IVR Studio — Terms of Service

Effective date: 2026-08-04 · Version: 1.0

These Terms of Service (the "Terms") are a binding agreement between 9436-7455 Québec inc., doing business as NQB AI (Québec Enterprise Number (NEQ) 1176322874; registered office in Québec, Canada — registered address on file in the public Québec enterprise register) ("NQB.ai", "we", "us"), and the customer organization identified at registration (the "Customer", "you"). They govern access to and use of IVR Studio (ivr.studio), a software-as-a-service platform for designing telephone auto-attendant (IVR) call flows and producing audio files and deployment packages for phone systems (the "Service"). The Data Processing Addendum ("DPA", Exhibit A) and its Annexes form part of these Terms.

1. Acceptance and authority to bind

1.1. The Service is provided to organizations. The owner of an organization, or an admin actually authorized by the Customer, concludes these Terms on the Customer's behalf and represents having that authority. The contracting Customer is the legal entity whose legal name and details are provided at registration — a display or white-label name shown in the product is not the contracting identity.

1.2. Other members invited into an organization accept these Terms as rules of use applicable to their individual access; the contract remains between NQB.ai and the Customer.

1.3. Each acceptance is recorded with the document version, a cryptographic hash of the exact text presented, the interface language, the acceptance method, a server timestamp and the organization context. If we publish a materially revised version, continued use requires re-acceptance as described in Section 14.

2. Eligibility; business use only

2.1. The Service is offered for business and professional use only. You may not use the Service as a consumer. By accepting, you confirm that you are acting in the course of a business, trade or profession.

2.2. Users must be at least 18 years old. Where you invite external contributors through the Service's public links (for example voice narrators), you are responsible for ensuring they are adults or act with appropriate authority.

2.3. Account registrations are subject to approval by us. We may decline or revoke approval at our discretion during the Pilot (Section 3).

3. Pilot program

3.1. The Service is currently offered as a pilot ("Pilot"). It is provided free of charge, "as is" and "as available", without any service-level commitment. Features evolve as described in Section 13, which also governs changes during the Pilot.

3.2. Plans and credits granted during the Pilot are promotional: they have no monetary value, are non-transferable, may expire on the schedule published in the product, and create no entitlement to future availability, pricing or features.

3.3. We may terminate the Pilot, or any Pilot account, at our discretion. Except in the cases of Section 12 (suspension for serious breach), you will have an export window of at least 30 days from notice before deletion, as in Section 15.3.

3.4. Nothing in the Pilot obliges either party to enter into a paid subscription. Any future activation of paid plans will be preceded by updated commercial terms (prices, taxes, billing, renewal) presented for acceptance before any billing occurs.

3.5. Territorial limits of the Pilot. During the Pilot, the Customer must not: (a) be established in the European Economic Area or the United Kingdom; (b) use the Service for or on behalf of an end-client established there; (c) generate, supply, deploy or permit the use of Output where the Customer knows or reasonably should know that the Output will be used there; or (d) direct any share, approval or studio link at an individual located there. The Customer must not circumvent these restrictions through an intermediary. These restrictions lift when the corresponding compliance assessments (AI-transparency marking, hosting-service qualification, representation) are completed and announced.

4. The Service; what it is not

4.1. The Service produces artifacts: call-flow definitions, audio prompts (synthetic or human-recorded), documentation and export packages intended for provisioning on third-party phone systems (PBX). The product includes a call simulator and technician documents to verify artifacts before deployment.

4.2. Except where an optional push integration is expressly enabled by you, the Service does not operate live telephony, does not carry calls, and does not provision your PBX. Deployment of exported artifacts, and the operation of your telephone system, remain your responsibility.

4.3. The Service is not designed for emergency services or life-safety uses. You must not use it to build call flows whose failure could cause death, personal injury or severe damage (for example emergency dispatch lines).

4.4. Regulated data. The Service is not offered for content or data subject to a regime the Pilot does not provide (for example regulated health records — do not include personal health information in prompt scripts —, payment-card data, or biometric identification uses). Do not submit such data without our prior written agreement.

4.5. Maintenance; availability. We operate the Service on a best-effort basis. Planned maintenance is announced in the product where practicable; urgent maintenance may occur without notice. No availability level is warranted during the Pilot.

5. Accounts and security

5.1. You are responsible for your users' credentials, for maintaining accurate account information, and for all activity under your organization. Security features (two-factor authentication, passkeys, session management) are available and recommended.

5.2. You must notify us promptly at [email protected] of any suspected unauthorized access.

6. Customer Content

6.1. "Customer Content" means content you or your users submit to the Service: scripts and texts, uploaded audio, human voice recordings (including recordings contributed by external narrators through studio links you issue), settings and call-flow structures.

6.2. As between the parties, you retain all rights you hold or validly control in Customer Content. Some Customer Content may be held by you under a license only (for example a narrator's voice recording, contributed under the narrator contribution terms); you remain responsible for the scope of the rights you actually hold.

6.3. You grant NQB.ai a worldwide, non-exclusive, royalty-free license to host, process, reproduce, convert, display and transmit Customer Content solely to provide, secure and operate the Service and as otherwise instructed by you (for example generating exports or serving share links you create). NQB.ai pursues no purposes of its own on Customer Content other than the platform-controller purposes described in the Privacy Policy (security, abuse prevention, aggregated non-identifying statistics), which may involve automated inspection strictly for those purposes.

6.4. You warrant that you have all rights, consents and authorizations needed for your Customer Content (including the consent of any person whose voice is recorded) and that it does not violate law or third-party rights.

6.5. Share links and studio links you create are under your control. A link is a secret access credential: anyone holding the URL may access, copy or forward the content it serves. You are responsible for who you give links to, for the sensitivity of what you expose through them, and for using the protections the product offers for the link kind (such as password, expiration and revocation) where content warrants it. Where the product asks for the identity of the controller responsible for a page (for example an end-client a link is prepared for), you must provide accurate information. Do not use links for highly sensitive content without such protections.

6.6. Limited agency for narrator contributions. You appoint NQB.ai as your limited agent solely to present your narrator contribution terms on studio pages and to record narrators' acceptances on your behalf; the contribution license is granted to you (and, where applicable, to your end-client), not to NQB.ai.

7. Generated Output

7.1. "Output" means artifacts generated by the Service from your instructions, in these categories: (a) synthetic speech audio files; (b) audio generated with a custom voice designed from your description — the underlying voice model or profile itself remains with NQB.ai and its providers and is not transferred; (c) generated hold-music tracks; (d) export packages assembling audio and documentation.

7.2. Subject to these Terms, NQB.ai grants you — to the extent of, and subject to, the rights NQB.ai is authorized to grant under the applicable upstream rights in force at the time of generation — a worldwide, non-exclusive license, sublicensable to the end-clients for whom the artifacts were prepared (and to their technical operators) for deployment in their telephone systems, to use, reproduce and distribute Output generated for your organization, for use in telephone systems and related business purposes. Where those upstream rights allow assignment, NQB.ai assigns instead.

7.3. The scope of your rights in an Output is determined at the time of generation, by the upstream rights then in force. Within that scope, a later change of technology provider, plan or catalog does not retroactively withdraw rights in Output already generated and delivered to you; NQB.ai does not, however, warrant against the effects of an upstream condition that applied at generation.

7.4. Because Output is machine-generated, NQB.ai does not warrant that Output is protectable by copyright, that it is unique, that similar or identical output will not be generated for others, or that Output does not infringe third-party rights.

7.5. You may not use Output to build or seed a competing voice-generation or music-generation service, to train machine learning models, or to remove or alter any machine-readable provenance or disclosure marking that the Service embeds in generated audio. An export produced without such marking through an option the Service itself offers (for platform-compatibility reasons, recorded in the organization's activity log) is not a removal within the meaning of this Section; territorial restrictions on unmarked exports may apply.

8. Music

8.1. Hold-music tracks from the default library are licensed to you, to the extent of the rights NQB.ai controls, for use as telephone hold/announcement audio within telephone systems you or your end-clients operate. Tracks generated by your organization are Output under Section 7 (including its upstream-rights condition) with the same permitted use.

8.2. You may deliver music as part of an export package to the end-client for whom it was prepared, under the same use limits. You may not redistribute music as, or into, a music library, catalog, streaming offer or repository, resell it on a standalone basis, or claim it is "royalty-free".

8.3. Within the scope of Section 8.1, music validly exported or installed remains licensed for the deployment for which it was prepared, even if the corresponding track is later removed from the library and after these Terms end.

8.4. Public-performance and communication royalties. The licenses of this Section cover only the rights NQB.ai controls. Playing music to callers may attract royalties or licenses administered by collective-management organizations (for example music-on-hold tariffs such as SOCAN Tariff 15B in Canada); obtaining and paying for any such licenses is the responsibility of the Customer or of the operator of the telephone system, not of NQB.ai.

8.5. Sector restrictions on generated music. Under upstream rights conditions, music generation by your organization (Section 8.1, organization-generated tracks) is not available for use by or on behalf of organizations operating in the following sectors: firearms or weapons manufacturing or distribution; tobacco products; prescription pharmaceuticals or controlled substances; adult entertainment; religious organizations or institutions; political advocacy or campaigning. Music prompts must not include artist names, songwriter names, song or album titles, publisher or label names, or substantial lyrics excerpts. These restrictions apply to generating new tracks; they do not affect tracks from the default library.

9. Acceptable use

You must not, and must not permit anyone to:

• use the Service for unlawful content or purposes, including unlawful

robocalling, fraud, or deceptive caller identification;

• use artifacts in unsolicited automated outbound calling

("robocalls") or bulk-communication campaigns — the Service produces artifacts for inbound call handling (auto-attendants, queues, voicemail);

• impersonate a real person's voice or identity without that person's

documented consent, simulate the voice of a political or government figure (with or without their consent), or create content intended to deceive as to its origin;

• deploy synthetic-voice audio in a manner likely to mislead callers

into believing they are interacting with a live human where that matters to them: you must ensure — and must require of the end-clients to whom you distribute artifacts — that the synthetic nature of a voice is disclosed to callers in an appropriate manner wherever applicable law, or the context of deployment, requires it;

• upload content that infringes intellectual-property, personality or

privacy rights, or that is defamatory or hateful;

• submit regulated data prohibited by Section 4.4;
• probe, disrupt or overload the Service, circumvent authentication,

quotas, credit accounting or plan gates, or access another tenant's data;

• resell, sublicense or provide the Service itself to third parties as

a service bureau — agencies may use the Service to produce artifacts for their end-clients in the normal operation of the product;

• use the Service in violation of applicable export-control or

sanctions rules.

We publish one unified acceptable-use standard: obligations of NQB.ai's technology providers are reflected in these Terms and in product rules; we do not pass through undisclosed third-party terms.

10. Credits and plans

10.1. Usage of generation features consumes credits according to the schedule published in the product (units, rounding, cost per feature). The schedule may be adjusted prospectively; changes do not affect credits already consumed.

10.2. Credits are consumed only for generations actually produced and delivered. A generation that fails, or whose target no longer exists at delivery, is not charged; any credit charged in error is re-credited on request.

10.3. Credits have no monetary value, are not redeemable, and are not transferable between organizations. Expiration and consumption order, where applicable, follow the published schedule (Pilot credits: Section 3.2).

10.4. Plan features and gates (which features are available on which plan) may change as described in Section 13.

11. Third-party services and sub-processors

11.1. The Service is built on third-party infrastructure and generation technology. Sub-processors handling personal data are listed, with countries and transfer mechanisms, in the versioned schedule referenced in the DPA (Exhibit A, Annex 3). Where a provider's terms require specific flow-through provisions, they appear in Schedule P.

11.2. Some capabilities interact with services you choose and control under your own agreements with those providers: identity providers for social login or enterprise SSO, and the PBX systems (for example 3CX) you designate as push targets. We are not a party to those relationships.

11.3. We may substitute or add technology providers. Section 7.3 protects Output already generated; the DPA governs sub-processor changes.

12. Suspension

12.1. We may suspend an organization or user, or disable specific content or links, where reasonably necessary: (a) for serious or repeated breach of Section 9; (b) to prevent harm to the Service, other customers or third parties; (c) where required by law; (d) during the Pilot, per Section 3.3.

12.2. Where practicable we will notify you of a suspension, its reason, and how to remedy it, and lift it when the cause is resolved. Public share links of a suspended organization stop resolving. Suspension under this Section is remediable and distinct from Pilot termination under Section 3.3, which is a separate discretionary right. Even while suspended, self-service data export remains available unless the law prohibits it (Section 15.3).

13. Changes to the Service

13.1. We may add, modify, replace or remove features, voices, technology providers, export formats, plans, quotas and the music library. This is how the product evolves and is part of what you accept.

13.2. For a material adverse change to a capability available on your plan, we will give at least 30 days' notice (email or in-product), and the change applies prospectively. A change is materially adverse where it substantially reduces a core capability your organization actually uses; features identified as beta or experimental are excluded. If you object, your remedy is to export your data and terminate; the export window of Section 15.3 applies.

13.3. We may act immediately, with notice as soon as practicable, where a change is required by security, law, or a third-party provider's withdrawal or requirements.

14. Changes to these Terms

14.1. We may revise these Terms. Material revisions take effect no earlier than 30 days after notice, apply prospectively, and require re-acceptance in the product. If you do not accept, your access ends at the effective date; the export window of Section 15.3 is guaranteed from the notice.

14.2. Non-material revisions (clarifications, typography) may take effect on publication. Schedules published in the product (credit schedule, sub-processor schedule) are identified, dated and archived; a schedule change cannot materially amend these Terms outside the process of this Section.

15. Term, termination and data restitution

15.1. These Terms apply from acceptance until the organization is deleted or the agreement is terminated.

15.2. You may terminate at any time by purging your organization (self-service, subject to the 7-day grace mechanism) after exporting your data (self-service export).

15.3. Export window. On Pilot end (3.3), refusal of revised Terms (14.1) or termination by us without cause, self-service export remains available for at least 30 days from notice. On suspension for serious breach (12.1(a)), we may restrict interactive use of the Service, but self-service data export remains available unless the law prohibits providing it. After the applicable window: (a) share and studio links are revoked; (b) we delete Customer Content and Output from active systems; (c) residual copies in backups are deleted on the backup rotation (retention periods: Privacy Policy); (d) we may retain records we are legally entitled or required to keep (acceptance records, billing and audit journals) for their documented retention periods.

15.4. Sections 6.4, 7, 8, 9, 16, 17, 19, 20, 21 and 22, and the DPA as to data processed, survive termination to the extent applicable.

16. Confidentiality

16.1. "Confidential Information" is non-public information disclosed by a party in connection with the Service, excluding information that is or becomes public without breach, was lawfully known before disclosure, is independently developed, or is received from a third party without duty.

16.2. Each party will protect the other's Confidential Information with reasonable care, use it only to perform under these Terms, and disclose it only to personnel and contractors under equivalent obligations. Disclosure compelled by law is permitted with prior notice to the other party where legally allowed.

16.3. This Section survives for 5 years after termination — and, for information that constitutes a trade secret or must remain confidential by law, for as long as that status lasts. For personal data, the DPA governs.

17. Platform ownership; feedback

17.1. NQB.ai and its licensors own the Service, its software, models, integrations, designs and documentation. No rights are granted except as expressly stated.

17.2. If you send feedback or suggestions, we may use them without restriction or compensation — excluding any personal data and any information identified as confidential. We will not identify you publicly as the source without consent.

18. Warranties and disclaimers

18.1. The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, availability, accuracy and non-infringement, to the maximum extent permitted by law.

18.2. Synthetic audio quality, voice availability and third-party platform compatibility are not guaranteed. You are responsible for verifying exported artifacts with the tools provided (simulator, technician documents) before deployment.

19. Indemnification

19.1. You will defend and indemnify NQB.ai against third-party claims, damages and reasonable costs to the extent caused by: (a) your Customer Content, including voice recordings lacking valid consent; (b) your use of the Service or Output in breach of these Terms or of law; (c) your or your end-clients' telephone operations — excluding in each case the portion attributable to NQB.ai's breach of these Terms or fault.

19.2. Procedure: we notify you promptly of a claim, you control the defense with counsel reasonably acceptable to us, we cooperate at your expense and may participate with our own counsel at our cost; you will not settle a claim imposing obligations on us (beyond payment you fully cover) without our consent.

20. Limitation of liability

20.1. To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or loss of profits, revenue, goodwill or data. Amounts payable to third parties under Section 19 are direct damages for the purpose of this Section.

20.2. NQB.ai's total aggregate liability under or in connection with these Terms — including under the DPA, as between the parties, and regardless of the number of claims — is capped at USD $100 during the Pilot, or, once paid subscriptions are in force, at the fees paid by the Customer in the 12 months preceding the event, whichever is greater at that time.

20.3. Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law — including for intentional or gross fault, fraud, or bodily or moral injury — and nothing limits the rights that individuals or authorities hold directly under data-protection law.

21. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control (including outages of upstream providers, network failures, acts of government, labor disputes), provided the affected party notifies the other within a reasonable time and uses reasonable efforts to mitigate. If such an event substantially prevents the Service for more than 60 consecutive days, either party may terminate; Section 15.3 applies. Confidentiality and data-protection obligations are not excused by this Section.

22. Governing law and forum

These Terms are governed by the laws of the Province of Québec, Canada, excluding conflict-of-law rules. The courts of competent jurisdiction sitting in the judicial district of Québec have exclusive jurisdiction, and the parties attorn to them — without depriving either party of protections of mandatory local law that apply notwithstanding this clause.

23. Illegal-content and IP complaints (notice & action)

Anyone may notify us of allegedly illegal or infringing content available through the Service (including share links) at [email protected] (or [email protected] for IP claims), identifying the content, the grounds and the notifier's contact details. We review notices diligently, disable content where warranted, inform the affected customer with the reasons, and give them an opportunity to respond. Abusive or manifestly unfounded notices may be disregarded.

24. General

Assignment: you may not assign these Terms without our consent, except to a successor of your business; we may assign to an affiliate or successor. Notices: to [email protected] (to us) and to your owner/admin email addresses (to you). Severability: invalid provisions are replaced by valid ones closest in effect. No waiver by tolerance. These Terms (with the DPA, its Annexes and the identified product schedules) are the entire agreement regarding the Service. Order of precedence for their subject matter: mandatory applicable law; any standard contractual clauses entered into for transfers; the DPA and its Annexes (for personal data); the body of these Terms; the identified product schedules. The Privacy Policy and visitor notices are informational notices and do not form part of this Agreement; the DPA constitutes the parties' contractual data-processing terms. These Terms currently exist in English only; the parties confirm their express wish to contract in English to the extent permitted by applicable law.

25. Contact

9436-7455 Québec inc. (doing business as NQB AI) · NEQ 1176322874 · Québec, Canada · [email protected]

Person in charge of the protection of personal information: President, reachable at [email protected].

Exhibit A — Data Processing Addendum (DPA)

This DPA forms part of the Terms and applies where NQB.ai processes personal data on behalf of the Customer in providing the Service. In case of conflict regarding personal data, this DPA prevails over the body of the Terms. Annexes: Annex 1 (Details of Processing), Annex 2 (Technical and Organizational Measures), Annex 3 (Sub-processors and Transfers — versioned schedule).

"Customer Personal Data" means any personal data processed on the Customer's instructions in connection with the Service — within Customer Content, but also within Output and derived artifacts, generation metadata, and link journals, to the extent they contain personal data. References to Customer Content in this DPA extend to Customer Personal Data.

A1. Roles. For Customer Content (scripts, audio, voice recordings, and the names/comments collected through share and studio links the Customer issues), the Customer acts as controller — or, where the Customer prepares artifacts for its own end-clients, as a processor for those end-clients — and NQB.ai acts as the Customer's processor (or sub-processor, as applicable). For account, security, billing/usage, audit, acceptance and abuse-prevention data, NQB.ai is an independent controller (see Privacy Policy).

A2. Instructions. NQB.ai processes Customer Content only on the Customer's documented instructions — these Terms, product settings and actions taken in the product constitute such instructions — unless processing is required by law, in which case NQB.ai informs the Customer unless prohibited. NQB.ai will inform the Customer without delay if, in its opinion, an instruction infringes applicable data-protection law; it may suspend the instruction pending clarification.

A3. Customer obligations. The Customer warrants that the relevant controller (itself, or its end-client where the Customer acts as that client's processor) has a lawful basis and has given the required information (and obtained the required consents or authorizations, including for recorded voices) for the Customer Personal Data processed through the Service; that the Customer is authorized to engage NQB.ai as processor or sub-processor; that its instructions reflect the relevant controller's instructions and are lawful; and that it will not instruct processing of data categories excluded by Section 4.4 of the Terms without written agreement.

A4. Confidentiality. Persons authorized to process Customer Content are bound by confidentiality obligations.

A5. Security. NQB.ai implements and maintains the technical and organizational measures of Annex 2. NQB.ai may update Annex 2 provided the changes do not materially degrade the overall level of protection.

A6. Sub-processors. The Customer gives general authorization to the sub-processors listed in Annex 3, published and versioned at /privacy. NQB.ai will give at least 14 days' notice before adding or replacing any sub-processor (email or in-product). The Customer may object on reasonable data-protection grounds; the parties will seek a solution in good faith (including not deploying the change for the Customer where feasible), failing which the Customer may terminate and export its data. Where an urgent replacement of a sub-processor is necessary to maintain the security or availability of the Service, NQB.ai may proceed and will notify the Customer as soon as reasonably possible, the objection right applying from that notice. NQB.ai imposes on sub-processors the same data-protection obligations as this DPA in substance, and remains fully liable to the Customer for their performance.

A7. Assistance. Taking into account the nature of processing and the information available to it, NQB.ai assists the Customer: (a) with data-subject requests — the product provides self-service export, purge and per-item deletion; a request NQB.ai receives directly about Customer Personal Data is forwarded to the Customer without undue delay and answered substantively only on the Customer's documented instruction, unless the law requires otherwise; (b) with security, breach notification, data protection impact assessments and prior consultations (GDPR arts. 32–36). Assistance beyond the product's self-service capabilities may be subject to reasonable fees, except where the need results from NQB.ai's breach of this DPA.

A8. Personal-data breach; attempted breaches. NQB.ai notifies the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data — or of an attempted breach of the confidentiality obligations relating to it — providing, immediately and then in phases as information becomes available: the nature of the incident, the categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point, so that the Customer can meet its own notification obligations (72 hours under GDPR). NQB.ai enables the Customer's person in charge of the protection of personal information to carry out reasonable related verifications.

A9. Deletion and return. During the term, export is self-service — including while an organization is suspended (Section 15.3 of the Terms), unless the law prohibits providing it. At the end of the services, NQB.ai returns, deletes, or returns then deletes Customer Personal Data, as the Customer directs, then deletes remaining copies: active systems after the export window of Section 15.3, backups on the rotation periods of Annex 3/Privacy Policy, sub-processor copies per their schedules — unless law requires retention of an identified item. On request, NQB.ai certifies deletion in writing.

A10. Audits. NQB.ai makes available the information reasonably necessary to demonstrate compliance (documentation, Annexes, summaries of measures, certifications where available) and allows audits. Audits proceed first on a documentary or remote basis; an on-site audit may follow where documentary review is insufficient. On-site audits are limited to once per 12 months, on 30 days' notice, at the Customer's cost, and must not compromise other customers' data. The auditor must be independent (not a competitor of NQB.ai), bound by confidentiality obligations, and is not given access to source code, to other tenants' data, or to security information whose disclosure would itself create risk; penetration testing requires a separate written agreement. These conditions apply except where a supervisory authority requires an audit, after a personal-data breach affecting the Customer, or where material non-compliance is reasonably evidenced; where non-compliance is established, the audit is at NQB.ai's cost.

A11. Transfers. Customer Personal Data is processed in the locations listed in Annex 3, which states, per sub-processor, the data categories, countries and the transfer mechanism relied on. Annex 3 is descriptive of the current state of the Service and changes with it (A6): NQB.ai makes no data-residency or data-localization commitment and may process Customer Personal Data in any location so listed, unless expressly agreed otherwise in writing. NQB.ai will not transfer Customer Personal Data otherwise without ensuring an appropriate safeguard. Transfer to NQB.ai : for customers subject to the GDPR or UK GDPR, the initial transfer to NQB.ai in Canada relies on the adequacy decisions applicable to commercial organizations subject to Canadian federal privacy law, or, where these do not apply, on standard contractual clauses (and the UK addendum/IDTA) to be entered into on request — such clauses prevail over this DPA for their subject matter. Copies or summaries of the safeguards are available via [email protected].

A12. Liability; duration. Liability under this DPA between the parties is subject to Section 20 of the Terms; the direct rights of data subjects and the powers of authorities are unaffected (Section 20.3). This DPA applies as long as NQB.ai processes Customer Personal Data.

Annex 1 — Details of Processing

• Subject matter and duration: operation of the IVR Studio service

for the Customer, for the duration of the Terms plus the deletion periods of A9.

• Nature and purposes: hosting; storage; audio conversion,

normalization and packaging; speech and music generation from Customer instructions; serving of share/approval/studio pages the Customer issues; export and delivery of artifacts.

• Categories of data subjects: the Customer's users; its

end-clients' staff named in call flows or documents; external contributors (voice narrators); recipients and technicians using links; callers are not processed (the Service does not carry calls).

• Categories of personal data: identification data (names, email

addresses), professional context (extensions, roles, business hours), voice recordings, scripts and free-text content (which may incidentally contain any category the Customer includes), names, decisions and comments of link visitors, IP addresses and browser identifiers captured with acceptance and contribution evidence, generation metadata, and link-event journals.

• Special categories: none sought by design; incidental content

possible under the Customer's responsibility (A3).

• Controller obligations and rights: as set out in the DPA,

exercised through the product and [email protected].

Annex 2 — Technical and Organizational Measures (summary)

Measures include: tenant isolation by organization across data stores, blobs, exports, search and links; TLS in transit; password hashing; optional TOTP 2FA and passkeys with session listing and revocation; integration secrets encrypted at rest (AES-256-GCM) with a key-rotation procedure; role-based staff access on least privilege; an audit journal of administrative actions designed to be append-only; support impersonation designed to be read-only, time-boxed, audited and disclosed to the affected organization; backups with bounded rotation and periodic restore verification (Annex 3); vulnerability and dependency updates applied in the normal course; incident-response handling per A8; development practices with automated proofs replayed on security-touching changes. This Annex summarizes measures in place; it may be updated per A5 without degrading the overall level of protection.

Annex 3 — Sub-processors and Transfers (versioned schedule)

Schedule version: 1.0 (2026-08-04) — the current version is published at /privacy; changes follow A6 (14 days' notice).

| Provider | Service | Data categories | Country of processing | Transfer mechanism | |---|---|---|---|---| | OVH (OVH Hosting Inc., Montréal) | application hosting, storage, backups | all Customer Content | Canada (Beauharnois, Québec) | provider agreement incl. its Personal Information Protection Agreement (Québec law) | | Cloudflare, Inc. | network, TLS termination and relay | traffic data, visitor IP addresses, technical logs; content transits and may be cached during relay | global network (core data centers in the U.S. and EU) | EU SCCs (Modules 2 and 3) incorporated into the provider DPA; provider declares EU-U.S. / Swiss-U.S. DPF certification (+ UK extension) | | Speech-synthesis provider (primary) | speech synthesis | script text and voice identifier; no retention by the provider (real-time synthesis) | Canada | provider DPA incl. 2021 EU SCCs + UK IDTA; provider certified under the EU-U.S. / Swiss-U.S. DPF and UK Extension | | Speech-synthesis provider (fallback); AI support-assistant provider | speech synthesis (fallback); support assistant | script texts; assistant conversations and account context | United States | provider DPA incl. EU SCCs (art. 46(2)(c) GDPR) + UK Addendum | | Speech, voice-design and music-generation provider | speech synthesis, voice design, music generation | script texts, voice descriptions, music prompts | United States (storage); Netherlands, Singapore (processing) | provider certified under the EU-U.S. DPF (U.S. entity) ; provider DPA incl. EU SCCs | | Plus Five Five, Inc. (Resend) | transactional email | recipient email, display name where applicable, message content, delivery metadata | United States (storage regardless of sending region) | provider DPA incl. EU SCCs (Module 2) + UK Addendum; provider declares EU-U.S. DPF adherence |

Generation and assistant providers are listed by function: their identities are confidential commercial information of NQB.ai. A Customer that has entered into the DPA may obtain the identity of the sub-processors processing its Customer Personal Data by written request to [email protected], under confidentiality; the response is provided within the notice framework of A6.

The "country of processing" column describes the current version of this schedule only; it is not a residency commitment, and locations (including new regions) change with A6 notice (A11). Payment processing (Stripe) is not active during the Pilot and is absent from this schedule; it will be added with A6 notice before any activation. An urgent replacement forced by a provider's withdrawal or requirements follows Section 13.3 of the Terms, with A6 notice as soon as practicable and the same objection and export rights. Backup rotation periods: snapshots up to 48 hours (hourly), 30 days (daily) and 12 months (monthly); logical database dumps 14 days.

Schedule P — Provider Flow-Through Terms

Where a technology provider's terms require specific provisions in the agreement between NQB.ai and the Customer, those provisions appear in this Schedule and form part of the Terms. They apply only to the features actually powered by the relevant provider.

P1. Voice-generation features (ElevenLabs). For features powered by ElevenLabs, Inc.: (a) the Customer's use is subject to restrictions at least as protective as those of Section 9 (acceptable use), which reflects the provider's prohibited-use requirements; (b) neither NQB.ai nor the Customer acts as the provider's agent or partner, and the Customer must not hold itself out as such; (c) ElevenLabs, Inc. is a third-party beneficiary of the Customer's obligations under this Schedule and Section 9 as they relate to those features; and (d) to the extent End User data is processed through those features, the End User grants the provider a non-exclusive right to process that data solely to provide and support the service, consistent with the DPA and Annex 3. This Schedule does not expand any provider's rights beyond what these Terms and the DPA allow, and Section 24's confidentiality of this identification applies: it is disclosed here solely because the provider's terms require it.