Master Service Agreement

1.1.1 Parties and Purpose. This Master Services Agreement ("Agreement") governs access to and use of the Mrava Platform and related services provided by Mrava UG (haftungsbeschränkt) ("Mrava") to the customer identified in an applicable Order Form (or creating an account for a trial/pilot) ("Customer").

1.1.2 Scope of Services. This Agreement applies to (a) Customer's and its Affiliates' and Authorized Users' use of the Platform, including any features labeled as automation or AI-driven functionality, and (b) any integrations enabled by Customer (including email, ERP/accounting, and banking connectivity), in each case as configured by Customer.

1.1.3 Order Forms; Precedence. Specific commercial terms (including subscription term, and usage limits) are set out in one or more order forms, statements of work, or similar documents referencing this Agreement ("Order Form"). If there is a conflict, the following order of precedence applies: (1) Order Form, (2) this Agreement, (3) any applicable policies or exhibits expressly incorporated by reference.

1.1.4 Data Processing. Where Mrava processes personal data on behalf of Customer, the parties' data processing terms are governed by the Data Processing Agreement ("DPA"), which is incorporated by reference. If there is a conflict between this Agreement and the DPA regarding personal data processing, the DPA controls.

1.1.5 No Financial Institution; No Advice. Mrava provides software and technical services. Mrava is not a bank, payment institution, regulated financial service provider, or financial advisor, and does not provide legal, tax, accounting, or regulatory advice. The customer remains responsible for its finance decisions and compliance obligations.

1.1.6 Free Trial & Beta Services. If a customer is granted access to the Platform for a trial, proof of concept (POC), or "Beta" period, such access is provided "AS-IS" without warranty or SLA. Mrava may suspend or terminate trial access at any time.

For purposes of this Agreement, the following definitions apply:

1.2.1 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than fifty percent (50%) of the voting shares or other equity interests.

1.2.2 "AI Agents" means software-based functionalities within the Platform that use automation and/or machine learning to assist with tasks such as extraction, classification, drafting, summarization, recommendations, or workflow actions, as enabled by Customer.

1.2.3 "Authorized Users" means Customer's employees, contractors, and other individuals authorized by Customer to access the Platform under Customer's account, subject to assigned permissions.

1.2.4 "Autonomy Modes" means the configurable operating modes that determine how AI Agents behave within the Platform, including:

• "Advisory": AI Agents provide suggestions, drafts, summaries, or recommendations that require user review and action.
• "Assisted": AI Agents may perform limited actions within the Platform workflow based on Customer configuration, while maintaining required user approvals for defined high-risk actions.
• "Autopilot": AI Agents may execute predefined workflow actions within the Platform in accordance with Customer configuration and controls; high-risk actions remain subject to mandatory human control as set out in this Agreement and the Platform settings.

1.2.5 "Customer Data" means any data, content, files, documents, messages, records, or information submitted to, uploaded to, transmitted through, or processed within the Platform by or on behalf of Customer or its Authorized Users, including financial documents and related communications.

1.2.6 "Documentation" means user guides, knowledge base materials, and technical documentation made available by Mrava describing the Platform's features and usage.

1.2.7 "Integrations" means connections between the Platform and third-party services or systems (including email providers, ERP/accounting systems, and banking or payment connectivity providers) enabled by Customer.

1.2.8 "Platform" means Mrava's hosted software platform (including web and mobile interfaces, APIs made available as part of the service, and associated functionality) and any updates provided by Mrava.

1.2.9 "Order Form" has the meaning set out in Section 1.1.3.

1.2.10 "Services" means access to and use of the Platform and any related professional services expressly purchased under an Order Form (if any).

1.2.11 "Usage Fees" means variable fees based on consumption or usage metrics (for example, volume of documents processed, AI usage, or enabled integrations), as specified in the applicable Order Form.

1.2.12 "User Content" means content submitted by Authorized Users within the Platform, including comments, internal notes, tags, chat messages, and workflow annotations. User Content is a subset of Customer Data.

1.2.13 "Third-Party Services" means any products, services, platforms, or systems not provided by Mrava, including Integrations and any third-party providers used to enable them.

2.1.1 Grant of Access. Subject to this Agreement and any applicable Order Form, Mrava grants Customer a limited, non-exclusive, non-transferable right to access and use the Platform (including any associated mobile applications) for its internal business purposes during the applicable subscription term.

2.1.2 Authorized Users. Access to the Platform is limited to Authorized Users (which may include employees or contractors of Customer's Affiliates). Customer is responsible for all activities conducted under its accounts and for ensuring that Authorized Users comply with this Agreement.

2.1.3 Access Methods. The Platform may be accessed via web interfaces, mobile interfaces, and other access methods made available by Mrava from time to time. Mrava may modify or discontinue specific access methods provided that the core functionality of the Services is not materially reduced.

2.1.4 Credentials & Security. Customer is responsible for maintaining the confidentiality of login credentials and for promptly notifying Mrava of any suspected unauthorized access. Mrava is not responsible for access resulting from compromised credentials unless caused by Mrava's breach of this Agreement.

2.2.1 Availability. Mrava will use commercially reasonable efforts to make the Platform available in accordance with any availability targets or support commitments expressly set out in an applicable Order Form.

2.2.2 No Implied SLA. Except as expressly stated in an Order Form, the Platform is provided without any guaranteed uptime, response times, or service levels.

2.2.3 Support. Mrava may provide technical support in accordance with its then-current support practices. The scope and priority of support may vary depending on the subscription tier or commercial arrangement.

2.2.4 Third-Party Dependencies. Availability of the Platform may be affected by Third-Party Services, including email providers, ERP systems, and banking or payment connectivity providers. Mrava is not responsible for outages, delays, or errors caused by such Third-Party Services or for any changes to their APIs that may temporarily disrupt functionality.

2.3.1 Sandbox and Test Environments. Mrava may make sandbox, test, preview, or beta environments or features available to Customer for evaluation or testing purposes ("Beta Services").

2.3.2 Non-Production Use. Beta Services are not intended for production use and may contain defects, incomplete functionality, or data inconsistencies.

2.3.3 Testing Data. The customer is solely responsible for the data it chooses to use in Beta Services and should avoid using live, sensitive, or production data unless expressly agreed otherwise in writing. Mrava shall have no liability for any loss, corruption, or public disclosure of data entered into Beta Services.

2.3.4 No Warranties or SLA. Beta Services are provided "AS IS" without warranties, service levels, or support commitments, and Mrava may modify or discontinue them at any time.

2.4.1 Ongoing Development. Customer acknowledges that the Platform is an evolving service. Mrava may update, enhance, modify, or replace features of the Platform as part of its ongoing development.

2.4.2 Regulatory and Security Changes. Mrava may implement changes to the Platform to address legal, regulatory, security, or risk management requirements, including changes affecting automation, AI functionality, or integrations.

2.4.3 No Material Degradation. Mrava will not materially reduce the core functionality of the Services purchased by Customer during an active subscription term, except where required for security, compliance, or legal reasons or due to the deprecation of a Third-Party Service integration.

2.4.4 Feature Toggles. Certain features, including AI Agents and Autonomy Modes, may be configurable or optional and can be enabled, limited, or disabled by Customer or, where necessary, by Mrava to mitigate risk.

2.5.1 Right to Suspend. Mrava may temporarily suspend access to all or part of the Platform, without terminating this Agreement, if Mrava reasonably determines that:

• (a) there is a security incident, suspected breach, or risk to the Platform or Customer Data;
• (b) Customer's use of the Platform poses a legal, regulatory, or compliance risk;
• (c) Customer is in material breach of this Agreement, including non-payment of undisputed fees past due by more than fifteen (15) days; or
• (d) suspension is required to protect Mrava, Customer, or third parties.

2.5.2 Scope and Duration. Any suspension will be limited in scope and duration to what Mrava reasonably considers necessary to address the underlying issue.

2.5.3 Notice. Where practicable, Mrava will provide notice of the suspension and an opportunity to remediate the issue. However, Mrava reserves the right to suspend immediately without prior notice in the event of a security threat or legal requirement.

2.5.4 Effect of Suspension. During a suspension, Customer's access to the affected Services may be restricted, but this Agreement will remain in effect unless otherwise terminated in accordance with Section 10.

3.1.1 Technical Service Only. Mrava provides software and technical services that enable the customer to connect with Third-Party Services, including banking, payment, ERP, and email providers. Mrava does not itself provide banking, payment, or regulated financial services.

3.1.2 No Custody or Control of Funds. Mrava does not hold, custody, control, or transfer Customer funds. Any movement of funds is executed exclusively by Third-Party Services pursuant to Customer's agreements with those providers.

3.1.3 No Financial Advice. Information, insights, alerts, or outputs generated through the Platform are provided for informational and operational support purposes only and do not constitute financial, accounting, legal, or regulatory advice.

3.2.1 Payment Initiation Support. Where enabled by Customer, the Platform may support the preparation, initiation, or transmission of payment instructions to Third-Party Services (including banks or payment service providers) on Customer's behalf.

3.2.2 Customer Authorization and Responsibility. All payment instructions are initiated based on Customer configuration, approvals, and authorizations. Customer remains solely responsible for:

• (a) the accuracy of payment details,
• (b) the approval of payments, and
• (c) compliance with applicable laws and internal controls.

3.2.3 No Execution Guarantee. Mrava does not guarantee the execution, settlement, timing, or success of any payment instruction and is not responsible for rejected, delayed, duplicated, or failed payments caused by Third-Party Services or resulting from insufficient funds, authentication failures, or risk blocks imposed by Customer's bank.

3.2.4 Liability Boundary. Mrava shall not be liable for losses arising from payment execution, settlement errors, or bank processing issues, except to the extent directly caused by Mrava's breach of this Agreement.

3.3.1 Read-Only Account Data. Where enabled, the Platform may retrieve account information, balances, and transaction data from Third-Party Services for reconciliation, reporting, and workflow purposes.

3.3.2 Data Accuracy. Account information is provided to Mrava by Third-Party Services. Mrava does not verify, reconcile, or guarantee the accuracy, completeness, or timeliness of such information.

3.3.3 Informational Use Only. Retrieved account data is provided for informational and operational support purposes and should not be relied upon as a definitive source for cash position, liquidity, or regulatory reporting without independent verification. Mrava is not liable for overdraft fees, interest penalties, or failed payments resulting from reliance on data that may be cached or delayed.

3.4.1 Customer-Enabled Write Access. Where Customer enables write-back or synchronization features with ERP or accounting systems, the Platform may create, update, or modify records in such systems based on Customer configuration and approved workflows.

3.4.2 Customer Responsibility for Configuration. Customer is solely responsible for:

• (a) mapping of fields and accounts,
• (b) configuration of approval flows, and
• (c) validation of postings prior to execution.

3.4.3 No Ledger Guarantee. Mrava does not guarantee that postings, updates, or reversals performed via Integrations will be error-free or compliant with Customer's accounting policies.

3.4.4 Limitation of Liability. Mrava shall not be liable for ledger corruption, mispostings, or accounting errors resulting from Customer configuration choices, Third-Party Service behavior, or data provided by Customer, except where directly caused by Mrava's breach of this Agreement.

3.4.5 Rollbacks. While the Platform may offer features to reverse or "rollback" entries, Customer acknowledges that such actions depend on Third-Party Service APIs and may not be fully reversible. Mrava is not liable if a Third-Party Service rejects a reversal request.

3.5.1 Email Integration Scope. Where authorized by Customer, the Platform may integrate with email providers to support finance workflows, including:

• reading emails and attachments,
• extracting and structuring data,
• drafting and sending messages on behalf of Authorized Users, and
• modifying email state (such as labels, folders, or processing status).

3.5.2 Customer Control and Sender of Record. Email integrations are enabled and configured by Customer. Customer acknowledges that it is the "sender of record" for all communications transmitted via the Platform (whether user-initiated or AI-automated). Customer remains responsible for:

• determining which actions are permitted,
• approving automated or AI-assisted communications, and
• compliance with applicable anti-spam and communications laws (including CAN-SPAM and GDPR).

3.5.3 No Monitoring Obligation. Mrava does not monitor the content or legality of communications sent via the Platform and does not guarantee delivery, receipt, or correctness of any email.

3.5.4 Liability Boundary. Mrava is not responsible for communications sent via Third-Party Services except to the extent directly caused by Mrava's breach of this Agreement.

3.5.5 Third-Party Acceptable Use. Customer warrants that its use of Email Integrations will comply with the applicable Acceptable Use Policies (AUPs) of the Third-Party Service (e.g., Google or Microsoft), including prohibitions on spam, phishing, or bulk messaging.

3.6.1 Third-Party Services. The Platform depends on Third-Party Services, including banks, payment providers, ERP systems, and email providers. Such services are governed by Customer's separate agreements with those providers.

3.6.2 Availability and Changes. Mrava is not responsible for the availability, performance, security, or changes to Third-Party Services, including API deprecations, outages, or functional limitations that may affect the Platform.

3.6.3 No Warranty for Third-Party Services. Mrava makes no warranties regarding Third-Party Services and disclaims all liability arising from their acts or omissions, except as required by applicable law.

4.1.1 Configurable Autonomy. The Platform includes AI Agents that may operate under different Autonomy Modes as configured by Customer. Autonomy Modes determine whether AI Agents provide recommendations only or may execute certain workflow actions.

4.1.2 Advisory Mode. In Advisory mode, AI Agents provide suggestions, drafts, summaries, classifications, or recommendations. All actions require review and execution by an Authorized User.

4.1.3 Assisted and Autopilot Modes. In Assisted or Autopilot modes, AI Agents may execute predefined workflow actions in accordance with Customer configuration, subject to the mandatory human control requirements set out in this Agreement and the Platform settings.

4.1.4 Customer Control. Customer may enable, limit, or disable Autonomy Modes at any time through the Platform. The customer is responsible for selecting appropriate Autonomy Modes based on its risk tolerance, internal controls, and compliance requirements.

4.2.1 High-Risk Actions Defined. Certain actions are deemed high-risk due to their potential financial, legal, or compliance impact, including, without limitation:

• (a) initiating or approving payments,
• (b) modifying accounting or ledger records,
• (c) sending external communications to suppliers or third parties,
• (d) changing supplier master data, and
• (e) any other actions designated as high-risk in the Platform or Documentation.

4.2.2 Human-in-the-Loop Requirement. High-risk actions require explicit approval or confirmation by an Authorized User, regardless of the selected Autonomy Mode, unless Customer has expressly configured otherwise where permitted by the Platform (e.g., enabling autonomous emails). Notwithstanding the foregoing, the execution of payments or transfer of funds shall always require explicit human approval and cannot be fully automated.

4.2.3 Customer Responsibility. Customer is responsible for defining approval thresholds, assigning appropriate roles, and ensuring that Authorized Users review and approve high-risk actions in accordance with Customer's internal policies.

4.3.1 Decision Support Tool. AI Agents are designed to support and augment Customer workflows. AI outputs do not replace human judgment or professional decision-making.

4.3.2 No Guaranteed Outcomes. Mrava does not warrant that AI outputs will be accurate, complete, or suitable for any specific purpose.

4.3.3 Customer Accountability. Customer remains solely responsible for all decisions, approvals, and actions taken based on AI outputs, including where such outputs are generated or executed under Assisted or Autopilot modes.

4.3.4 Liability Boundary. Mrava shall not be liable for losses arising from Customer's reliance on AI outputs, except to the extent directly caused by Mrava's breach of this Agreement.

4.4.1 Automated Communications. Where enabled by Customer, AI Agents may draft or send communications (including emails) to suppliers or other third parties on Customer's behalf, in accordance with Customer configuration and Autonomy Modes.

4.4.2 Sender of Record. Customer acknowledges that it is the sender of record for all AI-assisted or AI-automated communications transmitted via the Platform.

4.4.3 Compliance Responsibility. Customer is responsible for ensuring that all automated communications comply with applicable laws, regulations, and Third-Party Service policies, including anti-spam, data protection, and communications requirements.

4.4.4 Indemnity. Customer shall indemnify and hold harmless Mrava from claims arising out of unlawful, misleading, or non-compliant communications sent via the Platform, except to the extent directly caused by Mrava's breach of this Agreement.

4.5.1 Probabilistic Nature of AI. Customer acknowledges that AI Agents may generate outputs based on probabilistic models and may occasionally produce incorrect, incomplete, or misleading results (often referred to as "hallucinations").

4.5.2 Verification Obligation. Customer agrees to review and verify AI outputs before relying on them for financial, accounting, legal, or operational decisions.

4.5.3 No Reliance Guarantee. Mrava disclaims any liability arising from errors, omissions, or inaccuracies in AI outputs, except to the extent directly caused by Mrava's breach of this Agreement.

5.1.1 Subscription Fees. Customer shall pay the subscription fees for access to the Platform as set out in the applicable Order Form. Subscription fees are typically charged on a recurring basis (e.g., monthly or annually) in advance and are non-cancelable and non-refundable during the applicable subscription term unless expressly stated otherwise in the Order Form.

5.1.2 Usage Fees. In addition to subscription fees, Customer may incur Usage Fees based on actual consumption of certain features, including AI Agents, document processing, or enabled Integrations, as specified in the applicable Order Form or pricing schedule. Unless otherwise specified in an Order Form (e.g., as pre-purchased credits), Usage Fees are billed in arrears.

5.1.3 Measurement of Usage. Usage Fees are calculated based on usage metrics recorded by the Platform. Such measurements shall be deemed accurate unless Customer notifies Mrava of a good-faith dispute within thirty (30) days of receipt of the relevant invoice.

5.1.4 Changes to Usage. Customer acknowledges that Usage Fees may vary depending on its level of activity, configuration choices, and enabled Autonomy Modes. Customer is responsible for monitoring its usage through the Platform.

5.1.5 Price Adjustments. Mrava may increase the fees applicable to a renewal term by providing written notice to Customer at least sixty (60) days prior to the start of such renewal term. If Customer does not object to the increase prior to the renewal date, the increased fees will apply.

5.2.1 Invoicing. Mrava will invoice Customer in accordance with the billing frequency specified in the applicable Order Form. Invoices may be issued electronically. Customer is responsible for providing complete and accurate billing and contact information to Mrava and notifying Mrava of any changes to such information.

5.2.2 Payment Terms. Unless otherwise stated in an Order Form, invoices are payable within thirty (30) days from the invoice date.

5.2.3 Late Payments. Any undisputed amounts not paid when due may accrue interest at the statutory rate applicable under German law, calculated from the due date until payment is received.

5.2.4 Suspension for Non-Payment. In accordance with Section 2.5, Mrava may suspend access to the Platform for undisputed fees that remain unpaid more than fifteen (15) days after written notice, without terminating this Agreement.

5.2.5 No Withholding. Customer shall not withhold or offset payments except where expressly permitted by applicable law.

5.2.6 Payment Methods. Payments shall be made via SEPA Direct Debit, bank transfer (Wire), or credit card, as authorized in the Order Form. Checks are not accepted.

5.3.1 Taxes. Fees are exclusive of all applicable taxes, duties, or levies, including value-added tax (VAT), sales tax, or similar charges. Customer is responsible for payment of all such taxes, except for taxes based on Mrava's net income. If Customer is located in the EU (outside Germany), the Reverse Charge Mechanism may apply.

5.3.2 Tax Documentation. Mrava shall provide reasonable documentation to support applicable tax treatment, including VAT identification numbers where required.

5.3.3 Invoice Disputes. Customer must notify Mrava in writing of any good-faith dispute regarding an invoice within thirty (30) days of receipt, specifying the basis for the dispute. The parties shall work together in good faith to resolve the dispute promptly.

5.3.4 Undisputed Amounts. Customer shall pay all undisputed portions of an invoice in accordance with the payment terms while a dispute is being resolved.

6.1.1 Accuracy of Data. Customer is responsible for the accuracy, completeness, and legality of all Customer Data provided to or processed through the Platform, including financial documents, supplier information, payment details, and User Content.

6.1.2 Credentials and Access Management. Customer is responsible for safeguarding credentials used to access the Platform and any Integrations, including API keys, OAuth tokens, and banking credentials, for enforcing Multi-Factor Authentication (MFA) where supported, and for promptly revoking access for departing or unauthorized users.

6.1.3 No Reliance on Platform Validation. While the Platform may perform automated checks or validations, Customer acknowledges that such checks do not replace Customer's own controls and verification processes.

6.2.1 Supplier Communications. Customer is solely responsible for all communications with suppliers and third parties conducted via the Platform, including communications drafted or sent using AI Agents.

6.2.2 Anti-Spam and Communications Laws. Customer shall ensure that all communications comply with applicable laws and regulations, including anti-spam, marketing, and data protection laws (such as GDPR and CAN-SPAM), as well as any contractual obligations owed to suppliers.

6.2.3 No Bulk or Abusive Use. Customer shall not use the Platform to send unsolicited, deceptive, or abusive messages, or to conduct bulk communications in violation of applicable laws or Third-Party Service policies.

6.2.4 Supplier Portals. Where the Platform enables supplier portals or automated supplier interactions, Customer is responsible for determining the appropriateness of such features and for managing supplier access and consent.

6.2.5 Supplier Data Rights Warranty. Customer warrants that it has obtained all necessary rights, consents, and legal bases to input supplier contact information into the Platform and to contact such suppliers via the Platform's communication tools.

6.3.1 Configuration Responsibility. Customer is responsible for configuring the Platform, including workflows, approval thresholds, Autonomy Modes, security settings, and role-based access controls (RBAC), in accordance with its internal policies and risk management requirements.

6.3.2 Administrative Users. Customer shall designate qualified administrators to manage permissions, roles, and system settings. Actions taken by administrators are deemed actions of Customer.

6.3.3 Misconfiguration Risk. Mrava is not responsible for errors, losses, or compliance issues arising from Customer misconfiguration, inadequate access controls, or failure to review and test configuration changes (e.g., setting approval thresholds too high or granting excessive user permissions).

6.3.4 Review and Oversight. Customer is responsible for periodically reviewing user permissions, workflows, and automation settings to ensure they remain appropriate.

6.4.1 Third-Party Agreements. Customer's use of Integrations is subject to Customer's agreements with the applicable Third-Party Services. Customer is responsible for complying with all applicable terms, acceptable use policies, and technical requirements imposed by such providers.

6.4.2 No Circumvention. Customer shall not use the Platform to circumvent usage limits, security measures, or contractual restrictions imposed by Third-Party Services.

6.4.3 Consequences of Non-Compliance. Mrava is not liable for suspension, termination, or restriction of access to Third-Party Services resulting from Customer's non-compliance with third-party terms or policies.

6.4.4 API Rate Limits. Customer acknowledges that Third-Party Services (e.g., Outlook, Gmail, OpenAI, Banks) may impose API rate limits or usage quotas. Mrava is not liable for service interruptions caused by Customer exceeding these third-party limits.

7.1.1 Customer Data Ownership. As between the parties, Customer retains all right, title, and interest in and to Customer Data, including User Content. Mrava does not acquire any ownership rights in Customer Data.

7.1.2 License to Provide the Services. Customer grants Mrava a limited, non-exclusive, worldwide license to host, process, transmit, use, and display Customer Data solely as necessary to provide, secure, support, and maintain the Services in accordance with this Agreement and the DPA.

7.1.3 User Content License. Customer grants Mrava the right to use User Content (including internal notes, comments, chat messages, and workflow annotations) for the purposes of operating the Platform, enabling collaboration, maintaining audit trails, and providing AI-assisted functionality as configured by Customer.

7.1.4 No Sale of Data. Mrava does not sell Customer Data or User Content and does not use such data for advertising or marketing purposes.

7.2.1 Mrava IP. Mrava retains all right, title, and interest in and to the Platform, the Services, Documentation, AI Agents, models, workflows, algorithms, and any related intellectual property, including all improvements, enhancements, or derivatives thereof.

7.2.2 Restrictions. Except as expressly permitted under this Agreement, Customer shall not copy, modify, reverse engineer, decompile, or otherwise attempt to derive the source code, models, or underlying structure of the Platform or AI Agents.

7.2.3 Feedback. Customer may provide feedback or suggestions regarding the Platform. Mrava may use such feedback without restriction or obligation, provided it does not include Customer Data or Confidential Information.

7.3.1 Service Improvement. Mrava may use aggregated, anonymized, and de-identified data derived from Customer's use of the Platform ("Usage Data") to improve, maintain, and develop the Services, including improving extraction accuracy, workflows, and system performance. Mrava retains all ownership rights in such Usage Data.

7.3.2 No Training on Customer Content. Mrava does not use raw Customer Data, User Content, or identifiable customer communications to train, fine-tune, or improve its own proprietary generalized artificial intelligence or large language models. Where Customer Data is processed by Third-Party AI Providers, such processing is governed by the applicable data protection and confidentiality obligations imposed on those providers and is limited to what is necessary to provide the requested functionality, ensure security, prevent abuse, or comply with applicable law. Such data is not used by Mrava or its providers for advertising or unrelated purposes.

7.3.3 Third-Party AI Providers. Where AI functionality relies on third-party AI providers, such providers process data solely to deliver the requested functionality and do not use Customer Data to train their models, in accordance with applicable contractual commitments.

7.4.1 Confidential Information. Each party may receive confidential or proprietary information of the other party ("Confidential Information"). Confidential Information includes non-public business, technical, financial, or product information disclosed in connection with this Agreement.

7.4.2 Obligations. Each party shall:

• (a) use Confidential Information solely to perform under this Agreement, and
• (b) protect Confidential Information using reasonable measures at least as protective as those used for its own similar information.

These obligations shall survive for a period of three (3) years following the termination of this Agreement, except that trade secrets shall remain confidential for as long as they qualify as a trade secret under applicable law.

7.4.3 Exclusions. Confidential Information does not include information that is publicly available without breach, independently developed, or rightfully received from a third party without confidentiality obligations.

7.4.4 Publicity. Customer grants Mrava the right to identify Customer as a customer in marketing materials (e.g., name and logo), unless Customer notifies Mrava in writing that it opts out.

7.5.1 Audit Requests. Upon reasonable prior written notice and no more than once per twelve (12) months, Customer may request information reasonably necessary to verify Mrava's compliance with its obligations under this Agreement and the DPA.

7.5.2 Audit Scope and Cost. Audits shall be limited to documentation reviews, third-party certifications, or questionnaires. On-site audits require mutual agreement, shall be conducted at Customer's sole expense, and shall not unreasonably disrupt Mrava's operations.

7.5.3 Government or Regulator Requests. If Mrava receives a legally binding request from a government authority for Customer Data, Mrava will, where legally permitted, notify Customer and cooperate to limit the scope of disclosure.

7.6.1 Security Measures. Mrava implements and maintains appropriate technical and organizational security measures designed to protect Customer Data against unauthorized access, loss, or disclosure, in accordance with industry standards.

7.6.2 Data Processing Agreement. To the extent Mrava processes personal data on behalf of Customer, such processing is governed by the Data Processing Agreement (DPA), which is incorporated by reference into this Agreement.

7.6.3 Security Policies. Additional information regarding Mrava's security practices may be made available in a security policy, trust center, or similar documentation upon request.

7.6.4 Incident Response. Mrava will notify Customer of personal data breaches in accordance with the DPA and applicable data protection laws.

8.1.1 As-Is Provision. Except as expressly set out in this Agreement, the Services (including the Platform, AI Agents, Beta Services, and Integrations) are provided "AS IS" and "AS AVAILABLE."

8.1.2 No Implied Warranties. To the maximum extent permitted by law, Mrava disclaims all implied warranties, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, non-infringement, or uninterrupted operation.

8.1.3 No Regulatory or Professional Warranty. Mrava does not warrant that use of the Services will ensure compliance with any law, regulation, accounting standard, or internal policy, or that the Services replace professional judgment.

8.2.1 Operational Support Only. Alerts, reminders, task lists, due-date tracking, and notifications provided by the Platform are for operational support purposes only.

8.2.2 No Guarantee of Completeness or Timeliness. Mrava does not guarantee that alerts or tasks will be complete, accurate, delivered on time, or acted upon.

8.2.3 Customer Responsibility. Customer remains solely responsible for monitoring deadlines, statutory obligations, payment due dates, filings, approvals, and compliance actions, regardless of whether the Platform provides related alerts or reminders.

8.3.1 Liability Cap. To the maximum extent permitted by law, Mrava's total aggregate liability arising out of or related to this Agreement shall not exceed the total fees paid or payable by Customer to Mrava under the applicable Order Form during the twelve (12) months preceding the event giving rise to the claim.

8.3.2 Per-Contract Cap. The liability cap applies in the aggregate across all claims and shall not be increased by the existence of multiple claims or Order Forms.

8.3.3 Basis of the Bargain. The parties acknowledge that this limitation of liability reflects the allocation of risk and is a fundamental element of the commercial agreement.

8.4.1 Excluded Damages. To the maximum extent permitted by law, neither party shall be liable for any indirect, incidental, consequential, special, punitive, or exemplary damages, including loss of profits, revenue, reputation, business, goodwill, or anticipated savings. Liability for loss of data is limited to the typical recovery effort that would have occurred if Customer had performed regular backups.

8.4.2 Banking and Third-Party Errors. Mrava shall not be liable for losses, damages, or interruptions arising from or related to (i) the performance, availability, accuracy, security, or actions of Third-Party Services or external systems, (ii) failures, delays, reversals, or errors in external processing or execution, or (iii) Customer's configuration, use, or misuse of the Platform, except to the extent directly caused by Mrava's breach of this Agreement.

8.4.3 Mandatory Liability. Notwithstanding anything to the contrary in this Agreement, nothing herein shall exclude or limit either party's liability to the extent such liability cannot be excluded or limited under applicable law.

9.1.1 IP Infringement Indemnity. Mrava shall defend Customer against any third-party claim alleging that the Platform, when used in accordance with this Agreement, infringes or misappropriates such third party's intellectual property rights, and shall indemnify Customer for damages finally awarded or agreed in settlement, including reasonable legal fees, to the extent such claim arises directly from the Platform.

9.1.2 Exclusions. Mrava shall have no obligation under this Section 9.1 to the extent a claim arises from:

• (a) Customer Data or User Content;
• (b) use of the Platform in combination with products, services, or data not provided by Mrava;
• (c) use of the Platform in violation of this Agreement or applicable law; or
• (d) modifications to the Platform not made or authorized by Mrava.

9.1.3 Mitigation. If the Platform becomes, or in Mrava's reasonable opinion is likely to become, subject to an infringement claim, Mrava may, at its option and expense:

• (a) procure the right for Customer to continue using the Platform;
• (b) modify or replace the affected functionality to be non-infringing; or
• (c) terminate the affected Services and refund any prepaid, unused fees for the terminated portion (pro-rated for the remainder of the term).

9.2.1 Customer Indemnity. Customer shall defend, indemnify, and hold harmless Mrava from and against any third-party claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising out of or related to:

• (a) Customer Data or User Content, including allegations that such data is unlawful, infringing, inaccurate, or processed without proper rights or legal basis;
• (b) communications sent via the Platform, including AI-assisted or automated communications, that violate applicable law, regulations, or Third-Party Service policies (including anti-spam or data protection requirements);
• (c) Customer's misuse of the Platform or breach of this Agreement; or
• (d) Customer's violation of any applicable laws or third-party terms.

9.3.1 Notification and Control. The party seeking indemnification must:

• (a) promptly notify the indemnifying party in writing of the claim (provided that failure to notify will not relieve the indemnifying party of liability except to the extent prejudiced by the delay);
• (b) grant the indemnifying party sole control of the defense and settlement of the claim; and
• (c) provide reasonable assistance, at the indemnifying party's expense.

9.3.2 Settlement Limitations. The indemnifying party may not enter into any settlement that admits fault, imposes non-monetary obligations, or involves a payment by the indemnified party without the indemnified party's prior written consent, such consent not to be unreasonably withheld.

10.1.1 Subscription Term. This Agreement commences on the effective date set out in the applicable Order Form (or, for trials or pilots, on the date access is first granted) and continues for the initial subscription term specified in the Order Form ("Initial Term").

10.1.2 Renewal. Unless otherwise stated in the applicable Order Form, the subscription will automatically renew for successive renewal terms of equal length ("Renewal Term"), unless either party provides written notice of non-renewal at least thirty (30) days prior to the end of the then-current term.

10.1.3 Renewal Fees. Fees applicable to any Renewal Term will be as set out in the applicable Order Form or as adjusted in accordance with Section 5.1.5.

10.2.1 Termination by Either Party. Either party may terminate this Agreement for cause upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice.

10.2.2 Immediate Termination. Either party may terminate this Agreement immediately upon written notice if the other party:

• (a) commits a material breach that is not capable of cure;
• (b) becomes insolvent, enters liquidation, or ceases business operations; or
• (c) engages in unlawful conduct in connection with this Agreement.

10.2.3 Termination of Trials or Beta Services. Mrava may terminate access to any trial, pilot, or Beta Services at any time without notice and without liability.

10.3.1 Cessation of Access. Upon termination or expiration of this Agreement, Customer's right to access and use the Platform shall cease.

10.3.2 Outstanding Fees & Acceleration. Termination does not relieve Customer of its obligation to pay any fees accrued or payable prior to the effective date of termination. If Mrava terminates this Agreement for cause (under Section 10.2) or if Customer terminates without cause prior to the end of the then-current subscription term, Customer shall remain obligated to pay all fees that would have become payable for the remainder of such term in accordance with the applicable billing schedule (e.g., monthly), as if this Agreement had remained in effect through the end of the term.

10.3.3 Data Export. Upon written request made within thirty (30) days following termination, Mrava will make Customer Data available for export in a commercially reasonable format (e.g., CSV, JSON, or PDF). Mrava reserves the right to charge reasonable fees for custom data extraction requests or non-standard formats requiring engineering support.

10.3.4 Data Deletion. After the data export period, Mrava will render Customer Data inaccessible ('soft delete') and subsequently permanently delete Customer Data in accordance with its internal system maintenance cycles and the DPA, unless retention is required by law.

10.4.1 Survival. The following sections shall survive termination or expiration of this Agreement: Sections 5 (Fees, Billing & Payment Terms), 7 (Data Ownership, IP & Confidentiality), 8 (Warranties, Disclaimers & Liability), 9 (Indemnification), 10.3 (Effect of Termination & Data Export), and 11 (General Provisions), together with any provisions which by their nature are intended to survive.

11.1.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the Federal Republic of Germany, excluding its conflict of law rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

11.1.2 Venue. The exclusive venue for all disputes arising out of or in connection with this Agreement shall be the courts having jurisdiction at Mrava's registered office (currently Berlin), unless mandatory law provides otherwise.

11.2.1 Modifications. Mrava may modify this Agreement from time to time by providing reasonable notice (e.g., via email or Platform notification). Changes will become effective thirty (30) days after notice, unless Customer objects in writing. Continued use of the Platform after the effective date constitutes acceptance.

11.2.2 Severability. If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect. The invalid or unenforceable provision shall be replaced by a valid provision that most closely reflects the parties' original intent.

11.3.1 Assignment by Customer. Customer may not assign or transfer this Agreement, in whole or in part, without Mrava's prior written consent, which shall not be unreasonably withheld.

11.3.2 Assignment by Mrava. Mrava may assign this Agreement without Customer's consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets or to an Affiliate.

11.3.3 Change of Control. Any permitted assignment shall be binding upon and inure to the benefit of the parties and their respective successors and permitted assigns.

11.4.1 Force Majeure Events. Neither party shall be liable for any failure or delay in performance under this Agreement (other than payment obligations) due to events beyond its reasonable control, including natural disasters, acts of government, war, terrorism, labor disputes, failures of utilities or networks, or widespread service outages.

11.4.2 Mitigation. The affected party shall use commercially reasonable efforts to mitigate the impact of the force majeure event and resume performance as soon as practicable.

All notices under this Agreement must be in writing (Textform, e.g., email, PDF, or DocuSign is sufficient). Notices to Mrava shall be sent to legal@mrava.ai. Notices to Customer shall be sent to the email address specified in the Order Form.

This Agreement, together with the Order Form, DPA, and any referenced policies, constitutes the entire agreement between the parties and supersedes all prior agreements, understandings, and representations, whether written or oral.