Observability Terms

ATTACHMENT 1
OBSERVABILITY TERMS#

1. Agreement Structure and Service#

1.1 Agreement. These Observability Terms (the “Terms”) govern Subliminal Labs Inc. (“Subliminal”) and the customer identified in an Order Form (“Customer”), each a “Party” and together the “Parties”. “Agreement” means these Terms, accepted Order Forms, and incorporated schedules and addenda. An “Order Form” is signed by both Parties or offered by Subliminal and affirmatively accepted by Customer’s authorized representative through online ordering. These Terms govern the assessment and later observability Order Forms that refer to them without re-execution. Unless expressly stated otherwise, Sections 2 through 11 and Schedules 1 and 2 apply to both assessments and paid observability subscriptions. Each Order Form is a separate service commitment. Assessment use alone creates no subscription or further purchase obligation.

1.2 Service and Changes. “Service” means Subliminal’s AI Workflow Observability service and related desktop software, dashboard, documentation, support, analysis, and outputs included in an Order Form. Subliminal will provide the Service and support specified in each Order Form. Subliminal may improve and change the platform and features without amending these Terms, but will not materially reduce a paid Service’s core functionality during its then current subscription period. A materially new capture category, including microphone or system/output audio, requires prior disclosure and Customer’s affirmative authorization through an Order Form or administrator configuration, after required personnel notices and permissions. Automation deployment requires separately agreed legal and commercial terms.

1.3 Acceptance. Each person signing or electronically accepting an Order Form represents that they are authorized to bind the accepting Party. Customer must accept the initial Order Form, these Terms, and applicable addenda before installation or collection begins. For online ordering, Subliminal will present or link the applicable documents before affirmative acceptance and retain the accepted versions and acceptance record. This Section applies to assessment and subscription Order Forms.

1.4 Beta Features. Features expressly identified as beta, preview, or experimental are provided “as is”, may be modified or withdrawn, and are excluded from the functionality warranty in Section 7. Subliminal’s confidentiality, security, and data protection obligations continue to apply to those features.

2. Access, Responsibilities, and Restrictions#

2.1 Access. During the applicable service period, Subliminal grants Customer and its authorized personnel a limited, non-exclusive, non-transferable right to access and use the Service and associated software and documentation for Customer’s internal business purposes within the Order Form’s scope. These Terms cover direct customers’ own operations; they do not authorize resale or deployment for third-party companies.

2.2 Customer Responsibilities. Customer is responsible for its users, account and credential security, lawful use of Customer Content, authorized deployment, appropriate exclusions, and required personnel notices, consents, legal bases, labor or works-council consultations, and approvals before installation or collection. Customer will prepare and deliver the required personnel notices; Subliminal has no obligation to prepare those notices unless an Order Form expressly provides otherwise. Customer will promptly notify Subliminal of suspected unauthorized account access or compromised credentials. Customer provides agreed infrastructure and access for Customer-hosted deployments; revoking required access may prevent service. Customer remains responsible for its systems and exported copies.

2.3 Restrictions. Except as expressly permitted by this Agreement, Customer will not, and will not permit others to: reverse engineer or decompile the Service except where law prohibits this restriction; copy, modify, create derivative works of, resell, sublicense, or provide unauthorized access to it; remove proprietary notices; conduct security or vulnerability testing without Subliminal’s written approval; circumvent access or security controls or interfere with operation; use it to develop a competing product or in activities where failure could cause death, bodily injury, or environmental damage; use it unlawfully or access systems without authority; or submit content it lacks rights to provide. Use must comply with the documentation and agreed use limits. These restrictions do not prevent authorized audits under Section 4.6.

2.4 Workforce Use Limits. Identifying personnel, process roles, workflow participation, and workflow-related time is permitted for process analysis. Customer may not use the Service or its outputs to monitor or evaluate employee performance, productivity, attendance, or working hours; enforce attendance or working hours; rank individuals by hours; or compare or rank individuals or teams by productivity or output. These restrictions apply to all users, administrators, dashboards, chatbots, and connected AI assistants and cannot be overridden. Subliminal will maintain instructions to its Service agents to refuse such requests. Chatbot and connected-assistant queries to recorded-work evidence will be audit logged before access, including the requester, workspace, tool, and declared purposes; if that audit record cannot be written, the query will not proceed.

2.5 Suspension. Subliminal may suspend access as reasonably necessary to address a security risk, material violation of the Agreement, or an undisputed payment more than thirty (30) days overdue. Subliminal will give notice when practical and restore access promptly after the underlying issue is resolved.

3. Content, Analytics, and Intellectual Property#

3.1 Customer Content. “Customer Content” means information submitted or made available by or on behalf of Customer through the Service, information captured from Customer’s systems or users, including recordings, communications, business content, and associated metadata, and customer-specific findings and reports generated from that information. Customer Content excludes Usage Data, but information constituting Customer Content does not cease to be Customer Content merely because it is incorporated into Usage Data. Customer retains all right, title, and interest in Customer Content. Customer grants Subliminal the right to access, copy, transmit, process, and otherwise use Customer Content to provide, operate, maintain, secure, support, and troubleshoot the Service and, to the extent incorporated into Usage Data, for the purposes permitted under Section 3.2, subject to Sections 3.3, 4, and 6. Customer Content excludes Subliminal’s underlying software, technology, templates, methods, and know-how, including those incorporated into findings or reports, but Subliminal’s ownership of those materials does not extend to the underlying Customer Content.

3.2 Usage Data. “Usage Data” means analytics, diagnostics, statistics, and other information generated or collected by Subliminal concerning the provision, use, operation, and performance of the Service, including account and workspace identifiers, feature usage, service logs, customer feedback, chatbot questions, and associated tool requests. Usage Data does not include customer recordings or customer-specific findings and reports merely because Subliminal generates or processes them. As between the Parties, Subliminal owns all right, title, and interest in Usage Data, excluding any underlying Customer Content. Subject to Sections 3.3, 4, and 6, Subliminal may collect, analyze, and use Usage Data to operate, maintain, secure, support, troubleshoot, develop, improve, and enhance its products and services. Usage Data may identify Customer or individuals and may contain Customer Content; Subliminal’s ownership does not limit its confidentiality, data protection, retention, or deletion obligations concerning that information. Subliminal may disclose Usage Data for its own business purposes only in aggregated and deidentified form that does not identify Customer or any individual or disclose Customer’s Confidential Information. This restriction does not prevent disclosures necessary to provide the Service or otherwise permitted under Sections 4 and 6.

3.3 Use Restrictions. Subliminal will not, and will require its providers not to, use Customer Content or Usage Data to train or fine-tune artificial intelligence or machine-learning models. Without Customer’s separate, explicit written authorization, Subliminal will not sell or license Customer Content or customer-derived data, including in anonymized or aggregated form, or use customer recordings or customer-specific findings or reports for demonstrations, marketing, or cross-customer benchmarking. This Agreement does not grant that authorization. The rights in Section 3.2 do not authorize unrelated use of customer recordings or customer-specific findings or reports.

3.4 Reserved Rights and Feedback. Subliminal and its licensors retain all right, title, and interest in the Service and its underlying software, technology, methods, and know-how, including improvements to them. Customer may retain and use findings and reports delivered through the Service for its internal business purposes after the applicable Order Form ends. To the extent those findings or reports incorporate materials owned by Subliminal, Subliminal grants Customer a perpetual, non-exclusive, royalty-free license to use those materials solely as incorporated into the findings or reports for those purposes. Customer may voluntarily provide suggestions or other feedback concerning the Service (“Feedback”). Subliminal may use Feedback and generalized knowledge and experience gained in providing the Service without restriction or obligation, provided that doing so does not disclose Customer’s Confidential Information or violate Sections 3.3, 4, or 6. No rights are granted except as expressly stated in the Agreement.

4. Privacy, Security, and Data Processing#

4.1 Roles and Instructions. This Section and Schedules 1 and 2 form the Parties’ data processing terms. “Personal Data” has the meaning under applicable data protection law. “Customer Personal Data” means Personal Data in Customer Content or Usage Data processed under this Agreement. Customer is controller (or equivalent business) and Subliminal is processor (or equivalent service provider) for Customer Personal Data; if Customer is a processor, Subliminal is its subprocessor, and Customer will obtain any required controller authorization. Subliminal will process Personal Data only on Customer’s documented lawful instructions, including for transfers, unless law requires otherwise; it will inform Customer of that requirement unless prohibited. Permitted processing includes the operations and limited analytics in Section 3 and Schedule 1. Subliminal will promptly inform Customer if unable to follow an instruction or if an instruction appears unlawful. Subliminal will give prior notice of material changes to processing details and obtain any required Customer authorization; routine feature updates do not require amendment of these Terms.

Where service-provider/contractor restrictions apply under U.S. privacy law, Subliminal will provide the same level of protection that law requires, will not sell or share Personal Data, retain, use, or disclose it outside the specified services or direct business relationship, or combine it with other personal data except as that law permits. Subliminal certifies that it understands and will comply with those restrictions and will notify Customer if unable to meet them. Customer may take reasonable steps to verify compliance and stop and remediate unauthorized processing.

4.2 Customer Duties and Sensitive Data. Customer is responsible for lawful collection, instructions, required notices and permissions, and responses to individuals. The Service can incidentally capture sensitive content despite filtering. Customer will use exclusions and personnel instructions to limit unnecessary capture of credentials, payment-card data, government identification numbers, special-category data, and other specially regulated data. Customer may intentionally submit or authorize such data only if expressly agreed in writing with appropriate safeguards. A signed business associate agreement (“BAA”) is required before any deployment involving protected health information (“PHI”). That BAA governs PHI in case of conflict.

4.3 Safeguards and Incidents. Subliminal will maintain commercially reasonable administrative, physical, and technical safeguards appropriate to processing risks, including encryption in transit and at rest, least-privilege access, confidentiality, integrity, availability, and resilience controls. Personnel with access will be bound by confidentiality obligations and limited to need-to-know access for their work. The privacy controls and their limits are described in Schedule 1. Subliminal will notify Customer without undue delay and no later than seventy-two (72) hours after becoming aware of a breach of security involving accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. It will provide available material details, update Customer as information becomes available, and reasonably investigate, contain, and remediate the incident. Notice is not an admission of liability.

4.4 Providers and Locations. Customer generally authorizes the providers in Schedule 2 for the stated purposes and locations, subject to applicable law and required transfer safeguards. Regional infrastructure may be in Subliminal’s or Customer’s AWS account; central operational/workspace data and high-level outputs are also processed in the United States, and regional evidence is sent to the listed US AI providers. Central APIs may relay evidence without persisting it. The selected region does not confine all processing to that region or Customer’s account. Subliminal will impose equivalent applicable data protection duties on subprocessors, remain responsible for their performance, provide copies of relevant agreements on request subject to confidentiality redactions, and notify Customer of material subprocessor failures. Subliminal will give at least ten (10) business days’ prior notice and sufficient information about additions or replacements. Customer may object on reasonable data protection grounds within ten (10) business days; the Parties will work in good faith to resolve the objection before affected processing begins. If no reasonable solution is available, Customer may terminate the affected service and receive a refund of prepaid unused fees.

4.5 International Transfers. A restricted international transfer may begin only after the Parties put the legally required transfer safeguard in place. Where required, the Parties will complete the applicable tables and annexes and incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with Module Two for controller-to-processor transfers or Module Three for processor-to-subprocessor transfers, and/or the UK International Data Transfer Addendum (the “UK Addendum”). Clause 9 uses Option 2 with the notice period in Section 4.4; optional docking and Clause 11 language are excluded. Swiss transfers require the applicable Swiss adaptations. These transfer documents may be attached to an Order Form or separately; Schedule 1 supplies baseline processing information. A Customer-selected region or hosting model does not itself satisfy transfer requirements.

4.6 Assistance and Audits. Taking account of the processing and available information, Subliminal will reasonably assist Customer with individual rights requests, security and breach duties, data protection and transfer impact assessments, prior regulatory consultations, and regulatory inquiries. It will notify Customer of third-party requests concerning Customer Personal Data unless prohibited, follow lawful Customer instructions, and respond only as authorized by Customer or required by law. Subliminal will provide compliance information, available security reports, and reasonable security questionnaires, and allow legally required audits or inspections by Customer or an independent auditor bound by confidentiality. Existing reports will be used first where sufficient. Routine reviews require reasonable notice, business hours, protection of other customers’ data, and ordinarily no more than annual frequency; these limits do not prevent legally required, regulator-directed, or incident-related reviews. Subliminal will maintain non-content compliance records for three years after processing ends without retaining Customer Content or Personal Data beyond Section 4.7. Security requests may be sent to [email protected]. Customer bears reasonable costs of assistance beyond the ordinary Service except to the extent arising from Subliminal’s breach.

4.7 Retention and Ending Service. During active service, raw recordings are retained for up to one hundred eighty (180) days on a rolling basis; analysis outputs have no fixed retention limit. If an Order Form ends and no continuing Order Form or written agreement authorizes retention of the same data, Subliminal will promptly revoke recording-upload authorization, leave results and exports available for thirty (30) days, and, after any requested return/export, delete Customer Content, Usage Data, and Personal Data, including backup copies, by the end of those thirty (30) days. Legally required records remain protected and may be retained only as required. Subliminal will require applicable deletion by its subprocessors and confirm deletion in writing on request. Customer may also direct deletion during service, which Subliminal will implement as soon as reasonably practicable, subject to legal retention duties. Customer and its users must disable and uninstall the desktop client to stop local capture. Subliminal will delete Customer-hosted data while authorized access remains; Customer must complete deletion where it revoked that access or retained independent copies. Continuing service may retain the same data between Order Forms.

4.8 Accidental Capture and Requests. Customer and affected individuals may report accidentally captured personal, non-work, or sensitive content to [email protected]. Subliminal will reasonably assist Customer to locate, restrict access to, and delete such content, subject to identity verification, lawful instructions, and applicable legal retention duties. Individual rights requests for which Customer is responsible will be referred to Customer and supported under Section 4.6. Nothing in the filtering description excuses a required response or deletion under applicable law.

5. Fees, Taxes, and Payment#

Fees, payment deadlines, service periods, renewal, and usage limits are stated in each Order Form; an assessment may be free or paid. Unless otherwise stated there, fees are in US dollars, exclude taxes, and are invoiced in advance except usage-based fees, which are invoiced in arrears. Customer will pay undisputed amounts when due and itemized applicable transaction taxes, excluding taxes on Subliminal’s income. If automatic payment is selected in an Order Form, Customer authorizes charges under its payment schedule, and Subliminal will make bills or transaction records available. Fees are non-refundable except as stated in the Agreement or applicable Order Form. Customer must raise good-faith disputes before payment is due or within thirty (30) days after an automatic charge and pay undisputed amounts on time; the Parties will seek resolution within fifteen (15) days, without limiting available remedies.

6. Confidentiality#

A Party receiving non-public information disclosed in connection with the Agreement (“Confidential Information”) will use it only to perform or exercise rights under the Agreement and protect it with the care used for its own similar information, at least reasonable care. It may disclose it only to personnel, advisors, contractors, and service providers with a need to know and confidentiality duties at least as protective, and remains responsible for their compliance. This excludes information the recipient can show it already knew without restriction, becomes public without breach, receives lawfully without restriction, or independently develops without using the discloser’s information. Legally compelled disclosure is permitted after advance notice where lawful and reasonable assistance, at the discloser’s expense, to seek confidential treatment. Customer Content, identifiable Usage Data, non-public Service information, and non-public Agreement terms are Confidential Information. Subliminal may identify Customer as a Service customer and use its name and logo for that purpose, subject to supplied written brand guidelines. Other publicity requires prior written consent; recordings and findings remain subject to Section 3.3.

7. Warranties and Disclaimer#

Each Party represents and warrants that it is duly organized, validly existing, and in good standing under its jurisdiction of organization, has authority to enter into the Agreement, and will comply with laws applicable to its performance. Customer represents it has the rights needed to authorize collection and processing of Customer Content. If Subliminal materially reduces a paid Service’s core functionality contrary to Section 1.2, Customer must notify it within forty-five (45) days of discovery with sufficient details; Subliminal will attempt restoration within forty-five (45) days after that notice. If it cannot restore functionality, Customer may terminate the affected Order Form and receive a prorated refund of prepaid unused fees. This section sets forth Customer’s exclusive remedies for that functionality warranty. AI outputs and automated classifications may be inaccurate and require appropriate human review. Subliminal does not guarantee identification of every workflow, exclusion of all sensitive content, or any savings, performance, or business outcome. Except for express Agreement commitments, the Service and findings are provided “as is” and “as available”; to the maximum extent permitted by law, each Party disclaims other express, implied, or statutory warranties, including merchantability, fitness, title, and non-infringement. Subliminal does not provide legal, employment, or regulatory advice.

8. Limitation of Liability#

To the maximum extent permitted by law, neither Party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits or revenues, arising out of the Agreement, even if advised of their possibility. Except as provided below, each Party’s total aggregate liability under the Agreement will not exceed the greater of (a) the amount paid by Customer to Subliminal in the twelve (12) month period preceding the applicable claim or (b) $100,000. Neither the foregoing damages exclusion nor liability cap applies to Customer’s obligation to pay fees and taxes properly due under the Agreement, a Party’s indemnification obligations under Section 9, breach of its confidentiality obligations under Section 6, fraud, or willful misconduct, or to liability under executed EU Standard Contractual Clauses or the UK Addendum. These limits apply regardless of claim theory but do not limit liability where prohibited by law or an individual’s data protection rights.

9. Indemnification#

9.1 Subliminal. Subliminal will indemnify, defend, and hold harmless Customer from third-party claims that the Service, as provided and permissibly used, infringes U.S. intellectual property rights, including damages, settlements, and reasonable defense costs and attorneys’ fees. This excludes claims caused by Customer Content, Customer-directed or unauthorized modifications, combination with items not provided by Subliminal, unauthorized use, or use of an outdated version where a current version would avoid the claim. Subliminal may obtain continued use rights, modify or replace the affected Service without materially reducing core functionality, or, if neither is reasonably available, terminate the affected Order Form and refund prepaid unused fees. Section 9.1 states Customer’s exclusive remedies and Subliminal’s entire liability for third-party claims that the Service infringes intellectual property rights.

9.2 Customer. Customer will indemnify, defend, and hold harmless Subliminal from third-party claims arising from Customer Content, Customer’s collection, submission, or use of it in violation of law or the Agreement, or Customer’s or its users’ breach of Section 2, including damages, settlements, and reasonable defense costs and attorneys’ fees, except to the extent caused by Subliminal’s breach or unlawful acts.

9.3 Procedure. The protected Party will promptly notify the indemnifying Party, reasonably cooperate at that Party’s expense, and permit it to control defense and settlement. Delay in notice excuses indemnification only to the extent materially prejudicial. The protected Party may participate with its own counsel at its own expense. No settlement may impose an admission, payment, or ongoing obligation on the protected Party without its prior written consent, not unreasonably withheld. The indemnifying Party is not responsible for any settlement entered into without its prior written consent, not unreasonably withheld.

10. Term and Termination#

10.1 Framework. These Terms take effect upon acceptance of the first Order Form and remain in effect after its completion to govern later Order Forms unless terminated under this Section. Either Party may terminate the framework on 30 days’ written notice when no Order Form remains in effect. Each Order Form lasts for its stated period; automatic renewal applies only if that Order Form expressly states the renewal period and non-renewal deadline.

10.2 Ending an Order Form. Either Party may terminate for a material breach uncured thirty (30) days after notice, or immediately for an incurable material breach, insolvency, or cessation of business without a successor, subject to applicable law. Customer may terminate an assessment Order Form at any time by notice to Subliminal, but committed assessment fees remain payable unless that Order Form states otherwise. Section 4.7 applies upon that termination. Either Party may terminate an affected Order Form if an event beyond reasonable control prevents material operation for thirty (30) consecutive days. If Customer terminates for Subliminal’s uncured material breach, or either Party terminates under that force majeure provision, Subliminal will refund prepaid unused fees.

10.3 Effect and Survival. Active-use rights end on expiration or termination, subject to the thirty (30)-day results/export period in Section 4.7 and the continuing rights to delivered findings and reports under Section 3.4; accrued fees remain payable. Each Party will return or destroy the other’s Confidential Information on request, subject to lawful retention and ordinary backups, but Customer Content, Usage Data, and Personal Data must be handled within Section 4.7’s stricter limits. Ending one Order Form does not end others or automatically end these Terms. Sections 2.3, 2.4, 3, 5 (for accrued fees), 6, 7 (disclaimers only), 8, 9, 10.3, and 11 survive, and Section 4 continues for any retained data.

11. General Terms#

11.1 Agreement and Interpretation. The Agreement supersedes prior proposals and discussions about its subject. Customer purchase orders and vendor-portal terms are administrative only and do not amend it unless expressly agreed in writing by an authorized Subliminal representative. Amendments and waivers require written agreement, including electronic acceptance by authorized representatives; an Order Form changes these Terms only if it expressly identifies the provision amended. Failure to enforce a provision is not a waiver. In a conflict, mandatory transfer clauses control, then an applicable BAA or data protection addendum for its subject, then an Order Form for commercial and service-specific terms, then these Terms and schedules. An ordinary Order Form does not displace a BAA. Headings are for convenience; “including” is non-exclusive. The UN Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transaction Act do not apply.

11.2 Remedies and Relationships. Delaware law governs, excluding conflict-of-laws rules; Delaware state and federal courts have exclusive jurisdiction, subject to mandatory transfer-clause requirements. For actual or threatened confidentiality or intellectual property violations, the affected Party may seek injunctive relief in any competent court, without bond to the extent permitted by law. Except for an expressly exclusive remedy, remedies are cumulative. Neither Party may assign without consent except to an entity controlling, controlled by, or under common control with it, or in a merger, reorganization, or sale of substantially all relevant assets, business, or equity, upon notice. Other attempted assignments are void. Permitted successors and assigns are bound. The Parties are independent contractors and cannot bind one another; there are no third-party beneficiaries except as required by law or transfer clauses. Neither Party is liable for delay beyond reasonable control after reasonable mitigation, except accrued payment duties. Legal notices go to the Order Form’s notice emails and are effective upon confirmed delivery. Electronic signatures, acceptance under Section 1.3, and counterparts are effective. Unenforceable provisions are severable.

11.3 Compliance. Each Party will comply with applicable anti-bribery laws. Customer will comply with applicable export controls and sanctions, will not make the Service available to prohibited persons or locations, and represents that it is not a prohibited person or owned to an extent prohibited by applicable sanctions by such persons. Subliminal may suspend or terminate affected service immediately to comply with those laws. If supplied to the US Government, the Service, software, and documentation are commercial computer software and documentation provided only with the rights in this Agreement, to the extent applicable law permits.

Schedule 1 — Processing and Capture Details#

Subject and Purpose. AI workflow observability: capture and analyze workplace activity; reconstruct processes; provide dashboards, recommendations, workflow/wiki outputs, and automation opportunities; operate, secure, support, troubleshoot, and improve the Service through the limited analytics in Section 3. No automation deployment or model training.

Duration and Frequency. Continuous or intermittent capture while the client is enabled during the ordered service period; retention and deletion under Section 4.7. Raw recordings: up to one hundred eighty (180) days during active service. Analysis outputs: no fixed limit during active service. Results/exports: thirty (30) days after service ends; return/deletion by the end of that period unless a continuing agreement covers the same data or law requires retention.

Data Subjects. Customer’s employees, contractors, end users, and other persons whose information appears in its business systems, communications, or captured workplace activity.

Capture Categories. Screen images and video (including background windows/content); keyboard actions, typed text, mouse/cursor/click/scroll actions; clipboard changes and available text; running/visible applications, active window titles and locations, browser URLs where available; accessibility/interface structure, controls and supported displayed-page text; device/install/account identifiers, computer/OS/client details, display configuration, timestamps, sessions, permissions, errors and upload metadata. Availability depends on OS permissions, configuration, exclusions, and application support.

Content and Sensitive Data. Documents, emails, chats, spreadsheets, messages and notifications can be captured, including typed drafts/text later deleted and clipboard text never pasted. Secure-input protections suppress recognized typed-password capture and certain interface data but do not guarantee exclusion of credentials, tokens, card data, or sensitive content displayed elsewhere. PHI requires an executed BAA; other specially regulated data requires written authorization. No microphone or system/output audio is currently captured; new capture categories require the authorization in Section 1.2.

Customer-Visible Data. Authorized users can see identifiable employee names, emails, teams, weekly work hours, workflow participation and attributed time, roles/responsibilities, wiki/process descriptions, and supported work-evidence answers. This information remains subject to Section 2.4’s use restrictions.

Operations and Hosting. Collection, transmission, storage, classification, analysis, retrieval, disclosure to authorized users/providers, export, restriction and deletion. Regional AWS infrastructure stores recordings and detailed intermediate analysis in the selected region; central US systems hold workspace/identity/role/configuration data, aggregate statistics and high-level outputs. Evidence may transit central APIs without persistent storage there; AI analysis is performed by the listed US providers.

Privacy Filtering and Safeguards#

Local Controls. Customer controls which computers/accounts have the client installed and enabled. Application and website rules use exclusions and exceptions, not a general approved-applications-only mode. Built-in exclusions cover selected personal/sensitive services. Workspace administrators may add exclusions and permit business-use exceptions to some built-in rules; password-manager, dating, gambling, adult-content, and piracy exclusions are not overridable. Individuals may add stricter exclusions that override workspace exceptions. A detected foreground exclusion suppresses capture on the affected display; other displays may continue recording. Missing application/URL context and background content can prevent complete exclusion.

Cloud Filtering. AI classification occurs after transmission and may involve the AI providers before activity is classified as non-work. Segments classified as personal activity or breaks are excluded from subsequent workflow analysis and customer-facing segment search; recording content and associated captured text/analysis are scheduled for deletion or stripping. Limited timing, activity-category and deletion-audit information may remain. Idle time is treated separately, mixed work/non-work video clips may remain, and classification can be wrong. Filtering does not guarantee removal of every instance of personal or sensitive content. Accidental-capture requests are handled under Section 4.8.

Security. Subliminal will maintain encryption in transit and at rest, least-privilege access by personnel with a business need, confidentiality and authorization controls, physical security, system resilience and timely recovery, logging, security governance, data minimization and retention controls, appropriate pseudonymization, and regular assessment of safeguards. Customer controls its own AWS access for Customer-hosted deployments. Evidence-query audit logging is governed by Section 2.4.

Schedule 2 — Authorized Providers and Processing Locations#

The following providers support the Service; actual use depends on configuration. “Selected Region” means the region entered in the Order Form for regional AWS infrastructure. Customer-hosted deployment still uses central US systems and applicable AI providers. A provider directly engaged by Customer for its own infrastructure is Customer’s provider to that extent; the other listed processing remains governed by the Agreement.

Provider changes and objections are governed by Section 4.4. Required transfer schedules must be completed before a restricted transfer under Section 4.5. Applicable PHI processing also requires the executed BAA and any required downstream arrangements.