MIQ Diagnostic Engagement Letter

Document ID: MIQ-ENG-001
Version: 2026-09-02 (published version; instrument form 1.4 web-published form, Section 7 pricing conformed to the 2026-09-02 Article IV-2 continuous-volume formula) Date: 2026-08-30
Client: [Client legal name]
MIQ entity: Mechanus IQ Ltd.

No statement in this letter represents outside legal, tax, accounting, insurance, lender, regulator, or professional approval.

[Date]

[Client legal name]
[Client address]
[Attention: Name and title]

Mechanus IQ Ltd. ("MIQ") is pleased to provide a no-fee diagnostic mini-audit for [Client legal name] ("Client") on the terms below.

1. Parties

1.1 MIQ. MIQ means Mechanus IQ Ltd.

1.2 Client. Client means the dealership, dealership group, RV dealer, finance office, or other automotive-retail operator identified above.

1.3 Authorized contacts. Each party will identify one business contact authorized to provide instructions, receive notices, and coordinate data exchange for this engagement.

2. Engagement Purpose

2.1 Purpose. MIQ will perform a limited, no-fee diagnostic review of operational export data to identify potential leakage, anomaly, documentation, workflow, or compliance-control signals that may justify a later paid statement of work.

2.2 No paid follow-on engagement by implication. This letter does not create a paid retainer, managed-service arrangement, Separate Fixed-Scope Service (as defined in the Master Services Agreement), or long-term services commitment and does not authorize paid services. No recovery, outcome, evidence, or reporting artifact creates a payment obligation. No paid Services, and no Client Data provisioning for a paid follow-on engagement, may begin until the parties execute all four required instruments: the Master Services Agreement, Data Processing Agreement, Statement of Work, and Source Access Request Agreement.

2.3 Mutual NDA is optional pre-MSA coverage only. The Mutual NDA is optional pre-MSA confidentiality coverage for a deliberate pre-MSA discussion only. It does not authorize paid services, data provisioning, data processing, source access, or any service scope and is not part of the required paid-start package.

2.4 No professional-advice engagement. MIQ does not provide legal, tax, accounting, audit, insurance, investment, employment, lending, regulator, OEM, or compliance-certification advice. Client remains responsible for obtaining advice from its own qualified professional advisors before taking decisions that require professional judgment.

3. Scope of Work

3.1 Diagnostic review. MIQ may review data categories listed in Schedule A, as available and approved by Client, to produce a limited diagnostic report.

3.2 Six-pillar lens. MIQ may organize observations against its customer-facing six-pillar model where the available data supports that mapping: Sales and Desking Optimization; F&I Revenue and Compliance; Cash Flow and Funding Velocity; Service and Warranty Recovery; Inventory and Market Intelligence; and Financial Structure and OEM Recovery. Monitoring and Governance remains MIQ's internal platform layer.

3.3 Excluded work. Unless separately agreed in writing, this engagement excludes live system access, credentialed DMS access, scraping, robotic process automation, customer outreach, employee interviews, legal analysis, tax analysis, forensic accounting attestation, insurance claims handling, lender communication, regulator communication, OEM communication, litigation support, formal audit assurance, production dashboard deployment, and ongoing monitoring.

3.4 Two-layer PII protection; customer PII must not enter the analytical layer. Before transfer, Client must use a dealer-side stripping tool or workflow to remove customer names, customer addresses, customer emails, customer phone numbers, full VINs, raw partial VINs, payment card data, bank account data, driver's licence numbers, social insurance numbers, credit bureau pulls, medical information, and other customer personal information. Client should use operational identifiers such as stock numbers, deal numbers, RO numbers, or other approved non-customer identifiers. MIQ operates an independent intake screen that checks each export and rejects detectable customer personal information fail-closed before the export is accepted into storage. Personal information identified at intake is not retained. This screening is a second protective layer: it supplements, and does not replace or transfer to MIQ, Client's stripping and confirmation obligations under the Source Access Request Agreement, and it is not a certification that an export is free of personal information or authority to analyze customer identities.

3.5 Personnel data. If personnel analysis is required, Client must use role labels, department labels, Client-assigned staff codes, or other pseudonymous identifiers unless MIQ expressly approves a narrower handling path in writing. MIQ will not ask Client to provide employee names or unnecessary employee personal information for a no-fee diagnostic review, and MIQ will not describe staff-coded analysis as legally anonymous unless later written authority supports that statement.

4. Client Responsibilities

4.1 Authority. Client represents that it has authority to provide the approved operational exports and that the exports may be used for this diagnostic purpose.

4.2 Data minimization. Client will provide only the minimum operational data necessary for the agreed diagnostic review and will remove customer personal information before transfer.

4.3 Export accuracy. Client is responsible for the accuracy, completeness, and lawful preparation of the data it provides. MIQ may identify data-quality concerns but does not certify the completeness of Client's systems of record.

4.4 No decision by report alone. Client will not use MIQ's diagnostic report as the sole basis for employment discipline, termination, customer action, lender disclosure, insurer disclosure, OEM escalation, regulator disclosure, public accusation, chargeback demand, clawback demand, or litigation position.

5. Data Transfer and Security

5.1 Approved source and transfer channel. Before Client provides real export data for this no-fee diagnostic, the parties must execute this letter, the applicable Data Processing Agreement, and the Source Access Request Agreement. The Source Access Request Agreement controls approved sources, exports, transfer manifests, stripping confirmation, and transfer channels. The default transfer channel is SFTP or another mutually approved secure transfer method. A one-time encrypted package may be used only through an Approved Transfer Channel under the Source Access Request Agreement, only if both parties approve that method in writing for the specific transfer, the password or key is sent through a separate approved channel, and no customer personal information is included. Client Data must be PII-stripped before handoff through either path.

5.2 No credentials. Client will not provide MIQ with DMS credentials, finance-portal credentials, OEM credentials, lender credentials, email credentials, or other account credentials under this letter.

5.3 Storage posture. MIQ's default storage, database, and primary compute posture is Canada-first. MIQ will not represent that all processing is exclusively within Canada unless the applicable written path excludes model-assisted cross-border inference or a Canada-resident inference path has been verified and stated in writing.

5.4 Model-assisted inference. No model-assisted inference over Client Data is authorized under this letter unless both parties approve it in a separate written instruction or a later data protection agreement or statement of work. If model-assisted inference is authorized, the written authorization must state whether it is excluded, client-authorized with disclosed cross-border inference, or performed through a verified Canada-resident inference path.

5.5 No public AI tool upload. MIQ will not place Client Data into public AI chat tools, general-purpose developer assistants, or training pipelines.

5.6 Safety stop. If MIQ reasonably believes a transfer includes prohibited data, unsafe data, data outside the agreed scope, or data that cannot be handled under this letter, MIQ may stop work until the parties agree on a corrected data path.

6. Deliverables

6.1 Diagnostic report. MIQ will provide a limited diagnostic report or briefing that may include observed issues, data-quality limitations, source-row references, methodology notes, confidence indicators, severity indicators, and recommended next steps.

6.2 Traceability. Each client-facing finding must include a source reference, method or algorithm identity, material assumptions or parameters, confidence or severity level, benchmark comparison, recommended action, and claim tag. If any mandatory field is unavailable, the output remains a non-deliverable internal signal and must not be delivered as a client-facing finding.

6.3 No assurance. The diagnostic report is not a financial audit, legal opinion, tax opinion, compliance certification, insurance opinion, lender attestation, regulator filing, OEM position, or forensic-accounting assurance report.

6.4 Presentation. MIQ may provide one remote presentation of the diagnostic report to Client's authorized business contacts.

7. Fees, Taxes, and Expenses

7.1 No fee for diagnostic mini-audit. The fee for the diagnostic mini-audit under this letter is CAD $0.

7.2 Expenses. MIQ will not charge expenses unless Client approves the specific expense in writing before it is incurred.

7.3 Taxes. No GST/HST/PST is charged on the CAD $0 diagnostic mini-audit fee. Applicable taxes may apply to approved reimbursable expenses or later paid engagements.

7.4 Later paid work. Any paid follow-on engagement requires the executed Master Services Agreement, Data Processing Agreement, Statement of Work, and Source Access Request Agreement. MIQ's Article IV-2 monthly retainer per rooftop is the greater of CAD $2,900 or (CAD $1,000 + CAD $75 x U), where U is measured monthly new-plus-used retail units. The executed SOW records the applicable trailing full-month window and eligible retail-deal count. Apply their quotient without rounding; round only the resulting per-rooftop quote once to whole cents, half up. A group pays the sum of all rooftop formula quotes less the applicable discount: 1 to 2 rooftops at list price; 3 to 5 at 10 percent; 6 to 10 at 15 percent; and 11 or more at 20 percent. The group discount applies to the sum of all Scoped Rooftops' formula quotes, including rooftops described as Enterprise. Round the discounted group total once to whole cents, half up. The CAD $2,900 per-rooftop minimum is applied before the group discount and is not reapplied to the discounted total. Core, Growth, Flagship and Enterprise are descriptive size labels only. They do not select another price, fee floor, capability or scope. The signed SOW defines scope and records the measurement window, units, formula quotes, rooftop count, group discount and contracted monthly retainer. Identified annual savings is ROI evidence only and never the price basis. The contracted retainer is fixed at signing for the SOW term and is not recalculated or re-billed because unit volume or recovery outcomes change. Remeasurement and repricing occur only at renewal under the authorized measurement rule. A fee-bearing scope, entity or rooftop change requires a countersigned SOW amendment and does not silently reprice an existing rooftop during the term. Recovery Receipts and outcome-proof records have no fee or invoice authority.

8. Confidentiality

8.1 Confidential information. Each party may receive business, operational, financial, technical, or commercial information that is confidential to the other party.

8.2 Use restriction. Each party will use the other party's confidential information only for the purpose of this engagement unless another written agreement allows a different use.

8.3 Disclosure restriction. Neither party will disclose the other party's confidential information except to its personnel and professional advisors who need to know the information for the engagement and are bound by confidentiality obligations, or as required by law. Client Data may be disclosed to contractors or service providers only where the disclosure is necessary for the engagement, consistent with Sections 5.3 and 5.4, subject to written confidentiality and security obligations, and not a transfer to public AI tools, model-training paths, or unauthorized subprocessors.

8.4 Aggregated learning. MIQ will not use Client Data for generalized benchmarking, model training, marketing claims, or aggregated learning unless Client expressly opts in through a separate written authorization.

9. Retention, Destruction, and Evidence Mode

9.1 Retention classes. Unless a later signed agreement changes the retention period, MIQ will apply the following retention schedule:

9.2 Mini-audit evidence mode. The no-fee diagnostic mini-audit uses source-row traceability, method notes, and internal quality controls. It does not activate a full evidence-chain regime unless a later signed agreement selects the applicable evidence mode and MIQ records verified production availability for every selected rail. Contractual selection alone does not make a rail live or available.

9.3 Destruction notice. MIQ will provide a written data-destruction notice within 30 calendar days after engagement termination and will provide milestone destruction confirmations where a retained class reaches its scheduled destruction date.

9.4 Legal hold. MIQ may suspend destruction where required by law, a valid legal hold, or a written professional-advisor instruction that Client confirms in writing.

10. Reliance and Risk Allocation

10.1 Client reliance. Client may use the diagnostic report to evaluate whether to pursue a later MIQ engagement or internal review. Client remains responsible for business decisions and for review by its own legal, tax, accounting, employment, insurance, lender, OEM, and regulator-facing advisors.

10.2 No guarantee. MIQ does not guarantee that the diagnostic review will identify all leakage, anomalies, recoveries, compliance issues, documentation defects, personnel issues, or control weaknesses.

10.3 Limitation of liability. To the maximum extent permitted by law, MIQ's total aggregate liability arising from or relating to this letter is limited to CAD $5,000.

10.4 Excluded damages. To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, punitive, or loss-of-profit damages arising from this letter.

10.5 Non-waivable liability. Nothing in this letter limits liability that cannot be limited by law.

11. Term and Termination

11.1 Term. This letter begins on the date of last signature and continues until MIQ delivers the diagnostic report or either party terminates it earlier.

11.2 Termination for convenience. Either party may terminate this letter by written notice. If Client terminates before providing usable data, MIQ has no obligation to produce a report.

11.3 Termination for unsafe data path. MIQ may terminate or suspend this letter if the data path is unsafe, outside scope, not authorized, or inconsistent with MIQ's privacy and evidence controls.

11.4 Effect of termination. Sections intended to survive, including confidentiality, data handling, retention, reliance limits, liability limits, and general terms, survive termination.

12. General Terms

12.1 Independent contractor. MIQ is an independent contractor and is not Client's employee, agent, fiduciary, auditor, legal advisor, tax advisor, accountant, insurance advisor, lender representative, OEM representative, regulator representative, or compliance officer.

12.2 No assignment. Neither party may assign this letter without the other party's written consent, except to a successor in connection with a merger, reorganization, or sale of substantially all assets.

12.3 Governing law. This letter is governed by the laws of the Province in which the Client's principal place of business is located and the federal laws of Canada applicable therein.

12.4 Entire agreement for diagnostic mini-audit. This letter, the applicable Data Processing Agreement, and the Source Access Request Agreement together form the entire agreement for the no-fee diagnostic mini-audit and supersede prior discussions about that mini-audit. The Data Processing Agreement controls privacy, security, retention, subprocessors, model inference, cross-border transfer, Client Data, return, export, and offboarding; the Source Access Request Agreement controls approved sources, exports, manifests, stripping confirmation, and transfer channels; this letter controls the diagnostic scope, deliverables, fees, reliance limits, and term.

12.5 Changes. Any amendment must be in writing and signed by both parties.

12.6 Counterparts and electronic signatures. This letter may be signed in counterparts and by electronic signature.

13. Acceptance

Accepted and agreed:

Schedule A: Approved Data Categories

Client should provide only approved, minimized, PII-stripped operational exports. No category is required unless selected in writing for Client's diagnostic scope. MIQ may narrow this list after reviewing Client's system capabilities.

Reliance Record

This is the client signature copy of the MIQ Diagnostic Engagement Letter. No statement in this letter represents outside legal, tax, accounting, insurance, lender, regulator, or professional approval.