NEXIOS REAL ESTATE PROJECT FINANCE — TERMS OF SERVICE Version 2026-11-14 These Terms of Service ("Terms") are an agreement between Norman Fuchs, doing business as Nexios ("Nexios", "we", "us", or "our"), and the bank, lender, or other financial institution, and the individual accepting on that institution's behalf, identified at account creation (together, "you" or "your"), governing your access to and use of the NEXIOS Real Estate Project Finance hosted software service (the "Service"). By accessing or using the Service, you agree to these Terms. If you are accepting on behalf of an institution, you represent that you have the authority to bind that institution, and "you" refers to the institution as well as to you individually. 1. THE SERVICE The Service is a cloud-hosted due-diligence and construction-draw-administration platform for real-estate project loans: underwriting screens, loan syndication and draw tracking, maker-checker draw approval, covenant monitoring, alerting, credit-committee reporting, and related tools used by a lending institution's own staff to evaluate and monitor its own loans. Unlike a shared multi- tenant database, each institution using the Service is provisioned its own, fully separate database -- not a shared table or a shared schema -- so there is no query path by which one institution's loan data could ever be returned in response to another institution's request. 2. ACCOUNTS, STAFF, AND ROLES An institution's access to the Service is provisioned by Nexios directly (there is no public self-service signup); the institution's designated Admin user may then invite additional staff accounts and assign each a role (Viewer, Underwriter, Approver, or Admin) that governs what that person can see and change, including a hard rule enforced by the Service itself that the person who submits a draw request can never be the same person who approves it. You are responsible for (a) the accuracy of information provided when inviting staff, (b) promptly removing access for anyone who should no longer have it, and (c) all activity that occurs under your institution's accounts, whether or not you authorized it, except to the extent caused by our breach of these Terms. You must notify us promptly of any known or suspected unauthorized access to your institution's workspace. 3. YOUR DATA As between you and us, you retain all right, title, and interest in the loan, borrower, project, covenant, draw, and related data you or your staff enter into or upload to the Service ("Your Data"). We claim no ownership interest in Your Data. We process Your Data as a service provider acting on your instructions, solely to provide, maintain, secure, and support the Service, and as otherwise described in the Privacy Policy below and the Data Processing Agreement available at GET /api/saas/platform/dpa. Where Your Data includes personal information about a borrower's principals, guarantors, or other individuals (for example, in a borrower-submission upload), you represent that you have a lawful basis and, where required, that individual's consent or your own contractual authority to enter that information into the Service and to permit us to process it as described in these Terms. You are responsible for complying with any regulatory, contractual, or confidentiality obligations you owe in connection with that data (including any obligations arising under banking, privacy, or consumer-protection law applicable to you); the Service is a tool that helps you meet those obligations, not a substitute for your own compliance program, counsel, or regulator-facing judgment. 4. THE AI ASSISTANT IS OPTIONAL, ADVISORY, AND DISCLOSED The Service includes an optional in-app AI assistant. It is advisory only: it explains and narrates a project's own numbers already visible to the signed-in user, it never submits a draw, never changes an underwriting input, and never issues or overrides the Service's own deterministic go/no-go screen. When a user sends a message to the assistant, the relevant project data needed to answer that question is sent to our AI provider, Anthropic, PBC, strictly to generate that one response -- see the Privacy Policy, §3, for what that provider does and does not do with it. The assistant can be disabled for your institution's deployment entirely if you do not want any project data reaching that provider; ask your Nexios contact to turn it off. 5. ACCEPTABLE USE You will not: (a) use the Service to process data you are not lawfully permitted to hold or process; (b) attempt to access another institution's workspace or data, or probe, scan, or test the Service's security without our prior written authorization; (c) reverse engineer, decompile, or attempt to extract the Service's source code except to the extent such a restriction is prohibited by law; (d) use the Service to build or support a product that competes with it; (e) introduce malicious code; or (f) resell or provide the Service to third parties outside your own institution's staff without our prior written consent. 6. FEES AND BILLING Use of the Service beyond any trial period requires an active paid subscription, billed through our payment processor on the plan and seat count you select. Fees are invoiced and charged in advance and, except as required by law or expressly stated otherwise, are non-refundable. We may change our fees for future billing periods with reasonable advance notice. If a subscription payment fails or lapses and is not cured within the grace period described at checkout or in-product, we may place your workspace into a read-only state -- you may still view and export Your Data, but cannot create, edit, or approve records -- and, if the lapse continues beyond that, suspend access entirely until payment is restored, without deleting Your Data during either state. 7. SERVICE AVAILABILITY AND SUPPORT We will use commercially reasonable efforts to keep the Service available and to correct reported defects, but the Service is provided on an "as available" basis. We may perform scheduled or emergency maintenance, and we may modify, suspend, or discontinue features of the Service with reasonable notice where practicable, provided that we will not materially degrade the core functionality you are paying for during an active subscription term without a corresponding adjustment to fees. Specific uptime or response-time commitments, if any, are as separately agreed in writing with your institution. 8. DATA SECURITY We maintain administrative, technical, and physical safeguards designed to protect Your Data, described in full in our Security Overview (GET /api/saas/platform/security), including: a dedicated, isolated database per institution; encryption of sensitive control-plane secrets at rest and of all data in transit; role-based access control; and maker-checker segregation of duties on draw approval. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or disclosure of data will never occur. You are responsible for maintaining the confidentiality of your account credentials. 9. SUSPENSION AND TERMINATION We may suspend or terminate your access to the Service if: (a) your subscription lapses beyond any applicable grace period; (b) you materially breach these Terms and do not cure the breach within a reasonable period after notice; (c) your use poses a security risk to the Service or to another institution; or (d) we are required to do so by law. You may stop using the Service, and request cancellation of your subscription, at any time. Upon termination for any reason, we will make Your Data available for export for a reasonable period (at least 30 days, unless a shorter period is required by law or by the circumstances of the termination), after which it, and your institution's dedicated database, will be permanently deleted from our production systems. 10. THIRD-PARTY SERVICES The Service relies on third-party infrastructure and processors to operate, including database hosting, application hosting, payment processing, and -- only if you choose to use it -- the AI assistant provider (see §4). The Privacy Policy's Subprocessors section lists the specific vendors and what each one handles. 11. DISCLAIMER OF WARRANTIES THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE SERVICE, INCLUDING ITS GO/NO-GO SCREEN, COVENANT MONITORING, AND AI ASSISTANT, IS A DECISION-SUPPORT AND RECORD-KEEPING TOOL; IT DOES NOT PROVIDE CREDIT, APPRAISAL, ACCOUNTING, TAX, OR LEGAL ADVICE, DOES NOT CERTIFY ANY FIGURE AS CORRECT, AND IS NOT A SUBSTITUTE FOR YOUR OWN QUALIFIED CREDIT OFFICER, APPRAISER, OR COUNSEL. YOU ARE SOLELY RESPONSIBLE FOR YOUR OWN CREDIT, FUNDING, AND MONITORING DECISIONS AND FOR VERIFYING THE ACCURACY OF ANY FIGURE BEFORE RELYING ON IT. 12. LIMITATION OF LIABILITY TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, OR DATA, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. OUR TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS, THE SERVICE, OR THE DATA PROCESSING AGREEMENT WILL NOT EXCEED THE AMOUNTS YOU PAID US FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM. NOTHING IN THESE TERMS LIMITS EITHER PARTY'S LIABILITY FOR GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR WHERE SUCH A LIMITATION IS PROHIBITED BY LAW. 13. INDEMNIFICATION You will defend, indemnify, and hold us harmless from and against any third-party claim, loss, or expense (including reasonable attorneys' fees) arising from: (a) Your Data; (b) your breach of these Terms; or (c) your or your staff's violation of applicable law or of a third party's rights in connection with your use of the Service. 14. GOVERNING LAW AND DISPUTES These Terms are governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. Any dispute arising out of or relating to these Terms or the Service will be brought exclusively in the state or federal courts located in Florida, and each party consents to the personal jurisdiction of those courts. 15. CHANGES TO THESE TERMS We may update these Terms from time to time. If a change is material, we will provide reasonable notice (for example, by email or an in-product notice) before it takes effect, and may require re-acceptance before continued use of the Service. Continued use of the Service after a non-material change takes effect constitutes acceptance of the updated Terms. 16. GENERAL These Terms, together with the Privacy Policy and, where executed, the Data Processing Agreement, are the entire agreement between you and us regarding the Service and supersede any prior agreements on the same subject. If any provision of these Terms is found unenforceable, the remaining provisions remain in full effect. Our failure to enforce any provision is not a waiver of our right to do so later. You may not assign these Terms without our written consent; we may assign these Terms in connection with a merger, acquisition, or sale of substantially all of our assets. Questions about these Terms can be sent to sales@polyapps-ai.com.

NEXIOS REAL ESTATE PROJECT FINANCE — PRIVACY POLICY Version 2026-11-14 This Privacy Policy describes how Norman Fuchs, doing business as Nexios ("Nexios", "we", "us"), collects, uses, and protects information in connection with the NEXIOS Real Estate Project Finance hosted software service (the "Service"). It is part of, and should be read together with, the Terms of Service above. 1. INFORMATION WE COLLECT Account information: when your institution's workspace is created, or a staff member accepts an invitation, we collect the name, email address, and a securely hashed password needed to authenticate you. Institution and role data: your institution's name, the roles assigned to each staff member, and which deals each person has worked with. Loan and project data you enter: parcels, instruments, syndication participants, underwriting inputs, draw requests and approvals, covenant test readings, document checklists, borrower submissions, and related records you or your staff enter into the Service ("Your Data"). This may include personal information about a borrower's principals or guarantors where you choose to enter it. We process Your Data as a service provider acting on your instructions, not for our own independent purposes. AI assistant conversations: if a user sends a message to the optional in-app AI assistant (Terms §4), the message and the specific project data needed to answer it are sent to our AI provider, Anthropic, to generate a response. We do not send data to Anthropic for any project where the assistant feature has not been used. Billing information: if your institution subscribes to a paid plan, our payment processor collects and stores your payment method directly; we receive only the subscription status, plan, and amounts necessary to administer your account, never your full card number. Usage and log data: standard server logs (IP address, timestamps, request paths, error details) generated by ordinary operation of the Service, used for security monitoring, debugging, and abuse prevention. 2. HOW WE USE INFORMATION We use the information above to: provide, maintain, and secure the Service; authenticate sign-ins and enforce the role-based access controls and maker-checker rules your institution relies on; respond to support requests; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations. We do not sell Your Data, and we do not use it to train any product outside the Service or for advertising purposes. 3. SUBPROCESSORS We use a small number of third-party service providers to operate the Service, each limited to the function described: - Database hosting (Neon, Inc.): hosts each institution's own, fully separate database. Your Data is never stored in a database shared with any other institution. - Application hosting (Vercel, Inc.): runs the Service's application code and terminates HTTPS connections. - Payment processing (Stripe, Inc.): processes subscription payments and stores payment methods on our behalf. We never receive or store full card numbers. - AI assistant (Anthropic, PBC): ONLY if and when a user sends a message to the optional AI assistant, the message and the specific project data needed to answer it is sent to Anthropic's API to generate that response. Anthropic's standard commercial API terms, at the time this policy was written, state that it does not use API customer data to train its models; confirm Anthropic's current terms, and consider a stricter data-use agreement with Anthropic directly, before relying on this for a particularly sensitive deployment. This is the one subprocessor that can see the actual content of a project's figures, not just account metadata -- it is why the feature can be turned off per institution (Terms §4). Each subprocessor is contractually limited to using the information it receives only to perform the service it provides to us, and is not authorized to use it for its own independent purposes. We will provide reasonable advance notice before adding a new subprocessor that would process Your Data, and will update this list accordingly. 4. DATA RETENTION We retain Your Data for as long as your institution's workspace is active. If your subscription ends or your workspace is terminated, we retain Your Data for a reasonable export period (see Terms of Service §9) before permanently deleting it, including your institution's dedicated database, from our production systems, except where a longer retention period is required by law or necessary to resolve disputes or enforce our agreements. Backup copies retained by our database provider may persist for a limited additional period (currently up to 24 hours of point-in-time recovery history) before being overwritten. 5. DATA SECURITY See the Security Overview (GET /api/saas/platform/security) for the full description. In summary: data is encrypted in transit; each institution's data lives in its own fully separate database, not a shared schema or a shared table; sensitive control-plane secrets (each institution's own database connection string) are encrypted at rest; passwords are hashed with bcrypt, never stored in plain text; and access within an institution is further limited by the role each staff member is assigned. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting Your Data, we will notify your institution without undue delay, and in any event within 72 hours of confirming the breach, as further described in the Data Processing Agreement. 6. YOUR RIGHTS AND CHOICES You may access, correct, export, or request deletion of information in your account by using the Service's own account screens, or by contacting us at the address below. An institution's Admin may disable a staff member's access at any time; disabling access immediately revokes that person's active sessions. Where applicable law gives you additional rights over personal information (such as the right to request a copy of what we hold about a person, or to request its deletion subject to the retention needs described above), you may exercise those rights by contacting us. 7. CHILDREN The Service is a B2B product intended for use by lending-institution professionals acting on behalf of their employer. It is not directed to, and we do not knowingly collect information from, individuals under 18. 8. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time, with the same notice practice described in the Terms of Service for material changes. 9. CONTACT Questions about this Privacy Policy, or requests regarding your information, can be sent to sales@polyapps-ai.com.