End User License Agreement (EULA) v1.1

Effective Date: 17 March 2026

Vellum ESG Pty Ltd (ABN [54 649 878 080]) — vellum.com.au

This End User License Agreement (“Agreement”) sets out the legally binding terms and conditions under which you (“you” or “User”) may access and use the VellumESG platform and associated services (collectively, “Services”), provided by Vellum ESG Pty Ltd (“Vellum,” “Company,” “we,” “us,” or “our”), located at Level 36, 1 Macquarie Place, Sydney NSW 2000, Australia.

The Services include the ESG Ranking Engine, AI-Powered Pre-population (RAG pipeline), Report Generation (PDF/HTML with rich-text editor), Community Portal, Impact Valuation tools, and all related features.

By checking the box and clicking “I Agree and Continue” during onboarding, or by accessing or continuing to use the Services, you agree to be bound by this Agreement and our Privacy Policy (available at vellum.com.au/privacy). If you do not agree, you must not use the Services.

If you are using the Services on behalf of an organisation, you represent and warrant that you have the authority to bind that organisation to this Agreement, and “you” and “your” include both you and the organisation.

Agreement – This End User License Agreement, as amended from time to time.

Services – The VellumESG platform, including the ESG Ranking Engine, AI-Powered Pre-population (AI pipeline using Gemini 2.5 Flash Lite), Report Generation, Community Portal, Impact Valuation, and all related tools.

User / you / your – Any individual or entity accessing or using the Services.

Data Owner – The individual designated by your organisation who controls data visibility and permissions in reports.

Viewers – Internal employees or external parties granted access to reports by the Data Owner.

Seat – A licensed user slot under the per-seat subscription model (ESG or Impact).

By completing the clickwrap acceptance during onboarding (checkbox + “I Agree and Continue”), you confirm you have read, understood, and agree to this Agreement and the Privacy Policy. This acceptance is logged with your user ID, timestamp, IP address, and document version for traceability and audit purposes. Continued use after any update also constitutes acceptance.

You must be at least 18 years of age (or have parental/guardian consent if younger under applicable law). If acting on behalf of an organisation, you represent that the organisation has authorised your use and accepts full responsibility for compliance.

Subject to payment of applicable fees and your compliance with this Agreement, Vellum grants you a limited, non-exclusive, non-transferable, revocable licence to access and use the Services solely for your internal business ESG and impact reporting purposes. You may not sublicense, assign, or transfer the licence.

Access is provided exclusively on a per-seat subscription basis:

ESG Software Plan seat: A$380 per year (unlimited self-service ESG ranking, pre-population, and reporting for one assigned user).

Impact Software Plan seat: A$830 per year (unlimited self-service Impact Valuation and reporting for one assigned user).

You manage seats (assign, unassign, view status and expiry) through the Subscription Management dashboard. Only active and assigned seats are billed. Additional seats require a plan upgrade. Fees are in AUD, exclusive of GST, payable in advance. We will provide at least 30 days’ notice of any fee changes. Payments are non-refundable except as required by Australian Consumer Law. Non-payment may result in immediate suspension or termination of seats.

ESG Ranking Engine: Questionnaire-based evaluations with automated KPI calculation, normalised scoring, and peer benchmarking.

AI-Powered Pre-population: AI pipeline that ingests company documents, performs hybrid retrieval, and uses Gemini 2.5 Flash Lite or later to pre-fill responses.

Report Generation: Automated PDF and HTML reports with a rich-text editor for customisation.

Community Portal: Public-facing platform for publishing ESG reports and impact stories.

Impact Valuation: SDG-aligned impact measurement and reporting (consolidated into the core backend).

The designated Data Owner within your organisation is solely responsible for managing data visibility in reports. Viewers receive access only as granted by the Data Owner and must comply with all privacy obligations.

“User Content” means any content, data, or information you submit, store, or generate through the Services (including uploaded documents, ESG responses, and reports). You retain ownership of your User Content. By submitting it, you grant Vellum a worldwide, non-exclusive, royalty-free licence to use, copy, modify, store, and analyse it solely to provide, improve, and operate the Services (including AI processing and report generation). All User Content must be accurate, verifiable, and comply with applicable laws.

User Responsibilities

You agree to:

Use the Services only for lawful internal business purposes and in compliance with all applicable laws (including the Corporations Act 2001 (Cth) and Australian Privacy Principles).

Provide accurate, complete and up-to-date account and company information and promptly notify us of any changes.

Maintain the confidentiality of your login credentials and immediately report any unauthorised access.

Assign and manage seats correctly via the Subscription Management dashboard. Only designated users may access the corresponding features.

Designate and manage a “Data Owner” who controls data visibility and ensures privacy compliance for Viewers.

Use signed URLs provided by the backend for accessing private GCS documents and reports — you must not share, modify or distribute these URLs.

Monitor and supervise use of the AI-Powered Pre-population and ensure all outputs are reviewed by qualified personnel before any external use.

Follow the report workflow states (Processing → Edit → Validate → Review → Publish) and only publish final reports through authorised Community Portal channels.

Prohibited Conduct

You must not:

Attempt to reverse-engineer, decompile, disassemble or derive the source code, algorithms or embeddings of any Service, including the AI pipeline or KPI engine.

Bypass, circumvent or disable any security measure.

Access or attempt to access data belonging to another tenant.

Use automated scripts, bots or any means other than the official interface to access the Services.

Upload content that infringes third-party rights or contains malicious code.

Publish false, misleading or defamatory information via the Community Portal.

Use the Services for resale, redistribution or any purpose outside your internal ESG and impact obligations.

Trade, transfer or assign seats without our prior written consent.

Interfere with or overload any Cloud Run service, Firestore, or RAG pipeline.

Any breach may result in immediate suspension or termination.

(See Section 5 above for full per-seat details.)

Vellum (or its licensors) owns all right, title and interest in the Services, including software, databases, vector embeddings, and technology. You retain ownership of your uploaded documents and generated reports. Aggregated anonymised data may be used for benchmarking and insights. You may not remove proprietary notices.

The Services are provided “as is” and “as available” without any warranties. AI outputs (RAG pre-population, ESG scores, Impact Valuation) are assistive only and do not constitute professional, financial, legal or assurance advice. The Services assist with preparation of reports (including mandatory climate disclosures under the Corporations Act and AASB S2) but we do not guarantee accuracy, completeness or regulatory compliance. You remain solely responsible for all verification and filings. Nothing excludes non-excludable consumer rights under Australian Consumer Law.

To the maximum extent permitted by law, our total aggregate liability is limited to the total fees you paid us in the twelve (12) months immediately preceding the claim. We are not liable for indirect, consequential or punitive damages, or for any reliance on AI outputs, ESG/Impact scores, or mandatory filings.

You agree to indemnify Vellum against any claims, losses, or costs arising from your breach of this Agreement, misuse of the Services, or infringement related to your content.

Neither party shall be liable for any failure or delay in performance under this Agreement where such failure or delay results from circumstances beyond its reasonable control (including acts of God, natural disasters, pandemics, governmental actions, or regulatory changes).

We may suspend or terminate access immediately for breach, non-payment, or legal reasons. You may terminate by contacting support (effective at the end of the current billing period). Upon termination, all seats are revoked, access ceases, and you must delete any locally stored signed URLs or reports.

Any notice required under this Agreement shall be in writing and deemed effectively given (i) upon personal delivery, (ii) when sent by confirmed email during normal business hours (or the next business day if sent outside), or (iii) when sent by registered post. Notices to us shall be sent to Level 36, 1 Macquarie Place, Sydney NSW 2000 or the support email listed below.

You may not transfer or assign this Agreement or any rights hereunder without our prior written consent. We may assign this Agreement without restriction. Any attempted assignment in violation of this section is void.

This Agreement is governed by the laws of New South Wales, Australia. Disputes shall first be resolved informally. Unresolved disputes will be submitted to binding arbitration under the ACICA Arbitration Rules in Sydney, conducted in English. We may seek urgent injunctive relief in any competent court.

We may update this Agreement. Material changes will be notified via the Services or email. Continued use constitutes acceptance.

If any provision is invalid, the remainder remains in effect. This Agreement (together with the Privacy Policy) constitutes the entire understanding between you and Vellum and supersedes all prior agreements.

The provisions of this Agreement which by their nature should survive termination (including IP, liability, indemnity, governing law, and confidentiality) shall remain in effect after termination.

Vellum ESG Pty Ltd

Level 36, 1 Macquarie Place, Sydney NSW 2000, Australia

Email: hello@vellum.com.au