Terms and Policies

SAAS AGREEMENT

This SaaS Agreement (the “Agreement”) is a legal agreement between you (“you” or “Customer”) and Cyabra Strategy Ltd., a company incorporated under the laws of Israel, having its principal place of business at Gershon Shatz Street 13, Tel Aviv 6701749, Israel (“Company” or “Cyabra”) (each, a “Party”, and collectively as the “Parties”).

BY EXECUTING THE PURCHASE ORDER (AS DEFINED BELOW), OR BY CONNECTING TO, ACCESSING AND/OR USING OUR PLATFORM, YOU (A) ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS AGREEMENT IN ITS ENTIRETY; AND (B) EXPRESSLY REPRESENT THAT YOU POSSESS THE LEGAL AUTHORITY TO ENTER INTO THIS AGREEMENT AND TO FORM A BINDING AGREEMENT UNDER ANY APPLICABLE LAW, AND HEREBY ACCEPT AND AGREE TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT AGREE TO THIS AGREEMENT, PLEASE DO NOT CONNECT TO, ACCESS OR USE THE PLATFORM.

WHEREAS Cyabra is the developer and proprietor of an innovative online platform in the field of social intelligence, offered on a software-as-a-service (SaaS) basis (the “Platform”);

WHEREAS the Customer wishes to access and use the Platform and receive the Services; and

WHEREAS the Company agrees to grant the Customer the right and license to access and use the Platform subject to the terms of this Agreement;

NOW, THEREFORE, the Parties agree as follows:

1. The Platform.

   1. License. The Company grants Customer a limited, personal, non-exclusive, non-transferable and revocable license to access and use the Platform during the Term solely for internal business purposes.
   2. Use by Affiliates. If permitted under the Purchase Order, Customer shall ensure its Affiliates comply with this Agreement.
   3. Updates. The Company is not obligated to provide updates or upgrades unless agreed otherwise.
   4. Documentation. Documentation may be provided for internal use only and remains Confidential Information.
   5. Services. Services will be provided as described in the Purchase Order and may incur additional fees.

2. Fees; Payment Terms.

   1. Fees. Customer shall pay all fees specified in the Purchase Order. All fees are non-refundable unless stated otherwise.
   2. Payment Terms. Late payments may accrue interest up to 1.5% per month or the maximum allowed by law.
3. Account. Customer is responsible for maintaining secure login credentials and all activity performed under the Account.
4. Prohibited Uses. Customer shall not reverse engineer, modify, resell, distribute, or misuse the Platform, nor violate applicable laws.

5. Customer Data; Analytics Information.

   1. Customer Data. The Company may process Customer Data as required to operate the Platform.
   2. Results. Customer is solely responsible for actions taken based on Output Data.
   3. Anonymous Analytics. Company may use aggregated non-identifiable analytics information for improvement and R&D.
6. Customer Warranties. Customer will use the Platform in compliance with applicable laws.
7. Mutual Warranties. Each Party represents it is duly authorized to enter into this Agreement.

8. Ownership.

   1. The Platform. All intellectual property rights remain the sole property of the Company.
   2. Feedback. Feedback provided by Customer may be used by Company without compensation.
9. Confidentiality. Each Party shall protect the other Party’s Confidential Information using reasonable care.
10. Reference Customer. Company may identify Customer as a user for marketing purposes.

11. LIMITED WARRANTIES.

    1. The Platform will substantially perform according to Documentation under normal authorized use.
    2. Except as stated, the Platform and Services are provided “as is” without warranties.

12. LIMITATION OF LIABILITY.

    1. Company shall not be liable for indirect or consequential damages arising from use of the Platform.
    2. Total liability shall not exceed the fees paid in the preceding twelve (12) months.

13. Company’s Indemnification.

    1. Company will defend Customer against third-party IP infringement claims related to the Platform, subject to conditions.
    2. Company may replace, modify, or discontinue the Platform if infringement claims arise.
14. Customer’s Indemnification. Customer agrees to indemnify Company against claims arising from Customer Data or breach of this Agreement.

15. Term and Termination.

    1. Term. This Agreement remains effective until all Purchase Orders expire or are terminated.
    2. Termination. Either Party may terminate for material breach after notice.
    3. Effects of Termination. Access to the Platform ends and confidential materials must be returned or deleted.
16. Miscellaneous. This Agreement is governed by the laws of the State of Israel and disputes shall be handled in Tel-Aviv courts.

DATA PROCESSING AGREEMENT

This Data Processing Agreement (the “Agreement”) is entered into by and between Cyabra, whether a company incorporated in the State of Israel or in the U.S., as shall be defined in the Terms of Service or the respective order form (the “Company” or “Processor”), and the Customer (the “Controller”).

All capitalized terms shall have the meaning ascribed to them in the Terms of Service unless otherwise defined herein. In the event of conflict, this Agreement shall control regarding processing of Personal Data.

The Customer and the Company hereby agree as follows:

1. DEFINITIONS

   1. Applicable Data Protection Laws means applicable privacy laws including GDPR, Israel Privacy Protection Law and CCPA.
   2. CCPA means the California Consumer Privacy Act of 2018.
   3. Customer means the Customer entering into the Terms of Service and its affiliates.
   4. Customer Personal Data means Personal Data processed by Company on behalf of Customer.
   5. Data Subject Requests means requests relating to access, erasure, portability or similar rights.
   6. Designated Contact means yossef@cyabra.com and Customer’s designated email.
   7. GDPR means EU Regulation 2016/679.
   8. Personnel means employees, contractors or representatives.
   9. Processed Data means Personal Data processed under the Terms.
   10. Security Event means unauthorized access or compromise attempts.
   11. Service Provider has meaning under CCPA.

2. DATA PROTECTION AND PRIVACY OF PERSONAL DATA

   1. Each party shall comply with Applicable Data Protection Laws.
   2. The Company acts as a Service Provider processing data solely to provide Services.
   3. No transfer constitutes a sale of information.
   4. Processing shall follow documented instructions of Customer.
   5. Transfers outside EU require appropriate safeguards under GDPR.
   6. Each party shall notify the other if instructions violate applicable laws.

3. DATA SUBJECT RIGHTS

   1. Company shall assist Customer in responding to data subject requests.
   2. Company will notify Customer upon receiving such requests.
   3. Company will reasonably assist with supervisory authority inquiries.

4. PERSONAL DATA BREACH AND SECURITY EVENTS

   1. Company shall notify Customer without undue delay upon becoming aware of a breach.
   2. Customer instructs whether to notify authorities or data subjects.
   3. Company shall take reasonable remediation steps.

5. SUBPROCESSORS AND PERSONNEL

   1. Authorized Personnel must maintain confidentiality.
   2. Access limited to need-to-know basis.
   3. Customer grants general authorization to use subprocessors subject to safeguards.

6. SECURITY

   1. Company shall maintain appropriate security measures.
   2. Both parties shall implement technical and organisational safeguards.
   3. Data shall be retained only as long as necessary.

7. RECORDS AND AUDITS

   1. Company shall provide compliance information upon request.
   2. Audits allowed with reasonable notice and confidentiality safeguards.
   3. Data accuracy and retention requirements apply.

8. GENERAL

   1. This Agreement is governed by the law applicable to the Terms of Service.
   2. Provisions survive termination while data processing continues.
   3. This Agreement becomes binding as part of the Terms of Service.

ANNEX A – DETAILS OF PROCESSING

A. Subject matter and duration: As defined in the order form and Terms.

B. Nature and purpose:

• Provision of Services
• Customer support
• Technical troubleshooting
• Legal compliance

C. Types of Personal Data: name, phone, email, role, usage data, IP, cookies and analytics data.

D. Categories of Data Subjects: employees, contractors and authorized users.

E. Sub-Processors: Provided upon Customer request.

ANNEX B – STANDARD CONTRACTUAL CLAUSES

SECTION I – PURPOSE AND SCOPE.
These Clauses ensure compliance with GDPR requirements regarding international transfers of personal data.

SECTION II – OBLIGATIONS OF THE PARTIES.
The data importer shall process personal data only on documented instructions and maintain security safeguards.

SECTION III – LOCAL LAWS.
Parties confirm laws of destination countries do not prevent compliance with these Clauses.

SECTION IV – FINAL PROVISIONS.
These Clauses shall be governed by EU law and disputes resolved before courts of the United Kingdom.

APPENDIX – EXPLANATORY NOTE: Information for each transfer must be clearly identified.

CYABRA AI TERMS

Last updated: July 24, 2025

1. Scope and Application

   These AI Terms (the “Terms”) govern the use of artificial intelligence technologies and machine learning capabilities (“AI”) integrated within Cyabra Strategy Inc. and its affiliates (“Cyabra”, “us” or “we”) Platform and Services.
   These Terms supplement and are incorporated into all agreements between Cyabra and its clients (“Client” or “you”) including any SaaS agreement or Master Agreement.
   Where conflicts arise, these Terms take precedence regarding AI-related matters, except that IP rights, limitations of liability and disclaimers in the Master Agreement remain in effect.

2. Definitions

   AI Functionalities means Cyabra’s proprietary AI capabilities including machine learning, NLP and automated analysis technologies.

   Client Content means all materials, data, social media posts and digital content submitted by clients.

   External AI Partners shall have the meaning set forth in Section 4.

   Output means analyses, insights, reports and AI-generated results derived from Client Content.

3. Our Commitment

   Cyabra is committed to deploying AI Functionalities responsibly with strong safeguards, fairness, transparency, legal compliance and respect for human rights.

4. Core AI Capabilities

   The Platform includes narrative extraction and analysis using fine-tuned transformer models that analyze textual content across social media and client-provided documents.
   Outputs are based exclusively on Client Content scans.

   Cyabra combines proprietary algorithms with third-party AI models listed in Exhibit A (“External AI Partners”).
   Client Content is transmitted solely for analysis under strict contractual restrictions, with no retention or training permitted.

5. Data Governance and Processing Standards

   Cyabra maintains an AI governance framework including transparency, ethics principles, security assessments and monitoring for bias.
   Cyabra complies with GDPR and maintains SOC 2 Type II standards.

   Client Content is never used to train AI models. AI Functionalities do not make automated decisions affecting individuals.
   Cyabra may use anonymized aggregated insights to improve Services.
   Cyabra may update AI technologies and External AI Partners at its discretion.

6. IP; Output Rights

   All intellectual property rights in Output belong to the Client, subject to Cyabra’s underlying proprietary rights in its Platform, algorithms and methodologies.
   The Client authorizes Cyabra to submit Client Content to External AI Partners as required to provide Services.

7. Output Quality; Acceptable Use Guidelines

   Outputs require human review and should not be relied upon as standalone decisions.
   AI Functionalities may produce inaccuracies, bias or limitations requiring validation.
   Clients must ensure compliance with applicable laws and ethical standards.

   Clients must not use AI Functionalities for illegal activity, harmful content, deceptive practices, malicious automation or rights infringement.

   
   WITHOUT LIMITING ANY DISCLAIMER IN THE MASTER AGREEMENT, CYABRA DISCLAIMS ALL WARRANTIES REGARDING OUTPUT ACCURACY, RELIABILITY OR COMPLETENESS.
   ALL OUTPUT IS PROVIDED “AS IS” AND USED AT CLIENT’S OWN RISK.
   

8. Miscellaneous

   All matters not addressed herein remain governed by the Master Agreement.
   Cyabra may update these Terms periodically. Continued use constitutes acceptance of updates.
   For questions, contact Cyabra’s legal and compliance team.

***

Exhibit A – External AI Partners

• OpenAI
• ClaudeAI
• Google
• Meta

Answers to Frequently Asked Questions

We value your privacy!

To ensure the protection of your data, we have implemented security and privacy measures inline with commonly accepted best practices.
Here, you will find responses to key questions concerning the security and privacy practices we employ in delivering our services:

1. What type of data we collect and process in order to provide our services?
   • Cyabra collects and processes data in accordance with specific data permissions provided by you – our client.
     Some of the main categories are name, address, e-mail address, company name, industry, website URL, IPs, devices names.
   • Cyabra also collects public profile data from social media, only from accessible websites or platforms where data is openly available and aligns its activities with user expectations.
     Such data is collected by Cyabra’s proprietary technology, organized, rearranged, compared and merged with other data attributes and being presented to Cyabra’s clients for service and analytics provision.
2. While providing the services, do we act as a Data Controller or Data Processor?Cyabra acts as Data Processor, and the client acts as a Data Controller.
   Cyabra will only process data for the purposes of providing the service to its clients, and its actions will be limited to the client’s instructions.
3. Will we transfer data outside of the client’s territory?The data is shared and accessed from the client’s location to the U.S., or Israel, on an ongoing basis.
   Additionally, in order to provide a global service, we share and/or store data required to provide ongoing maintenance and support with our regional offices and some of our sub-processors.
   The sub-processor list can be provided by the Company upon the Customer’s request.
   We rely on “appropriate safeguards” under applicable data protection laws for any cross-border data transfers, including with respect to transfer of personal data outside of the EU.
4. How would we deal with an actual or suspected data breach?Cyabra has a well-maintained and up-to-date incident response policy, and constantly adapts to security developments through the expertise of our own team and the advice of leading external legal and professional services consultants.
   We would report data breaches in accordance with our legal obligations.
5. Do we offer a Data Processing Agreement (“DPA”)?Yes we do. Link to our DPA in which we commit to operate in accordance with applicable laws.
6. Who at Cyabra can access the data?Only those specifically authorized personnel who their access is required in order to provide successful delivery, operation and service to the clients may access data.
7. For how long do we retain our clients’ data?Client data will be deleted after expiration/termination of the services, all in accordance with the Terms of Use and Cyabra policies.
   Additionally, the client may make a specific deletion written request at any time.
8. Is there an appointed DPO?All of our personnel are bound by strict duties of confidentiality and are required to undergo periodic training courses on information security, GDPR compliance, and other applicable data protection laws.
   We also appointed a Data Protection Officer (DPO) for monitoring and advising on ongoing privacy and compliance matters.

If you have further questions, please contact us at DPO@cybra.com.

These FAQs are provided for information purposes only, and the contents are subject to change without notice.
These FAQs are not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose.
We specifically disclaim any liability with respect to these FAQs, and no contractual obligations are formed either directly or indirectly by these FAQs.