STRIXS TERMS OF USE

Last updated: November 5, 2026.

This is an English translation provided for convenience. In case of any divergence, the Portuguese version, Termos de Uso do Strixs, prevails.

1. Who We Are

1.1. STRIXS is a B2B technology integration platform provided by CORA ASSIST LTDA, a private legal entity enrolled in the CNPJ under No. 69.708.277/0001-70, headquartered at Av. Brig. Faria Lima, No. 1811, CXPST 17308, Conj. 115, Jardim Paulistano, São Paulo/SP, CEP 01452-001, Brazil.

1.2. STRIXS offers resources for companies and developers to integrate artificial intelligence agents with digital environments, including for automated browsing of websites, product search, cart building and execution of purchase-related actions, as well as integration with card tokenization solutions and with financial services of institutions participating in Open Finance.

1.3. STRIXS is a technology infrastructure provider. By making these tools available, it is not the Customer's AI agent, the seller of the goods, the merchant or the financial institution providing the regulated activities.

1.4. These Terms exclusively govern the relationship between CORA ASSIST LTDA and the Customers who contract STRIXS for professional or business use. End users of AI agents do not become contracting parties to these Terms merely by using integrated agents.

2. Acceptance and Electronic Contracting

2.1. STRIXS is contracted through the electronic acceptance of these Terms on the platform, subject to the applicable information and commercial conditions.

2.2. When accepting on behalf of a legal entity, the representative declares, under their own responsibility, that they have sufficient powers to bind it, without the need to present supporting documents in advance. The Customer undertakes to provide true and up-to-date registration information, including the information necessary for billing and the issuance of the applicable tax documents.

2.3. The Customer is exclusively responsible for obtaining and keeping the necessary authorizations from end users for its artificial intelligence agents to act, including to make purchases and other requested operations, and is responsible for the legitimacy of the commands transmitted to STRIXS. The authorizations and confirmations required for regulated financial services will follow the procedures of the responsible institutions.

2.4. The Customer may contract additional features or integrations that require specific terms.

2.5. If it does not agree with the Terms, the Customer must not contract or use the platform.

2.6. CORA ASSIST LTDA may request from the Customer additional information and documents necessary to verify its identity, the legitimacy of representation, fraud prevention, Platform security and compliance with legal requirements or requirements of partners responsible for the contracted integrations. The unjustified failure to provide this information may prevent the enabling of features or lead to access restrictions, with adequate justification and notice.

3. Definitions

3.1. STRIXS or Platform: technology integration service operated by CORA ASSIST LTDA.

3.2. Customer: legal entity or professional that contracts STRIXS to use its technology infrastructure to execute commands sent by artificial intelligence agents under its responsibility.

3.3. AI Agent or Integrated Agent: autonomous or semi-autonomous solution made available or operated by the Customer or by a third party authorized by it, which determines the requests and commands transmitted to the Platform.

3.4. End User: individual or legal entity that uses the agent made available by the Customer and authorizes operations requested by that agent.

3.5. Command: instruction sent to STRIXS by the Integrated Agent, within the limits of the contracted integration.

3.6. Card Vault: solution for the encrypted storage of card data.

3.7. Integrations: technology connections with AI agents, websites, merchants, card vault providers, institutions participating in Open Finance and other third parties.

4. Access, License and Integration

4.1. STRIXS grants the Customer non-exclusive, limited access, revocable under these Terms, to the contracted infrastructure and integration interfaces, exclusively for lawful purposes.

4.2. The Customer is responsible for configuring its agents, for enabling the access permissions granted to its representatives and for the security of the credentials and integration mechanisms under its control.

4.3. The Customer is responsible for the integration of its systems and artificial intelligence agents with the STRIXS infrastructure, as well as for the legitimacy of the commands sent to STRIXS.

4.4. STRIXS may restrict features, credentials or integrations in case of misuse, demonstrable security risk or breach of contract, subject to the suspension rules of this instrument.

5. Nature and Features of the Platform

5.1. STRIXS provides infrastructure and technology tools that allow the execution of commands sent by its Customers' artificial intelligence agents, according to the features and integrations available on the platform.

5.2. Making a function or integration available does not mean that STRIXS is a party to a purchase and sale agreement, receives funds in its own name or assumes the position of a regulated participating institution.

5.3. Features will be made available according to the contracted configuration.

6. Artificial Intelligence Agents

6.1. The Customer defines, configures, makes available and supervises the AI Agent that will use the STRIXS infrastructure, and is responsible for its purpose, instructions, decisions, communications and relationship with End Users.

6.2. STRIXS processes integration commands sent by the AI Agent and does not, for that reason, assume authorship of the choices, decision-making or statements made by the agent to the End User.

6.3. The Customer must adopt adequate mechanisms for supervision, prevention of undue instructions, error handling and clear communication about the capabilities and limits of its AI Agent.

6.4. STRIXS is liable for proven failures attributable to its own infrastructure and to the obligations that are actually its own, under these Terms and applicable law.

7. Commands and End User Authorizations

7.1. The Customer, through the AI Agent it operates, is exclusively responsible for obtaining the necessary authorizations from End Users before requesting purchases or other actions on their behalf.

7.2. The Customer must keep the evidence capable of demonstrating the existence, scope and validity of the authorizations obtained from end users, and undertakes to present it to STRIXS at any time, including for the investigation of incidents, analysis of disputes, compliance with legal obligations or the regular exercise of rights.

7.3. STRIXS provides the means for the technological execution of the commands received, without assuming the obligation to collect the End User's acceptance directly for each purchase made by the AI Agent.

7.4. Commercial authorizations granted to AI Agents do not waive the authorizations and procedures that may be required by the responsible financial institutions.

7.5. The use of STRIXS for unlawful purposes is prohibited, including through the Customer's artificial intelligence agents.

7.6. The Customer is responsible for defining and implementing, in its AI Agents, limits and conditions of action compatible with the authorizations granted by End Users, including, where applicable, maximum amounts, transaction frequency, authorized merchants and cases requiring additional confirmation. The use of recurring or automated authorization mechanisms must respect the limits previously set by the End User and the requirements of the service providers involved.

7.7. The Customer must adopt adequate mechanisms to prevent undue commands, malicious instructions, unauthorized changes and duplicate executions of operations, including through authentication, validation and traceability controls. STRIXS may provide additional technical security and duplicate prevention mechanisms, according to the contracted features, without assuming the obligation to fully supervise the AI Agent's decisions.

8. Automated Browsing

8.1. STRIXS may perform technical operations on third-party websites and interfaces based on commands from the AI Agent, including for product search, adding items to carts and continuing purchase journeys.

8.2. The Customer is responsible for using these features in compliance with the law, the rights of third parties and the rules of the digital environments accessed, including legitimate access and use restrictions.

8.3. Prices, stock, shipping, deadlines, payment conditions, cancellation policies and other information about offers are defined and made available by the merchants, not by STRIXS, which merely passes them on.

8.4. The purchase is entered into between the purchasing End User and the selling merchant, according to the conditions of the selling platform. Matters relating to the product, delivery, warranty, exchange, withdrawal, return, refund or after-sales service must be handled directly between buyer and seller, through their respective channels.

8.5. The completion of operations in third-party environments is subject to the rules, procedures and decisions of the respective merchants and service providers, and STRIXS is not liable for their completion or for circumstances attributable to such third parties, except for any failures of its own technology infrastructure.

8.6. The Customer must inform the End User of the identity of the merchant where the purchase will be made and the relevant commercial conditions, according to the experience offered by its AI Agent.

9. Card Vaults, Tokenization and Payment Integrations

9.1. Full card data are stored in encrypted form in Card Vaults, proprietary or of partners, depending on the integration used. STRIXS receives and uses the tokens necessary for the contracted technology operations, without storing full card data.

9.2. The Customer is responsible for ensuring that the AI Agent requests the use of tokens only in the cases authorized by the End User and in compliance with the contractual rules applicable to the integration.

9.3. The End User's authorization for a purchase does not replace authentications, confirmations, restrictions or verifications required by the issuer, acquirer, payment scheme or other provider involved.

10. Financial Services, Means of Payment and Open Finance

10.1. CORA ASSIST LTDA is not a financial institution or a payment institution, does not provide regulated financial services on its own behalf and does not assume the regulatory responsibility attributed to the institutions responsible for providing the financial services made available through STRIXS, as described in this section.

10.2. CORA ASSIST LTDA, through STRIXS, acts as a provider of technology infrastructure and integration, making available interfaces for access to and communication with the services provided by financial institutions, payment institutions and other partners, subject to the responsibilities incumbent upon it for the provision of its own services.

10.3. The financial and payment services made available through STRIXS, including opening and maintaining payment accounts, transaction processing, issuing and managing charges and boletos, paying bills and boletos, transfers, Pix, withdrawals and other movements of funds, are provided by ASAAS GESTÃO FINANCEIRA INSTITUIÇÃO DE PAGAMENTOS S.A. ("ASAAS"), a payment institution authorized to operate by the Central Bank of Brazil, according to the features contracted and enabled.

10.4. The Customer declares that it is aware that the financial and payment relationship and the regulatory responsibility for the services provided by ASAAS rest with that institution, under the regulations in force. The services are subject to the contractual conditions, policies, security procedures and legal and regulatory requirements applicable to ASAAS, including identification and registration verification procedures, prevention of money laundering and terrorist financing, and fraud prevention, without prejudice to the responsibilities of CORA ASSIST LTDA for the STRIXS technology infrastructure.

10.5. STRIXS acts as a technology integrator for access to banking information and payment initiation services within Open Finance, through LINA INSTITUIÇÃO DE PAGAMENTO S.A. ("LINA") and/or other duly authorized participating institutions, according to the contracted integration. The features may use the technology infrastructure and the authorization journey of LINA, in a white-label environment, subject to the responsibilities of each participant.

10.6. The provision of regulated financial activities within Open Finance, including the receipt and transmission of data in the regulated ecosystem and the initiation of transactions, where applicable, is the responsibility of the responsible participating institutions, according to their respective authorizations, obligations and applicable regulations.

10.7. The sharing of financial data, the use of payment services and the initiation of transactions depend on the authorizations, authentications and consents required in the respective journeys, according to the procedures of the responsible institutions and applicable law. These acts are not replaced by the commercial authorization granted by the End User to the AI Agent.

10.8. Contracting STRIXS does not authorize the Customer to offer, sell, sublicense or redistribute to third parties the financial and payment services provided by ASAAS without the necessary authorizations from that institution and from CORA ASSIST LTDA, subject to the conditions of the approved operating model and applicable law.

10.9. The remuneration owed to CORA ASSIST LTDA for the use of STRIXS corresponds to the provision of the contracted infrastructure and technology services and does not constitute a charge, on its own behalf, for the provision of the regulated financial services attributed to the responsible institutions.

10.10. The Customer and the End Users who use the financial and payment services made available through STRIXS must have access to the identification information and service channels of the responsible institutions. For matters related to the financial and payment services provided by ASAAS, the channels made available by that institution may be used, including the e-mail contato@asaas.com.br and the telephone number 0800 009 0037, subject to the service options available.

11. Customer Obligations

11.1. The Customer undertakes to: (i) use the Platform lawfully; (ii) integrate and supervise its AI Agents; (iii) obtain End User authorizations and keep evidence of them; (iv) comply with information and data protection duties; (v) respect the rules of the websites accessed; and (vi) not transmit fraudulent, abusive commands or commands incompatible with the contracted purpose.

11.2. The Customer must have the legal bases necessary for processing and sharing personal data of End Users and of third parties related to the operations it carries out, as well as provide the relevant privacy notices.

11.3. It is prohibited to use STRIXS for fraud, unlawful activity, violation of third-party rights, circumvention of security systems, undue access, exploitation of vulnerabilities or any purpose prohibited by law.

11.4. The Customer is responsible for its representatives, employees, contractors and integrated agents and must cooperate in investigating complaints related to commands transmitted by its agents.

11.5. The Customer may not attribute to STRIXS, before the End User or third parties, commercial, financial or customer service obligations that have not been expressly assumed by STRIXS.

11.6. The Customer is prohibited from using the Platform to carry out cyberattacks, distribute malicious code, exploit vulnerabilities, impersonate identities, circumvent authentication controls, carry out fraudulent operations or make automated calls in breach of the technical limits and conditions of use published by STRIXS. Non-compliance may lead to the restriction or suspension of the affected features, subject to the provisions of these Terms.

12. Data Protection

12.1. Personal data will be processed in accordance with applicable law, including Law No. 13,709/2018 (LGPD), STRIXS's own privacy documents and the instruments applicable to the contracted integrations.

12.2. The Customer is the controller of the personal data of End Users processed through the Platform, as it determines the purposes and essential means of such processing. CORA ASSIST LTDA acts as processor with respect to such data and processes it only in accordance with the Customer's lawful instructions and these Terms, under art. 39 of the LGPD. The Customer authorizes CORA ASSIST LTDA to engage the sub-processors necessary to perform the services, provided that they are subject to adequate confidentiality and data protection obligations, in accordance with applicable law.

12.3. CORA ASSIST LTDA is the controller of the data necessary for managing the contractual relationship, billing, customer service, security, fraud prevention and compliance with its legal obligations, including the operation records described in the STRIXS Privacy Policy.

12.4. STRIXS will not use personal data of End Users or Customers to train artificial intelligence models or for its own behavioral advertising purposes. For product improvement, it may use exclusively effectively anonymized data that do not allow the identification of data subjects by reasonably available means.

12.5. The Customer is responsible for informing data subjects of the processing of their data and for enabling, within the limits of its role, the exercise of the rights provided for in the LGPD. The parties must cooperate in proportion to their duties.

12.6. The retention and deletion of personal data will comply with applicable law and the STRIXS Privacy Policy, respecting the responsibilities of each party. Upon termination of the contract, CORA ASSIST LTDA will delete the personal data of End Users processed as processor, except for data whose retention is required by law or necessary for fraud prevention or the regular exercise of rights.

12.7. ASAAS is the controller of the personal data it processes to provide the financial and payment services, under its privacy policy.

12.8. LINA and the other institutions participating in Open Finance are the controllers of the personal data they process to provide their services, under their respective privacy policies. The Open Finance features made available through STRIXS use the technology infrastructure and the authorization journey of LINA, in a white-label environment, subject to the responsibilities of each participant in processing and sharing the data, in accordance with applicable law and the relevant instruments.

12.9. The personal data necessary for the financial integrations may be shared among CORA ASSIST LTDA, ASAAS, LINA and other providers involved, exclusively to the extent necessary to perform the contracted features, to comply with legal and regulatory obligations and for the other legitimate purposes described in the STRIXS Privacy Policy. The responsibilities of each participant for the processing will reflect the activities actually performed and applicable law.

12.10. In the event of international transfer of personal data, arts. 33 to 36 of the LGPD will be observed.

12.11. Privacy contact: privacidade@strixs.ai.

13. Confidentiality and Security

13.1. Each party must protect the confidential information of the other party and of End Users to which it has access by reason of the integration, using it only for contractually authorized or legally required purposes.

13.2. STRIXS will adopt measures proportionate to the risks of the activities under its responsibility, without prejudice to the specific obligations assigned to partners.

13.3. The Customer must protect the credentials and environments under its control, implement adequate measures in its AI Agents and prevent bank passwords, full card data or sensitive credentials from being sent to channels not intended to receive them.

13.4. The duty of confidentiality does not cover information that becomes public without breach of contract, that is demonstrably and legitimately known by the receiving party or whose disclosure is required by law or by order of a competent authority, to the extent necessary.

13.5. Confidentiality will remain enforceable after termination for as long as the confidential nature of the information or the relevant legal obligation persists.

13.6. The parties must notify each other, without undue delay, of security incidents they become aware of that may affect personal data, credentials, integrations or information related to the performance of the services, providing, to the extent of their responsibilities and the information available, the elements necessary for investigation, damage mitigation and compliance with legal obligations. Notification will not imply automatic acknowledgment of liability.

14. Remuneration and Commercial Conditions

14.1. The use of the STRIXS infrastructure will be remunerated according to the consumption units, prices and other conditions set out in the commercial table presented to the Customer and accepted at the time of contracting.

14.2. The prices in the commercial table do not include the taxes levied on the provision of the services, which will be added to the amounts owed by the Customer, when applicable and actually due, in accordance with current law.

14.3. STRIXS may revise prices and billing criteria by notifying the Customer at least 30 (thirty) days before the changes take effect, except for changes resulting from legal, tax or regulatory requirements that demand a shorter period. If it does not agree with changes that increase its remuneration, the Customer may terminate the contract before the new amounts take effect, without a termination penalty, remaining liable for the amounts owed until actual termination.

14.4. Default may lead to collection measures, restriction or suspension of access, with adequate notice and in accordance with applicable law.

15. Relationship with Third Parties and Merchants

15.1. Websites, merchants, partners, payment providers, financial institutions and other third parties maintain their own contractual relationships, policies and responsibilities for the services they actually provide.

15.2. STRIXS does not determine the offers, stock, return or delivery policies of merchants, nor is it, by its mere role as integration infrastructure, part of the purchase and sale agreement entered into between buyer and merchant.

15.3. Complaints regarding product quality, fulfillment of the offer, delivery, exchange, return, withdrawal and refund must be sent by the buyer to the selling merchant, through the merchant's channels and platform, in accordance with applicable law.

15.4. The Customer is liable for its relationship with the End User and for the information and decisions of the AI Agent it operates; STRIXS is liable for fulfilling the obligations it has assumed and for failures attributable to its own infrastructure.

16. Liability and Allocation of Risks

16.1. STRIXS does not assume responsibility for obtaining commercial purchase authorizations by the AI Agent, for the choice of products or merchants, for the content of offers, for the conduct of the selling merchant or for the provision of regulated financial activities assigned to participating institutions.

16.2. The Customer will be liable for damages caused by undue commands, lack or insufficiency of End User authorization, failures attributable to the agents it operates and breach of its legal or contractual obligations.

16.3. The Platform will be made available according to the contracted technical and commercial conditions, subject to maintenance, updates, operational limitations and dependencies on third-party systems. Except for the warranties expressly assumed and applicable legal obligations, making the services available does not imply a guarantee of uninterrupted availability, universal compatibility with third-party environments or successful completion of every requested operation.

16.4. To the fullest extent permitted by applicable law, CORA ASSIST LTDA will not be liable for loss of profits, loss of business opportunities, loss of expected revenue or other indirect damages arising from the use of the Platform, except where such exclusion is prohibited by law.

16.5. Except in cases of willful misconduct, gross negligence and other situations in which limitation is prohibited by law, the total civil liability of CORA ASSIST LTDA for damages arising from a given event or set of related events will be limited to the total amount actually paid by the Customer to STRIXS in the 12 (twelve) months immediately preceding the triggering event, subject to any minimum liability amount expressly set out in the applicable commercial conditions.

16.6. The Customer must reimburse CORA ASSIST LTDA for the direct losses demonstrably incurred, including reasonable defense costs, arising from third-party claims caused by unauthorized commands, misuse of the Platform, violation of third-party rights or breach of legal and contractual obligations attributable to the Customer or to the AI Agents under its responsibility. The obligation will be proportional to the Customer's contribution to the event and will not cover losses arising from a failure or conduct attributable to CORA ASSIST LTDA itself.

17. Intellectual Property

17.1. STRIXS and its components, interfaces, documentation, trademarks, code and other technology assets remain the property of CORA ASSIST LTDA or their legitimate owners.

17.2. The Customer receives a restricted license to use the contracted infrastructure and is not authorized to copy, sublicense, exploit, distribute, disassemble or reverse engineer the protected elements, except in cases permitted by law or with express consent.

17.3. The Customer remains the owner of the rights it holds over its AI Agent, its applications, trademarks and content, and the integration does not imply the assignment of these assets to STRIXS.

17.4. The Customer authorizes CORA ASSIST LTDA to process, transmit, store and technically use the commands, content and information made available through the Platform, exclusively to the extent necessary to provide the contracted services, for operational security, for the regular exercise of rights and for compliance with legal obligations, subject to the provisions of these Terms and the STRIXS Privacy Policy. This authorization does not imply a transfer of ownership of the Customer's content or intellectual property rights.

17.5. The Customer authorizes CORA ASSIST LTDA, free of charge and on a non-exclusive basis, to use its corporate name, trade name, trademarks and logos in STRIXS institutional, commercial and advertising materials, including websites, social networks, sales presentations, proposals and promotional campaigns, for the purpose of identifying and publicizing the commercial relationship between the parties, without the need for additional authorization for each use.

17.5.1. The authorization provided for in this clause does not imply a transfer of ownership of the Customer's intellectual property rights, and CORA ASSIST LTDA must respect its visual identity and refrain from using its distinctive signs in a way that suggests unauthorized sponsorship or endorsement.

17.5.2. The disclosure of case studies, testimonials, commercial results or confidential information of the Customer will depend on prior and express authorization.

18. Suspension, Termination and Closure

18.1. The Customer may request the termination of the contract through the mechanisms of the Platform, subject to the accepted commercial conditions, pending obligations and applicable legal deadlines.

18.2. STRIXS may suspend or restrict access in the event of a material breach of the Terms, well-founded suspicion of fraud, unlawful use, concrete security risk or an order from a competent authority, giving adequate notice whenever compatible with the urgency of the measure.

18.3. In the case of a curable breach, a reasonable period for correction may be granted, at the reasoned discretion of STRIXS and according to the seriousness of the case.

18.4. Termination does not prejudice the collection of amounts owed for prior consumption or the obligations that, by their nature or by legal requirement, must survive.

19. Changes to the Terms and General Provisions

19.1. These Terms may be modified to reflect legal, technological, operational or commercial changes.

19.2. These Terms are governed by the laws of the Federative Republic of Brazil. For disputes arising from a business relationship involving disposable rights, the courts of the Judicial District of São Paulo/SP are chosen, except in cases of mandatory legal jurisdiction.

19.3. The invalidity of one provision does not affect the others, to the extent permitted by law. Tolerance of a breach does not constitute a waiver, novation or contractual amendment.

19.4. The Customer may not transfer its contractual position without the prior authorization of STRIXS. CORA ASSIST LTDA may reorganize rights and obligations in legally permitted corporate transactions, respecting the relevant information and data protection obligations.

19.5. These Terms, together with the accepted commercial conditions and any specific instruments entered into, make up the B2B contracting of STRIXS. In the event of conflict, the specific provisions expressly applicable to the respective service will prevail.

19.6. The parties will make efforts to amicably settle any disputes arising from these Terms, by written notice and with a period of up to 30 (thirty) days for negotiation, without prejudice to the immediate adoption of urgent judicial measures or measures necessary to preserve rights. If a consensual solution is not reached, the jurisdiction set out in clause 19.2 will remain applicable.

20. Contact

20.1. Contractual and commercial questions: contato@strixs.ai.

20.2. Privacy and data protection matters: privacidade@strixs.ai.