UP SOLUTIONS AI — TERMS, CONSUMER CONDITIONS & AI GOVERNANCE RULEBOOK LEGAL REVIEW NEEDED — This draft is not legal advice. It is a product safeguard, not a claim of compliance in every jurisdiction. Ontario/Canadian and launch-market counsel must confirm the operator details, consumer disclosures, privacy schedule, cancellation rights and liability language before paid launch. Version: 2026-08-12-global-review-1 Effective: Effective when accepted, subject to mandatory local law Operating location: Toronto, Ontario, Canada Contact: hello@upsolai.com Principle: Consumers keep every right that applicable law does not allow them to waive. Principle: AI output is assistive, may be wrong, and requires qualified human review. Principle: Customer data is used only for disclosed, authorized service purposes. Principle: Material decisions, paid changes and high-impact actions require human confirmation. Core Terms of Service Audience: Everyone The common rules for accounts, workspaces, service use and changes. Agreement and operator These Terms form an agreement between the account holder and Up Solutions AI, operated from Toronto, Ontario, Canada ("Up", "we", "us"). The final legal name, business address and registration details must appear on the order form or service confirmation before paid launch. If an order form or signed business agreement conflicts with these Terms, the signed agreement controls for that conflict. Eligibility and authority You must be legally able to enter this agreement. If you use the service for an organization, you confirm that you are authorized to bind it. Workspace owners control invitations, roles and module access and remain responsible for authorized users. Service Up provides modular business workspaces, records, workflows, configuration tools, implementation support and, where enabled, AI-assisted suggestions. Features, limits, trial terms, price, currency, taxes and renewal terms shown at confirmation form part of the agreement. No revenue, profit, savings, compliance or other result is guaranteed. Accounts and security Provide accurate account information, protect login methods, use individual accounts, and notify hello@upsolai.com promptly of suspected misuse. You are responsible for activity by authorized users, but not for activity caused solely by Up's failure to use reasonable safeguards. Changes and availability We may improve, replace or discontinue features. We will give reasonable advance notice of a material reduction to paid core functionality when practicable and any notice required by law. Maintenance, security events and third-party failures can interrupt service. We do not promise uninterrupted or error-free availability. Suspension and termination We may suspend access when reasonably necessary for a security threat, unlawful use, material breach or unresolved payment failure. We will use proportionate measures and notice when practicable. You may stop using a free service or cancel a paid service as disclosed at purchase. Export, retention and deletion are governed by the service configuration, Privacy Notice, applicable agreement and law. Consumer Terms Audience: Personal, family or household users Plain-language protections that supplement the common terms and preserve mandatory rights. Your mandatory rights Nothing in these Terms excludes, restricts or replaces a consumer guarantee, cancellation right, remedy, forum right or other protection that applicable law does not permit you to waive. If a clause conflicts with mandatory consumer law, that law controls and the remaining clauses continue where lawful. Before you accept The confirmation screen must identify the service, total price and currency, recurring charges, taxes or tax status, trial and renewal terms, cancellation method, material limits and operator contact details. You must have an express opportunity to correct errors and accept or decline. A durable copy or download of the accepted version will be available. Trials, renewals and cancellation A free trial does not become paid unless the confirmation screen clearly says when and how a charge starts and you validly agree. Automatic renewal is off unless it is lawfully configured and expressly accepted. Statutory cooling-off, withdrawal, cancellation and refund rights remain available where they apply. Complaints Contact hello@upsolai.com with the account email, workspace and issue. We will acknowledge the complaint, investigate it, explain the outcome and preserve escalation options required by applicable law. This process does not prevent you from contacting a regulator, consumer-protection body or court where permitted. Consumer liability We do not exclude liability that cannot lawfully be excluded, including where applicable liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or breach of mandatory consumer rights. Any other limitation is only to the maximum extent permitted by the law that applies to you. Business Customer Terms Audience: Business customers Commercial responsibility, warranty, indemnity and risk allocation for B2B use. Customer administration The business customer is responsible for its workspace configuration, authorized users, lawful instructions, internal approvals, record accuracy, retention choices and decisions made using the service. Up is not the customer's accountant, lawyer, employer, fiduciary, records custodian or regulatory decision-maker. Customer content and indemnity The customer will defend and indemnify Up and its personnel against third-party claims arising from customer content, unlawful instructions, unauthorized data, or the customer's use of output in breach of these Terms, except to the extent caused by Up's breach, negligence or wilful misconduct. Up must give prompt notice and reasonable control of the defence; no settlement may impose an admission or non-monetary duty on Up without consent. Limited warranty Up warrants that paid services will be provided with reasonable care and skill and substantially as described in the applicable order. The customer's primary remedy is re-performance or, if that is not reasonably possible, termination and a pro-rated refund for the affected prepaid period. Other implied warranties are excluded only where law permits. B2B liability cap To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, punitive or consequential loss, or lost profits, revenue, goodwill or data, except where such exclusion is prohibited. Up's aggregate liability arising from a paid service is proposed to be limited to fees paid or payable for the affected service in the 12 months before the event. This cap requires counsel review and does not apply to liabilities that law does not permit to be limited. Business disputes The parties will first attempt good-faith business escalation. Nothing prevents urgent injunctive relief, debt collection or a claim that cannot lawfully be subject to the proposed forum clause. AI Governance Rulebook Audience: AI-assisted feature users Human oversight, evidence, safety boundaries and escalation for AI-supported work. Assistive output only AI output can be incomplete, outdated, biased, inconsistent or wrong. It is a draft or recommendation, not a fact, instruction, guarantee or substitute for qualified professional judgment. Review source material, assumptions, calculations and consequences before use. No professional advice The service does not provide legal, tax, accounting, medical, employment, investment, safety, regulatory or other licensed professional advice. Obtain an appropriately qualified professional where the context requires it. High-impact decisions Do not use AI output as the sole basis for employment, credit, insurance, housing, education, eligibility, legal rights, health, safety, compliance filings, payroll, payments or similarly significant decisions. A qualified, authorized human must review and approve any permitted high-impact use, and affected people must receive any notice, explanation or recourse required by law. Controls AI-assisted features must use only authorized tenant context, disclose when an output is AI-assisted, preserve relevant sources and rule versions where supported, flag uncertainty, respect role and module permissions, and fail safely when a provider or evidence is unavailable. AI may propose changes but cannot silently enable modules, spend money, change permissions, delete records or communicate externally. Prohibited AI use Do not use the service to deceive, impersonate, discriminate unlawfully, manipulate vulnerable people, infer highly sensitive traits without lawful necessity, conduct hidden surveillance, create malware, evade safeguards, or generate or operationalize unlawful or dangerous activity. Escalation and feedback Stop and escalate to an authorized human when evidence conflicts, confidence is low, sensitive data appears unexpectedly, a request exceeds permissions, or harm is reasonably foreseeable. Report unsafe or inaccurate behavior to hello@upsolai.com. Reports and corrective actions should be recorded without retaining unnecessary sensitive content. Data, Privacy & Security Audience: Owners, users and data subjects Roles, permitted data, processing, international transfers, retention and incidents. Customer content and permissions Customers retain ownership of their content. They grant Up a limited, non-exclusive right to host, copy, validate, transform and process it only to provide, secure, support and improve the contracted service as disclosed. Customers must have lawful authority, notices and consents for personal information and must not submit unnecessary credentials, government identifiers, medical records or other highly sensitive data. Controller and processor roles For account, security, billing and service-administration information, Up generally determines the service purposes. For personal information submitted by a business customer for its own operations, the customer generally determines purposes and Up acts on documented instructions. A data-processing agreement is required where applicable and must address confidentiality, subprocessors, assistance, deletion or return, audits and transfers. Minimization and purpose We aim to collect and retain only information reasonably necessary for identified service, security and legal purposes. Workspace owners must configure access and retention appropriately. The service must not repurpose tenant content for model training unless a separate, explicit and lawful choice is implemented; no such training choice is represented as active here. International processing Service providers may process information outside the user's province or country when configured. Foreign courts, law-enforcement or national-security authorities may lawfully access data in that jurisdiction. Up remains accountable as required by applicable law and uses contractual, technical and organizational safeguards appropriate to the risk. Exact providers, regions and transfer mechanisms must be disclosed in the production privacy schedule. Security and incidents No system is perfectly secure. Up will use safeguards appropriate to sensitivity, restrict access, log material administrative actions where supported, assess suspected incidents, preserve evidence, mitigate harm and make notices required by applicable law. Customers must promptly report suspected compromise and cooperate with containment. Retention, export and deletion Retention follows configured workspace rules, contractual needs, security logs, backups and legal obligations. Deletion can be delayed by backups, fraud prevention, disputes or legal holds. Upload functionality must remain disabled unless quarantine, malware scanning, authorization and verified deletion controls are active. Available export and deletion options must be described truthfully in-product. Privacy requests People may request access, correction, deletion, portability, consent withdrawal or objection where applicable by contacting hello@upsolai.com. We may verify identity and authority, and lawful exceptions may apply. Unresolved privacy complaints may be taken to the applicable privacy regulator. Acceptable Use Audience: All account holders Boundaries protecting people, customer workspaces and the platform. Lawful and authorized use Use the service only for lawful purposes, with appropriate authority, approved sources, role-based access, transparent workplace practices and meaningful human review. Security abuse Do not bypass access controls, probe or disrupt systems, introduce malware, scrape prohibited sources, share accounts, access another tenant, expose secrets, overload services or attempt to reconstruct protected source code or models except where a non-waivable law permits interoperability or security research. Content and conduct Do not submit content that is unlawful, infringing, deceptive, abusive or collected without necessary rights. Do not use the service for spam, unlawful surveillance, discrimination, exploitation, fraud, dangerous activity or to present unreviewed AI output as an authorized professional determination. Reports and enforcement Report suspected violations to hello@upsolai.com. We may investigate and apply proportionate restrictions, preserve evidence and cooperate with lawful requests. Where appropriate and legally required, we will provide reasons, notice and an avenue to contest a restriction. Intellectual Property Audience: Everyone Ownership of customer content, service technology, feedback and output. Customer content Customers keep their rights in content they provide. The limited service licence ends when content is deleted, except for lawful retention, backups and records necessary to establish or defend rights. Platform rights Up and its licensors retain rights in the platform, designs, software, documentation, templates and methods. No ownership is transferred. You may use the service and permitted exports for your internal purposes during your authorized term. AI output As between Up and the customer, and subject to law and third-party rights, the customer may use output generated for its workspace. Output may not be unique and may resemble output provided to others. Up does not warrant that output is protectable, non-infringing or exclusively owned. Feedback and notices You may provide feedback voluntarily. Up may use it without identifying you or disclosing confidential information. Send infringement notices with enough detail to identify the work, material, authority and requested action to hello@upsolai.com. Commercial, Records & Audit Audience: Paid customers and owners Billing truth, acceptance evidence, logs and operational records. Orders and payment The applicable confirmation identifies plan, modules, seats, price, billing period, currency, taxes, trial, promotion, renewal and cancellation. Payment processing is not active unless the product expressly confirms a configured provider. We do not store raw card details; a configured payment provider processes them under its terms. Audit and acceptance evidence We may retain the accepted document version, presented consent text, account or stable identity, source, timestamp, order and security events necessary to evidence the agreement and protect the service. Marketing consent is separate and optional. Logs are access-controlled and retained only as reasonably necessary or legally required. Version changes The displayed version and effective date identify these Terms. Material changes require reasonable advance notice and renewed acceptance when required by contract or law. Changes do not retroactively alter an accepted price lock, redeemed offer or accrued right without lawful agreement. Archived versions should remain downloadable. Taxes and records Prices exclude taxes unless shown otherwise. Each party is responsible for its own accounting and records. Any invoice, receipt, tax calculation or currency conversion must reflect the configured provider and jurisdiction; setup placeholders are not financial records. Governing Law & Disputes Audience: Everyone Ontario base terms with mandatory-law and consumer-forum safeguards. Ontario governing law Subject to the mandatory-law savings clause below, these Terms are governed by the laws of Ontario and the federal laws of Canada applicable there, without regard to conflict-of-law rules. Proposed forum For B2B disputes not resolved by good-faith escalation, the courts located in Toronto, Ontario have exclusive jurisdiction, unless a signed order provides otherwise. For consumers, this clause applies only where lawful and does not take away a right to bring a claim or complaint in the consumer's home jurisdiction or another forum required by mandatory law. Mandatory-law savings Nothing in these Terms chooses a law, forum, remedy, limitation, waiver or process that applicable law does not permit the parties to choose. Non-waivable consumer, privacy, employment, accessibility, competition and other statutory protections continue to apply. Severability and priority If a provision is invalid or unenforceable, it is adjusted only to the minimum extent lawful or severed, and the rest remains effective. A data-processing agreement controls for its subject; a signed order controls commercial specifics; the consumer section controls over a conflicting B2B clause for a consumer.