AI Services Terms and Governance

Sagecom AI Services Terms and Governance Version: 1.0 Effective Date: July 29, 2026 Last Updated: July 29, 2026

These AI Services Terms govern the use of Sagecom's artificial intelligence products and services and supplement the Master Terms of Service, Privacy Policy, Data Processing Addendum, Acceptable Use Policy, and other applicable agreements.

These Terms apply to AI Receptionists, AI Voice Agents, Chat AI, Knowledge Bases, AI Workflows, AI-generated content, call transcription, summaries, analytics, APIs, CRM integrations and future AI-enabled services.

Sagecom provides configurable AI receptionists, voice agents, chat assistants, retrieval-augmented knowledge bases, workflow automation, scheduling, customer support automation, and business intelligence features.

Users acknowledge that they may interact with artificial intelligence. AI systems will not intentionally be represented as human personnel. Human escalation may be available depending on the subscribed service.

Sagecom may select, upgrade, replace or discontinue underlying AI models to improve quality, security, compliance, performance or availability. Equivalent or improved functionality may be substituted without notice where commercially reasonable. Model behaviour may vary between versions.

AI Services may automate classifications, routing, scheduling, summarisation, recommendations and workflow actions based on customer-defined rules. Customers remain responsible for reviewing and approving decisions affecting legal rights, employment, healthcare, finance, credit, insurance or other regulated matters.

AI outputs are probabilistic and may contain inaccuracies, omissions or fabricated information. Customers must independently verify important outputs before relying upon them.

Customers should maintain appropriate human oversight for material business decisions and implement review processes proportionate to operational risk.

Customers are responsible for the legality, quality, currency and accuracy of uploaded knowledge, prompts, workflows and automation rules.

Customers retain ownership of prompts, uploaded documents, business data and proprietary knowledge. Sagecom retains ownership of its software, orchestration logic, proprietary prompts, documentation and platform IP.

Unless expressly authorised in writing, Sagecom will not use customer prompts or confidential business content to train public foundation AI models. Processing necessary to provide the service or improve platform operations may occur where permitted by contract and applicable law.

Subscription plans include defined AI usage allocations. Overage charges, fair-use policies, throttling or suspension may apply once included quotas or AI voice minutes are exceeded.

Certain capabilities rely upon third-party AI, speech recognition, text-to-speech, cloud infrastructure or messaging providers. Service performance may depend upon those providers and their terms.

Customers remain responsible for determining whether AI Services are suitable for regulated environments. Where applicable, customers must comply with HIPAA, PCI-DSS, GDPR, UK GDPR, CCPA/CPRA, TCPA, CAN-SPAM, telecommunications regulations, accessibility requirements and industry-specific obligations.

Retention periods for prompts, transcripts, recordings, logs and AI outputs are governed by the applicable service configuration, customer settings and legal obligations. Upon lawful termination, Sagecom will delete or return customer data in accordance with the applicable agreement unless retention is legally required.

Sagecom implements commercially reasonable administrative, technical and organisational safeguards including encryption where appropriate, role-based access controls, authentication, audit logging, monitoring, secure APIs and vulnerability management.

16. Incident Response Sagecom maintains security incident response procedures designed to identify, investigate, contain and remediate confirmed security incidents. Customer notification will be provided where required by applicable law or contract. 17. Export Controls & Sanctions Customers shall not use AI Services in violation of applicable export control, trade sanctions or embargo laws and shall not permit access from prohibited jurisdictions where restricted by law. 18. Responsible AI & Ethics Sagecom is committed to responsible AI through transparency, fairness, privacy protection, security, human oversight and accountability. Customers shall not intentionally deploy AI to generate unlawful, deceptive, discriminatory or harmful content. 19. Customer Indemnification Customers agree to defend and indemnify Sagecom against claims arising from customer prompts, uploaded datasets, unlawful AI usage, infringement, failure to obtain required consents or misuse of AI Services. 20. Availability & Model Performance AI Services are provided on a commercially reasonable basis. AI model latency, response quality and functionality may fluctuate due to evolving models, provider limitations, maintenance or external dependencies. Sagecom does not guarantee identical outputs across model versions. 21. Regulatory Changes Where changes in applicable law or regulation materially affect AI Services, Sagecom may modify features, policies or these Terms to maintain compliance. 22. Limitation of Liability To the maximum extent permitted by law, Sagecom disclaims liability for indirect, consequential or special damages arising from AI-generated outputs or customer reliance upon such outputs. Liability remains subject to the Master Terms of Service. 23. Enterprise AI Governance Commitments o Transparent AI identification - Sagecom is committed to the responsible and transparent use of artificial intelligence. We strive to ensure that customers, users, and other individuals interacting with our AI Services understand when they are communicating with or receiving assistance from an AI-powered system. As part of this commitment:

AI Disclosure. Sagecom will make commercially reasonable efforts to identify AI-powered interactions through appropriate disclosures, notifications, branding, or other indicators where practicable. No Intentional Misrepresentation. Sagecom will not intentionally design or deploy AI Services to misrepresent themselves as human representatives. AI agents may use conversational language to improve the user experience but are intended to operate as artificial intelligence systems. Human Escalation. Where supported by the applicable service or customer configuration, users may request or be transferred to a human representative. Human availability may vary depending on the customer's subscription, business hours, staffing, and service configuration. Customer Responsibility. Customers are responsible for implementing any legally required AI disclosures, call recording announcements, consent notices, chatbot notifications, or other transparency requirements applicable to their jurisdiction, industry, or business operations. Automated Processing Notice. Customers acknowledge that AI Services may automatically process, classify, summarize, transcribe, analyze, route, prioritize, or respond to communications using machine learning models and other automated technologies. Model Limitations. AI-generated responses are probabilistic and may produce incomplete, inaccurate, outdated, or unexpected results. Customers should implement appropriate human oversight for decisions involving legal, financial, medical, employment, regulatory, or other high-impact matters. Continuous Improvement. Sagecom may update, improve, replace, or modify AI models and transparency mechanisms as technology, customer needs, industry standards, and applicable laws evolve. Responsible AI Principles. Sagecom seeks to develop and operate AI Services consistent with principles of transparency, accountability, privacy, security, fairness, human oversight, and regulatory compliance. o Human escalation pathways - Sagecom recognizes that artificial intelligence is intended to assist—not replace—human judgment in appropriate circumstances. To promote responsible AI use, Sagecom is committed to providing mechanisms that support human review and intervention where commercially reasonable and technically feasible. As part of this commitment: Human Assistance. Where supported by the applicable AI Service, customers may configure AI interactions to transfer users to a live representative, designated employee, or other authorized contact. The availability of human assistance depends on the customer's subscription, business hours, staffing, and service configuration. Customer-Controlled Escalation Rules. Customers may configure escalation criteria based on business requirements, including user requests, confidence thresholds, unresolved inquiries, emergency situations, compliance requirements, sentiment analysis, or other predefined workflow conditions.

No Guarantee of Immediate Human Availability. Sagecom does not guarantee that a human representative will be immediately available or that every interaction can be transferred without interruption. Human response times are the responsibility of the customer unless otherwise expressly agreed in a separate service agreement. High-Impact Decisions. Sagecom recommends that customers implement mandatory human review for AI-generated recommendations or actions involving legal, financial, medical, employment, insurance, regulatory, or other material business decisions where human oversight is appropriate. Emergency Situations. Sagecom AI Services are not designed or intended to function as emergency response services. Customers should not rely on AI Services for emergency communications or life-critical situations and must maintain appropriate procedures for handling emergency requests. Customer Responsibility. Customers are solely responsible for configuring escalation workflows, maintaining qualified personnel, monitoring escalated interactions, and ensuring compliance with applicable laws, regulations, and internal business policies. AI Service Limitations. Technical limitations, system outages, network interruptions, third-party service dependencies, or customer configuration settings may affect the availability or performance of human escalation features. Sagecom makes no warranty that escalation pathways will operate without interruption or error. Continuous Improvement. Sagecom may modify, enhance, or expand available escalation capabilities as AI technologies, customer requirements, and regulatory standards evolve. Responsible Human Oversight. Sagecom encourages customers to implement governance procedures that combine AI automation with appropriate human supervision to improve decision quality, reduce operational risk, and maintain accountability for customer-facing communications and business processes. o Customer-controlled knowledge bases - Customers remain responsible for the content, accuracy, governance, and maintenance of their knowledge bases while Sagecom provides the technology platform to securely process and retrieve authorized information. As part of this commitment: Customer Ownership. Customers retain all right, title, and interest in the documents, data, knowledge bases, prompts, and other content they upload, create, or manage within the AI Services. Sagecom claims no ownership of Customer Content. Limited License. Customers grant Sagecom a limited, non-exclusive, revocable license to host, process, index, retrieve, and use Customer Content

solely to provide, maintain, secure, and improve the contracted AI Services. This license terminates upon deletion of the content or termination of the applicable services, subject to applicable legal retention requirements. Content Accuracy. Customers are solely responsible for ensuring that uploaded documents, knowledge articles, policies, pricing, procedures, and other content are accurate, complete, current, and legally compliant. Sagecom does not verify, validate, or guarantee the accuracy of Customer Content. Confidential Information. Customers should upload only content they are authorized to use and disclose. Customers remain responsible for protecting confidential, proprietary, regulated, or sensitive information and for obtaining all necessary rights, permissions, and consents before making such information available to AI Services. AI Training Restrictions. Except as expressly authorized by the customer or required to deliver the Services, Sagecom will not use Customer Content or customer-managed knowledge bases to train publicly available foundation AI models. Data Security. Sagecom implements commercially reasonable administrative, technical, and organizational safeguards designed to protect Customer Content from unauthorized access, disclosure, alteration, or destruction. No internet-based service, however, can guarantee absolute security. Removal and Deletion. Customers may update or remove knowledge base content at any time, subject to system processing times, backup retention policies, and applicable legal or regulatory obligations. Compliance Responsibility. Customers are solely responsible for ensuring that their knowledge bases comply with applicable laws, regulations, contractual obligations, intellectual property rights, privacy requirements, and industry standards, including those relating to confidential information and regulated data. Service Limitations. AI responses generated from customer knowledge bases are based on the information provided and may not always reflect the most recent updates, contextual nuances, or intended business outcomes. Customers should implement appropriate review and governance procedures to validate AI-generated responses before relying on them for material business decisions. Continuous Improvement. Sagecom may enhance knowledge base capabilities, retrieval technologies, indexing methods, and search functionality to improve service performance, provided such enhancements do not alter the customer's ownership rights in Customer Content. o Audit logging and monitoring - Sagecom is committed to maintaining appropriate audit logging and monitoring capabilities to support the security, integrity, accountability, and reliable operation of its AI Services. Audit records help customers and Sagecom investigate security events, monitor system activity, support regulatory compliance, and improve the overall security posture of the platform.

As part of this commitment: Operational Audit Logging. Sagecom maintains commercially reasonable audit logs of significant system events, administrative actions, authentication attempts, configuration changes, AI workflow modifications, API activity, and other security-relevant events, where supported by the applicable AI Service. Administrative Accountability. Audit logs are designed to help identify actions performed by authorized users, administrators, service accounts, and integrated applications, providing accountability for administrative and operational activities within the platform. Security Monitoring. Sagecom employs monitoring processes and security controls designed to detect unusual, unauthorized, or potentially malicious activities affecting the availability, integrity, or confidentiality of the AI Services. Monitoring may include automated threat detection, anomaly detection, system health monitoring, and operational alerts. Investigation and Incident Support. Audit records may be used to investigate suspected security incidents, unauthorized access, service disruptions, fraud, misuse, policy violations, or other operational and security events, consistent with applicable laws and Sagecom's internal security procedures. Log Integrity. Sagecom implements commercially reasonable safeguards to protect audit logs from unauthorized modification, deletion, or disclosure and to preserve the integrity of security records necessary for operational, legal, and compliance purposes. Limited Customer Access. Where supported by the applicable service or subscription plan, customers may be provided access to selected audit logs, activity reports, administrative history, or security events. The scope, retention period, and availability of audit information may vary by service offering. Retention of Audit Records. Audit logs are retained for periods determined by Sagecom's operational requirements, contractual obligations, applicable legal requirements, and data retention policies. Sagecom may archive or securely delete audit records after the applicable retention period has expired. Privacy and Confidentiality. Audit logs may contain metadata relating to customer activity, user accounts, system events, or service usage. Sagecom processes such information in accordance with its Privacy Policy, Data Processing Addendum, and applicable data protection laws. Shared Responsibility. Customers remain responsible for reviewing available audit information, monitoring user activity within their organization, maintaining appropriate internal controls, and promptly reporting suspected unauthorized access or security incidents. No Continuous Monitoring Guarantee. Although Sagecom maintains commercially reasonable monitoring and logging practices, no monitoring system can detect every event or prevent every unauthorized activity. Customers should implement complementary security controls appropriate to their business, regulatory, and operational requirements.

Continuous Security Improvement. Sagecom may enhance its logging, monitoring, reporting, and security analytics capabilities as technology, cybersecurity threats, regulatory expectations, and industry best practices evolve. o Secure API integrations - Sagecom is committed to providing secure, reliable, and well-governed Application Programming Interfaces ("APIs") that enable customers to integrate AI Services with their business applications, communications platforms, customer relationship management (CRM) systems, and other authorized third-party services. Sagecom is dedicated to protecting the confidentiality, integrity, and availability of data exchanged through API integrations while promoting secure interoperability and industry best practices. As part of this commitment: Secure-by-Design APIs. Sagecom designs and maintains its APIs using commercially reasonable security practices intended to protect the confidentiality, integrity, and availability of customer data and AI Services. Authentication and Authorization. Access to Sagecom APIs is protected through industry-standard authentication and authorization mechanisms, including API keys, OAuth, tokens, or other approved security credentials, where supported. Customers are responsible for securely managing API credentials and preventing unauthorized access. Encrypted Communications. API communications are transmitted using industry-standard encryption protocols, such as Transport Layer Security (TLS), to protect data exchanged between Sagecom, customers, and authorized third-party systems. Customer-Controlled Integrations. Customers determine which third-party applications, services, or systems may connect to their Sagecom environment. Customers are responsible for evaluating the security, privacy, and compliance practices of any third-party service they authorize to access Sagecom APIs. Least-Privilege Access. Sagecom encourages the use of least-privilege access principles by allowing API credentials and integrations to be limited to only those permissions necessary to perform their intended business functions. Monitoring and Abuse Prevention. Sagecom may monitor API usage to detect unauthorized access, excessive usage, security threats, abuse, fraud, or activities that could adversely affect the security, stability, or availability of the Services. Sagecom reserves the right to implement rate limits, request throttling, or other protective measures where commercially reasonable. Third-Party Integrations. Integrations with third-party platforms, including CRM systems, communication platforms, AI providers, workflow automation tools, and business applications, remain subject to the availability, security, performance, and terms of service of those third parties. Sagecom is not

responsible for failures, vulnerabilities, data loss, or service interruptions caused by third-party systems. Customer Development Responsibility. Customers are solely responsible for the design, security, testing, maintenance, and legal compliance of any applications, scripts, custom integrations, or software they develop using Sagecom APIs. Customers must ensure that such integrations do not compromise the security or integrity of the Services. Protection of Credentials. Customers must maintain the confidentiality of API keys, authentication tokens, client secrets, certificates, and other access credentials. Compromised credentials should be revoked or rotated immediately. Sagecom may suspend or revoke compromised credentials to protect the security of the platform. API Changes and Versioning. Sagecom may introduce new API versions, modify existing endpoints, deprecate legacy functionality, or discontinue APIs as technology, security requirements, regulatory obligations, or business needs evolve. Sagecom will make commercially reasonable efforts to provide advance notice of material API changes where practicable. Compliance and Data Protection. Customers remain responsible for ensuring that API integrations comply with applicable laws, contractual obligations, privacy requirements, telecommunications regulations, and industry standards, including those governing the collection, transmission, storage, and processing of personal information. Shared Security Responsibility. The security of API integrations is a shared responsibility. Sagecom is responsible for securing the API platform and infrastructure under its control, while customers are responsible for securing their applications, integration endpoints, user credentials, devices, networks, and connected third-party systems. No Warranty of Third-Party Services. Sagecom does not warrant the continued availability, compatibility, functionality, or security of third-party APIs, external platforms, or customer-developed integrations and disclaims liability for issues arising from services outside Sagecom's direct control. Continuous Improvement. Sagecom will continue to enhance its API security controls, authentication methods, monitoring capabilities, encryption standards, and developer resources to address evolving cybersecurity threats, industry best practices, and applicable regulatory requirements. o Privacy-by-design principles - Sagecom is committed to protecting the privacy and confidentiality of customer information by incorporating privacy-by-design principles throughout the lifecycle of its AI Services. Privacy considerations are integrated into the planning, development, deployment, operation, and maintenance of Sagecom's AI technologies to help safeguard personal information and support compliance with applicable data protection laws.

As part of this commitment: Privacy-Centric Development. Sagecom considers privacy requirements during the design, development, testing, deployment, and ongoing enhancement of AI Services to reduce privacy risks before new features are introduced. Data Minimization. Sagecom seeks to collect, process, and retain only the information reasonably necessary to provide the requested AI Services and fulfill legitimate business, contractual, legal, or regulatory obligations. Purpose Limitation. Customer data is processed solely for the purposes authorized by the customer, required to deliver the Services, or otherwise permitted under applicable agreements and law. Security Safeguards. Sagecom implements commercially reasonable administrative, technical, and organizational safeguards designed to protect customer information against unauthorized access, disclosure, alteration, loss, or destruction. Customer Control. Customers maintain control over the business information, prompts, knowledge bases, workflows, and other content they provide to the AI Services, subject to the limited processing rights necessary for Sagecom to provide the Services. Transparency. Sagecom provides information regarding its AI data processing practices through its Privacy Policy, Data Processing Addendum, and applicable service documentation. Legal Compliance. Sagecom designs its privacy practices to support compliance with applicable privacy and data protection laws, including GDPR, UK GDPR, CCPA/CPRA, and other applicable regulations. Continuous Privacy Improvement. Sagecom may update its privacy practices and technical safeguards as privacy regulations, cybersecurity risks, technologies, and industry best practices evolve. o Responsible AI Governance - Sagecom is committed to developing, deploying, and operating AI Services in a responsible, ethical, and accountable manner. Sagecom seeks to balance innovation with appropriate governance, human oversight, transparency, security, and legal compliance while recognizing the evolving nature of artificial intelligence technologies. As part of this commitment: Responsible Development. Sagecom develops and deploys AI Services using commercially reasonable governance practices intended to promote reliability, transparency, security, and responsible business use. Human Oversight. Sagecom encourages customers to implement appropriate human review for significant business decisions and other high-impact use cases where AI-generated outputs may materially affect individuals or business operations.

Transparency. Sagecom seeks to provide appropriate disclosures regarding AI-generated interactions and automated processing where commercially reasonable and legally required. Fair and Lawful Use. Sagecom prohibits the use of its AI Services for unlawful, fraudulent, deceptive, discriminatory, or malicious purposes and reserves the right to suspend or terminate services used in violation of applicable agreements. Risk Management. Sagecom continually evaluates operational, cybersecurity, privacy, and regulatory risks associated with AI technologies and implements commercially reasonable safeguards to mitigate identified risks. Shared Responsibility. Responsible AI governance is a shared responsibility between Sagecom and its customers. Customers remain responsible for configuring AI systems appropriately, validating outputs, supervising automated workflows, and complying with applicable laws. Continuous Governance. Sagecom may modify its AI governance practices, safeguards, and policies to address evolving legal requirements, technological advancements, cybersecurity threats, and industry standards. o Periodic security and compliance reviews - Sagecom is committed to maintaining an effective security and compliance program through ongoing assessments, monitoring, and periodic reviews designed to protect the confidentiality, integrity, and availability of its AI Services. As part of this commitment: Security Assessments. Sagecom periodically evaluates the security of its AI platform, infrastructure, APIs, integrations, and supporting systems using commercially reasonable administrative, technical, and organizational controls. Compliance Reviews. Sagecom periodically reviews applicable legal, regulatory, contractual, and industry requirements to support continued compliance with evolving privacy, telecommunications, cybersecurity, and AI governance obligations. Risk Assessments. Sagecom performs periodic risk evaluations to identify potential operational, security, privacy, and compliance risks that could affect the delivery of AI Services. Vulnerability Management. Sagecom maintains processes for identifying, assessing, prioritizing, and addressing known security vulnerabilities consistent with commercially reasonable cybersecurity practices. Policy Reviews. Sagecom periodically reviews and updates its internal security policies, AI governance procedures, privacy practices, and operational controls as business needs and regulatory requirements evolve. Third-Party Risk Considerations. Where AI Services depend upon third-party providers, Sagecom may evaluate the operational and security implications of those providers as part of its vendor risk management practices.

No Certification Guarantee. Unless expressly stated in writing, Sagecom does not represent that its Services maintain any particular certification, audit standard, or regulatory approval beyond those expressly identified in applicable agreements or service documentation. Continuous Improvement. Findings from security reviews, operational assessments, customer feedback, and incident investigations may be incorporated into future improvements of Sagecom's AI Services and governance framework. o Continuous platform improvement - Sagecom is committed to the ongoing enhancement of its AI Services to improve functionality, security, reliability, performance, usability, and regulatory compliance. Because artificial intelligence technologies evolve rapidly, Sagecom continuously evaluates opportunities to improve the platform while maintaining the stability and security of customer services. As part of this commitment: Ongoing Innovation. Sagecom may introduce new AI capabilities, workflows, integrations, automation features, security enhancements, and performance improvements as technology and customer needs evolve. Model Enhancements. Sagecom may update, replace, or modify underlying AI models, retrieval technologies, speech recognition engines, language models, and supporting infrastructure to improve service quality, security, reliability, or compliance. Performance Optimization. Sagecom continually seeks to improve system responsiveness, scalability, availability, accuracy, and operational efficiency through platform enhancements and infrastructure optimization. Security Enhancements. Sagecom regularly evaluates emerging cybersecurity threats and may implement new security controls, authentication methods, encryption technologies, monitoring capabilities, and protective measures as appropriate. Regulatory Adaptation. Sagecom may modify AI Services, policies, workflows, or platform functionality to comply with new or amended laws, regulations, regulatory guidance, or industry standards without liability for resulting feature modifications. Customer Feedback. Sagecom may consider customer feedback, feature requests, operational experience, and industry developments when determining future platform enhancements and product roadmaps. Service Compatibility. While Sagecom strives to maintain backward compatibility where commercially reasonable, certain enhancements, security improvements, or regulatory requirements may require modifications to existing features, APIs, integrations, or AI model behavior.

No Obligation to Maintain Legacy Features. Sagecom reserves the right to modify, replace, discontinue, or retire features, models, integrations, or services that become obsolete, insecure, unsupported, commercially impractical, or inconsistent with applicable legal or regulatory requirements.