Relvo Privacy Policy

AGOS LABS TECHNOLOGIES LTD., a corporation registered in Lewes, Delaware, USA (the "Company"), establishes this Privacy Policy (the "Policy") regarding the handling of personal data in connection with the cloud service "Relvo" provided at relvo.si and its subdomains, including the dashboard, the MCP endpoint, the HTTP API and the command-line interface (the "Service"). Capitalized terms not defined in this Policy have the meanings given in the Relvo Terms of Use (the "Terms").

This Policy applies to Members, to the individuals who represent Organizations, and to visitors to the Company's websites (collectively, "Data Subjects"). It describes the personal data that the Company processes for its own purposes as a controller (Terms, Article 25, paragraph 3). It does not govern personal data contained in Inputs, User Content or Results that the Company processes on the instructions of a User; that processing is governed by the Terms, and Article 11 of this Policy explains how it is handled.

Article 1 (Personal Data)

In this Policy, "personal data" means information relating to an identified or identifiable living individual, including "personal information" under the Act on the Protection of Personal Information of Japan (the "APPI"), "personal data" under the EU General Data Protection Regulation and the UK GDPR (together, the "GDPR"), and "personal information" under the California Consumer Privacy Act as amended (the "CCPA") and other applicable laws.

Article 2 (Personal Data We Collect and Purposes of Use)

1. The Company collects the following personal data and uses it for the purposes, and on the legal bases, set out below.

2. Request and response bodies: The Company does not record the bodies of requests to, or responses from, Providers in its usage and audit records. Inputs and Results are, however, processed to perform the Execution, and Results (including generated files) are stored for the period displayed with the Result so that the User can retrieve them (Terms, Article 4, paragraph 3). If the Company introduces a function that answers repeated identical requests with stored Results (caching), it will describe that function in this Policy before introducing it. That processing is carried out on the User's instructions and is governed by Article 11.

3. Google and YouTube data: Where a User connects a Google account or YouTube channel, the Company requests only the scopes necessary for the Tools that the User elects to use, and accesses only the data that those scopes permit. The Company's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, the Company (i) uses Google user data only to provide and improve the user-facing features for which it was connected, (ii) does not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to Users, (iii) does not use it for advertising, (iv) does not use it to develop, improve or train generalized artificial intelligence or machine learning models, and (v) does not allow humans to read it except with the User's affirmative consent, where necessary for security purposes or to comply with applicable law, or where the data is aggregated and anonymized for internal operations. Use of YouTube features is also subject to the Google Privacy Policy (https://policies.google.com/privacy). A User may revoke the Company's access at any time at https://myaccount.google.com/permissions.

4. The Company does not use personal data, Stored Credentials, Access Credentials, Inputs or Results to train artificial intelligence or machine learning models, except for the de-identified metadata described in the table above (Terms, Article 13, paragraph 3).

5. The Company does not sell personal data and does not "share" personal data for cross-context behavioral advertising within the meaning of the CCPA.

6. Where the Company intends to use personal data for a purpose other than those set out above, it will notify Data Subjects and, where required by law, obtain their consent in advance.

Article 3 (Sources of Personal Data)

1. The Company collects personal data from the following sources:

(1) directly from Data Subjects, when they register, use the Service, contact the Company or make payments;

(2) from the Owner or Administrator of an Organization, when they invite a Member;

(3) from identity providers used to sign in (such as GitHub or Google), limited to the information the Data Subject authorizes them to provide;

(4) from Third-Party Platforms, when a User links a Connected Account;

(5) from the payment processor, in respect of payment status and limited card information (such as the card brand and last four digits); and

(6) automatically, through the Company's systems, its hosting provider and the technologies described in Article 6.

Article 4 (Provision to Third Parties)

1. The Company does not provide personal data to third parties without the prior consent of the Data Subject, except in the following cases:

(1) where the Company entrusts the handling of personal data to service providers (sub-processors) within the scope necessary to achieve the purposes of use, as listed in Article 5;

(2) where personal data is transmitted to a Provider or Third-Party Platform because a User has requested an Execution, linked a Connected Account or registered a Stored Credential, to the extent necessary to perform that Execution;

(3) where usage and audit records of a Member are made available to the Owners and Administrators of the Organization to which the Member belongs (Terms, Article 5, paragraph 4);

(4) where the Company shares usage records with a Provider or Third-Party Platform in good-faith compliance or abuse investigations (Terms, Article 25, paragraph 2);

(5) where a User takes part in a referral program, to the extent of the information displayed to the referring User, namely the referred User's e-mail address, sign-up date and whether funds have been added;

(6) where personal data is provided in connection with a merger, business transfer or other business succession, in which case the Company will notify Data Subjects in advance; and

(7) other cases permitted or required by applicable law, including in response to a lawful request of a court or competent authority, or where necessary to protect the life, body or property of a person.

2. Where the Company provides personal data to a third party, or receives personal data from a third party, it keeps the records and makes the confirmations required by the APPI.

Article 5 (Service Providers and International Transfers)

1. The Company uses the following service providers (sub-processors) to operate the Service. This table, together with the Providers indicated as sub-processors for each Tool in the catalog of the Service, constitutes the Sub-processor List under the Terms.

2. The Company is established in the United States and processes personal data in the United States and in the other countries in which the providers above operate. Where personal data of Data Subjects in Japan is provided to a third party in a foreign country, the Company provides the information required by Article 28 of the APPI, namely the name of the country, information on the personal data protection system of that country obtained by an appropriate and reasonable method, and the measures taken by the recipient for the protection of personal data, by means of this Article and, upon request, in more detail. Each recipient listed above has in place, by contract or through its published terms, measures equivalent to the obligations of a business operator under the APPI, or the Company has otherwise taken the measures required by the APPI.

3. Where personal data of Data Subjects in the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not been recognized as providing an adequate level of protection, the Company relies on the Standard Contractual Clauses approved by the European Commission (and, for the United Kingdom, the International Data Transfer Addendum) or another lawful transfer mechanism. A copy of the relevant safeguards may be requested using the contact details in Article 15.

Article 6 (Cookies and Similar Technologies)

1. The Company uses the following cookies and similar technologies on its websites and dashboard.

2. Strictly necessary cookies are used without consent because the Service cannot function without them. Other cookies are used only with consent where required by applicable law. Data Subjects can manage cookies through their browser settings and can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

Article 7 (Requests for Disclosure, Correction, Deletion and Other Rights)

1. Data Subjects may request the Company to notify them of the purposes of use of, disclose, correct, add to, delete, suspend the use of, or cease the provision to third parties of, their retained personal data, and to disclose records of provision to third parties, in accordance with the APPI.

2. Data Subjects in the European Economic Area, the United Kingdom and Switzerland have the rights of access, rectification, erasure, restriction of processing, data portability and objection under the GDPR, and the right to withdraw consent at any time without affecting processing carried out before withdrawal. They also have the right to lodge a complaint with a supervisory authority in their place of residence or work.

3. Residents of California and other U.S. states with comprehensive privacy laws have the rights to know, access, correct and delete their personal information and not to be discriminated against for exercising those rights. The Company does not sell or share personal information as described in Article 2, paragraph 5.

4. The Company honors the requests described in paragraphs 1 to 3 for all Data Subjects, regardless of their place of residence, to the extent permitted by applicable law. Members may delete Stored Credentials, unlink Connected Accounts, revoke Relvo Keys and delete their accounts in the dashboard. Other requests may be made to the contact in Article 15.

5. The Company will verify the identity of the person making a request before responding and will respond without undue delay and in any event within thirty (30) days of receipt, or within any shorter period required by law. The Company does not charge a fee for responding to requests.

6. The Company may decline a request, in whole or in part, where permitted by applicable law, for example where responding would infringe the rights of others or where the Company is required by law to retain the data, and will give its reasons.

7. Requests concerning personal data contained in Inputs, User Content or Results should be directed to the relevant User, as described in Article 11.

Article 8 (Retention Period)

1. The Company retains personal data only for as long as necessary to achieve the purposes of use and to comply with legal obligations. The retention periods are as follows:

2. After the applicable period, the Company deletes or anonymizes the personal data.

Article 9 (Security Control Measures)

1. The Company takes necessary and appropriate measures to prevent leakage, loss or damage of personal data and otherwise to manage it securely, including the following:

(1) Organizational measures: designating a person responsible for personal data protection, establishing internal rules for handling personal data, and reviewing their implementation.

(2) Personnel measures: imposing confidentiality obligations on personnel and limiting access to personal data to those who need it.

(3) Technical measures: encrypting Stored Credentials and Access Credentials at rest using authenticated encryption, with the encryption key held separately from the database; never returning or displaying the secret value of a Stored Credential after it is saved; storing Relvo Keys and session tokens only as one-way hashes; encrypting all communications in transit with TLS; checking access on every request against Organization membership, role and per-Member Tool access; running Server-Side Runs in sandboxes with file system and network egress restrictions; and enabling immediate revocation of all Relvo Keys.

(4) Supervision of service providers: selecting providers that maintain appropriate security and binding them to confidentiality and data protection obligations.

(5) Understanding foreign environments: where personal data is handled in a foreign country, understanding the personal data protection system of that country and taking security measures accordingly.

2. In the event of a personal data breach, the Company will notify the affected Data Subjects and the competent supervisory authorities without undue delay and as required by applicable law, including the APPI, the GDPR and U.S. state breach notification laws, and will take measures to prevent recurrence.

3. Further information on the Company's security measures is available on request using the contact details in Article 15. Security vulnerabilities may be reported to info@relvo.si.

Article 10 (Children)

1. The Service is not intended for persons under the age of sixteen (16), and the Company does not knowingly collect personal data from them. If the Company becomes aware that it has collected personal data of a person under sixteen, it will delete that data and the related account.

Article 11 (Personal Data Processed on Behalf of Users)

1. Certain Tools return or act upon personal data of individuals who are not Users (for example, contact, professional or social-media data), and Inputs, User Content and Results may contain personal data. In respect of such data, the User is the controller (or a processor acting for its own customer), and the Company processes it only on the User's instructions to perform Executions and to store and return Results, in accordance with the Terms (Article 25, paragraphs 4 to 6).

2. Individuals whose personal data is processed in this way should direct requests to the User concerned. Where the Company receives such a request directly, it will, where possible, refer the individual to the User and assist the User in responding, as provided in the Terms (Article 25, paragraph 5).

3. Providers that receive such data to perform an Execution handle it under their own terms; the catalog of the Service identifies, for each Tool, the Providers that act as sub-processors of the Company, and other Providers act as independent controllers.

Article 12 (Modification of This Policy)

1. The Company may amend this Policy. The Company will publish the amended Policy on the Service together with its effective date and, for material changes, will notify Users by e-mail or by notice on the Service before the change takes effect. Where an amendment requires the consent of Data Subjects under applicable law, the Company will obtain that consent.

Article 13 (Compliance with Laws)

1. The Company complies with the APPI, the GDPR, the CCPA and other laws and regulations applicable to its handling of personal data.

Article 14 (Company Information and Data Protection Manager)

Name: AGOS LABS TECHNOLOGIES LTD.

Address: 16192 Coastal Highway, Lewes, Delaware 19958, USA

Representative: Kosuke Yokoyama

Personal Data Protection Manager: Kosuke Yokoyama

Article 15 (Contact)

1. Inquiries, requests and complaints concerning this Policy or the handling of personal data should be sent to: Relvo Support, info@relvo.si.

Supplementary Provisions

Enacted and effective as of October 29, 2026.