Google Cloud and Google Maps Platform Additional Policy

1. The scope of the regulations and the role of service providers

This additional policy applies to the use of Google Maps Platform, location, route, environment, speech, translation, image recognition, document, data and other Google Cloud API services available on the AIOS Business interface. Powered by AIOS Business: Immunity Invest Holdings Plc. Google services are provided by Google in accordance with Google's terms and conditions.

The Google name, trademark, and services do not imply a partnership, endorsement, or joint venture between Google and AIOS Business. In addition to the terms of AIOS Business, the user must also comply with the Google terms and documentation applicable to him and the selected Google service.

2. Central AIOS connection and own Google Cloud project

Directly-initiated actions use a server-side protected Google Maps Platform API key set by the AIOS Business operator. The key is not received by the browser or the user.

For a service that requires an SDK, mobile app, own data set, own domain, or unique Cloud resource, the user must create their own Google Cloud project, billing account, API authorization, key restriction, or OAuth contribution. Google may invoice the project owner directly for the Google fees incurred in their own project; in such case, AIOS may only charge the separate AIOS service fee announced in advance.

The API key or service account JSON specified in the protected setting process of My project connection is stored separately and encrypted by AIOS for each organization, it is not displayed again later, and it can only be used for the specifically launched Google Cloud operation of the given workspace. When the connection is deleted, the stored credentials are also deleted.

The own project can also be connected with a Google OAuth connection. On the Google permission request page, the user selects the account and approves the requested authorizations; AIOS can only use the connection within the authorized scope and for the specifically initiated operation. Access can be revoked in the Google account or in the AIOS contact manager.

Verifying project connectivity does not create a Google Cloud project, automatically turn on an API, or change a billing account, IAM role, DNS, or domain. The owner of the project is responsible for the necessary settings on the Google side and the cost limits of his own project.

3. Package, balance and settlement

The $0 Demo package does not make any Google or other external API calls. A Google API call through a central AIOS connection requires an active paid plan and sufficient pre-loaded API balance.

The table shows the current published AIOS Business end-user unit prices in USD per 1,000 billable events. With a central AIOS connection, the displayed AIOS customer price is deducted from the API balance. With an own-project connection, Google bills the user's Google Cloud billing account directly.

For central AIOS usage, only the published AIOS customer price is deducted from the AIOS API balance. With an own-project connection, Google bills the user's own Google Cloud billing account, so Google's service charge does not affect the AIOS API balance.

The Starter, Business, and Enterprise base fees do not include unlimited Google API usage. The base subscription fee, AIOS API balance, and Google fees incurred in the user's own Google Cloud project are three separate items. Affiliate or partner commissions can only be calculated based on the base fee for the AIOS package; Google, AI, and API usage costs do not constitute a commission basis.

After failed authentication, missing authorization, disabled API, quota error, or a request rejected by Google, AIOS will not deduct a usage fee if no verified billable provider event has occurred. Google may apply a different billing rule in its own Google Cloud project, for which the project owner is responsible.

4. Security of API Keys and Access

API key, OAuth secret, provider password, or other credentials are prohibited in a task description, chat, document, or shared field. Authentication data can only be entered in the designated, protected setting process.

Your own Google Cloud key must be protected by application and API restrictions, IP, domain, Android or iOS restrictions if necessary. The user is obliged to apply the principle of the least necessary authorization, to review the key regularly and to withdraw it immediately in case of suspicion of unauthorized use.

The service account private key is a high-risk credential. The user can connect a service account created exclusively for this purpose, with minimal IAM rights, must monitor the use of the key, rotate or revoke it if necessary, and securely manage or delete the local copy.

A browser key limited to a domain and the necessary APIs can only be used for a map or visualization function running in a browser. Entering an unlimited server key, service account key, or OAuth secret in a browser field is prohibited.

5. Google Maps Content, Attribution and Display

Attribution, logo, legal reference and user information provided by Google must not be removed, hidden or modified in an ambiguous manner. Google Maps content must be clearly distinguished from AIOS, user and third-party content.

Google Maps content may not be copied, collected, sold, mass exported, used to train a model, or turned into a database that replaces the Google service. Display, storage and caching together with a map is permitted only according to the documentation and service-specific conditions of the given API.

6. Location, address and personal data

The user can only send addresses, coordinates, device locations or other data that can be legally handled to the Google APIs. If the location data is related to an identified or identifiable person, an appropriate legal basis, transparent information and, if necessary, consent must be provided in advance.

No personal data can be sent to Google when using the Maps Datasets API. Data from Address Validation, Geocoding, Geolocation, Places, Routes, Roads, environmental and other APIs may be subject to separate storage, caching and usage limits; the AIOS results view itself does not provide unlimited retention or reuse rights.

7. Route planning, navigation and safety

Route, traffic, weather, air quality, pollen, topography and other location-based results are informative and may be delayed, incomplete or inaccurate. They cannot be used as an exclusive source in an emergency, traffic safety, health, construction or other high-risk decision.

A real-time driving or navigation application can only be created in compliance with Google's security requirements. The user is responsible for compliance with local traffic, occupational safety, consumer protection and professional regulations, as well as for appropriate human control.

8. Special limitations of use

Air quality and pollen data may only be used for environmental risk, research, and routing purposes as permitted by Google. The Solar API is primarily used to support the feasibility, design, installation or user-requested offer of an energy system.

Places results are subject to specific permitted use cases in the EEA. Places Aggregate API results may not be used to make decisions that affect a person's housing, employment, credit, insurance or other rights.

The results of Cloud Natural Language, Speech-to-Text, Text-to-Speech, Translation, Vision, Video Intelligence, Document AI, Vertex AI, Dialogflow, and other AI services may be probabilistic, inaccurate, or incomplete. Audio, images, documents, or personal data may only be processed with a valid legal basis; human review is required for legal, health, financial, employment, or other significant decisions.

9. Service Change, Accuracy and Liability

Google APIs, endpoints, fields, quotas, fees, and terms may change, be restricted, or discontinued over time. AIOS transfers the verified price change in the published price list; provides information on significant changes according to the applicable rules.

AIOS does not guarantee the completeness, up-to-dateness or suitability of Google data for a given business purpose. The user is obliged to check the result, save his important work and have it reviewed by a suitable professional before using it with professional or legal consequences.

10. Suspension and logging

AIOS may automatically limit or suspend usage that threatens security, budget, quota, or compliance. Bypassing quotas, automated overloading, key sharing, unauthorized data collection and fee evasion are prohibited.

The service logs the billable event ID, organization, user, API name, time, status and the applied AIOS customer charge. The secret API key and full location data are not included in the usage log.

The My Project Connection log may contain the project ID, authentication type, name of the enabled APIs detected, the time and result of the verification, but not the full API key, private key, access token, or service account JSON.

Deleting a connection terminates the use of the authentication record stored in AIOS, but does not delete the user's Google Cloud project, Google-side logs, billing data, or resources. Deleting or stopping them must be done separately by the project owner on the Google Cloud interface.