NXRIP PRIVACY POLICY FOR THE NXRIP SOFTWARE, WEBSITE, LICENSING, SUPPORT, AND SUBSCRIPTIONS IMPORTANT - READ THIS POLICY CAREFULLY THIS POLICY EXPLAINS WHAT INFORMATION SAPEX LLC COLLECTS, WHY IT USES IT, WHEN IT DISCLOSES IT, HOW LONG IT KEEPS IT, AND WHAT CHOICES MAY BE AVAILABLE TO YOU. Privacy contact: info@nxrip.com Online location: nxrip.com/privacy This Privacy Policy describes how SAPEX LLC, a North Carolina limited liability company ("SAPEX," "we," "us," or "our"), handles Personal Information in connection with the NXRIP desktop software, nxrip.com and related webpages (the "Site"), account and licensing services, subscriptions, customer support, and any optional online feature that links to this Policy (collectively, the "Services"). "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household. It does not include information that is lawfully made public, aggregated information, or information that has been deidentified so that it cannot reasonably be linked to an individual. NXRIP is offered for business and professional use. When you use NXRIP for an employer, customer, or other organization, that organization may also control information associated with your account and may have its own privacy obligations. 1. Scope and Roles (a) SAPEX is the business or controller responsible for Personal Information handled under this Policy, except where another party is identified as the controller. (b) This Policy applies to the Services. It does not govern third-party websites, payment pages, products, plugins, printers, drivers, hosting platforms, or other services that operate under their own privacy policies. (c) The NXRIP End User License Agreement and Subscription Terms governs use of the Software and allocation of commercial risk. This Policy is a notice about information practices and is not a warranty, service-level agreement, or promise that the Services will always be available or secure. (d) A customer organization may be an independent controller of information it places in NXRIP, transmits through support, or makes available to its users. The organization is responsible for giving any required notices and obtaining any required permissions from its personnel and customers. 2. Summary of Our Practices 3. Information We Collect (a) Account and Contact Information. We may collect a name, email address, business name, job role, country or region, account credentials, contact preferences, and information used to verify authority over an account or license. (b) Subscription and Transaction Information. We may collect the selected plan, price, billing interval, subscription status, start and renewal dates, invoices, taxes, discounts, transaction identifiers, payment status, refund or dispute status, and limited payment-method details made available by Stripe, such as card brand, expiration date, and last four digits. (c) License, Installation, and Device Information. NXRIP may transmit and SAPEX may collect account or license identifiers, installation identifiers, device or hardware fingerprints, operating-system information, application version, activation and validation timestamps, subscription status, IP address, approximate location inferred from IP address, and signals used to detect duplicate, unauthorized, manipulated, or abusive use. (d) Printer Integration and Direct Printer Mode Information. When Direct Printer Mode or a printer-integration feature is configured or used, NXRIP may process information such as printer model, controller or board type and revision, firmware or driver version, printhead type and count, channel mapping, connection method, local network endpoint, printer-profile or configuration identifier, status and error data, job metadata, command and response logs, and records showing acceptance of the Direct Printer Mode acknowledgment. Much of this information may remain local to the user's device and Printer System. SAPEX receives it only when the relevant feature requires transmission, when diagnostics or telemetry are enabled, when the user submits it to support, when a remote-support session exposes it, or as otherwise disclosed in the feature interface. (e) Usage, Diagnostic, and Security Information. Depending on the version and settings, we may collect feature-use events, mode-selection events, startup and shutdown events, update status, crash reports, error codes, performance measurements, server request logs, authentication events, and security or anti-tampering signals. We use this information to operate, secure, debug, and improve the Services. (f) Support and Communications. If you contact us, we may collect your message, email address, account and license details, screenshots, logs, Printer System or workflow configuration, configuration exports, command or response logs, files you choose to attach, and records of our response. If you request remote support, the support tool may expose information visible on the shared screen or accessible through the authorized session. Telephone or video communications are not recorded unless we give notice where required. (g) Website Information. When you use the Site, servers and service providers may automatically receive IP address, browser type, device type, operating system, referring page, requested pages, timestamps, and security logs. The Site may use cookies or similar storage needed for security, session management, preferences, and operation. (h) Information from Third Parties. We may receive information from Stripe, hosting and licensing providers, resellers, distributors, identity or fraud-prevention providers, remote-support or diagnostic providers, business account administrators, and public sources. The information may include transaction status, account details, support history, and security signals. (i) Information You Provide Voluntarily. You may choose to provide feedback, survey responses, beta-testing information, testimonials, or other content. Do not provide government identifiers, financial-account credentials, health information, biometric information, or other sensitive data unless SAPEX specifically requests it for a legitimate reason and provides an appropriate notice. 4. Artwork, Print Files, and Optional Online Features (a) Local File Processing. NXRIP is a desktop production tool and ordinarily processes artwork, images, layouts, profiles, print data, and Output on the user's computer. The ordinary license activation or validation request is not intended to transmit the contents of artwork or print files to SAPEX. (b) Local Direct Printer Communication. When Direct Printer Mode is enabled, NXRIP may send Output, data, or commands from the user's device to the selected Printer System and may receive status, response, or configuration data. Local communication between the user's device and Printer System does not by itself mean SAPEX receives the content of the print job or Printer Configuration. (c) Deliberate Submission and Diagnostics. SAPEX may receive User Content, Printer Configuration, logs, command or response data, screenshots, or other information when you deliberately attach or submit it to support, enable a diagnostic or online function that involves transmission, or authorize a remote-support session. We use submitted information to provide the requested function, troubleshoot, secure the Services, investigate misuse or claims, and maintain necessary business and legal records. (d) Online or AI-Enabled Features. An optional online or AI-enabled feature may send prompts, files, previews, metadata, settings, or other content to SAPEX or a designated provider. The feature interface or a supplemental notice will identify material online processing before submission. Do not use an online feature for content you are not authorized to disclose. (e) Confidential and Regulated Content. You are responsible for determining whether content is confidential, subject to a nondisclosure agreement, export-controlled, regulated, or protected by privacy law. Unless SAPEX expressly agrees in writing, the Services are not designed to receive protected health information, payment-card data embedded in files, government-classified information, or other specially regulated content. 5. How We Use Information We may use Personal Information for the following purposes: Provide, activate, validate, update, maintain, and administer NXRIP and related accounts. Configure and operate requested printer integrations and Direct Printer Mode functions, route local print communications, record feature acceptance, and diagnose compatibility or communication problems. Investigate alleged configuration loss, equipment damage, security incidents, misuse, or other claims and preserve relevant technical and contract records. Process subscriptions, payments, renewals, taxes, refunds, chargebacks, invoices, and account changes. Authenticate users, enforce device and plan limits, prevent piracy, detect abuse, and protect accounts, systems, users, and SAPEX. Respond to support requests, diagnose errors, reproduce problems, and communicate about service, security, billing, and product changes. Develop, test, analyze, and improve functionality, reliability, compatibility, usability, and security. Create aggregated or deidentified statistics that do not reasonably identify an individual. Comply with law, court orders, tax and accounting requirements, sanctions, export controls, and lawful governmental requests. Establish, exercise, or defend legal claims and enforce agreements, policies, licenses, and intellectual-property rights. Evaluate or complete a financing, reorganization, acquisition, asset sale, merger, or similar business transaction. Send product news or marketing where permitted by law. You may unsubscribe from promotional email, but not from operational messages needed for an active account or subscription. 6. Legal Bases for Processing Where the law requires a legal basis, SAPEX relies on one or more of the following: (a) Contract. Processing needed to provide the Services, activate a license, administer a subscription, process a transaction, or respond to a request made in connection with a contract. (b) Legitimate Interests. Processing needed for security, fraud prevention, license enforcement, support, product improvement, business administration, and protection of legal rights, balanced against the rights and interests of affected individuals. (c) Legal Obligation. Processing needed to comply with tax, accounting, sanctions, export-control, court, regulatory, and other legal requirements. (d) Consent. Processing based on consent where required, including certain marketing, non-essential cookies, or optional features. Consent may be withdrawn prospectively, but withdrawal does not affect prior lawful processing. 7. How We Disclose Information We may disclose Personal Information in the following circumstances: (a) Service Providers. To vendors that provide hosting, license infrastructure, payment processing, email, support tools, security, diagnostics, software distribution, analytics, professional advice, and other services for SAPEX. They may process information only as permitted by contract and applicable law. (b) Stripe. To Stripe for hosted checkout, billing, customer-portal, payment, fraud-prevention, tax, and related functions. Stripe also receives information directly from you and acts under its own privacy policy for some processing. (c) Customer Organizations and Administrators. To the organization that purchased or controls the account and to its authorized administrators. Administrators may manage users, licenses, billing, access, and related records. (d) At Your Direction. To a third party when you request an integration, submit content to an online feature, authorize a reseller or consultant, or otherwise direct the disclosure. (e) Legal, Safety, and Enforcement. To courts, regulators, law enforcement, government authorities, opposing parties, insurers, advisors, and others when reasonably necessary to comply with law, protect safety or rights, investigate fraud or abuse, enforce an agreement, or establish, exercise, or defend a legal claim. (f) Business Transactions. To actual or prospective investors, lenders, buyers, sellers, and professional advisors in connection with due diligence, financing, restructuring, merger, acquisition, bankruptcy, or sale of all or part of the business or assets, subject to appropriate confidentiality protections where practicable. (g) Aggregated or Deidentified Information. We may disclose information that has been aggregated or deidentified so that it does not reasonably identify an individual. We will not attempt to reidentify data that applicable law requires us to maintain as deidentified. 8. Stripe Payments and Subscription Billing (a) Stripe processes payment credentials and operates hosted checkout and customer-portal functions. When you enter payment information into a Stripe-hosted interface, that information is provided directly to Stripe rather than to SAPEX. (b) SAPEX normally receives transaction identifiers, customer and subscription identifiers, billing contact information, payment status, amounts, tax information, invoices, and limited payment-method details. SAPEX does not normally receive or store the full payment card number or card security code when Stripe-hosted payment collection is used. (c) Stripe may use device, network, identity, and transaction data for payment processing, fraud prevention, compliance, and its own legally permitted purposes. Stripe's processing is governed by Stripe's privacy policy and terms, which are available through the Stripe interface and website. 9. Cookies and Similar Technologies (a) The Site may use cookies, local storage, pixels, and similar technologies that are necessary for authentication, security, load balancing, fraud prevention, preferences, and operation. (b) If SAPEX introduces non-essential analytics, advertising, or similar technologies, the Site will provide notice and obtain consent where required by law. Browser controls may allow you to delete or block cookies, but blocking necessary technologies may prevent parts of the Site from working. (c) Because SAPEX does not sell Personal Information or use it for cross-context behavioral advertising as described in this Policy, a browser-based opt-out preference signal does not change those practices. We will honor legally recognized signals if our practices change and applicable law requires it. 10. Data Retention (a) We retain Personal Information for the shortest period reasonably necessary for the purposes described in this Policy, taking into account account status, subscription and license administration, security, support needs, legal duties, limitation periods, disputes, audits, backups, and protection of SAPEX and its users. (b) Account, license, feature-acceptance, device, and printer-profile records may be retained while an account or license is active and for a reasonable period afterward to prevent abuse, restore access, prove contract acceptance, investigate technical or equipment-related claims, resolve disputes, and maintain transaction history. Billing, tax, and accounting records may be retained for the period required by law and ordinary business practice. (c) Support materials, remote-support records, configuration exports, screenshots, and diagnostic or command logs are retained according to the nature of the request, the need to maintain a troubleshooting or claim history, security needs, and applicable legal obligations. Files submitted for support may be deleted sooner when no longer needed, but copies may remain temporarily in backups or legal holds. (d) When information is no longer needed, SAPEX will delete, anonymize, or securely isolate it, subject to technical limitations and legal requirements. 11. Security (a) SAPEX uses administrative, technical, and organizational measures intended to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. Measures may include access controls, authentication, encryption in transit where appropriate, logging, backups, provider review, and security monitoring. (b) No software, local or internet transmission, storage system, remote-support tool, printer connection, or security measure is completely secure. SAPEX cannot guarantee absolute security. You are responsible for protecting account credentials, devices, local files, Printer Systems, Printer Configuration, networks, backups, remote-access tools, and access granted to your personnel or contractors. (c) Notify info@nxrip.com promptly if you reasonably believe an account, license, or communication with SAPEX has been compromised. Do not send passwords, full payment-card numbers, or other secrets by ordinary email. 12. International Processing and Transfers SAPEX is based in the United States. SAPEX and its providers may process information in the United States and other countries that may have different privacy laws from your country. Where required, SAPEX uses a legally recognized transfer mechanism or another lawful basis for cross-border processing. By using the Services, you understand that information may be processed in locations where SAPEX or its providers operate, subject to applicable law. 13. Your Rights and Choices (a) Account Information. You may update certain account and billing information through available account or Stripe customer-portal tools. You may unsubscribe from promotional email using the unsubscribe link. Operational, legal, security, and billing communications may still be sent when needed. (b) Privacy Requests. Depending on your location and subject to legal exceptions, you may have a right to request access, confirmation, correction, deletion, portability, restriction, or objection; to withdraw consent; to opt out of certain sales, sharing, targeted advertising, or profiling; or to appeal a denial. (c) Submitting a Request. Send a request to info@nxrip.com and identify the account, email address, jurisdiction, and right you wish to exercise. Do not send identity documents unless requested through an appropriate method. (d) Verification and Agents. SAPEX may verify identity and authority using account information, email confirmation, transaction information, license details, or other reasonable methods. An authorized agent may submit a request where permitted, but SAPEX may require proof of authorization and may verify the request directly with the individual. (e) Limitations. Rights are not absolute. SAPEX may deny or limit a request where permitted by law, including when information is needed for security, fraud prevention, licensing, accounting, legal claims, compliance, or another person's rights. SAPEX will not unlawfully discriminate against an individual for exercising a privacy right. (f) Complaints. You may contact SAPEX first so the issue can be investigated. You may also have a right to complain to a privacy or data-protection authority in your jurisdiction. 14. U.S. State Privacy Notice For residents of U.S. states with applicable privacy laws, the following information supplements the rest of this Policy. During the preceding 12 months, SAPEX may have collected the categories below for the business and commercial purposes described in Sections 5 and 7: Identifiers and customer-record information, such as name, email address, business contact details, account identifiers, IP address, and limited billing information. Commercial information, such as subscriptions, invoices, transaction history, refunds, and support purchases. Internet or other electronic activity, such as device, application, website, license, Direct Printer Mode, printer-integration, diagnostic, command or response, and security events. Commercial and technical equipment information, such as printer model, controller or board type, firmware or driver version, printhead and channel configuration, printer-profile identifier, connection method, status and error information, and related support records when transmitted to SAPEX. Approximate geolocation inferred from IP address. Professional information, such as employer, business name, role, or authority over a business account. Contents of communications and files voluntarily submitted to support or an online feature. Sources include you, your organization and devices, Stripe and other service providers, resellers or administrators, and public sources. Recipients may include the categories described in Section 7. SAPEX does not sell Personal Information for money, does not share it for cross-context behavioral advertising, and does not offer financial incentives in exchange for Personal Information. Applicable rights and request procedures are described in Section 13. 15. Business Account Administrators If an organization provides your NXRIP account or subscription, its administrators may create or disable users, assign licenses, see account and device information, manage billing, and request support records related to the organization. Direct questions about the organization's use of your information to that organization. SAPEX is not responsible for an organization's independent privacy practices. 16. Children The Services are not directed to children and are offered for business and professional use. SAPEX does not knowingly collect Personal Information from anyone under 18 through the Services. Contact info@nxrip.com if you believe a child has provided Personal Information, and SAPEX will review the report and take appropriate action. 17. Third-Party Services and Links The Services may link to or interoperate with Stripe, printer, controller, firmware, driver, or operating-system vendors, remote-support and diagnostic providers, cloud providers, resellers, social platforms, AI providers, or other third parties. SAPEX does not control their independent privacy or security practices. Review the applicable third-party policies before providing information or enabling an integration or remote session. 18. Changes to This Policy SAPEX may update this Policy to reflect changes in the Services, law, providers, security practices, or business operations. The updated version will be posted at nxrip.com/privacy with a new effective date. When required by law, SAPEX will provide additional notice or obtain consent. Continued use after the effective date is subject to the updated Policy, but an update does not retroactively authorize materially different processing where applicable law requires consent. 19. Contact Privacy questions, requests, and complaints may be sent to: SAPEX LLC North Carolina, United States Email: info@nxrip.com Website: nxrip.com Privacy Policy: nxrip.com/privacy 20. Mandatory Law This Policy is intended to describe SAPEX's actual information practices, not to waive a privacy right that cannot lawfully be waived. If applicable law requires a notice, consent, retention limit, security measure, contract, transfer mechanism, response procedure, or other protection that conflicts with this Policy, SAPEX will follow the mandatory requirement to the extent it applies.