LIQUID INFERENCE DATA PROCESSING AGREEMENT

This Data Processing Agreement (“Agreement”) forms part of the Liquid Inference Terms of Service or other agreement for the Liquid Inference services (“Principal Agreement”) between

the customer that accepts this Agreement as described below (the “Customer”)

and

Architect Financial Technologies Inc.

1 E Erie St, Suite 525-5211

Chicago, IL 60611

Notice email: [email protected]

(the “Data Processor” or “Processor”)

(together, the “Parties”)

WHEREAS

(A) The Customer acts as a Data Controller.

(B) The Customer wishes to use the Services, which involve the processing of personal data, and to have the Data Processor perform that processing on its behalf.

(C) The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), and the other Data Protection Laws.

(D) The Parties wish to lay down their rights and obligations.

IT IS AGREED AS FOLLOWS:

Acceptance. The Customer accepts this Agreement by clicking “I agree” (or a similar button or checkbox) where this Agreement is presented, or by accepting the Principal Agreement where it incorporates this Agreement, effective on the date of that acceptance (the “Effective Date”). The individual who accepts confirms that they are authorized to bind the Customer. No signature is required. Processor will keep a record of each acceptance.

1. Definitions and Interpretation

1.1 Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:

1.1.1 “Agreement” means this Data Processing Agreement and all Schedules;

1.1.2 “Applicable Laws” means all laws, regulations, and binding orders that apply to a Party in connection with this Agreement, including Data Protection Laws;

1.1.3 “Customer Content” means the prompts, inputs, files, and other content the Customer or its authorized users submit to the Services (“Prompts”), and the responses generated by Inference Providers and returned through the Services (“Outputs”);

1.1.4 “Customer Personal Data” means any Personal Data contained in Customer Content, or otherwise Processed by a Contracted Processor on behalf of the Customer, pursuant to or in connection with the Principal Agreement. It excludes Usage Metadata and the Customer’s account and billing information, which the Processor processes as an independent controller under its Privacy Policy located at: https://architect.co/legal/architect-financial-technologies-inc/privacy-policy/;

1.1.5 “Contracted Processor” means the Processor or a Subprocessor;

1.1.6 “Data Protection Laws” means EU Data Protection Laws and, to the extent applicable, the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), US State Privacy Laws, Canada’s Personal Information Protection and Electronic Documents Act and applicable provincial laws, Brazil’s Lei Geral de Proteção de Dados (“LGPD”), and the data protection or privacy laws of any other country, in each case as amended or replaced;

1.1.7 “EEA” means the European Economic Area;

1.1.8 “EU Data Protection Laws” means the GDPR and the laws of the European Union and its Member States implementing or supplementing the GDPR;

1.1.9 “GDPR” means EU General Data Protection Regulation 2016/679;

1.1.10 “Data Transfer” means:

1.1.10.1 a transfer of Customer Personal Data from the Customer to a Contracted Processor; or

1.1.10.2 an onward transfer of Customer Personal Data from a Contracted Processor to another Subprocessor, or between two establishments of a Contracted Processor,

in each case, where such transfer would be prohibited by Data Protection Laws in the absence of a transfer mechanism described in Section 11;

1.1.11 “Inference Provider” means a third party that offers model inference capacity through the Services and that Processes Customer Content to fulfil a Customer request routed to it;

1.1.12 “Routing Settings” means the configuration settings the Customer selects in the Services governing how its requests are routed, including permitted or excluded Inference Providers, models, and regions, whether to route requests only to ZDR Listings, and whether to permit routing to Training Listings;

1.1.13 “Services” means the Liquid Inference AI inference platform services, available at inference.ai.exchange, that the Processor provides to the Customer under the Principal Agreement;

1.1.14 “Standard Contractual Clauses” means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021;

1.1.15 “Subprocessor” means any person, including an Inference Provider, appointed by or on behalf of the Processor to process Personal Data on behalf of the Customer in connection with the Agreement;

1.1.16 “Usage Metadata” means technical and transactional information about use of the Services that does not include the substance of Customer Content, such as timestamps, token counts, model identifiers, latency, routing decisions, prices, and error codes;

1.1.17 “US State Privacy Laws” means the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations, and all other comprehensive US state consumer privacy laws, to the extent they apply to the Processing of Customer Personal Data;

1.1.18 “Data Policy Designation” means the designation an Inference Provider gives each model it offers through the Services, as a “ZDR Listing” (Section 2.4.2), a “Limited Retention Listing” (Section 2.4.3), or a “Training Listing” (Section 2.6), displayed in the Services together with any retention period, retention purposes, training use, and human review the Inference Provider has disclosed.

1.2 The terms “Commission”, “Controller”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Supervisory Authority” shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly. Where other Data Protection Laws apply, those terms include their closest equivalents (such as “personal information,” “business,” and “service provider”).

2. Processing of Customer Personal Data

2.1 Processor shall:

2.1.1 comply with all applicable Data Protection Laws in the Processing of Customer Personal Data;

2.1.2 not Process Customer Personal Data other than on the Customer’s documented instructions, unless required to do so by Applicable Laws, in which case Processor shall inform the Customer of that legal requirement before Processing, unless those laws prohibit it; and

2.1.3 promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

2.2 The Customer instructs Processor to Process Customer Personal Data to provide, secure, and support the Services, including by routing Prompts to Inference Providers in accordance with the Customer’s Routing Settings and returning Outputs. Inference Providers Process Customer Content as Processor’s Subprocessors, subject to Sections 2.4 and 2.5. This Agreement, the Principal Agreement, and the Customer’s Routing Settings constitute the Customer’s complete instructions. The subject matter, duration, nature, and purpose of the Processing, and the types of Personal Data and categories of Data Subjects, are described in Schedule 1.

2.3 The Customer is responsible for having a lawful basis, and for providing any notices and obtaining any consents, required for the Processing of Customer Personal Data under this Agreement.

2.4 Data Retention.

2.4.1 Processor processes Prompts and Outputs only in transit and in memory, for the time necessary to route each request to an Inference Provider and return the Output. Processor does not store the content of Prompts or Outputs in its databases, logs, or backups.

2.4.2 Each model offered through the Services carries a Data Policy Designation. For a ZDR Listing, Processor requires the Inference Provider, by written contract, to Process Customer Content only for the time necessary to complete the request and return the Output, and then to discard it without writing it to persistent storage, logs, backups, or monitoring tools. The Inference Provider may (a) keep short-lived caches in volatile memory that cannot be accessed by other customers’ requests and expire, and (b) screen requests with automated safety classifiers, in each case without retaining Customer Content.

2.4.3 For a Limited Retention Listing, Processor requires the Inference Provider, by written contract, to retain Customer Content only for the period disclosed in its Data Policy Designation and only to detect and prevent abuse, protect safety and security, and comply with law; to encrypt it and restrict access to it; not to use it for any other purpose; and then to delete it. Human review is permitted only where disclosed in the Data Policy Designation or required by law.

2.4.4 The Customer may set its Routing Settings to route requests only to ZDR Listings. If it does not, its requests may be routed to Limited Retention Listings. Processor verifies Inference Providers’ commitments through annual attestations and will suspend routing to an Inference Provider it reasonably believes is not complying. Processor does not operate Inference Providers’ systems but remains responsible for them as set out in Section 5.4.

2.4.5 Processor may retain Usage Metadata, which contains no Customer Content, for operating, securing, and billing for the Services. Operational logs and billing records are retained for up to five (5) years or as required by Applicable Laws. Inference Providers may retain operational metadata that contains no Customer Content (such as timestamps, request identifiers, token counts, and error codes) for billing, capacity planning, and security, and may not use it to identify the Customer or any individual.

2.4.6 Where Applicable Laws or a binding order require Processor to retain Customer Personal Data, it shall retain only the minimum required, protect it under this Agreement, and delete it when the requirement ends.

2.5 Processor shall not use Customer Content to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, whether or not the data is anonymized or aggregated. Processor shall require each Inference Provider, by written contract, not to use Customer Content to train, fine-tune, evaluate, or otherwise improve any artificial intelligence or machine learning model, or for benchmarking or product improvement, whether or not the data is de-identified, anonymized, or aggregated, and not to combine Customer Content with other data. Processor shall not sell or share Customer Personal Data, or retain, use, or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Services. To the extent US State Privacy Laws apply, Processor acts as the Customer’s service provider or contractor, and certifies that it understands and will comply with these restrictions.

2.6 Despite Section 2.5, some Inference Providers may offer models designated as “Training Listings,” for which they use Customer Content to train or improve their own models. Processor will route the Customer’s requests to a Training Listing only if the Customer turns on that option in its Routing Settings, which is off by default. If the Customer does so: (a) the Customer shall not include any Personal Data in those requests; (b) the Inference Provider uses that Customer Content as an independent controller under the training terms disclosed in its listing, and not as Processor’s Subprocessor; (c) Customer Content used for training may not be capable of deletion or return; and (d) Processor relies on the Inference Provider’s disclosures and does not warrant its training practices. The Customer may turn the option off at any time, which applies to future requests only.

3. Processor Personnel

Processor shall take reasonable steps to ensure the reliability of any employee, agent, or contractor of any Contracted Processor who may have access to Customer Personal Data. Processor shall ensure in each case that access is strictly limited to those individuals who need to access the relevant Customer Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Laws in the context of that individual’s duties to the Contracted Processor. Processor shall ensure that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

4. Security

4.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall, in relation to Customer Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR and the measures described in Schedule 2.

4.2 In assessing the appropriate level of security, Processor shall take account of the risks presented by Processing, in particular from a Personal Data Breach.

4.3 The Customer is responsible for securing its accounts, credentials, and API keys, and for configuring its Routing Settings appropriately.

5. Subprocessing

5.1 Processor shall not appoint (or disclose any Customer Personal Data to) any Subprocessor unless required to use the Services or as otherwise authorized by the Customer.

5.2 The Customer grants Processor general authorization to engage the Subprocessors, including Inference Providers, listed at inference.ai.exchange. Processor shall give at least thirty (30) days’ notice before a new Subprocessor Processes Customer Personal Data. A new Inference Provider shall not receive the Customer’s requests before the notice period ends, unless the Customer’s Routing Settings permit it. Each Inference Provider’s subcontractors that Process Customer Personal Data, including hosting providers, are disclosed in its listing in the Services and may be engaged only with Processor’s approval.

5.3 The Customer may object to a new Subprocessor on reasonable, documented data protection grounds within fifteen (15) days of notice. The Customer may resolve an objection to an Inference Provider by excluding it through its Routing Settings. If an objection to any other Subprocessor cannot be resolved in good faith within thirty (30) days, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees, as its sole remedy.

5.4 Processor shall impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this Agreement, including the retention and use restrictions in Sections 2.4 and 2.5 that apply to each Inference Provider’s Data Policy Designation. Processor remains responsible to the Customer for its Subprocessors’ performance of those obligations, to the extent required by Data Protection Laws.

6. Data Subject Rights

6.1 Taking into account the nature of the Processing, Processor shall assist the Customer by implementing appropriate technical and organizational measures, insofar as this is possible, to fulfil the Customer’s obligations to respond to requests to exercise Data Subject rights under Data Protection Laws. Because Processor does not retain Customer Content, Processor will generally hold no Customer Content to which such a request could apply. Inference Providers with a Limited Retention Listing may hold Customer Content for their disclosed retention period (Section 2.4.3). Where relevant, Processor will forward requests to them and require them to assist.

6.2 Processor shall:

6.2.1 promptly notify the Customer if it receives a request from a Data Subject under any Data Protection Law in respect of Customer Personal Data; and

6.2.2 ensure that it does not respond to that request except on the documented instructions of the Customer or as required by Applicable Laws to which the Processor is subject. In that case, Processor shall, to the extent permitted by Applicable Laws, inform the Customer of that legal requirement before the Contracted Processor responds to the request.

7. Personal Data Breach

7.1 Processor shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data**.** Processor shall provide the Customer with sufficient information, as it becomes available, to allow the Customer to meet any obligations to report the Personal Data Breach to Supervisory Authorities or inform Data Subjects under Data Protection Laws. For a Personal Data Breach at a Subprocessor, this period runs from when Processor becomes aware of it.

7.2 Processor shall co-operate with the Customer and take reasonable commercial steps as are directed by the Customer to assist in the investigation, mitigation, and remediation of each such Personal Data Breach.

7.3 Processor’s notification of or response to a Personal Data Breach is not an acknowledgment of fault or liability.

8. Data Protection Impact Assessment and Prior Consultation

Processor shall provide reasonable assistance to the Customer with any data protection impact assessments, and prior consultations with Supervisory Authorities or other competent data privacy authorities, which the Customer reasonably considers to be required by Article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law. This assistance applies solely to Processing of Customer Personal Data by, and takes into account the nature of the Processing and information available to, the Contracted Processors.

9. Deletion or Return of Customer Personal Data

9.1 Subject to this Section 9, Processor shall promptly, and in any event within ten (10) business days of the date of cessation of any Services involving the Processing of Customer Personal Data (the “Cessation Date”), delete all copies of any Customer Personal Data still held by Processor, and require its Subprocessors to delete any Customer Personal Data they hold. Inference Providers with a Limited Retention Listing delete Customer Content at the end of their disclosed retention period (Section 2.4.3).

9.2 Processor may retain Customer Personal Data where required by Applicable Laws, subject to Section 2.4.6. Any Customer Personal Data in backups shall be kept isolated from further Processing and deleted in the ordinary backup cycle.

9.3 Processor shall provide written certification to the Customer that it has fully complied with this Section 9 within ten (10) business days of the Customer’s written request.

10. Audit Rights

10.1 Subject to this Section 10, Processor shall make available to the Customer on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer in relation to the Processing of Customer Personal Data by the Contracted Processors.

10.2 Information and audit rights of the Customer only arise under Section 10.1 to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.

10.3 Processor may first satisfy a request under Section 10.1 by providing its current third-party audit reports or certifications, security documentation, and any Inference Provider reports or attestations made available to Processor. The Customer may conduct one audit in any twelve (12) month period, on at least thirty (30) days’ notice, during business hours, and subject to confidentiality obligations. Additional audits are permitted following a confirmed Personal Data Breach or where a Supervisory Authority requires it. The Customer bears its own audit costs, unless Data Protection Laws require otherwise. Audits of Inference Providers are conducted through the reports, certifications, and annual attestations they provide to Processor and, where Data Protection Laws require, through audits that Processor conducts or arranges under its agreements with them.

11. Data Transfer

11.1 The Customer authorizes Contracted Processors to transfer Customer Personal Data to countries outside the EEA, the United Kingdom, Switzerland, and the Customer’s own country, provided the personal data is adequately protected. The Customer may restrict the regions and Inference Providers that Process its requests through its Routing Settings, and Processor shall honor those restrictions. Each Inference Provider Processes requests only in the countries disclosed in its listing in the Services.

11.2 To ensure adequate protection, the Parties shall, unless agreed otherwise, rely on the following transfer mechanisms:

11.2.1 for the EEA: the Standard Contractual Clauses, Module Two (controller to processor), which are incorporated by reference. Clause 7 (docking) applies. Under Clause 9, Option 2 applies, with the notice period in Section 5.2. Clause 11’s optional language does not apply. Clauses 17 and 18 select Ireland. Annexes I and II are completed by Schedules 1 and 2. The Customer’s acceptance of this Agreement constitutes its execution of the Standard Contractual Clauses;

11.2.2 for the United Kingdom: the Standard Contractual Clauses as supplemented by the UK Information Commissioner’s International Data Transfer Addendum;

11.2.3 for Switzerland: the Standard Contractual Clauses, with references to the GDPR read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner as the competent authority;

11.2.4 for Brazil: the standard contractual clauses approved under ANPD Resolution CD/ANPD No. 19/2024; and

11.2.5 for any other jurisdiction: any transfer mechanism required by the applicable Data Protection Laws, which the Parties shall cooperate in good faith to put in place.

11.3 The transfer mechanisms in this Section 11 prevail over the rest of this Agreement to the extent of any conflict.

11.4 Processor shall put in place any transfer mechanism required by Data Protection Laws for onward transfers to Subprocessors.

12. General Terms

12.1 Confidentiality. Each Party must keep this Agreement, and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”), confidential. Neither Party may use or disclose that Confidential Information without the prior written consent of the other Party, except to the extent that:

(a) disclosure is required by law; or

(b) the relevant information is already in the public domain.

12.2 Notices. All notices and communications given under this Agreement must be in writing and will be sent by email. Notices to Processor must be sent to [email protected]. Notices to the Customer will be sent to the email address associated with its account. Processor may also give general notices, including Subprocessor notices under Section 5.2, through the Services.

12.3 Order of precedence. For the Processing of Customer Personal Data, this Agreement prevails over the Principal Agreement in the event of any conflict, except that all obligations of this Agreement should be read as additive with respect to Section 5.4 of the Liquid Inference Terms of Service.

12.4 Liability. Each Party’s liability arising out of or in connection with this Agreement is subject to the limitations and exclusions of liability in the Principal Agreement, except where Data Protection Laws do not permit such limitation.

12.5 Updates. Processor may update this Agreement on at least thirty (30) days’ notice under Section 12.2, or sooner where required by Data Protection Laws. Continued use of the Services after an update takes effect constitutes acceptance, except that an update that materially reduces the protection of Customer Personal Data requires the Customer’s affirmative acceptance before the Customer may continue to use the Services. If the Customer does not accept an update, it may stop using the Services and terminate the Principal Agreement before the update takes effect.

13. Governing Law and Jurisdiction

13.1 This Agreement is governed by the laws of New York without regard to conflict of law principles, except that the Standard Contractual Clauses are governed as set out in Section 11.2.

13.2 Any claim or action brought by one of the parties in connection with this Agreement will be brought in the appropriate Federal or State court located in the County of New York, and the parties irrevocably consent to the exclusive jurisdiction of such court.

Schedule 1 — Details of Processing

Schedule 2 — Technical and Organizational Measures