Client Subscription Agreement

Effective Date: July 6, 2026

This Client Subscription Agreement (“Agreement”) is entered into by and between:

• Vaxen Labs Inc., a Kansas corporation, with a principal place of business at 4601 E. Douglas Ave. STE 150, Wichita, KS 67218 (“Vaxen”), and
• the customer identified at checkout or in an order form (“Client”).

1. Subscription

Client is subscribing to the Vaxen Service and the specific plan selected at checkout.

2. Term

This Agreement begins when Client accepts it and continues month-to-month unless terminated under this Agreement.

3. Fees and billing

Client agrees to pay all applicable fees.

Billing is monthly unless otherwise stated in writing.

If annual plans are introduced later, they will be governed by the applicable order form or updated terms.

4. Auto-renewal

The subscription renews automatically each billing cycle unless Client cancels before the renewal date.

5. Cancellation

Client may cancel before the renewal date.

Cancellation becomes effective at the end of the current billing cycle.

6. Refunds

Refunds are available only if there is a material failure of the Service, meaning the agents do not work as intended.

If a refund is approved:

• it applies only to the affected month;
• no other fees are refundable unless required by law.

7. Client data ownership

Client owns all rights in Client Data.

“Client Data” includes all data, content, contact lists, call recordings, transcripts, messages, campaign content, bookings, and other information submitted by or on behalf of Client or its end users.

8. License to Vaxen

Client grants Vaxen a limited, non-exclusive, worldwide, royalty-free license to host, store, process, transmit, reproduce, display, and use Client Data:

• to provide and support the Service;
• to secure the Service;
• to troubleshoot and maintain the Service;
• to comply with law;
• to improve the Service;
• to train and evaluate AI models, unless Client opts out.

9. Client training opt-out

Client may opt out of AI training use through account settings or written notice to Vaxen.

10. Prohibited data

Client will not upload, transmit, or process using the Service:

• PHI / medical data;
• attorney-client privileged information;
• financial account data;
• government ID or SSN data;
• other sensitive personal data.

Client is solely responsible for ensuring such data is excluded.

11. Customer list, consent, and campaigns

Client is solely responsible for:

• the legality of its customer list;
• obtaining consent for messages, calls, and campaigns where required;
• honoring opt-outs, unsubscribes, do-not-call requests, and suppression requirements;
• complying with CAN-SPAM, TCPA, telemarketing, privacy, and consumer protection laws.

Vaxen only provides the tool.

Client acknowledges that:

• unsubscribes and suppression are built into the product;
• campaigns require owner approval before sending;
• current campaign scope is email only;
• SMS and phone outreach may be added later and will require separate compliance review.

12. Client representations and warranties

Client represents and warrants that:

• it has all rights and authority needed to use the Service;
• it has all consents required to upload and process Client Data;
• its use of the Service complies with law;
• its lists, messages, and campaigns are lawful;
• it will not misuse the Service or violate third-party rights;
• it will not submit prohibited data.

13. Acceptable use

Client will not use the Service:

• unlawfully;
• to send spam or deceptive communications;
• to violate privacy, marketing, or telemarketing laws;
• to infringe IP or misuse confidential information;
• to process prohibited data;
• to interfere with or disrupt the Service;
• in a way that creates legal or security risk.

14. Vaxen’s suspension rights

Vaxen may suspend or restrict the Service immediately if:

• Client breaches this Agreement;
• Client uses prohibited data;
• Client fails to pay;
• Client’s use creates legal, security, or reputational risk;
• Vaxen reasonably believes suspension is necessary to protect the Service or third parties.

15. Security

Vaxen maintains reasonable safeguards including:

• encryption in transit;
• encryption at rest;
• access controls / role-based permissions;
• backups;
• logging and monitoring;
• MFA for admin accounts.

16. Support

The Service is provided as available.

Vaxen does not provide an uptime SLA unless separately agreed in writing.

17. End-user communications and recording

Client authorizes Vaxen to handle communications with Client’s end users, including calls and recordings, as part of the Service.

Vaxen is responsible for the call-recording disclosure functionality it provides.

Client remains responsible for the legality of its business operations and use of the Service.

18. Data retention and deletion

• Call recordings and transcripts are retained for 90 days, then archived to cold storage, then deleted after 1 year.
• Upon cancellation, Client will have a 30-day export window.
• After that, Vaxen may delete Client Data within 6 months, except as required by law or for legitimate business/legal purposes.

19. DPA incorporated

The Data Processing Addendum in this Agreement applies where Vaxen processes Client Data as a processor or service provider.

20. Confidentiality

Each party will protect the other’s confidential information using reasonable care and only use it for the purposes of this Agreement.

21. Intellectual property

Vaxen retains all rights in the Service, software, models, and branding.

Client retains all rights in Client Data.

22. Indemnification

Client will defend, indemnify, and hold harmless Vaxen and its officers, directors, employees, and agents from claims arising out of or relating to:

• Client Data;
• Client’s customer list;
• Client’s messages or campaigns;
• lack of consent or unlawful outreach;
• Client’s breach of this Agreement;
• Client’s violation of law;
• Client’s misuse of the Service;
• any claim by Client’s customers or end users arising from Client’s acts or omissions.

23. Limitation of liability

Vaxen’s total liability is limited to the fees paid by Client in the 3 months before the event giving rise to the claim.

This limit does not apply to:

• unpaid fees;
• breach of confidentiality;
• misuse of IP;
• indemnity claims;
• gross negligence or willful misconduct.

24. Dispute resolution

Binding arbitration, class action waiver, small claims carve-out, and injunctive relief carve-out apply as stated in the Terms.

Governing law is Kansas and venue for court proceedings is Johnson County, Kansas.

25. Signature and acceptance

Client’s acceptance through clickwrap, checkout, or electronic signature is binding under ESIGN and UETA.

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Client Subscription Agreement between Vaxen Labs Inc. and Client.

1. Roles

Client is the controller/business.

Vaxen is the processor/service provider.

2. Processing instructions

Vaxen will process Client Data only:

• to provide the Service;
• on Client’s documented instructions;
• as required by law.

3. Client obligations

Client is responsible for:

• notices to data subjects/end users;
• lawful basis or consent;
• security of its own systems and credentials;
• honoring deletion, access, and opt-out requests where applicable;
• ensuring its content and lists are lawful.

4. Vaxen obligations

Vaxen will:

• process Client Data only for authorized purposes;
• maintain appropriate safeguards;
• restrict access to authorized personnel;
• notify Client of material security incidents as required by law;
• assist reasonably with deletion, export, and compliance requests.

5. Subprocessors

Client authorizes Vaxen to use subprocessors such as Together AI, Twilio, Hostinger, Supabase, Ghost, and analytics or hosting providers used to operate the Service.

6. AI training

Client may opt out of AI training use.

If Client opts out, Vaxen will use Client Data for training only if otherwise permitted by law and contract or in de-identified or aggregated form.

7. Retention and deletion

Data is retained according to the retention schedule in the Agreement and Privacy Policy.

8. International transfers

The Service is intended for U.S. use only unless otherwise agreed in writing.