SaaS Agreement Suite

Trackflow B2B SaaS Subscription Agreement

Effective Date: 04th September, 2026

This Subscription Agreement is entered into between:

BlueRose Technologies Pvt. Ltd., doing business as BlueRose Technologies and Trackflow ("Provider")
and
the customer identified in the applicable Order Form ("Customer").

Subscription

Subject to this Agreement and payment of applicable fees, Provider grants Customer a limited, non-exclusive, non-transferable right to access and use Trackflow during the Subscription Term.

Trackflow may include:

• Project management
• Issue and ticket management
• Backlogs
• Sprint management
• Kanban workflows
• Component management
• Release management
• GitHub and other integrations
• Dashboards
• AI-powered productivity features
• Other functionality included in the applicable subscription

Authorized Users

Customer may permit its employees, contractors and other authorized personnel to use Trackflow within the limits of its subscription. Customer is responsible for the actions of its Authorized Users.

Customer Data

Customer retains all rights, title and interest in Customer Data. Customer grants Provider the limited right to host, process, transmit, store and otherwise handle Customer Data solely to:

• Provide Trackflow
• Maintain security
• Provide support
• Comply with legal obligations
• Improve the Service in accordance with applicable agreements and law

Provider does not claim ownership of Customer Data.

Provider Responsibilities

Provider will:

• Provide the subscribed Service
• Maintain reasonable security measures
• Provide support according to the applicable plan
• Use commercially reasonable efforts to maintain service availability
• Process Customer Data only as permitted under applicable agreements and law

Customer Responsibilities

Customer will:

• Pay applicable fees
• Maintain appropriate user access controls
• Ensure lawful use of Trackflow
• Obtain required rights and permissions for Customer Data
• Maintain appropriate internal security practices
• Avoid unauthorized or prohibited use

Fees and Payment

Subscription fees, billing frequency, payment terms and applicable taxes will be specified in the Order Form or applicable commercial proposal. Unless otherwise stated:

• Fees are payable in advance
• Taxes are additional where applicable
• Overdue amounts may result in suspension after reasonable notice
• Subscription fees are non-refundable except where required by law or expressly agreed

Intellectual Property

Provider retains all rights in Trackflow, including:

• Software
• Technology
• Interfaces
• Documentation
• Branding
• Enhancements
• Product architecture

Nothing transfers ownership of Trackflow to Customer. Customer retains ownership of Customer Data.

Confidentiality

Each party will protect the other party's confidential information using reasonable care. Confidential information may only be used to perform obligations or exercise rights under this Agreement.

Third-Party Integrations

Trackflow may connect with third-party services such as GitHub. Provider is not responsible for changes, outages, security incidents or discontinuation of third-party services.

AI Features

AI functionality is provided as an assistive capability. Customer and users remain responsible for reviewing AI-generated output. Provider does not guarantee that AI output will always be accurate, complete or appropriate for a particular purpose.

Suspension

Provider may suspend access where reasonably necessary due to:

• Security risks
• Material breach
• Unlawful activity
• Non-payment
• Threats to Service integrity

Where reasonably practicable, Provider will provide prior notice.

Term and Termination

The Agreement continues for the Subscription Term. Either party may terminate for material breach if the breach is not cured within [30] days of written notice, unless immediate termination is reasonably required due to security or legal circumstances.

Data Return

Following termination, Customer may request export of available Customer Data within the applicable retention period, subject to the Customer's subscription and technical capabilities. Provider may subsequently delete Customer Data in accordance with its retention practices, contractual commitments and legal obligations.

Warranty Disclaimer

Except as expressly stated, Trackflow is provided on an "as available" basis. Provider does not warrant uninterrupted or error-free operation.

Limitation of Liability

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special or consequential damages, including lost profits or business opportunities.

Provider's aggregate liability arising from this Agreement will not exceed the fees paid by Customer for Trackflow during the twelve (12) months preceding the event giving rise to the claim. This limitation does not apply where liability cannot legally be excluded or limited.

Governing Law

Unless otherwise agreed in an Order Form, this Agreement is governed by the laws of India. Courts in Bengaluru, Karnataka, India shall have jurisdiction, subject to applicable law and any separately agreed dispute-resolution mechanism.

Trackflow Service Level Agreement

Scope

This SLA applies to paid Trackflow subscriptions unless a separate enterprise SLA applies.

Availability Target

Trackflow will target monthly availability of: 99.5%

excluding:

• Scheduled maintenance
• Emergency maintenance
• Customer-controlled systems
• Third-party outages
• Internet or telecommunications failures
• Force majeure events
• Events outside Provider's reasonable control

Scheduled Maintenance

Where reasonably practicable, scheduled maintenance will be communicated in advance.

Support Severity Levels

Response targets are targets and not guaranteed resolution times unless separately agreed.

Support Channels

Support requests may be submitted through:
Email: info@track-flow.io

Enterprise customers may receive additional support channels.

Support Services by Plan

The level of support available to Customer depends on the active subscription plan. Support levels increase progressively from the Starter plan through the Business plan.

Higher-tier plans include all support features of lower-tier plans. Support is provided in accordance with the severity levels and response targets set out in the Service Level Agreement above.

Trackflow Data Processing Addendum

This Data Processing Addendum ("DPA") applies where Provider processes Personal Data on behalf of Customer.

Roles

Where applicable:

• Customer acts as Controller, Data Fiduciary or other legally recognized primary decision-maker
• Provider acts as Processor, Data Processor or other legally recognized service provider

The parties will adapt these roles as required by applicable law.

Processing Instructions

Provider will process Personal Data only:

• To provide Trackflow
• According to Customer's documented instructions
• As required by applicable law
• To maintain security and service integrity

Confidentiality

Provider will ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.

Security Measures

Provider will maintain reasonable technical and organizational measures appropriate to the nature of the processing and foreseeable risks.

Subprocessors

Provider may use infrastructure, cloud, AI, security and support providers. Where required, Provider will maintain appropriate contractual protections with relevant subprocessors. Customer may request information regarding material subprocessors where applicable.

Personal Data Incidents

Provider will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Data where notification is required or appropriate under applicable law. The notification may include available information regarding:

• Nature of the incident
• Categories of affected data
• Likely consequences
• Mitigation measures

Data Subject Requests

Where legally applicable, Provider will provide reasonable assistance to Customer in responding to data-subject or data-principal requests relating to Customer Data.

International Transfers

Where applicable, international transfers will be handled using legally recognized safeguards or mechanisms.

Deletion and Return

Upon termination, Provider will return or make available Customer Data where supported by the Service and applicable agreement. Provider may retain limited information where necessary for legal, security, backup or legitimate operational purposes.

Trackflow Data Security & Compliance Statement

Trackflow is designed with security and operational controls appropriate for a modern SaaS platform. Our security approach includes appropriate measures across the following areas:

Identity and Access Management

• Authentication controls
• Role-based access
• User and administrator permissions
• Access review practices
• Secure credential handling

Application Security

• Secure development practices
• Vulnerability management
• Security testing appropriate to the product lifecycle
• Patch and update processes

Infrastructure Security

• Controlled cloud or hosting infrastructure
• Network and system access controls
• Monitoring and logging
• Backup and recovery practices appropriate to the deployment

Data Protection

• Logical access controls
• Encryption measures where appropriate
• Secure data transmission
• Data-retention controls
• Customer data separation

Security Incident Management

Trackflow maintains processes for:

• Detecting potential security events
• Investigating incidents
• Containing and mitigating identified threats
• Communicating material incidents where appropriate

Business Continuity

Provider maintains reasonable operational processes intended to support:

• Service recovery
• Data backup
• Infrastructure resilience
• Continuity planning

Specific recovery objectives, audit commitments, penetration-testing rights, certifications, data residency or enterprise security requirements may be agreed separately in an enterprise contract.

Order of Precedence

Where multiple Trackflow documents apply, the following order generally applies:

1. Executed Enterprise Agreement or Order Form
2. Data Processing Addendum
3. Service Level Agreement
4. SaaS Subscription Agreement
5. Privacy Policy
6. Acceptable Use Policy
7. Other published Trackflow policies

A specific written agreement may override this order where expressly stated.