ARQIV TERMS OF SERVICE

1.1 "Customer"

means an end user who accesses customer-facing features of the Services (including receipt viewing, offer viewing, and related functionality).

1.2 "Merchant"

means a business or organization that uses the Services in a merchant-facing capacity (including dashboards, analytics, receipt operations, offers, or integrations).

1.3 "Order Form"

means an ordering document, statement of work, pilot agreement, or similar instrument that references these Terms and describes the Services, fees (if any), and applicable commercial terms.

1.4 "Receipt Data"

means item-level receipt and transaction information and associated metadata that is processed by the Services, including line items, timestamps, location identifiers, order identifiers, and related fields, whether sourced from a point-of-sale system, email, uploads, APIs, or other permitted sources.

1.5 "Third-Party Services"

means external services and platforms that interoperate with the Services, including Square and other integrations, and any providers used to host, operate, or support the Services.

1.6 "Square"

means the Square platform operated by Block, Inc., including its APIs, webhooks, OAuth authorization services, and related developer services.

2.1 Eligibility.

You must be at least 18 years old and capable of forming a binding contract to use the Services.

2.2 Account Registration.

You agree to provide accurate and complete information when registering and to keep your account information current.

2.3 Account Security.

You are responsible for maintaining the confidentiality of your credentials and for all activity under your account. You will promptly notify Arqiv of any unauthorized access or use.

2.4 Role-Based Access and Tenant Scoping.

The Services may support different roles and permissions. Merchant data is logically scoped to the applicable merchant tenant. You agree not to attempt to access data outside of your authorized scope.

3.1 Permitted Use.

Subject to these Terms, Arqiv grants you a limited, non-exclusive, non-transferable, revocable right to access and use the Services for your internal business purposes (Merchant) or personal use (Customer), as applicable.

3.2 Restrictions.

You will not, and will not permit any third party to:

• access or use the Services in a manner that violates applicable law or regulation;
• access, probe, scan, or test the vulnerability of the Services or any Arqiv systems without Arqiv's prior written authorization;
• circumvent or attempt to circumvent access controls, tenant isolation boundaries, or authentication mechanisms;
• reverse engineer, decompile, or disassemble the Services, except to the extent permitted by applicable law (and then only with prior notice to Arqiv to the extent permitted);
• interfere with or disrupt the integrity or performance of the Services, including by transmitting malware or harmful code;
• scrape, harvest, or extract data from the Services except as expressly authorized via the Services or documented APIs and applicable Order Forms;
• use the Services to send unlawful, deceptive, or unsolicited communications, or to violate marketing and messaging laws.

3.3 Rate Limiting; Abuse Prevention.

Arqiv may implement throttling, rate limits, request caps, and other controls to protect the Services and users. Arqiv may suspend or restrict access in response to suspected abuse, security risk, or violations of these Terms.

4.1 Pilot Nature.

Some or all of the Services may be offered as pilot, beta, or pre-release functionality. You acknowledge and agree that pilot Services may be modified, discontinued, or changed without notice, and may be subject to limited support.

4.2 No SLA.

Unless expressly stated in an applicable Order Form, the Services are provided without any service level commitment during the pilot period.

4.3 Feedback.

If you provide feedback, suggestions, or ideas regarding the Services, you grant Arqiv a perpetual, irrevocable, worldwide, royalty-free license to use, modify, and incorporate that feedback without compensation.

5.1 Authorization.

If you connect a Third-Party Service, you authorize Arqiv to access, process, and store data made available through that integration as necessary to provide the Services. OAuth state parameters are validated using HMAC-SHA256 to prevent CSRF attacks.

5.2 Square Connectivity.

Square webhook events are verified using HMAC-SHA1 signature validation (as required by Square's API specification) to ensure authenticity and prevent forgery. If you authorize Square connectivity, the Services may receive transaction-related events via Square's APIs and/or webhooks, queue events for processing, and create derived records (including receipts and analytics) within your tenant.

5.3 Third-Party Terms.

Your use of any Third-Party Service is governed by that third party's terms and policies. Arqiv does not control Third-Party Services and is not responsible for their availability, security, performance, data accuracy, API changes, or outages.

6.1 Your Data.

As between you and Arqiv, you retain your rights in your data. Arqiv does not claim ownership over Receipt Data or other content you provide or that is processed on your behalf.

6.2 License to Operate.

You grant Arqiv a non-exclusive, worldwide license to host, store, process, transmit, and display Receipt Data and other content solely to:

• provide, maintain, and support the Services;
• perform normalization, assume reasonable transformations, and generate analytics within authorized scopes;
• secure the Services, prevent fraud and abuse, enforce these Terms, and comply with applicable law; and
• improve and develop the Services (subject to Section 6.4).

6.3 Merchant Responsibilities.

Merchants are responsible for ensuring their collection and use of customer data, and any communications (including email/SMS), comply with applicable laws (including consumer protection, privacy, and marketing laws) and that required notices and consents are provided and obtained.

6.4 Aggregated and De-Identified Data.

Arqiv may create and use aggregated and/or de-identified data derived from use of the Services for analytics, product improvement, and operational metrics, provided that such data does not reasonably identify an individual Customer or a specific Merchant.

6.5 No Sale of Identifiable Receipt Data to Data Brokers.

Arqiv does not sell identifiable Receipt Data to data brokers. If Arqiv introduces any advertising or sponsored offer functionality in the future, Arqiv will do so consistent with applicable law and will provide appropriate disclosures and controls.

6.6 Ethical Use.

Arqiv is committed to responsible handling of receipt data and will not knowingly use the Services to facilitate unlawful discrimination or harmful profiling.

7.1 Privacy Policy.

Arqiv's collection and use of personal information is described in Arqiv's Privacy Policy (the "Privacy Policy"), which is incorporated by reference. If there is a conflict between these Terms and the Privacy Policy regarding personal information, the Privacy Policy governs.

7.2 Customer Controls.

Where available in the Services, Customers may have tools to access, export, or delete certain data. Arqiv will also respond to verified requests as required by applicable law.

8.1 Security Measures.

Arqiv maintains administrative, technical, and organizational measures designed to protect data processed through the Services, including access controls, encryption in transit (TLS 1.3), encryption at rest for sensitive data (AES-256-GCM for OAuth tokens), secure password hashing (scrypt), session management (30-minute idle timeout, 12-hour maximum duration), and monitoring/logging practices appropriate to the Services' risk profile.

8.2 No Absolute Security.

You acknowledge that no system is entirely secure. Arqiv does not guarantee that unauthorized access will never occur.

9.1 Merchant Offers.

If the Services enable Merchants to configure or deliver offers, promotions, incentives, or communications, the Merchant is solely responsible for: (a) offer content, eligibility rules, and fulfillment; (b) compliance with applicable laws; and (c) honoring applicable terms presented to Customers.

9.2 Arqiv Role.

Arqiv provides the technical platform. Arqiv is not the sponsor or issuer of Merchant offers unless expressly stated.

10.1 Fees.

Fees (if any) and payment terms are set forth in the applicable Order Form. For clarity, the Services may be provided at no cost during a pilot period, and may become paid thereafter pursuant to an Order Form.

10.2 Taxes.

Fees are exclusive of taxes. Merchants are responsible for applicable taxes, duties, and similar governmental assessments, except taxes based on Arqiv's net income.

10.3 Non-Payment.

Arqiv may suspend access for overdue undisputed amounts after providing reasonable notice.

11.1 Confidential Information.

"Confidential Information" means non-public information disclosed by one party to the other that is designated confidential or that should reasonably be understood to be confidential, including product plans, non-public features, security information, and pricing.

11.2 Obligations.

The receiving party will (a) use Confidential Information only to evaluate or use the Services, (b) protect it using reasonable care, and (c) not disclose it to third parties except to employees/contractors with a need to know and who are bound by confidentiality obligations.

11.3 Exclusions.

Confidential Information does not include information that is publicly available without breach, independently developed without use of Confidential Information, or lawfully received from a third party.

11.4 Compelled Disclosure.

Disclosure may be made if required by law, provided the receiving party gives notice (if legally permitted) and reasonably cooperates.

12.1 Arqiv IP.

The Services, including all software, designs, interfaces, documentation, and Arqiv trademarks, are owned by Arqiv and its licensors and are protected by intellectual property laws.

12.2 Your Materials.

You retain ownership of your trademarks and any materials you provide. You grant Arqiv the licenses necessary to display and use them to provide the Services.

12.3 No Implied Rights.

Except as expressly granted, no rights are granted by Arqiv under these Terms.

13.1 Suspension.

Arqiv may suspend or restrict access immediately if Arqiv reasonably believes: (a) your account is compromised; (b) your use poses a security risk; (c) you are violating these Terms; or (d) your use may harm Arqiv, the Services, or others.

13.2 Termination by You.

You may stop using the Services at any time. If you are a Merchant, termination may also be governed by an Order Form.

13.3 Termination by Arqiv.

Arqiv may terminate these Terms or an Order Form for cause if you materially breach and do not cure within a reasonable period (or immediately if the breach is not curable). Arqiv may also discontinue pilot Services with reasonable notice where practicable.

13.4 Effect of Termination.

Upon termination, your access rights cease. Arqiv may retain and delete data in accordance with the Privacy Policy, applicable law, and any applicable Order Form, including reasonable backup and audit retention practices.

15.1 Exclusion of Damages.

IN NO EVENT WILL ARQIV BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA, USE, OR GOODWILL, ARISING OUT OF OR RELATING TO THE SERVICES OR THESE TERMS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF ADVISED OF THE POSSIBILITY.

15.2 Liability Cap.

ARQIV'S TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATING TO THE SERVICES OR THESE TERMS WILL NOT EXCEED (A) THE AMOUNTS PAID OR PAYABLE BY YOU TO ARQIV FOR THE SERVICES IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS (US $100) IF NO FEES HAVE BEEN PAID.

15.3 Basis of Bargain.

The parties agree that these limitations are a fundamental basis of the bargain.

Some jurisdictions do not allow certain limitations; in that case, liability is limited to the maximum extent permitted by law.

16.1 Merchant Indemnity.

Merchants will defend, indemnify, and hold harmless Arqiv and its officers, directors, employees, and agents from and against any third-party claims, liabilities, damages, and expenses (including reasonable attorneys' fees) arising out of or relating to: (a) Merchant offers/promotions or Merchant communications; (b) Merchant's breach of these Terms; (c) Merchant's violation of law; or (d) Merchant content.

16.2 Customer Indemnity.

Customers will indemnify Arqiv from third-party claims arising out of the Customer's unlawful use of the Services or breach of these Terms.

17.1 Agreement to Arbitrate.

Except as provided in Section 17.6, you and Arqiv agree that any dispute, claim, or controversy arising out of or relating to these Terms or the Services (a "Dispute") will be resolved by binding arbitration administered by JAMS (or, if unavailable, the American Arbitration Association) under its applicable rules.

17.2 Arbitration Location and Procedure.

Arbitration will take place in Delaware, unless the parties agree otherwise. The arbitrator may conduct proceedings by video, telephone, or written submissions where appropriate.

17.3 Arbitrator Authority.

The arbitrator has exclusive authority to resolve Disputes, including the interpretation and enforceability of this arbitration agreement, except that courts may decide issues regarding the enforceability of the class action waiver.

17.4 Class Action Waiver.

YOU AND ARQIV AGREE THAT EACH MAY BRING DISPUTES AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, OR REPRESENTATIVE PROCEEDING.

17.5 Fees.

Arbitration fees will be allocated in accordance with the arbitration provider's rules, subject to applicable law. The arbitrator may award fees and costs as permitted by law.

17.6 Exceptions.

Either party may seek injunctive or equitable relief in a court of competent jurisdiction to prevent (a) unauthorized access to the Services or (b) misuse or infringement of intellectual property rights.

17.7 Opt-Out.

You may opt out of arbitration by sending written notice to Arqiv within thirty (30) days of the date you first accept these Terms. Your notice must include your name, the email address associated with your account (if any), a clear statement that you wish to opt out of arbitration, and your mailing address. Notices must be sent to: legal@arqiv.com, subject line "Arbitration Opt-Out." If you opt out, you and Arqiv agree that Disputes will be resolved in accordance with Section 18 (Governing Law; Venue). This opt-out does not affect any other provisions of these Terms, including Section 17.4 (to the maximum extent permitted by law).

19.1 Assignment.

You may not assign these Terms without Arqiv's prior written consent. Arqiv may assign these Terms in connection with a merger, acquisition, reorganization, or sale of assets.

19.2 Force Majeure.

Neither party is liable for delay or failure caused by events beyond reasonable control.

19.3 Severability.

If any provision is held unenforceable, the remainder remains in effect.

19.4 No Waiver.

Failure to enforce any provision is not a waiver.

19.5 Entire Agreement.

These Terms, the Privacy Policy, and any Order Form constitute the entire agreement between you and Arqiv regarding the Services and supersede prior agreements on that subject.

19.6 Changes.

Arqiv may modify these Terms from time to time. If we make material changes, we will provide notice (e.g., via the Services or email). Continued use after the effective date constitutes acceptance.