BACI

MOBILE APPLICATION TERMS

Version 1.0 · Effective Date: 10 September 2026 · Last Updated: 10 September 2026

These Mobile Application Terms ("Mobile Terms") are Supplemental Terms governing download, installation, access to and use of any BACI mobile or tablet application, mobile software component, app extension, mobile authentication feature or related mobile functionality made available by BACI LLC ("BACI").

The BACI mobile application is an access surface for the BACI Services. Installing the application does not itself create a separate BACI subscription, separate organisation or separate entitlement. Access remains tied to the applicable BACI Account, organisation, subscription, Mode, Capacity, permissions and Order.

Where an application marketplace processes a purchase, subscription, cancellation or refund, that marketplace may control the payment transaction. BACI's underlying Service terms continue to govern use of BACI except to the extent mandatory marketplace terms or Applicable Law control a specific matter.

1. INCORPORATION AND PRECEDENCE

These Mobile Terms form part of the BACI Legal Framework and Agreement.

For matters expressly concerning the mobile application, these Mobile Terms apply as Supplemental Terms. The Terms of Service remain the principal agreement. The Privacy Policy governs BACI's controller processing, the DPA governs Customer Personal Data processed on Customer's behalf, the Security Addendum governs contracted security obligations, and the AI & Autonomous Systems Terms govern applicable AI and Autonomous functionality.

An executed Order or negotiated agreement controls where the Agreement's order of precedence gives it priority.

2. SCOPE

These Mobile Terms apply to BACI applications distributed through an application marketplace, enterprise distribution mechanism, device-management system or another BACI-authorised channel.

They apply to updates, upgrades and replacement versions unless accompanied by separate terms that expressly govern them prospectively.

3. DEFINITIONS

“App” means a BACI mobile or tablet application covered by these Mobile Terms.

“App Marketplace” means Apple App Store, Google Play or another authorised application distribution platform.

“Device” means a compatible mobile, tablet or other supported device on which the App is installed.

“Marketplace Purchase” means a subscription, in-app purchase or other transaction for which an App Marketplace or its payment provider controls billing.

Other capitalised terms have the meanings in the Terms or applicable Supplemental Terms.

4. LICENCE — NOT SALE

Subject to the Agreement, BACI grants Customer a limited, revocable, non-exclusive, non-transferable and non-sublicensable licence during the applicable entitlement to install and use the App on supported Devices that Customer owns or controls, or is otherwise authorised to use, subject to applicable App Marketplace usage rules.

The App is licensed, not sold. BACI and its licensors retain all rights not expressly granted.

5. ORGANISATIONAL USERS

Where Customer is an organisation, Customer may permit Authorised Users to use the App within their assigned BACI permissions.

Customer remains responsible for administration of its organisation, users and access rights as provided by the Agreement.

Installation on a Device does not grant a user broader BACI permissions than the user's Account permits.

6. ACCOUNT REQUIRED

Certain App functionality requires a BACI Account and an active entitlement.

Customer must protect Account credentials and must not allow unauthorised persons to use an Account.

Device possession alone does not establish authority to access an organisation.

7. CROSS-PLATFORM ENTITLEMENTS

BACI entitlements are associated with the applicable BACI Account or organisation rather than with the mere installation of a particular App.

Where supported, a Customer may access the same underlying BACI entitlement through web, mobile or other authorised BACI interfaces.

Installing the App does not create a duplicate subscription and deleting it does not cancel an existing subscription.

8. DEVICE REQUIREMENTS

The App may require a supported operating system, Device capabilities, network connectivity, security settings or other technical prerequisites.

BACI may cease supporting obsolete operating-system versions or Devices where reasonably necessary for security, compatibility or product evolution.

Customer is responsible for maintaining a compatible Device.

9. APP MARKETPLACE TERMS

Use of an App obtained through an App Marketplace is also subject to applicable mandatory marketplace usage rules.

These Mobile Terms are between BACI and Customer, not between Customer and the App Marketplace, except for rights that marketplace terms expressly grant to the marketplace.

Nothing in these Mobile Terms requires an App Marketplace to provide BACI's contractual Services.

10. APPLE-SPECIFIC ACKNOWLEDGEMENT

For an App obtained through Apple's App Store, Customer and BACI acknowledge that these Mobile Terms are concluded between BACI and Customer only, and not with Apple, and BACI—not Apple—is responsible for the App and its content, subject to the Agreement.

The licence is limited to use on Apple-branded products Customer owns or controls, or otherwise as permitted by Apple's applicable usage rules, including any permitted associated-account, family-sharing or volume-purchasing use.

Apple has no obligation to provide maintenance or support for the App except to the extent Applicable Law requires otherwise.

11. APPLE THIRD-PARTY BENEFICIARY

For an App obtained through Apple's App Store, Apple and its subsidiaries are intended third-party beneficiaries of the provisions of these Mobile Terms applicable to the Apple-distributed App and, upon Customer's acceptance, may enforce those provisions against Customer to the extent required by Apple's applicable minimum EULA terms.

This Section does not make Apple a party to BACI's underlying subscription or enterprise Agreement.

12. GOOGLE PLAY-SPECIFIC TERMS

For an App obtained through Google Play, Customer's use is subject to applicable Google Play terms and usage rules.

Where Google Play controls a Marketplace Purchase, subscription management, cancellation and refund administration may need to occur through Google Play.

Uninstalling the App does not cancel a Google Play subscription.

13. INSTALLATION

Customer may install the App only through BACI-authorised distribution channels unless BACI expressly permits another method.

Customer must not obtain, distribute or install modified, pirated or unauthorised copies.

BACI may use platform-supported mechanisms to verify App integrity or entitlement.

14. UPDATES

BACI may provide updates to improve functionality, compatibility, reliability, privacy or security.

Some updates may be required to continue using the App.

Where Device settings permit automatic updates, the App Marketplace or Device may install updates automatically according to the user's platform settings.

15. SECURITY UPDATES

BACI may require prompt installation of a security update where an older version creates material risk.

BACI may restrict access from materially insecure or unsupported versions.

Customer should keep the Device operating system and App reasonably current.

16. MOBILE SECURITY

Customer is responsible for reasonable Device security, including passcodes or biometric protection where appropriate, operating-system updates, avoiding untrusted software, and preventing unauthorised Device access.

BACI may provide App-level security controls but does not control the entire Device environment.

17. LOST OR STOLEN DEVICES

Customer should promptly secure a BACI Account if a Device is lost, stolen or compromised.

Customer should use available Device-management, remote-lock, credential-revocation or BACI access controls as appropriate.

BACI may revoke sessions or require reauthentication where reasonably necessary.

18. BIOMETRIC AUTHENTICATION

Where the App permits Device biometric authentication, biometric matching may be performed by the Device operating system rather than BACI.

BACI may receive confirmation that authentication succeeded without receiving the underlying biometric template, depending on the supported implementation.

Customer should not enable biometric access where other persons are enrolled on the Device and should not have access to the BACI Account.

19. DEVICE PASSCODES

Where the App relies on Device-level authentication, Customer is responsible for maintaining a secure Device passcode and controlling who can unlock the Device.

BACI is not responsible for access by a person whom Customer has authorised to unlock the Device except to the extent the Agreement allocates responsibility differently.

20. SESSION MANAGEMENT

The App may maintain authenticated sessions to support usability.

BACI may expire, revoke or require reauthentication of sessions based on security, risk, Account changes, password changes, administrator action or other reasonable controls.

Customer should sign out or revoke access when a Device is transferred to another person.

21. MOBILE DEVICE MANAGEMENT

Enterprise Customers may use supported mobile-device-management or enterprise-mobility controls to manage the App where available.

Customer is responsible for its own MDM configuration and policies.

BACI does not assume responsibility for a Customer-selected MDM provider.

22. ROOTED OR JAILBROKEN DEVICES

BACI may restrict or warn against use on rooted, jailbroken or materially compromised Devices where the condition undermines security controls.

Technical ability to install the App on such a Device does not guarantee support.

23. NETWORK CONNECTIVITY

The App may require internet or mobile-data connectivity.

Customer is responsible for carrier, roaming, internet and other third-party connectivity charges.

BACI is not responsible for network availability outside BACI's control.

24. OFFLINE FUNCTIONALITY

Certain App features may support limited offline access or local caching where BACI enables it.

Offline information may become stale and should not be assumed current until synchronisation occurs.

High-consequence decisions should not rely on stale cached information where current data is material.

25. LOCAL STORAGE

The App may store limited information on a Device to support authentication, preferences, performance, offline use or other functionality.

BACI will use reasonable application-level safeguards for information within BACI's control.

Customer is responsible for Device security and should remove BACI data before disposing of or transferring a Device where appropriate.

26. NOTIFICATIONS

The App may send push or local notifications where Customer enables them.

Notification previews can expose information on a locked screen depending on Device settings.

Customer is responsible for configuring notification privacy appropriate to its environment.

27. EMAIL, SMS AND DEVICE COMMUNICATIONS

Where the App initiates email, SMS, telephone or other Device communications, carrier or provider charges may apply.

Customer must not use BACI functionality to send unlawful spam, harassment or prohibited communications.

The Acceptable Use Policy applies.

28. CAMERA, PHOTOS AND FILES

Where Customer chooses to grant access to camera, photos, files or documents, the App may use that access only for supported functionality and subject to applicable permissions and privacy rules.

Customer is responsible for having rights to content it uploads.

BACI does not obtain unlimited rights to a Device's photo library or files merely because a permission is granted.

29. MICROPHONE AND AUDIO

Where supported functionality requires microphone access, the App will rely on applicable Device permissions.

Customer is responsible for complying with laws governing recording, consent and communications in the Customer's jurisdiction.

BACI does not authorise covert or unlawful recording.

30. LOCATION

If BACI introduces functionality that uses Device location, the App will rely on applicable permissions and BACI's Privacy Policy.

Location access does not grant BACI authority to use precise location for unrelated purposes.

Customer may control location permissions through Device settings, subject to functionality that legitimately depends on them.

31. CONTACTS AND CALENDAR

If Customer elects to connect contacts, calendar or similar Device data to supported BACI functionality, Customer is responsible for having appropriate authority and permissions.

BACI will not treat Device-level access as permission to use that data for unrelated purposes.

Applicable privacy and data-processing terms continue to apply.

32. CLIPBOARD AND SHARING

Information copied to or from the Device clipboard, share sheet or another application may become accessible to the operating system or other applications according to platform behaviour.

Customer should avoid copying sensitive credentials or unnecessary protected data into insecure destinations.

33. THIRD-PARTY APPLICATIONS

The App may interoperate with third-party applications, browsers, identity providers, maps, communication services or other external systems.

Third-party services are governed by their own terms and privacy practices.

BACI is responsible only to the extent the Agreement expressly allocates responsibility to BACI.

34. DEEP LINKS AND EXTERNAL LINKS

The App may open external websites or other applications.

Customer should verify destinations before submitting credentials or sensitive information.

BACI does not control third-party content merely because the App provides a link.

35. SINGLE SIGN-ON

Where BACI supports enterprise SSO or federated identity, Customer is responsible for its identity-provider configuration, user lifecycle and administrator controls.

BACI may rely on authentication assertions supplied by Customer's configured identity provider subject to the Agreement.

36. SUBSCRIPTIONS

Paid BACI access may be purchased directly from BACI or, where offered, through an App Marketplace.

The applicable purchase confirmation identifies the billing channel and subscription terms.

The Billing Policy governs direct BACI purchases; marketplace billing rules govern Marketplace Purchases to the extent the marketplace controls the transaction.

37. NO SEPARATE MOBILE SUBSCRIPTION BY INSTALLATION

Downloading, installing or signing into the App does not by itself create a new paid subscription.

A paid obligation arises only through an authorised purchase, renewal, Order or other agreed transaction.

The App may display or facilitate access to an existing BACI subscription.

38. IN-APP PURCHASES

Where BACI offers an in-app purchase, the App will identify the relevant product, price or subscription information through the applicable purchase flow.

Marketplace rules may determine payment collection, taxes, receipts and refund administration.

An in-app purchase does not expand Customer's rights beyond the purchased entitlement.

39. MARKETPLACE SUBSCRIPTION MANAGEMENT

Where an App Marketplace controls a subscription, Customer may need to manage renewal, payment method or cancellation through that marketplace.

BACI may provide a link or direction to the appropriate subscription-management mechanism.

BACI cannot guarantee that a cancellation submitted only to BACI will stop billing controlled by a third-party merchant of record.

40. CANCELLATION

Deleting or uninstalling the App does not cancel a subscription.

Direct BACI subscriptions must be cancelled under the Cancellation Policy. Marketplace subscriptions must be cancelled through the applicable marketplace where that marketplace controls renewal.

Customer may ordinarily retain access through the paid period after cancellation where the applicable terms provide.

41. REFUNDS

Refunds for direct BACI purchases are governed by the Refund Policy.

Refunds for Marketplace Purchases may be administered by the applicable marketplace under its rules and Applicable Law.

BACI cannot promise to override a marketplace's transaction controls.

42. RESTORING PURCHASES

Where supported by an App Marketplace, Customer may be able to restore eligible purchases to another compatible Device associated with the applicable marketplace account.

Restoring a marketplace purchase does not create duplicate BACI entitlements.

BACI may require Account authentication to associate restored access with the correct BACI organisation.

43. PRICING DIFFERENCES

Prices, taxes, currencies or purchasing options may differ between BACI's direct channels and an App Marketplace because of regional, platform, tax or commercial factors.

A price displayed in one channel does not create a right to that price in another channel unless BACI expressly states otherwise.

44. TRIALS

Where a mobile trial converts to paid access automatically, the applicable purchase flow will disclose the conversion terms as required by law and marketplace rules.

Customer must cancel through the applicable billing channel before conversion or renewal where it wishes to avoid the future charge.

Trial functionality may differ from paid functionality.

45. BUSINESS AND ENTERPRISE ACCOUNTS

An organisation may centrally purchase BACI while Authorised Users access the Service through the App.

An individual user's installation does not alter the organisation's Order, Capacity, billing or contractual rights.

Enterprise administrators may restrict mobile access according to supported controls.

46. ACCOUNT AND ORGANISATION SEPARATION

A Device may be capable of accessing more than one BACI organisation where BACI supports it.

Customer must ensure users act within the correct organisation and permissions.

Data or actions must not be intentionally moved between organisations without appropriate authority.

47. AI FUNCTIONALITY

AI Functionality accessed through the App is governed by the AI & Autonomous Systems Terms.

Mobile presentation does not change the probabilistic nature of AI Outputs or Customer's obligation to apply proportionate review.

Customer must not treat a mobile notification or concise interface as a substitute for reviewing material context where consequence requires it.

48. NO GENERAL MODEL TRAINING BY DEFAULT

Unless Customer expressly agrees in writing or affirmatively opts into a clearly identified programme, BACI will not use Customer Confidential Information, Customer Personal Data, private Inputs or private Outputs to train or fine-tune general-purpose or shared AI models for the benefit of other customers.

Use of the mobile App does not weaken this contractual restriction.

The DPA remains authoritative for Customer Personal Data.

49. AUTONOMOUS FUNCTIONALITY

Where the App allows Customer to configure, approve, monitor, pause or interact with Autonomous functionality, the AI & Autonomous Systems Terms govern.

A tap, biometric confirmation or mobile approval has the legal effect assigned to the relevant authorised workflow.

Autonomy does not remove governance.

50. MOBILE APPROVALS

Customer is responsible for ensuring that users authorised to approve consequential actions through the App have appropriate organisational authority.

BACI may require reauthentication, step-up authentication or additional confirmation for certain actions.

Device possession alone does not create approval authority.

51. HIGH-CONSEQUENCE USE

Customer must not use the App as the sole decision or operational control where Applicable Law requires human review, specialised safeguards or prohibits the use.

Mobile convenience does not reduce governance requirements for high-consequence actions.

52. FINANCIAL AND COMMERCIAL ACTIONS

Where BACI supports financial or commercial approvals through the App, Customer remains responsible for Authority Boundaries, spending limits, permissions and internal controls.

BACI will not infer unlimited financial authority from an authenticated mobile session.

53. DATA RIGHTS

Customer retains rights in Customer Data as provided by the Terms.

The App licence does not transfer ownership of BACI Technology.

Third-Party Data remains subject to applicable third-party rights.

54. PRIVACY

BACI's Privacy Policy explains how BACI handles Personal Data for BACI's own purposes.

Where BACI Processes Customer Personal Data on Customer's behalf through the App, the DPA applies.

Device permissions are used in accordance with supported functionality, applicable settings and the BACI Legal Framework.

55. ANALYTICS AND DIAGNOSTICS

BACI may collect reasonable application diagnostics, performance information, crash information, security telemetry and Usage Data as described in the Privacy Policy and Agreement.

BACI will not treat diagnostic collection as permission to use private Customer content for unrelated general model training.

Platform providers may independently collect information under their own terms.

56. ADVERTISING AND TRACKING

BACI will comply with Applicable Law and applicable platform requirements for tracking, advertising identifiers and consent.

The existence of an operating-system advertising identifier does not mean BACI uses it.

Any applicable tracking or advertising practice must be accurately disclosed through the Privacy Policy, Cookie Policy or platform disclosures.

57. CHILDREN

The App is not to be used in violation of applicable children's privacy, age-assurance or parental-consent laws.

BACI may impose age or account restrictions appropriate to the Service.

Organisations deploying BACI to younger users are responsible for ensuring the deployment is authorised and supported.

58. ACCEPTABLE USE

The Acceptable Use Policy applies to use of the App.

Customer must not use mobile functionality for fraud, unlawful access, harassment, malware, prohibited discrimination, safeguard circumvention or other prohibited conduct.

A mobile interface does not create an exception to BACI's platform rules.

59. REVERSE ENGINEERING

Except to the extent Applicable Law expressly prohibits the restriction, Customer must not reverse engineer, decompile, disassemble, derive source code from, tamper with or create unauthorised derivative works of the App or protected BACI Technology.

Open-source components remain governed by their applicable licences.

60. APP INTEGRITY

Customer must not bypass code signing, integrity checks, authentication, certificate controls, entitlement checks or other security mechanisms.

BACI may refuse access from materially modified or unauthorised App builds.

61. INTELLECTUAL PROPERTY

BACI and its licensors retain all rights in the App, BACI Technology, interfaces, designs, software, models, content and associated intellectual property except rights expressly granted under the Agreement.

No trademark or branding licence is granted merely by installation.

62. OPEN-SOURCE COMPONENTS

The App may contain open-source software governed by separate licences.

Where an open-source licence grants rights that conflict with these Mobile Terms for the applicable component, the open-source licence controls for that component.

Those rights do not extend to unrelated proprietary BACI Technology.

63. EXPORT CONTROLS AND SANCTIONS

Customer must comply with applicable export controls, sanctions and trade restrictions in downloading and using the App.

Customer must not use account, marketplace, VPN, proxy or Device configuration to unlawfully evade geographic restrictions.

BACI may restrict access where legally required.

64. GOVERNMENT AND PUBLIC-SECTOR USE

Government and public-sector use remains subject to the Government & Public Sector Schedule where applicable.

Distribution through a consumer App Marketplace does not override negotiated public-sector requirements, data restrictions or procurement terms.

65. SUPPORT

BACI is responsible for support for the App to the extent provided by the applicable BACI plan, support policy, SLA or Order.

An App Marketplace is not responsible for BACI support merely because it distributes the App.

Customer should use BACI's designated support channels for App-specific issues.

66. MAINTENANCE

BACI may maintain, update and modify the App consistent with the Agreement.

BACI does not promise continued compatibility with every historical Device or operating-system version.

Specific enterprise support commitments must be stated in an Order or SLA.

67. APP MARKETPLACE WARRANTY ALLOCATION

Where mandatory App Marketplace terms provide a remedy if the App fails to conform to an applicable warranty, those marketplace terms apply to the extent required.

Except for any marketplace-administered purchase-price remedy required by applicable platform terms or law, BACI remains responsible for warranties concerning the App under the Agreement, not the App Marketplace.

68. PRODUCT CLAIMS

To the extent required by applicable App Marketplace terms, BACI—not the marketplace—is responsible for addressing claims relating to the App or Customer's possession or use of it, including product-liability, legal-conformity or consumer-protection claims, subject to the Agreement and Applicable Law.

This Section does not expand BACI's liability beyond non-waivable requirements or the Agreement's applicable allocation.

69. INTELLECTUAL-PROPERTY CLAIMS INVOLVING THE APP

If a third party claims that the App or Customer's authorised possession or use of it infringes intellectual property rights, responsibility is allocated under the Agreement and any mandatory App Marketplace terms.

The marketplace is not responsible for BACI's defence obligations merely because it distributed the App.

70. AVAILABILITY

The App and underlying Services may be unavailable because of maintenance, networks, Device conditions, marketplace services, third-party dependencies or other causes.

Binding availability commitments exist only where an SLA or Order expressly provides them.

Customer should not assume uninterrupted mobile connectivity.

71. THIRD-PARTY PLATFORM OUTAGES

BACI is not responsible for an App Marketplace, mobile carrier, operating system or third-party platform outage except to the extent the Agreement expressly provides otherwise.

Where the BACI web service remains available, Customer may use another supported interface if its entitlement permits.

72. EMERGENCY SECURITY ACTIONS

BACI may disable a vulnerable App version, revoke sessions, require reauthentication or restrict mobile functionality where reasonably necessary to contain a material security threat or comply with law.

Where practicable, BACI will limit the action to the affected functionality.

73. SUSPENSION

BACI may suspend App access on grounds permitted by the Terms, including material breach, security risk, prohibited use, non-payment or legal requirement.

Suspension of mobile access does not necessarily terminate the underlying subscription.

74. TERMINATION

The App licence ends when Customer's applicable BACI entitlement terminates or when the Agreement otherwise requires use to cease.

Upon termination, Customer must stop using the App except to the extent residual rights are required by Applicable Law.

BACI may revoke sessions and credentials associated with terminated access.

75. UNINSTALLATION

Customer may uninstall the App from a Device at any time.

Uninstallation removes the local App but does not by itself cancel a subscription, close the BACI Account, delete the organisation or require immediate deletion of Customer Data held by BACI.

Those matters are governed by their respective BACI policies.

76. DATA AFTER UNINSTALLATION

Some locally stored App data may be removed by the operating system when the App is uninstalled, but BACI-hosted data remains subject to the Agreement and Data Retention & Deletion Policy.

Customer should not rely on uninstallation as a data-deletion request.

77. ACCOUNT CLOSURE

Account closure is separate from App uninstallation and subscription cancellation.

Where Customer wants to close an Account, Customer must use the applicable BACI account process.

Organisation administrators should consider effects on other users before requesting organisation closure.

78. BUSINESS CONTINUITY

Customer should maintain reasonable alternative access or procedures where mobile access is operationally important.

A mobile Device should not be the sole control for a critical process where loss, battery failure, network outage or Device compromise would create unacceptable risk.

79. WARRANTIES

Warranties applicable to the App and Services are those stated in the Agreement and mandatory law.

BACI does not warrant that the App will operate on every Device, with every third-party application or in every jurisdiction.

Customer is responsible for confirming suitability for its use case.

80. LIABILITY

Liability arising from the App is governed by the Agreement, including applicable exclusions, caps, enhanced caps and non-excludable liabilities.

The involvement of an App Marketplace does not create duplicative recovery.

Mandatory Applicable Law remains unaffected.

81. INDEMNITIES

Indemnity obligations relating to Customer Data, unlawful use, third-party claims and intellectual property are governed by the Agreement.

These Mobile Terms do not create duplicative indemnities where the Agreement already allocates the relevant risk.

82. CHANGES TO THE APP

BACI may change mobile features, interfaces, Device support and technical implementation as the Service evolves, subject to applicable contractual commitments.

A feature available on web is not necessarily available on mobile, and vice versa.

Material contracted functionality remains governed by the Agreement.

83. CHANGES TO THESE MOBILE TERMS

BACI may update these Mobile Terms prospectively to reflect changes in the App, App Marketplace requirements, technology, law or BACI Services.

BACI will not use a lower-precedence update to retroactively eliminate a higher-precedence contractual protection where the Agreement prohibits that change.

Mandatory notice requirements will be followed.

84. REGIONAL REQUIREMENTS

Mobile distribution, payments, consumer rights, privacy, age restrictions and platform requirements can differ by jurisdiction.

BACI may apply regional schedules or marketplace-specific provisions where required.

Mandatory local law prevails to the required extent.

85. INTERPRETATION

The App is an interface to BACI, not a separate legal service merely because it is installed on a Device.

“Purchase through the App” does not necessarily mean BACI is the merchant of record; the purchase flow determines the billing provider.

Device permission, technical capability and authenticated access do not by themselves establish unlimited organisational authority.

86. CONTACT

Mobile application and account enquiries may be directed through BACI's applicable support channel.

Billing: billing@bacihq.com

Privacy: privacy@bacihq.com

Security: security@bacihq.com

ANNEX I — MOBILE RESPONSIBILITY MATRIX

BACI is responsible for the BACI-controlled App and Services as provided by the Agreement; BACI-controlled authentication; BACI security obligations; BACI privacy and data-processing obligations; and supported mobile functionality.

Customer is responsible for Device security; Authorised Users; Device operating-system configuration; permissions granted by Customer; carrier and connectivity charges; Customer-selected third-party applications; organisation authority; and appropriate use of mobile approvals.

App Marketplaces may control distribution, marketplace payment processing, subscription administration, refunds and platform-level functions for Marketplace Purchases.

The Agreement controls where responsibility is expressly allocated differently.

ANNEX II — MOBILE SECURITY BASELINE

Customer should, as appropriate:

1. use a Device passcode; 2. enable secure biometric authentication only for authorised users; 3. keep the operating system current; 4. keep the BACI App current; 5. avoid rooted or jailbroken Devices; 6. protect BACI Account credentials; 7. use enterprise SSO or MDM controls where appropriate; 8. restrict lock-screen notification previews for sensitive environments; 9. report lost or stolen Devices promptly; 10. revoke sessions when a Device changes hands; 11. avoid copying secrets into insecure applications; 12. verify external links before entering credentials; 13. use trusted networks for sensitive activity where practicable; 14. review mobile approval authority; 15. maintain alternative procedures for critical workflows; and 16. contact security@bacihq.com for suspected compromise.

This baseline is risk-based guidance and does not imply that every control is required or technically applicable in every deployment.

ANNEX III — PURCHASE CHANNEL MATRIX

DIRECT BACI PURCHASE — BACI Billing Policy, Refund Policy and Cancellation Policy govern, subject to the Agreement.

APPLE APP STORE PURCHASE — Apple may control payment, subscription administration and marketplace refund mechanisms; applicable Apple usage and minimum EULA requirements also apply.

GOOGLE PLAY PURCHASE — Google Play may control payment, subscription administration, cancellation and marketplace refund mechanisms; applicable Google Play rules also apply.

AUTHORISED RESELLER OR OTHER MARKETPLACE — the applicable provider may control billing administration as stated in the purchase terms.

Installing the App does not create a separate subscription. Uninstalling the App does not cancel a subscription.

ANNEX IV — MOBILE AI & AUTONOMY CONTROL FRAMEWORK

Where AI or Autonomous functionality is available through mobile:

AI Outputs remain subject to proportionate review. • Customer must preserve Authority Boundaries. • Mobile authentication does not create unlimited authority. • High-consequence actions may require heightened or independent approval. • Customer should use step-up authentication where supported and appropriate. • Customer should review notification privacy for sensitive AI results. • Customer should avoid approving consequential actions from incomplete or stale context. • Lost or compromised Devices should trigger rapid session and credential review. • Customer-controlled connected-system permissions should be revoked separately where necessary. • No-General-Model-Training-by-Default protections remain unchanged.

Autonomy does not remove governance.

ANNEX V — APP MARKETPLACE ALLOCATION

For an App distributed through an App Marketplace:

BACI remains responsible for the App and BACI Services under the Agreement.

The App Marketplace is not BACI's contracting party for the underlying BACI enterprise or subscription Service merely because it distributes the App.

Marketplace usage rules may govern installation and permitted Device use.

Marketplace payment rules may govern a Marketplace Purchase.

Marketplace refund and cancellation mechanisms may control where the marketplace is merchant of record or otherwise administers the subscription.

Applicable marketplace minimum EULA requirements and mandatory law are incorporated to the extent required.

No provision in these Mobile Terms is intended to impose obligations on an App Marketplace that the marketplace has not accepted.

BACI MOBILE APPLICATION TERMS — VERSION 1.0 Effective 10 September 2026

We're listening.