Legal

Version 2026-08-08 · Effective 8 August 2026

Terms of Service

These terms govern your use of the service operated by Exon Biosciences (“we”, “us”). By creating an account you agree to them. If you are agreeing on behalf of an organisation, you confirm you are authorised to bind that organisation.

The service

We provide a semantic layer that connects to data sources you authorise, maps them to a shared schema, and makes the result queryable through dashboards, BI tools and automated agents. You keep ownership of your data and of the credentials you supply.

Your responsibilities

You are responsible for having the right to connect the data sources you connect, for the accuracy of that data, and for keeping your account credentials secure. You must not use the service to process data you are not permitted to process, or to attempt to access another customer’s data.

Billing

Seats are billed per user per month or year. Data connections beyond those included in your plan, AI assistant access, and data-migration runs are billed as separate metered add-ons at the prices shown at purchase. Trials run for 7 days; you are not charged until the trial ends. Payment is handled by an external payment processor — we never see or store your card details. You can cancel at any time; cancellation takes effect at the end of the current term.

Best efforts, and your responsibility to verify

We provide the service on a best-efforts basis. The service maps and aggregates your data using an automated system, and automated mappings, translations, aggregations and query results can be wrong. Confidence scores and review queues are provided so that mappings can be checked before they are relied on.

You decide whether the service meets your needs. You are solely responsible for determining whether the service is suitable for your purposes, for verifying any output before acting on it, and for any decision you or anyone else takes on the basis of that output. We do not know your business, your obligations or the consequences of a given number being wrong; you do. Do not use an unverified output for a decision with material financial, legal, regulatory, clinical or safety consequences.

No warranties

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY. To the fullest extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade.

We do not warrant that the service will be uninterrupted, timely, secure or error-free; that any output will be accurate, complete or current; or that defects will be corrected. No advice or information, whether oral or written, creates any warranty not expressly stated here.

Limitation of liability

To the fullest extent permitted by law, we will not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, goodwill, business opportunity, anticipated savings, or data — however caused and on any theory of liability — even if we have been advised of the possibility.

In particular, and without limiting the above, we are not liable for any decision made, or not made, in reliance on any output of the service, nor for any loss arising from an inaccurate mapping, aggregation, translation or query result.

Our total aggregate liability arising out of or relating to the service, under any theory, will not exceed the total fees you actually paid us in the 12 months immediately preceding the event giving rise to the claim.

Nothing in these terms excludes or limits liability that cannot be excluded or limited by law — including liability for fraud, fraudulent misrepresentation, or willful misconduct. If any part of this section is held unenforceable, it is severed and the remainder continues to apply.

Indemnification

You will indemnify, defend and hold harmless Exon Biosciences and its officers, employees and agents from any claim, demand, loss, liability, cost or expense (including reasonable legal fees) arising out of or relating to: the data you connect or upload and your right to do so; your use of the service or of any output from it; your violation of these terms or of any law; or any claim by a third party — including a data subject, regulator, employer or customer of yours — relating to data you brought into the service.

Governing law

These terms are governed by the laws of the State of Kansas, without regard to its conflict-of-laws rules. The state and federal courts located in Kansas have exclusive jurisdiction, and both parties consent to venue there.

Termination

You may delete your account at any time from Settings. Doing so cancels your subscription, revokes the credentials we hold for your connections, and deletes your tenant data. We may suspend an account for non-payment or for use that endangers the service or other customers.

Privacy Policy

This section describes what actually happens in the system, not an aspiration.

What we collect about you

Account details you give us: name, email address, organisation name, and a hashed password. Billing identifiers from our payment processor. Operational logs including IP address, which we use for rate limiting and abuse prevention.

What we store — and what we do not

Your rows are not stored. Queries against connected sources are executed live and returned; results are held only in a short-lived cache. What we persist is metadata: table and column names, the concepts your columns map to, relationships, and generated schema definitions.

Two deliberate exceptions, stated plainly. First, a small sample of values — up to ten per column, truncated — is read at setup so the automated system can identify what a column contains; these are used for mapping and are not retained as a copy of your data. Second, if you upload a file, that file is stored so it can be re-read.

Credentials. Passwords, API keys and OAuth tokens for your connections are held in an encrypted credential vault, not in the application database. We store a reference to them plus non-secret details such as host and username.

Backups. Encrypted nightly backups are retained off-site. A deletion request removes your data from the live system immediately; backup copies age out on the retention cycle.

Automated processing

Mapping your schema to the shared vocabulary uses an automated system. The prompt contains your column names and types, and up to ten sample values per column, each truncated. It does not contain your full dataset. This is how a column called cust_nm is recognised as a customer name.

If your organisation cannot permit sample values to leave your environment, tell us before you connect a source — this is a real constraint for regulated data and we would rather discuss it than have you discover it here.

Patterns learned during mapping — for example that a column matches a chemical-identifier format — are retained in a shared pattern library so the platform improves for everyone. These entries record the shape of a value (for example NNNN-NN-N), never the value itself.

Subprocessors

We engage third-party providers to deliver the service. They are described below by category and by the data they receive, rather than by naming a fixed vendor for each — providers change, and a list pinned to one supplier would be out of date the day we add or replace one.

The categories, and the data each category receives, are what we commit to. We may add, replace or remove individual providers within a category at any time, including adopting new automated-processing providers as they become available. Doing so does not change what data leaves the service or why.

Want the specific providers? We keep a current list of the named providers in each category and will give it to you on request at customer_service@exonbiosciences.com. If your organisation requires advance notice of changes within a category, ask for that in writing before connecting personal data and we will agree it with you.

Cookie Policy

Strictly necessary — always on

A session cookie keeps you signed in, and a CSRF token protects form submissions. These cannot be turned off without breaking sign-in, and no consent is required for them.

Optional — only with your consent

Our website chat widget sets cookies and reports the pages you visit. It loads only if you accept. Declining leaves the product fully functional; you simply will not see the chat bubble. You can change your choice at any time in Settings, and withdrawing consent is as easy as giving it.

We do not use advertising cookies and we do not sell personal data.

Data processing

Where you connect data that contains personal data, you act as the controller and we act as a processor on your behalf. We process that data only to provide the service and on your instructions, which are given by the connections and settings you configure.

We keep the security measures described above, engage only the subprocessors listed above, assist you with data-subject requests so far as the service allows, and delete your data on termination as described below.

This section is a summary, not a data processing agreement. If your organisation needs a signed DPA — with standard contractual clauses, subprocessor notification terms and audit rights — contact us at customer_service@exonbiosciences.com before connecting personal data. We would rather agree terms with you first than have you discover the gap afterwards. Note that data-protection duties apply to us by law and are not affected by the limitations elsewhere in these terms.

Your rights, export and deletion

If you are in the UK, EU or another jurisdiction with equivalent law, you have the right to access, correct, export and delete your personal data, and to object to processing.

Deletion is self-serve. Settings → Delete account removes your tenant data, cancels your subscription and revokes the credentials we hold. Encrypted backups age out on the retention cycle.

For access, correction or export requests, or anything else in this document, contact customer_service@exonbiosciences.com. We aim to respond within 30 days.

Exon Biosciences · Version 2026-08-08 · Effective 8 August 2026