Security, Privacy & Legal Policies

1. Introduction

Iqidis, Inc. (“Iqidis,” “we,” “us,” or “our”) is committed to protecting privacy and safeguarding information.

This Privacy & Data Policy explains how we collect, use, disclose, secure, and retain information when you use the Irys legal AI platform, our websites, and related applications and services (collectively, the “Services”).

“Irys” is a product name and brand of Iqidis, Inc. and is not a separate legal entity.

This Policy should be read together with our Terms of Service, Acceptable Use Policy, Cookie Policy, Disclaimer, and Service Providers & Subprocessors Policy.

2. Scope and Roles

This Policy applies to:

• customers and authorized users of the Services;
• visitors to our websites;
• prospective customers who interact with us through demos, events, forms, or other communications; and
• other individuals whose information we process in connection with operating the Services.

Organization Customers

Where an organization uses Irys and determines the purposes and means of processing Customer Content, the organization acts as the controller and Iqidis generally acts as its processor or service provider.

Authorized Users act on behalf of the applicable organization.

Customer Content and Output remain subject to the ownership provisions in the Terms of Service and applicable customer agreements.

Iqidis as Controller

Iqidis may act as a controller for information it processes for its own legitimate business purposes, including account administration, billing, website operations, security, fraud prevention, legal compliance, and marketing communications.

3. Information We Collect

Information You Provide

We may collect:

• Account and Profile Information: such as name, email address, organization, role, and authentication information.
• Billing Information: payment and billing information processed through approved payment providers.
• Customer Content: documents, prompts, files, text, and other information submitted to or generated through the Services.
• Support and Feedback: information provided through support requests, product feedback, or other communications.

Information Collected Automatically

We may collect limited operational information such as:

• IP address;
• browser and device information;
• timestamps;
• authentication and security events;
• general location information derived from IP; and
• interaction and performance metadata used to operate, secure, and improve the Services.

Ordinary operational telemetry is designed not to include the substantive contents of customer prompts, model outputs, or uploaded documents except where processing is reasonably necessary for an authorized support, security, incident-response, or legal-compliance purpose.

Information from Third Parties

We may receive limited information from service providers, security and fraud-prevention partners, event or marketing platforms, and other sources consistent with this Policy.

Publicly Available Information

Iqidis may use publicly available legal and other information to develop, operate, and improve the Services in accordance with applicable law.

4. How We Use Information

We may use information to:

• provide and operate the Services;
• process customer requests and generate Output;
• provide customer support;
• maintain account and billing functions;
• improve reliability, performance, and product functionality;
• detect and prevent fraud, misuse, and security threats;
• comply with legal obligations;
• enforce our agreements and policies;
• communicate service, administrative, and product updates; and
• analyze general usage patterns and performance.

Where Iqidis acts as a processor, Customer Personal Data is processed on the applicable customer’s documented instructions and in accordance with the applicable agreement and Data Processing Addendum, where applicable.

5. AI Processing and Customer Content

Irys uses a combination of Iqidis-controlled systems and approved third-party service providers to deliver the Services.

No Training on Customer Content

Iqidis does not use Customer Content to train Iqidis or third-party foundation models unless expressly agreed otherwise in writing.

Where third-party AI providers process Customer Content as part of the Services, they are subject to applicable contractual, privacy, security, and data-use controls.

Iqidis configures third-party AI services to restrict training and vendor-side retention or caching where supported and applicable to the Services.

Current providers are identified in our Service Providers & Subprocessors Policy.

Data Minimization

Iqidis seeks to limit data sent to third-party providers to information reasonably necessary to perform the applicable function.

Data Isolation

Customer Content is logically segregated by organization and applicable user or workspace controls.

Customer Content is not intentionally pooled with unrelated customers’ Customer Content for model training.

6. Access, Storage, and Retention

Authorized Access

Access to Customer Content by Iqidis personnel is limited to authorized purposes such as:

• providing customer support;
• troubleshooting technical issues;
• maintaining and securing the Services;
• investigating incidents;
• complying with legal obligations; and
• enforcing applicable agreements.

Access is subject to appropriate access controls and confidentiality obligations.

Customer Content Retention

Customer Content may be retained during an active subscription as necessary to provide the Services and according to applicable customer settings and agreements.

Upon termination or expiration, Customer Content is handled in accordance with the Terms of Service and, where applicable, the Data Processing Addendum.

Residual copies may remain temporarily in secure backup systems until overwritten in the ordinary course.

Operational Data

Operational logs and telemetry may be retained for periods reasonably necessary for security, reliability, fraud prevention, compliance, and service operation.

7. Sharing and Disclosure

Iqidis does not sell Customer Personal Data.

We may disclose information to:

• Service Providers and Subprocessors necessary to provide and secure the Services;
• professional advisors such as attorneys, auditors, and insurers;
• government authorities or regulators where legally required;
• business transaction participants in connection with a merger, acquisition, financing, or similar transaction, subject to appropriate protections;
• other Authorized Users where directed through the Services and applicable organization permissions; and
• other parties with your consent or at your direction.

Current service providers and subprocessors are listed in our Service Providers & Subprocessors Policy.

8. Organization Accounts

Where Customer Content is created within an Organization Account, that content is processed within the applicable organization context.

Organization administrators may manage users, roles, and organization-level controls.

Access to individual user workspaces is governed by the product’s applicable permissions and administrative features.

When an Authorized User is removed from an Organization, that user’s access to the applicable Organization Account is terminated. Customer Content associated with the Organization remains subject to the Organization’s rights and applicable agreement.

9. Security

Iqidis maintains technical and organizational measures designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, loss, and misuse.

These measures may include:

• encryption in transit and at rest;
• role-based and least-privilege access controls;
• authentication and identity-management controls;
• security logging and monitoring;
• vulnerability-management and security-testing processes;
• network and infrastructure protections;
• secure software-development practices; and
• incident-response procedures.

Iqidis maintains SOC 2 Type II attestation and ISO/IEC 27001:2022 certification, and its data-protection program complies with HIPAA, GDPR, and CPRA. A Business Associate Agreement (BAA) is available for customers subject to HIPAA. Current reports and certificates are available under NDA on request.

No security system can eliminate all risk, and these measures do not constitute a guarantee that a security incident can never occur.

10. Personal Data Breaches

If Iqidis becomes aware of a Personal Data Breach affecting Customer Personal Data for which Iqidis acts as a processor, Iqidis will notify the applicable Customer without undue delay in accordance with Applicable Data Protection Laws and any applicable Data Processing Addendum.

Where reasonably practicable, the notice will include information then available regarding:

• the nature of the incident;
• affected information or individuals, where known;
• likely consequences;
• mitigation or remediation measures; and
• other information reasonably necessary for the Customer to meet applicable legal obligations.

Information may be provided in phases as the investigation develops.

Notification does not constitute an admission of fault or liability.

Iqidis does not publicly identify customers in connection with security incidents unless authorized by the customer or required by law.

11. Customer Security Responsibilities

Customers are responsible for:

• managing Authorized Users;
• protecting credentials;
• removing access when authorization ends;
• configuring available security controls appropriate to their environment;
• maintaining security of customer-controlled devices and systems; and
• promptly reporting suspected unauthorized access or account compromise.

12. Data Processing Addendum

Where Iqidis acts as a processor and applicable law or the parties’ agreement requires additional processor terms, the Iqidis Data Processing Addendum (“DPA”) may be incorporated into the applicable Order Form, enterprise agreement, or other customer agreement.

The DPA addresses matters including:

• controller and processor obligations;
• subprocessors;
• security;
• Data Subject rights;
• audits;
• deletion and return;
• international data-transfer mechanisms; and
• related privacy obligations.

If there is a conflict between this Policy and an applicable DPA, the DPA controls for the matters it governs.

The DPA is available where applicable by contacting info@iqidis.ai.

13. International Data Transfers

Customer Personal Data may be processed in the United States and other supported locations depending on the Services, customer configuration, and applicable service providers.

Where applicable law requires a transfer mechanism for Personal Data transferred internationally, Iqidis uses appropriate safeguards, which may include:

• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• recognized Swiss transfer safeguards;
• adequacy decisions; or
• other lawful mechanisms available under Applicable Data Protection Laws.

Additional details are contained in the applicable DPA and Service Providers & Subprocessors Policy.

14. Privacy Rights

Depending on applicable law and Iqidis’s role in the Processing, individuals may have rights to:

• request access to Personal Data;
• correct inaccurate Personal Data;
• request deletion;
• restrict or object to certain Processing;
• obtain eligible Personal Data in a portable format;
• withdraw consent where Processing is based on consent; and
• lodge a complaint with a relevant supervisory authority.

Where Customer Personal Data is processed by Iqidis on behalf of an organization, requests relating to that Customer Personal Data should generally be directed to the applicable organization.

Requests relating to Personal Data for which Iqidis acts as controller may be submitted to:

info@iqidis.ai

Iqidis may take reasonable steps to verify identity before fulfilling a request.

15. Automated Decision-Making

Iqidis does not use Personal Data for solely automated decision-making that produces legal or similarly significant effects on individuals unless expressly disclosed and permitted by applicable law.

16. Children’s Privacy

The Services are not intended for individuals under 18 acting as users of the Services.

Iqidis does not knowingly create accounts for children under 18.

Customer Content may contain information about minors where lawfully submitted by customers in connection with legal matters or other professional use.

17. Cookies and Tracking Technologies

Our use of cookies and similar technologies is described in the Cookie Policy.

Where required by applicable law, users may manage non-essential cookies and related preferences through available consent controls.

18. Changes to This Policy

Iqidis may update this Policy to reflect changes in law, technology, the Services, or our business practices.

Material changes will be communicated with reasonable advance notice where appropriate.

The current version will identify its effective date.

19. Contact Us

Iqidis, Inc.

3 Columbus Circle, Floor 15

New York, NY 10019

Email: info@iqidis.ai

PLEASE READ THESE TERMS OF SERVICE CAREFULLY. BY REGISTERING FOR, ACCESSING, OR USING THE SERVICES, YOU AGREE TO BE BOUND BY THESE TERMS. IF YOU DO NOT AGREE TO ALL OF THESE TERMS, DO NOT ACCESS OR USE THE SERVICES.

Irys is an assistive legal AI platform, not a substitute for professional legal judgment. AI-generated Output may contain errors or inaccuracies and must be independently reviewed and verified before professional reliance.

This Terms of Service agreement (this “Agreement”) constitutes a legally binding agreement between you, whether personally or on behalf of an entity (“you” or “Customer”), and IQIDIS, INC. (“Iqidis,” “Company,” “we,” “us,” or “our”), concerning your access to and use of the Irys legal AI services, including the websites currently available at https://iqidis.ai and https://irys.ai, and any related applications or services (collectively, the “Services”). “Irys” is a product name and brand of Iqidis, Inc., and not a separate legal entity.

By registering for, accessing, or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Agreement and the documents and policies incorporated by reference, including our Data Processing Addendum, Privacy Policy, Acceptable Use Policy, applicable product-specific addenda, Subprocessor Policy, Cookie Policy, and Disclaimer. If you create, access, or use the Services on behalf of an Organization, you represent and warrant that you have authority to bind that Organization to this Agreement. In that case, the Organization is the Customer for purposes of this Agreement.

1. Definitions

1.1 Acceptable Use Policy or AUP. Means the Iqidis Acceptable Use Policy, available on our website, within the Irys platform, or by request, as may be updated from time to time.

1.2 Account. Means the account created by or for a User to access and use the Services.

1.3 Authorized User. Means an individual user who has been invited to, accepted access to, or otherwise uses the Services under an Organization Account.

1.4 Confidential Information. Means information disclosed by one party (“Discloser”) to the other (“Recipient”) that is designated confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure. Iqidis Confidential Information includes, without limitation, non-public aspects of the Services, technology, pricing, security information, and Non-Public Materials. Customer Confidential Information includes Customer Content that is not publicly available. Confidential Information does not include information that: (i) becomes publicly available through no fault of the Recipient; (ii) was lawfully known to the Recipient without restriction before disclosure; (iii) is lawfully received from a third party without breach of an obligation; or (iv) is independently developed without use of or reference to the Discloser’s Confidential Information.

1.5 Content. Means Input and Output collectively.

1.5.1 Customer Content. Means all Content submitted to or generated through the Services by or for a Customer or its Authorized Users. Customer Content excludes Feedback, Usage Data, telemetry, and Account registration information.

1.5.2 Personal Content. Means Customer Content created by an Authorized User within that Authorized User’s personal workspace and not explicitly shared with other users.

1.5.3 Shared Content. Means Customer Content that an Authorized User affirmatively shares with one or more other Authorized Users or with an Organization pursuant to the sharing features of the Services.

1.6 Cookie Policy. Means the Iqidis Cookie Policy, available on our website, within the Irys platform, or by request, as may be updated from time to time.

1.7 Customer. Means (a) an individual person, where the Services are purchased or used under an individual subscription, or (b) an entity, such as a law firm, company, or other organization, where the Services are purchased or used under an organization or enterprise subscription.

1.8 Data Processing Addendum or DPA. Means the Iqidis data processing addendum, available on our website or by request, that governs Processing of Customer Personal Data on Customer’s behalf and sets forth applicable obligations concerning data protection, security, subprocessors, and international data transfers.

1.9 Data Retention Policy. Means the Iqidis policy, available by request, describing available data retention features, settings, and default periods applicable to Customer Content.

1.10 Disclaimer. Means the Iqidis Disclaimer, available on our website, within the Irys platform, or by request, as may be updated from time to time.

1.11 Feedback. Means suggestions, ideas, enhancement requests, recommendations, or other information provided to Iqidis relating to the Services, including during a Free Trial or use of Beta Services.

1.12 Input. Means text, queries, prompts, documents, data, matters, voice or audio recordings, or other information provided or uploaded by a User to the Services for processing.

1.13 Intellectual Property Rights. Means patents, copyrights, trademarks, service marks, trade names, design rights, database rights, rights in software, trade secrets, know-how, and all other intellectual property or proprietary rights recognized in any jurisdiction.

1.14 Irys. Means the artificial-intelligence-powered legal software platform branded as “Irys,” which is owned, operated, and provided by Iqidis, Inc. References to the Irys platform or Irys Services refer to the Services.

1.15 Non-Public Materials. Means any part of the Services or related information that requires authentication or is otherwise not intentionally made public by Iqidis, including the user interface, screens, workflows, dashboards, administrative consoles, in-product messages, non-public performance results, pre-release or beta features, and documentation or APIs marked confidential. Access through a trial or demo does not make Non-Public Materials public.

1.16 Organization or Organization Account. Means a Customer account established by or on behalf of an entity, under which one or more users may be provisioned access to the Services through seats, roles, or workspaces and for which billing is managed at the organization level.

1.17 Output. Means data, text, responses, summaries, analyses, drafts, citations, or other information generated and returned by the Services based on User Input.

1.18 Public-Facing Materials. Means content Iqidis intentionally makes available without authentication, such as marketing webpages, public documentation, and blog posts.

1.19 Privacy Policy. Means the Iqidis Privacy & Data Policy, available on our website, within the Irys platform, or by request, as may be updated from time to time.

1.20 Retention Period. Means the period following the Expiration Date of a subscription cancelled by the Customer through an available self-service cancellation feature, as designated in or selected by the Customer through the cancellation flow, or, if no period is designated, a default period of ninety (90) days, during which the Agreement remains in effect but access to the Services is restricted to Customer Content export or account reactivation.

1.21 Subscription Term. Means the period during which Customer has subscribed to access and use the Services, as specified in the applicable order or registration process.

1.22 Subprocessor Policy. Means the Iqidis Subprocessor Policy, available on our website, within the Irys platform, or by request, as may be updated from time to time.

1.23 User. Means an individual human who accesses or uses the Services, whether on that individual’s own behalf or as an Authorized User of a Customer Organization.

1.24 User Content. Means that portion of Customer Content provided, submitted, or generated directly by an individual User.

1.25 Workspace. Means a logical environment within the Services in which content is created, stored, and managed.

2. The Services

2.1 Purpose. The Services provide an AI-powered platform designed to assist legal professionals with tasks such as research, drafting, analysis, document review, summarization, and related workflows. The Services are intended as assistive tools and are not a substitute for professional legal judgment, advice, supervision, or independent verification.

2.2 AI Limitations. Customer acknowledges that the Services use artificial intelligence and machine learning technologies that are probabilistic and may produce Output that is inaccurate, incomplete, outdated, or otherwise erroneous. Errors may involve legal authorities, quotations, factual assertions, dates, amounts, legal analysis, or source materials. Iqidis does not warrant the accuracy, reliability, completeness, or suitability of Output. Customer and each User are responsible for reviewing and verifying material Output before relying on or using it.

2.3 Professional Review Before External Use. Output should not be treated as professionally approved, filing-ready, client-ready, or otherwise verified merely because it is presented in completed legal format, contains citations or source links, or has been processed by a verification feature. Before Output is filed, submitted, distributed, executed, or otherwise relied upon in a professional context, the responsible legal professional must perform the review appropriate to the task and applicable professional obligations.

2.4 Verification Features. The Services may include features that assist users in checking citations, authorities, source links, or related information. These features are intended to reduce risk and support professional review; they are not warranties or certifications. Unless expressly stated otherwise for a specific feature, a successful match, pass, source link, or treatment indicator does not by itself establish that an authority supports a particular proposition, that a quotation is exact and complete, that all subsequent treatment has been identified, or that the resulting work product is appropriate for a particular filing, jurisdiction, client, or matter. Users should review the underlying sources before professional reliance.

2.5 Architecture; Local-First Processing; Scoped Subprocessor Inference. By default, requests are processed within Iqidis-controlled infrastructure using Iqidis proprietary systems and orchestration layers. User Content is logically segregated per tenant and per user profile and is not pooled or commingled with the content of other Customers. For certain aspects of a request, the Services may invoke a subprocessor, such as OpenAI, Anthropic, or Google, for inference. Vendor-side caching or retention is disabled where supported and contractually applicable, payloads are minimized where practicable, and contractual no-training restrictions apply. Additional detail appears in the Privacy Policy and Subprocessor Policy.

2.6 Authorized Users. Authorized Users may access and use the Services solely for the benefit of the applicable Customer and subject to this Agreement. Customer is responsible for managing Authorized User access and for ensuring that Authorized Users are notified of applicable terms, policies, training, and organization-level requirements. Notwithstanding the Customer’s primary liability, each Authorized User remains individually bound by this Agreement upon accessing the Services. Customer assumes primary and direct responsibility for acts and omissions of its Authorized Users as if performed by Customer itself.

2.7 Free Trial. If Customer registers for a free trial, Iqidis will make the Services available on a trial basis until the earlier of the end of the trial period or the start date of a paid subscription. Customer Content provided during a free trial may be permanently deleted after the trial unless Customer purchases a subscription or otherwise agrees with Iqidis in writing.

2.8 Beta Services. From time to time, Iqidis may invite Users to test pre-release, experimental, or beta features or models (“Beta Services”). Beta Services are provided for evaluation and testing and may be modified, suspended, or discontinued without notice. AI models powering Beta Services may be actively calibrated and may produce less predictable Output.

NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, DURING A FREE TRIAL OR USE OF BETA SERVICES, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT ANY WARRANTY, SERVICE LEVEL, SUPPORT, OR INDEMNITY OBLIGATION OF ANY KIND FROM IQIDIS, EXCEPT THAT IQIDIS’S COMMITMENT NOT TO USE CUSTOMER CONTENT FOR AI MODEL TRAINING, AS SET FORTH IN SECTION 5.5, REMAINS IN EFFECT.

3. Accounts and Registration

3.1 Registration. Users may be required to register for an Account. User agrees to provide accurate, current, and complete information during registration and to keep that information current.

Accounts created using false or misleading information, disposable emails, impersonated credentials, or other deceptive means are subject to immediate suspension or termination.

3.2 Account Security. User is responsible for safeguarding Account credentials and for activities occurring under the Account. User agrees to notify Iqidis promptly of unauthorized access or use.

3.3 Eligibility. The Services are intended for Users who are at least 18 years old and possess legal capacity to enter into this Agreement.

3.4 Roles. Organization Accounts may include multiple role types, such as Owner, Administrator, and Member. Role-based permissions determine administrative capabilities, including User management, billing, and settings.

3.5 Administrative Controls. Organization Owners and Administrators may invite or remove Authorized Users, assign or modify user roles, manage subscription and billing settings, configure organization-level preferences, and exercise visibility and control over Shared Workspaces as made available by the Services.

Organization Administrators do not automatically have access to the contents of another Authorized User’s personal workspace unless content has been explicitly shared or access is required for support, security, legal compliance, preservation, or transfer of content from a deactivated account as permitted by this Agreement.

3.6 Safeguards and Account Practices. Users may not knowingly bypass, disable, remove, or circumvent in-product warnings, verification steps, administrative restrictions, or organization-mandated controls. Where individual Accounts are provided, credentials should not be shared among multiple individuals unless Iqidis expressly permits a shared-access configuration.

4. License Grant and Restrictions

4.1 License. Subject to all terms and conditions of this Agreement, payment of applicable fees, and compliance by Customer and its Authorized Users, Iqidis grants Customer and its Authorized Users a limited, non-exclusive, non-transferable, non-sublicensable, revocable license during the Subscription Term to access and use the Services, including the right to use, modify, reproduce, and distribute Output for Customer’s internal business purposes or for providing legal services to Customer’s clients, provided such use complies with this Agreement and applicable professional and ethical obligations.

During any applicable Retention Period, Iqidis grants Customer a limited license to access the Services solely for exporting Customer Content or reactivating a subscription.

4.2 General Use Restrictions. Customer and Users shall not, and shall not permit others to:

• Use the Services in violation of the Acceptable Use Policy or applicable law;
• License, sublicense, sell, resell, rent, lease, transfer, assign, time-share, or otherwise commercially exploit the Services except as expressly permitted for Customer’s legal services;
• Modify, copy, or create derivative works based on the Services except as expressly permitted with respect to Output;
• Use the Services to store or transmit unlawful, infringing, libelous, or tortious material or material that violates third-party privacy or intellectual property rights;
• Transmit viruses, worms, malicious code, or other harmful material;
• Interfere with or disrupt the integrity or performance of the Services;
• Attempt to gain unauthorized access to the Services or related systems or networks;
• Remove or obscure proprietary notices or labels;
• Knowingly make materially false statements of fact concerning Iqidis, Irys, or the technical operation, security, or capabilities of the Services;
• Capture, copy, distribute, or publicly disclose screenshots, screen recordings, or other visual depictions of Non-Public Materials without Iqidis’s prior written consent, except as necessary for Customer’s internal business purposes, client deliverables, or disclosures required by law or professional obligation; or
• Treat trial or demo access as permission to publish or disclose Non-Public Materials.

Nothing in this Section prohibits a truthful review, opinion, or legally required disclosure concerning the Services.

4.3 Prohibitions on Reverse Engineering and Unfair Competition. User acknowledges that the Services, including their underlying technology, algorithms, architecture, and design, constitute valuable trade secrets and proprietary intellectual property of Iqidis. Accordingly, User shall not, and shall not permit or authorize any third party to:

• (a) reverse engineer, decompile, disassemble, translate, or otherwise attempt to discover, derive, or reconstruct source code, object code, underlying structure, proprietary prompts, datasets, trade secrets, know-how, algorithms, or architecture of the Services except to the extent such restriction is prohibited by law;
• (b) access, use, monitor, copy, or benchmark the Services or Output for the purpose of developing, building, training, improving, or offering a product or service competitive with the Services, including by extracting data or Output for competitive analysis or model training, replicating core functionality or workflows, or publicly disseminating non-public performance information or benchmarks without prior written consent; or
• (c) use false or deceptive means to access the Services for unauthorized testing, benchmarking, probing, analyzing, or evaluating the Services.

4.4 Monitoring and Access Control. To protect the integrity of the Services and enforce this Agreement, Iqidis may monitor and analyze usage patterns, registration behavior, IP address logs, device information, and other technical metadata for fraud detection, abuse prevention, compliance verification, security auditing, and enforcement of this Agreement. Iqidis may restrict, suspend, or terminate access in accordance with this Agreement if a violation or abuse is reasonably suspected.

5. Content and Data

5.1 Content Ownership. Subject to the terms of this Agreement, as between Customer and Iqidis, Customer retains all right, title, and interest in and to Customer Content, including applicable Intellectual Property Rights. Customer grants Iqidis and its necessary service providers a worldwide, non-exclusive, royalty-free license to host, store, transfer, process, analyze, modify, and use Customer Content solely to the extent necessary to provide, maintain, secure, support, and operate the Services in accordance with this Agreement.

5.2 Responsibility for Content. Customer is responsible for the accuracy, quality, integrity, legality, reliability, and appropriateness of Input. Customer represents and warrants that it has necessary rights, consents, and permissions to provide Input to Iqidis and that Input and its use within the Services will not violate applicable law or third-party rights.

5.3 Data Processing and Privacy. For information on Iqidis data practices, please see the Privacy Policy and Data Processing Addendum.

5.4 Data Retention and Deletion. During an active Subscription Term, Iqidis retains Customer Content as necessary to provide the Services and in accordance with Customer settings and applicable policies. Customer is responsible for managing its Content to meet its own business, professional, ethical, or regulatory record-keeping obligations.

Notwithstanding ordinary retention settings, Iqidis may preserve relevant information where required by applicable law, valid legal process, litigation hold, security obligations, or another binding legal requirement, in each case consistent with the DPA and Privacy Policy.

5.5 AI Processing and Data Retention. Iqidis utilizes AI technologies that process Customer Content in real time. Iqidis does not use Customer Content to train its own or third-party foundation models unless expressly agreed otherwise in writing. Third-party model calls are configured with vendor caching or retention disabled where supported and applicable and are used for stateless inference.

Iqidis may access Customer Content only for limited purposes permitted by this Agreement, including providing customer support, troubleshooting technical issues, ensuring service operation, investigating a reported product or security incident, complying with applicable law or valid legal process, and enforcing this Agreement, subject to the Privacy Policy, DPA, and applicable safeguards.

5.6 Usage Data and Telemetry. Iqidis may collect, analyze, and use aggregated or anonymized data derived from use of the Services (“Usage Data”) and limited operational telemetry, such as UI events, navigation flows, request timing, status or error codes, and coarse device or browser metadata, for performance monitoring, service improvement, security, and abuse detection. Usage Data and telemetry will not identify User or contain Customer Confidential Information and do not include prompts, model outputs, or uploaded documents or files unless expressly described in an applicable policy or agreement.

5.7 Roles; Ownership; Data Location and Segregation. As between Customer and Iqidis, Customer is the controller or owner of Customer Content. Where Customer is an Organization, Authorized Users act on behalf of Customer in their use of the Services. Iqidis acts as Customer’s processor or service provider as applicable. Customer Content is stored and processed within Customer’s Iqidis tenant and user-profile containers and is not pooled or commingled with content of other Customers. Regional routing may be available and automatically applied.

5.8 Organization Shared Content; Offboarding. By sharing Shared Content within an Organization Account, each Authorized User grants the Organization a non-exclusive, worldwide, royalty-free license to access, use, reproduce, modify, export, and retain such Shared Content and resulting Output for the Organization’s internal business or legal-services purposes. Upon removal of an Authorized User from an Organization Account, the Organization may retain access to Customer Content created by that Authorized User in the context of the Organization, subject to applicable law and Customer policies.

Customer is responsible for promptly removing Authorized Users when authorization ends. Upon removal, the User’s access is revoked, applicable Customer Content may be preserved for the Organization, and Organization Administrators may request transfer of archived content to another active Authorized User as supported by Iqidis.

6. Intellectual Property

6.1 Iqidis IP. Iqidis and its licensors own and retain all right, title, and interest, including Intellectual Property Rights, in and to the Services, underlying technology, Usage Data, Iqidis Confidential Information, and modifications or enhancements thereto. No rights are granted other than those expressly set forth in this Agreement.

6.2 Output. Subject to Section 6.1, Section 5.1, and Customer’s compliance with this Agreement, as between the parties and to the extent permitted by law, Customer owns Output generated through the Services by Customer or its Authorized Users. Due to the nature of AI, Output may not be unique and other users may receive similar or identical Output. Rights in Output do not extend to Iqidis technology or third-party data incorporated into Output.

6.3 Feedback. User and Customer grant Iqidis a worldwide, perpetual, irrevocable, transferable, sublicensable, royalty-free license to use, reproduce, modify, create derivative works from, incorporate, and otherwise exploit Feedback for service improvement, development, and promotional purposes, subject to applicable confidentiality obligations.

7. Fees and Payment

7.1 Fees. Customer shall pay all fees specified in the applicable order form or registration process (“Fees”). Fees are based on the subscription plan purchased and not actual usage. Payment obligations are non-cancelable and Fees paid are non-refundable except as expressly provided in this Agreement or an applicable order form.

7.2 Payment Terms. Fees will be invoiced or charged in advance on a monthly, annual, or other agreed billing cycle. Unless otherwise expressly stated in an applicable Order Form, all invoiced amounts are due immediately upon receipt of the invoice.

Customer agrees to provide and maintain valid and current payment information. If paying by credit card or other automatic payment method, Customer authorizes Iqidis and its payment processor to charge all Fees when due.

If any amount is not paid when due, including because a payment method is declined or fails, Iqidis may, in its sole discretion and without prior notice or opportunity to cure, immediately suspend, restrict, or terminate Customer’s access to any or all Services, Accounts, Organization Accounts, and Authorized User accounts until all outstanding amounts are paid in full. Iqidis may also terminate this Agreement immediately for non-payment.

Suspension, restriction, or termination for non-payment does not relieve Customer of any payment obligations, and all outstanding Fees remain immediately due and payable. Iqidis’s exercise of these rights is without prejudice to any other rights or remedies available under this Agreement or applicable law.

7.3 Taxes. Fees are exclusive of applicable taxes, levies, duties, or similar governmental assessments. Customer is responsible for taxes associated with its purchases, excluding taxes based on Iqidis net income.

7.4 Fee Changes. Iqidis may change Fees or institute new charges upon at least thirty (30) days’ notice. Fee changes take effect at the start of the next Subscription Term unless otherwise agreed.

7.5 Mid-Term Subscriptions. Customer may add Authorized User subscriptions during a Subscription Term by Order Form, amendment, or supported self-service functionality. Fees, billing cycle, and term for additional subscriptions will be as specified in the applicable transaction.

8. Confidentiality

8.1 Obligations. The Recipient will use the Discloser’s Confidential Information only for purposes of this Agreement, protect it using at least reasonable care, and disclose it only to personnel, contractors, and agents with a need to know who are bound by appropriate confidentiality obligations.

8.2 Compelled Disclosure. If the Recipient is required by law or valid governmental order to disclose Confidential Information, it will, where legally permitted, provide prompt notice and reasonable assistance in seeking confidential treatment or a protective order. Disclosure will be limited to what is required.

8.3 Non-Public UI and Screens. Non-Public Materials are Iqidis Confidential Information. Trial or demo access does not waive confidentiality. Users may not publicly distribute screenshots or recordings of Non-Public Materials except as permitted by this Agreement or required by law or professional obligation.

9. Disclaimers

9.1 General. THE SERVICES, SITE, AND RELATED CONTENT ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

9.2 AI Output. Iqidis does not warrant that Output will be accurate, complete, reliable, current, or suitable for any particular purpose. Output may contain errors, omissions, or biases and may not be unique. Material Output must be independently reviewed and verified with professional judgment before reliance.

9.3 Verification Features. Verification features are provided to support review and reduce risk. They do not guarantee that every issue will be detected or that a matched authority supports a particular proposition, quotation, filing, or legal conclusion.

9.4 No Legal Advice. The Services and Output do not constitute legal advice or the practice of law. Use of the Services does not create an attorney-client relationship. Irys is an assistive tool for legal professionals and is not a substitute for licensed legal counsel.

9.5 Availability. Iqidis does not warrant that the Services will be uninterrupted, timely, secure, or error-free. Remedies for availability shortfalls are limited to those expressly provided in an applicable service-level agreement.

9.6 Reference. Additional disclaimers are described in the Iqidis Disclaimer, which is incorporated by reference into this Agreement.

10. Limitation of Liability

10.1 Exclusion of Indirect Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE USE OF, OR INABILITY TO USE, THE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.2 Cap on Direct Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNT PAID OR PAYABLE BY CUSTOMER TO IQIDIS FOR THE SERVICES DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED U.S. DOLLARS ($100.00), WHICHEVER IS GREATER.

10.3 Exceptions. The limitations in Sections 10.1 and 10.2 shall not apply to: (i) indemnification obligations under Section 11.2; (ii) a party’s breach of confidentiality obligations under Section 8, except that liability arising from a Data Security Incident is subject to any limitation stated in the DPA; (iii) User’s breach of Section 4.2 or 4.3; or (iv) a party’s gross negligence or willful misconduct.

10.4 Basis of Bargain. The parties acknowledge that the disclaimers and limitations of liability in this Agreement reflect a reasonable allocation of risk and form an essential basis of the bargain between the parties, and that Iqidis pricing reflects this allocation.

11. Indemnification

11.1 Indemnification by Iqidis. Iqidis will defend or settle any unaffiliated third-party claim alleging that the Services, including Output generated by the Services when used as delivered and in accordance with this Agreement, directly infringe or misappropriate such third party’s U.S. patents, copyrights, or trademarks (“Infringement Claim”), and will indemnify Customer against damages and reasonable costs finally awarded or agreed in settlement. Iqidis has no obligation to the extent an Infringement Claim arises from Customer Content, modification or republication of Output, non-Iqidis applications or services, combinations not supplied by Iqidis, or use in violation of this Agreement. If the Services are or are likely to become subject to an Infringement Claim, Iqidis may secure continued use rights, replace or modify the affected Services, or terminate the affected Services and refund prepaid unused Fees for the remainder of the Subscription Term. This Section states Iqidis entire liability and Customer’s exclusive remedy for third-party IP claims concerning the Services.

11.2 Indemnification by Customer. Customer shall defend, indemnify, and hold harmless Iqidis and its affiliates, directors, officers, employees, and agents from and against any unaffiliated third-party claim arising from or related to: (a) Customer Content, including allegations that Customer Content violates third-party rights or law; (b) Output that Customer or an Authorized User modifies, republishes, distributes, or uses beyond the form delivered by the Services; (c) Customer’s or an Authorized User’s use of the Services in violation of this Agreement, the AUP, or applicable law; or (d) Customer’s or an Authorized User’s violation of professional or ethical obligations in connection with use of the Services. Customer will indemnify Iqidis for damages, attorney fees, and costs finally awarded against Iqidis or paid by Iqidis under a court-approved settlement, provided that Iqidis promptly notifies Customer, grants Customer control of the defense and settlement subject to an unconditional release of Iqidis, and provides reasonable cooperation at Customer’s expense.

12. Term and Termination

12.1 Term. This Agreement commences on the date it is first accepted by or on behalf of Customer and continues until all Subscription Terms and any applicable Retention Periods have expired, unless terminated earlier under this Section.

12.2 Subscription Renewal. Unless otherwise specified in an applicable order form, subscriptions automatically renew for additional periods equal to the expiring Subscription Term or one year, whichever is shorter, unless either party provides written notice of non-renewal at least thirty (30) days before the end of the relevant Subscription Term.

12.3 Termination for Cause. Either party may terminate this Agreement for cause upon thirty (30) days’ written notice of a material breach if the breach remains uncured at the end of that period, or immediately upon specified insolvency events. Iqidis may also terminate immediately upon notice for material violations of the AUP, Section 4.2, or Section 4.3.

12.4 Termination by Customer. If Customer is subscribed month-to-month without a separate subscription agreement or order form, Customer may cancel by contacting Iqidis support or through supported account functionality, effective at the end of the current billing cycle. Contracted subscriptions with a defined term are governed by the applicable agreement or Order Form and, unless expressly stated otherwise, are non-cancellable during the term and Fees are non-refundable.

12.5 Effect of Termination. Upon termination or expiration: (a) rights and licenses granted to Customer and its Authorized Users terminate; (b) use of the Services must cease; (c) unpaid Fees become due; and (d) each party will handle the other party’s Confidential Information as required by this Agreement. Sections that by their nature should survive, including provisions concerning intellectual property, confidentiality, disclaimers, liability, indemnification, dispute resolution, and professional responsibility, will survive.

12.6 Post-Termination Data Deletion. Following termination and any applicable Retention Period, Iqidis will delete Customer Content from active production systems within thirty (30) days unless a different period is required by law or agreed in writing. Iqidis is not a system of record. Customer remains responsible for exporting client files and satisfying its legal, ethical, professional, and regulatory record-keeping obligations. Residual copies may persist in secure backup archives for a limited period before being overwritten in the ordinary course.

13. Governing Law and Dispute Resolution

13.1 Governing Law. This Agreement, including incorporated policies, and disputes arising out of or related to the Services are governed by the laws of the State of New York without regard to conflicts-of-law principles, except where a DPA specifies another law for international data transfer mechanisms.

13.2 Informal Resolution. The parties will first attempt to resolve disputes informally for at least sixty (60) days after written notice of the dispute.

13.3 Binding Arbitration. If a dispute is not resolved informally, it shall be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules then in effect, in New York County, New York, before a single arbitrator, except for disputes expressly excluded below. The arbitrator’s decision is final and binding and may be entered in any court of competent jurisdiction.

13.4 Exceptions to Arbitration. Disputes concerning enforcement or validity of intellectual property rights, or claims for injunctive or equitable relief, are not subject to arbitration and may be brought in state or federal courts located in New York County, New York. The parties consent to jurisdiction and venue in those courts for such purposes.

13.5 Class Action Waiver. TO THE MAXIMUM EXTENT PERMITTED BY LAW, ARBITRATION OR COURT PROCEEDINGS SHALL BE CONDUCTED SOLELY ON AN INDIVIDUAL BASIS AND NOT AS A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION.

13.6 Jury Trial Waiver. EACH PARTY WAIVES ITS RIGHT TO A JURY TRIAL IN CONNECTION WITH A DISPUTE ARISING OUT OF OR RELATING TO THIS AGREEMENT TO THE MAXIMUM EXTENT PERMITTED BY LAW.

14. Professional Responsibility and Ethics

14.1 User Responsibility. User acknowledges that it is a legal professional or entity employing legal professionals and remains responsible for professional conduct and compliance with applicable laws, rules, regulations, ethical obligations, court requirements, client obligations, and professional standards governing legal practice.

14.2 Independent Judgment. The Services are assistive tools. Users must exercise independent professional judgment in using the Services and evaluating Output. Users remain responsible for advice given, work product created, filings made, and decisions taken in the course of professional practice.

14.3 Verification. Users are responsible for reviewing and verifying the accuracy, completeness, and appropriateness of material Output before relying on it or incorporating it into work product or advice. Where relevant, review should include the underlying authorities and record materials, citation accuracy, quotations, factual assertions, dates, amounts, jurisdiction, procedural posture, and subsequent treatment.

14.4 Court, Client, and Other External Use. Before submitting or providing Output to a court, tribunal, regulator, client, counterparty, or other third party in a professional context, the responsible legal professional must perform the review required by applicable law, professional obligations, court rules, client requirements, and the circumstances of the matter. The presence of citations, source links, formatting, proposed orders, signature blocks, or verification indicators does not constitute Iqidis approval of the work product.

14.5 Confidentiality and Privilege. Iqidis is designed with enterprise-oriented security and data privacy controls. Users remain responsible for ensuring their use of the Services complies with applicable confidentiality and attorney-client privilege obligations. If Iqidis becomes aware of a data security incident affecting Customer Content, Iqidis will notify Customer and cooperate as described in the Privacy Policy, DPA, and applicable agreement.

14.6 Firm Governance and Supervision. Organization Customers are responsible for implementing reasonable policies, training, supervision, and internal controls appropriate to their use of AI-enabled legal tools and applicable professional obligations. Customer is responsible for communicating organization-level requirements to Authorized Users and for configuring available controls as appropriate.

14.7 Material Incidents. If Customer becomes aware of a material incident involving the Services that has resulted in or could reasonably result in a court or regulatory filing issue, sanctions or professional-responsibility inquiry, client claim, material security or privacy concern, or media inquiry concerning the technical operation of the Services, Customer will promptly notify Iqidis at info@iqidis.ai where legally permitted. The parties will reasonably cooperate to establish relevant technical facts and preserve information as appropriate. Nothing in this Section requires either party to waive attorney-client privilege, work-product protection, client confidentiality, or another legal protection.

14.8 External Technical Statements and Required Disclosures. Where legally permitted and reasonably practicable, before making a public factual statement that attributes a material incident to Irys or describes the technical operation of the Services in connection with such an incident, Customer will provide Iqidis a reasonable opportunity to confirm the technical accuracy of that description.

Nothing in this Agreement restricts truthful reviews or opinions or limits any disclosure required by law, court order, subpoena, regulator, professional-responsibility rule, client obligation, insurer, or other legally binding duty. Customer remains solely responsible for determining and satisfying its own legal and professional disclosure obligations.

14.9 Compliance. User agrees to use the Services in a manner consistent with applicable professional standards, ethical guidelines, law, and this Agreement.

15. Export Compliance

User agrees to comply with applicable U.S. and foreign export-control and trade-sanctions laws and regulations and shall not use, export, re-export, transfer, or access the Services in violation of those laws.

16. Miscellaneous

16.1 Entire Agreement. This Agreement, together with the Privacy Policy, AUP, Cookie Policy, Disclaimer, DPA, applicable product-specific addenda, and applicable order forms, constitutes the entire agreement concerning the Services and supersedes prior agreements or understandings concerning the same subject matter. In the event of a conflict, the order of precedence is: (i) an applicable order form, but only to the extent it expressly modifies a specific provision; (ii) an applicable product-specific addendum for its subject matter; (iii) this Agreement; and (iv) other incorporated policies.

16.2 Modifications. Iqidis may modify this Agreement from time to time by posting a revised version on its website or notifying User by email or through the Services. Material changes will be communicated with reasonable advance notice. Continued use after the effective date of a valid modification constitutes acceptance to the extent permitted by law. Iqidis may request affirmative acceptance of updated terms through the Services.

16.3 Assignment. Neither party may assign this Agreement without the other party’s prior written consent, not to be unreasonably withheld, except that Iqidis may assign this Agreement in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all relevant assets.

16.4 Relationship of the Parties. The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary, or employment relationship.

16.5 Marketing Identification and Feedback Use. Customer grants Iqidis a worldwide, royalty-free, non-exclusive license to use Customer’s name, trademarks, and logos to identify Customer as a customer of Iqidis on Iqidis websites and in marketing materials. Customer may revoke this permission prospectively by written notice to info@iqidis.ai, subject to a commercially reasonable removal period. Iqidis will generally seek prior approval before high-visibility uses such as press releases, published case studies, or media announcements. Feedback remains subject to Section 6.3.

16.6 Notices. Notices under this Agreement shall be in writing and may be delivered personally, by email, recognized overnight delivery service, or certified or registered mail. Notices to Iqidis shall be sent to IQIDIS, INC., Attn: Legal Department, 3 Columbus Circle, Floor 15, New York, NY 10019, with a copy to info@iqidis.ai. Notices to Customer may be sent to the account administrator, billing contact, legal contact, or email address associated with the Account. Notice to a Customer’s designated account administrator constitutes notice to Customer and its Authorized Users to the extent permitted by applicable law and agreement.

16.7 Waiver. No failure or delay in exercising a right under this Agreement constitutes a waiver of that right.

16.8 Severability. If a provision is held unenforceable, it will be modified and enforced to the maximum lawful extent, and the remaining provisions will remain in effect.

16.9 Force Majeure. Neither party is liable for delay or failure in performance, other than payment obligations, caused by events beyond its reasonable control.

16.10 Headings. Headings are for convenience only and do not affect interpretation.

17. Contact Us

IQIDIS, INC.

3 Columbus Circle, Floor 15

New York, NY 10019

Email: info@iqidis.ai