SaaS Subscription Agreement

MYFAQ SAAS SUBSCRIPTION AGREEMENT

Provider: Faciliter AI, SASU with share capital of EUR 1,000, registered with the Salon-de-Provence Trade and Companies Register under number 938 793 775, VAT number FR14938793775

Registered office: 100 chemin de Mireille, 13300 Salon-de-Provence, France

Contact: contact@myfaq.ai - +33 4 65 01 14 66

Version: 2.3 - Effective date: 2 November 2026

1. SCOPE, CONTRACT FORMATION AND PRECEDENCE

These General Terms and Conditions of Service and Use (the "Terms") govern the professional use of the MyFAQ software-as-a-service platform (the "Service") and all subscriptions ordered from Faciliter AI (the "Provider") by a business customer (the "Customer"). The Service is not offered to consumers.

The contract is formed when the Customer accepts these Terms during registration, places an order referring to them, or first uses the Service. A person accepting on behalf of a Customer represents that they have authority to bind it. The order or subscription page identifies the selected plan, billing cycle, price, included credits and any trial. If a signed order form expressly conflicts with these Terms, the order form prevails; otherwise these Terms, the Data Processing Terms in Appendix 1, the Acceptable Use Policy and the Privacy Policy apply in that order.

Customer purchase-order or procurement terms do not modify this contract unless expressly accepted in writing by the Provider. For personal-data processing, Appendix 1 prevails over conflicting general provisions; a signed data-processing addendum prevails over Appendix 1.

2. DEFINITIONS

• Authorised User: an employee, contractor or other person authorised by the Customer to use its account.
• Customer Content: documents, questions, answers, instructions, personal data and other material submitted to the Service by or for the Customer.
• AI Output: content generated by the Service using artificial intelligence.
• Credits: usage units consumed by specified Service operations.
• Subscription Term: the monthly, annual or other period shown when the plan is ordered.

3. ACCESS AND ACCEPTABLE USE

3.1 Right of use. Subject to payment and compliance with the contract, the Provider grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right to use the Service for its internal business purposes during the Subscription Term.

3.2 Accounts. The Customer is responsible for its Authorised Users, accurate account information, protecting credentials and promptly reporting suspected unauthorised access. Personal login credentials must not be shared. Authorising an application under Section 3.4 is not prohibited account sharing.

3.3 Restrictions. The Customer must comply with the Acceptable Use Policy and applicable law. It must not unlawfully access, disrupt, copy, resell, reverse engineer or circumvent the Service or its technical limits, except where a restriction is prohibited by mandatory law.

3.4 Authorised channels and automation. The Service may be used through supported web interfaces, APIs, MCP connections, AI agents and messaging applications, including ChatGPT, Claude and Microsoft Teams where made available for the selected plan. An Authorised Application is an application or agent authorised by the Customer or its Authorised Users to act on their behalf. Such access is not a transfer or sublicense. The Customer is responsible for the permissions and instructions it grants, resulting actions and Credit consumption. Access remains subject to user permissions, subscription limits and security controls. Use scoped tokens or supported authorisation methods rather than disclosing personal passwords. Automated use is permitted within these limits; it must not bypass controls or degrade the Service.

3.5 Customer-selected third-party applications. By enabling an external application, the Customer instructs the Provider to transmit the content and results needed for the authorised functions, subject to applicable law and third-party data restrictions. The external service has its own terms, retention, security, AI-training settings and processing locations, which the Customer must assess. Disconnecting it stops future authorised access but does not erase copies already held externally. The Provider remains responsible for its own integration and legal obligations; it does not warrant external services it does not control. This allocation does not exempt the Provider from responsibility for its own suppliers under Appendix 1.

4. ORDERS, PRICES, PAYMENT AND CREDITS

4.1 Prices and taxes. The price, currency and billing cycle displayed at checkout or in an order form apply to the subscription. Prices are exclusive of VAT and other taxes unless stated otherwise. The Customer is responsible for applicable taxes other than taxes on the Provider's income.

4.2 Billing. Subscription fees are billed in advance through the stated payment method. The Customer authorises recurring charges for each renewal. Invoices are due on the date shown on the invoice; where no date is shown, payment is due within 30 days of issue. No discount is granted for early payment.

4.3 Late payment. Without reminder, overdue B2B amounts bear interest from the day after the due date at the European Central Bank refinancing rate applicable on 1 January or 1 July, as relevant, plus 10 percentage points, subject to the statutory minimum. A fixed recovery charge of EUR 40 is also due for each overdue invoice, without prejudice to documented additional recovery costs permitted by law.

4.4 Credits. Included subscription Credits reset at the end of each billing cycle and do not roll over. Separately purchased Credit packs expire 12 months after purchase unless the order states otherwise. Credits have no cash value and are non-transferable. Consumption rates are shown in the Service. The Provider may change future rates on at least 30 days' notice; a materially adverse change does not apply before the next renewal unless required for security, law or an unavoidable third-party change.

4.5 Refunds. Except where mandatory law requires otherwise, fees and used or expired Credits are non-refundable. This does not limit the Customer's remedies for a proven material breach by the Provider. If the Customer validly terminates under Section 10 for the Provider's uncured material breach, prepaid subscription fees attributable to the unused period after termination will be refunded. No double recovery is due; other mandatory remedies remain unaffected.

5. TERM, RENEWAL, CANCELLATION AND SWITCHING

5.1 Renewal. The subscription renews automatically for successive periods equal to the selected billing cycle unless cancelled before renewal through the account settings or the stated billing portal.

5.2 Cancellation. The Customer may initiate cancellation at any time, with no notice period beyond any technical confirmation required by the Service. Cancellation does not erase amounts already due. Access may end when cancellation is confirmed, as clearly indicated in the cancellation flow. The Customer should export needed data before cancelling.

5.3 Data retrieval and deletion. On cancellation, termination or expiry, the Customer may request reasonable export assistance at contact@myfaq.ai for 30 calendar days before scheduled deletion. Where Section 5.4 applies, this retrieval period starts after the agreed switching transition ends and any longer mandatory period prevails; Section 5.2 does not shorten that transition or retrieval period. Exportable data includes submitted documents, knowledge-base content, questions, answers, AI Output, project data and customer-specific metadata and settings required by law, in available structured, commonly used, machine-readable formats or formats required by law. Provider software, model weights and internal security secrets are excluded only to the extent permitted by law and without obstructing switching. Active-system deletion follows the retrieval period, subject to legal retention and backup rotation. Backup restoration is not guaranteed.

5.4 Switching. Where Chapter VI of Regulation (EU) 2023/2854 (the EU Data Act) applies, the Provider will support switching and data portability as required by that Regulation. The switching notice period will not exceed two months and the mandatory transition period will not exceed 30 calendar days unless the Regulation permits an extension. The Customer will cooperate, protect exported data and pay any charges still permitted by mandatory law and disclosed in advance.

6. SERVICE OPERATION, CHANGES AND SUPPORT

The Provider will use reasonable professional care to operate and secure the Service. Temporary interruption may occur for maintenance, security, capacity, third-party failures or events beyond reasonable control. Unless a separate service-level agreement is signed, no specific uptime or response time is guaranteed. Features may evolve; the Provider will give reasonable advance notice of a change that materially reduces core paid functionality and, if the reduction is materially adverse and not legally or security required, the Customer may cancel before it takes effect.

6.1 Third-party infrastructure and AI services. The Service relies on third-party hosting infrastructure and third-party AI models, APIs and related services, including services supplied by providers such as Google, Mistral and OVH. To the fullest extent permitted by law, the Provider is not liable for downtime, service degradation, latency, policy or model changes, suspension or unavailability attributable to those third-party providers and outside the Provider's reasonable control. Such an event does not constitute a breach of any availability commitment unless a signed service-level agreement expressly provides otherwise.

6.2 Optional preview features. Features expressly identified as beta or preview are optional, may change or be withdrawn, and have no separate availability or accuracy guarantee unless agreed in writing. Do not rely on them for critical operations. Existing confidentiality, data-protection obligations and mandatory legal rights continue to apply.

6.3 Support access. A support request authorises access to the Customer's instance and relevant content only as reasonably necessary to investigate and resolve that request. Such access remains subject to confidentiality and Appendix 1. No particular support response time is promised unless expressly agreed.

7. ARTIFICIAL INTELLIGENCE

7.1 Human review. AI Output is probabilistic and may be incomplete, inaccurate or unsuitable. It is a drafting aid, not professional advice or an authoritative source. The Customer remains responsible for human review, source verification and decisions made using AI Output, especially before submitting tenders, contracts, quotations or other external communications. The Customer must make any disclosure about AI assistance that is required by applicable law or its own contractual duties.

7.2 Strict obligation of means. The Provider's commitments concerning AI Output are strict obligations to use reasonable professional means and not obligations to achieve any particular result. The Provider does not warrant that AI Output is accurate, complete or fit for a particular purpose, or that it satisfies any regulatory or legal requirement or any requirement specific to a contracting authority, purchaser, prospect, tender, RFP or RFI. The Customer must obtain appropriate professional review where needed.

7.3 Customer indemnity. The Customer will defend and indemnify the Provider against third-party claims arising from Customer Content that infringes rights or violates law, or from the Customer's use of the Service or AI Output in breach of this contract. This does not apply to the extent attributable to the Provider's own breach, negligence or liability that cannot lawfully be excluded. The Provider will give prompt notice and reasonable cooperation at the Customer's expense. The Customer controls the defence but may not admit the Provider's liability, require payment from it or impose non-monetary obligations without its written consent. A notice delay excuses the obligation only to the extent it prejudices the defence.

8. CUSTOMER CONTENT, INTELLECTUAL PROPERTY AND CONFIDENTIALITY

8.1 Customer Content. The Customer retains its rights in Customer Content and grants the Provider only the rights necessary to host, copy, transmit and process it to provide, secure and support the Service. The Customer confirms that it has the rights and lawful basis needed to submit Customer Content.

8.2 Internal improvement and third-party LLMs. The third-party LLM providers engaged by the Provider are contractually prohibited from using Customer Content to train or fine-tune their models. The Provider may process Customer Content internally to assess and improve the Service's functionality, retrieval, response quality, reliability and security, within the agreed processing purposes and the Customer's documented instructions, subject to confidentiality, applicable data-protection law and source-data restrictions. Where an improvement purpose falls outside those instructions, only irreversibly anonymised aggregate data may be used unless a separate lawful authorisation and any required legal basis have been obtained. Anonymisation must prevent identification of the Customer or individuals and reconstruction of the original content by reasonably likely means; pseudonymisation alone is insufficient. The Provider will not attempt re-identification and will maintain and periodically review appropriate safeguards. External applications selected by the Customer are addressed in Section 3.5; this does not waive restrictions on the Provider's onward disclosure.

8.3 Provider rights. The Provider and its licensors retain all rights in the Service, software, documentation, models and improvements. No ownership transfers under these Terms.

8.4 Confidentiality. Each party will protect the other party's non-public business, technical and commercial information with at least reasonable care, use it only to perform the contract and disclose it only to persons who need it and are bound by confidentiality. This does not cover information that is public without breach, already lawfully known, independently developed or lawfully received from a third party. A legally compelled disclosure is permitted after advance notice where lawful. Customer Content and non-public AI Output are Confidential Information without requiring a confidentiality marking, subject to the exceptions above.

8.5 AI Output rights. As between the parties, the Customer retains its rights in Customer Content. To the extent permitted by law, the Provider assigns any transferable economic rights it holds in each AI Output when generated, including reproduction, distribution, communication to the public, translation and adaptation, worldwide for the duration of those rights, for the Customer's internal and external business purposes, on paper and digital media, with consideration included in the Service price. This overrides Section 8.3 only for such Output rights. It does not transfer Service, model or third-party rights, warrant copyright protection or non-infringement, or make Output exclusive: others may receive similar results.

8.6 Voluntary feedback. The Customer permits the Provider to use voluntary product suggestions without payment or attribution. This permission excludes Customer Content, AI Output and confidential information and does not override training restrictions.

9. DATA PROTECTION AND SECURITY

Each party will comply with applicable data-protection law. For account, billing, security and direct relationship data, the Provider acts as an independent controller as described in the Privacy Policy. For personal data contained in Customer Content that the Provider processes on the Customer's behalf, the Customer is controller and the Provider is processor, and Appendix 1 applies. Data is hosted in the region selected or assigned to the Customer; any restricted international transfer will use a legally recognised transfer mechanism. The Provider maintains appropriate technical and organisational security measures proportionate to risk.

10. SUSPENSION AND TERMINATION FOR CAUSE

The Provider may suspend affected access where reasonably necessary to address a security risk, unlawful use, non-payment, breach of the Acceptable Use Policy or a threat to the Service or third parties. Where practicable, it will give notice and an opportunity to remedy. Either party may terminate for a material breach not cured within 30 days after written notice, or immediately if the breach cannot be cured, the other party becomes insolvent, or continued performance would be unlawful. Sections intended by their nature to survive termination remain effective.

11. WARRANTIES AND LIABILITY

11.1 Warranties. Each party warrants it has authority to enter into the contract. The Provider warrants that it will perform the Service with reasonable professional care. Except for express warranties in the contract and to the extent permitted by law, implied warranties are excluded.

11.2 Excluded loss. Neither party is liable for indirect, incidental, special or consequential loss, or loss of profit, revenue, anticipated savings, goodwill or business opportunity. To the fullest extent permitted by law, expressly excluded, whether arising directly or indirectly from content produced by the Service, are any loss of chance, loss of market or business, loss of award of an RFP or RFI, unsuccessful tender or missed conclusion of a commercial contract, even if such loss was foreseeable or the party had been advised of its possibility.

11.3 Overall annual aggregate cap. Subject to Sections 11.4 and 11.5 and 11.6, each party's total aggregate liability for all events, acts, omissions and claims arising from or relating to the contract in any consecutive 12-month period is limited to the fees paid or payable by the Customer for the Service during the 12 months preceding the first event giving rise to liability in that period. This is a single, non-cumulative annual aggregate cap, regardless of the number of events, claims, claimants or legal grounds. If the Service was free, the Provider's aggregate cap is EUR 1,000.

11.4 AI sub-cap. Within, and not in addition to, the cap in Section 11.3, the Provider's total aggregate liability for all claims arising from or relating to AI Output in any consecutive 12-month period is limited to the fees paid or payable for the Service during the six (6) months preceding the first event giving rise to such liability. If the Service was free, this AI sub-cap is EUR 500. The sub-cap is aggregate regardless of the number of AI Outputs, events or claims.

11.5 Exceptions. Nothing excludes or limits payment obligations, the Customer's indemnity under Section 7.3, fraud or wilful misconduct, gross negligence, death or personal injury, or liability that mandatory law does not allow to be excluded or limited. No limitation deprives an essential contractual obligation of its substance or limits statutory rights of data subjects or powers of regulators.

11.6 Confidentiality and intellectual-property cap. Subject to Section 11.5, aggregate liability for breach of confidentiality or infringement of the other party's intellectual-property rights is capped at twice the fees paid or payable in the reference period in Section 11.3 (EUR 2,000 for a free Service). This replaces the ordinary and AI caps for those claims; caps are not cumulative and the same loss cannot be recovered twice. No provider IP defence or indemnity is granted unless separately agreed in writing.

12. GENERAL

The parties are independent contractors. Neither may assign the contract without the other's consent, not to be unreasonably withheld, except that either may assign it with its business or relevant assets on written notice. The Provider may use subcontractors and remains responsible to the extent required by applicable law and Appendix 1, subject to the express third-party dependency allocation in Section 6. Neither party is liable for delay caused by an event beyond its reasonable control, but payment obligations already due are not excused. If a provision is unenforceable, it will be adjusted only as needed and the remainder will continue. Failure to enforce is not a waiver.

The Provider may update these Terms for legal, security or operational reasons. Material changes will be notified on a durable medium at least 30 days before they take effect. Changes do not retroactively alter an already paid fixed term; if a materially adverse change takes effect at renewal, the Customer may cancel before renewal. Notices may be sent to the registered email address and are deemed received when sent, absent a delivery failure.

13. GOVERNING LAW AND DISPUTES

13.1 Governing law and amicable resolution. French law governs the contract, without regard to conflict-of-law rules. The parties will first attempt in good faith for 30 days to resolve a dispute through their authorised representatives.

13.2 Jurisdiction. Except where Section 13.3 applies, WHERE BOTH PARTIES ARE MERCHANTS, ANY DISPUTE FALLING WITHIN ITS SUBJECT-MATTER JURISDICTION IS SUBJECT TO THE EXCLUSIVE JURISDICTION OF THE COMMERCIAL COURT OF SALON-DE-PROVENCE, INCLUDING IN SUMMARY PROCEEDINGS, WARRANTY CLAIMS OR PROCEEDINGS INVOLVING MULTIPLE DEFENDANTS. Mandatory jurisdiction rules remain unaffected.

13.3 International arbitration. Where the Customer's registered office is outside the European Union and European Economic Area, any dispute arising out of or in connection with the contract will be finally settled under the Rules of Arbitration of the International Chamber of Commerce by one arbitrator appointed in accordance with those Rules. The seat of arbitration will be Paris, France; the language will be English; and French law will govern the merits and the arbitration agreement. Either party may seek urgent interim or conservatory relief from a competent court without waiving arbitration.

13.4 Waivers and time limit. To the fullest extent permitted by applicable law, each party waives any right to trial by jury or to bring or participate in any class, collective, consolidated or representative action or proceeding against the other; disputes must be brought only on an individual basis. Any claim arising out of or relating to these Terms or the Service must be filed within one (1) year after the claim arose, otherwise it is permanently barred. This contractual limitation does not apply where, and only to the extent that, applicable mandatory law prohibits shortening the limitation period.

APPENDIX 1 - DATA PROCESSING TERMS

A.1 Roles, instructions and details. The Provider processes personal data in Customer Content only on documented instructions from the Customer, including these Terms and configured use of the Service, unless applicable law requires otherwise. The subject matter is provision of the Service; duration is the contract plus the deletion period; nature and specific business purposes include hosting, indexing, retrieval, AI-assisted generation, support, security and deletion. Data may include identity, contact, employment, document and usage information about the Customer's personnel, prospects, suppliers, clients and other persons whose data the Customer submits. The Customer is responsible for lawful instructions, notices and legal bases. Where the GDPR applies, the Customer is controller and the Provider processor. Where the CCPA/CPRA applies, the Customer is the Business and the Provider is its Service Provider or Contractor. Where the LGPD applies, the Customer is the Controlador and the Provider is the Operador. The Provider will not sell or share Customer personal information and will not retain, use or disclose it outside the limited and specific business purposes stated above, except as permitted by applicable law. Documented instructions also cover internal assessment and improvement of Service functionality, retrieval, response quality, reliability and security within the agreed purposes, subject to Section 8.2 and applicable source-data restrictions.

A.2 Personnel and security. Persons authorised to process the data are bound by confidentiality. The Provider will implement measures appropriate under Article 32 GDPR, including access control, tenant separation, encryption in transit and at rest where supported, logging, backup and recovery processes, vulnerability management and incident procedures.

A.3 Sub-processors. The Customer gives general written authorisation for sub-processors necessary to deliver the Service. The Provider will maintain information on material sub-processors and give reasonable advance notice of additions or replacements, enabling the Customer to object on reasonable data-protection grounds. The Provider will impose substantially equivalent data-protection obligations and remains responsible for its sub-processors as required by law.

A.4 Assistance and incidents. Taking account of the nature of processing and information available, the Provider will reasonably assist the Customer with data-subject requests, security, breach notification, impact assessments and prior consultation obligations. It will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Content and provide available information needed for the Customer's obligations.

A.5 Return, deletion and audits. At the end of the Service, the Provider will, at the Customer's choice where technically available, return or delete personal data and existing copies, unless law requires retention. On reasonable written request, the Provider will provide information necessary to demonstrate compliance with Article 28 GDPR and allow proportionate audits, preferably through current independent reports. On-site audits require reasonable notice, confidentiality, no disruption, no access to other customers' data and reimbursement of reasonable costs unless the audit reveals a material breach.

A.6 International transfers, local authorisations and unlawful instructions. The Provider will not make a restricted transfer without a valid legal mechanism, such as an adequacy decision or applicable standard contractual clauses. The Customer is solely responsible for identifying and obtaining any prior declaration, notification, approval or transfer authorisation required by the data-protection authority in the Customer's country of establishment before submitting personal data to the Service, including any declaration or authorisation required from Morocco's CNDP under Law No. 09-08 for a transfer from Morocco to the European Union or another foreign country. On reasonable request, the Provider will supply available information needed for such filing. The Provider may suspend the affected processing until the Customer provides reasonable evidence of compliance. It will promptly inform the Customer if, in its opinion, an instruction infringes applicable data-protection law and may suspend that instruction while the parties resolve the issue.