Communications Compliance Addendum

This Communications Compliance Addendum ("Addendum") supplements the Terms of Service between Orion AI Solutions Inc., a Delaware corporation located at 2810 N Church St #607813, Wilmington, DE 19802 ("Orion"), and Customer. Capitalized terms have the meanings in the Terms.

1. Customer controls Communications

Customer creates, selects, controls, and initiates each Communication and is responsible as the applicable seller, telemarketer, caller, texter, sender, advertiser, and initiator. Orion provides configurable software and transmission access. Orion does not choose recipients, determine consent, supply Customer's legal advice, or certify compliance.

Customer is responsible for Communications by its owners, employees, agents, contractors, customers, subaccounts, invitees, white-label users, and configured AI agents.

2. Laws and rules

Customer will comply with all laws and rules applicable to each Communication, including the Telephone Consumer Protection Act and FCC rules, Telemarketing Sales Rule and FTC Act, CAN-SPAM Act, state telemarketing and mini-TCPA laws, state and federal do-not-call requirements, call-abandonment, caller-identification, calling-time, call-recording, and wiretap laws, privacy and consumer-protection laws, insurance licensing and advertising rules, sanctions rules, carrier policies, CTIA guidance, and A2P 10DLC or other registration requirements.

For Communications involving recipients or activities outside the United States, Customer will also comply with applicable non-U.S. direct-marketing, anti-spam, telemarketing, privacy, and electronic-communications requirements, including Canada's Anti-Spam Legislation, the EU General Data Protection Regulation and ePrivacy rules, and comparable national laws where they apply.

The list is not exhaustive. Customer must determine which requirements apply to its facts and jurisdictions.

3. Continuing pre-send warranty

Immediately before every Communication, Customer represents and warrants that:

• it owns or has lawful rights to use the lead and contact data;
• the intended recipient and telephone number or address are eligible for the Communication;
• the named seller, brand, product, channel, purpose, technology, frequency, and content are within the scope of legally sufficient consent or another lawful basis;
• required consent has not been revoked, no applicable do-not-contact or suppression request applies, and Customer has addressed reassignment, wrong-number, and dispute information;
• every required federal, state, professional, seller, telemarketer, caller-ID, carrier, campaign, DNC subscription, license, registration, and bond is current;
• caller ID, sender identity, routing, and domain information are accurate, authorized, and not misleading;
• scripts, prompts, offers, claims, disclosures, recording practices, and AI or artificial-voice use are lawful;
• the Communication will occur at a lawful time and, for automated Orion marketing calls or texts, only between 9:00 a.m. and 8:00 p.m. at the lead's local time unless Orion has expressly classified a lawful exception; and
• Customer's Orion settings accurately reflect these facts.

These warranties are repeated at each attempt. Customer must not rely on a prior warranty when facts change.

4. Consent and evidence

Where consent is required, Customer will obtain it directly or through a source whose proof Customer has reviewed and can lawfully rely on. The consent request must be clear and conspicuous and must identify the consumer and destination, the seller or brand, the channels and purposes, the relevant technology, the authorization requested, and every disclosure required for that activity. Where prior express written consent is required for telemarketing using an automatic telephone dialing system or an artificial or prerecorded voice, the agreement must identify the authorized telephone number, bear a valid written, electronic, or digital signature, clearly authorize the covered telemarketing, and state that consent is not required, directly or indirectly, as a condition of purchasing property, goods, or services.

Customer will preserve, as applicable:

• consumer name and called or texted number;
• seller and brand authorized;
• channels, purpose, product, and technology authorized;
• exact disclosure, form, script, prompt, and version shown;
• affirmative action, signature, recording, or other authorization;
• date, time, source URL or location, IP/device evidence when collected, and source vendor;
• lead certificate, ping-post, transfer, and chain-of-custody records;
• revocation, do-not-contact, reassignment, wrong-number, dispute, and suppression events;
• scripts, prompts, artificial or prerecorded messages, call-detail records, message records, caller ID, and proof of authority to use it;
• DNC registry access and the service providers used, where applicable.

Where the Telemarketing Sales Rule applies or Customer relies on an exception or safe harbor under it, Customer will also preserve complete and accurate records of:

• each substantially different advertisement, brochure, telemarketing script, and promotional material and each unique prerecorded message;
• the telemarketer, seller or other person for whom each call was placed or received, the good, service, or charitable purpose involved, whether the recipient was an individual or business, and whether the call was inbound, outbound, or used a prerecorded message;
• the calling number, called number, date, time, and duration, using the applicable NANP or E.164 telephone-number format, Coordinated Universal Time, and closest-second precision where required;
• each script or prerecorded message used, the caller-ID number and name transmitted, the contract or other proof authorizing its use, and the authorization period;
• the call disposition, including whether it was answered, connected, dropped, or transferred and, for a transfer, the destination telephone number or IP address and receiving company;
• required customer and purchase details; prize-recipient details; established-business-relationship and previous-donor records when asserted; and the required identity, fictitious-name, contact, and job-title records for personnel directly involved in telephone sales or solicitations;
• the contract, signature date, and effective period for each service provider used to deliver outbound calls; and
• each entity-specific do-not-call request, including the consumer, number, seller or organization, telemarketer, request date, and offered good, service, or charitable purpose, and each National Do Not Call Registry version used, including the accessing entity, access date, subscription account, and campaign.

Customer will retain each required record for the period and from the trigger required by applicable law. Where the Telemarketing Sales Rule applies, this generally means five years from the date a record is produced, except that substantially different scripts, promotional materials, and unique prerecorded messages are kept for five years after they are no longer used, and service-provider contracts are kept for five years after expiration. A longer period applies when required by another law, contract, claim, investigation, or legal hold. Customer will not delete or alter relevant evidence after notice of a complaint or dispute.

As between Orion and Customer, Customer bears the recordkeeping duties for its Communications and must retain access to records created by its personnel, lead vendors, telemarketers, service providers, and Downstream Users. This allocation does not determine whether law independently assigns duties or liability to another person.

Orion's receipt of a file, field, certificate, or acknowledgment does not validate the legal sufficiency of consent. For SMS or other activity where Orion does not require an upload, Customer still gives this continuing warranty and proof-on-request commitment.

5. Lead sources

Customer will perform documented diligence on lead vendors and sources. For each material lead supplier, Customer will maintain a written agreement requiring lawful acquisition and seller-specific use rights, preservation and prompt production of consent and provenance records, cooperation with audits and disputes, and commercially reasonable warranties, indemnity, refund, replacement, or other recourse for invalid or unverifiable data. Customer will not use scraped, harvested, fabricated, recycled, shared, resold, transferred, aged, or purchased contact data unless Customer has verified that acquisition and intended use are lawful and that consent or another lawful basis extends to the specific seller, channel, purpose, technology, and time of contact.

Customer will not alter source data, manufacture consent, conceal a lead vendor, or treat a generic consent to "marketing partners" as seller-specific permission unless counsel has determined it is legally sufficient for the intended use. Missing, incomplete, inconsistent, or disputed proof must be quarantined.

6. Do-not-contact, revocation, and reassignment

Customer will maintain written do-not-contact procedures, train relevant personnel, subscribe to and scrub applicable federal and state registries, maintain an entity-specific suppression list, and honor applicable company, platform, carrier, and consumer restrictions.

Customer will recognize every legally reasonable revocation method, including words or conduct a reasonable person would understand as a request to stop. Customer will promptly record and propagate the request across controlled systems and campaigns to the extent required by law. Customer may send only a non-promotional confirmation where lawful and may not circumvent a request by changing numbers, accounts, campaigns, channels, brands, or users.

Customer will use commercially reasonable reassigned-number and wrong-number controls appropriate to its campaigns and stop after learning that consent does not belong to the current subscriber.

7. Voice, AI, prerecorded messages, and recording

Customer acknowledges that AI-generated or simulated voices may be regulated as artificial or prerecorded voices. Before use, Customer will obtain the level of consent required for the call, provide required seller and caller identification, provide required automated opt-out methods, and make every required artificial-intelligence, recording, monitoring, or solicitation disclosure.

Customer will determine and comply with every applicable one-party or all-party recording-consent law. Customer may not clone, imitate, or use a person's voice or likeness without all necessary rights and disclosures, or use AI to deceive a recipient about who is speaking.

Customer will not abandon an outbound telephone call where prohibited. If Customer relies on the Telemarketing Sales Rule's abandoned-call safe harbor, Customer will configure, monitor, and document each campaign so that: no more than the legally permitted percentage of live-answered calls is abandoned over the required measurement period; an unanswered call rings for at least the required duration or number of rings; a live representative is connected within the required time after the completed greeting or the recipient promptly receives only the permitted recorded identification message; and complete records establish compliance. Under the current federal safe harbor, those conditions generally include no more than three percent abandonment measured over a campaign shorter than thirty days or each successive thirty-day campaign period, at least fifteen seconds or four rings, connection within two seconds, and a recorded message stating the seller's name and telephone number without a sales pitch and making any additional identification required by applicable law. Customer must follow any stricter or later-applicable federal, state, or international rule.

8. SMS, MMS, RCS, and voicemail

Customer will register campaigns and senders where required; use accurate campaign, brand, and use-case information; honor opt-outs and carrier keywords; include required sender identification and instructions; and avoid prohibited content, evasion, snowshoeing, traffic pumping, misleading links, and list sharing.

Customer will not send a marketing message merely because the platform permits it or because a recipient previously engaged on another channel. Ringless voicemail and similar delivery methods are Communications under this Addendum and require separate legal review.

9. Email

Customer will use accurate header and routing information, non-deceptive subjects, required advertising identification, a valid postal address, and a clear functioning opt-out for commercial email. Customer will honor opt-outs within the legally required period, maintain the opt-out mechanism for the required period, and monitor vendors and Downstream Users sending on its behalf.

10. Compliance controls

Orion's proof fields, upload workflow, suppression checks, calling-hour controls, templates, carrier registration support, keyword handling, and monitoring are aids only. Customer must not disable, evade, reverse, or work around controls. A platform pass means only that the implemented control did not block the attempt; it is not a legal determination.

11. Proof requests and complaints

Customer will notify legal@orionaisolutions.ai within twenty-four hours of a carrier complaint, regulator inquiry, subpoena, demand letter, threatened claim, do-not-contact complaint, consent dispute, or material failure involving the Services. Customer will provide urgent records within one business day and other requested records within three business days.

Customer will cooperate, preserve evidence, identify responsible users and vendors, and refrain from admissions or settlements affecting Orion without Orion's written consent.

12. Suspension and remediation

Orion may immediately block, quarantine, preserve, suspend, or terminate affected leads, campaigns, numbers, channels, features, users, or accounts when Orion reasonably suspects noncompliance, fraud, missing proof, disputed consent, provider risk, or harm. Orion may require retraining, source removal, script changes, re-registration, proof remediation, or an independent compliance review before reinstatement.

13. Downstream terms

Customer must bind all Downstream Users by written duties no less protective than this Addendum and the Agreement, including communications, privacy, acceptable-use, audit, suspension, evidence-preservation, indemnification, defense, reimbursement, and cooperation duties. Those terms must prohibit credential sharing, require individual authorized access, permit prompt access termination, and identify Orion and the persons protected by the Agreement as intended third-party beneficiaries entitled to enforce the protective provisions directly to the extent permitted by law. Customer will monitor Downstream Users and terminate access when compliance cannot be established. Customer remains responsible for them. A self-billed subscriber's authority and liability are limited to that subscriber's account and use; a centrally billed enterprise user does not bind the enterprise merely by acknowledging personal responsibilities.

14. Indemnity and precedence

Claims arising from Communications are covered by the indemnification, defense, reimbursement, settlement, and survival provisions in the Terms. This Addendum controls over the Terms only for Communications compliance; an Order cannot waive legal compliance unless it expressly identifies a permitted contractual allocation and is signed by Orion.

Questions and legal notices regarding this Addendum must be sent to legal@orionaisolutions.ai or Orion AI Solutions Inc., 2810 N Church St #607813, Wilmington, DE 19802. Delaware law governs as stated in the Terms.