Client Confidentiality & AI Data Processing Agreement

Version: 1.2 · Effective Date: 2026-07-27 · Provider: RealValue Group LLC d/b/a RVC Capital

This Client Confidentiality and AI Data Processing Agreement (this “Agreement”) is a legally binding agreement between RealValue Group LLC d/b/a RVC Capital, a Nevada limited liability company, with its principal business address at 360 W 31st St, Floor 6, New York, NY 10001, United States(“Provider,” “we,” “us,” or “our”), and the individual or legal entity that creates, administers, or uses an account for the Platform (“Client,” “you,” or “your”).

This Agreement governs Provider’s confidentiality obligations and its collection, use, disclosure, protection, retention, and deletion of Client Data in connection with the Platform, including its website, applications, APIs, automated workflows, artificial-intelligence functionality, and related services (collectively, the “Platform”).

1. Electronic Acceptance and Authority

By selecting the acceptance checkbox and clicking “Accept Agreement,” “I Agree,” or a substantially similar button, you: (1) acknowledge that you have read and understood this Agreement; (2) agree to be legally bound by this Agreement; (3) consent to enter into this Agreement electronically; (4) acknowledge the External AI Processing Disclosure in Section 8; and (5) represent that you have the legal capacity and authority required to accept this Agreement.

If you access or use the Platform for a company, fund, partnership, family office, investment vehicle, nonprofit organization, governmental body, or other legal entity, you represent that you have authority to bind that entity. In that case, “Client,” “you,” and “your” refer to that entity, and your acceptance binds its Authorized Users. If you do not have such authority or do not agree to this Agreement, you may not access the substantive functionality of the Platform.

2. Scope and Relationship to Other Agreements

This Agreement governs: (1) the confidentiality and restricted use of Client Confidential Information; (2) Provider’s processing of Client Data; (3) Provider’s use of External AI Services and other Subprocessors; (4) Provider’s private de-identification and data-minimization procedures; (5) information security and incident response; and (6) retention and deletion of Client Data.

Your use of the Platform may also be governed by Provider’s Terms of Service, Privacy Policy, subscription or services agreement, order form, Data Processing Addendum, Business Associate Agreement, or another written agreement expressly accepted by Client. If a direct conflict concerns the confidentiality, security, or processing of Client Data, a separately executed Data Processing Addendum or Business Associate Agreement controls within its subject matter; a separately executed enterprise, subscription, or services agreement controls if it expressly supersedes this Agreement; otherwise the provision providing greater protection to Client Confidential Information controls.

The confidentiality obligations in this Agreement are principally unilateral. Provider receives and protects Client Confidential Information. Client does not assume a reciprocal confidentiality obligation under this Agreement merely by accepting it.

3. Definitions

Account Information means information used to create, administer, secure, bill, or support a Platform account. Authorized Usermeans an individual whom Client authorizes to access the Platform through Client’s account. Client Content means documents, files, prompts, messages, financial records, transaction information, spreadsheets, correspondence, and other content submitted through the Platform.

Client Datameans Client Content; Account Information; information from a connected data source; Platform outputs that contain, summarize, reflect, or are derived from Client Content; information about Client’s use of features; and other information processed by Provider specifically for Client. It excludes Provider’s software, system prompts, general architecture, and Aggregated and De-identified Data under Section 11.

Client Confidential Informationmeans all nonpublic Client Data and other nonpublic information disclosed, submitted, observed, obtained, or generated in connection with Client’s account, including identity, ownership, investors and counterparties; financial statements, valuations, investment positions, banking and tax information; potential or actual investments, acquisitions, dispositions, and financings; transaction structures, diligence materials, and term sheets; business plans and strategies; Personal Information and PII; Material Nonpublic Information; and analyses or outputs derived from the foregoing. It need not be marked “confidential” to be protected.

De-identified Processing Datameans Client Data processed through Provider’s Private De-identification System to remove, mask, replace, tokenize, pseudonymize, generalize, bucket, or otherwise minimize identifiers and sensitive values. These controls reduce, but do not eliminate, missed detection, contextual inference, Client or transaction identification, MNPI, trade-secret, or other confidentiality risks.

External AI Providermeans a third-party provider of a commercially available, cloud-hosted large language model or related AI infrastructure. Provider’s current External AI Provider is Google Gemini; changes are disclosed on Provider’s then-current External AI Provider List. External AI Service means such a service used by Provider to process De-identified Processing Data. Material Nonpublic Information or MNPI means material information not made publicly available. Personal Information and PII mean information reasonably usable to identify a natural person. Private De-identification System means the software and workflows Provider operates locally to apply input-appropriate masking, entity replacement, and minimization before transmission to an External AI Service. Security Incident means a confirmed unauthorized acquisition, access, use, loss, alteration, or disclosure of Client Confidential Information. Subprocessor means a third party engaged by Provider to process Client Data, including an External AI Provider.

4. Exclusions

Client Confidential Information does not include information Provider can demonstrate through contemporaneous records was lawfully known without restriction before receipt; becomes public through no breach by Provider; is lawfully received from a third party not under a confidentiality obligation; is independently developed without reference to Client Confidential Information; or is expressly approved for unrestricted disclosure by Client in writing. A compilation is not excluded merely because individual elements are public. Provider bears the burden of establishing an exclusion.

5. Provider’s Confidentiality Obligations

Provider shall:

• use Client Confidential Information only to provide, secure, support, and improve the Platform for Client, perform authorized services, prevent fraud and abuse, comply with law, and exercise or defend legal rights;
• not sell Client Confidential Information;
• not disclose it except as permitted by this Agreement, authorized by Client, or legally required;
• not use it to solicit unrelated business from, or appropriate the opportunities of, Client’s investors, counterparties, or contacts;
• limit access to personnel and service providers with a legitimate need to know;
• protect it with at least reasonable care and appropriate administrative, technical, organizational, and physical safeguards; and
• not use Client’s name, transactions, or activity in marketing without prior written consent.

6. Authorized Processing

Client instructs and authorizes Provider to process Client Data as reasonably necessary to create and administer the account; store, organize, and retrieve Client Content; extract, classify, summarize, translate, analyze, and transform it; generate reports, analyses, and other outputs; execute requested workflows; provide support; maintain reliability and security; detect fraud and abuse; comply with law; and perform other processing clearly disclosed and requested. Provider shall apply reasonable data-minimization principles. Where applicable privacy law treats Client as controller and Provider as processor, Provider processes Personal Information on Client’s documented instructions as reflected in this Agreement.

7. Private De-identification Before External AI Processing

Before transmitting Client Data to an External AI Service, Provider applies locally operated controls appropriate to the input path. Structured questionnaire data is subject to field-level masking, bucketing, and minimization. Uploaded files follow a separate local pipeline using the OpenAI Privacy Filter and GLiNER before the portions reasonably necessary for the requested functionality are transmitted externally. This does not mean every Platform input is processed by GLiNER.

For uploaded-file text, the locally operated OpenAI Privacy Filter is used to identify covered personal information, and GLiNER is configured to recognize and replace commercial entity identifiers including company names, legal entities, counterparties, and acquisition targets. Provider uses commercially reasonable best efforts to mask, replace, tokenize, pseudonymize, generalize, or otherwise minimize identified content and limits external transmission to content reasonably necessary for the requested functionality. Any re-identification mapping remains within Provider’s privately controlled environment.

Provider operates the Private De-identification System with reasonable care and commercially reasonable best efforts. Provider does not warrant that every item of PII or every commercial entity identifier will be detected, that contextual information cannot support inference, that MNPI or trade secrets will always be removed, that De-identified Processing Data satisfies every statutory definition of “anonymous data,” or that re-identification is impossible. These limitations do not relieve Provider of its obligations to maintain, test, and apply the safeguards described here or to respond to a confirmed failure under Section 13.

8. External AI Processing Disclosure and Authorization

The Platform uses External AI Services as an integral part of its functionality. Certain Platform features may not be available unless Client authorizes this processing.

Client understands and agrees that:

• Provider may transmit De-identified Processing Data to the disclosed External AI Provider, currently Google Gemini;
• Provider will first apply the input-specific, locally operated masking, entity-replacement, and data-minimization procedures described in Section 7;
• De-identified Processing Data may still contain confidential financial, commercial, strategic, technical, transaction, or investment information that is not PII;
• removal of PII does not necessarily remove MNPI, Client identity, transaction identity, trade secrets, or all information that could be sensitive to Client;
• after transmission, the External AI Provider’s handling of the data is governed by that provider’s applicable terms and the configuration selected by Provider; and
• Provider does not control the External AI Provider’s infrastructure, personnel, internal practices, future terms, or technical operation.

Client expressly authorizes Provider to use External AI Services to process De-identified Processing Data as reasonably necessary to provide Platform functionality, including summarization, classification, extraction, translation, document comparison, search, reasoning, analysis, report generation, natural-language interaction, and workflow automation. This authorization does not permit Provider knowingly to transmit PII contrary to Section 7 or to use Client Data for unrelated purposes. External AI Provider terms do not relieve Provider of its own obligations under this Agreement.

9. Selection and Configuration of External AI Services

Where commercially reasonable and technically available, Provider shall use APIs, enterprise services, or business accounts rather than public consumer chat interfaces for processing Client Data, and shall select settings under which submitted data is not used to train generally available models by default, disable optional sharing for model improvement, select appropriate retention settings, restrict access, and use available security controls. Provider shall not affirmatively opt in to generalized model training using Client Data without Client’s express consent.

Provider shall maintain a reasonably current list of material External AI Providers at /ai-agreement/full#external-ai-providers, identifying where practicable the provider, service, processing purpose, applicable documentation, and material retention or training settings. Provider may add, replace, or remove providers as the Platform evolves and shall provide reasonable notice of a change that materially reduces disclosed protection. If an External AI Provider materially reduces protection, Provider shall take commercially reasonable steps such as changing configuration, further minimizing information, migrating processing, suspending the feature, or notifying Client.

10. Provider Model Training and Product Improvement

Provider shall not use identifiable Client Content to train a generally available AI model for the benefit of unrelated customers without Client’s express consent. Provider may use Client Data to provide Client-specific retrieval and personalization, test and troubleshoot requested functionality, detect errors and abuse, evaluate performance through access-controlled procedures, and create Aggregated and De-identified Data under Section 11.

11. Aggregated and De-identified Data

Provider may create and use statistics, telemetry, and metrics derived from use of the Platform only where the resulting information does not identify Client or any individual; does not disclose Client’s specific transactions, counterparties, positions, strategies, documents, or financial information; is aggregated or otherwise not reasonably linkable to Client; and is used for legitimate purposes such as security, analytics, reliability, or improvement. Provider shall not publish a benchmark or dataset permitting identification of Client without prior written consent, and shall not attempt re-identification except to test safeguards, investigate a Security Incident, or comply with law.

12. Personnel and Subprocessors

Provider may permit employees, contractors, advisors, affiliates, and Subprocessors to access Client Confidential Information only where they have a legitimate need to know, are informed of its confidential nature, and are subject to appropriate confidentiality obligations. Provider remains responsible for its personnel’s compliance, shall use commercially reasonable care in selecting material Subprocessors, and shall require them to protect Client Data appropriately. A current Subprocessor list is available on request at ziyaojin@realvaluecp.com.

13. Information Security and Incident Response

Provider shall maintain a risk-based written information-security program with reasonable administrative, technical, organizational, and physical safeguards appropriate to the sensitivity of Client Data, addressing as appropriate access controls, authentication, encryption in transit and at rest, secure development, vulnerability management, logging, monitoring, backup and recovery, personnel confidentiality, vendor management, and incident response.

Provider shall notify Client without undue delay after confirming a Security Incident materially affecting Client Confidential Information, including to the extent known the nature of the incident, categories of information affected, approximate period of exposure, remediation measures, and a contact. Notification may be delayed as necessary for law enforcement or to establish whether Client Data was materially affected. If Provider confirms that PII was materially transmitted to an External AI Service contrary to this Agreement, Provider shall investigate, take reasonable steps to stop further transmission, determine affected data and accounts, use available mechanisms to request deletion or restriction, remediate the de-identification process, and notify affected Clients as required.

14. MNPI and Financial Information

Provider acknowledges Client Data may include MNPI and sensitive financial information. Provider shall use such information only to provide the Platform and requested services; restrict access to those with a legitimate need to know; not trade, recommend trading, or cause another to trade based on Client’s MNPI; not knowingly communicate Client’s MNPI except as authorized, required to provide the Platform, or legally required; not use it to compete with Client or benefit another customer; and maintain reasonable policies against misuse. Client acknowledges that masking, entity detection, and minimization may not detect or remove all MNPI, trade secrets, or other confidential information, and is responsible for determining whether submission is consistent with its legal, contractual, fiduciary, and compliance obligations. Provider does not become Client’s broker, adviser, fiduciary, attorney, or other regulated professional solely by entering into this Agreement.

15. Client Responsibilities

Client shall:

• submit only information Client has the right and authority to submit and authorize Provider to process;
• provide legally required notices and obtain required consents from individuals whose Personal Information Client submits;
• assess whether its confidentiality obligations, information barriers, and internal policies permit the contemplated processing;
• use reasonable judgment about the sensitivity and necessity of information submitted;
• not submit passwords, private keys, active tokens, complete payment-card information, unredacted government identification, or other Sensitive Information unless the feature is expressly designed for it;
• maintain the confidentiality of credentials, promptly revoke access for former Authorized Users, and notify Provider of suspected unauthorized use.

Provider may reject, quarantine, redact, restrict, or delete Sensitive Information where reasonably necessary. Client’s responsibilities do not waive Provider’s express obligations.

16. Legally Required and Client-Directed Disclosures

Provider may disclose Client Confidential Information when required by law, subpoena, court order, or other enforceable process and shall, to the extent legally permitted, notify Client before disclosure, provide information sufficient to seek a protective order, cooperate at Client’s expense, disclose only what is required, and request confidential treatment. Provider may also disclose Client Confidential Information to a recipient designated by Client, through a sharing or integration feature activated by Client, to a data source connected by Client, or at the direction of an Authorized User acting within apparent account authority. Client is responsible for reviewing recipients, permissions, and sharing settings before directing disclosure.

17. Ownership

As between Client and Provider, Client retains its rights in Client Content and Client Confidential Information, and grants Provider a limited, nonexclusive right to process Client Data only as necessary to provide and support the Platform, comply with Client’s instructions, and satisfy legal obligations. Provider retains its rights in the Platform and its software, system prompts, models, infrastructure, workflows, general skills and know-how, and Aggregated and De-identified Data created in compliance with Section 11.

18. Retention, Export, and Deletion

During an active subscription, Provider shall make Client Data available through the Platform’s ordinary access and export features. Following termination or expiration, Provider shall retain Client Data for 90 days unless Client requests earlier deletion, a different period is stated in an enterprise agreement, law requires longer retention, the information is needed to resolve a dispute, or immediate deletion is not technically feasible from backups. After the applicable period, Provider shall delete or de-identify Client Data from active systems. Client Data may remain in encrypted or access-restricted backups until overwritten through Provider’s ordinary backup lifecycle. Information transmitted to an External AI Provider is retained and deleted according to that provider’s terms, the configuration selected by Provider, available deletion controls, and applicable law; Provider cannot independently guarantee deletion from an External AI Provider’s systems beyond that provider’s commitments.

19. Confidentiality Period

Provider’s obligations continue while Client maintains an account, while Provider retains the information, and for five years after termination. Notwithstanding that period, trade secrets remain protected as long as they remain trade secrets; Personal Information and PII remain protected as long as required by law or retained; credentials remain protected while capable of enabling unauthorized access; MNPI remains subject to securities laws; and information Provider is contractually or legally required to protect remains protected for the applicable period.

20. Changes to this Agreement

Provider may update this Agreement to address changes in law, Platform functionality, security practices, third-party services, or processing practices, with reasonable notice of material changes. A change that materially reduces contractual protection applies prospectively and shall not retroactively reduce protection for information submitted before the change without Client’s affirmative acceptance, except where reasonably necessary to comply with law or address an urgent security risk. Provider may require Client to affirmatively accept an updated version before continuing to use substantive Platform functionality and shall maintain records of the version accepted.

21. No Guarantee of Absolute Security, De-identification, or External Control

Provider shall perform its obligations using the standards of care stated in this Agreement. However, no internet-connected system can be guaranteed completely secure; no de-identification method can guarantee that re-identification is impossible in every circumstance; AI systems may process information probabilistically; third-party systems may experience errors or changes outside Provider’s control; and Provider cannot warrant protections beyond an External AI Provider’s contractual commitments and selected configuration. These limitations do not waive Provider’s express obligations to use reasonable safeguards, process information privately before external transmission, apply commercially reasonable field-level and uploaded-file safeguards, minimize disclosures, and investigate and remediate confirmed incidents.

22. Remedies and Liability

Provider acknowledges that unauthorized use or disclosure of Client Confidential Information may cause harm for which monetary damages may be inadequate, and, subject to any controlling dispute-resolution provision, Client may seek injunctive or equitable relief for an actual or threatened material breach. Any exclusion or limitation of monetary liability in the Terms of Service or another controlling agreement applies to claims under this Agreement to the extent stated there and permitted by law. Nothing limits liability to the extent such limitation is prohibited by law.

23. Governing Law and Dispute Resolution

This Agreement is governed by the laws of the State of New York, without regard to conflict-of-laws principles. Disputes shall be resolved under the dispute-resolution provisions of the Terms of Service or another controlling agreement. If none exists, the state and federal courts located in New York County, New York shall have exclusive jurisdiction, and each Party consents to personal jurisdiction and venue there.

24. Notices

Provider may deliver notices through the Platform, the administrative email address associated with Client’s account, an account dashboard, or another reasonable electronic method. Client is responsible for maintaining a current administrative email address. Legal notices, privacy inquiries, and security reports to Provider shall be sent to ziyaojin@realvaluecp.com.

25. General Provisions

This Agreement, together with incorporated documents and any applicable separately executed agreement, constitutes the agreement between the Parties concerning confidentiality and AI processing of Client Data. A failure or delay in enforcing a provision does not waive it. If a provision is held invalid, it shall be modified to the minimum extent necessary to make it enforceable and the remainder stays effective. Provider may assign this Agreement to an affiliate or in connection with a merger, acquisition, or transfer of the Platform, provided the assignee assumes Provider’s obligations. This Agreement creates no third-party-beneficiary rights. Provider may maintain electronic records of acceptance (accepting account, version, date and time, acceptance action, and IP address), which may be used to demonstrate acceptance. Provisions that by their nature should survive termination survive according to their terms.

26. Mandatory Acceptance Disclosure

BY SELECTING THE ACCEPTANCE CHECKBOX AND CLICKING “ACCEPT AGREEMENT,” YOU CONFIRM THAT: (1) YOU HAVE READ AND AGREE TO THIS AGREEMENT; (2) YOU UNDERSTAND THAT THE PLATFORM USES THIRD-PARTY AI AND LARGE LANGUAGE MODEL SERVICES AS AN INTEGRAL PART OF ITS FUNCTIONALITY; (3) YOU AUTHORIZE PROVIDER TO TRANSMIT DE-IDENTIFIED PROCESSING DATA TO THE EXTERNAL AI PROVIDERS IDENTIFIED ON PROVIDER’S CURRENT PROVIDER LIST; (4) YOU UNDERSTAND THAT PROVIDER WILL FIRST APPLY STRUCTURED-FIELD MASKING AND MINIMIZATION AND, FOR UPLOADED FILES, A LOCALLY OPERATED OPENAI PRIVACY FILTER AND GLINER ENTITY-REPLACEMENT PIPELINE BEFORE MINIMIZING THE INFORMATION TRANSMITTED; (5) YOU UNDERSTAND THAT THESE CONTROLS MAY MISS IDENTIFIERS OR ALLOW CONTEXTUAL INFERENCE AND THAT PROCESSING DATA MAY STILL CONTAIN CONFIDENTIAL FINANCIAL, COMMERCIAL, STRATEGIC, INVESTMENT, TRANSACTION, TECHNICAL, OR MATERIAL NONPUBLIC INFORMATION; (6) YOU UNDERSTAND THAT AN EXTERNAL AI PROVIDER’S HANDLING OF SUBMITTED INFORMATION IS GOVERNED BY THAT PROVIDER’S APPLICABLE TERMS AND THE CONFIGURATION SELECTED BY PROVIDER; (7) YOU UNDERSTAND THAT NO DE-IDENTIFICATION OR SECURITY PROCESS CAN GUARANTEE THAT RE-IDENTIFICATION, UNAUTHORIZED ACCESS, OR DISCLOSURE IS IMPOSSIBLE IN EVERY CIRCUMSTANCE; AND (8) YOU REPRESENT THAT YOU HAVE AUTHORITY TO ACCEPT THIS AGREEMENT FOR YOURSELF AND, IF APPLICABLE, THE ENTITY ON WHOSE BEHALF YOU USE THE PLATFORM.