

6.8. Late Payment. Late payments are subject to a service charge equal to 1.5% per month of the amount due or the maximum amount allowed by Law, whichever is less, plus reasonable costs of collection. We may suspend the Services for accounts with amounts overdue by more than 10 days after notice.

6.9. Non-Payment — Managed Entities. Customer is advised that non-renewal or non-payment in respect of a Managed Entity has consequences beyond the Platform: in addition to suspension of dashboard access, non-payment of renewal fees for a Managed Entity will initiate a strike-off process for that Entity under the rules of the incorporating jurisdiction, on the timeline determined by that jurisdiction and the applicable Local Agent. Corpfolio.ai has no liability for the striking off, dissolution, penalties, or loss of good standing of any Entity resulting from Customer’s non-payment or non-renewal.

6.10. Monitoring. Corpfolio.ai monitors platform uptime, performance, and error logs for operational purposes, and tracks active Entities and Seats per account for pricing-tier compliance as described in Section 6.2. Beyond tier compliance, Corpfolio.ai does not meter or charge based on API calls, queries, document volumes, or other consumption metrics; Corpfolio Agent task fees are triggered by task-completion events.

6.11. Refunds. Refund requests must be submitted via Corpfolio.ai’s Refund Form, confirming the original payment method and the return wallet address or bank account details. The following refund terms apply: (a) before KYC/due diligence has commenced on an order, a full refund of that order is available; (b) after work has commenced, a partial refund is available, with incorporation costs incurred and time spent deducted; Customer may instead elect a company credit for the full pre-deduction amount; (c) Subscription fees are non-refundable for any unexpired portion of a billing period following Customer-initiated termination; (d) Corpfolio Agent task fees are non-refundable once a task has been confirmed as completed, subject to the five-business-day dispute window in Section 6.4; (e) orders older than 90 days are not eligible for a cash refund; a company credit will be issued instead; (f) refunds are processed within 30–60 days of receipt of a completed Refund Form; and (g) all processed refunds are final, and Corpfolio.ai will not reprocess a refund where the wallet address provided was invalid. Crypto refunds: in compliance with AML requirements, all refunds are returned only to the original wallet address or bank account from which payment was received; where the original wallet is no longer accessible, a company credit will be issued; payments made from centralized-exchange accounts are not eligible for crypto refunds (exchange accounts use shared wallet addresses that cannot be matched for return), and customers are advised to pay from a self-custodied wallet to preserve refund eligibility.

7. Term; Termination; Portability

7.1. Term. This EULA becomes effective on the date you accept it as described above and continues for the duration of your use of the Platform or Services and any active Subscription (the “Term”).

7.2. Renewal; Non-Renewal. Subscriptions auto-renew annually for Managed Entities and monthly for Self-Managed Entities unless Customer gives notice of non-renewal before the applicable renewal date (through the Platform or in writing). Non-renewal or non-payment suspends dashboard access, and, for Managed Entities, has the further consequences described in Section 6.9. White-Label Operator terms and renewal cadence are governed by the applicable Order Form.

7.3. Termination by Customer. Customer may terminate this EULA or any Subscription at any time for convenience by written notice or through the Platform. For annual plans, no refund is provided for the unexpired portion of the Subscription term; for monthly plans, termination takes effect at the end of the current billing period.

7.4. Suspension and Termination by Corpfolio.ai. Corpfolio.ai may: (a) terminate this EULA or any Subscription for convenience on 30 days’ written notice; (b) terminate immediately upon a material breach by Customer that remains uncured 10 business days after written notice, including non-payment, violation of Section 5 (KYC/AML; flow-downs) or Section 11 (Use Restrictions), submission of false or misleading KYC Materials, or use of the Platform in a manner that exposes Corpfolio.ai, the Fulfillment Partner, or the Local Agent network to regulatory risk; (c) terminate immediately and without prior written notice upon Customer’s insolvency, appointment of a receiver, assignment for the benefit of creditors, or filing for bankruptcy protection; and (d) suspend the Services (in whole or in part) immediately where reasonably necessary to comply with Law, to complete an AML or sanctions review under Section 5.3, to prevent harm to the Platform or other customers, or pending cure of a payment default. Where Corpfolio.ai terminates for convenience under clause (a) of this section, it will refund prepaid, unused Subscription fees for the terminated period on a pro-rata basis.

7.5. Effect of Termination; Data Export. Upon termination or expiration: (a) Customer’s dashboard access is suspended and all licenses granted to Customer terminate; (b) Customer Data will remain available for export by Customer in a standard format for 30 days following termination, after which Corpfolio.ai may delete or anonymize Customer Data in accordance with its data-retention policy and Section 8.8, except where retention is required by Law (including AML record-keeping obligations); and (c) all fees accrued through the effective date of termination become immediately due. Termination of this EULA does not, by itself, terminate any Entity’s engagement with a Local Agent or the Fulfillment Partner, or relieve any Entity of its jurisdictional maintenance obligations.

7.6. Transfer-Out; Portability. Customers on Managed-Entity plans that wish to transfer their Entities to another provider may do so by giving notice and completing the Platform’s transfer-out process. Corpfolio.ai will, and will request that the Fulfillment Partner and the applicable Local Agents, reasonably cooperate with outgoing transfers of Entities in good standing, subject to settlement of all outstanding fees. Transfer timelines depend on the receiving agent and the relevant jurisdiction and are not guaranteed by Corpfolio.ai.

7.7. Survival. The rights, obligations, and commitments in this EULA that, by their nature, would logically continue beyond termination, including Sections 3, 5.2, 6 (as to accrued fees), 7.5, 8, 9.6, 10, 11, 13, 14, 15, 16, 18, and 19, survive termination of this EULA.

8. Customer Data; Data Protection; Security

8.1. Ownership. As between the parties, Customer owns all Customer Data, including Customer-specific entity records, registers, cap tables, uploaded documents, completed workflow documents, and documents generated on Customer’s behalf for a specific Entity or Corporate Action, subject to Corpfolio.ai’s ownership of the underlying Platform, Content, templates, workflows, prompts, software, and other Corpfolio.ai IP described in Section 10. Corpfolio.ai does not claim ownership of Customer Data. Corpfolio.ai owns the Platform, the software, and all associated Intellectual Property Rights, together with the De-Identified Data and Usage Data as described in Section 8.5.

8.2. License to Process. Customer grants Corpfolio.ai a limited, non-exclusive, worldwide, royalty-free license (with the right to sublicense to the subcontractors and Third-Party Services used to provide the Platform) to access, host, process, store, transmit, display, and reproduce Customer Data solely to the extent necessary to (a) provide and operate the Platform and Services, (b) route orders and Corporate Actions to the Fulfillment Partner and Local Agents, (c) comply with Law, and (d) create De-Identified Data as described in Section 8.5. This license terminates upon expiry of the post-termination retention periods described in Section 8.8, except as to De-Identified Data.

8.3. Roles; Data Processing Agreement. For most personal data within Customer Data processed through the Platform, Corpfolio.ai acts as a processor on Customer’s documented instructions and Customer acts as controller (or as a processor on behalf of its own End-Clients). Where Corpfolio.ai processes personal data for its own purposes, including AML/KYC compliance, fraud prevention, security, platform analytics, and product improvement, Corpfolio.ai acts as an independent controller. The DPA at Exhibit A governs the processor relationship, including subject matter, nature and purpose of processing, categories of data and data subjects, processor obligations (security measures and breach-notification timelines), sub-processor management and notification rights, data-subject rights assistance, audit rights, international transfer mechanisms, and retention and deletion, and includes the then-current sub-processor schedule (including the Fulfillment Partner and the Local Agent network) and a mechanism for notifying customers of changes.

8.4. KYC and Identity Data; Onward Transfers. KYC Materials submitted through the Platform are processed by SumSub as an independent controller for identity-verification, fraud-prevention, and AML-compliance purposes, subject to SumSub’s own terms and privacy policy. The Fulfillment Partner and the Local Agents also receive Entity, officer, shareholder, and UBO data as necessary to complete filings with in-country registries, and may themselves act as independent controllers under local Law. Customer consents, and represents that it has obtained all consents and provided all notices necessary for the relevant individuals, including any express written consents required under biometric-information privacy Laws in respect of selfie/liveness or biometric verification data, to these disclosures and transfers, including cross-border transfers to jurisdictions for which no adequacy decision applies (subject to the transfer mechanisms in the DPA).

8.5. De-Identified Data; Usage Data. Notwithstanding anything to the contrary in this EULA, Corpfolio.ai may create and use De-Identified Data for analytics, benchmarking, product improvement, and the development of new functionality, and may collect and use Usage Data to develop, improve, secure, support, and operate the Platform and Services. Corpfolio.ai owns all right, title, and interest in and to the De-Identified Data and Usage Data, and may use and disclose the same for any lawful business purpose; provided that Corpfolio.ai will not, unless required by applicable Law, (a) re-identify, or attempt to re-identify, De-Identified Data, or (b) disclose De-Identified Data in a form that identifies Customer, any Entity, any End-Client, or any individual.

8.6. AI Training Restriction. Corpfolio.ai will not use identifiable Customer Data to train its own or any third party’s artificial-intelligence models without Customer’s express consent. Corpfolio.ai will not intentionally route identifiable Customer Data to an AI Provider under a configuration that permits that AI Provider to train its generally available models on that Customer Data, unless Customer has expressly consented or opted in. Customer acknowledges that AI Providers may process and retain inputs, outputs, logs, metadata, and safety classifications for service provision, abuse monitoring, security, legal compliance, debugging, and similar purposes under their then-current commercial/API terms, and that zero-retention or modified-retention configurations may not be available for all features or customers. Aggregated and De-Identified interaction data may be used to improve Corpfolio Agent prompting, workflows, evaluation, safety, and quality in accordance with Section 8.5.

8.7. Permitted Disclosures; No Sale. Customer Data will not be sold, rented, or otherwise transferred to third parties for commercial purposes, and will not be used to profile customers for third-party advertising or disclosed to Customer’s competitors. Customer Data is disclosed only: (a) to the infrastructure and service providers identified in Section 12 and in the DPA, strictly to the extent necessary to operate, secure, support, and improve the Platform; (b) to the Fulfillment Partner and Local Agents to fulfil orders and Corporate Actions; (c) to Payment Processors, banks, registries, competent authorities, regulators, courts, and law-enforcement bodies where required or permitted by Law, Local Agent Terms, payment rules, or valid legal process; (d) to Customer’s own Authorized Users and, for Intermediaries and White-Label Operators, their End-Clients, as configured by Customer within the Platform; and (e) to a successor, assignee, investor, acquirer, or professional adviser in connection with a bona fide financing, merger, acquisition, reorganization, assignment, or sale of all or part of Corpfolio.ai’s business, subject to reasonable confidentiality protections.

8.8. Retention; Deletion. Following termination, Customer Data remains exportable for the period stated in Section 7.5, after which Corpfolio.ai will delete or anonymize Customer Data in accordance with its data-retention policy, except where retention is required by Law, including AML record-keeping obligations, which may require retention of KYC Materials for up to seven years depending on the jurisdiction. Corpfolio.ai will inform Customer of legally mandated retention obligations applicable to its data upon request.

8.9. Security; Breach Notification. Corpfolio.ai will maintain commercially reasonable administrative, technical, and organizational security measures designed to protect Customer Data against unauthorized access, loss, misuse, and alteration, including encryption of Customer Data in transit and at rest, role-based access controls, mandatory 2FA, and audit-trail logging. Corpfolio.ai does not currently hold SOC 2 or ISO 27001 certification, and any reference on the Platform, website, or marketing materials to “SOC 2 controls” or similar language refers to control objectives or practices only, not to a completed SOC 2 audit, SOC 2 report, or certification, unless Corpfolio.ai expressly provides such report or certification in writing. SSO and advanced permission features are available only to the extent enabled for the applicable tier or Order Form. Corpfolio.ai will notify affected Customers of a personal-data breach affecting Customer Data without undue delay and in any event within 72 hours of confirming such breach, as further described in the DPA.

9. Artificial Intelligence Capabilities; Corpfolio Agent

9.1. Nature of AI Outputs. The Platform and Services include artificial-intelligence and machine-learning capabilities, including Corpfolio Agent, AI-assisted document analysis, AI chat, structure visualization, and Public Tools (collectively, the “AI Capabilities”). AI Capabilities generate outputs probabilistically; outputs may be inaccurate, incomplete, outdated, non-unique, or unsuitable for a particular purpose, may not reflect the current law, regulatory position, banking practice, tax treatment, or registry practice of any jurisdiction, and may differ across identical prompts. Other users may receive similar or identical outputs. You understand and agree that your use of the AI Capabilities is at your sole risk, and you are solely responsible for evaluating the accuracy, completeness, lawfulness, and appropriateness of all outputs before relying on them.

9.2. Mandatory Human Review of Binding Acts. Customer must review and approve every document, filing, resolution, instruction, signature request, bank-account package, renewal, registry submission, or other output generated or prepared by the AI Capabilities before it is signed, executed, filed, submitted to a registry, sent to a bank or other third party, or otherwise given legal effect (each, a “Binding Act”). Where Customer is an Intermediary or other regulated professional, or where the Binding Act requires legal, tax, accounting, fiduciary, corporate-secretarial, securities, investment, fund, banking, or other professional judgment, that review must be performed by an appropriately licensed or qualified individual within Customer’s or its Intermediary’s organization. Corpfolio.ai has no obligation to provide that licensed or qualified reviewer. Use of the AI Capabilities for automated decision-making intended to replace such review is expressly prohibited. Corpfolio.ai is not liable for any decision made, action taken, document executed, or filing made in reliance on the outputs of the AI Capabilities.

9.3. Instructions; Authority to Act. Corpfolio Agent acts on Customer’s natural-language instructions. Customer is responsible for the clarity, accuracy, and lawfulness of its instructions, and represents that each instruction is duly authorized by the relevant Entity (and, where applicable, End-Client). Subject to Sections 6.4 (pre-authorization) and 9.2 (human review of Binding Acts), Customer authorizes Corpfolio Agent to prepare drafts, populate filings, coordinate signature requests, and queue Corporate Actions for fulfillment in accordance with its instructions. Corpfolio Agent will escalate to human review Customer’s or Corpfolio.ai’s operations team, as applicable where the Platform’s workflows require.

9.4. AI Providers. The AI Capabilities are powered by third-party foundation models and services (currently OpenAI and Anthropic (Claude), with VoiceFlow for AI chat). Customer Data submitted to the AI Capabilities may be processed by AI Providers and their subprocessors under their then-current commercial/API terms, data-processing terms, usage policies, retention controls, and safety requirements. Corpfolio.ai may add, remove, or substitute underlying AI Providers at any time and without prior notice, provided that Corpfolio.ai will use commercially reasonable efforts not to substitute an AI Provider in a manner that materially weakens the AI training restriction in Section 8.6 for identifiable Customer Data submitted after the substitution. Customer acknowledges that AI Provider outages, policy changes, safety filters, rate limits, abuse-monitoring requirements, or restrictions may delay, degrade, block, or alter AI Capability outputs without constituting a breach by Corpfolio.ai.

9.5. AI Use Restrictions (Flow-Down). Customer must not, and must not permit any Authorized User or End-Client to: (a) use outputs of the AI Capabilities to develop, train, distill, benchmark for competitive development, or improve any machine-learning or artificial-intelligence model that competes with the Platform or with an AI Provider’s products or services, except to the extent an AI Provider’s terms permit a specific exception; (b) use the AI Capabilities to generate content or take actions that violate Law, third-party rights, professional duties, Local Agent Terms, Payment Processor terms, or the applicable AI Provider’s usage policies; (c) attempt to extract model weights, training data, hidden chain-of-thought, system prompts, non-public model information, or safety mechanisms, or to reverse engineer, circumvent rate limits, bypass safety mitigations, or otherwise interfere with the AI Capabilities or AI Providers; (d) represent AI-generated output as human-generated professional advice; (e) use AI Capabilities for automated high-stakes decisions in legal, financial, employment, insurance, housing, education, healthcare, migration, law-enforcement, national-security, or similar contexts without appropriate human review and legal authorization; (f) use AI Capabilities to provide tailored legal, tax, medical, financial, investment, or other licensed professional advice without appropriate involvement by a licensed professional; or (g) submit or process data concerning minors, biometric identification, sensitive personal data, or regulated data except as expressly required for KYC/AML verification or another lawful, documented Platform purpose and in compliance with the DPA and applicable Law.

9.6. Survival of AI Disclaimers. The acknowledgments and allocations of responsibility in this Section 9 survive termination and apply to all outputs generated during the Term.

10. Intellectual Property

10.1. Corpfolio.ai IP; Reservation of Rights. Corpfolio.ai and its licensors own and will continue to own and retain all right, title, and interest, including all Intellectual Property Rights, in and to the Platform, the Services, the AI Capabilities, and the technology, software, models, prompts, workflows, templates, processes, methodologies, “look-and-feel”, documentation, and materials used to provide them, together with all improvements and derivative works thereof and all De-Identified Data and Usage Data. Except for the limited license in Section 10.2, no rights are granted to Customer, whether by implication, waiver, estoppel, or otherwise, and all rights not expressly granted are reserved exclusively by Corpfolio.ai. Customer will not copy, reproduce, disclose, modify, create derivative works of, publicly display, publicly perform, republish, download, store, or transmit any of the foregoing except as expressly permitted by the Agreement.

10.2. License to Customer. Subject to the terms of the Agreement (including payment of applicable fees), Corpfolio.ai grants Customer a limited, non-exclusive, non-transferable, non-sublicensable (except as expressly permitted under an applicable Category Addendum with respect to End-Client access) right, during the Term, to access and use the Platform and Services, solely for Customer’s internal business purposes and, if Customer is an Intermediary or White-Label Operator, for the provision of services to its End-Clients in accordance with the applicable Category Addendum. This is a subscription right of access to a hosted service; no software is licensed for installation, and no ownership interest is conveyed.

10.3. Feedback. Customer hereby assigns to Corpfolio.ai, without compensation, all rights in any Feedback. Any alterations, enhancements, or derivatives of the Platform made as a result of Feedback are the sole and exclusive property of Corpfolio.ai, together with all Intellectual Property Rights therein.

10.4. Trademarks. No right to use any party’s trade names, trademarks, branding, or logos is granted under this EULA, except that (a) Corpfolio.ai may use Customer’s name and logo within the Platform solely to render the service to Customer, and (b) branding rights for White-Label Operators are governed exclusively by Exhibit D and the applicable Order Form. Neither party will issue press releases or public announcements naming the other without prior written consent.

10.5. Customer-Specific Outputs and Documents. Subject to Customer’s compliance with the Agreement and payment of applicable fees, Customer may use documents, registers, filings, resolutions, certificates, signature packets, entity records, and other outputs generated through the Platform specifically for Customer’s Entities or End-Clients for the internal business, legal, tax, corporate-record, filing, and advisory purposes for which those outputs were generated. This Section 10.5 does not transfer ownership of, or grant Customer any right to extract, reuse, commercialize, or create derivative works from, Corpfolio.ai’s underlying templates, clause libraries, forms, prompts, workflows, structure-visualization logic, software, Content, or other Platform components except as embedded in Customer-specific outputs used for the applicable Entity or Corporate Action.

11. Use Restrictions

11.1. Restrictions. Customer will not, and will not permit any Authorized User, End-Client, or third party to:

• copy, modify, translate, or create derivative works of the Platform or any part thereof;
• reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, object code, underlying structure, algorithms, models, prompts, or non-public APIs of the Platform, except to the extent such restriction is prohibited by Law;
• sell, resell, rent, lease, lend, sublicense, distribute, or otherwise commercially make available the Platform or the Services to any third party, or operate any service-bureau or time-sharing arrangement, in each case except as expressly permitted for Intermediaries and White-Label Operators under the applicable Category Addendum and Order Form;
• access or use the Platform to build, benchmark for, or assist a competing product or service, or copy any ideas, features, functions, or graphics of the Platform;
• use any robot, spider, scraper, data-mining tool, or other automated means to access, extract, or index the Platform or any data therein, or access the Platform through any interface other than those made available by Corpfolio.ai (including any permitted API used beyond its documented scope);
• probe, scan, or test the vulnerability of the Platform, breach or circumvent any security or authentication measure (including 2FA or the domain-validation rule), or access accounts, Entities, or data belonging to others without authorization;
• interfere with or disrupt the integrity or performance of the Platform, including by introducing viruses or other harmful code, engaging in denial-of-service attacks, or imposing an unreasonable load on the infrastructure;
• use the Platform to create, order, or administer any Entity for, or otherwise in furtherance of, money laundering, terrorist financing, sanctions evasion, tax evasion, fraud, or any other unlawful purpose, or to conceal or misrepresent the identity of any beneficial owner;
• circumvent, or assist any person to circumvent, the Platform’s KYC/AML verification requirements, including by granting End-Client access in a manner that bypasses verification;
• submit false, misleading, or infringing information or materials, or upload content that violates any third party’s Intellectual Property Rights, confidentiality, or privacy rights;
• remove, obscure, or alter any proprietary notices on the Platform;
• systematically export, transfer, or synchronize Customer Data out of the Platform into a competing entity-management or registry platform by automated means, other than through the export functionality provided by the Platform (including under Sections 7.5 and 7.6);
• use the Platform, Services, AI Capabilities, Content, or outputs to provide legal, tax, accounting, fiduciary, investment, securities, fund-administration, banking, trust-company, corporate-services, or other regulated advice or services unless Customer is properly licensed or otherwise legally permitted to do so and conducts all required human review; or
• use the Platform or Services in any way or for any purpose that is not permitted under the Agreement, that is intended to interfere with the provision of the Platform or Services to other customers, or that violates applicable Law.

11.2. Enforcement. Corpfolio.ai may investigate suspected violations of this Section 11 and may suspend or terminate access in accordance with Section 7.4. Corpfolio.ai reserves the right to conduct usage reviews for the purpose of verifying compliance with subscription-tier limits and this Section 11.

12. Third-Party Services; Dependencies

12.1. Third-Party Services. The Platform is built on, interoperates with, and depends on Third-Party Services, currently including: Privy (authentication); SumSub (KYC verification); Cloudflare (hosting/CDN); Amazon Web Services (“AWS”) (data storage); Brevo (transactional email); OpenAI and Anthropic (AI and document analysis); VoiceFlow (AI chat); Tresorit (secure file sharing); MetaBase (analytics); Platoforms and DocuSeal (document generation and e-signature); Stripe (card payments and automated billing); and Radom (crypto payments). Corpfolio.ai may change its Third-Party Services from time to time. Use of features powered by a Third-Party Service may be subject to that provider’s terms, which Customer accepts by using the relevant feature.

12.2. Core Infrastructure Dependencies. Platform availability depends on Cloudflare, AWS, and Privy; an outage in any of these directly affects users’ ability to access the Platform. Corpfolio.ai monitors these dependencies continuously but has no contractual ability to guarantee their uptime and accepts no liability for Platform unavailability caused by failures in these providers’ infrastructure.

12.3. Service-Layer Dependencies. Certain Platform functions depend on specific Third-Party Services, and an outage of the relevant provider will delay or disable the corresponding function without constituting a breach by Corpfolio.ai: SumSub (KYC verification, blocking new incorporations and verification-gated Corporate Actions); Stripe (payment processing, blocking new orders and Corpfolio Agent completion billing); Platoforms and DocuSeal (document generation and e-signature); OpenAI and Anthropic and VoiceFlow (AI Capabilities, including Corpfolio Agent with functions such as dashboard access, entity management, and document storage remain available independently of AI-provider uptime); Tresorit (secure document sharing); and Brevo (transactional email delivery).

12.4. Links; No Endorsement. The Platform may contain hyperlinks or references to third-party websites or resources. Corpfolio.ai does not control and is not responsible for the content, products, or services available from such third parties, and a link does not imply endorsement.

13. Warranties; Disclaimers; Service Levels

13.1. Limited Warranty. Corpfolio.ai will perform the Services and maintain the Platform using a commercially reasonable level of skill and care.

13.2. Disclaimers. OTHER THAN AS EXPRESSLY SET OUT IN SECTION 13.1, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE EXPRESSLY DISCLAIM ALL WARRANTIES (INCLUDING IMPLIED WARRANTIES) IN RELATION TO THE PLATFORM AND THE SERVICES, INCLUDING TITLE, NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE. Without limiting the generality of the foregoing, we specifically make the following disclaimers:

13.2.1. THE PLATFORM AND THE SERVICES ARE DELIVERED “AS-IS” AND “AS-AVAILABLE”. WE MAKE NO REPRESENTATION, WARRANTY, OR GUARANTY THAT THE PLATFORM OR SERVICES WILL BE SECURE, TIMELY, UNINTERRUPTED, OR ERROR-FREE, THAT THEY WILL OPERATE IN COMBINATION WITH ANY OTHER HARDWARE, SOFTWARE, SYSTEM, OR DATA, OR THAT THEY WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS;

13.2.2. WE DO NOT WARRANT THAT ANY CONTENT, TEMPLATE, JURISDICTION INFORMATION, STRUCTURE VISUALIZATION, OR OUTPUT OF THE AI CAPABILITIES IS ACCURATE, CORRECT, COMPLETE, UP-TO-DATE, OR ERROR-FREE, OR THAT IT REFLECTS THE CURRENT LAW OR REGISTRY PRACTICE OF ANY JURISDICTION;

13.2.3. CORPFOLIO.AI IS NOT A CORPORATE SERVICES PROVIDER, LAW FIRM, ACCOUNTING FIRM, OR TAX ADVISOR, AND NOTHING ON THE PLATFORM CONSTITUTES LEGAL, TAX, ACCOUNTING, OR OTHER PROFESSIONAL ADVICE. FULFILLMENT SERVICES ARE PERFORMED BY THE FULFILLMENT PARTNER AND LOCAL AGENTS, REGARDLESS OF THE FULFILLMENT PARTNER’S OWNERSHIP STATUS, AND CORPFOLIO.AI MAKES NO WARRANTY REGARDING, AND ACCEPTS NO RESPONSIBILITY OR LIABILITY FOR, THE PERFORMANCE, TIMELINESS, ACCURACY, OR OUTCOME OF ANY FULFILLMENT SERVICES, ANY REGISTRY FILING OR DECISION, OR ANY ACT OR OMISSION OF THE FULFILLMENT PARTNER, ANY LOCAL AGENT, OR ANY REGISTRY;

13.2.4. WE DO NOT WARRANT ANY THIRD-PARTY SERVICES, AND WE ARE NOT RESPONSIBLE FOR UNAVAILABILITY, ERRORS, OR LOSSES CAUSED BY THIRD-PARTY SERVICES, INCLUDING THOSE IDENTIFIED IN SECTION 12; AND

13.2.5. WE MAKE NO WARRANTY THAT THE PLATFORM OR SERVICES ARE OR WILL REMAIN FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS, AND, EXCEPT AS EXPRESSLY SET OUT IN SECTION 8.9 AND THE DPA, WE MAKE NO WARRANTY RELATED TO THE CONFIDENTIALITY AND SECURITY OF ANY DATA PROVIDED BY YOU TO US.

13.3. No Reliance; Marketing Materials. Customer acknowledges that it has not relied on any representation or warranty not expressly set out in the Agreement, including any statement on the Corpfolio.ai website, demo site, sales materials, product screenshots, or marketing materials regarding certifications, controls, SSO, uptime, “24/7/365” availability, SLAs, dedicated support, priority support, timelines, jurisdictions, outcomes, “avoidance” of penalties, legal or tax optimization, filings, bank-account openings, or the availability of particular features, integrations, or AI Providers. Unless expressly incorporated into an Order Form or written SLA signed by Corpfolio.ai, such statements are descriptive or aspirational only and do not create contractual commitments, warranties, service levels, or remedies. For clarity, website statements such as “we file,” “Corpfolio Agent drafts and files,” “licensed human review,” “SOC 2 controls,” “SLA and dedicated support,” and “24/7/365 AI agent uptime” are subject to Sections 2, 3, 8.9, 9, 12, and 13.6 and do not override this EULA.

13.4. Jurisdictional Availability. The list of supported jurisdictions, entity types, and Corporate Actions may change from time to time, including as a result of changes in Law, registry practice, or the Local Agent network, without liability to Corpfolio.ai.

13.5. High-Risk Use. The Platform is not designed for, and may not be used for, any purpose requiring fail-safe performance.

13.6. Service Levels. Except to the extent an Order Form or written SLA expressly states a specific uptime commitment, support response commitment, service credit, or other service-level remedy, the Platform is provided on a commercially reasonable-efforts basis. Corpfolio.ai monitors uptime continuously and targets high availability, but availability depends in part on third-party infrastructure, AI Providers, Payment Processors, registries, the Fulfillment Partner, and Local Agents outside Corpfolio.ai’s direct control, and CORPFOLIO.AI DOES NOT COMMIT TO ANY UPTIME PERCENTAGE, LATENCY FIGURE, AI AGENT AVAILABILITY, OR RESPONSE OR RESOLUTION TIME. THE SUPPORT TARGETS IN EXHIBIT B ARE TARGETS ONLY, NOT CONTRACTUAL GUARANTEES, AND NO SERVICE CREDITS OR OTHER REMEDIES ATTACH TO MISSING THEM UNLESS AN ORDER FORM OR WRITTEN SLA EXPRESSLY PROVIDES OTHERWISE.

13.7. No Formal DR/BCP Commitment. Corpfolio.ai does not currently maintain a formal disaster-recovery or business-continuity plan that is contractually committed to customers, unless an Order Form or written addendum expressly provides otherwise; AWS and Cloudflare provide inherent redundancy at the infrastructure level. Customers with material continuity requirements should factor this into their risk assessment.

14. Limitation of Liability

14.1. Exclusion of Indirect Damages. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, CONTRACTORS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, INCIDENTAL, OR SPECIAL DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, OR DATA, OR FOR THE COST OF SUBSTITUTE SERVICES, WHETHER IN AN ACTION IN WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

14.2. Liability Cap. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE MAXIMUM AGGREGATE LIABILITY OF CORPFOLIO.AI AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, ATTORNEYS, AGENTS, CONTRACTORS, AND LICENSORS (THE “CORPFOLIO.AI PARTIES”) FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE AGREEMENT, THE PLATFORM, OR THE SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, WILL NOT EXCEED THE TOTAL FEES PAID BY CUSTOMER TO CORPFOLIO.AI FOR THE SERVICES IN THE 12 MONTHS IMMEDIATELY PRECEDING THE EVENT FIRST GIVING RISE TO THE CLAIM. FOR CLARITY, FEES PAID FOR FULFILLMENT SERVICES AND AMOUNTS PASSED THROUGH TO THE FULFILLMENT PARTNER, LOCAL AGENTS, OR REGISTRIES ARE EXCLUDED FROM THE CAP CALCULATION.

14.3. Specific Exclusions. Without limiting Section 14.1, the Corpfolio.ai Parties will have no liability for: (a) the acts, omissions, delays, or failures of the Fulfillment Partner (whether or not the Fulfillment Partner is at any time under common Control with Corpfolio.ai, partially owned or operated through a joint venture, wholly sold or transferred, independent, replaced, or otherwise affiliated or unaffiliated), any Local Agent, any registry, bank, Payment Processor, AI Provider, or other Third-Party Service; (b) losses arising from inaccurate, incomplete, or outdated information supplied by or on behalf of Customer; (c) decisions made or actions taken in reliance on outputs of the AI Capabilities in breach of Section 9.2; (d) the striking off, dissolution, penalties, fines, missed deadlines, rejected filings, loss of good standing, or other adverse consequences of any Entity resulting from Customer’s non-payment, non-renewal, failure to complete KYC, failure to approve or sign documents, failure to provide accurate information, or failure to act on Platform reminders; (e) losses arising from a Payment Processor declining, reversing, freezing, delaying, or refusing a transaction; (f) Customer’s or any End-Client’s business, tax, securities, investment, fund, banking, licensing, professional, or regulatory obligations; and (g) unavailability, degradation, suspension, or alteration of AI Capabilities arising from AI Provider outages, rate limits, safety filters, policy changes, or abuse-monitoring requirements.

14.4. Basis of the Bargain; Allocation. The parties acknowledge that the fees reflect the allocation of risk in this Section 14 and Section 13, that Corpfolio.ai provides only the technology layer at fees that are a small fraction of the value of the Entities and transactions administered through the Platform, and that the limitations in this Section 14 will apply notwithstanding any failure of essential purpose of any limited remedy.

15. Indemnification

15.1. By Corpfolio.ai (IP Infringement). Corpfolio.ai will defend Customer against any third-party claim alleging that the Platform, as provided by Corpfolio.ai and used in accordance with the Agreement, infringes such third party’s United States patent, copyright, or trademark, or misappropriates its trade secret, and will indemnify Customer against the damages, costs, and reasonable attorneys’ fees finally awarded against Customer (or agreed in settlement by Corpfolio.ai) in respect of such claim. If the Platform becomes, or in Corpfolio.ai’s opinion is likely to become, the subject of such a claim, Corpfolio.ai may, at its option and expense: (a) procure the right for Customer to continue using the Platform; (b) modify or replace the Platform so it becomes non-infringing without material loss of functionality; or (c) terminate the affected Subscription and refund prepaid, unused Subscription fees. This Section 15.1 does not apply to claims arising from: (i) Customer Data; (ii) combination of the Platform with items not provided by Corpfolio.ai; (iii) modifications not made by Corpfolio.ai; (iv) use in breach of the Agreement; (v) Third-Party Services; or (vi) outputs of the AI Capabilities to the extent the claim arises from Customer’s instructions or inputs or from use of outputs in breach of Section 9. THIS SECTION 15.1 STATES CORPFOLIO.AI’S SOLE LIABILITY, AND CUSTOMER’S EXCLUSIVE REMEDY, FOR INFRINGEMENT CLAIMS.

15.2. By Customer. To the extent not prohibited by Law, Customer will indemnify, defend, and hold harmless the Corpfolio.ai Parties, as well as the Fulfillment Partner and Local Agents (as third-party beneficiaries of this Section 15.2 solely for this purpose), from and against any and all demands, losses, liabilities, damages, claims, causes of action, actions, suits, fees (including reasonable attorneys’ fees and expert fees), and costs arising directly or indirectly out of or in connection with: (a) Customer Data, including its accuracy, completeness, legality, or quality, or Customer’s failure to obtain any consent, permission, license, right, or authorization necessary for the processing of Customer Data as contemplated by the Agreement (including consents required under data-protection and biometric-information privacy Laws); (b) Customer’s (or its Authorized Users’ or End-Clients’) use of the Platform, the Services, or any outputs of the AI Capabilities, including any Binding Act executed, filed, or given effect by or for Customer; (c) Customer’s violation of the Agreement, including Sections 5 and 11; (d) Customer’s (or any Entity’s or End-Client’s) violation of applicable Law, including AML, sanctions, tax, and beneficial-ownership disclosure requirements; (e) claims by End-Clients or other third parties relating to Customer’s services, advice, markups, or business; and (f) infringement or misappropriation of any third party’s rights (including Intellectual Property Rights, confidentiality, or privacy rights) resulting from Customer Data or Customer’s use of the Platform or Services.

15.3. Mutual Indemnity (Gross Negligence; Willful Misconduct). Each party will indemnify, defend, and hold harmless the other party from and against third-party claims to the extent arising from the indemnifying party’s gross negligence or willful misconduct; provided that Corpfolio.ai’s liability under this Section 15.3 remains subject to Section 14.

15.4. Procedure. The indemnified party must give the indemnifying party prompt written notice of the claim (provided that late notice relieves the indemnifying party only to the extent of resulting prejudice), reasonable cooperation at the indemnifying party’s expense, and sole control of the defense and settlement of the claim; provided that the indemnifying party may not settle any claim in a manner that imposes non-monetary obligations on, or admits fault of, the indemnified party without its prior written consent. The indemnified party may participate in the defense with counsel of its own choosing at its own expense, and agrees not to settle any indemnified matter without the indemnifying party’s prior written consent.

16. Confidentiality

16.1. Definition. “Confidential Information” means non-public information disclosed by one party to the other under the Agreement that is designated confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure, including Customer Data (Customer’s Confidential Information), the terms of any Order Form, the Platform’s non-public features, security information, and roadmaps (Corpfolio.ai’s Confidential Information). Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the recipient; (b) was known to the recipient without restriction before disclosure; (c) is independently developed without use of the discloser’s Confidential Information; or (d) is rightfully received from a third party without duty of confidentiality.

16.2. Obligations. Each party will: (a) use the other party’s Confidential Information only to exercise its rights and perform its obligations under the Agreement; (b) protect it using at least the same degree of care it uses for its own similar information, and no less than reasonable care; and (c) not disclose it except to its and its Affiliates’ personnel, professional advisers, subcontractors, and (in Corpfolio.ai’s case) the Fulfillment Partner, Local Agents, and Third-Party Services who need to know it for the purposes of the Agreement and are bound by confidentiality obligations no less protective. A party may disclose Confidential Information to the extent required by Law or valid legal process, with prior notice to the other party where legally permitted.

16.3. Duration. The obligations in this Section 16 apply during the Term and for five years thereafter, except for trade secrets and KYC Materials, as to which they continue for as long as the information retains its character as such or as required by Law.

17. Force Majeure; Business Continuity

17.1. Force Majeure. Corpfolio.ai’s obligations are suspended to the extent that performance is prevented or delayed by events outside its reasonable control (each a “Force Majeure Event”), including natural disasters, epidemics, government actions, sanctions, changes in Law or regulation affecting a specific jurisdiction, war or civil unrest, internet or telecommunications infrastructure failures, power failures, cyberattacks or denial-of-service attacks, failures of Third-Party Services identified in Section 12, registry closures or backlogs, and any Fulfillment Disruption as described in Section 3.4. Corpfolio.ai will notify affected Customers promptly and use commercially reasonable efforts to restore the Services or identify workarounds.

17.2. Extended Force Majeure. If a Force Majeure Event prevents the material provision of the Services for more than 60 consecutive days, either party may terminate the affected Subscription on written notice, in which case Corpfolio.ai will refund prepaid, unused Subscription fees for the terminated period on a pro-rata basis (and, for a Fulfillment Disruption, Section 3.4 governs unfulfilled orders). Such refund is Customer’s sole and exclusive remedy for a Force Majeure Event.

18. Governing Law

18.1. Governing Law. Any disputes arising in connection with the Agreement or the use of the Platform or Services will be governed by and construed and enforced solely and exclusively in accordance with the Laws of the State of Delaware, without regard to its conflicts-of-law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

18.2. Informal Resolution. Each party agrees to provide written notice of any dispute to the other party at its notice address and to attempt in good faith to resolve the dispute for 30 days after notice before commencing litigation.

18.3. Jurisdiction; Venue. Each party irrevocably and unconditionally submits to the exclusive jurisdiction of the state and federal courts located in Wilmington, Delaware, for the resolution of any dispute arising out of or relating to the Agreement, the Platform, or the Services, and waives, to the fullest extent permitted by applicable Law, any objection to venue or any claim that such courts are an inconvenient forum.

18.4. Injunctive Relief. Notwithstanding Section 18.3, either party may seek temporary or preliminary injunctive relief in any court of competent jurisdiction to protect its Intellectual Property Rights or Confidential Information, or to enforce Section 11.

19. Miscellaneous

19.1. Assignment. Customer may not assign its rights and obligations under the Agreement, in whole or in part, without our prior written consent, except to a successor in interest in connection with a merger, acquisition, or sale of substantially all of Customer’s assets that is not a competitor of Corpfolio.ai, upon written notice. We may assign the Agreement, in whole or in part, or delegate any of our rights and obligations, without your consent and with or without notice to you, including to an Affiliate or to a successor entity in connection with the incorporation or spin-off of the Corpfolio.ai business, a merger, acquisition, corporate reorganization, or sale of all or substantially all of our assets. No designation, change of Control, sale, assignment, contribution to a joint venture, or replacement of the Fulfillment Partner requires Customer consent or operates as an assignment of the Agreement by Corpfolio.ai; any related transition of Fulfillment Services is governed by Section 3.4 and applicable Local Agent Terms. The Agreement binds and benefits the parties’ successors, representatives, and permitted assigns.

19.2. Notices. We may provide notices to you via the email address associated with your account, the dashboard, or the Platform, and such notices are effective when sent or posted. You may provide notice to us by email at [email protected] or by mail to Corpfolio.ai LLC, 1111B S Governors Ave # 7473, Dover, Delaware 19904, USA, Attn: Legal; your notices are effective upon our confirmed receipt. Legal process and indemnity/dispute notices must be sent by both email and mail.

19.3. No Waiver; Delay. Either party’s failure or delay to insist on or enforce strict performance of any provision of the Agreement will not be construed as a waiver of any provision or right, and will not prevent enforcement at a later date.

19.4. Severability. If any provision (or part thereof) of the Agreement becomes illegal, invalid, unenforceable, or prohibited under applicable Law, that provision or part will be deemed not to form part of the Agreement, and the legality, validity, and enforceability of the remainder will remain in full force and effect.

19.5. Entire Agreement. The Agreement constitutes the entire agreement between you and us relating to its subject matter and supersedes all prior communications and agreements relating to access to and use of the Platform and Services. Terms in any Customer purchase order or vendor-onboarding form are void and of no effect, even if signed after this EULA.

19.6. Relationship. We provide the Platform and the Services as an independent contractor. The Agreement does not create any partnership, joint venture, fiduciary, agency, or employment relationship between the parties, and neither party may bind the other. For the avoidance of doubt, Corpfolio.ai is not the agent of the Fulfillment Partner or any Local Agent, and none of them is an agent of Corpfolio.ai, regardless of whether the Fulfillment Partner is under common Control with Corpfolio.ai, partially owned or operated through a joint venture, wholly sold or transferred, independent, replaced, or otherwise affiliated or unaffiliated.

19.7. No Third-Party Beneficiaries. Except as expressly stated in Sections 1.5, 15.2, this Section 19.7, and Exhibit D, no provision of the Agreement creates any third-party beneficiary rights. The Fulfillment Partner, Local Agents, Payment Processors, AI Providers, and other Third-Party Services are intended third-party beneficiaries of the flow-down restrictions, disclaimers, liability exclusions, and indemnities that expressly protect them or are necessary to enforce their upstream terms, solely to that extent.

19.8. Interpretation. Headings are for convenience only. “Including” means “including without limitation.” The parties agree that no rule of construction applies against the drafter.

19.9. Electronic Contracting. You consent to transact electronically, and agree that your electronic acceptance, e-signatures, and Platform confirmations have the same force as ink signatures.

19.10. Language. This EULA is drafted in English. Any translation is provided for convenience only, and the English-language version controls in the event of a conflict.

1. Introduction and Incorporation

This Data Processing Addendum (this “DPA”) is Exhibit A to the Corpfolio.ai Platform End User License Agreement (the “EULA”) between Corpfolio.ai LLC (“Corpfolio.ai”) and Customer (as defined in the EULA), and forms part of the Agreement (as defined in the EULA). This DPA is effective as of the date Customer accepts or executes the EULA, or, if later, the date Customer first accesses or uses the Platform (the “Effective Date”).

1.1. Capitalized terms used but not defined in this DPA have the meanings given to them in EULA Section 1.1, including: Customer, Customer Data, Authorized User, End-Client, Entity, Fulfillment Partner, Local Agent, KYC Materials, AI Provider, AI Capabilities, Corpfolio Agent, Platform, Services, De-Identified Data, and Usage Data.

1.2. This DPA governs the Processing of Personal Data by Corpfolio.ai on behalf of Customer in connection with the Platform and the Services. This DPA does not apply to De-Identified Data or Usage Data, which are governed exclusively by Sections 8.5 and 8.7 of the EULA.

1.3. Order of Precedence. In accordance with EULA Section 1.3, in the event of any conflict or inconsistency between this DPA and the EULA body, this DPA shall govern solely as to data protection subject matter. The order of precedence set forth in EULA Section 1.3 (Order Form > Category Addendum > DPA (as to data protection subject matter) > EULA body > other incorporated documents) applies. To the extent the Standard Contractual Clauses or the UK Addendum applies to a Restricted Transfer, the provisions of the SCCs or UK Addendum shall prevail over this DPA in the event of a conflict solely with respect to such transfer.

2. Definitions

In addition to the terms defined in the EULA and elsewhere in this DPA, the following terms have the meanings set forth below:

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including a “Business” as defined under the CCPA/CPRA.

“Data Protection Laws” means, to the extent applicable to the Processing of Personal Data under this DPA: (a) Regulation (EU) 2016/679 (the “GDPR”); (b) the United Kingdom General Data Protection Regulation as retained in UK law by virtue of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, together with the Data Protection Act 2018 (collectively, the “UK GDPR”); (c) the Swiss Federal Act on Data Protection of 25 September 2020 (the “FADP”); (d) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) (the “CCPA/CPRA”); (e) the Virginia Consumer Data Protection Act (Va. Code Ann. § 59.1-575 et seq.) (“VA CDPA”); (f) the Colorado Privacy Act (Colo. Rev. Stat. § 6-1-1301 et seq.) (“CO CPA”); (g) the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.) (“CT CDPA”); (h) the Utah Consumer Privacy Act (Utah Code Ann. § 13-61-101 et seq.) (“UT CPA”); (i) each other comprehensive consumer data privacy or data protection law of general application enacted by any US state or territory, whether currently in effect or hereafter enacted, amended, or made effective (collectively with (d) through (h), the “US State Privacy Laws”), it being the parties’ intent that this defined term automatically incorporate each such law without requiring amendment of this DPA as additional US State Privacy Laws take effect; and (j) all other applicable data protection, data privacy, or data security laws and regulations in the jurisdictions served by the Platform (including the UAE, BVI, Bahamas, Cayman Islands, Hong Kong, Singapore, Panama, Canada, Isle of Man, Marshall Islands, St. Kitts and Nevis, St. Vincent and the Grenadines, Cyprus, Ireland, and Malta), in each case as amended, re-enacted, or superseded from time to time.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates, including a “Consumer” as defined under the CCPA/CPRA.

“Personal Data” means any information relating to a Data Subject that is Processed by Corpfolio.ai on behalf of, or at the direction of, Customer in connection with the Platform and the Services, including “Personal Information” as defined under the CCPA/CPRA and analogous terms under other Data Protection Laws. For the avoidance of doubt, Personal Data does not include De-Identified Data or Usage Data (each as defined in the EULA).

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.

“Processing” (and “Process”, “Processed”, and “Processes”) means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

“Processor” means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller, including a “Service Provider” or “Contractor” as defined under the CCPA/CPRA.

“Restricted Transfer” means a transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country or territory outside that area that does not benefit from an adequacy decision or adequacy regulations (as applicable) under the relevant Data Protection Laws.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, superseded, or replaced from time to time.

“Sub-processor” means any third party engaged by Corpfolio.ai (or by any existing Sub-processor of Corpfolio.ai) to Process Personal Data on behalf of Customer in connection with the Platform and/or the Services.

“Technical and Organizational Measures” or “TOMs” means the technical and organizational security measures implemented and maintained by Corpfolio.ai as described in Section 10 of this DPA and in EULA Section 8.9.

“UK Addendum” or “UK IDTA” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018, Version B1.0, in force 21 March 2022, as may be amended, superseded, or replaced from time to time.

3. Roles of the Parties

3.1. The parties acknowledge and agree that, in respect of the Processing of Personal Data under the Agreement:

(a) Customer acts as a Controller (or, where Customer is an Intermediary or White-Label Operator Processing Personal Data on behalf of its End-Clients, as a Processor acting on instructions from its own controller) of Personal Data, and Corpfolio.ai acts as a Processor Processing Personal Data on Customer’s documented instructions in accordance with Section 5 of this DPA;

(b) Corpfolio.ai acts as an independent Controller with respect to Personal Data that it Processes for its own purposes, including: (i) AML/KYC compliance and identity verification; (ii) fraud prevention and detection; (iii) security of the Platform and Services; (iv) platform analytics and product improvement (to the extent such data constitutes Personal Data rather than De-Identified Data or Usage Data); and (v) compliance with applicable Law, professional obligations, and regulatory requirements. When acting as an independent Controller, Corpfolio.ai shall Process such Personal Data in accordance with its Privacy Policy and applicable Data Protection Laws, and the Processor obligations in Section 5 shall not apply to such Processing;

(c) SumSub acts as an independent Controller for KYC/AML identity verification, fraud prevention, and compliance purposes as set forth in EULA Section 8.4 and SumSub’s own terms and privacy policy; and

(d) the Fulfillment Partner and Local Agents may act as independent Controllers under local Law upon receipt of Entity, officer, shareholder, and UBO data for registry filings, as set forth in EULA Section 8.4.

3.2. Re-evaluation of Roles. The parties acknowledge that the characterization of the parties’ roles under Data Protection Laws is subject to change due to evolving legal, regulatory, or judicial developments. If Corpfolio.ai reasonably determines that its role with respect to any category of Personal Data has changed (including as a result of regulatory guidance, enforcement action, court decision, or change in law), Corpfolio.ai shall notify Customer in writing. Upon delivery of such notice, the parties shall negotiate in good faith any amendments to this DPA necessary to reflect the revised roles. Corpfolio.ai’s obligations under this DPA shall continue in full force and effect with respect to the affected category of Personal Data unless and until such amendments take effect or the affected Services are terminated.

3.3. Customer represents and warrants that: (a) it has all necessary authority, rights, consents, and legal bases required under applicable Data Protection Laws to disclose or make available Personal Data to Corpfolio.ai and to authorize the Processing described in this DPA; (b) it has provided all required notices to, and obtained all required consents from, Data Subjects (including express written consents where required under biometric-information privacy laws in respect of selfie/liveness or biometric verification data); and (c) its instructions to Corpfolio.ai, and Corpfolio.ai’s Processing in accordance with such instructions, will not violate applicable Data Protection Laws.

4. Subject Matter, Nature, Duration, and Purpose of Processing; Categories of Data Subjects and Personal Data

4.1. Subject Matter. The subject matter of the Processing is the provision of the Platform and Services, being a SaaS-based corporate/LLC entity formation and management workflow platform operating across the jurisdictions served by the Platform.

4.2. Nature of Processing. The nature of Processing includes: collection of Personal Data via the Platform website and dashboard; KYC/AML verification (via SumSub); storage on cloud infrastructure; AI-assisted document drafting and analysis (via AI Providers); transmission to the Fulfillment Partner and Local Agents for entity formation filings; document generation and e-signature coordination; email communications; analytics; and secure file sharing.

4.3. Duration. The duration of Processing is the Term of the EULA (including any renewal periods) plus the post-termination retention periods described in EULA Sections 7.5 and 8.8, including retention of KYC Materials for up to seven years as required by applicable AML/KYC record-keeping laws depending on the jurisdiction of the relevant Entity.

4.4. Purpose of Processing. Personal Data is Processed for the following purposes: (a) providing, operating, maintaining, and improving the Platform and Services; (b) processing and fulfilling orders for entity formation, Corporate Actions, and registered-agent services; (c) KYC/AML compliance, sanctions screening, beneficial-ownership verification, and identity verification; (d) fraud prevention and detection; (e) security monitoring, audit-trail logging, and incident response; (f) AI-assisted document generation, analysis, and chat functionality; (g) email communications relating to the Services; (h) compliance with applicable Law, regulatory requirements, and professional obligations; and (i) any other purpose described in the EULA or documented in Customer’s instructions.

4.5. Categories of Data Subjects. Personal Data Processed under this DPA relates to the following categories of Data Subjects: (a) Authorized Users; (b) directors, officers, and managers of Entities; (c) shareholders, members, and equity holders of Entities; (d) ultimate beneficial owners (UBOs); (e) other individuals named in KYC Materials; (f) Entity signatories and authorized representatives; (g) End-Clients (where Customer is an Intermediary or White-Label Operator); and (h) any other natural persons whose Personal Data is submitted to the Platform by or on behalf of Customer.

4.6. Categories of Personal Data. The categories of Personal Data Processed may include:

(a) Full legal names, aliases, and former names;

(b) Residential and business addresses and proof-of-address documents;

(c) Dates of birth;

(d) Tax identification numbers, including Employer Identification Numbers (EINs);

(e) Passport numbers, government-issued identification card numbers, driver’s license numbers, and copies thereof;

(f) Beneficial-ownership declarations, source-of-funds information, and net-worth statements;

(g) Sanctions screening and watchlist data;

(h) Selfie/liveness or biometric verification data (processed via SumSub as independent controller);

(i) Signatures (wet-ink and electronic);

(j) Professional and employment information (title, employer, professional qualifications);

(k) Account credentials and authentication data;

(l) Usage data, audit-trail metadata, and IP addresses; and

(m) Any other personal data submitted to the Platform by or on behalf of Customer.

4.7. Sensitive/Special Category Data. Selfie/liveness and biometric verification data constitutes sensitive data and/or special category data under certain Data Protection Laws (including GDPR Article 9, Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington biometric privacy law). Such data is Processed solely by SumSub as an independent Controller in accordance with EULA Section 8.4. Customer is responsible for ensuring that all required consents (including jurisdiction-specific biometric consents) have been obtained from Data Subjects prior to submission of biometric verification data to the Platform.

5. Processor Obligations

5.1. Processing Instructions. Corpfolio.ai shall Process Personal Data only on Customer’s documented instructions, unless Processing is required or permitted by applicable Law to which Corpfolio.ai is subject (in which case Corpfolio.ai shall, to the extent permitted by applicable Law, inform Customer of that legal requirement upon request). The parties agree that the EULA (including this DPA), any applicable Order Form, and Customer’s use of the Platform and Services configuration constitute Customer’s complete and final documented instructions to Corpfolio.ai for the Processing of Personal Data. Any additional or alternative instructions must be agreed in writing and may, in Corpfolio.ai’s sole discretion, require a separate written agreement and/or additional fees. Notwithstanding the foregoing, the parties acknowledge and agree that Corpfolio.ai may Process Personal Data without specific instruction from Customer to the extent necessary for: (a) AML/KYC compliance and identity verification; (b) fraud prevention and detection; (c) security of the Platform and Services; (d) compliance with applicable Law, legal process, or regulatory requirements; and (e) the exercise of Corpfolio.ai’s rights as an independent Controller as described in Section 3.1(b).

5.2. Confidentiality. Corpfolio.ai shall ensure that any person authorized to Process Personal Data on its behalf is subject to a duty of confidentiality (whether contractual or statutory) with respect to such Personal Data.

5.3. Technical and Organizational Measures. Corpfolio.ai shall implement and maintain appropriate Technical and Organizational Measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of Processing, and the risk of varying likelihood and severity for the rights and freedoms of Data Subjects. Such measures include, as further described in Section 10 of this DPA: encryption of Personal Data in transit and at rest; role-based access controls; two-factor authentication (2FA); and audit-trail logging. Customer acknowledges that Corpfolio.ai does not currently hold SOC 2 Type II or ISO 27001 certification, and that no representation, warranty, or commitment to obtain or maintain any such certification is made in this DPA or the Agreement, unless Corpfolio.ai expressly provides such certification in a separate writing.

5.4. Assistance with Compliance Obligations. Taking into account the nature of the Processing and the information available to Corpfolio.ai, Corpfolio.ai shall provide reasonable assistance to Customer, at Customer’s written request and expense, in ensuring compliance with Customer’s obligations under Data Protection Laws in respect of: (a) data protection impact assessments and prior consultations with supervisory authorities (GDPR Articles 35-36); and (b) Customer’s security and breach-notification obligations (to the extent not already addressed in Sections 10 and 11 of this DPA).

5.5. Data Subject Rights. Corpfolio.ai shall, taking into account the nature of the Processing, provide reasonable assistance to Customer by appropriate technical and organizational measures, insofar as this is possible and at Customer’s expense (for anything beyond reasonable effort), for the fulfillment of Customer’s obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws. If Corpfolio.ai receives a request directly from a Data Subject, Corpfolio.ai shall promptly redirect the Data Subject to Customer and notify Customer of such request, unless Corpfolio.ai is legally required to respond directly. Corpfolio.ai shall not be required to respond directly to Data Subjects on Customer’s behalf unless expressly agreed in writing.

6. Sub-processors

6.1. General Authorization. Customer hereby provides a general written authorization for Corpfolio.ai to engage Sub-processors to Process Personal Data on Customer’s behalf in connection with the Platform and Services. The Sub-processors engaged as of the Effective Date are set forth in Schedule 1 to this DPA.

6.2. Obligations on Sub-processors. Corpfolio.ai shall: (a) enter into a written agreement with each Sub-processor containing data protection obligations that are materially no less restrictive than those set out in this DPA with respect to the protection of Personal Data, to the extent applicable to the nature of the services provided by such Sub-processor; and (b) remain liable to Customer for the performance of each Sub-processor’s obligations to the same extent as Corpfolio.ai would be liable for its own performance of such obligations under this DPA (but subject in all cases to the limitations of liability in EULA Section 14 as incorporated herein).

6.3. Notification of New Sub-processors. Corpfolio.ai shall notify Customer of any intended addition or replacement of Sub-processors by updating the Sub-processor list on the Platform or at a URL designated by Corpfolio.ai, and by providing notice via the notice mechanisms in the EULA (including via the Platform), at least 14 days prior to such Sub-processor commencing Processing of Personal Data (the “Notice Period”). Customer may subscribe to Sub-processor change notifications through the Platform.

6.4. Objection Right. If Customer has a reasonable, documented objection to a new Sub-processor based on data protection grounds, Customer shall notify Corpfolio.ai in writing within the Notice Period, specifying the reasonable data protection grounds for the objection. The parties shall discuss such concerns in good faith with a view to achieving a commercially reasonable resolution. If the parties are unable to resolve Customer’s objection within thirty (30) days after Corpfolio.ai’s receipt of the objection notice, Customer’s sole and exclusive remedy shall be to terminate the affected Services (or, at Customer’s election, the entire Agreement) by providing written notice to Corpfolio.ai, and such termination shall not be deemed a breach by either party. If Customer does not object within the Notice Period, Customer shall be deemed to have accepted the new Sub-processor.

6.5. AI Provider Sub-processors. Customer acknowledges that AI Providers (currently OpenAI and Anthropic) Process Customer Data submitted to the AI Capabilities under their then-current commercial/API terms, data-processing terms, usage policies, and retention controls, as described in EULA Section 9.4. Corpfolio.ai’s engagement of AI Providers as Sub-processors is subject to the AI training restriction in EULA Section 8.6. Customer further acknowledges that: (a) AI Providers may process and retain inputs, outputs, logs, metadata, and safety classifications for service provision, abuse monitoring, security, legal compliance, and debugging under their own commercial/API terms; (b) Corpfolio.ai will not intentionally route identifiable Customer Data to an AI Provider under a configuration that permits that AI Provider to train its generally available models on that Customer Data absent Customer’s express consent; and (c) zero-retention or modified-retention configurations may not be available for all features or customers.

7. International Data Transfers

7.1. General. Customer acknowledges that, given the multi-jurisdictional nature of the Platform and Services (which facilitate entity formation across UAE, US, BVI, Bahamas, Canada, Cayman Islands, Cyprus, Hong Kong, Ireland, Isle of Man, Malta, Marshall Islands, Panama, Singapore, St. Kitts and Nevis, St. Vincent and the Grenadines, Switzerland, and UK), Personal Data will necessarily be transferred to, and Processed in, multiple countries, including countries outside the European Economic Area, the United Kingdom, and Switzerland that have not received an adequacy decision. Where such transfers constitute Restricted Transfers, the mechanisms in this Section 7 shall apply.

7.2. EU Standard Contractual Clauses. To the extent that a Restricted Transfer of Personal Data from the EEA is subject to the GDPR, the parties hereby enter into the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which are incorporated by reference into this DPA as follows:

(a) Module 2 (Controller to Processor) shall apply where Customer (as data exporter and Controller) transfers Personal Data to Corpfolio.ai (as data importer and Processor) in a third country;

(b) Module 3 (Processor to Processor) shall apply where Customer (as data exporter, acting as Processor on behalf of one or more of its own End-Clients or other third-party Controllers) transfers Personal Data to Corpfolio.ai (as data importer and sub-processor) in a third country. For Module 3 transfers, the selections set forth in Section 7.2(c) shall apply mutatis mutandis, and Customer represents and warrants that it has been duly authorized by each relevant Controller to enter into the SCCs on such Controller’s behalf, or has otherwise established a lawful onward-transfer chain;

(c) For each Module, where applicable: (i) Clause 7 (Docking Clause): the optional docking clause SHALL apply; (ii) Clause 9(a) (Sub-processors): OPTION 2 (General Written Authorization) shall apply, with a notice period of 14 days; (iii) Clause 11 (Redress): the optional language SHALL NOT apply; (iv) Clause 13(a) (Supervision): the supervisory authority of the EU Member State in which the data exporter is established, or, where the data exporter is not established in the EU, the supervisory authority of the EU Member State in which the data exporter’s EU representative is established, or, if no representative, the supervisory authority of the EU Member State in which the Data Subjects most affected by the transfer are located; (v) Clause 17 (Governing Law): OPTION 1 shall apply; the SCCs shall be governed by the law of Ireland; (vi) Clause 18(b) (Forum): disputes shall be resolved before the courts of Ireland.

(d) Annex I (List of Parties), Annex II (Technical and Organizational Measures), and Annex III (List of Sub-processors) of the SCCs shall be deemed completed with the information set forth in Schedule 1 and Section 10 of this DPA, respectively, and the Sub-processor list in Schedule 1.

7.3. UK International Data Transfer Addendum. To the extent that a Restricted Transfer is subject to the UK GDPR, the parties hereby enter into the UK Addendum (International Data Transfer Addendum to the EU Commission Standard Contractual Clauses), which is incorporated by reference into this DPA. The UK Addendum Tables are completed as follows: (a) Table 1 (Parties): The Start Date is the Effective Date of this DPA. The parties and their details are as set forth in Section 17 and Schedule 1 (Annex I, List of Parties); (b) Table 2 (Selected SCCs): The Approved EU SCCs referenced are the Module 2 SCCs incorporated in Section 7.2 above, including the selections made in Section 7.2(c); (c) Table 3 (Appendix Information): As set forth in Schedule 1 (Annex I.B, Description of Transfer), Section 10 (Technical and Organizational Measures), and the Sub-processor list in Schedule 1; (d) Table 4 (Ending the UK Addendum): The Importer may end the UK Addendum as set out in Section 19 of the UK Addendum; the Exporter may not.

7.4. Swiss FADP. To the extent that a transfer of Personal Data is subject to the Swiss FADP and constitutes a Restricted Transfer: (a) the SCCs incorporated in Section 7.2 shall also apply to such transfer, with the following modifications: references to the GDPR are to be understood as references to the FADP; references to the EU or EU Member States are to be understood as references to Switzerland; the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner (FDPIC); and the term “Member State” shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland); and (b) the governing law under Clause 17 and forum under Clause 18 shall be Swiss law and Swiss courts, respectively, for such Swiss-FADP-governed transfers.

7.5. Transfer Impact Assessment Cooperation. Upon Customer’s reasonable written request and at Customer’s expense, Corpfolio.ai shall provide reasonable cooperation and assistance to Customer in connection with any transfer impact assessment that Customer is required to conduct under applicable Data Protection Laws, including by providing available information regarding Corpfolio.ai’s processing operations, technical and organizational measures, and the legal framework in the country of import. Corpfolio.ai shall not be required to disclose its proprietary security configurations, trade secrets, or commercially sensitive information.

8. CCPA/CPRA and US State Comprehensive Privacy Laws

8.1. CCPA/CPRA Service Provider Terms. To the extent that Corpfolio.ai Processes Personal Data that constitutes “Personal Information” (as defined under Cal. Civ. Code § 1798.140(v)) on behalf of Customer, Corpfolio.ai is a “Service Provider” (and, where applicable, a “Contractor”) under the CCPA/CPRA, and:

(a) Corpfolio.ai shall not sell or share (as those terms are defined in the CCPA/CPRA) Personal Information received from or on behalf of Customer;

(b) Corpfolio.ai shall not retain, use, or disclose Personal Information received from or on behalf of Customer for any purpose other than: (i) the specific business purposes set forth in this DPA and the EULA (including providing the Platform and Services, KYC/AML compliance, fraud prevention, security, and compliance with applicable Law); or (ii) as otherwise permitted for Service Providers and Contractors under the CCPA/CPRA, including for the business purposes enumerated in Cal. Civ. Code § 1798.140(e), the purposes set forth in Cal. Code Regs. tit. 11, § 7050(a), and as otherwise exempted under Cal. Civ. Code § 1798.145;

(c) Corpfolio.ai shall not retain, use, or disclose Personal Information outside of the direct business relationship between Corpfolio.ai and Customer, except as permitted by the CCPA/CPRA;

(d) Corpfolio.ai shall not combine Personal Information received from or on behalf of Customer with personal information that it receives from or on behalf of another person or persons, or that it collects from its own interaction with Data Subjects, except to the extent permitted under the CCPA/CPRA (including for purposes of detecting data security incidents, protecting against fraud or illegal activity, or improving the Platform to the extent such improvement does not involve cross-context profiling of individual Data Subjects);

(e) Corpfolio.ai shall comply with all applicable obligations of a Service Provider and/or Contractor under the CCPA/CPRA;

(f) Corpfolio.ai shall notify Customer if it makes a determination that it can no longer meet its obligations under the CCPA/CPRA; and

(g) Customer has the right to take reasonable and appropriate steps to help ensure that Corpfolio.ai uses Personal Information in a manner consistent with Customer’s obligations under the CCPA/CPRA. For the avoidance of doubt, such steps are limited to the audit and compliance-verification rights set forth in Section 12 of this DPA and do not create any independent or broader audit right. Notwithstanding the foregoing, upon written notice from Customer that Customer reasonably believes Corpfolio.ai is Processing Personal Information in a manner inconsistent with this Section 8.1, Corpfolio.ai shall take reasonable and appropriate steps to stop and remediate such unauthorized use.

Corpfolio.ai hereby certifies that it understands and will comply with the restrictions and obligations set forth in this Section 8.1 and will treat the Personal Information it receives from or on behalf of Customer with the same degree of privacy protection as required by the CCPA/CPRA.

Corpfolio.ai shall ensure that any Sub-processor that Processes Personal Information on behalf of Customer under this DPA is bound by contractual terms that are consistent with the requirements of the CCPA/CPRA applicable to Service Providers and/or Contractors.

8.2. US State Comprehensive Privacy Laws. The following terms apply to Corpfolio.ai’s Processing of Personal Data as a Processor (or Service Provider/Contractor, as applicable) on behalf of Customer under the US State Privacy Laws, as applicable:

(a) Corpfolio.ai shall maintain the confidentiality of Personal Data and shall not disclose Personal Data to any third party except as required or permitted under this DPA, the EULA, or applicable Law;

(b) Upon termination of the Agreement, Corpfolio.ai shall, at Customer’s election and subject to Sections 13 and 8.8 of the EULA, delete or return to Customer all Personal Data in its possession, unless retention is required by applicable Law or permitted under the retention provisions of the EULA;

(c) Upon Customer’s reasonable written request (no more than once per twelve (12) months and at Customer’s expense), Corpfolio.ai shall make available to Customer information reasonably necessary to demonstrate Corpfolio.ai’s compliance with its obligations under applicable US state comprehensive privacy laws, which may be satisfied by providing: (i) a written response to a reasonable data-protection questionnaire; (ii) a summary of Corpfolio.ai’s then-current information security program; and/or (iii) a third-party audit report, certification, or attestation that Corpfolio.ai holds, subject in all cases to Corpfolio.ai’s reasonable confidentiality requirements. Corpfolio.ai may elect to use a qualified, independent assessor to conduct an assessment of Corpfolio.ai’s policies and technical and organizational measures in support of the obligations under applicable US state comprehensive privacy laws, using an appropriate and accepted control standard or framework and assessment procedure, and to provide a report of such assessment to Customer upon request, in lieu of Customer-directed audits;

(d) Corpfolio.ai shall cooperate with Customer, at Customer’s expense, with respect to Customer-conducted or independent assessments of Corpfolio.ai’s policies and technical and organizational measures to the extent required by applicable US state comprehensive privacy laws, subject to the audit limitations in Section 12 of this DPA;

(e) Corpfolio.ai shall engage Sub-processors only in accordance with Section 6 of this DPA, with flow-down data protection obligations that are materially no less restrictive than those in this DPA;

(f) The nature, purpose, duration, and categories of Personal Data and Data Subjects are as described in Section 4 of this DPA; and

(g) Corpfolio.ai’s obligations with respect to Data Subject rights requests are as described in Section 5.5 and Section 11 of this DPA.

9. Non-EU/Non-US Jurisdictional Data Protection Frameworks

To the extent that Corpfolio.ai Processes Personal Data subject to the data protection laws of any jurisdiction listed in Schedule 2 to this DPA, Corpfolio.ai shall comply with the applicable requirements of such laws to the extent they apply to the Processing activities under this DPA, subject to the terms and limitations set forth in this DPA. The jurisdiction-specific provisions set forth in Schedule 2 supplement (and do not derogate from) the general obligations in this DPA.

10. Security Measures and Breach Notification

10.1. Technical and Organizational Measures. Corpfolio.ai shall implement and maintain the following Technical and Organizational Measures, consistent with EULA Section 8.9 and the state of the art:

(a) Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);

(b) Role-based access controls limiting access to Personal Data to personnel with a legitimate need-to-know;

(c) Two-factor authentication (2FA) for personnel accessing systems containing Personal Data;

(d) Audit-trail logging of access to and modifications of Personal Data;

(e) Regular backup and disaster recovery procedures;

(f) Network security measures, including firewalls, intrusion detection/prevention, and DDoS mitigation (via Cloudflare);

(g) Personnel security measures, including background checks (where legally permitted) and confidentiality obligations for authorized personnel;

(h) Incident response procedures and security incident management; and

(i) Periodic review and testing of security measures.

Customer acknowledges that Corpfolio.ai does not currently hold SOC 2 Type II or ISO 27001 certification, and nothing in this DPA shall be construed as a representation, warranty, or commitment to obtain or maintain any such certification. Corpfolio.ai may update its TOMs from time to time, provided that such updates do not materially decrease the overall level of protection of Personal Data.

10.2. Personal Data Breach Notification.

(a) Corpfolio.ai shall notify Customer of any confirmed Personal Data Breach affecting Personal Data without undue delay upon Corpfolio.ai confirming such Personal Data Breach.

(b) Such notification shall include, to the extent available to Corpfolio.ai at the time of notification and taking into account the nature of the Processing and information available: (i) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (ii) the likely consequences of the Personal Data Breach; (iii) the measures taken or proposed to be taken by Corpfolio.ai to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects; and (iv) the name and contact details of Corpfolio.ai’s data protection contact from whom more information can be obtained.

(c) Corpfolio.ai shall use commercially reasonable efforts to provide any further information about the Personal Data Breach as it becomes available. Customer acknowledges that Corpfolio.ai’s initial notification may be based on incomplete information and that Corpfolio.ai does not guarantee the completeness or accuracy of information provided at the time of initial notification.

(d) Customer shall be solely responsible for: (i) determining whether a notification to any Data Subject, supervisory authority, regulator, or other third party is required under applicable Data Protection Laws; (ii) making any such required notifications; and (iii) taking any remedial actions with respect to Customer’s own customers, End-Clients, and Data Subjects. Corpfolio.ai shall provide reasonable cooperation (at Customer’s expense) to Customer in connection with such obligations.

(e) Corpfolio.ai’s obligation to notify or report a Personal Data Breach under this Section 10.2 is not and will not be construed as an acknowledgment by Corpfolio.ai of any fault or liability with respect to the Personal Data Breach.

11. Data Subject Rights Assistance

11.1. Taking into account the nature of the Processing, Corpfolio.ai shall provide reasonable assistance to Customer in fulfilling Customer’s obligation to respond to requests from Data Subjects exercising their rights under applicable Data Protection Laws (including rights of access, rectification, erasure, restriction, portability, and objection). Such assistance may include providing Customer with self-service functionality through the Platform to access, export, correct, or delete Personal Data.

11.2. If Corpfolio.ai receives a request directly from a Data Subject relating to Personal Data Processed on Customer’s behalf, Corpfolio.ai shall: (a) promptly (and in any event within five (5) business days) redirect the Data Subject to Customer; and (b) notify Customer of the request. Corpfolio.ai shall not respond directly to a Data Subject request except to redirect the Data Subject to Customer, unless required to do so by applicable Law.

11.3. Customer shall reimburse Corpfolio.ai for all reasonable costs and expenses incurred by Corpfolio.ai in providing assistance beyond reasonable effort under this Section 11, at Corpfolio.ai’s then-current professional services rates.

12. Audit Rights

12.1. Information and Compliance Verification. Corpfolio.ai shall make available to Customer, upon reasonable written request and no more than once per 12 month period (unless a Personal Data Breach affecting Customer’s Personal Data has occurred or a supervisory authority or regulator has specifically required an audit), information reasonably necessary to demonstrate Corpfolio.ai’s compliance with its obligations under this DPA and applicable Data Protection Laws. Such information may be provided, at Corpfolio.ai’s election, in the form of: (a) a written response to a reasonable written data-protection or security questionnaire provided by Customer; (b) a summary or executive-level description of Corpfolio.ai’s then-current information security program and data protection practices; or (c) a copy of any third-party audit report, SOC report, penetration test summary, certification, or attestation that Corpfolio.ai holds (subject to Corpfolio.ai’s reasonable confidentiality and non-disclosure requirements).

12.2. On-Site Audits. If Customer reasonably demonstrates that the information provided under Section 12.1 is insufficient to verify Corpfolio.ai’s compliance, and provided that Customer has a specific, documented compliance concern (and not merely a general desire for inspection), Customer may request an remote audit of Corpfolio.ai’s data-processing facilities and practices, subject to the following conditions: (a) Customer shall provide Corpfolio.ai with at least 30 days’ prior written notice of the proposed audit, including a detailed scope and plan; (b) audits shall be conducted no more than once per 12 month period (unless required by a competent supervisory authority or following a confirmed Personal Data Breach affecting Customer’s Personal Data); (c) audits shall be conducted during Corpfolio.ai’s normal business hours and in a manner that minimizes disruption to Corpfolio.ai’s operations; (d) the auditor (whether Customer’s own personnel or a third-party auditor) must execute a reasonable non-disclosure agreement acceptable to Corpfolio.ai and must not be a competitor of Corpfolio.ai; (e) the scope of the audit shall be limited to Corpfolio.ai’s compliance with this DPA and shall not extend to: (i) the systems, data, or records of other customers; (ii) Corpfolio.ai’s proprietary source code, algorithms, trade secrets, or commercially sensitive business information; or (iii) information unrelated to the Processing of Customer’s Personal Data; (f) Customer shall bear all costs and expenses of the audit, including Corpfolio.ai’s reasonable internal costs and personnel time spent facilitating the audit (to the extent exceeding two hours of Corpfolio.ai personnel time, billed at Corpfolio.ai’s then-current professional services rate); and (g) the parties shall discuss the audit findings in good faith, and Corpfolio.ai shall use commercially reasonable efforts to address any verified material non-compliance within a reasonable timeframe.

12.3. For the purposes of this Section 12, Corpfolio.ai may satisfy audit requests from Customer by providing an independent qualified assessor’s report or attestation conducted in accordance with an appropriate and accepted industry control standard or framework (such as SOC 2, ISO 27001, or similar), at Corpfolio.ai’s election, in lieu of permitting Customer-directed on-site audits.

12.4. Nothing in this Section 12 shall require Corpfolio.ai to disclose information that would compromise the security of its systems, disclose any information to an Corpfolio.ai competitor, violate its obligations to other customers, breach applicable Law or professional obligations, or disclose proprietary or trade-secret information, except to the minimum extent required by a competent supervisory authority.

13. Retention and Deletion

13.1. During the Term of the EULA, Corpfolio.ai shall retain Personal Data in accordance with Customer’s documented instructions and the data-retention practices described in the EULA.

13.2. Upon termination or expiration of the EULA: (a) Customer Data (including Personal Data) will remain available for export by Customer in a standard format for thirty (30) days following termination, as set forth in EULA Section 7.5; and (b) following expiry of such export period, Corpfolio.ai shall delete or anonymize Personal Data in accordance with its data-retention policy, except to the extent that retention is required by applicable Law (including AML/KYC record-keeping obligations, which may require retention of KYC Materials for up to seven (7) years depending on the jurisdiction of the relevant Entity).

13.3. Any Personal Data retained after termination pursuant to a legal retention obligation shall continue to be subject to the confidentiality and security obligations of this DPA and the EULA for the duration of such retention, and shall be Processed solely for the purpose of compliance with the applicable legal retention obligation.

13.4. Customer acknowledges that Corpfolio.ai may retain De-Identified Data and Usage Data indefinitely in accordance with EULA Section 8.5, and that such data is not subject to the deletion obligations in this Section 13.

14. Limitation of Liability

14.1. The parties agree that the limitations and exclusions of liability set forth in EULA Section 14 (including the aggregate liability cap equal to fees paid by Customer in the preceding twelve (12) months, excluding Fulfillment Services pass-through amounts, and the exclusion of indirect, consequential, special, incidental, punitive, and exemplary damages) shall apply in their entirety to any and all claims arising under or in connection with this DPA, whether based in contract, tort (including negligence), strict liability, or any other legal or equitable theory.

THIS DPA DOES NOT EXPAND, INCREASE, OR OTHERWISE ALTER CORPFOLIO.AI’S LIABILITY BEYOND THE LIMITATIONS AND EXCLUSIONS SET FORTH IN EULA SECTION 14. IN NO EVENT SHALL CORPFOLIO.AI’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS DPA (WHETHER ALONE OR TOGETHER WITH ANY LIABILITY UNDER THE EULA) EXCEED THE AGGREGATE LIABILITY CAP IN EULA SECTION 14.1.

14.2. Nothing in this Section 14 shall be interpreted to limit or exclude liability that cannot be limited or excluded under applicable Law (including the SCCs or UK Addendum, to the extent applicable).

15. Term and Termination

15.1. This DPA shall take effect on the Effective Date and shall continue in force for the duration of the Term of the EULA (including any renewal periods).

15.2. This DPA shall automatically terminate upon termination or expiration of the EULA, except that the provisions of this DPA that relate to: (a) retention, deletion, and return of Personal Data (Section 13); (b) confidentiality; (c) limitation of liability (Section 14); and (d) any obligations that by their nature should survive termination, shall survive the termination or expiration of this DPA and the EULA to the extent necessary to give effect to such provisions.

15.3. Termination of this DPA (whether by termination of the EULA or otherwise) shall not affect the validity of the SCCs or the UK Addendum to the extent that they continue to apply to Personal Data retained by Corpfolio.ai after termination pursuant to a legal retention obligation.

16. General Provisions

16.1. Order of Precedence. This DPA controls over the EULA body solely as to data protection subject matter, in accordance with the order of precedence set forth in EULA Section 1.3. In the event of any conflict between this DPA (exclusive of the SCCs and UK Addendum) and the SCCs or UK Addendum, the SCCs or UK Addendum (as applicable) shall prevail with respect to the relevant Restricted Transfer.

16.2. Amendments. Corpfolio.ai may update Schedule 1 (Sub-processor List) in accordance with Section 6.3 (notification of new Sub-processors). Corpfolio.ai may update its Technical and Organizational Measures (provided that such updates do not materially decrease the overall level of protection) by notice to Customer via the Platform. All other amendments to this DPA require a written instrument signed by both parties.

16.3. Severability. If any provision of this DPA is held to be illegal, invalid, or unenforceable under applicable Law, that provision shall be deemed modified to the minimum extent necessary to make it legal, valid, and enforceable, or if such modification is not possible, deemed deleted, and the remaining provisions shall continue in full force and effect.

16.4. Governing Law. This DPA (exclusive of the SCCs and UK Addendum, which are governed by their own governing law provisions) shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflicts-of-law principles, consistent with EULA Section 18.1.

16.5. Notices. All notices under this DPA shall be given in accordance with EULA Section 19.2 (Notices). Notices to Corpfolio.ai’s data protection contact may be sent to: [email protected], or by mail to: Corpfolio.ai LLC, 1111B S Governors Ave # 7473, Dover, Delaware 19904, USA, Attn: Legal.

16.6. Counterparts; Electronic Execution. This DPA may be executed in counterparts, each of which shall be deemed an original and all of which together constitute one instrument. Electronic signatures and electronically transmitted copies shall have the same legal effect as originals. This DPA is an Exhibit incorporated by reference into the EULA upon Customer’s acceptance or execution of the EULA; a separate signature on this DPA is not required for it to take effect, but the parties may execute a standalone copy of this DPA if desired.

16.7. Entire Agreement. This DPA, together with the EULA, the Order Form (if applicable), and the Schedules hereto, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written, relating to such subject matter.

Schedule 1 — Sub-Processor List and Description of Processing

Part A: List of Parties (SCC Annex I.A)

Data Exporter: Name: Customer (as identified in the EULA and applicable Order Form). Address: as set forth in the Order Form or Customer’s registration on the Platform. Contact Person: Customer’s designated data protection contact. Activities Relevant to Transfer: use of the Platform for corporate/LLC entity formation and management. Role: Controller (or Processor on behalf of its own End-Clients).

Data Importer: Name: Corpfolio.ai LLC Address: 1111B S Governors Ave # 7473, Dover, Delaware 19904, USA. Contact Person: Legal Department ([email protected]). Activities Relevant to Transfer: provision of the Platform and Services (corporate/LLC entity formation and management workflow SaaS). Role: Processor.

Part B: Description of Transfer (SCC Annex I.B)

Categories of Data Subjects: As described in Section 4.5 of this DPA.

Categories of Personal Data: As described in Section 4.6 of this DPA.

Sensitive Data and Applied Safeguards: Selfie/liveness and biometric verification data (special category/sensitive data under GDPR Article 9 and applicable biometric privacy laws), processed solely by SumSub as independent controller under heightened access controls, encryption, purpose limitation, and data-minimization safeguards. No other special categories of data are anticipated absent specific Customer instructions.

Frequency of Transfer: Continuous (ongoing as Customer uses the Platform).

Nature of Processing: As described in Section 4.2 of this DPA.

Purpose of Transfer and Further Processing: As described in Section 4.4 of this DPA.

Retention Period: As described in Section 4.3 and Section 13 of this DPA (Term plus post-termination export period plus legally mandated retention, up to 7 years for KYC/AML records).

Part C: Competent Supervisory Authority (SCC Annex I.C)

The competent supervisory authority shall be determined in accordance with Clause 13 of the SCCs. Where the data exporter is established in an EU Member State, it shall be the supervisory authority of that Member State. Where the data exporter is not established in the EU but falls within the territorial scope of the GDPR pursuant to Article 3(2), it shall be the supervisory authority of the Member State designated pursuant to Article 27(4) GDPR or, failing that, the Irish Data Protection Commission.

Part D: Current Sub-processor List (SCC Annex III)

The following Sub-processors are authorized as of the Effective Date:

AI Provider Disclosure: Customer acknowledges that AI Providers (OpenAI and Anthropic) may, depending on configuration and their then-current commercial/API terms: (a) process and retain inputs, outputs, logs, metadata, and safety classifications for service provision, abuse monitoring, safety, legal compliance, and debugging; and (b) use such data for their own permitted purposes under their commercial/API terms. Corpfolio.ai’s commitment under EULA Section 8.6 is that Corpfolio.ai will not intentionally route identifiable Customer Data to an AI Provider under a configuration that permits that AI Provider to train its generally available models on that Customer Data absent Customer’s express consent. This restriction is Corpfolio.ai’s own commercial commitment and does not constitute a warranty or guarantee regarding each AI Provider’s independent processing activities under their own terms.

Updates to Schedule 1: Corpfolio.ai may update this Schedule 1 from time to time in accordance with Section 6.3 of this DPA by providing notice to Customer via the Platform or the notice mechanisms in the EULA. A separate signature or written amendment to this DPA is not required for such updates to take effect.

Schedule 2 — Non-EU/Non-US Jurisdictional Data Protection Frameworks

This Schedule 2 supplements the DPA with jurisdiction-specific provisions applicable to the Processing of Personal Data subject to the data protection laws of the following jurisdictions. To the extent a provision in this Schedule 2 conflicts with the body of the DPA, the more protective provision (from the perspective of the Data Subject) shall apply to the extent required by the applicable Data Protection Law.

1. United Arab Emirates.

1.1. To the extent that Corpfolio.ai Processes Personal Data subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”), the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended), or the ADGM Data Protection Regulations 2021 (as amended), Corpfolio.ai shall Process such Personal Data in accordance with the terms of this DPA and the applicable requirements of such laws, in each case to the extent applicable to Corpfolio.ai in its capacity as a Processor Processing Personal Data on behalf of Customer, and in each case as amended, supplemented (including by any implementing or executive regulations), or superseded from time to time.

1.2. As between the parties, Customer shall be solely responsible for: (a) determining whether the UAE PDPL, the DIFC Data Protection Law, or the ADGM Data Protection Regulations apply to Customer’s use of the Platform and Services; (b) establishing all lawful bases and obtaining all consents required thereunder for the Processing and cross-border transfer of Personal Data contemplated by this DPA and the Agreement, in accordance with Section 3.3 of this DPA; and (c) complying with any controller-side registration, notification, or appointment requirements imposed by the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection in respect of Customer’s own processing.

2. Canada.

2.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”) or substantially similar provincial legislation (including Quebec’s Act respecting the protection of personal information in the private sector), Corpfolio.ai shall Process such Personal Data in accordance with the applicable requirements, including: (a) processing only for purposes that a reasonable person would consider appropriate in the circumstances; (b) implementing appropriate safeguards; and (c) providing reasonable access and correction rights assistance to Customer.

2.2. Customer acknowledges that transfers of Personal Data to Corpfolio.ai in the United States are subject to the laws of that jurisdiction, and that Corpfolio.ai may be required to disclose Personal Data pursuant to lawful process in the United States.

2.3. To the extent that Personal Data is subject to Québec’s Act respecting the protection of personal information in the private sector, CQLR c P-39.1 (as amended by Law 25), Customer shall be solely responsible for conducting any assessment of privacy-related factors required prior to communicating Personal Data outside Québec, and the parties agree that this DPA constitutes the written agreement governing such communication for the purposes of that Act.

2.4. As between the parties, Customer shall be solely responsible for complying with the obligations of an organization under PIPEDA and applicable provincial legislation in respect of the Personal Data, including obtaining all required consents and providing all required notices, in accordance with Section 3.3 of this DPA. The parties agree that this DPA constitutes the contractual protections required of Customer under PIPEDA (including clause 4.1.3 of Schedule 1 thereto) to ensure a comparable level of protection for Personal Data transferred to Corpfolio.ai for processing.

3. Cayman Islands.

3.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Cayman Islands Data Protection Act (2021 Revision) (the “Cayman DPA”), Corpfolio.ai shall Process such Personal Data in accordance with the terms of this DPA and the applicable requirements of the Cayman DPA, in each case to the extent applicable to Corpfolio.ai in its capacity as a data processor Processing Personal Data on behalf of Customer.

3.2. Customer acknowledges that the Cayman DPA imposes its obligations, including the data protection principles set out in Schedule 1 thereto (and the restrictions on transfers of personal data to countries or territories that do not ensure an adequate level of protection under the eighth data protection principle), on the data controller. As between the parties, Customer shall be solely responsible for: (a) complying with the data protection principles applicable to it as data controller; and (b) establishing all lawful bases, obtaining all consents, and ensuring all safeguards required under the Cayman DPA for the Processing and cross-border transfer of Personal Data contemplated by this DPA and the Agreement, in accordance with Section 3.3 of this DPA. Customer’s instructions to Corpfolio.ai under Section 5.1 shall be deemed to include an instruction to transfer Personal Data outside the Cayman Islands as necessary to provide the Platform and Services.

4. Hong Kong.

4.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”), Corpfolio.ai shall: (a) Process such Personal Data in a manner consistent with the Data Protection Principles set out in Schedule 1 to the PDPO, to the extent applicable to the Processing activities of a data processor under this DPA; (b) take practicable steps to protect such Personal Data against unauthorized or accidental access, processing, erasure, loss, or use; (c) not retain such Personal Data longer than is necessary for the fulfillment of the purposes described in this DPA, subject to Section 13 of this DPA and any retention required by applicable Law; and (d) provide reasonable assistance to Customer, in accordance with Sections 5.5 and 11 of this DPA, in responding to data access requests and data correction requests made under Part 5 of the PDPO.

4.2. The parties acknowledge that, where Customer is a “data user” under the PDPO and engages Corpfolio.ai as a data processor, the PDPO (including DPP2(3) and DPP4(2) of Schedule 1 thereto) requires Customer to adopt contractual or other means to prevent personal data transferred to the data processor from being (i) kept longer than is necessary for processing, and (ii) subject to unauthorized or accidental access, processing, erasure, loss, or use. The parties agree that Corpfolio.ai’s obligations under this DPA (including Sections 5, 10, and 13) constitute such contractual means for the purposes of the PDPO. As between the parties, Customer shall be solely responsible for complying with the obligations of a data user under the PDPO in respect of the Personal Data, including obtaining any required consents and providing any required notifications to data subjects, in accordance with Section 3.3 of this DPA.

5. Singapore.

5.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Personal Data Protection Act 2012 (No. 26 of 2012) (the “Singapore PDPA”), the parties acknowledge that Corpfolio.ai acts as a “data intermediary” processing personal data on behalf of and for the purposes of Customer pursuant to a contract evidenced in writing, and Corpfolio.ai shall comply with the obligations applicable to it in that capacity, namely: (a) protecting such Personal Data by making reasonable security arrangements in accordance with Section 10 of this DPA; (b) ceasing to retain such Personal Data when retention is no longer necessary for legal or business purposes, in accordance with Section 13 of this DPA; and (c) notifying Customer without undue delay of any Personal Data Breach in accordance with Section 10.2 of this DPA.

5.2. As between the parties, Customer shall be solely responsible for complying with the obligations of an “organisation” under the Singapore PDPA in respect of the Personal Data, including the consent, purpose limitation, notification, access and correction, accuracy, accountability, and transfer limitation obligations, in accordance with Section 3.3 of this DPA. With respect to the transfer limitation obligation, the parties agree that this DPA constitutes legally enforceable obligations that provide the transferred Personal Data a standard of protection comparable to that under the Singapore PDPA, and Customer’s instructions to Corpfolio.ai under Section 5.1 of this DPA shall be deemed to include an instruction to transfer Personal Data outside Singapore as necessary to provide the Platform and Services.

6. Panama.

6.1. To the extent that Corpfolio.ai Processes Personal Data subject to Panama’s Law No. 81 of 2019 on Personal Data Protection and its implementing regulations (including Executive Decree No. 285 of 2021) (collectively, the “Panama DPL”), Corpfolio.ai shall Process such Personal Data in accordance with the terms of this DPA and the applicable requirements of the Panama DPL, in each case to the extent applicable to Corpfolio.ai in its capacity as a data processor Processing Personal Data on behalf of Customer.

6.2. As between the parties, Customer shall be solely responsible for establishing all lawful bases, obtaining all consents, and ensuring all conditions required under the Panama DPL for the Processing and cross-border transfer of Personal Data contemplated by this DPA and the Agreement, in accordance with Section 3.3 of this DPA, and for complying with any registration, notification, or other controller-side requirements administered by the National Authority for Transparency and Access to Information (ANTAI). Customer’s instructions to Corpfolio.ai under Section 5.1 shall be deemed to include an instruction to transfer Personal Data outside Panama as necessary to provide the Platform and Services.

7. Isle of Man.

7.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Isle of Man Data Protection Act 2018 (the “IOM DPA 2018”) and the GDPR as applied in the Isle of Man, Corpfolio.ai shall comply with the applicable requirements. The provisions of Sections 5-7 of this DPA (Processor obligations, Sub-processors, and International Data Transfers including SCCs) shall apply mutatis mutandis to Processing subject to IOM data protection law.

8. British Virgin Islands.

8.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Virgin Islands Data Protection Act, 2021 (the “BVI DPA”), Corpfolio.ai shall Process such Personal Data in accordance with the terms of this DPA and the applicable requirements of the BVI DPA, in each case to the extent applicable to Corpfolio.ai in its capacity as a data processor Processing Personal Data on behalf of Customer.

8.2. Customer acknowledges that the BVI DPA imposes its obligations principally on the data controller, including obligations to obtain the consent of data subjects to processing and disclosure and to ensure that any transfer of personal data outside the Virgin Islands is made with the data subject’s consent and/or subject to adequate safeguards. As between the parties, Customer shall be solely responsible for: (a) obtaining all consents and establishing all lawful bases required under the BVI DPA for the Processing, disclosure, and cross-border transfer of Personal Data contemplated by this DPA and the Agreement, in accordance with Section 3.3 of this DPA; and (b) providing any notices to data subjects required under the BVI DPA. Customer’s instructions to Corpfolio.ai under Section 5.1 shall be deemed to include an instruction to transfer Personal Data outside the Virgin Islands as necessary to provide the Platform and Services.

9. Bahamas.

9.1. To the extent that Corpfolio.ai Processes Personal Data subject to the Bahamas Data Protection (Privacy of Personal Information) Act, 2003 (the “Bahamas DPA”), Corpfolio.ai shall Process such Personal Data in accordance with the terms of this DPA and the applicable requirements of the Bahamas DPA, in each case to the extent applicable to Corpfolio.ai in its capacity as a data processor Processing Personal Data on behalf of Customer.

9.2. Customer acknowledges that the Bahamas DPA imposes its obligations principally on the data controller. As between the parties, Customer shall be solely responsible for complying with the data protection principles applicable to it as data controller and for establishing all lawful bases and obtaining all consents required under the Bahamas DPA for the Processing and cross-border transfer of Personal Data contemplated by this DPA and the Agreement, in accordance with Section 3.3 of this DPA.

10. People’s Republic of China (PIPL).

10.1. If Personal Data of Chinese-resident Data Subjects is anticipated to be Processed under this DPA, the parties acknowledge that the Personal Information Protection Law of the People’s Republic of China (effective November 1, 2021) may require a separate cross-border transfer mechanism, which may include: (a) a standard contract for cross-border transfer of personal information filed with the Cyberspace Administration of China; (b) a security assessment conducted by the CAC; or (c) personal information protection certification. The parties shall separately assess the applicability of the PIPL and implement the appropriate mechanism before any such Processing commences.

10.2. As between the parties, Customer shall be solely responsible for determining whether the PIPL applies to its use of the Platform and Services and, if so, for complying with the obligations of a “personal information handler” thereunder, including obtaining any required separate consents, conducting any required personal information protection impact assessment, and implementing the applicable cross-border transfer mechanism described in Section 10.1. Corpfolio.ai shall provide reasonable cooperation, at Customer’s expense, with Customer’s implementation of any such mechanism.