Standard Terms

STANDARD TERMS TO RENLO SERVICE AGREEMENT

Last modified: September 11, 2026

These Standard Terms are between Renlo, Inc., a Delaware corporation ("Renlo" or "Provider"), and the customer that orders the Service, whether by entering into an Order Form or by subscribing through the Service ("Customer"). Capitalized terms are defined in Section 13 or in the Order Form.

1. Service

1.1 Access and Use. During the Subscription Period and subject to this Agreement, Customer may access and use the Service, receive Outputs, and use any Software and Documentation as needed to do so, for its internal business purposes.

1.2 Support. Provider will provide reasonable technical support by email at support@renlo.co, or as otherwise described in the Order Form. Provider does not commit to specific support hours or response times unless the Order Form says so.

1.3 User Accounts. Customer is responsible for all activity under its Users' accounts and for its Users' compliance with this Agreement. Customer and its Users must keep credentials confidential and promptly notify Provider of any suspected unauthorized access.

1.4 Feedback and Usage Data. Customer may provide Feedback, which Provider may use without restriction or obligation. Provider may collect and use Usage Data to operate, secure, improve, and promote its products and services and for its other lawful business purposes, and will not publicly disclose Usage Data in a form that identifies Customer or any User.

1.5 Customer Content.

(a) License. Customer grants Provider a non-exclusive, worldwide, royalty-free license, sublicensable to Provider's service providers, to host, copy, process, adapt, and otherwise use Customer Content as needed to provide, maintain, secure, and improve the Product (including to develop, train, and evaluate the models and features that power it) and to comply with Applicable Laws. Provider does not use Customer Content to train Provider's own general-purpose AI models.

(b) Anonymized and Aggregated Data. Provider may derive anonymized, de-identified, or aggregated data from Customer Content and from use of the Product, owns that data, and may use, license, sell, and otherwise exploit it for any lawful purpose without obligation to Customer, provided it does not identify Customer or any individual.

(c) Responsibility. Customer is responsible for the accuracy and legality of Customer Content and for having all rights, consents, and licenses needed to provide it to Provider for processing under this Agreement.

(d) Opt-Out. Customer may opt out of Provider's use of Customer Content to improve the Product by emailing support@renlo.co. The opt-out does not apply to processing needed to provide the Product or to comply with Applicable Laws, or to data already derived under Section 1.5(b).

1.6 AI Outputs. The Service uses machine learning, which is probabilistic by nature. Outputs may be inaccurate, incomplete, or fail to reflect real people, places, or facts, and their quality depends substantially on the Customer Content and instructions provided. Customer agrees that: (a) Outputs are not a substitute for professional advice or independent verification; (b) Customer will review Outputs for accuracy and suitability before relying on or sharing them; (c) Customer will not use Outputs about an individual to make decisions with legal or similarly significant effects on that individual, except at Customer's own risk; (d) Outputs may contain content that does not reflect Provider's views; and (e) Outputs may not be unique.

1.7 Third-Party AI Providers. The Service uses models and technology from third-party AI providers to generate Outputs. Provider may change these providers at any time, provided each provider is bound by confidentiality obligations and is contractually prohibited from training its models on Customer Content. A change of AI provider is a change of Subprocessor under Section 5 of the DPA and requires neither Customer's consent nor advance notice. Customer's use of AI features is also subject to those providers' usage policies as identified in the Documentation or otherwise notified to Customer. Provider is not responsible for the availability or performance of third-party AI providers.

1.8 Usage Limits. Ordinary use of the Service is included in the Fees. Provider may set reasonable usage limits on features that carry a per-use cost (for example bulk enrichment, skiptracing, or large-scale AI processing), and may charge for use above those limits on a usage basis. Provider will tell Customer what the limits and any usage-based charge are before they apply, and may restrict use above the limits until Customer accepts the charge.

1.9 Changes to the Service. Provider is continuously developing the Service and may add, modify, or discontinue features at any time. Any commitment not to reduce the functionality of the Service applies only where an Order Form expressly includes it, and is subject to Section 5.4.

2. Restrictions and Obligations

2.1 Restrictions. Except as expressly permitted, Customer will not, and will not permit anyone else to: (i) reverse engineer or attempt to discover the source code or underlying algorithms of the Product; (ii) resell, sublicense, or otherwise make the Product available to third parties; (iii) remove proprietary notices; (iv) copy, modify, or create derivative works of the Product; (v) interfere with, degrade, or circumvent security or access controls of the Product; (vi) access accounts or data it is not authorized to access; (vii) use the Product to build a competing product or service; (viii) use the Product, its Outputs, or the Documentation to train or improve any AI model, or for competitive benchmarking; (ix) attempt to manipulate or subvert the Product's AI features through prompt injection or similar techniques; (x) use the Product for High Risk Activities or in violation of Applicable Laws; or (xi) submit Customer Content for which Customer lacks the necessary rights or consents.

2.2 Suspension and Removal. Provider may suspend Customer's access to the Product if Customer materially breaches this Agreement, fails to pay undisputed Fees when due, or uses the Product in a way that harms the Product or others. Provider will try to give notice before suspending and will restore access once the issue is resolved. Provider is not obliged to monitor Customer Content or Outputs but may remove content it reasonably believes violates this Agreement or Applicable Laws.

3. Privacy and Security

3.1 Personal Data. Customer Content will ordinarily include Personal Data about Customer's contacts, clients, and counterparties. Customer is the controller of that Personal Data and Provider processes it on Customer's behalf under the Data Processing Addendum (the "DPA"), which forms part of this Agreement and controls in the event of conflict regarding Personal Data.

3.2 Recording Consents. Where Customer uses the Service to record, transcribe, or analyze calls or meetings, Customer is responsible for obtaining any consent required from participants under Applicable Laws.

3.3 Prohibited Data. Customer will not submit Prohibited Data to the Product unless the Order Form expressly permits it.

3.4 Security. Provider will use commercially reasonable measures to protect the Service against unauthorized access, alteration, or disclosure.

4. Payment

4.1 Fees. Fees, billing frequency, and the number of seats are set out in the Order Form. Unless the Order Form states otherwise, Fees are in U.S. Dollars, exclude Sales Taxes, and are non-refundable except where this Agreement expressly provides a refund.

4.2 Seats. The Service is licensed per seat. Each seat is for one named User at a time and credentials may not be shared. Customer may add seats at any time; added seats are charged at the applicable per-seat rate, pro rata for the remainder of the current Subscription Period. Changes to the number of seats are otherwise made as described in the Order Form or through the Service.

4.3 Payment Method. Where Customer pays by card, Customer authorizes Provider and its Payment Processor to charge the payment method on file for all Fees on a recurring basis until the Subscription Period ends. Invoiced amounts are due within 30 days of the invoice date unless the Order Form states otherwise. Provider may charge reasonable interest on amounts that are more than 30 days overdue, at a rate not exceeding what Applicable Laws allow.

4.4 Taxes. Customer is responsible for all sales, use, VAT, GST, withholding, and similar taxes on Fees ("Sales Taxes"), other than taxes on Provider's income.

4.5 Disputes. Customer must raise any good-faith dispute over Fees within 30 days of the charge or invoice and pay all undisputed amounts on time. The parties will work in good faith to resolve the dispute.

5. Term and Termination

5.1 Term and Renewal. Each Order Form begins on the effective date stated in it, runs for the Subscription Period, and renews automatically for successive periods of the same length unless either party gives notice of non-renewal before the end of the current period, or by any earlier deadline stated in the Order Form. Unless Provider tells Customer otherwise before a renewal, the Fees for the renewal period are the same as for the period before.

5.2 Termination for Cause. Either party may terminate this Agreement on notice if the other party materially breaches it and fails to cure within 30 days of notice, or becomes insolvent or ceases to do business.

5.3 Effect of Termination. On expiration or termination, Customer's right to use the Product ends (except to export Customer Content as described below) and Customer will pay all Fees accrued before termination. Customer may export its Customer Content for 30 days after termination, after which Provider will delete it, in each case as described in Section 8 of the DPA. Sections 1.4, 1.5, 1.6, 2.1, 4, 5.3, 5.4, and 6 through 13 survive termination.

5.4 Discontinuation. Provider may discontinue the Service, or change it so materially that it no longer serves the purpose described in the Order Form, on reasonable notice to Customer. If it does, Provider will assist with export of Customer Content and refund prepaid Fees for the unused portion of the Subscription Period, and that refund is Customer's sole remedy for the discontinuation or change.

6. Warranties

6.1 Mutual. Each party warrants that it has the authority to enter into this Agreement and will comply with Applicable Laws in performing it.

6.2 From Customer. Customer warrants that Customer Content, and its use as contemplated by this Agreement, does not infringe any third party's intellectual property, privacy, or other rights, and that Customer has obtained all consents required from any individual whose Personal Data, voice, or likeness appears in Customer Content.

6.3 From Provider. Provider will provide the Service with reasonable skill and care and warrants that the Service will perform materially as described in the Order Form. Customer's sole remedy for breach of this warranty is for Provider to use reasonable efforts to correct the issue, or, if Provider cannot do so within a reasonable time, for Customer to terminate the affected Order Form and receive a prorated refund of prepaid Fees for the remainder of the Subscription Period.

7. Disclaimer

Except as expressly stated in Section 6, the Product is provided "as is". Provider disclaims all other warranties, express, implied, or statutory, including merchantability, fitness for a particular purpose, title, and non-infringement, to the maximum extent permitted by Applicable Laws. PROVIDER DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT OUTPUTS WILL BE ACCURATE OR COMPLETE. OUTPUTS ARE NOT LEGAL, FINANCIAL, INVESTMENT, OR OTHER PROFESSIONAL ADVICE AND ARE NOT INTENDED TO BE THE BASIS FOR ANY INVESTMENT OR BUSINESS DECISION. The Documentation describes the Service as it exists from time to time and is not a warranty. Beta Products are provided "as is" without any warranty and may be changed or withdrawn at any time.

8. Limitation of Liability

8.1 Cap. Except for Customer's payment obligations, Customer's breach of Section 2.1 or 6.2, and Customer's indemnification obligations, each party's total cumulative liability arising out of or relating to this Agreement (including under Section 9) will not exceed the Fees paid or payable by Customer in the 12 months before the event giving rise to the claim.

8.2 Exclusion. Neither party will be liable to the other for lost profits or revenues, or for indirect, consequential, special, exemplary, or punitive damages, even if advised of their possibility.

8.3 Scope. These limitations apply regardless of the theory of liability, and nothing in this Agreement excludes liability that cannot be excluded under Applicable Laws.

9. Indemnification

9.1 By Provider. Provider will defend Customer against third-party claims that the Service (excluding Outputs and any third-party data or models), used in accordance with this Agreement, infringes that third party's intellectual property rights, and will pay resulting damages and reasonable legal fees finally awarded or agreed in settlement. Provider may, at its option, modify the Service to make it non-infringing, obtain a license, or terminate the affected Order Form and refund prepaid Fees pro rata. This obligation does not cover claims arising from Customer Content, unauthorized modifications, use in breach of this Agreement, or combination with items not provided by Provider.

9.2 By Customer. Customer will defend Provider against third-party claims arising from Customer Content, Customer's use of the Product in breach of this Agreement, or Customer's failure to obtain required consents, and will pay resulting damages and reasonable legal fees finally awarded or agreed in settlement.

9.3 Procedure. The indemnified party must promptly notify the indemnifying party of the claim, give it sole control of the defense and settlement (provided no settlement admits fault on the indemnified party's behalf without its consent), and provide reasonable cooperation at the indemnifying party's expense.

10. Confidentiality

Each party will use the other's Confidential Information only to perform this Agreement or exercise its rights under it (including, for Provider, under Sections 1.4 and 1.5), will protect it with at least reasonable care, and will not disclose it except to its Affiliates, employees, advisors, service providers, and actual or prospective investors, acquirers, and financing sources who need to know it and are bound by confidentiality obligations, or as required by law (with reasonable notice where permitted). Confidential Information does not include information that is public through no fault of the recipient, already known to the recipient without restriction, received from a third party without restriction, or independently developed. These obligations continue for three years after termination, and indefinitely for trade secrets.

11. Intellectual Property

Provider owns all right, title, and interest in the Product, including improvements developed during the Subscription Period. Customer owns all right, title, and interest in Customer Content. As between the parties, Customer owns Outputs, subject to Provider's rights in the Product and to the fact that Outputs may not be unique. Outputs may include data licensed from third-party data providers, and Customer's use of that data is subject to those providers' terms as identified in the Documentation or otherwise notified to Customer.

12. General Terms

12.1 Governing Law and Courts. This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The parties will attempt in good faith to resolve any dispute through discussion before starting legal proceedings. Any legal proceeding will be brought exclusively in the state or federal courts located in Delaware, and each party submits to their jurisdiction. Either party may seek injunctive relief in any court to protect its intellectual property or Confidential Information. Each party waives any right to a jury trial.

12.2 Entire Agreement. This Agreement, together with the Order Form and the DPA, is the entire agreement between the parties on its subject and supersedes all prior discussions. Provider's Privacy Policy describes how Provider handles personal information it processes for its own purposes, but does not form part of this Agreement. Terms in Customer's purchase orders or vendor forms do not apply.

12.3 Changes. Provider may update these Standard Terms by posting the updated version at renlo.co/terms, which is sufficient notice. Changes apply from the start of Customer's next Subscription Period, or earlier if Customer agrees, except that changes required by Applicable Laws or needed to address a security risk take effect when posted. Changes to an Order Form must be agreed in writing by both parties.

12.4 Assignment. Neither party may assign this Agreement without the other's consent, except to a successor in a merger, acquisition, or sale of substantially all of its assets.

12.5 Publicity. Provider may identify Customer by name and logo as a customer. Any case study or testimonial requires Customer's approval.

12.6 Notices. Notices must be in writing and sent by email to the address in the Order Form or on Customer's account (for Provider, support@renlo.co). Email notices are effective when sent, unless the sender receives a delivery failure.

12.7 Force Majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, except payment obligations.

12.8 Export and Sanctions. Customer will comply with applicable export control and sanctions laws and represents that it is not located in an embargoed country or on any restricted-party list.

12.9 Miscellaneous. The parties are independent contractors. There are no third-party beneficiaries. If any provision is unenforceable, the rest remains in effect. A waiver must be in writing. Provider may use subcontractors and remains responsible for their performance. Section headings are for convenience only. This Agreement may be signed electronically and in counterparts.

13. Definitions

"Affiliate" means an entity that controls, is controlled by, or is under common control with a party.

"Agreement" means the Order Form as governed by these Standard Terms and the documents they incorporate.

"Applicable Laws" means the laws and regulations that apply to a party or to the Product.

"Beta Product" means any feature or version of the Product identified as beta, preview, early access, or similar.

"Confidential Information" means non-public information disclosed by one party to the other in connection with this Agreement that is marked confidential or would reasonably be understood as confidential. Customer Content is Customer's Confidential Information; non-public information about the Product, including pricing, is Provider's.

"Customer Content" means data, documents, recordings, and other materials submitted to the Product by or on behalf of Customer or its Users, excluding Feedback and Usage Data.

"Documentation" means any usage guides, help articles, or descriptions of the Service that Provider makes available from time to time.

"Feedback" means suggestions or comments about the Product.

"Fees" means the amounts payable under an Order Form.

"High Risk Activity" means any use where failure of the Product could reasonably be expected to cause death, bodily injury, or environmental damage.

"Order Form" means the order that establishes Customer's subscription and identifies the seats, Fees, and Subscription Period. It may be an order document accepted by both parties, or an online order or plan selection Customer makes through the Service.

"Outputs" means the documents, summaries, transcripts, analyses, records, and other results the Service generates from Customer Content.

"Payment Processor" means the third-party payment provider Provider uses to process payments.

"Personal Data" has the meaning given in the DPA.

"Product" means the Service, Software, and Documentation.

"Prohibited Data" means protected health information regulated by HIPAA, payment card and bank account numbers, government-issued identification numbers, and similar categories of sensitive data under Applicable Laws.

"Service" means Renlo's AI-native CRM and deal platform for commercial real estate brokers, made available at renlo.co and related applications.

"Software" means any client-side software, browser extension, or application Provider makes available as part of the Product.

"Subscription Period" means the initial term stated in the Order Form and each renewal term.

"Usage Data" means data about the provision, use, and performance of the Product, including account information, feature usage, and technical logs. Usage Data is not Customer Content.

"User" means an individual who uses the Product through Customer's account.

Exhibit A — Data Processing Addendum

Last modified: September 11, 2026

This Data Processing Addendum ("DPA") forms part of the Renlo Standard Terms (the "Agreement") between Renlo, Inc. ("Renlo") and the customer that subscribes to the Service ("Customer"). It describes how Renlo processes Personal Data on Customer's behalf in providing the Service. Capitalized terms not defined here have the meanings in the Agreement. If this DPA conflicts with the Agreement on the subject of Personal Data, this DPA controls.

1. Definitions

"Customer Personal Data" means Personal Data in Customer Content, or in Outputs generated from Customer Content, that Renlo processes on Customer's behalf.

"Data Protection Laws" means the U.S. federal and state privacy laws that apply to the processing of Customer Personal Data, including the California Consumer Privacy Act as amended ("CCPA") and similar state laws.

"Personal Data", "Controller", "Processor", "Data Subject", and "Processing" have the meanings given in Data Protection Laws. Under the CCPA, "Controller" includes "business" and "Processor" includes "service provider".

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data in Renlo's or its Subprocessors' possession.

"Subprocessor" means a third party Renlo engages to process Customer Personal Data.

2. Roles

Customer is the Controller of Customer Personal Data and Renlo is its Processor (or sub-processor, where Customer is itself a Processor). Annex 1 describes the processing. This DPA does not apply to Usage Data or account information that Renlo processes as an independent Controller under its Privacy Policy.

3. Customer's Obligations

Customer will comply with Data Protection Laws in its use of the Service, including by having a lawful basis for collecting Customer Personal Data and providing it to Renlo, giving any required notices, and obtaining any required consents. Where the Service is used to record or transcribe calls or meetings, Customer is responsible for obtaining any consent required from participants. Customer will not submit Prohibited Data unless the Order Form permits it. Customer's instructions to Renlo must be lawful.

4. Renlo's Obligations

4.1 Instructions. Renlo will process Customer Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA, Customer's configuration and use of the Service, and any other instructions agreed in writing. Renlo will inform Customer if it believes an instruction violates Data Protection Laws, unless prohibited from doing so.

4.2 Additional Processing. To the extent permitted by Data Protection Laws, Renlo may also process Customer Personal Data to detect and respond to Security Incidents and fraud, to comply with legal obligations, and, unless Customer has opted out under Section 1.5(d) of the Agreement, to improve the Service.

4.3 Confidentiality. Renlo will ensure its personnel who access Customer Personal Data are bound by confidentiality obligations.

4.4 Security. Renlo will maintain commercially reasonable technical and organizational measures to protect Customer Personal Data, as described in Annex 2.

4.5 Security Incidents. Renlo will notify Customer without undue delay after becoming aware of a Security Incident, will provide the information reasonably available to help Customer meet its own notification obligations, and will take reasonable steps to contain and remediate the incident. Notification is not an admission of fault.

4.6 Data Subject Requests. If Renlo receives a request directly from a Data Subject about Customer Personal Data, Renlo will either forward it to Customer or direct the Data Subject to Customer, and will reasonably assist Customer in responding, primarily through the functionality of the Service.

4.7 Assistance and Compliance Information. Renlo will provide reasonable assistance with Customer's data protection impact assessments and regulator consultations where required by Data Protection Laws and relevant to the Service. On reasonable request, Renlo will provide information reasonably necessary to demonstrate compliance with this DPA, such as responses to a security questionnaire and copies of any third-party audit reports or certifications it holds. If Data Protection Laws require an audit that cannot be satisfied this way, Customer or an independent auditor bound by confidentiality may conduct one on reasonable notice, during business hours, no more than once a year, without unreasonably disrupting Renlo's operations, and at Customer's expense.

5. Subprocessors

Customer generally authorizes Renlo to engage Subprocessors to process Customer Personal Data, and to add, replace, or remove Subprocessors at any time. Renlo will make its current list of Subprocessors available to Customer on request. Renlo is not required to give advance notice of a change to its Subprocessors, and a change of Subprocessor does not give Customer a right to object to the change, to terminate this Agreement or an Order Form, or to any refund. Renlo will have a written agreement with each Subprocessor that requires it to protect Customer Personal Data as Data Protection Laws require, and remains responsible for its Subprocessors' performance.

6. Processing Location and Non-U.S. Laws

Customer authorizes Renlo and its Subprocessors to process Customer Personal Data in the United States and in other countries where they operate. The Service is currently offered to U.S. customers. If Customer submits Personal Data subject to the data protection laws of another jurisdiction (such as the EU or UK), Customer will notify Renlo, and the parties will agree any additional terms those laws require, such as standard contractual clauses, before that data is processed.

7. CCPA and U.S. State Law

To the extent the CCPA or a similar U.S. state law applies, Renlo acts as a service provider or processor and will: process Customer Personal Data only to provide the Service and for the other purposes permitted by Section 4.2; not sell or share it; not retain, use, or disclose it outside the direct business relationship with Customer or for any other purpose, except as the law permits; not combine it with Personal Data from other sources except as the law permits; provide the level of privacy protection the law requires; notify Customer if it can no longer meet its obligations; and allow Customer to take reasonable steps to ensure compliance and to stop and remediate unauthorized use.

8. Return and Deletion

Customer may export Customer Content using the export features of the Service during the Agreement and for 30 days after it ends. After that, Renlo will delete Customer Content (including Customer Personal Data) from active systems within a reasonable time, and from backups in the ordinary course of its backup rotation, except where retention is required by law, in which case it remains protected under this DPA. Anonymized, de-identified, or aggregated data that does not identify Customer or any individual is not subject to deletion.

9. Liability and Term

Liability under this DPA is subject to the limitations in the Agreement. This DPA applies for as long as Renlo processes Customer Personal Data.

Annex 1 — Details of Processing

Parties. Customer, at the notice address in the Order Form or on Customer's account, as Controller. Renlo, Inc., a Delaware corporation, support@renlo.co, as Processor.

Subject matter and purpose. Providing Renlo's AI-native CRM and deal platform for commercial real estate brokers, including hosting, organizing, enriching, transcribing, summarizing, and analyzing Customer Content and generating Outputs.

Duration. The Subscription Period plus the return and deletion period in Section 8.

Data Subjects. Customer's employees and Users; Customer's clients, prospects, and contacts; property owners, tenants, investors, lenders, brokers, and other counterparties; participants in recorded calls and meetings.

Personal Data. Names, contact details, job titles and employers; property ownership and transaction information; communications including emails, notes, call and meeting recordings and transcripts; deal and pipeline activity; and any other Personal Data Customer chooses to submit.

Sensitive data. None intended.

Frequency. Continuous during the Agreement.

Annex 2 — Security Measures

Renlo maintains commercially reasonable technical and organizational security measures appropriate to the nature of the data and the size and stage of its business, covering access control, encryption in transit, hosting with reputable cloud providers, separation of customer data, backups, incident response, and personnel confidentiality. Renlo's AI providers are contractually prohibited from training their models on Customer Personal Data. Renlo will continue to develop its security program as it grows and may adopt additional or replacement measures over time. Renlo will describe its current measures on request.