Terms and Conditions of Use of Quantum Automation Center (QAC)

1. Identification of Quantum and acceptance

These Terms and Conditions of Use govern access to and use of Quantum Automation Center, QAC, and its associated services. They constitute a binding agreement between the Client and the Quantum entity identified in the Order, commercial proposal, invoice, registration, or applicable contracting mechanism.

"Quantum" may mean Quantum Developers S.A.S., Quantum Developers Inc., or the affiliate expressly identified as the Contracting Entity. Each entity is responsible only for the obligations it has assumed; no affiliate, shareholder, officer, employee, or contractor will be jointly and severally liable solely by virtue of belonging to the Quantum group.

QAC is intended exclusively for businesses and individuals acting in the exercise of a business or professional activity. Whoever accepts these Terms represents that they have sufficient capacity and authorization to bind the Client.

Acceptance may occur through signature, electronic acceptance, issuance of an Order, payment, account creation, activation, access to, or use of the Service. If the Client does not accept these Terms, it must not access or use QAC.

2. Definitions

• Client: the legal entity or business unit identified in the Order and its Authorized Users.
• Client Component: code, content, or logic independently created by the Client, without incorporating Quantum Technology or Quantum's Confidential Information.
• Quantum Component: any flow, agent, automation, connector, library, template, model, technical configuration, or development created in whole or in part by Quantum.
• Client Data: information, files, records, instructions, inputs, outputs, and content provided by the Client or processed on its behalf.
• De-identified Data: information aggregated or transformed through reasonable measures so that it does not directly identify a person or the Client.
• Documentation: manuals, guides, specifications, and current policies published or provided by Quantum.
• Contracting Entity: the Quantum entity identified in the applicable Order.
• Order: a proposal, service order, form, plan, quote, or accepted commercial document that defines scope, term, price, capacity, and particular conditions.
• QAC or Platform: Quantum Automation Center, including its interfaces, APIs, control plane, governance modules, analytics, observability, execution, and associated components.
• Service: access to QAC and the implementation, operation, support, or capacity services expressly included in an Order.
• Third-Party Service: infrastructure, software, artificial intelligence model, API, system, or service not controlled by Quantum.
• Telemetry: technical and operational data generated by use of the Service, such as execution states, times, events, versions, errors, resources, machines, volumes, traces, and metrics.
• Quantum Technology: QAC and all software, source or object code, architecture, API, SDK, library, method, algorithm, ontology, schema, model, template, documentation, design, trade secret, improvement, and know-how of Quantum.
• Authorized User: a person enabled by the Client to use the Service within the contracted limits.

3. Purpose and scope of QAC

QAC is an enterprise platform for instrumenting, orchestrating, governing, observing, analyzing, and, where applicable, executing workflows, automations, artificial intelligence agents, and operational processes.

QAC may connect with the Client's or third parties' environments, runtimes, applications, machines, APIs, and systems. The Service may cover governance, telemetry, and analytics only, or may include execution and operation, as defined in the Order.

The functionalities, environments, integrations, volumes, Authorized Users, support levels, and included responsibilities will be exclusively those indicated in the Order. No demonstration, sales conversation, presentation, roadmap, or marketing material expands the contracted scope.

Quantum may improve, update, replace, or reorganize the Platform. During a committed contractual period, it will not materially reduce the core functionality acquired, except when necessary for security, law, third-party availability, abuse prevention, or causes beyond its control.

4. Contractual documents and order of precedence

The agreement may be composed of these Terms, the Order, the scope or SOW, the SLA, the Data Processing Agreement, the Security Exhibit, the Acceptable Use Policy, the Privacy Policy, and the applicable Documentation.

An Order will prevail over these Terms only when it expressly identifies the clause it intends to modify. The Data Processing Agreement will prevail only with respect to the processing of personal data. The SLA will prevail only with respect to availability, support, and credits. In all other respects, these Terms will prevail.

Terms included by the Client in purchase orders, vendor portals, emails, forms, or unilateral documents will have no effect, even if Quantum receives, processes, or invoices them, unless accepted in writing by an authorized Quantum representative.

No obligation to assign intellectual property, deliver source code, grant a perpetual license, exclusivity, business outcome, or unlimited liability will be deemed accepted through silence, conduct, payment, or general reference.

5. Eligibility, orders, and right of access

Quantum may accept or reject requests, registrations, Users, use cases, or Orders at its discretion prior to acceptance. Submitting a request or accessing a demonstration does not obligate Quantum to contract, provision, or maintain the Service.

Access depends on a current Order, timely payment, available capacity, compliance with these Terms, and technical, operational, and security approval where applicable.

Quantum may limit the number of users, environments, flows, executions, agents, connections, machines, storage, retention, concurrency, or consumption in accordance with the contracted plan.

Quantum reserves the right not to renew, to deny future contracting, or to require additional conditions when it identifies technical, legal, financial, reputational, security, or use-incompatible risk with the Service.

6. License to use

6.1 Grant

During the term of the Order and subject to payment, Quantum grants the Client a limited, revocable, non-exclusive, non-transferable, non-sublicensable license restricted to internal business use of the Service by its Authorized Users.

The license does not imply sale, assignment, delivery of source code, or transfer of any right over Quantum Technology. All rights not expressly granted are reserved to Quantum.

6.2 Restrictions

The Client may not, directly or indirectly:

• Copy, modify, translate, adapt, distribute, sublicense, sell, lease, publish, or exploit Quantum Technology outside the license granted.
• Reverse engineer, decompile, disassemble, or extract code, models, prompts, rules, schemas, or trade secrets.
• Circumvent access controls, metering, licensing, security, technical limits, or authorized telemetry mechanisms.
• Use QAC or its Confidential Information to build, train, or improve a competing or substantially equivalent product.
• Remove proprietary notices, attributions, audit controls, or Quantum identifiers.
• Publish comparative tests, security results, or benchmarks without Quantum's written authorization.
• Allow third-party access, provide managed services, or resell the Service without express authorization.

6.3 Third-party components

The Service may incorporate open-source software or third-party components subject to their own licenses. Such licenses do not expand the Client's rights over Quantum Technology.

7. Deployment and operating modalities

The Order may establish a modality managed by Quantum, operated by the Client, hybrid, private, or one that instruments external systems.

Installing components in the Client's infrastructure does not transfer ownership of them. Every Quantum Component deployed in private environments remains subject to the active license, these Terms, and Quantum's technical protection, support, and metering controls.

When the Client manages infrastructure, runtime, workers, networks, VPN, source systems, or connectors, it will be responsible for their availability, capacity, patching, configuration, backup, security, and operation. Quantum will be responsible only for the components under its effective control.

When Quantum wholly or partially operates the solution, its obligations will be limited to the scope, schedules, capacity, and SLA expressly contracted.

The location of a flow in the Client's infrastructure, its funding, or its integration with the Client's systems does not modify the intellectual property ownership defined in these Terms.

8. Accounts, credentials, and Client obligations

The Client will be responsible for all acts carried out through its accounts and credentials, unless unauthorized access results directly from a security breach attributable to Quantum.

The Client must:

• Maintain accurate account information and designate technical, operational, and business points of contact.
• Apply access controls, least privilege, strong authentication, and credential rotation.
• Provide the data, access, environments, and decisions required within the agreed timeframes.
• Ensure it has sufficient legal bases, authorizations, licenses, and rights over the connected data and systems.
• Validate business rules, thresholds, permissions, acceptance criteria, and authorized actions before production use.
• Retain copies of its data and systems when the Order does not include a backup or archival service.
• Immediately notify incidents, compromised credentials, misuse, or changes affecting operation.

The Client must not introduce sensitive personal data, third-party secrets, regulated information, or special categories of data unless expressly authorized in the Order and the corresponding controls are adopted.

9. Quantum's intellectual property

Quantum is and will continue to be the exclusive owner of Quantum Technology, of all Quantum Components, and of their improvements, updates, adaptations, derivatives, reusable technical configurations, and know-how.

Payment for implementation, development, support, capacity, or subscription compensates services and licenses. It does not convert the work into a work made for hire, does not create co-ownership, and does not transfer code, algorithms, architecture, libraries, templates, internal documentation, or trade secrets.

Quantum will retain ownership even when a development is funded by the Client, responds to its requirements, uses its processes, is carried out jointly, or is deployed on its infrastructure, unless a specific assignment is made in writing and signed by Quantum.

Quantum may develop for itself or for third parties similar solutions, patterns, connectors, or components, provided it does not disclose Client Data or the Client's Confidential Information.

Suggestions, ideas, and feedback voluntarily submitted regarding QAC may be used by Quantum worldwide, perpetually, irrevocably, and royalty-free, without any obligation to incorporate or compensate for them.

Quantum's trademarks, names, domains, and visual elements may not be used without written authorization.

10. Flows, agents, automations, and developments

10.1 Components created by Quantum

Every flow, agent, automation, connector, activity, business object, technical configuration, library, or development created in whole or in part by Quantum will be a Quantum Component and will belong exclusively to Quantum.

By default, the Client may use it only for its internal operation, for as long as the license and the corresponding Order remain active. It may not reuse it in other projects, companies, clients, or platforms, nor deliver it to third parties.

A perpetual license, delivery in object code, escrow, or an independent continuity right will exist only if an Order expressly establishes it. Unless otherwise stipulated, such exception will not include source code, internal documentation, updates, support, modification rights, sublicensing, or access to future components.

10.2 Components created by the Client

The Client will retain ownership of Client Components independently created by it. Use of QAC does not transfer to Quantum ownership of the Client's original code or logic.

The Client grants Quantum, during the term and for as long as necessary to fulfill subsequent obligations, a license to host, copy, execute, observe, test, and process such components in order to provide, secure, and support the Service.

The Client may execute a Client Component outside QAC only if it does not incorporate, reproduce, or depend on Quantum Technology. The Client may independently rewrite its logic, but may not extract or reuse Quantum's protected components.

10.3 Mixed development

There will be no implied co-ownership. Each party will retain its pre-existing materials; Quantum will own all code and material created by Quantum, and the Client will own the data, content, and business rules it has contributed in a separable form.

When a Client contribution is deliberately incorporated into the Platform's core, shared libraries, templates, or documentation, the Client grants Quantum a perpetual, worldwide, irrevocable, transferable, sublicensable, and royalty-free license to use, modify, and exploit it.

10.4 Processes and business rules

The Client retains its business knowledge, policies, data, criteria, and business rules. Quantum retains the technical form of implementing, orchestrating, modeling, observing, and converting them into software, unless the Order provides a different assignment.

11. Client Data

The Client retains the rights it holds over its Client Data. It grants Quantum and its subprocessors a limited license to receive, host, transmit, transform, query, reproduce, and delete such data to the extent necessary to provide, secure, invoice, maintain, and support the Service, comply with the law, and exercise contractual rights.

The Client is responsible for the accuracy, completeness, legality, quality, authorization, and relevance of Client Data and of the instructions given to Quantum.

QAC is designed to minimize unnecessary storage of personal data. However, the technical scope may require processing of inputs, results, documents, exceptions, or traces. The Order and the Data Processing Agreement will define the cases requiring additional controls.

Quantum will not sell Client Data, will not use it for targeted advertising, and will not use it to train its own or third-party general models without the Client's express authorization.

Quantum's human access to Client Data will be limited to reasonable needs for implementation, support, security, incident investigation, compliance, or authorized instructions, and will be subject to confidentiality obligations.

12. Telemetry and process intelligence

12.1 Capture

Quantum may capture Telemetry and process data necessary to operate and improve QAC, including execution states, duration, errors, retries, resources, machines, versions, sequences, volumes, exceptions, business objects, events, decisions, approvals, and outcome metrics.

When an Order requires it, capture may include input and output parameters, artifacts, or case information, subject to the limits and controls defined therein.

12.2 Authorized uses

Quantum may use Telemetry to provide support, verify consumption, detect abuse, improve reliability and security, develop functionalities, analyze performance, create benchmarks, and generate process intelligence.

12.3 Linked and de-identified information

Telemetry that reasonably allows the Client to be identified will remain protected as Confidential Information and may be retained for as long as reasonably necessary for operation, security, audit, billing, defense of rights, product improvement, and legal compliance.

Quantum may transform information into De-identified and aggregated Data. Quantum may retain and use it indefinitely for analytics, research, performance models, benchmarks, development, security, and legitimate business purposes. This data will not be subject to the Client's export or deletion requests.

Quantum will not attempt to re-identify De-identified Data. If information remains reasonably linkable to a person or to the Client, it will not be treated as fully anonymous and the corresponding protections will apply.

12.4 Ownership of derived results

Quantum will own the aggregated metrics, models, patterns, taxonomies, schemas, benchmarks, learnings, improvements, and derived results that do not reveal Client Data. The Client will have no right to identify other clients or to obtain Quantum's internal models, aggregated data sets, or calculation methods.

13. Artificial intelligence and third-party services

QAC may use artificial intelligence models, infrastructure, APIs, runtimes, and other Third-Party Services. Quantum may substitute providers or versions when it deems necessary for security, quality, availability, cost, or evolution of the Service.

Artificial intelligence outputs may be probabilistic, incomplete, or incorrect. The Client must establish human controls, thresholds, permissions, and escalation proportional to the impact of each use case.

Actions that affect money, rights, security, compliance, sensitive data, or critical systems must only be automated within the limits and approvals defined in the Order or in the authorized configuration.

The Client is responsible for holding the licenses and permissions required for its Third-Party Services. Quantum is not responsible for changes, failures, unavailability, limits, prices, loss of access, or decisions made by such providers.

Unless expressly warranted, Quantum does not guarantee that output generated by artificial intelligence is unique, protectable, non-infringing, or suitable for a specific decision.

14. Implementation, acceptance, and change control

The Order or scope document will define deliverables, dependencies, milestones, acceptance criteria, responsible parties, environments, and assumptions. Timelines depend on the timely supply of access, information, approvals, and resources from the Client.

Delays, restrictions, or changes attributable to the Client or to third parties will extend timelines and may generate additional charges.

Unless the Order specifies another period, the Client will have five business days from delivery to accept or reject a deliverable in writing, indicating objective non-conformities against the agreed criteria. If the Client does not respond, uses the deliverable in production, or obtains operational benefit from it, the deliverable will be deemed accepted.

Minor defects that do not prevent substantial use will not block acceptance and will be handled through support or a correction plan.

Every change in scope, integration, volume, use case, rule, dependency, environment, or requirement must be managed through change control. Quantum may adjust price, timeline, capacity, and risks before implementing it.

Rules, thresholds, tolerances, permissions, approvals, and autonomous actions must be validated by the Client before production use. QAC's logs and evidence do not replace the Client's official system of record unless expressly agreed.

15. Security and shared responsibility

Quantum will maintain commercially reasonable technical, human, and organizational measures, consistent with the nature of the Service and aligned with recognized security practices. Quantum may continuously improve such measures.

No measure eliminates all risk. Quantum does not guarantee absolute security and does not claim to hold certifications that have not been obtained and expressly identified as current and applicable to the Service.

Security operates under a shared responsibility model. Quantum is responsible for the components it controls; the Client is responsible for its users, devices, identities, networks, VPN, infrastructure, runtimes, workers, secrets, connected systems, permissions, and configurations.

The Client will not perform penetration testing, scanning, extraction, adversarial load, or vulnerability research without written authorization. It must report vulnerabilities confidentially and allow reasonable time for correction.

Quantum may immediately suspend connections, credentials, flows, or access when there is a risk of security, integrity, abuse, or spread of harm.

16. Support, availability, and service levels

Support levels, hours, channels, availability, first-response times, RTO, RPO, and applicable credits will be only those included in the Order or in an expressly incorporated SLA.

In the absence of a contracted SLA, Quantum will provide support using commercially reasonable efforts, without any contractual commitment to availability, response, or resolution.

Severities P1 through P4 are defined in Exhibit A. Quantum may reclassify an incident based on its verified impact. Response times are not resolution times.

Service credits will only apply when an Order or SLA establishes them, their conditions are met, and the Client requests them in a timely manner. They will be the sole remedy for availability failures and will never exceed the charges for the affected Service during the applicable period.

Failures resulting from the Client, Third-Party Services, the public Internet, scheduled maintenance, contracted limits, misuse, unsupported versions, force majeure, or components outside Quantum's control will not count as unavailability.

17. Pricing, sizing, billing, and taxes

Price will depend on the use case and may be sized based on complexity, flows, agents, executions, users, environments, integrations, machines, concurrency, criticality, data volume, retention, infrastructure, support, operation, and contracted capacity.

The Order will define the economic units, limits, initial, recurring, variable, overage, and professional services charges. Changes in consumption or scope may require a plan upgrade or an additional charge.

Unless expressly stated otherwise, charges are non-cancellable and non-refundable. The Client may not offset, withhold, or deduct payments for claims not recognized by Quantum.

Invoices will be due on the date indicated. Quantum will grant a fifteen-calendar-day grace period after the due date before suspending for non-payment, without this modifying the due date or implying a waiver of collection, permitted interest, or recovery costs.

Prices do not include taxes. The Client will bear applicable taxes, fees, withholdings, and charges, except taxes on Quantum's income. When the law requires a withholding, the Client will gross up the payment so that Quantum receives the full invoiced net amount, unless the Order expressly provides otherwise.

Quantum may verify consumption through its records. The Client must pay reasonably substantiated overages and differences.

Quantum may adjust prices upon renewal and when the scope, capacity, third-party costs, currency, or Service conditions change, with the notice indicated in the Order or in these Terms.

18. Confidentiality

Each party will protect the other's Confidential Information with a level of care no lower than that used to protect its own information of a similar nature and, at a minimum, with reasonable care.

Quantum's Confidential Information includes Quantum Technology, code, architecture, security, non-public pricing, internal documentation, designs, models, prompts, methods, roadmap, vulnerabilities, credentials, and trade secrets.

The receiving party will use the information solely to perform the agreement and will disclose it only to personnel, affiliates, and providers who need to know it and are subject to equivalent obligations.

Information will not be confidential if the receiving party demonstrates that it was public without breach, was legitimately known, was lawfully received from a third party, or was independently developed without using the disclosed information.

A disclosure required by law must be limited to what is necessary and, when permitted, must be notified to the disclosing party in advance.

The obligations will remain in effect for five years after the relationship ends; trade secrets, source code, and Quantum Technology will remain protected for as long as they retain that nature.

Use of the Client's name, trademark, logo, testimonial, or case study will require written authorization. The existence of the relationship may be disclosed only when it is public, legally required, or authorized.

19. Suspension and restriction of the Service

Quantum may immediately suspend or limit accounts, connections, flows, agents, environments, or the Service when there is:

• Non-payment after the grace period.
• Material breach of these Terms, the Order, or the Acceptable Use Policy.
• Risk of security, integrity, fraud, abuse, harm, overload, or unauthorized access.
• Illegal, infringing, deceptive use, or use contrary to third-party rights.
• An order from an authority, a provider restriction, or an urgent need for protection.
• False information, insolvency, material credit deterioration, or reasonable impossibility of continuing the Service.

Suspension does not extinguish payment obligations or generate liability for Quantum. Quantum may require remediation, payment, technical changes, or reasonable assurances before restoring access.

Quantum may reject new Orders, prevent new sign-ups, and decide not to renew without any obligation to state its reasons, unless the law requires otherwise.

20. Term, termination, and effects

These Terms remain in effect for as long as the Client accesses or uses the Service. Each Order will have the term and renewal indicated therein.

Quantum may terminate an Order for material breach not cured within ten calendar days of notice, or immediately when the breach is not curable, or affects intellectual property, security, legality, confidentiality, solvency, or the integrity of the Service.

Payment default may give rise to termination after the fifteen-calendar-day grace period.

Unless an Order provides otherwise, Quantum may terminate the Service for convenience with thirty calendar days' notice. In that case, the Client's sole remedy will be a proportional refund of prepaid recurring charges for the period not rendered. There will be no refund when termination results from breach, abuse, risk, or a cause attributable to the Client.

The Client may only terminate for convenience when the Order permits it. Early termination does not release committed charges or generate a refund.

Upon termination, licenses will cease and the Client will stop using Quantum Components. Outstanding balances will become due, and Quantum may revoke credentials, connections, and access.

Provisions relating to intellectual property, derived data, confidentiality, payments, indemnification, limitation of liability, dispute resolution, and those that by their nature must continue will survive.

21. Export, portability, retention, and deletion

21.1 Export window

During the thirty calendar days following termination, and provided the Client is current on payments, it may request a standard export of the Client Data available in technically supported formats.

The export may include execution history, available input parameters, results, states, and expressly supported evidence. Reasonable technical assistance will be coordinated by Quantum; special developments, transformations, or migrations may be charged.

21.2 Exclusions

The export will not include source code, internal logic, system prompts, libraries, Quantum's technical configurations, secrets, models, security rules, architecture, deployment artifacts, internal tools, De-identified Data, benchmarks, or derived intelligence.

Data export does not grant runtime continuity, a license over Quantum Components, or the right to reproduce a flow's internal operation.

21.3 Retention and deletion

Once the window has closed, Quantum will have no obligation to retain Client Data in active systems and may delete it without liability. Copies may remain in backups until their ordinary rotation and in records required for security, billing, audit, legal defense, or by law.

Quantum may retain linked Telemetry for as long as reasonably necessary under clause 12 and may retain De-identified Data, aggregated data, and derived intelligence indefinitely.

Deletion requests will not apply to information that Quantum must or may legitimately retain, nor will they require reconstructing backups to delete individual records.

The Client is responsible for requesting and validating its export within the applicable period. Quantum does not act as a permanent archive unless an Order so indicates.

22. Warranties and disclaimers

Quantum warrants that it has the authority to enter into the agreement and that it will provide professional services with reasonable diligence. During a paid Order, QAC will function substantially in accordance with the applicable Documentation, subject to these Terms.

In the event of a verifiable breach, the exclusive remedy will be, at Quantum's election, to correct, re-perform the affected service, or terminate it and refund the unused prepaid recurring portion.

To the maximum extent permitted by law, the Service is provided on an "as available" basis. Quantum does not guarantee uninterrupted or error-free operation, full recovery, universal compatibility, savings, revenue, business outcomes, the Client's regulatory compliance, or the accuracy of third-party data, systems, models, or decisions.

Beta, free, evaluation, sandbox, or preview features are provided as is, without SLA, support, indemnification, or warranty.

Commercial statements, estimates, demonstrations, roadmaps, success stories, and potential metrics do not constitute warranties. The only enforceable warranties are those expressly included in these Terms or in an Order.

The Client retains responsibility for business decisions, human oversight, accounting controls, compliance, continuity, and validation of results.

23. Indemnification

23.1 Client indemnification

The Client will defend, indemnify, and hold harmless Quantum, its affiliates, and personnel against third-party claims, penalties, costs, and damages arising from Client Data, Client Components, instructions, illegal use, violation of rights, breach of the Acceptable Use Policy, connected systems, or acts of its Authorized Users.

23.2 QAC intellectual property

For paid Services, Quantum may assume the defense of a third-party claim alleging that QAC, unmodified and used in accordance with the agreement, infringes a patent, copyright, or trade secret.

Quantum will have no obligation when the claim arises from the Client's data, designs, or instructions; combinations not supplied by Quantum; modifications; use outside of scope; outdated versions after an update has been offered; Client Components; or Third-Party Services.

Quantum may obtain the right to use, modify, or replace the component, or terminate the affected Service and refund unused prepaid recurring charges. These are the exclusive remedies for intellectual property claims.

23.3 Procedure

The indemnified party must give timely notice, allow control of the defense, and cooperate reasonably. No settlement may admit liability or impose non-monetary obligations on the indemnified party without its consent.

24. Limitation of liability

To the maximum extent permitted by law, Quantum will not be liable for indirect, incidental, special, exemplary, or consequential damages, lost profits, loss of revenue, reputation, opportunity, savings, data, or business interruption, even if advised of the possibility thereof.

Quantum's aggregate liability for all claims related to an Order will not exceed the charges actually paid to Quantum for the affected Service during the twelve months preceding the event giving rise to the claim. For free or trial services, the limit will be one hundred United States dollars.

The limit applies in the aggregate, regardless of the number of events, legal theories, or claims, and includes Quantum's warranty and indemnification obligations, unless an Order expressly establishes a different limit.

Service credits form part of the limit and are the exclusive remedy for availability.

Nothing will limit liability that cannot be legally excluded. The Client's payment obligations and its liability for unauthorized use, infringement of intellectual property, breach of confidentiality, indemnification, or fraud will not be limited by this clause.

Any claim against Quantum must be filed within one year after it arose or could reasonably have been known, unless the law prohibits shortening that period.

The parties acknowledge that pricing and risk allocation depend on these limitations.

25. Modifications

Quantum may modify these Terms, exhibits, policies, and Documentation at any time by publishing a new version and providing notice by email, within QAC, on the website, or through another reasonable channel.

Non-material changes may take effect upon publication. Material changes will take effect on the date indicated in the notice. Quantum may make changes effective immediately when necessary for legal, security, abuse prevention, intellectual property protection reasons, or due to third-party changes.

Continued use of the Service after the effective date constitutes acceptance. If the Client does not accept the changes, it must stop using the Service and may only exercise the termination rights granted by the Order.

During an already-paid fixed period, a general modification will not retroactively alter the committed price or an express exception in the Order, except with contractual authorization, or due to a change in scope, consumption, law, security, or provider. Current terms will apply to renewals.

Quantum will keep the published version identified. The Client is responsible for reviewing notices and keeping its contact information up to date.

26. General provisions

The Client may not assign the agreement without Quantum's written consent. Quantum may assign it to an affiliate or in connection with a reorganization, financing, merger, asset sale, or business transfer.

The parties are independent contractors. Nothing creates a partnership, agency, employment, fiduciary, or exclusivity relationship.

Quantum will not be liable for delays or failures caused by force majeure, widespread outages, labor disputes, attacks, government actions, disasters, war, epidemics, provider disruptions, or circumstances reasonably beyond its control.

If a provision is found invalid, it will be adjusted to the minimum extent necessary and the remaining provisions will continue in effect. Failure to exercise a right does not constitute a waiver.

The agreement constitutes the entire understanding regarding the Service and supersedes prior communications. There are no third-party beneficiaries.

Electronic signatures, acceptances, and records will have the same validity as physical ones. Quantum may retain evidence of version, date, user, account, IP address, and acceptance mechanism.

Operational notices may be sent within QAC or to registered contacts. Legal notices to Quantum must be sent to contacto@quantdev.co and to the address of the Contracting Entity indicated in the Order.

In the event of translation, the version identified as prevailing in the Order will govern. If none is identified, the Spanish version will prevail for the Colombian Contracting Entity and the English version will prevail for the United States Contracting Entity, when applicable.

27. Governing law and dispute resolution

When the Contracting Entity is Quantum Developers S.A.S., the agreement will be governed by the laws of Colombia and disputes will be submitted to the competent courts of Medellín, Antioquia.

When the Contracting Entity is Quantum Developers Inc., the agreement will be governed by the laws of the State of Delaware, United States, excluding its conflict-of-law rules, and disputes will be submitted to the competent state or federal courts of Delaware.

Before initiating proceedings, the parties will seek to negotiate in good faith for thirty calendar days from notice of the dispute. This will not prevent either party from seeking urgent measures to protect intellectual property, confidentiality, security, data, or to avoid irreparable harm.

To the maximum extent permitted, each dispute will be handled individually and not as a class, representative, or consolidated action.

Exhibit A. Support and SLA Policy

A.1 Applicability

This Exhibit only creates commitments when an Order incorporates it and defines the support or availability plan. In the absence of express incorporation, its categories serve solely for operational classification.

A.2 Severities

• P1 — Critical: total production unavailability or an active risk to security, integrity, or material loss, with no reasonable workaround and broad impact.
• P2 — High: material degradation or a critical function unavailable, with significant impact and a limited workaround.
• P3 — Medium: partial or non-critical impact, with an available workaround and no general disruption of operations.
• P4 — Low: inquiry, request, enhancement, minor inconvenience, or cosmetic defect without material operational impact.

Quantum will determine the final severity based on evidence, scope, and impact. If the Client does not provide information, availability, or diagnostic access, the applicable timeframes will be suspended.

A.3 Response and resolution

Channels, hours, and first-response times will be those set out in the Order. First response means the start of attention, not resolution. Resolution targets are estimates unless expressly committed to.

The Client must provide an identifier, environment, schedule, affected users, impact, evidence, recent changes, available logs, and an authorized contact.

A.4 Availability

Availability will be measured on the QAC component controlled by Quantum and during the period defined in the Order. It does not include the Client's infrastructure, source systems, networks, VPN, workers, private runtimes, APIs, models, cloud, or Third-Party Services.

A.5 Exclusions and maintenance

Announced maintenance, security emergencies, force majeure, contracted limits, authorized suspension, actions of the Client, unsupported configurations, the public Internet, and degradations without material impact on the contracted Service are excluded.

A.6 Credits

Credits will exist only if the Order contains a credit table. They must be requested within fifteen calendar days after the close of the affected month, with reasonable evidence. They are not automatic, are not paid in cash, are not transferable, and will not exceed the recurring charge for the affected Service.

Exhibit B. Data Processing Agreement

B.1 Roles and scope

When Quantum processes personal data on the Client's behalf, the Client will act as the Data Controller and Quantum as the Data Processor. Quantum will act as an independent controller with respect to account, billing, security, compliance, and business relationship data that it determines for its own legitimate purposes.

Processing may include collection, receipt, transmission, organization, storage, query, use, analysis, pseudonymization, deletion, and other operations necessary to provide the Service.

B.2 Data and data subjects

Depending on the Order, data subjects may include Authorized Users, employees, contractors, customers, suppliers, and third parties whose data is incorporated by the Client. Data may include identifiers, contact information, transactions, documents, events, communications, technical data, and operational content.

Sensitive, regulated financial, health, biometric, minors', or other special category data may only be processed when the Order authorizes it and proportional controls are agreed upon.

B.3 Client instructions and obligations

Quantum will process personal data in accordance with the Client's documented instructions, these Terms, and applicable law. The Client warrants that its instructions, purposes, notices, and authorizations are lawful.

If Quantum considers that an instruction infringes the law, it may suspend it and request clarification, without assuming responsibility for the lawfulness of the Client's processing.

B.4 Confidentiality and security

Quantum will restrict access to personnel bound by confidentiality and will maintain the commercially reasonable measures described in Exhibit C.

B.5 Subprocessors and transfers

The Client authorizes Quantum to use affiliates and subprocessors for infrastructure, support, observability, communications, artificial intelligence, and provision of the Service. Quantum will impose appropriate protection obligations on them.

Quantum may update subprocessors and locations, informing the Client through documentation, the website, QAC, or another reasonable channel. The Client may raise a substantiated objection based on data protection within ten days; the parties will seek a reasonable alternative, which may involve an additional cost or termination of the affected component.

The Client authorizes domestic and international transfers necessary to provide the Service, subject to contractual mechanisms and applicable requirements.

B.6 Data subject rights

Quantum will provide reasonable assistance to the Client in responding to requests from data subjects, authorities, and assessments, taking into account the nature of the Service. The Client will remain responsible for responding and for verifying identity, scope, and basis.

Extraordinary assistance may be charged, except when it results directly from a breach by Quantum.

B.7 Incidents

Quantum will notify the Client without undue delay after confirming a security incident affecting personal data under its control. The notice will describe, where available, the nature, affected categories, measures taken, and a point of contact.

The notice does not constitute an admission of fault. The Client will be responsible for determining and making notifications to data subjects and authorities, with Quantum's reasonable cooperation.

B.8 Retention, return, and deletion

Upon termination, the thirty-day export window will apply. Thereafter, Quantum may delete personal data from active systems, without prejudice to backups, security records, legal obligations, and De-identified Data.

B.9 Audits

Quantum may provide questionnaires, control summaries, or available reports under confidentiality. An additional audit will require notice, reasonable scope, no disruption, and payment of costs, and may not expose information about other clients or Quantum's secrets.

B.10 Applicable framework

The parties will comply with the data protection regulations applicable to them, including, where applicable, Law 1581 of 2012, Decree 1074 of 2015, and the instructions of the Superintendence of Industry and Commerce (Colombia).

Exhibit C. Security and Shared Responsibility

C.1 General principle

Quantum will maintain a security program proportional to the risk, size, and maturity of the Service. The measures described are operational objectives and may evolve without materially reducing overall protection.

C.2 Quantum's controls

• Identity management, need-based access, least privilege, and strong authentication where applicable.
• Encryption in transit and, where applicable, at rest through reasonable mechanisms.
• Secrets management, environment separation, and production access controls.
• Logging, monitoring, alerting, and investigation of relevant events.
• Vulnerability, dependency, and patch management, and secure development based on risk.
• Backups, recovery, and continuity for the components included in the Order.
• Incident response and escalation procedures.
• Confidentiality commitments and reasonable controls over personnel and providers.

C.3 Client responsibilities

• Manage identities, devices, networks, VPN, firewalls, endpoints, infrastructure, and Third-Party Services under its control.
• Configure minimum permissions, segregation of duties, approvals, and execution limits.
• Protect, rotate, and revoke secrets and credentials.
• Keep runtimes, workers, agents, operating systems, and dependencies on supported versions.
• Review alerts, execute business actions, and participate in continuity testing.
• Not upload information outside the approved data scope.

C.4 Support access

Quantum may use temporary, logged access for support or incidents when necessary. The Client must provide secure and revocable mechanisms for access to its infrastructure.

C.5 Certifications

No certification, audit, or standard will be considered included unless Quantum expressly identifies it as current, applicable to the Service, and available for the contracted plan. Quantum may progressively work toward certifications without this constituting a promise to obtain them by a specific date.

Exhibit D. Acceptable Use Policy

D.1 Prohibited uses

The Client and its Users may not use the Service to:

• Violate laws, rights, sanctions, export controls, or applicable contracts.
• Infringe intellectual property, privacy, confidentiality, or third-party rights.
• Distribute malware, exploit vulnerabilities, obtain unauthorized access, or interfere with systems.
• Overload, degrade, circumvent quotas, generate artificial consumption, or abuse capacity.
• Perform cryptocurrency mining or workloads unrelated to the authorized use case.
• Collect, surveil, profile, or make decisions about individuals in an illegal, deceptive, or discriminatory manner.
• Process restricted categories of data without authorization and agreed controls.
• Automate critical actions outside of defined permissions, limits, approvals, or safeguards.
• Impersonate identities, conceal origin, commit fraud, or produce unlawful content.
• Extract Quantum Technology, other clients' data, models, prompts, secrets, or internal mechanisms.

D.2 Enforcement

Quantum may investigate, restrict, suspend, remove harmful content, preserve evidence, and cooperate with authorities when it reasonably considers that an infringement or risk exists.

Quantum will seek to provide notice when reasonable, but may act without notice to contain harm. The Client will cooperate with the investigation and remediation.

Exhibit E. QAC Privacy Policy

E.1 Scope

This Policy describes the processing that Quantum carries out as data controller over data of visitors, prospects, contacts, administrators, and Users of QAC. Client Data processed on the Client's behalf is governed primarily by Exhibit B.

E.2 Information collected

• Identification and contact information, such as name, email, company, position, and phone number.
• Account and contracting information, such as users, plan, orders, billing, and support.
• Technical data, such as IP address, device, browser, authentication, logs, and security.
• Usage and preferences, such as features consulted, interaction, communications, and consent.
• Information provided in forms, meetings, requests, events, or support.

E.3 Purposes

• Creating and administering accounts, providing support, and operating the Service.
• Managing contracting, billing, payments, and the business relationship.
• Protecting security, preventing fraud, investigating incidents, and complying with obligations.
• Analyzing and improving experience, performance, products, and communications.
• Sending commercial information when authorization or a legal basis exists, and allowing opt-out.
• Handling rights requests, claims, and requirements from authorities.

E.4 Recipients and transfers

Quantum may share information with affiliates, providers, subprocessors, advisors, and authorities when necessary for these purposes, subject to reasonable protection and transfers permitted by law.

E.5 Retention

Quantum will retain data for the duration of the relationship and for as long as reasonably necessary for business, security, audit, legal defense, and legal compliance purposes. De-identified Data may be retained indefinitely.

E.6 Rights

Data subjects may request access, knowledge, updating, rectification, deletion, or revocation where applicable, by contacting contacto@quantdev.co. Quantum will verify identity and respond in accordance with applicable law.

E.7 Cookies and similar technologies

The sites and QAC may use cookies, local storage, and similar technologies for authentication, security, preferences, analytics, and functionality. Available options will depend on the browser and published controls.

E.8 Minors

QAC is not directed at minors. The Client must not permit their use of the Service or enter their data unless expressly authorized and with sufficient legal basis.

E.9 Changes and contact

Quantum may update this Policy in accordance with clause 25. Inquiries may be directed to contacto@quantdev.co.