One-Way Non-Disclosure and Code Review Agreement

This One-Way Non-Disclosure and Code Review Agreement (the "Agreement") is between Vitabyte, Inc., a New York corporation with its principal office at 3525 30th Ave, Suite 306, Astoria, NY 11103 ("Vitabyte"), and as entered at signing (the "Reviewer"). If the Reviewer is an organization, it signs for itself and is responsible for every individual who reviews on its behalf; each such individual must also sign this Agreement personally before receiving access.

Vitabyte will let the Reviewer see some of its Confidential Information so the Reviewer can carry out the following: the purpose stated in the electronic signature record (or, if none is stated, evaluating a possible business relationship with Vitabyte) (the "Review"). Examples include a code or security audit, consulting work, due diligence by a prospective investor or acquirer, a penetration test, or a review exercise during hiring. Only Vitabyte discloses under this Agreement. Vitabyte accepts no duty of confidentiality for anything the Reviewer shares, except as stated for Findings in section 8.

The Agreement takes effect on the date the Reviewer signs it electronically (the "Effective Date").

Confidential Information means all non-public information that Vitabyte, or anyone acting for it, makes available to the Reviewer before or after the Effective Date in connection with the Review, in any form, whether written, electronic, oral or visual, and whether or not marked confidential. It includes anything the Reviewer sees during a demonstration, meeting, screen share, video call, code walkthrough, interview exercise or test session, and anything the Reviewer can access through an account, repository, environment, device or credential that Vitabyte provides.

It specifically includes everything relating to Vitabyte's products and services, including Translink (identity hub, payments portal and developer API), VITAPOS (Android point-of-sale application, APKs and back office), VitaRemote (remote management agents and console), VITABYTE CRM, Angie and Angie Eats (guest ordering and AI assistant), and its food and beverage inventory product; their source code, object code, commit history, builds, APKs, agents, firmware, database schemas, interfaces, prompts, model configurations, evaluation sets, test suites, infrastructure, credentials, security measures and vulnerabilities, designs, screens, architecture, roadmaps, pricing, vendor and processor arrangements, and all customer, merchant, guest, employee and cardholder data.

Source Code means human-readable software code, scripts, configuration, infrastructure definitions, schemas, prompts and model configurations, together with their comments and history, in any form, including partial extracts and paraphrases detailed enough to reproduce their logic.

Review Environment means the repositories, virtual machines, hosted workspaces, data rooms, test systems, accounts and devices that Vitabyte provides or approves in writing for the Review.

Findings means all reports, notes, vulnerabilities, defects, test results, suggestions, feedback, analyses and other output that the Reviewer creates in the course of the Review or that relates to Confidential Information.

Trade Secret has the meaning given in 18 U.S.C. §1839 and New York law.

Confidential Information does not include information that the Reviewer can show by written records is or becomes public through no fault of the Reviewer; was lawfully known to the Reviewer without restriction before Vitabyte disclosed it; or is lawfully received from a third party free to disclose it. Information is not within an exclusion because individual parts are public, unless the combination is public. The exclusion for independent development applies only to work done by people who had no access to the Confidential Information, as described in section 7.

The Reviewer will:

• use Confidential Information only for the Review;
• disclose it to no one except Vitabyte, and individuals working on the Review for the Reviewer who have personally signed this Agreement;
• protect it with at least reasonable care, and never less care than the Reviewer gives its own most sensitive information;
• not discuss it in public places, on public channels or on social media; and
• notify Vitabyte in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, sent within twenty-four (24) hours after becoming aware of any loss, unauthorized access, use or disclosure, and cooperate fully to contain it.

These rules apply in addition to section 3 whenever the Reviewer has access to Source Code, designs, builds or systems.

1. Access only through the Review Environment. The Reviewer will access Confidential Information only through the Review Environment, using only the credentials issued to the named individual, which may not be shared.
2. No personal copies. The Reviewer will not clone, download, sync, export or store any Confidential Information on a personal account, personal repository, personal cloud storage, personal email, or personal or unmanaged device, except to the extent Vitabyte permits it in writing for a specific device and period.
3. No copying or reproduction. The Reviewer will not copy, fork, mirror, print, photograph, screenshot, screen-record or transcribe Source Code or designs, in whole or in part, for any use outside the Review Environment, and will not distribute any such material. Short excerpts quoted inside Findings delivered only to Vitabyte are permitted.
4. No AI tools. The Reviewer will not paste, upload, attach, dictate or otherwise submit any Source Code, design, data or other Confidential Information to any artificial intelligence, large language model, coding assistant, code search, transcription or similar tool or service that retains inputs, trains or improves any model on them, or makes them available to its provider or anyone else. An enterprise tool that contractually guarantees no retention and no training may be used only with Vitabyte's prior written permission naming the tool and its configuration.
5. No reverse engineering. The Reviewer will not reverse engineer, decompile, disassemble, decrypt, unpack or otherwise attempt to derive source code, keys or internal design from any build, APK, agent, firmware, device or service, except where the written scope in section 9 expressly calls for it.
6. No circumvention. The Reviewer will not exceed the access granted, bypass any access control, logging or protection, or access any system, account or data outside the Review.
7. No live data. The Reviewer will not access, extract or attempt to access production customer, merchant, guest, cardholder or employee data unless the written scope expressly permits it, and will stop and report immediately if it encounters such data.

The Reviewer consents to Vitabyte logging, recording and monitoring all access to and activity within the Review Environment, including session recordings, commands, file views, downloads and network activity, and to Vitabyte using those records to enforce this Agreement and as evidence in any proceeding. The Reviewer has no expectation of privacy in the Review Environment. Vitabyte may suspend or end access at any time without notice.

For twelve (12) months after the Reviewer's last access to any Confidential Information, the Reviewer will not use the specific Confidential Information it accessed, including anything retained in memory, to develop, design, code, advise on, or assist in developing a product or service that competes with the Vitabyte product to which that information relates. This is a restriction on the use of Vitabyte's information. It is not a non-compete: it does not stop the Reviewer from working for, advising or building any business, so long as it does not use Vitabyte's Confidential Information. This section does not shorten the Reviewer's confidentiality duties, which continue as stated in section 13.

The Reviewer acknowledges that exposure to Source Code and designs may make it harder to prove that later work was independently developed. If the Reviewer, or an organization it works for, later develops anything in an area related to what it reviewed, the Reviewer will bear the burden of proving by written, dated records that the work was created by people with no access to the Confidential Information. The Reviewer will not take part in any such development unless an effective information barrier keeps the Confidential Information out of it. There is no residuals right: information remembered by any person remains Confidential Information.

All Findings belong to Vitabyte. The Reviewer hereby assigns to Vitabyte all right, title and interest in and to the Findings, including all copyrights, patent rights and trade secret rights, and waives any moral rights in them to the extent permitted by law. To the extent any Finding is not assignable, the Reviewer grants Vitabyte an exclusive, perpetual, irrevocable, worldwide, royalty-free licence, with the right to sublicense, to use it for any purpose. Findings are Vitabyte's Confidential Information, and the Reviewer will not publish, present or disclose any Finding, including any vulnerability, without Vitabyte's prior written consent.

This section does not transfer the Reviewer's own pre-existing tools, scripts, methodologies, templates and know-how ("Reviewer Tools"), which remain the Reviewer's property, provided they contain no Confidential Information. If a Reviewer Tool is included in a deliverable, the Reviewer grants Vitabyte a perpetual, irrevocable, worldwide, royalty-free, non-exclusive licence to use it as part of that deliverable. The Reviewer will sign any document reasonably needed to confirm Vitabyte's ownership of Findings.

The Reviewer may perform active security testing (including scanning, fuzzing, exploitation, social engineering or reverse engineering) only within a written scope that Vitabyte has signed or confirmed in writing and that names the systems, methods, accounts, dates and times permitted. Testing outside that scope is unauthorized.

For testing performed in good faith, strictly within that written scope and in compliance with this Agreement, Vitabyte will treat the testing as authorized, will not bring a claim against the Reviewer under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act anti-circumvention provisions or similar laws for that testing, and will not support such a claim by others. This safe harbour does not cover any activity outside the written scope, any access to or retention of live data not permitted by the scope, any disruption or degradation of production service, or any breach of this Agreement. The Reviewer will stop testing immediately on Vitabyte's request and will report any critical vulnerability to Vitabyte within twenty-four (24) hours of discovering it.

When the Review ends, or at any earlier time Vitabyte asks, the Reviewer will immediately stop using the Confidential Information and, within five (5) business days, return or permanently delete all Confidential Information and Findings in its possession, including all copies, notes, extracts and any material on any device or account, and will return any device or credential Vitabyte provided. Within that period the Reviewer will deliver a written certification of deletion, signed by the individual reviewer and, for an organization, an officer. No backup or archive copy may be kept unless Vitabyte agrees in writing.

If the Reviewer is legally required to disclose Confidential Information, it will, where legally permitted, notify Vitabyte promptly in writing before disclosing, cooperate with any effort to obtain a protective order, and disclose only what is legally required.

Under 18 U.S.C. §1833(b), an individual will not be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret that is made (a) in confidence to a federal, state or local government official, directly or indirectly, or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law; or (b) in a complaint or other document filed in a lawsuit or other proceeding, if that filing is made under seal. An individual who files a lawsuit for retaliation by an employer for reporting a suspected violation of law may disclose the trade secret to his or her attorney and use it in the court proceeding, if the individual files any document containing the trade secret under seal and does not disclose the trade secret except under court order. Nothing in this Agreement prohibits reporting possible violations of law to a government agency.

The Reviewer's duties under this Agreement begin on the Effective Date, or on first access if earlier, and continue for five (5) years after the Reviewer's last access to Confidential Information. Duties for Source Code and any other Trade Secret continue for as long as it remains a Trade Secret under applicable law. Duties for personal, customer, merchant, guest or cardholder data continue for as long as any of it is held. Sections 6 through 16 survive the end of the Review.

The Reviewer acknowledges that unauthorized disclosure, copying or use of Confidential Information, and especially of Source Code, would cause Vitabyte irreparable harm that money damages could not fully repair. Vitabyte is entitled to a temporary restraining order, preliminary and permanent injunctive relief and specific performance to prevent or stop any actual or threatened breach, without posting a bond or other security and without proving actual damages, in addition to all other remedies.

The parties agree that the harm caused by each unauthorized disclosure or copying of Source Code is real but difficult to measure at the time of signing, because it depends on how the code spreads and what competitors do with it. They therefore agree that for each unauthorized disclosure of Source Code to any person or service, and each unauthorized copy of Source Code made outside the Review Environment (including submission to an AI tool in breach of section 4), the Reviewer will pay Vitabyte USD 100,000 as liquidated damages. The parties agree that this amount is a reasonable estimate of the probable loss and is not a penalty. Liquidated damages are without prejudice to injunctive relief, and Vitabyte may instead elect to recover its actual damages where it proves them to be greater. The Reviewer will also pay Vitabyte's reasonable attorneys' fees and costs of enforcing this Agreement where Vitabyte prevails.

This Agreement is governed by the laws of the State of New York, without regard to conflict-of-law rules. The parties submit to the exclusive jurisdiction and venue of the state and federal courts located in the Eastern District of New York, except that Vitabyte may seek injunctive relief in any court of competent jurisdiction.

EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.

• No licence, no obligation. All Confidential Information remains Vitabyte's property. No licence is granted except the limited right to use it for the Review. Vitabyte has no obligation to disclose anything or to proceed with any engagement, investment, hire or transaction.
• No warranty. Confidential Information is provided "as is".
• Export. The Reviewer will comply with all United States export control and sanctions laws and will not access the Review Environment from, or transfer Confidential Information to, any embargoed country or restricted person.
• Entire agreement. This Agreement is the entire agreement about its subject matter. If the Reviewer also has a services, employment or transaction agreement with Vitabyte, the provision more protective of Vitabyte's Confidential Information controls.
• Amendment and waiver. Changes must be in writing signed by both parties. Failure to enforce is not a waiver.
• Assignment. The Reviewer may not assign this Agreement. Vitabyte may assign it to an affiliate or successor.
• Severability. An unenforceable provision will be enforced to the maximum extent permitted, and a court may modify it to the minimum extent needed; the rest stays in effect.
• Notices. Notices to Vitabyte must be sent in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103.

The parties agree to sign this Agreement electronically and agree that an electronic signature has the same legal effect as a handwritten signature, under the federal Electronic Signatures in Global and National Commerce Act (15 U.S.C. §7001 et seq.) and New York's Electronic Signatures and Records Act (N.Y. State Technology Law §301 et seq.).

The Reviewer signs by ticking an unchecked acceptance box for this document in Vitabyte's identity hub and typing their full name and title. Vitabyte records the document title and version, a SHA-256 hash of the exact text accepted, the date and time, the IP address and the browser user agent, in an append-only record that cannot be edited or deleted. The parties agree that this record is admissible as evidence that the named person signed this exact text, and will not contest its validity or admissibility on the ground that it is electronic. A person signing for an organization represents that they are authorized to bind it.

Vitabyte accepts this Agreement either by its authorized signatory countersigning electronically or by granting the Reviewer access to the Review Environment or any Confidential Information after the Reviewer has signed, whichever happens first.

Questions about this Agreement: in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103.