Acceptable Use Policy

Acceptable Use Policy Version: 1.0 Effective Date: July 2026 Applies To: All Sagecom Products and Services

This Acceptable Use Policy ("AUP") establishes the acceptable and prohibited uses of the products and services provided by Sagecom Inc. ("Sagecom," "we," "our," or "us"). This Policy is intended to: protect the integrity, security, availability, and reliability of the Services; safeguard Sagecom's telecommunications and cloud infrastructure; promote lawful, ethical, and responsible use of the Services; protect Customers, End Users, and third parties from abuse, fraud, and cybersecurity threats; and ensure compliance with applicable laws, regulations, carrier requirements, and industry standards. This Policy forms part of the Agreement between Sagecom and the Customer and is incorporated by reference into the Master Terms of Service.

This Policy applies to all Sagecom Services, including: Cloud PBX; Unified Communications (UCaaS); Hosted Voice; Virtual Office; SIP Trunking; Business Messaging; Communications APIs; Customer Portal; Artificial Intelligence ("AI") Services; AI Receptionists; AI Voice Agents; AI Customer Service Agents; AI Sales Agents; AI Workflows; AI Knowledge Bases; Professional Services; Managed Services; and

all websites, applications, APIs, software, cloud platforms, and telecommunications services operated by Sagecom. This Policy applies to: Customers; Authorised Users; administrators; employees; contractors; agents; resellers; distributors; and any person using the Services through a Customer account.

Customers shall use the Services only for lawful, authorised, and legitimate business purposes. Customers shall not use the Services in any manner that: violates Applicable Law; infringes the rights of others; compromises security; interferes with Sagecom's operations; damages Sagecom's reputation; disrupts telecommunications networks; abuses AI systems; or adversely affects other Customers. Customers are responsible for all activities occurring under their accounts, whether performed by employees, contractors, Authorised Users, or third parties acting on their behalf.

Customers shall not use the Services to engage in, facilitate, promote, or support any activity that is unlawful, fraudulent, harmful, deceptive, abusive, or otherwise prohibited. Without limitation, prohibited activities include: fraud or attempted fraud; identity theft; impersonation; phishing; spoofing; social engineering attacks; money laundering;

terrorist activities; organised criminal activity; child exploitation; human trafficking; harassment; threats; stalking; extortion; defamation; distribution of malware; ransomware; spyware; viruses; denial-of-service attacks; unauthorised interception of communications; unlawful surveillance; unauthorised access to systems; infringement of intellectual property rights; violations of privacy rights; unlawful collection of Personal Data; and any activity prohibited by Applicable Law.

Customers shall not use the Services to: engage in toll fraud; generate artificial traffic; manipulate call routing; originate unlawful robocalls; transmit unlawful prerecorded messages; spoof caller identification in violation of Applicable Law; interfere with emergency communications; originate excessive nuisance calls; bypass carrier restrictions; resell Services without Sagecom's written approval; interfere with telecommunications networks; or misuse numbering resources. Customers remain solely responsible for complying with all telecommunications laws governing: voice communications; emergency calling; caller identification; telemarketing; TCPA; Do-Not-Call regulations; Canada's Anti-Spam Legislation (CASL); call recording; and

messaging requirements.

Customers shall use AI Services responsibly and shall not use AI Services to: generate unlawful content; produce deceptive content intended to defraud; impersonate individuals without lawful authority; create deepfakes intended to deceive; automate unlawful activities; generate malicious software; circumvent security controls; violate intellectual property rights; violate privacy laws; create discriminatory or unlawful decision-making systems; distribute misinformation knowingly; facilitate cybercrime; or use AI in a manner prohibited by Applicable Law. Customers remain solely responsible for reviewing AI-generated outputs before acting upon them. AI-generated responses should not be relied upon as legal, medical, accounting, investment, emergency response, or other professional advice.

Customers shall not use messaging services to: send unsolicited commercial messages where consent is required; distribute spam; send malicious links; conduct phishing campaigns; distribute malware; send unlawful marketing communications; evade carrier restrictions; violate messaging regulations; generate artificial messaging traffic; interfere with messaging platforms; or transmit prohibited content. Customers are solely responsible for obtaining any required marketing consent before sending commercial messages.

Customers using Communications APIs shall not: exceed published rate limits; intentionally overload Sagecom systems; reverse engineer APIs except where permitted by law; bypass authentication controls; create excessive automated requests; interfere with API availability; exploit software vulnerabilities; compromise platform security; scrape unauthorised information; or use APIs for unlawful purposes. Sagecom reserves the right to throttle, suspend, or revoke API access to protect the security and availability of the Services.

Customers are solely responsible for all Customer Content uploaded, stored, transmitted, processed, or generated through the Services. Customers shall not upload or distribute content that: violates Applicable Law; infringes copyrights, trademarks, patents, or trade secrets; violates contractual obligations; contains malicious code; promotes criminal activity; exploits minors; contains unlawful obscene material; infringes privacy rights; violates export control laws; or otherwise violates this Policy. Sagecom has no obligation to monitor Customer Content but reserves the right to investigate reports of violations and take appropriate action where permitted by Applicable Law.

Customers shall: protect account credentials; implement strong passwords; enable multi-factor authentication where available;

maintain supported software; promptly install security updates; secure Customer Equipment; restrict administrative access; report suspected security incidents without unreasonable delay; and cooperate with Sagecom during security investigations. Customers shall not attempt to: bypass authentication; defeat encryption; exploit security vulnerabilities; perform unauthorised penetration testing; interfere with monitoring systems; or compromise Sagecom infrastructure.

Sagecom Services are intended for legitimate business use. Customers shall not use the Services in a manner that: materially degrades Service performance; consumes excessive shared resources; adversely affects other Customers; creates abnormal traffic patterns; abuses unlimited service offerings; or interferes with normal platform operations. Where excessive usage materially impacts platform performance, Sagecom may implement reasonable traffic management measures, rate limits, or other controls to preserve service quality.

Sagecom may, to the extent permitted by Applicable Law: monitor platform activity; investigate suspected violations; analyse traffic patterns; review security logs; implement fraud detection measures; suspend or restrict Services; block unlawful communications; disable compromised accounts; remove malicious content where authorised; and cooperate with law enforcement or regulatory authorities.

Sagecom is under no obligation to monitor all Customer activity and assumes no responsibility for Customer misuse of the Services.

Sagecom may, without prior notice where reasonably necessary, suspend, restrict, or terminate all or part of the Services if it reasonably believes that: this Policy has been violated; the Services are being used unlawfully; fraud is suspected; security is compromised; AI Services are being misused; telecommunications abuse has occurred; messaging abuse has occurred; Customer activity creates material risk to Sagecom, other Customers, telecommunications carriers, or third parties; suspension is required by Applicable Law or a governmental authority. Suspension under this Policy does not waive any other rights or remedies available to Sagecom under the Agreement or Applicable Law.

Suspected violations of this Policy may be reported to: Compliance Officer Sagecom Inc. Miami, Florida, USA Email: abuse@sagecominc.com Alternative Contact: Email: legal@sagecominc.com Customers shall cooperate with reasonable investigations relating to alleged violations.

This Policy shall be interpreted together with the following incorporated documents: Master Terms of Service; Enterprise Privacy & Cookies Policy;

Data Processing Addendum (DPA); AI Services Terms; AI Transparency & Responsible Use Policy; Communications & Call Recording Policy; Service Level Agreement (SLA); and any applicable Order Form, Enterprise Agreement, or Statement of Work. Where a conflict exists regarding privacy, Personal Data processing, or information security, the Enterprise Privacy & Cookies Policy and the Data Processing Addendum shall prevail to the extent of that conflict.

Sagecom may modify this Acceptable Use Policy from time to time to reflect changes in: Applicable Law; telecommunications regulations; cybersecurity threats; artificial intelligence technologies; carrier requirements; industry standards; operational practices; or the Services. Material changes will become effective upon notice provided in accordance with the Master Terms of Service or as otherwise required by Applicable Law. Continued use of the Services after the effective date of an updated Policy constitutes acceptance of the revised Policy. Nothing in this Policy limits Sagecom's rights under the Master Terms of Service, including its rights to suspend or terminate Services, investigate misuse, protect its infrastructure, comply with legal obligations, or enforce the Agreement.