SaaS Customer Agreement

Contents

1 ROC Responsibilities
2 Your Responsibilities
3 Fees and Payment
4 Temporary Suspension
5 Term and Termination
6 Proprietary Rights
7 Indemnification
8 Disclaimers
9 Limitations of Liability
10 Modifications to the Agreement
11 Miscellaneous
12 Definitions

This ROC SaaS Customer Agreement (this “Agreement”) contains the terms governing your use of the ROC cloud services and/or API (the “Services”) offered by Rank One Computing Corporation d/b/a ROC (“ROC”, “we”, “us”). By accepting this Agreement, either by clicking a box indicating your acceptance or by using the Services, you agree to it. If you are entering into this Agreement for an entity, you represent that you have authority to bind that entity. This Agreement takes effect when you click acceptance or first use the Services (the “Effective Date”).

This Agreement incorporates the following by reference (together, the “Policies”): the SaaS Terms of Service (roc.ai/legal/saas-terms-of-service), the Acceptable Use Policy (roc.ai/legal/acceptable-use-policy), the Privacy Policy (roc.ai/legal/privacy-policy), the Biometric Notice and Consent Terms (roc.ai/legal/biometric-notice), and, where you process personal data, the Data Processing Addendum (roc.ai/legal/dpa). The SaaS Terms of Service set out terms specific to each Service.

1 ROC Responsibilities

1.1 Provision of the Services. We will make the Services available to you under this Agreement and the applicable Documentation, and will provide them with commercially reasonable skill and care. We may update the Services from time to time; we will not materially reduce the core functionality of a Service you are paying for during your term.

1.2 SaaS Terms of Service. Terms specific to each Service are set out in the SaaS Terms of Service (roc.ai/legal/saas-terms-of-service) and incorporated into this Agreement. Where a term in the SaaS Terms of Service conflicts with the general terms of this Agreement, the SaaS Terms of Service control for that Service.

1.3 Security. We will implement reasonable and appropriate technical and organizational measures designed to protect Your Content against accidental or unlawful loss, access, or disclosure, consistent with our ISO/IEC 27001 / SOC 2 program and the DPA. As further described in the SaaS Terms of Service and the DPA, certain Services process inputs transiently and do not retain them, and we do not use Your Content to train our models.

1.4 Data privacy. We will process personal data within Your Content as a processor on your behalf, in accordance with the DPA and the Privacy Policy. We will not use it for our own purposes.

1.5 Service changes. We may change or discontinue a Service or feature; for a material discontinuation of a generally available Service, we will use reasonable efforts to give 12 months’ prior notice unless we reasonably determine that legal, security, or technical reasons require a shorter period.

2 Your Responsibilities

2.1 Your account. You are responsible for all activities under your account, regardless of whether the activities are undertaken by you, your employees, or a third party (including your End Users). You will keep your credentials and API keys confidential and notify us promptly of any unauthorized use.

2.2 Your Content and End Users. You are responsible for Your Content and for your End Users’ use of the Services, including compliance with this Agreement, the Policies, and applicable law. You will ensure you have all rights, notices, and consents needed for us to process Your Content, including the notices and consents required under the Biometric Notice and Consent Terms.

2.3 Configuration and lawful use. You are responsible for properly configuring and using the Services, for determining whether age estimation is an appropriate and legally sufficient age-assurance method for your use case and jurisdiction, and for meeting your own obligations as a controller and as an EU AI Act deployer (including Article 50 transparency).

2.4 Sandbox vs. Production. Non-production (“Sandbox”) access is for testing with synthetic or your own test images only; you will not submit real personal data in Sandbox. Real personal data may be processed only after you enable Production, which requires acceptance of the DPA and acknowledgement of the current Sub-processor List. We may enforce this technically.

3 Fees and Payment

3.1 Fees. You will pay the fees for your plan or order. Usage is metered per check as described at signup or in your order. Fees are exclusive of taxes and, except as expressly stated, non-refundable.

3.2 Fee changes. We may increase or add fees for existing Services by giving you at least 30 days’ prior notice, effective at your next renewal.

3.3 Taxes; late payment. You are responsible for any taxes other than ROC’s income taxes, and for any withholding. Undisputed amounts not paid when due accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower.

4 Temporary Suspension

4.1 Grounds. We may suspend your or any End User’s right to access or use any portion or all of the Services immediately upon notice if we determine that: (a) there is a security or availability risk to the Services or others; (b) your use could subject ROC or any third party to liability; (c) you are in breach of this Agreement or the Policies (including the AUP); (d) you are in non-payment; or (e) there is suspected fraudulent or unlawful use.

4.2 Effect. We will limit a suspension to what is reasonably necessary and, where practicable, give you notice and an opportunity to cure. You remain responsible for fees accrued before suspension.

5 Term and Termination

5.1 Term. This Agreement is effective from the Effective Date until terminated. You may stop using the Services and terminate at any time.

5.2 Termination for cause. Either party may terminate for cause if the other is in material breach and the breach remains uncured 30 days after notice. We may terminate immediately if we are required to by law or for an uncurable material breach (including certain AUP or Biometric Notice and Consent Terms violations).

5.3 Effect of termination. On termination, your right to use the Services ends and we will delete or return Your Content in accordance with the DPA. Given process-and-discard, transient images are already deleted. Provisions that by their nature survive (Sections 6–11) survive.

6 Proprietary Rights

6.1 Your Content. As between you and us, you own Your Content. You grant us the rights necessary to provide the Services to you and as instructed under the DPA. We obtain no rights to Your Content except those rights.

6.2 Your representations. You represent and warrant that you have all rights in Your Content and Suggestions necessary to grant the rights in this Agreement, and that Your Content and your and your End Users’ use of the Services will comply with the Policies and all applicable statutes, laws and regulations worldwide. Without limiting the foregoing, you will comply with all of the requirements of (i) the General Data Protection Regulation (GDPR) of the European Union, (ii) the European Union Artificial Intelligence Act (EU AI Act), (iii) the Biometric Information Privacy Act of the State of Illinois (BIPA), and (iv) all laws and regulations in any jurisdiction worldwide that govern (A) data privacy, (B) consumer protection, (C) the collection, storage, transmission, handling or utilization of biometric data or information or (D) the development or use of artificial intelligence systems or technology. In addition, you recognize that artificial intelligence and biometrics are powerful capabilities that must be used in an ethical manner. You agree to abide by the ROC Code of Ethics, which sets forth the principles that should guide any development and use of artificial intelligence or biometric technology, available at roc.ai/legal/code-of-ethics, as updated by ROC from time to time.

6.3 License Grant. We and our licensors own the Services, models, software, and Documentation. You receive a non-exclusive, non-transferable, revocable, limited license, without rights to sublicense, to access the Services solely through the APIs and interfaces set forth in the Documentation (the “Permitted Interfaces”), solely for your ordinary internal business purposes, and in no event for distribution to third parties.

6.4 Use Restrictions. You acknowledge that the structure, organization and source code of the Services constitute valuable trade secrets of ROC. Accordingly, you will not and will not allow any third party to: (a) modify, adapt, alter, translate or create derivative works based on the Services; (b) sublicense, lease, rent, loan, publish, copy, make available or otherwise transfer access to the Services or any API key, password, key, or other access code for the Services to any third party; (c) reverse engineer, decompile or disassemble the Services or otherwise attempt to derive the source code of the Services, including, without limitation, via knowledge distillation from use of the Services; or (d) defeat or work around any access restrictions, encryption, usage limits, metering or other technical restrictions or limitations in the Services. You will not and will not allow any third party to (i) use the Services, or any outputs, responses, or data generated by the Services (“Outputs”), to develop, train, fine-tune, or improve any machine learning models, artificial intelligence algorithms, functional equivalent of the Services or other competing software products or (ii) use any automated means, including ‘scraping’ or high-frequency API calls, to extract Outputs for the purpose of creating a dataset for machine learning training or otherwise extracting model weights or training data. All Outputs generated by the Services are licensed for the sole purpose of your ordinary internal business operations. You shall not publish or disclose to any third party any benchmarking, performance evaluations, or competitive analysis of the Services. You must use up-to-date, high industry standard technical, administrative and physical security measures to ensure that the Services are not accessed or used in any unauthorized manner. You will promptly notify ROC in writing of any actual or suspected unauthorized access to or use of the Services. Nothing in this Agreement gives you a right to use any of ROC’s trade names, trademarks, service marks, logos or other branding. All rights not expressly granted to you herein are reserved by ROC; there are no implied licenses under this Agreement.

6.5 Suggestions. If you give us Suggestions, we may use them without restriction; we obtain no right to your personal data or Confidential Information thereby.

7 Indemnification

7.1 By you. You will defend, indemnify, and hold harmless ROC and its affiliates and licensors from and against any Losses arising out of or relating to any third-party claim concerning: (a) Your Content or your use of the Services in breach of this Agreement, the Policies, or law; (b) your failure to provide required notices or obtain required consents (including under the Biometric Notice and Consent Terms) or to otherwise comply with your legal obligations in your use of the Services; or (c) your age-assurance decisions.

7.2 By ROC. We will defend you against all claims, costs and damages finally awarded to a third-party (each, a “Third Party Claim”) against you to the extent that any such Third Party Claim arose as a direct result from the Services or use thereof infringing any U.S. copyrights, trademark rights or service mark rights or misappropriating any trade secrets recognized as such under applicable U.S. trade secret regulation. If the Services become, or in ROC’s opinion are likely to become, the subject of an infringement claim, ROC may, at its option and expense, either (a) procure for you the right to continue exercising the rights licensed to you in this Agreement or (b) modify the Services so that they become non-infringing or (c) where ROC determines that (a) and (b) above are commercially impracticable, terminate this Agreement. Notwithstanding the foregoing, ROC will have no obligation under this Section 7.2 or otherwise with respect to any Third Party Claim to the extent based upon (i) any unauthorized use, reproduction, or distribution of the Services, (ii) any unauthorized modification of the Services or (iii) any third party technology, software or hardware or a combination of the Services with any technology, software, hardware or other material not provided by ROC. ROC will not indemnify you to the extent that a Third Party Claim is based on your use of the Services in their unmodified form after ROC has modified such Services as set forth above. This Section 7.2 sets forth ROC’s sole obligation and your exclusive remedy with respect to any claims of infringement or misappropriation of any intellectual property rights worldwide.

7.3 Process. The indemnified party will give prompt notice, allow the indemnifying party to control the defense, and cooperate. No settlement imposing a non-monetary obligation on the indemnified party binds it without consent.

8 Disclaimers

8.1 THE SERVICES AND ROC CONTENT ARE PROVIDED “AS IS.” EXCEPT AS EXPRESSLY STATED AND TO THE EXTENT PERMITTED BY LAW, ROC AND ITS AFFILIATES AND LICENSORS DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE. SOME SERVICES PRODUCE PROBABILISTIC OR ESTIMATED OUTPUTS; ROC DOES NOT WARRANT THAT ANY OUTPUT IS ACCURATE FOR ANY INDIVIDUAL OR CASE, OR THAT THE SERVICES SATISFY ANY SPECIFIC STATUTORY STANDARD. SERVICE-SPECIFIC DISCLAIMERS ARE SET OUT IN THE SAAS TERMS OF SERVICE.

9 Limitations of Liability

9.1 Exclusion. NEITHER PARTY (NOR ROC’S AFFILIATES OR LICENSORS) WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, STATUTORY, OR EXEMPLARY DAMAGES, OR FOR LOST PROFITS, REVENUES, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY.

9.2 Cap. EACH PARTY’S AGGREGATE LIABILITY UNDER THIS AGREEMENT WILL NOT EXCEED THE AMOUNTS YOU PAID FOR THE SERVICES DURING THE 12 MONTHS BEFORE THE LIABILITY AROSE.

9.3 Exceptions. THE EXCLUSION AND CAP DO NOT APPLY TO YOUR PAYMENT OBLIGATIONS, INDEMNIFICATION OBLIGATIONS OF SECTION 7.1, BREACH OF SECTION 6.3 OR 6.4, OR BREACHES OF THE AUP, OR EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OR ANY LIABILITY THAT CANNOT BE LIMITED BY LAW.

9.4 Acknowledgement. EACH PARTY ACKNOWLEDGES THAT THE FEES SET FORTH IN THIS AGREEMENT REFLECT THE ALLOCATION OF RISK SET FORTH IN THIS AGREEMENT AND THAT NEITHER PARTY WOULD ENTER INTO THIS AGREEMENT WITHOUT THESE LIMITATIONS ON ITS LIABILITY.

10 Modifications to the Agreement

10.1 We may modify this Agreement or any Policy at any time by posting a revised version at the applicable URL or by notifying you. For material changes we will provide reasonable prior notice (e.g., 30 days) and, where required, obtain your renewed acceptance. By continuing to use the Services after the effective date of a modification, you agree to the modified terms. Each document shows a version and effective date, and we maintain an archive of prior versions.

11 Miscellaneous

11.1 Assignment. You may not assign this Agreement without our prior consent, except to a successor in a merger or sale of substantially all assets, on notice. We may assign it to an affiliate or successor.

11.2 Entire agreement; precedence. This Agreement incorporates the Policies by reference and is the entire agreement between you and us regarding the Services. In case of conflict, the following order of precedence applies: (1) a mutually signed order; (2) the DPA (data-protection matters); (3) the SaaS Terms of Service (service-specific matters); (4) this Agreement; (5) the other Policies; (6) the Documentation.

11.3 Force majeure; confidentiality; notices. Neither party is liable for delay or failure due to causes beyond its reasonable control. Each party will protect the other’s Confidential Information with reasonable care. Notices may be given electronically or in-portal.

11.4 Governing law; disputes. This Agreement is governed by the laws of Colorado (excluding conflict rules), and disputes are subject to the federal and state courts located in Denver County, Colorado.

11.5 US Government; export. The Services are “commercial items”; US Government rights are limited accordingly. You will comply with export-control and sanctions laws.

12 Definitions

12.1 “Your Content” means content that you or any End User transfers to us for processing by the Services (including, for some Services, images submitted for processing), together with any computational results.

12.2 “End User” means any individual or entity that accesses the Services through your account, including individuals whose facial images are submitted for age estimation.

12.3 “Documentation” means ROC’s then-current usage and technical documentation for the Services, including the API reference and Instructions for Use.

12.4 “Losses” means any claims, damages, losses, liabilities, penalties, fines, costs, and expenses (including reasonable legal fees).

12.5 “Suggestions” means feedback or suggestions about the Services.

12.6 “SaaS Terms of Service” means the ROC SaaS Terms of Service at roc.ai/legal/saas-terms-of-service, which set out universal and service-specific terms (including for our Age Verification API) and are incorporated into this Agreement.