Legal & Privacy Agreement

By accessing or using the DaaS-Chem platform operated by TheMoleculeLab ("Platform", "we", "us"), you ("User", "you") agree to be bound by these Terms & Conditions ("Terms") in their entirety. If you do not agree, you must immediately cease use of the Platform. Your continued use following any update to these Terms constitutes renewed acceptance.

All chemical, regulatory, and compliance data provided on this Platform is strictly for informational and research-support purposes only. It does not constitute definitive legal, regulatory, scientific, or commercial guidance.

You are legally obligated to independently verify all chemical data, regulatory status, substance classifications, concentration limits, and market authorisations against primary official sources before making any commercial, manufacturing, or research & development decision. Official sources include, without limitation:

• European Chemicals Agency (ECHA) — REACH, CLP, CosIng databases
• U.S. Environmental Protection Agency (EPA) and Food & Drug Administration (FDA)
• Health Canada — Cosmetic Ingredient Hotlist
• ASEAN Cosmetic Directive Annexes
• Japan MHLW Ministerial Ordinances
• China NMPA — IECIC and Prohibited/Restricted lists
• Any other competent national or supranational authority applicable to your market

TheMoleculeLab makes no warranty — express or implied — as to the accuracy, completeness, timeliness, or fitness for any particular purpose of the data presented on this Platform.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THEMOLECULELAB AND ITS OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, AND LICENSORS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES.

This limitation includes, without limitation, any:

• Financial losses or loss of profits arising from product development or commercialisation decisions
• Product recalls, market withdrawals, or reformulation costs
• Factory or production line shutdowns
• Regulatory penalties, fines, import bans, or enforcement actions
• Legal fees or costs arising from third-party claims
• Reputational harm to your business or brand

Cap on Damages: In no event shall TheMoleculeLab's total aggregate liability to you exceed the greater of (a) the total subscription fees paid by you to TheMoleculeLab in the twelve (12) calendar months immediately preceding the event giving rise to the claim, or (b) USD $100 (one hundred US dollars).

The Platform does not provide, and nothing on the Platform should be construed as, legal advice, chemical engineering advice, medical advice, pharmaceutical guidance, or regulatory counsel of any kind. You should always engage qualified legal, regulatory, or scientific professionals before making decisions that could have legal, health, safety, or commercial consequences. No attorney-client, chemist-client, or advisor-client relationship is created between you and TheMoleculeLab by your use of this Platform.

The AI Reformulation Agent ("Molecule Lab AI CSO") generates ingredient substitution suggestions based on publicly available regulatory data and machine learning models. AI-generated reformulations are experimental outputs and must not be treated as final or validated formulas.

Before any AI-suggested reformulation is used in a commercial product, prototype, or clinical study, it must undergo:

• Full physical laboratory stability testing (thermal, photo-stability, oxidative)
• Microbiological challenge testing (preservative efficacy)
• Safety assessment by a qualified cosmetic safety assessor or toxicologist
• Regulatory review in each target market
• Consumer safety testing as appropriate

TheMoleculeLab expressly disclaims all liability for any harm arising from the direct use of AI-generated reformulation outputs without independent scientific validation.

All Platform content, software, algorithms, UI designs, data compilations, and AI models are the exclusive intellectual property of TheMoleculeLab or its licensors. You are granted a limited, non-exclusive, non-transferable licence to access and use the Platform for your internal business purposes only. You may not reproduce, scrape, resell, sublicense, or create derivative works from any Platform content without express written permission.

You agree not to: (a) use the Platform for any unlawful purpose; (b) attempt to reverse-engineer, decompile, or extract proprietary algorithms; (c) submit false, misleading, or third-party proprietary data without authorisation; (d) circumvent any access controls or security measures; (e) use automated means to bulk-extract data; or (f) share your account credentials with unauthorised persons.

These Terms are governed by the laws of the jurisdiction in which TheMoleculeLab is incorporated, without regard to conflict-of-law provisions. Any dispute shall first be submitted to good-faith negotiation. Unresolved disputes shall be submitted to binding arbitration under the rules of a mutually agreed arbitral body. Nothing herein prevents either party from seeking urgent injunctive relief in a court of competent jurisdiction.

TheMoleculeLab reserves the right to update these Terms at any time. Material changes will be communicated by incrementing the version number displayed above. Continued use of the Platform after such changes constitutes your acceptance of the revised Terms.

TheMoleculeLab ("Controller") is the data controller for personal data processed through the DaaS-Chem Platform. For privacy enquiries or data subject requests, contact: privacy@themoleculelab.com.

We collect: (a) account registration data (name, email, organisation, country); (b) usage data (pages visited, search queries, features used, session duration); (c) formulation data you voluntarily upload to the SKU Vault; (d) technical data (IP address, browser type, device identifiers); (e) legal acceptance records including version, timestamp, and IP address.

Your proprietary formulations and master formulas uploaded to the SKU Vault are treated as confidential commercial secrets. We commit that:

• SKU Vault data is encrypted at rest (AES-256) and in transit (TLS 1.3+)
• Your formulations are never used to train public AI models or shared with any third party without your explicit consent
• Access is restricted to authenticated users within your organisation only
• TheMoleculeLab employees do not access your formulation data except for security incident investigation with your prior notification

Pro & Enterprise Users benefit from our Zero-Knowledge Private Vault: formulation data is encrypted with a key derived from your organisation's credentials before reaching our servers, ensuring TheMoleculeLab cannot technically access your IP even in adversarial scenarios.

If you upload supplier-provided ingredient data, safety data sheets, or specification documents, this data is stored in your private organisational vault and is strictly isolated from all other users' workspaces. We do not cross-reference, share, or aggregate your supplier data with other organisations on the Platform. Supplier confidentiality obligations you have contracted separately remain your responsibility to honour.

EU/EEA Users (GDPR): You have the right to access, rectify, erase ("right to be forgotten"), restrict processing, data portability, and object to processing of your personal data. To exercise these rights, submit a request to privacy@themoleculelab.com. We will respond within 30 days. Where we transfer data outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

California Residents (CCPA): You have the right to know what personal information we collect and how it is used, to delete your personal information, to opt-out of the sale of personal information (we do not sell personal data), and to non-discrimination for exercising your privacy rights. Submit requests to privacy@themoleculelab.com.

Account and profile data is retained for the duration of your subscription plus 90 days after termination, after which it is permanently deleted unless legal obligations require longer retention. Formulation data in the SKU Vault is deleted within 30 days of a verified erasure request. Legal acceptance records (version, timestamp, IP) are retained for 7 years for compliance and audit purposes.

We use strictly necessary cookies for authentication and session management, and optional analytics cookies (subject to your consent) to improve the Platform. We do not use cross-site advertising trackers. You may manage cookie preferences at any time via your browser settings.

We implement industry-standard technical and organisational security measures including encryption at rest and in transit, role-based access controls, multi-factor authentication options, regular penetration testing, and SOC 2-aligned operational practices. In the event of a data breach affecting your personal data, we will notify you within 72 hours as required by applicable law.

We may update this Privacy Policy from time to time. The version date at the top of this document indicates when it was last revised. Material changes will require your renewed acceptance the next time you log in to the Platform.