MMMmc LLC — Intellectual Property, Software Licensing, Consulting, Privacy & Security Handbook

MMMmc LLC

Intellectual Property, Software Licensing, Consulting, Privacy & Security Handbook

Effective date: August 21, 2026

Entity: MMMmc LLC, a Georgia limited liability company

Policy owner: Managing Member and IP/Compliance Lead

Interim legal and security notice: legal@sensorybridges.com

IMPORTANT USE NOTE. This handbook is an internal governance and drafting framework. It does not itself transfer intellectual property, create a customer license, bind an institution, establish trade-secret status, cure a missing assignment, or operate retroactively. Every asset, license, assignment, NDA, consulting engagement, data-processing role, and enforcement term must be supported by the correct signed agreement, recorded assent, and evidence. Georgia and Tennessee counsel should review all bracketed items and the intercompany structure before adoption.

Contents

1. Mission, Scope, and Role

2. Core Principles

3. Definitions

4. Corporate Separateness and Authority

5. IP Asset Register and Chain of Title

6. Copyright Policy

7. Patent and Invention Policy

8. Trade Secrets and Reasonable Measures

9. Trademarks, Product Names, Domains, and Branding

10. Ownership of Improvements and Contributions

11. Intercompany License to Sensory Bridges

12. License Formation and Assent

13. Standard Software License Grant

14. License Restrictions

15. Revocation, Suspension, and Termination

16. Post-Termination Return, Deletion, and Certification

17. Demonstrations, Evaluations, Betas, and Investor Materials

18. Repositories, Source Code, and Development Environments

19. AI, Models, Prompts, Training Data, and Outputs

20. Customer Content and Service Data

21. Privacy and Data Roles

22. Children, Education, Health, Research, and Biometric Restrictions

23. Consulting Engagements

24. Consulting Deliverables and Acceptance

25. Fees, Payment, Taxes, and Expenses

26. Participation, Outcomes, and Refunds

27. Meetings, Recordings, Notetakers, and Work Product

28. Confidentiality and NDA Standards

29. Acceptable Use and Security

30. Security Incidents and One-Hour Escalation

31. External Access, Universities, and UTC-Facing Controls

32. Unauthorized Access, Cloning, and Repository Response

33. Evidence Preservation and Privilege

34. Infringement, Misappropriation, and Remedies

35. Attorneys’ Fees, Advancement, and Cooperation

36. Disclaimers

37. Limitation of Liability

38. Mandatory Mediation

39. Open Source and Third-Party Materials

40. Export, Sanctions, and Government Rights

41. Workforce and Contractor IP Protection

42. Accessibility, Ethics, and Professional Conduct

43. Records Retention

44. Insurance and Risk Transfer

45. Governance, Audits, and Enforcement

46. Adoption and Acknowledgment

1. Mission, Scope, and Role

MMMmc LLC ("MMMmc") is intended to be the intellectual-property holding, software-licensing, technology-development oversight, and consulting entity for the software, applications, algorithms, workflows, data architectures, documentation, and related innovations used by Sensory Bridges LLC and other authorized licensees.

MMMmc may own or acquire source code, object code, applications, firmware, APIs, SDKs, system prompts, models, training and evaluation assets, designs, copyrights, patent rights, trade secrets, trademarks, domain names, documentation, datasets, and know-how. Ownership is asset-specific and must be proved through creation records, assignments, work-made-for-hire agreements, acquisition documents, corporate approvals, and IP schedules.

Sensory Bridges is a separate Tennessee operating entity that may build, test, market, deploy, support, and conduct research involving products under a signed intercompany license. MMMmc is not liable for Sensory Bridges’ operations merely because it licenses IP, and Sensory Bridges does not own MMMmc assets merely because its personnel helped create, test, or commercialize them. Actual conduct and contracts must preserve this separation.

2. Core Principles

• No ownership statement without an asset-specific chain of title.

• No license by implication, access, employment, meeting attendance, evaluation, grant participation, or technical capability.

• No retroactive attempt to bind UTC, a university, user, contractor, or other nonassenting person.

• Free and evaluation access may be highly revocable; paid licenses must honor the promised term or provide contractually defined cause, notice, transition, or refund.

• Trade-secret protection requires continuous reasonable measures and a precise secret schedule.

• User-supplied content remains the user’s, subject only to a purpose-limited service license.

• Privacy, research, education, health, and child data are not converted into Company IP merely through possession or processing.

• Remedies track governing law and contract; arbitrary penalties and unproven statutory maxima are not presented as automatic debt.

• Each entity, owner, controller, processor, licensor, licensee, inventor, author, and custodian is identified correctly.

3. Definitions

Affiliate means an entity controlling, controlled by, or under common control with MMMmc. Affiliation does not merge liabilities or assets.

Authorized Purpose means the specific internal, evaluation, commercial, research, education, accessibility, support, or development purpose stated in a signed agreement.

Background IP means IP owned, controlled, or developed outside a particular project and identified as pre-existing or independently developed.

Company IP means IP that the applicable schedule and chain-of-title records establish is owned or exclusively controlled by MMMmc. It does not include Customer Content, third-party materials, open-source components, research-participant rights, or an individual’s pre-existing works merely because they appear in a repository.

Company Materials means Company IP, Confidential Information, documentation, credentials, demonstrations, prototypes, repositories, devices, data, meeting records, and other materials provided under restriction.

Confidential Information means nonpublic information marked confidential or reasonably understood to be confidential, including source and object code; private repositories; system and model architecture; prompts and workflows; algorithms; inventions; patent and copyright records; hardware and firmware; security designs; datasets; customer, partner, investor, grant and research information; pricing, strategy and forecasts; credentials and logs; meetings; and privileged material. It excludes information lawfully known without restriction, independently developed without use, rightfully received without duty, or public through no breach.

Consulting Deliverable means a report, design, recommendation, configuration, code, document, analysis, training, or other item expressly identified as a deliverable in a statement of work.

Customer Content means data, text, files, communications, instructions, code, designs, recordings, or other material a customer submits or directs MMMmc to process.

Foreground IP means IP first conceived, authored, developed, or reduced to practice in a defined project. Its ownership is determined by the governing statement of work and assignment, not by this label alone.

Improvement means an enhancement, adaptation, derivative, configuration, integration, invention, discovery, update, or modification relating to Company IP, subject to copyright, patent, trade-secret, contract, and inventorship law.

Intellectual Property or IP includes copyrights, patent rights, trade secrets, trademarks, service marks, mask-work rights, database rights, publicity rights, know-how, and other proprietary rights.

License means a current, express grant in a signed writing or recorded electronic acceptance identifying licensor, licensee, Licensed Materials, users, scope, purpose, territory if relevant, term, restrictions, data rights, fees, termination, and post-termination duties.

Licensed Materials means only the items expressly identified in a License. References to a product name do not automatically include source code, future versions, other modules, patents, data, models, tools, or know-how.

Open Source Software means code subject to a license approved by the Open Source Initiative or another source-available or community license requiring review.

Personal Data means information linked or reasonably linkable to an identified or identifiable person.

Professional Services means consulting, implementation, integration, configuration, training, research support, design, development, security, licensing, or advisory services supplied by MMMmc.

Repository means any version-control, code-hosting, development, artifact, package, deployment, backup, or collaborative coding environment, including GitHub, Replit, Webflow, cloud storage, and local clones.

Service Data means diagnostic, usage, security, performance, entitlement, configuration, and billing data generated by operation of the licensed service, excluding substantive Customer Content unless specifically disclosed.

Trade Secret means information meeting the statutory definition because it has independent economic value from not being generally known and is subject to reasonable measures to preserve secrecy.

Unauthorized Access means access without a current resource-, person-, purpose-, action-, and time-specific authorization or beyond such authorization. Technical permission, possession of credentials, receipt of a public link, administrator status, prior access, or a configuration mistake is not alone legal authorization.

Unauthorized Copy includes a clone, fork, mirror, export, download, screenshot, transcription, recording, cache, index, backup, snapshot, replica, embedding, dataset, or reconstruction outside a License.

User means a licensee, customer, evaluator, consultant, developer, employee, contractor, researcher, investor, partner, attendee, administrator, or other authorized recipient.

4. Corporate Separateness and Authority

MMMmc will maintain separate formation records, good standing, books, bank accounts, tax registrations, insurance, capitalization, contracts, payroll or contractor records, minutes/consents, systems, and financial statements. No payment owed to MMMmc will be invoiced or collected by Sensory Bridges without a documented agency or services agreement.

Only an officer or representative with actual written authority may grant a License, transfer IP, waive a restriction, settle a claim, accept a source-code contribution, or authorize institutional access. Oral statements, demonstrations, emails by nonauthorized personnel, and technical invitations do not expand a License.

Related-party transactions require written approval and commercially reasonable terms. Intercompany services, development, personnel sharing, expenses, data processing, and IP use must be documented and accounted for.

5. IP Asset Register and Chain of Title

MMMmc will maintain an attorney-supervised IP register. Each entry should include:

• Asset name and confidential description.

• Category: copyright, patent, trade secret, trademark, domain, dataset, hardware, software, model, documentation, or other.

• Creation, conception, reduction-to-practice, fixation, acquisition, and publication dates.

• Authors, inventors, contributors, employers, contractors, institutions, sponsors, and funding sources.

• Pre-existing materials, third-party materials, open-source components, and applicable licenses.

• Current owner, prior owners, assignment documents, work-made-for-hire language, and corporate approvals.

• Repository, device, account, and backup locations.

• Confidentiality measures, authorized persons, access history, and markings.

• Patent application, copyright registration, trademark filing, or domain record.

• Licensees, field, territory, exclusivity, sublicenses, royalties, encumbrances, and termination.

• University-resource, grant, employment, investor, partner, or research agreements that may affect rights.

• Evidence file, custodian, hash, and legal-hold status.

The register will separately address the Brooks Band applications and platform; hardware and firmware; Mirror Match; Founders Lab; AVVOF; GFOD; calculators; dashboards; prompts; algorithms; models; datasets; training materials; prototypes; and future unfiled innovations. Names alone are placeholders, not proof of ownership.

6. Copyright Policy

Copyright protects original expression fixed in a tangible medium; it does not protect ideas, procedures, systems, methods of operation, facts, or short phrases as such. MMMmc will identify protectable versions of source code, UI artwork, documentation, media, diagrams, written materials, databases, and other works.

Copyright ownership must be supported by authorship and assignment. For employee and contractor work, agreements must include appropriate work-made-for-hire language where legally available and a present assignment of all covered rights, including the right to register and enforce. Contributors must list pre-existing material and third-party dependencies.

Registration is not the source of copyright, but the Company will maintain a registration calendar because registration and timing affect suit, statutory damages, and attorneys’ fees. Marketing may say “copyrighted” when accurate; it may say “registered” only when the identified work and registration are verified.

The Company will preserve dated source history, releases, build artifacts, authorship records, deposits, notices, and publication dates. Material versions may be registered in coordinated groups after counsel review.

7. Patent and Invention Policy

Inventorship is determined by contribution to the claimed invention and cannot be reassigned by policy. Ownership may be transferred by a written assignment. Every contributor must submit a confidential invention disclosure and cooperate with novelty, prior-art, inventorship, ownership, and filing review.

The patent schedule must identify application number, filing date, inventors, applicant/owner, assignment, status, claims, countries, deadlines, public disclosures, grant or government rights, and product mapping. “Patent pending” may be used only for a product or process actually covered by a pending application and must be removed when no longer accurate.

No public demonstration, publication, offer for sale, grant report, investor disclosure, release, or open-source publication of a potentially patentable invention may occur before the IP lead reviews filing consequences. This restriction does not authorize unlawful concealment or misrepresentation.

Patent marking will be implemented only after counsel verifies the relevant issued claims, product mapping, and 35 U.S.C. § 287 requirements. False marking is prohibited.

8. Trade Secrets and Reasonable Measures

The Company will not describe an entire business or repository as a Trade Secret without specificity. For each asserted secret, the protected schedule identifies a nonpublic description, owner, creation, economic value, interstate-commerce connection, persons who know it, storage, markings, contracts, controls, suspected acquisition or use, loss, and current secrecy status.

Reasonable measures include:

• Need-to-know roles and periodic access reviews.

• Private repositories and branch protections.

• MFA, secrets management, encryption appropriate to risk, and logging.

• Approved devices and prohibition on unmanaged syncing.

• NDA, license, employment, contractor, investor, and partner restrictions.

• Confidential legends on high-risk materials.

• Meeting and visitor controls.

• Export, print, screenshot, and download restrictions where feasible.

• Vendor diligence and subprocessor flow-down.

• Exit interviews, access cutoff, return/deletion, and certification.

• Incident response, preservation, and enforcement.

Trade-secret obligations survive while the information retains legal Trade Secret status. A confidentiality term does not create trade-secret status if secrecy is lost or reasonable measures were absent.

9. Trademarks, Product Names, Domains, and Branding

MMMmc will maintain a mark and domain schedule identifying owner, first use, goods/services, specimens, filing/registration, licensees, quality controls, renewals, domains, social handles, and enforcement.

Sensory Bridges may use MMMmc marks only under a written trademark license with quality-control provisions. Unauthorized or naked licensing is prohibited. The symbols ™ and SM may be used for claimed marks; ® may be used only for an active registration covering the relevant goods or services.

10. Ownership of Improvements and Contributions

The governing agreement must allocate Background IP, Foreground IP, Improvements, Customer Content, feedback, deliverables, data, inventions, derivatives, and residual knowledge. No one may rely on a general handbook clause to take a customer’s or contractor’s pre-existing IP.

Unless a signed agreement states otherwise:

• MMMmc retains Company IP and general tools, methods, templates, libraries, know-how, and reusable components.

• The customer retains Customer Content and customer-owned Background IP.

• MMMmc receives a limited license to Customer Content only to perform and secure the services.

• Feedback may be used without restriction only after a conspicuous accepted clause and subject to privacy and confidentiality.

• Bespoke deliverables are licensed or assigned only as expressly stated after payment.

• Improvements to Company IP created by employees or contractors must be assigned under a valid invention-assignment agreement.

• Inventorship, moral rights, government rights, and nonwaivable employee-invention protections remain governed by law.

11. Intercompany License to Sensory Bridges

MMMmc and Sensory Bridges must execute an intercompany agreement covering:

1. Precise Licensed Materials and schedules.

2. Whether the license is exclusive, sole, or nonexclusive.

3. Field of use, products, territory, customer segments, and channels.

4. Rights to market, host, reproduce, distribute, modify, create derivatives, sublicense, support, research, and use marks.

5. Source-code custody and developer access.

6. Quality, regulatory, security, privacy, accessibility, and brand controls.

7. Customer Content and controller/processor roles.

8. Improvements, assignments, feedback, and patent prosecution.

9. Royalties, minimums, transfer pricing, records, audits, taxes, and expenses.

10. Warranties, indemnities, liability, insurance, and claims control.

11. Suspension, breach, cure, termination, sell-off, transition, insolvency, and source escrow if appropriate.

12. Enforcement authority, recoveries, settlements, and cooperation.

No intercompany term may be backdated to defeat third-party rights or misstate past ownership. Corporate approvals and accounting must match the effective date.

12. License Formation and Assent

No external License exists unless it is signed or accepted through conspicuous clickwrap or another legally recognized process. High-risk access—source code, private repositories, demos, APIs, beta software, investor rooms, research data, partner assets, and technical disclosures—requires affirmative acceptance before access.

The assent record must preserve user identity, organization, authority, agreement version, full text or immutable hash, date/time, IP/device evidence as appropriate, and the action manifesting consent. Browsewrap or a link in a footer is not used for high-risk obligations.

Changes apply prospectively. Material changes to paid terms require notice and, where required, renewed assent or an opportunity to cancel. A user’s prior access does not authorize future versions or unrelated products.

13. Standard Software License Grant

Subject to payment and compliance, MMMmc may grant a limited, nonexclusive, nontransferable, nonsublicensable license during the stated term to use the identified object-code software and documentation for the Authorized Purpose by the authorized users and devices.

All rights not expressly granted are reserved. No license is granted to source code, patents, trademarks, datasets, models, APIs, research, future versions, or other modules unless specifically listed. Delivery, demonstration, review, support, or access does not transfer ownership.

The licensee must maintain account security, restrict access, use supported versions, comply with export and privacy laws, obtain necessary user and recording consents, and ensure its users comply.

14. License Restrictions

Unless an express signed exception applies, a licensee must not:

• Copy beyond approved backup or operational use.

• Modify, translate, adapt, or create derivative works.

• Reverse engineer, decompile, disassemble, derive source, decrypt, emulate, or circumvent protections, except where nonwaivable law permits.

• Clone, fork, mirror, scrape, harvest, index, export, or reconstruct repositories, prompts, models, datasets, APIs, workflows, interfaces, or outputs.

• Remove or alter ownership, copyright, patent, trademark, or confidentiality notices.

• Rent, lease, sell, sublicense, assign, host for third parties, timeshare, bureau, or redistribute.

• Exceed authorized users, seats, devices, volume, rate, field, territory, purpose, or term.

• Use the software to build, benchmark, validate, train, or improve a competing product, model, service, or dataset.

• Access another user’s data, test vulnerabilities outside approved scope, evade limits, introduce malicious code, interfere with service, or conceal origin.

• Upload unlawful, infringing, privileged, regulated, or third-party content without authority.

• Use output as medical, legal, employment, educational, safety-critical, or other high-risk decision authority without qualified human review.

• Continue use or retention after termination.

15. Revocation, Suspension, and Termination

MMMmc’s desired control is implemented by access category:

• Free, demo, evaluation, beta, investor-room, prototype, test, and repository-review access is revocable at any time, with or without cause, subject to law, confidentiality, and preservation.

• Emergency suspension may occur immediately for suspected compromise, unlawful use, infringement, nonpayment, confidentiality breach, safety risk, sanctions, or material threat. The Company will provide notice and a review route when reasonably safe.

• Paid licenses may be terminated immediately for serious cause or after the cure period stated in the agreement. Termination without licensee breach must comply with the paid term and may require advance notice, transition, replacement, or pro-rata refund.

• Consulting access ends with the engagement unless extended in writing.

Revocation ends permission to use, not the duty to preserve evidence or honor accrued payment, confidentiality, data-protection, IP, dispute, and return obligations. The Company will not use revocation to erase customer data unlawfully or block a required export.

16. Post-Termination Return, Deletion, and Certification

On expiration, termination, or written demand authorized by the agreement, the recipient must stop use; revoke access within its control; return devices and originals; identify copies, repositories, branches, backups, recipients, and derivatives; return or securely delete Company Materials; and provide a signed certification if required.

Deletion is suspended for evidence subject to legal hold or lawful recordkeeping. Preserved material must be isolated, access-limited, and used only for the preservation purpose. Backups may remain until ordinary overwrite if they are protected and not restored to active use.

MMMmc may require a verified inventory within twenty-four hours only from a party contractually bound to that deadline. The demand must not require a person to destroy evidence, violate law, or access another party’s systems without authority.

17. Demonstrations, Evaluations, Betas, and Investor Materials

Every demo, evaluation, beta, prototype, investor room, and technical disclosure uses a written notice or clickwrap that identifies MMMmc, Authorized Purpose, duration, users, confidentiality, no-reliance status, no production use, no reverse engineering, no copying, data restrictions, feedback, monitoring, recording, return/deletion, and revocation.

Pre-release materials are provided “as is,” may contain errors, may change, and may never be released. Evaluation access does not include commercialization, publication, benchmarking, competitive analysis, training, procurement rights, or a future license.

Investor and due-diligence access is tiered. Highly sensitive source, customer, research, child, health, privilege, and security information is excluded or shared through a controlled review after NDA and need-to-know approval. Securities, confidentiality, and selective-disclosure issues require counsel review.

18. Repositories, Source Code, and Development Environments

MMMmc owns or controls only the Repositories identified in its asset register. Each Repository must have an organization owner, business owner, technical owner, authorized-user list, license, backup, retention, security, and offboarding record.

Controls include MFA; least privilege; separate admin accounts; protected branches; peer review; signed or provenance-traceable commits; secrets scanning; dependency and license scanning; release signing where feasible; audit logs; token rotation; export controls; and prohibition on personal mirrors.

No university, employer, customer, collaborator, or administrator may be granted blanket access based only on a role. Authorization is specific to Repository, branch, purpose, action, and time. Any institutional hosting or SSO arrangement must identify ownership, administrative authority, export rights, audit access, and post-separation retrieval.

19. AI, Models, Prompts, Training Data, and Outputs

Model weights, fine-tunes, prompts, system instructions, evaluation suites, workflows, retrieval configurations, embeddings, synthetic data, safety controls, and related tools may be Company IP or third-party licensed materials depending on chain of title.

No user may use Company Materials or outputs to train, fine-tune, distill, benchmark, reverse engineer, validate, or build a competing model or service without a signed License. The restriction does not claim ownership of facts or lawful independent development and is subject to nonwaivable law.

MMMmc will document model and dataset provenance, permissions, sensitive data, retention, opt-outs, vendor terms, human review, testing, limitations, and incident reporting. Customer Content is not used for general model training unless a clear, separate, lawful choice authorizes it. Commercial customer content will not be treated as training data merely because it passes through an AI feature.

AI output may be inaccurate, incomplete, biased, nonunique, or infringing. Users remain responsible for review and decisions. MMMmc does not guarantee ownership or exclusivity of output and will not make high-risk decisions without authorized human oversight.

20. Customer Content and Service Data

Customers retain ownership of Customer Content. They grant MMMmc a limited, nonexclusive, worldwide right to host, copy, transmit, format, process, and display Customer Content only to provide, secure, support, and improve the contracted service as disclosed, comply with instructions and law, and enforce the agreement.

MMMmc owns Service Data and may use it for billing, security, diagnostics, reliability, capacity, product analytics, and compliance, subject to privacy law and the agreement. Service Data will not include more substantive content than reasonably necessary.

Aggregated or De-identified Data may be used only with technical and contractual protections against re-identification and consistent with notice, consent, research, child, education, health, and customer restrictions.

21. Privacy and Data Roles

MMMmc may act as controller, processor/service provider, licensor, consultant, or subprocessor depending on the activity. The contract and data map must state the role. A license to software does not automatically authorize processing of Personal Data.

Privacy notices and DPAs must identify data categories, sources, purposes, recipients, subprocessors, retention, rights, security, cross-border transfers, AI/model use, children, research, biometrics, and health data. The Company will not state that it does not sell or share data unless SDKs, cookies, analytics, and vendors have been verified.

Where MMMmc processes data for Sensory Bridges, their DPA must address instructions, confidentiality, security, rights support, return/deletion, audits, subprocessors, incidents, location, and allocation of notice duties. Entity separation does not prevent privacy responsibility where law treats affiliates jointly.

22. Children, Education, Health, Research, and Biometric Restrictions

MMMmc’s general public software accounts are not intended for direct use by children under thirteen. If MMMmc supplies technology for a child-directed service, school, clinic, or research study, the operating entity must implement the applicable COPPA, FERPA, HIPAA, FTC Health Breach, research, biometric, and state-law framework before processing.

MMMmc will not use Child data, Education Records, PHI, consumer health data, research-participant data, voiceprints, therapy communications, accommodation records, or privileged material for general model training, advertising, or unrelated product development without specific lawful authorization.

Research use requires a protocol and consent where applicable. “Ongoing research” is not a universal license. A meeting or product interaction is not Research merely because the Company may learn from it.

23. Consulting Engagements

Professional Services require a master services agreement and statement of work identifying the correct contracting entity, scope, assumptions, dependencies, deliverables, milestones, acceptance, fees, expenses, schedule, change control, customer responsibilities, data access, IP allocation, confidentiality, security, publicity, warranty, liability, and termination.

MMMmc provides advice and deliverables based on information reasonably available. Unless expressly agreed, MMMmc does not act as the customer’s lawyer, clinician, fiduciary, employer, engineer of record, auditor, or regulatory decision-maker. The customer retains responsibility for business, medical, legal, education, employment, safety, and deployment decisions.

Consulting outcomes depend on timely information, access, decisions, testing, implementation, and participation. Delays or defects caused by missing customer dependencies adjust schedule and fees through documented change control.

24. Consulting Deliverables and Acceptance

The statement of work must identify whether each Consulting Deliverable is assigned, exclusively licensed, or nonexclusively licensed. MMMmc retains Background IP and reusable tools unless the agreement clearly states otherwise.

Acceptance criteria must be objective and tied to the agreed specification, not subjective satisfaction. A deliverable is accepted on written acceptance, productive use, or expiration of a stated review period without a specific material nonconformity notice. MMMmc will correct timely reported material nonconformities as the exclusive contractual remedy during the acceptance period, subject to nonwaivable law.

25. Fees, Payment, Taxes, and Expenses

Invoices identify MMMmc, the engagement, period, services, license, taxes, approved expenses, due date, and payment instructions. Customers may not offset disputed damages without written agreement or final determination. Late fees apply only as stated and lawful.

Recurring licenses disclose renewal, notice, cancellation, price changes, and refunds before purchase. Consumer auto-renewal law must be followed. MMMmc will not withhold customer-owned data or safety information unlawfully as payment leverage.

26. Participation, Outcomes, and Refunds

Software and consulting outcomes require accurate inputs, timely decisions, implementation, testing, training, and ongoing participation. MMMmc does not guarantee a business, educational, behavioral, clinical, accessibility, grant, funding, litigation, or financial outcome.

Unless an order form states otherwise, paid consulting time and completed milestones are nonrefundable. Prepaid unused services may be credited or refunded if MMMmc terminates without customer breach. Subscription refunds follow the product-specific policy and nonwaivable law.

If a product-specific outcome program uses Active Participation and Documented Adverse Outcome, those terms must be objectively defined in the customer terms. Safety complaints and adverse events are reviewed independently and never conditioned on continued participation or waiver. A refund does not admit causation and does not replace statutory rights.

27. Meetings, Recordings, Notetakers, and Work Product

Nonpublic technical, investor, customer, research, product, legal, and strategy meetings are confidential when covered by notice, NDA, or circumstances. Participants may not add a recording, notetaker, transcription, phone bridge, screen capture, or AI assistant without organizer authorization and legally required consent.

MMMmc may use an approved notetaker or recording only after advance and contemporaneous notice. If participant locations are uncertain or an all-party rule may apply, affirmative consent from all participants is required. A participant may object; MMMmc will offer an unrecorded alternative when feasible or explain before participation why recording is essential.

MMMmc owns the recording, transcript, summary, and notes it creates as a business record, subject to participant privacy, pre-existing IP, Customer Content, research consent, privileged material, and contractual data ownership. Participation does not transfer a speaker’s unrelated IP.

Use for research or model training requires separate lawful authorization. Records containing legal, therapy, medical, student, child, research, investor, or grant material receive heightened access and retention controls.

28. Confidentiality and NDA Standards

Every NDA identifies discloser, recipient, purpose, covered information, exclusions, use limits, care, permitted recipients, compelled disclosure, term, survival, return/deletion, residuals if any, feedback, no license, no obligation to proceed, equitable relief, and governing law.

Recipients must use Confidential Information only for the Authorized Purpose, limit disclosure to bound need-to-know personnel, protect it with reasonable care, report suspected compromise, and return or delete as required. Trade-secret duties continue while information remains a Trade Secret.

The NDA does not prohibit protected government reporting, whistleblowing, lawful process, employee discussion protected by law, or the federal trade-secret whistleblower immunity. Attorney-client privilege is not created merely by an NDA.

29. Acceptable Use and Security

Users must protect credentials, use MFA, keep systems supported, comply with scope, and report compromise. Users may not exceed authorization; intercept communications; create hidden accounts or integrations; scan outside approved scope; introduce malware; evade controls; scrape or clone; misuse Personal Data; upload protected content to unapproved AI; falsify origin or attribution; destroy evidence; infringe; or assist prohibited conduct.

MMMmc will maintain a risk-based written security program aligned to NIST, including asset inventory, data classification, least privilege, secure development, encryption appropriate to risk, secrets management, logging, vulnerability management, backup/recovery, vendor risk, incident response, and training.

Public security claims must reflect implemented controls. The Company will not promise universal AES-256, TLS 1.3, zero-trust, permanent logs, or on-device destruction unless verified for every relevant system and product.

30. Security Incidents and One-Hour Escalation

Employees, contractors, administrators, licensees, and vendors bound by this policy must report an actual or suspected Security Incident to the designated security and legal contacts immediately and within one hour of discovery. The report should identify persons, times, Accounts, devices, credentials, resources, files, repositories, data, actions, recipients, persistence, and known copies.

Within twenty-four hours, the incident lead will preserve evidence; contain access within Company control; document chain of custody and native metadata; identify affected data owners, controllers, licensors and institutions; engage counsel, insurer and forensics; assess notice; and create an initial inventory. The deadline is operational and contractual, not a statement that strangers or nonassenting parties owe that duty.

No person may delete logs or evidence, publicly attribute blame without support, or access another person’s system to investigate.

31. External Access, Universities, and UTC-Facing Controls

Any university, employer, customer, collaborator, or administrator accessing Company Materials must sign a resource-specific agreement. An Authorization Matrix must identify owner, administrator, data owner, credential issuer, user, resource, purpose, dates, written approvals, technical permissions, revocation, exports, and recipients.

Institutional authority over an institution-owned account does not automatically authorize access to unrelated personal accounts, MMMmc Resources, private devices, privileged communications, or third-party confidential information. Conversely, MMMmc ownership of Company IP does not authorize MMMmc to enter institutional systems without permission or legal process.

Contracts with institutions should require logging, named approval, IP and license compliance, incident notice, forensic preservation, verified accounting, privilege sequestration, no secondary use or model training, return/deletion subject to hold, access cutoff, downstream recipient notice, and cooperation with research, sponsor, partner, and regulatory obligations.

UT System IT0002 may permit monitoring of UT resources and access to certain connected systems or systems containing UT data after identified approval or legitimate grounds; it also limits users to authorized resources and purposes, protects copyright and licensing, prohibits interception and credential misuse, and requires respect for privacy and IP. UT IT0122 requires incident tracking, protection of forensic evidence, containment, recovery, and communication. These policies may inform a contract or factual inquiry, but they do not prove a past event and are not incorporated as admissions.

32. Unauthorized Access, Cloning, and Repository Response

Suspected cloning, mirroring, export, account takeover, endpoint duplication, hidden routing, co-ownership, impersonation, scraping, or access must be handled as an allegation until verified by native evidence.

The response team will:

1. Identify each asset, owner, custodian, authorization, system, and date.

2. Preserve Repository, identity, cloud, database, endpoint, network, meeting, and vendor logs.

3. Record tenant, object, correlation, session, user, device, IP, user-agent, token, branch, commit, clone, download, export, and permission data.

4. Determine whether access was technically possible, legally authorized, actually performed, exported, used, disclosed, or retained.

5. Separate personal, Sensory Bridges, MMMmc, university, customer, partner, research, child, grant, and privileged data.

6. Use a neutral forensic examiner where credibility, privilege, or multi-party systems require it.

7. Seek preservation, accounting, access cutoff, nonuse, return/deletion subject to hold, and certification through agreement or lawful process.

This policy supports evidence and reasonable measures; it does not retroactively create a breach by a person who did not assent or eliminate state immunity, authorization defenses, or proof requirements.

33. Evidence Preservation and Privilege

When litigation, a claim, administrative matter, security incident, research inquiry, or license dispute is reasonably anticipated, counsel will issue a scoped legal hold. Relevant auto-deletion, log expiry, email purge, backup rotation, source-history rewriting, device disposal, and data destruction must stop.

Potentially privileged material discovered outside expected channels must be sequestered without substantive review; recipients, access, copies, and decision-maker exposure must be identified; and counsel will determine clawback, nonwaiver, neutral review, or protective-order steps. Public communications must not reveal the substance of privileged advice.

34. Infringement, Misappropriation, and Remedies

MMMmc may seek actual remedies available under the accepted agreement and applicable law, including injunction, impoundment, return, destruction, access termination, accounting, actual loss, infringer profits, unjust enrichment, reasonable royalty, statutory damages where available, exemplary damages under statutory conditions, court costs, and attorneys’ fees where recoverable.

Copyright statutory damages are determined under 17 U.S.C. § 504 and depend on registration, timing, number of works, willfulness, and other facts. Trade-secret exemplary damages require statutory findings. CFAA civil relief requires statutory elements including qualifying loss. No user automatically owes the theoretical maximum or a sum multiplied across overlapping claims.

An agreed liquidated-damages clause may be used only in a separately negotiated business agreement after counsel confirms difficulty of estimation and reasonable forecast. It may not operate as punishment.

35. Attorneys’ Fees, Advancement, and Cooperation

A party proven by final judgment, arbitral award, written admission, or settlement to have materially breached accepted authorization, confidentiality, return, security, preservation, or IP terms must reimburse reasonable, documented, causally related legal and technical costs to the extent authorized by law or contract.

MMMmc may require defense and indemnity for third-party claims caused by a business customer’s Customer Content, instructions, unlawful conduct, or user misuse, with notice, defense control, consent to settlement, mitigation, and exclusions for MMMmc’s own fault.

An automatic $25,000 advance within thirty days based solely on accusation is not included. A negotiated B2B agreement may require reasonable advancement into counsel trust or neutral escrow after a written admission, neutral interim finding, court order, or other objective trigger.

36. Disclaimers

To the fullest extent permitted by law, software, evaluations, betas, and Professional Services are provided “as is” and “as available.” MMMmc disclaims implied warranties of merchantability, fitness for a particular purpose, title, and noninfringement, subject to express order-form commitments and nonwaivable law.

MMMmc does not warrant uninterrupted or error-free operation; exact measurements; compatibility with every platform; data preservation; successful implementation; or a particular business, educational, health, accessibility, grant, funding, litigation, or financial outcome. AI and automated output require human review.

Third-party platforms, devices, integrations, open-source components, institutions, networks, customers, and unauthorized actors are outside MMMmc’s control. MMMmc is not responsible for their independent acts except to the extent law or a signed agreement attributes responsibility.

37. Limitation of Liability

To the fullest extent permitted by law, MMMmc and its affiliates, licensors, and suppliers will not be liable for indirect, incidental, special, exemplary, punitive, or consequential damages; lost profits, revenue, goodwill, business opportunity, or data; substitute services; business interruption; or third-party conduct.

MMMmc’s aggregate liability arising from the affected license, subscription, product, or Professional Services will not exceed the amount the claimant actually paid to MMMmc for that affected license, subscription, product, or service during the twelve months before the event. If a zero-dollar cap is invalid, the minimum amount required by law applies.

The cap and exclusions do not apply to the extent prohibited and must be reviewed for death or personal injury, fraud, gross negligence, willful misconduct, nonwaivable privacy or consumer rights, infringement by MMMmc, confidentiality, and negotiated enterprise indemnities. Payments to Sensory Bridges do not increase MMMmc’s cap unless a signed agreement says so.

38. Mandatory Mediation

Before filing a covered contractual claim, a claimant must provide a detailed written notice to MMMmc’s legal-notice address. The parties will select a mutually acceptable mediator within ten business days and use good-faith efforts to hold the first confidential session within thirty calendar days after receipt. They may extend by written agreement for mediator availability.

Mediation does not bar emergency injunctions, preservation orders, account-security relief, administrative or regulatory reports, law-enforcement contact, nonwaivable small-claims rights, or filings needed to preserve a limitation period. Limitations tolling requires a signed writing.

Unless the signed agreement states otherwise, mediation will occur remotely or, if the parties agree to meet in person, in the Georgia county where MMMmc’s registered office is then located. Georgia law governs without depriving Consumers of mandatory protections. Litigation or arbitration after mediation is governed by the accepted agreement; arbitration is not imposed by this handbook alone.

39. Open Source and Third-Party Materials

Before incorporation or distribution, the Company will review open-source, source-available, model, dataset, media, font, SDK, and third-party terms. A software bill of materials identifies component, version, source, license, obligations, vulnerabilities, modifications, notices, source-offer duties, patent clauses, and distribution.

No employee may remove notices, misstate authorship, violate copyleft or attribution, use unlicensed code, or assume internet availability means free use. Inbound contributions require a contribution agreement or verified license.

40. Export, Sanctions, and Government Rights

MMMmc will screen applicable transactions for export-control, sanctions, encryption, restricted-party, end-user, end-use, country, and technology-transfer requirements. Access to source code, encryption, technical data, cloud systems, or services from another country may be an export.

Government-funded or sponsored work may carry Bayh-Dole, federal acquisition, data-rights, invention-reporting, march-in, license, publication, or record obligations. The award and agreement must be reviewed before asserting exclusive ownership.

41. Workforce and Contractor IP Protection

Every employee and contractor with access to Company Materials must sign confidentiality, acceptable-use, security, return, and invention-assignment terms before access. The agreement must identify pre-existing materials, present assignment, work-made-for-hire where applicable, cooperation, records, moral-rights treatment, open-source rules, and state-law notices.

Assignments must be limited to rights the Company may lawfully claim and may not seize unrelated personal creations. Employees retain protected whistleblowing, labor, government-reporting, and trade-secret-immunity rights.

Offboarding requires access cutoff, credential rotation, device and account inventory, return/deletion subject to hold, reminder of surviving duties, and confirmation of personal/pre-existing materials.

42. Accessibility, Ethics, and Professional Conduct

MMMmc will design software and documents toward WCAG 2.2 AA where feasible and contractually define accessibility commitments. Accessibility feedback and accommodation requests receive prompt review without retaliation.

Personnel must avoid deceptive claims, dark patterns, discrimination, conflicts, retaliation, fabricated provenance, hidden surveillance, unauthorized recording, and misuse of personal, research, child, health, therapy, grant, investor, or privileged data.

43. Records Retention

MMMmc will maintain a schedule for formation and governance; IP ownership; patents, copyrights and trademarks; source history and releases; licenses; contracts; accounting and tax; security logs; incidents; privacy requests; vendors; consulting; personnel; recordings; and legal holds.

IP and corporate records may require permanent retention. Sensitive Personal Data and meeting content should not be retained indefinitely merely because it may be useful. Retention is suspended by legal hold, regulatory, sponsor, safety, or contractual obligation.

44. Insurance and Risk Transfer

MMMmc will evaluate technology E&O, cyber, media/IP, professional liability, D&O, employment practices, crime, and umbrella coverage. Policies and contracts must be reviewed for affiliate coverage, contractual liability, IP exclusions, privacy events, retroactive dates, notice, consent to counsel, sublimits, and cooperation.

Licensees and critical vendors may be required to carry appropriate insurance and provide certificates, but insurance does not replace security or indemnity.

45. Governance, Audits, and Enforcement

The managing member will designate IP, security, privacy, contract, finance, and records owners. At least annually, MMMmc will review the asset register, assignments, registrations, licenses, access, open-source inventory, vendor list, data map, incident plan, insurance, and related-party transactions.

Violations are investigated impartially. Enforcement must be supported by evidence, proportionate, consistent, and legally authorized. The Company will not backdate ownership, fabricate assent, use self-help on third-party systems, destroy evidence, retaliate, or threaten automatic penalties not supported by law or contract.

46. Adoption and Acknowledgment

This handbook becomes effective only after written adoption by MMMmc’s authorized governing body and counsel review. Adoption identifies the exact entity name, formation state, effective date, superseded policies, officers, training, and version control.

Acknowledgment. I acknowledge receipt of this handbook and understand that it is not an employment contract, customer license, IP assignment, NDA, or retroactive obligation. I will comply with the provisions applicable to my role and the signed agreements governing my access.

Name: ______________________________ Role: _______________________________ Signature: __________________________ Date: _______________________________