服务条款 | PassportCraft

Effective Date: February 8, 2026 Last Updated: June 26, 2026 Version: 1.1.0

These Terms of Service ("Terms") form a legally binding agreement between you ("Customer," "you," or "your") and PassportCraft LLC, a New York limited liability company ("PassportCraft," "we," "us," or "our"), governing your access to and use of the PassportCraft platform, website, and related services (collectively, the "Service").

By creating an account, accessing, or using the Service, you agree to be bound by these Terms. If you do not agree, do not use the Service.

1. Scope and Acceptance

1.1 Business Use Only

The Service is designed exclusively for business-to-business ("B2B") use. By accepting these Terms, you represent and warrant that:

(a) You are acting on behalf of a business entity, not as a consumer.

(b) You have the legal authority to bind that entity to these Terms.

(c) Your use of the Service is for commercial or professional purposes related to product compliance, supply chain management, or regulatory obligations.

These Terms do not create any consumer rights or obligations. If you are a natural person acting outside the scope of a trade, business, craft, or profession, you may not use the Service.

1.2 Acceptance

These Terms become effective when you first create an account, click "I agree," or otherwise access the Service — whichever occurs first. If you are accepting on behalf of an organization, "Customer" refers to that organization. Acceptance is given by the Customer's explicit, affirmative action (such as creating an account or clicking "I agree").

By that explicit action, the Customer acknowledges that it has read, understood, and specifically accepts each of the following provisions, which the Customer recognizes as significant terms allocating risk and rights between the parties: Section 3.3 (Modifications to the Service); Section 3.4 (Beta and Preview Features, including the liability cap in Section 3.4(c)); Section 5.4 (Price Changes); Section 5.10 (Chargebacks and Payment Disputes); Sections 10.1 and 10.2 (limitation and exclusion of liability); Section 12.1 (Subscription Term and Renewal, including automatic renewal); Sections 12.4 and 12.7 (Termination and Suspension by PassportCraft); Section 17 (Modifications to These Terms); and Sections 18.2 and 18.3 (arbitration and choice of jurisdiction). Where the mandatory law of the Customer's country of establishment (for example, Articles 1341 and 1342 of the Italian Civil Code) requires that designated clauses of this kind be specifically approved, the Customer's explicit acceptance of these Terms, which separately identifies and approves the provisions listed in this Section 1.2, constitutes that approval to the extent permitted by that law. This Section operates together with Sections 18.4 and 19.2, and any provision that remains unenforceable under such mandatory law is treated as provided in those Sections.

1.3 Additional Agreements

Certain features of the Service may be subject to additional terms, including but not limited to:

A Data Processing Agreement ("DPA"), which governs the processing of personal data on the Customer's behalf.
Service-specific terms published on our website.

Where additional terms conflict with these Terms, the additional terms prevail for the relevant feature or service.

1.4 Order of Precedence

In the event of a conflict between documents, the following order of precedence applies (highest to lowest):

Data Processing Agreement (DPA)
An applicable order form, with respect to the commercial terms (such as price, plan, and scope) it expressly sets out
These Terms of Service
The Acceptable Use Policy and other service-specific terms or policies published on the website

1.5 Public Passport Pages and Visitors

The Service hosts publicly accessible DPP pages (Section 3.1(b)) that anyone may view, including by scanning a printed QR code. For the avoidance of doubt:

(a) Individuals who view or scan a publicly hosted DPP page are visitors, not "Customers," Authorized Users, or parties to these Terms. No account is created, and no agreement under these Terms is formed, by merely viewing a passport page. This is consistent with the business-only representation in Section 1.1.

(b) A visitor's interaction with a public DPP page is governed by our Privacy Policy, not by these Terms. The handling of any data collected when a visitor views or scans a public DPP page — including the limited scan analytics for which PassportCraft acts as data controller — is described in our Privacy Policy, available at https://passportcraft.com/privacy. We intend to surface a direct link to the Privacy Policy on the public DPP page itself.

(c) The content of each DPP page is supplied and controlled by the publishing brand (the Customer), which is solely responsible for its accuracy, quality, legality, and completeness (Section 6.4). PassportCraft does not verify or validate that content.

(d) A visitor who believes a DPP page contains unlawful or infringing content may report it as described in Section 9.3.

2. Account Registration

2.1 Eligibility

To create an account, you must:

(a) Be at least 18 years of age.

(b) Provide accurate, current, and complete registration information.

2.2 Account Security

You are responsible for:

(a) Maintaining the confidentiality of your account credentials.

(b) All activity that occurs under your account, whether or not authorized by you, except for unauthorized activity to the extent it results from PassportCraft's own breach of its security obligations (including a security failure for which PassportCraft is responsible under Section 10.7); this exception does not apply to activity by your Authorized Users (Section 2.3), for which you remain responsible.

(c) Notifying us promptly at security@passportcraft.com if you become aware of any unauthorized access to or use of your account.

(d) Promptly reporting to security@passportcraft.com any suspected security vulnerability, data breach, or credential compromise affecting the Service or your account that you become aware of.

(e) Not conducting any security, penetration, or vulnerability testing of the Service or its infrastructure without our prior written authorization. This obligation complements, and does not limit, the prohibition on unauthorized access in Section 9.1(e).

We are not liable for any loss or damage arising from your failure to secure your account credentials or from your misconfiguration of the Service or your own systems.

2.3 Customer Users

You may authorize individuals within your organization to access the Service under your account ("Authorized Users"). You are responsible for ensuring that all Authorized Users comply with these Terms and for any actions they take through the Service.

3. Service Description

3.1 Overview

PassportCraft provides a software-as-a-service platform that enables brands to create, manage, and host Digital Product Passports ("DPPs") in preparation for compliance with the EU Ecodesign for Sustainable Products Regulation ("ESPR") and related delegated acts. The Service includes:

(a) DPP Creation Tools — Structured data entry for product-level sustainability, compliance, and circularity information.

(b) Hosted DPP Pages — Publicly accessible product passport pages hosted on PassportCraft infrastructure.

(c) GS1 Digital Link QR Codes — Generation of QR codes conforming to GS1 Digital Link standards, linking to hosted DPP pages.

(d) Compliance Tools — Readiness assessments, data validation, and formatting tools to help structure DPP data in line with current regulatory guidance.

(e) Reporting and Analytics — Dashboards and reports on DPP page performance, scan activity, and data completeness.

(f) AI-Assisted Tools — Optional features that use artificial intelligence to help you draft and structure DPP content (for example, sustainability-claim rewriting and care-symbol suggestions). AI output is a suggestion that you must review before use, is provided without warranty as to accuracy, and is neither used to train our models nor used by our AI provider to train its models by default. See our Privacy Policy for details on how data submitted to these features is processed.

(g) AI Act and Transparency. The AI-Assisted Tools incorporate a third-party general-purpose AI model. The general-purpose AI model embedded in these tools is supplied by a third-party model provider that is itself subject to the provider-side obligations for general-purpose AI models under the EU Artificial Intelligence Act (Articles 53 and 55), applicable since 2 August 2025; as between the parties, PassportCraft acts as a downstream deployer and integrator of that model and is not the provider of a general-purpose AI model, and any provider-side obligations — including provider-side marking of synthetic output in a machine-readable format — rest with the model provider, not with PassportCraft. As between the parties, you act as the deployer and publisher of any DPP content you create with these tools, and you are solely responsible for any transparency, labelling, disclosure, or human-oversight obligations applicable to that content under the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), including the transparency obligations in Article 50 that apply from 2 August 2026. This includes any duty to disclose AI generation or manipulation, to exercise human review and editorial control over the content before publication, and any requirement that synthetic output be marked in a machine-readable format. PassportCraft makes no representation that AI output is, or is not, marked as synthetic, and you must not rely on the Service to satisfy any provider-side marking obligation. This Section 3.1(g) does not limit, and is in addition to, the prohibitions in the Acceptable Use Policy.

3.2 Service Availability

We use commercially reasonable efforts to make the Service available on a continuous basis. However, the Service may be temporarily unavailable due to scheduled maintenance, unscheduled emergency maintenance, or events beyond our control. We will make reasonable efforts to provide advance notice of planned downtime.

PassportCraft does not provide a binding uptime service-level commitment, and the availability efforts described in this Section are a target, not a warranty. Any liability of PassportCraft for unavailability of the Service is subject to Sections 10.1, 10.2, and 10.5 and (for Customers in the European Economic Area) Section 10.7, and PassportCraft has no obligation to provide service credits.

3.3 Modifications to the Service

We may update, modify, or discontinue features of the Service from time to time. If we make a material reduction in the core functionality of the Service that adversely affects your use, we will provide at least 30 days' prior notice. Such changes do not affect your rights under the termination provisions in Section 12.

3.4 Beta and Preview Features

From time to time we may make features available that are identified as "beta," "preview," "alpha," "early access," or by a similar designation ("Beta Features"). Beta Features are provided to give you early access to functionality that is still under development.

(a) Beta Features are provided "as is" and "as available," without warranties of any kind, and are excluded from the Service availability commitment in Section 3.2, the material-reduction notice requirement in Section 3.3, the warranties referenced in Section 10.5, PassportCraft's indemnification obligations in Section 11.2 (including the IP indemnity), and any support obligation. Your indemnification obligations in Section 11.1 continue to apply to your use of any Beta Feature.

(b) We may modify, suspend, or discontinue any Beta Feature at any time, with or without notice, and without liability.

(c) Subject to Sections 10.3 and 10.7, and to the maximum extent permitted by applicable law, PassportCraft's total aggregate liability arising out of or related to your use of any Beta Feature shall not exceed one thousand US dollars (USD $1,000). The exceptions in Section 10.3 do not lift this Beta cap; for Beta Features, this $1,000 cap controls, except that (i) it does not limit liability that cannot be limited under applicable law (Section 10.3(b)(vi)), including the matters made unlimited for Customers in the European Economic Area under Section 10.7, and (ii) it does not cap your own indemnification obligations under Section 11.1, which remain uncapped. Where a Customer is on the Free Plan, the $100 limit in Section 10.1 applies in the aggregate, and the $1,000 Beta limit in this Section 3.4(c) operates only as a ceiling and does not increase the $100 aggregate limit applicable to a Free-Plan Customer.

(d) AI-Assisted Tools (Section 3.1(f)) that are not designated as Beta Features remain governed by the no-warranty terms in Section 3.1(f); where an AI-Assisted Tool is designated as a Beta Feature, this Section 3.4 also applies.

4. Free Tier and Trial

4.1 Free Tier

PassportCraft offers a free tier of the Service ("Free Plan") with limited functionality, including a restricted number of SKUs and features. The Free Plan is:

(a) Available indefinitely, subject to these Terms.

(b) Provided "as is" without any service level commitments.

We reserve the right to modify or discontinue the Free Plan with 90 days' prior notice to affected accounts.

4.2 Premium Trial

We may offer a 14-day trial of premium features ("Trial Period"). During the Trial Period:

(a) You have access to premium features at no charge.

(b) The Trial Period does not automatically convert to a paid subscription. At the end of the Trial Period, premium features will become inaccessible unless you explicitly subscribe to a paid plan.

(d) We will notify you before the Trial Period expires so you can decide whether to subscribe.

4.3 No Dark Patterns

We do not engage in deceptive subscription practices. We will never:

(a) Automatically convert a trial into a paid subscription without your explicit consent.

(b) Make it unreasonably difficult to cancel, downgrade, or export your data.

5. Subscription and Billing

5.1 Subscription Plans

Paid access to the Service is available through subscription plans as described on our pricing page at https://passportcraft.com/pricing. Subscriptions may be offered on a monthly or annual basis.

5.2 Fees and Payment

(a) Fees for your selected plan are due in advance, as specified at the time of purchase.

(b) All fees are stated exclusive of applicable taxes unless otherwise indicated.

(d) If payment fails, we will notify you and provide a reasonable grace period (not less than 14 days) before suspending access to paid features.

(e) All fees are quoted and payable in the currency shown at checkout or on the applicable order form (currently euro (EUR)), and that currency controls. The US-dollar amounts elsewhere in these Terms (the Beta liability cap in Section 3.4(c) and the liability caps in Section 10.1, including the aggregate USD $25,000 ceiling and the Free-Plan cap) are stated for the limited purpose of denominating those liability limits only; they are not the billing currency.

(f) Late payment. Without limiting our other rights, any amount not paid when due accrues interest from the due date until paid at the lower of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law. You are responsible for all reasonable costs we incur in collecting overdue amounts, including reasonable attorneys' fees and collection-agency costs, to the extent permitted by applicable law. For Customers established in the EU/EEA, interest on overdue amounts and recovery of reasonable collection costs apply at least as provided by Directive 2011/7/EU as implemented in the Customer's member state. Interest and collection costs under this paragraph are themselves payment obligations under Section 5. We will not apply default interest under this paragraph to an amount that you are disputing reasonably and in good faith within the period and on the terms set out in Section 5.10(f) for so long as that dispute remains open.

5.3 Taxes

You are responsible for all applicable taxes, levies, and duties imposed by taxing authorities in connection with your subscription, excluding taxes on PassportCraft's net income. If we are required to collect or remit taxes on your behalf, those amounts will be invoiced and added to your payment.

5.4 Price Changes

We may change subscription pricing with at least 30 days' prior notice. Price changes take effect at the start of your next billing cycle following the notice period. If you do not agree with a price change, you may cancel your subscription before the new pricing takes effect.

5.5 Refunds

All payment obligations are non-cancelable and all fees paid are non-refundable, except:

(a) Where required by applicable law.

(b) Where you terminate for PassportCraft's uncured material breach under Section 12.2(a), in which case PassportCraft will refund the prepaid fees covering the remainder of the then-current term after the effective date of termination.

(c) Pro-rated refunds may be issued at our discretion for annual subscriptions terminated early for cause by the Customer.

(d) Where PassportCraft terminates for convenience under Section 12.4(d), in which case PassportCraft will refund the prepaid fees covering the remainder of the then-current term after the effective date of termination.

Re-performance or a refund offered for a performance or availability failure that does not result in termination is governed by the sole-and-exclusive-remedy provision in Section 10.8; this does not reduce the refund payable under Section 5.5(b) where you terminate for PassportCraft's uncured material breach under Section 12.2(a).

5.6 Usage Limits and Overage

Each subscription plan includes the usage limits (such as the number of SKUs, published DPP pages, or features) published on our pricing page or set out in your order form. If your usage exceeds those limits:

(a) You must either upgrade to a plan that accommodates your usage or pay overage fees for the excess at our then-current rates.

(b) Where we make overage fees available, we will charge them for the excess usage; where we do not, you must upgrade to continue using the Service within the applicable limits.

(c) Exceeding your plan's limits without upgrading or paying applicable overage fees may also be a ground for suspension under Section 12.7(a)(iii).

5.7 Usage Verification

To confirm that your usage is consistent with your subscribed plan, we may measure your usage of the Service through the platform's own metering and may ask you to confirm your usage figures or provide a brief written self-certification of relevant usage records. You agree to respond to any such reasonable request within a reasonable period. This is a lightweight, self-service confirmation right and does not entitle us to access your premises or systems.

5.8 Value Added Tax (VAT)

This Section supplements Section 5.3 with respect to VAT for Customers established in the European Union or the European Economic Area ("EU/EEA").

(a) All fees are stated exclusive of VAT.

(b) If you are a business established in the EU/EEA, you must provide a valid VAT identification number for your member state and keep it accurate and current.

(c) Where you are a VAT-registered business established in a member state other than the one from which the supply is treated as made, the supply is made under the reverse-charge mechanism: we will invoice you without VAT, and you are responsible for self-accounting for VAT in your member state at the applicable rate.

(d) If you do not provide a valid VAT identification number, or where the reverse-charge mechanism does not apply, we may charge, collect, and remit any VAT we are required to apply, and those amounts will be added to your invoice in accordance with Section 5.3.

(e) You authorize us to collect and process your VAT identification number for the purpose of correctly invoicing your subscription, as also described in our Privacy Policy.

(f) Withholding tax gross-up. All fees are payable in full without deduction or withholding of any kind, other than taxes on PassportCraft's net income (which remain PassportCraft's responsibility under Section 5.3). If you are required by law to withhold or deduct any amount from a payment to PassportCraft, you will increase the amount payable so that, after the required withholding or deduction, PassportCraft receives and retains the full amount it would have received had no withholding or deduction been required. You will provide PassportCraft with official receipts evidencing any amounts withheld and remitted, and will reasonably cooperate to enable PassportCraft to claim any available credit or refund.

5.9 Plan Changes (Upgrades and Downgrades)

If you change subscription plans during a billing cycle, the following applies, in line with how plan changes are processed through our payment processor:

(a) Upgrades. An upgrade to a higher-priced plan takes effect immediately and may be charged a prorated amount for the remainder of the current billing cycle.

(b) Downgrades. A downgrade to a lower-priced plan takes effect at the start of your next billing cycle. Because all fees are paid in advance and are non-refundable (Section 5.5), a downgrade does not entitle you to a refund or credit of fees already paid for the current term. PassportCraft may, in its discretion, apply any unused prepaid value from the higher tier as a credit toward future invoices, but is not obligated to do so.

(c) Relationship to other provisions. This Section addresses the money treatment of a plan change. The functional effect of a downgrade on your published DPP pages — including the published-page grace period — is governed by Section 13.5(b). Price changes initiated by PassportCraft (as distinct from a plan change you choose) are governed by Section 5.4.

5.10 Chargebacks and Payment Disputes

This Section applies to fees that are validly due. It is subject to the European Economic Area mandatory-rights provisions in Section 10.7 and does not purport to override any non-waivable consumer or statutory right.

(a) Contact us first. You agree to contact us at support@passportcraft.com to resolve any billing concern before initiating a chargeback, payment reversal, or dispute with your card issuer or bank.

(b) Chargebacks as a breach. A chargeback, payment reversal, or similar dispute initiated against fees validly due is a breach of your payment obligations under Section 5.2. A reversal of this kind is distinct from a genuine payment failure: the grace period in Section 5.2(d) applies only to genuine payment failures, not to the reversal of a payment that previously succeeded.

(c) Immediate suspension. Pending resolution of a chargeback or payment reversal on fees validly due, we may suspend your access immediately under Section 12.7(a)(ii), without the grace period in Section 5.2(d). The effect of such a suspension on the continued public availability of your published DPP pages is governed by Section 13.5(d), which limits unpublication of public pages while the dispute remains unresolved.

(d) Your continued liability. You remain liable for the reversed amount, together with any dispute, representment, or processing fee that our payment processor charges us in connection with the chargeback or reversal.

(e) Dispute handling. You authorize us to share relevant account and usage information with our payment processor and your issuing bank as necessary to investigate and contest the dispute.

(f) Time to dispute. You must notify us in writing of any good-faith dispute regarding an invoice or charge within sixty (60) days of the date we first bill that amount. After that period, the charge is presumed correct, and you bear the burden of demonstrating that an amount is not owed; this presumption does not extinguish, and is without prejudice to, any non-waivable statutory right you have to recover amounts that were not in fact owed or that were paid without legal cause. We will not treat the withholding of a charge that you are disputing reasonably and in good faith, and as to which you are cooperating diligently to resolve, as a chargeback or breach under this Section, provided you raised the dispute within the 60-day period. Default interest under Section 5.2(f) does not accrue on such a disputed amount while the dispute remains open.

6. Customer Data Ownership

6.1 Your Data Belongs to You

You retain full ownership of all data, content, and materials that you or your Authorized Users upload, submit, or input into the Service ("Customer Data"). This includes all product information, supply chain data, sustainability metrics, compliance documentation, and any other content provided by you for the purpose of creating Digital Product Passports.

Nothing in these Terms transfers ownership of Customer Data to PassportCraft.

6.2 Limited License to PassportCraft

You grant PassportCraft a limited, non-exclusive, non-transferable license to use, process, store, and display Customer Data solely as necessary to:

(a) Operate, maintain, and provide the Service to you.

(b) Generate, host, and serve your DPP pages and QR codes.

(d) Comply with applicable law or respond to valid legal process.

(e) Detect, prevent, investigate, and respond to security incidents, fraud, abuse, and violations of these Terms or the Acceptable Use Policy (Section 9 and Section 12.7), and otherwise protect the security, integrity, and operation of the Service, other customers, and third parties.

This license is:

Not perpetual — it terminates when your account is closed and your data has been deleted in accordance with Section 13.
Not irrevocable — you may revoke it by terminating your account.
Not transferable — we may not sublicense Customer Data to third parties except to sub-processors necessary for providing the Service, as documented in our DPA.

6.3 No Other Use of Customer Data

We will not:

(a) Sell, rent, or trade Customer Data to any third party.

(b) Use Customer Data for advertising, profiling, or marketing purposes.

(d) Re-identify any aggregated or de-identified data derived from Customer Data, or sell or otherwise make available any identifiable Customer Data. The permitted use of aggregated and de-identified data is described in Section 6.5.

6.4 Data Accuracy and Customer Backups

You are solely responsible for the accuracy, quality, legality, and completeness of Customer Data. PassportCraft does not verify or validate the substantive accuracy of data entered into Digital Product Passports.

You are also responsible for maintaining your own current backup copies of any Customer Data you regard as critical, using the export tools described in Section 13.1 or other means of your choosing. The Service is not a system of record or your sole repository for Customer Data. This responsibility is the backup obligation referred to in Section 10.7(d).

6.5 Service Data and Aggregated Data

PassportCraft may generate and use aggregated and de-identified data derived from use of the Service, provided that such data does not identify you, any individual, or any specific product. We may use this aggregated and de-identified data for any business purpose, both during and after the term of these Terms, including to operate, secure, analyze, and improve the Service and to create and publish benchmarks, statistics, insights, and reports. This Section 6.5 does not change our commitments in Section 6.3(a) (we do not sell or trade Customer Data) or in Section 3.1(f) (Customer Data is not used to train our models or our AI provider's models), which remain in full effect.

6.6 AI Output

This Section applies to output generated for you by the AI-Assisted Tools described in Section 3.1(f) ("AI Output").

(a) Ownership. As between you and PassportCraft, and subject to your compliance with these Terms and the Acceptable Use Policy, PassportCraft assigns to you all of its right, title, and interest (if any) in and to the AI Output generated for you. The qualifier "if any" reflects that AI Output may not attract intellectual property protection. Once AI Output is incorporated into your DPP content, it is treated as Customer Data under this Section 6. Nothing in Section 7.1 reserves to PassportCraft any ownership of AI Output, as distinct from the underlying models, algorithms, and Service.

(b) Non-uniqueness. Due to the nature of machine learning, AI Output is not unique. Other customers may submit similar input and receive the same or substantially similar output, and PassportCraft makes no representation that AI Output is original or exclusive to you. You are responsible for ensuring that any AI Output you publish does not infringe a third party's rights.

(c) Operational data about the AI-Assisted Tools. Nothing in this Section limits PassportCraft's right under Section 6.5 to use aggregated and de-identified data about the operation and performance of the AI-Assisted Tools (such as acceptance, rejection, latency, and error signals) to operate, secure, and improve those tools. This does not permit, and is subject to, the prohibition in Section 3.1(f) on using Customer Data to train PassportCraft's or its AI provider's models.

7. Intellectual Property

7.1 PassportCraft IP

PassportCraft owns and retains all rights, title, and interest in the Service, including but not limited to:

(a) The platform software, algorithms, interfaces, and infrastructure.

(b) The PassportCraft name, logo, trademarks, and brand elements.

(d) DPP page templates, layouts, and formatting (but not the Customer Data displayed within them).

No rights to PassportCraft's intellectual property are granted to you except the limited right to access and use the Service as described in these Terms.

7.2 Customer IP

You retain all intellectual property rights in Customer Data and any pre-existing materials you provide. PassportCraft claims no ownership over your product data, brand assets, or other proprietary content uploaded to the Service.

7.3 Feedback

If you provide suggestions, ideas, or feedback about the Service ("Feedback"), you grant PassportCraft a non-exclusive, perpetual, irrevocable, worldwide, royalty-free, fully transferable and sublicensable license to use, copy, modify, distribute, and otherwise exploit the Feedback for any purpose, including to develop, improve, and commercialize the Service and other products, without restriction and without any obligation, attribution, or compensation to you. Feedback does not include Customer Data.

7.4 Product Identifiers, QR Codes, and Resolvable URLs

The Service generates GS1 Digital Link QR codes that resolve to your hosted DPP pages (Section 3.1(c)).

(a) Your identifiers. You retain all rights in the GTINs and other product identifiers you use in, or supply for, the GS1 Digital Link. PassportCraft claims no ownership of those identifiers.

(b) License to QR artwork. PassportCraft grants you a non-exclusive, royalty-free, worldwide license to reproduce and use the QR code artwork generated for you on and in connection with your products, packaging, and related materials, for as long as the corresponding DPP page is hosted through the Service. This license is consistent with, and additional to, your limited right to use the Service in Section 7.1.

(c) Resolvable URL is not portable. The resolvable URL that a PassportCraft-generated QR code encodes points to PassportCraft infrastructure and is provided as part of the Service. It is not portable: PassportCraft does not currently offer a way to redirect, transfer, or self-host that exact URL after the Service ends, and a QR code encoding a PassportCraft URL will cease to resolve to live DPP data once the corresponding page is unpublished (see Section 13.5). You should take this into account before printing PassportCraft-generated QR codes on physical products. Your Customer Data and product identifiers remain exportable under Section 13, and you may generate new QR codes resolving to your own or another provider's infrastructure for any reprint.

8. Data Processing

8.1 Data Roles

With respect to Customer Data that contains personal data (as defined under the EU General Data Protection Regulation, "GDPR"):

(a) You are the data controller. You determine the purposes and means of processing personal data within Customer Data.

(b) PassportCraft is the data processor. We process personal data in Customer Data solely on your documented instructions and as necessary to provide the Service.

8.2 Data Processing Agreement

The processing of personal data under these Terms is governed by our Data Processing Agreement ("DPA"), which is incorporated by reference and available at https://passportcraft.com/dpa. The DPA includes:

(a) The nature, purpose, and duration of processing.

(b) The types of personal data and categories of data subjects.

(d) Sub-processor management and notification procedures.

(e) Data subject rights assistance obligations.

8.3 Sub-Processors

A current list of our sub-processors is maintained at https://passportcraft.com/dpa#annex-c--sub-processor-list. We will notify you of any changes to our sub-processor list at least 30 days before a new sub-processor begins processing Customer Data. You may object to a new sub-processor in accordance with the procedure set out in the DPA.

8.4 EU Representative

PassportCraft is a US-based company that offers services to EU businesses and processes personal data of EU residents, and is therefore subject to Article 27 of the GDPR. PassportCraft has appointed Data Protection Representative Limited (trading as DataRep) as its Data Protection Representative under Article 27 of the EU GDPR (for the EU/EEA) and under the UK GDPR and the Data Protection Act 2018 (for the UK). Individuals in the EU/EEA or the UK may contact DataRep about our processing of their personal data by email at datarequest@datarep.com (quoting "PassportCraft LLC" in the subject line), via the online form at www.datarep.com/data-request, or by post addressed to "DataRep" (not PassportCraft LLC) at any of its local offices across the EU/EEA and the UK (registered office: 77 Camden Street Lower, Dublin D02 XE80, Ireland). For questions about the PassportCraft product or your account, please contact us at privacy@passportcraft.com rather than DataRep. Full contact details are also set out in our Privacy Policy.

9. Prohibited Uses

9.1 General Restrictions

You may not use the Service to:

(a) Violate any applicable law, regulation, or third-party rights.

(b) Upload, store, or transmit any content that is unlawful, harmful, threatening, defamatory, obscene, or otherwise objectionable.

(c) Upload or process special categories of personal data as defined in Article 9 of the GDPR (data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation).

(d) Impersonate any person or entity, or misrepresent your affiliation with any person or entity.

(e) Interfere with, disrupt, or attempt to gain unauthorized access to the Service, its infrastructure, or other users' accounts.

(f) Use automated means (bots, scrapers, crawlers) to access the Service except through published APIs in accordance with our API documentation.

(g) Reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Service; provided that this paragraph (g) does not prohibit, and does not apply to, any act of decompilation, reproduction, translation, observation, study, testing, back-up, or error correction that you are entitled to perform under mandatory law that cannot be excluded by contract, including Articles 5(2), 5(3), and 6 of Directive 2009/24/EC (and the national laws implementing them), and only to the extent such law renders the restriction unenforceable.

(h) Resell, sublicense, or redistribute the Service to third parties without our prior written consent.

(i) Use the Service for benchmarking or competitive analysis without our prior written consent.

(j) Upload content that infringes any third party's intellectual property rights.

9.2 Enforcement

We may investigate suspected violations and may suspend or terminate accounts that violate these Terms, with or without notice depending on the severity of the violation. Any action under this Section will be on objective grounds (an actual or reasonably suspected violation) and, for Customers established in the European Economic Area, proportionate to the violation; this is subject to the suspension safeguards in Section 12.7 (including notice where practicable, restoration, and reactivation) and does not affect PassportCraft's liability for a wrongful suspension or unpublication under Section 13.5(f).

9.3 Reporting Infringing or Unlawful Content

Because the Service hosts publicly accessible DPP pages containing Customer Data (Section 3.1(b)), we provide a channel for third parties to report content they believe is infringing or unlawful.

(a) How to report. If you believe content hosted through the Service infringes your intellectual property rights or is otherwise unlawful, send a notice to abuse@passportcraft.com or legal@passportcraft.com that identifies the content (including the URL of the relevant DPP page), describes the basis for your complaint, and provides your contact details.

(b) Our response. We may remove or disable access to reported content, and we may scope any such action to specific Customer Data, DPP pages, or content in accordance with Section 12.7(a). We may forward the substance of a complaint to the affected Customer.

(c) Repeat infringers. We will, in appropriate circumstances and at our discretion, suspend or terminate the accounts of Customers who are repeat infringers of intellectual property rights, in accordance with Sections 12.4 and 12.7.

(d) EU Digital Services Act representative. For the EU/EEA, PassportCraft has appointed Data Protection Representative Limited (trading as DataRep) as its legal representative under Article 13 of the Digital Services Act (Regulation (EU) 2022/2065). Recipients of the Service, members of the public, and authorities may also contact that representative on matters arising under that Regulation, including reports of allegedly illegal content; its contact details are set out in our Legal Notice.

9.4 DMCA Notices (United States)

For copyright matters arising under United States law, PassportCraft has designated a copyright agent to receive notifications of claimed infringement under the US Digital Millennium Copyright Act (17 U.S.C. § 512(c)). Notices of claimed copyright infringement should be sent to:

Copyright Agent, PassportCraft LLC 418 Broadway, Ste N, Albany, NY 12207, United States Email: legal@passportcraft.com

The agent's complete contact details, including telephone number, are also listed in the US Copyright Office's DMCA Designated Agent Directory.

(a) Required contents. To be effective under 17 U.S.C. § 512(c)(3), your notice must be a written communication that includes substantially the following: (i) a physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed; (ii) identification of the copyrighted work claimed to have been infringed; (iii) identification of the material claimed to be infringing that is to be removed or access to which is to be disabled, with information reasonably sufficient to permit us to locate it (including the URL of the relevant DPP page); (iv) information reasonably sufficient to permit us to contact you, such as an address, telephone number, and email address; (v) a statement that you have a good-faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and (vi) a statement that the information in the notification is accurate, and under penalty of perjury, that you are authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

(b) Our response and counter-notification. On receipt of a valid notice, we may remove or disable access to the material as described in Section 9.3(b) and will, where appropriate, notify the affected Customer. A Customer whose material has been removed or disabled may submit a counter-notification under 17 U.S.C. § 512(g). Repeat infringers are handled as described in Section 9.3(c).

10. Liability Limitation

10.1 Liability Cap

To the maximum extent permitted by applicable law, PassportCraft's total aggregate liability to you for all claims arising out of or related to these Terms or the Service, whether in contract, tort (including negligence), strict liability, or otherwise, shall not exceed the lesser of (i) the total fees paid by you to PassportCraft during the 12 months immediately preceding the event giving rise to the claim, or (ii) twenty-five thousand US dollars (USD $25,000).

For Customers on the Free Plan who have not paid any fees, PassportCraft's total aggregate liability shall not exceed one hundred US dollars (USD $100).

10.2 Exclusion of Certain Damages

To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages, including but not limited to:

(a) Loss of profits, revenue, or business.

(b) Loss of data (except PassportCraft's obligations regarding Customer Data as set out in these Terms and the DPA).

(d) Cost of procurement of substitute services.

(e) Regulatory fines or penalties imposed on the Customer by any authority.

(f) Loss of use of the Service or of any data.

(g) Business interruption.

This exclusion applies regardless of whether the party was advised of the possibility of such damages and regardless of the legal theory on which the claim is based.

10.3 Exceptions

This Section allocates which of the limitations in Section 10.1 (the monetary cap) and Section 10.2 (the exclusion of indirect and consequential damages) apply to the categories below. It distinguishes the cap from the exclusion: lifting the exclusion for a category does not, by itself, lift the cap. (The separate Beta cap in Section 3.4(c) is governed by that Section, not by this Section 10.3.)

(a) Exclusion lifted; cap continues to apply (PassportCraft-side). The exclusion of damages in Section 10.2 does not apply to, but the monetary cap in Section 10.1 continues to apply to:

(i) PassportCraft's liability arising from its own gross negligence; and
(ii) PassportCraft's indemnification obligations under Section 11.2.

(b) Both the cap and the exclusion lifted (Customer-side and non-excludable). Neither the limitation in Section 10.1 nor the exclusion in Section 10.2 applies to:

(i) your payment obligations under Section 5;
(ii) your indemnification obligations under Section 11.1;
(iii) your breach of Section 9 (Prohibited Uses) or the Acceptable Use Policy;
(iv) liability for a party's willful misconduct or fraud;
(v) liability for death or personal injury caused by a party's negligence; and
(vi) any other liability that cannot be limited or excluded under applicable law (including, for Customers in the European Economic Area, the matters listed in Section 10.7(a)).

(c) No double recovery. Where a single liability falls within more than one paragraph of this Section, it is treated under the paragraph most favorable to the claiming party, and amounts recovered for the same loss are not duplicated.

10.4 Basis of the Bargain

The limitations and exclusions in this Section 10 reflect a reasonable allocation of risk between the parties and form an essential basis of the bargain between you and PassportCraft. The Service would not be provided without these limitations.

10.5 Disclaimer of Warranties

Except as expressly stated in these Terms, the Service is provided "as is" and "as available," without warranties of any kind, whether express, implied, or statutory. To the maximum extent permitted by applicable law, PassportCraft disclaims all implied warranties, including the implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, reasonable care and skill, title, non-infringement, and quiet enjoyment, and any warranties arising from course of dealing or usage of trade. PassportCraft does not warrant that the Service will be uninterrupted, error-free, or secure, or that it will meet your requirements. PassportCraft further makes no warranty as to the results that may be obtained from use of the Service, or as to the accuracy, completeness, reliability, or fitness for any regulatory or compliance purpose of any data, content, output (including AI Output), report, or assessment generated by, entered into, or obtained through the Service; the allocation of responsibility for such matters is set out in Sections 6.4, 14, and (for AI Output) 3.1(f) and 6.6. Except as expressly provided in the Data Processing Agreement and Section 10.7(d), PassportCraft does not warrant that Customer Data will be secure or will not otherwise be lost or altered. The availability efforts in Section 3.2 are a target and not an express warranty for purposes of this Section. Nothing in this Section excludes any warranty or right that cannot be excluded or limited under applicable law, including the mandatory statutory rights of Customers in their jurisdiction of establishment.

10.6 Third-Party Services

The Service may interoperate with, or link to, third-party services, websites, or resources that PassportCraft does not control (for example, sign-in identity providers or services you choose to connect). PassportCraft is not responsible for the availability, accuracy, content, or practices of any third-party service, and your use of any third-party service is governed by that third party's own terms and privacy policy. The sub-processors PassportCraft engages to provide the Service are addressed in our Data Processing Agreement and Sub-processor list.

10.7 Liability — Customers in the European Economic Area

This Section applies to and prevails over the rest of this Section 10 (including Sections 10.1, 10.2, and 10.3) and over the Beta cap in Section 3.4(c), for Customers established in the European Economic Area (including Germany), to the extent those provisions would otherwise be invalid under the mandatory law applicable to such Customers. It does not extend PassportCraft's liability beyond what that law requires.

(a) Unlimited liability. PassportCraft's liability is unlimited for: (i) intent (Vorsatz) and gross negligence (grobe Fahrlässigkeit); (ii) injury to life, body, or health; (iii) defects fraudulently concealed; (iv) any express guarantee given by PassportCraft; and (v) claims under the German Product Liability Act (Produkthaftungsgesetz) or other applicable mandatory product-liability law.

(b) Cardinal duties (slight negligence). For damage caused by slight (ordinary) negligence, PassportCraft is liable only for breach of an essential contractual obligation — that is, an obligation whose fulfilment makes the proper performance of these Terms possible at all and on whose fulfilment the Customer may regularly rely (a wesentliche Vertragspflicht or Kardinalpflicht). In that case, PassportCraft's liability is limited to the foreseeable damage typical for this type of contract. The fixed monetary cap in Section 10.1 does not further reduce that amount: liability under this paragraph (b) is limited to the foreseeable typical damage and is not additionally capped at the Section 10.1 figure.

(d) Loss of data. Liability for the loss or corruption of Customer Data caused by PassportCraft's breach is not excluded, but is limited to the cost of restoring the data from the Customer's most recent backup — that is, the data the Customer would have had if it had maintained backups consistent with its backup responsibility under Section 6.4.

(e) Relationship to the cap and to Section 10.3. For Customers to whom this Section 10.7 applies, the liability result is determined by paragraphs (a) through (d) of this Section, and the monetary cap in Section 10.1 and the exclusions in Section 10.2 continue to apply only to the extent they are not displaced by those paragraphs. The exceptions in Section 10.3 do not separately enlarge PassportCraft's liability beyond what paragraphs (a) through (d) of this Section provide; in particular, PassportCraft's indemnification obligations under Section 11.2 are subject to the same graduated limits as the rest of its liability under this Section (unlimited only for the matters in paragraph (a), limited to the foreseeable typical damage for the cardinal-duty matters in paragraph (b), and otherwise subject to the cap in Section 10.1), and your indemnification obligations under Section 11.1 remain uncapped as provided in Section 10.3(b). Where both this Section and Section 10.1 would limit the same liability, the more specific limit in this Section governs, and no amount is counted twice. Nothing in this Section limits the mandatory statutory rights referred to in Section 10.5.

10.8 Sole Remedy for Service or Availability Failure

To the maximum extent permitted by applicable law, where PassportCraft materially fails to provide the Service as described, your sole and exclusive remedy, and PassportCraft's entire liability, is, at PassportCraft's option, re-performance of the affected Service or a refund of the fees paid for the affected period. This Section is without prejudice to, and does not limit, the rights preserved in Sections 10.5 and 10.7. It is also subject to Section 13.5(f), and does not cut down PassportCraft's liability under Section 13.5(f) for a wrongful suspension or unpublication that was not attributable to your breach or non-payment. This Section applies only to a failure of performance or availability of the Service; it does not apply to, and does not limit your remedies for, PassportCraft's gross negligence or willful misconduct under Section 11.2(b).

11. Indemnification

11.1 Customer Indemnification

You agree to indemnify, defend, and hold harmless PassportCraft and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

(a) Customer Data, including any claim that Customer Data infringes or misappropriates a third party's intellectual property or other rights.

(b) Your use of the Service in violation of these Terms or applicable law.

(d) Any dispute between you and your end users, customers, or supply chain partners concerning DPP content.

(e) Any third-party claim by a consumer who viewed or scanned a published DPP page, or any action, investigation, or proceeding by a competent authority (including market-surveillance, consumer-protection, and greenwashing or unfair-commercial-practices enforcement) that names PassportCraft as host, arising out of or relating to the content, accuracy, legality, or substantiation of your published DPP data. This paragraph is the affirmative counterpart to the exclusion of regulatory fines and penalties in Section 10.2(e) and is consistent with Sections 6.4 and 14.2 and with the Acceptable Use Policy. This indemnity applies regardless of any allegation of PassportCraft's concurrent fault, except: (i) to the extent the claim is for death or personal injury (or, for Customers in the EEA, injury to life, body, or health) caused by PassportCraft's own negligence, this paragraph (e) does not apply and your obligation is excluded to that extent, consistent with Section 10.3(b)(v) and Section 10.7(a)(ii); and (ii) for any other claim, to the extent it is finally determined to have been caused by PassportCraft's own gross negligence or willful misconduct, in which case Section 11.2(b) governs that portion and your obligation under this paragraph (e) is reduced proportionally. Nothing in this paragraph (e) requires you to indemnify PassportCraft against liability that cannot be limited, excluded, or shifted under applicable law. For the avoidance of doubt, the personal-injury exclusion in this paragraph (e)(i) and the preceding non-excludable-liability sentence apply to the whole of this Section 11.1, and nothing in subparts (a) through (d) requires you to indemnify PassportCraft for death or personal injury (or, for Customers in the EEA, injury to life, body, or health) caused by PassportCraft's own negligence.

11.2 PassportCraft Indemnification

PassportCraft agrees to indemnify, defend, and hold harmless you and your officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

(a) A claim that the Service (excluding Customer Data and AI Output) infringes or misappropriates a third party's intellectual property rights.

(b) PassportCraft's gross negligence or willful misconduct in providing the Service.

For the avoidance of doubt, the indemnity in Section 11.2(a) does not apply to any claim arising out of or relating to AI Output (as defined in Section 6.6), whether or not it has been incorporated into Customer Data, which is addressed solely by Sections 3.1(f), 6.6, and 11.1(a).

PassportCraft's liability under this Section 11.2 is subject to the monetary cap in Section 10.1 as provided in Section 10.3(a), except that liability for PassportCraft's willful misconduct or fraud is not capped (Sections 10.3(b)(iv) and 10.3(c)), and, for Customers in the European Economic Area, the graduated limits in Section 10.7 apply (including unlimited liability for the matters in Section 10.7(a)). Your indemnification obligations under Section 11.1 are not subject to that cap, as provided in Section 10.3(b).

11.3 Indemnification Procedures

The indemnified party must:

(a) Promptly notify the indemnifying party in writing of the claim.

(b) Grant the indemnifying party sole control over the defense and settlement of the claim.

(d) Settlement consent. The indemnifying party may not, without the indemnified party's prior written consent, enter into any settlement or compromise that (i) imposes any monetary or non-monetary obligation, liability, injunctive relief, or restriction on the indemnified party, (ii) includes any admission of fault, wrongdoing, or liability by the indemnified party, or (iii) does not include an unconditional release of the indemnified party from all liability on the claim. Consent may not be unreasonably withheld only as to clause (i) monetary terms that the indemnifying party funds in full.

(e) PassportCraft's control of proceedings against it. Notwithstanding paragraph (b), where a claim is an action, investigation, or proceeding by a competent authority that names PassportCraft as a respondent or addressee, or where joint defense is required by law, PassportCraft may assume or retain control of its own defense using counsel of its choice. In that case the Customer continues to bear all reasonable costs and any resulting liability for which it is the indemnifying party, and the parties will cooperate and not impair each other's defenses. PassportCraft will keep the Customer reasonably informed of the status of the proceeding and consult with the Customer in good faith on material decisions. PassportCraft will not, without the Customer's prior written consent (not to be unreasonably withheld, conditioned, or delayed), enter into any settlement or compromise that imposes any monetary or non-monetary obligation or liability on the Customer, except for settlement terms that PassportCraft funds in full. Costs and liability borne by the Customer under this Section 11.3(e) are limited to those reasonably and proportionately incurred.

Failure to provide prompt notice does not relieve the indemnifying party of its obligations, except to the extent it is materially prejudiced by the delay.

11.4 IP Infringement Remedies

If the Service becomes, or in PassportCraft's reasonable opinion is likely to become, the subject of an intellectual property infringement claim, PassportCraft may, at its option and expense:

(a) Procure the right for you to continue using the Service.

(b) Replace or modify the Service to make it non-infringing while maintaining substantially equivalent functionality.

(c) If neither (a) nor (b) is commercially reasonable, terminate your subscription and refund any prepaid fees for the unused portion of the subscription term.

The remedies in this Section 11.4, together with the indemnity in Section 11.2(a), are PassportCraft's entire liability and your sole and exclusive remedy for any claim that the Service infringes or misappropriates third-party intellectual property rights.

12. Termination

12.1 Subscription Term and Renewal

(a) Annual subscriptions auto-renew for successive one-year periods unless either party provides written notice of non-renewal at least 30 days before the end of the then-current term. Each renewal term is at PassportCraft's then-current rates for the applicable plan. If the renewal rate is higher than your current rate, the 30-day notice and your right to cancel before the increase takes effect under Section 5.4 apply, and for Customers established in Germany or the EEA the protections in Section 12.5 continue to apply.

(b) Monthly subscriptions auto-renew each month unless you cancel before the start of the next billing cycle.

12.2 Termination for Cause

Either party may terminate these Terms immediately by written notice if the other party:

(a) Materially breaches these Terms and fails to cure such breach within 30 days after receiving written notice specifying the breach.

(b) Becomes insolvent, files for bankruptcy, or has a receiver or liquidator appointed.

12.3 Termination by Customer

You may terminate your subscription at any time by providing written notice through your account settings or by contacting us at support@passportcraft.com. Termination takes effect at the end of the then-current billing period.

12.4 Termination by PassportCraft

PassportCraft may terminate or suspend your access:

(a) Immediately, for violations of Section 9 (Prohibited Uses) that pose a risk to the Service, other users, or third parties.

(b) After 14 days' notice, for non-payment of fees after the grace period in Section 5.2(d) has elapsed.

(d) For convenience, on at least 90 days' prior notice. If PassportCraft terminates for convenience under this Section 12.4(d), PassportCraft will refund the prepaid fees covering the remainder of the then-current term after the effective date of termination, and the data export provisions in Section 13 (including the post-termination export window in Section 13.2 and the public DPP page continuity provisions in Section 13.5) apply. Termination for convenience under this Section 12.4(d) does not trigger the acceleration of fees in Section 12.6(b).

12.5 Germany-Specific Provisions

For Customers established in Germany: after the initial subscription term, your subscription extends on a month-to-month basis and may be terminated by either party with one month's notice to the end of any calendar month. This provision complies with Section 309 No. 9 of the German Civil Code (BGB) and takes precedence over the general renewal terms in Section 12.1 for German Customers.

For Customers established in Germany or elsewhere in the European Economic Area, the following also applies to changes to these Terms under Section 17, and prevails over Section 17 to the extent of any conflict: (a) PassportCraft will only make changes that are objectively justified, such as changes required by a change in law or regulation, the introduction of new or modified features, or reasons of security; changes to the core commercial terms (such as price, which is governed by Section 5.4) or that materially shift the balance of rights and obligations to your disadvantage are not made by deemed acceptance; and (b) for any such material change, the deemed-acceptance mechanism in Section 17.2 applies only together with the 30-day notice and your right to object and terminate at the end of the then-current billing period, and PassportCraft will draw your attention in the change notice to your right to object and to the consequence of not objecting.

12.6 Effects of Termination

Upon termination or expiration of these Terms:

(a) Your right to access and use the Service ceases immediately (or at the end of the billing period for non-cause termination).

(b) You must pay all fees accrued or payable as at the termination date. If PassportCraft terminates for cause under Section 12.2 or Section 12.4(a)-(b), or you terminate other than for PassportCraft's uncured material breach, all fees for the remainder of your then-current committed subscription term become immediately due and payable, to the extent permitted by applicable law. Such accelerated amount represents the committed fees you agreed to pay and is reduced by (i) a reasonable discount to reflect the accelerated, lump-sum payment and (ii) any costs and expenses PassportCraft reasonably saves, or could with reasonable effort save, as a result of not performing for the remainder of the term. You may show that PassportCraft's actually saved costs and expenses, or its actual loss, are lower than the accelerated amount, and PassportCraft will credit any amount so shown. This Section is intended as a genuine estimate of PassportCraft's loss and not as a penalty or forfeiture. A chargeback or payment reversal that is the subject of a good-faith dispute raised within, and handled in accordance with, Section 5.10(f) does not by itself constitute the material breach that triggers acceleration under this Section 12.6(b). Where a chargeback or payment reversal is the only asserted ground for acceleration, fees for the remainder of the committed term become immediately due and payable under this Section only after (i) the dispute is finally resolved against you (or you cease to pursue it diligently in good faith) and (ii) the cure period in Section 12.2(a) has run from PassportCraft's written notice of the resulting payment breach. This does not limit PassportCraft's right to suspend access under Section 5.10(c), subject to the public-page carve-out in Section 13.5(d). In no event does termination relieve you of any obligation to pay fees for the period before the effective date of termination.

(d) Sections that by their nature should survive termination will survive, including Section 5 (with respect to fees accrued or payable as at termination and Section 5.10), Sections 6 (Customer Data Ownership), 7 (Intellectual Property), 9 (Prohibited Uses) and the Acceptable Use Policy, 10 (Liability Limitation), 11 (Indemnification), 13 (with respect to the export window and deletion obligations), 14 (No Compliance Guarantee), 15 (Confidentiality), 18 (Governing Law and Disputes), and 19 (Miscellaneous), together with the Beta liability cap in Section 3.4(c) and any other provision that by its nature should survive.

12.7 Suspension of Access

In addition to, and as a less drastic alternative to, the termination rights above, we may suspend all or part of your access to the Service. A suspension may be scoped to your entire account, to an individual Authorized User, or to specific Customer Data, DPP pages, or content.

(a) Grounds for suspension. We may suspend access immediately, and without prior notice, where:

(i) there is a material violation of Section 9 (Prohibited Uses) or the Acceptable Use Policy, including a violation that poses a risk to the Service, other users, or third parties (consistent with Section 12.4(a));
(ii) there is a security risk, fraud, or other threat to the Service, our infrastructure, or other users, including where credentials may have been compromised;
(iii) your usage is anomalous or abusive in a way that degrades or threatens the stability, performance, or integrity of the platform, even where it does not constitute a breach of these Terms; or
(iv) suspension is required to comply with applicable law or a binding order, request, or requirement of a competent authority.

(b) Non-payment suspension. Suspension of paid features for non-payment follows the grace period in Section 5.2(d) and does not require the grounds in Section 12.7(a).

(c) Notice. Where practicable and not inconsistent with the grounds above or any legal requirement, we will give you notice of a suspension and an opportunity to address the cause.

(d) Effect during suspension. Suspension does not relieve you of your payment obligations, and fees continue to accrue during any suspension that is not attributable to a failure of the Service on our part.

(e) Restoration. We will promptly restore suspended access once the cause of the suspension has been resolved to our reasonable satisfaction.

(f) Escalation to termination. If the cause of a suspension is not resolved within a reasonable period, we may terminate your access under Section 12.4, in which case the 30-day post-termination export window in Section 13 applies.

(g) No liability for lawful suspension or termination. PassportCraft will not be liable to you for any suspension or termination of access carried out in accordance with Section 12.4, Section 12.7, or Section 5.2(d) (a "permitted action"), and a permitted action is not a breach of these Terms by PassportCraft. This paragraph does not limit your remedies for a suspension or termination that is not a permitted action, which remain governed by Section 10 (and, for Customers in the European Economic Area, Section 10.7), and does not affect the chargeback carve-out protecting public pages in Section 13.5(d).

13. Data Portability and Exit

13.1 Your Right to Export

You may export Customer Data at any time during the term of your subscription using the self-service export tools provided in the Service.

13.2 Post-Termination Export Window

Upon termination or expiration of your subscription:

(a) We will provide a 30-day post-termination window during which you can access and export your Customer Data through the Service's export functionality or by request to support@passportcraft.com.

(b) During this window, your access is limited to data export — you may not use other features of the Service.

13.3 Data Deletion After Export Window

After the 30-day export window:

(a) We will permanently delete all Customer Data from our active systems within 30 days.

(b) Customer Data may persist in encrypted backups for up to an additional 90 days, after which it will be permanently deleted.

(d) Notwithstanding the foregoing, PassportCraft may retain (i) Customer Data to the extent required to comply with applicable law, tax, or accounting obligations; (ii) information reasonably necessary to establish, exercise, or defend legal claims, or subject to a legal hold (Privacy Policy Section 7.2); (iii) records necessary to enforce these Terms or investigate fraud, abuse, or security incidents; and (iv) residual copies in routine backups until overwritten in the ordinary backup-rotation cycle. For personal data, this paragraph is subject to and consistent with Article 11 of the DPA, which prevails under Section 1.4; accordingly, the discretionary bases in clauses (ii) and (iii) apply to non-personal Customer Data and apply to personal data only where an exception under Article 17(3) of the GDPR independently applies. Any retained data remains subject to the confidentiality and security obligations of these Terms and the DPA and will not be used for any other purpose.

13.4 Transition Assistance

If you are migrating to another DPP provider, we will provide reasonable cooperation to facilitate the transition, including:

(a) Exporting data in standard formats compatible with common data exchange standards.

(b) Providing documentation of the data schema and export format.

Transition assistance beyond what is described in this section may be available as a paid professional service.

13.5 Public DPP Page Continuity on Exit

This Section describes what happens to your publicly hosted DPP pages, and to the GS1 Digital Link URLs that printed QR codes resolve to, when your access to the relevant pages ends. It applies in addition to, and does not change, the Customer Data export and deletion provisions in Sections 13.1 through 13.3.

(a) Only published pages are public. A DPP page is publicly viewable only while it is in a "published" state. Pages that are in draft, unpublished, suspended, deactivated, or any other non-published state are not served publicly. This behavior is designed to fail closed: where the Service cannot confirm that a page is published, the page is not shown publicly.

(b) Cancellation or downgrade (grace period). If you cancel your subscription or downgrade to a plan with a lower published-page limit, any published DPP pages above your new plan's limit may remain live for a grace period of at least 30 days, after which PassportCraft may unpublish the excess pages (oldest first). This paragraph reserves our right to unpublish excess pages; it does not obligate us to unpublish them or guarantee their continued availability. Any such grace period is separate from, and runs in parallel with, the 30-day post-termination Customer Data export window in Section 13.2.

(c) What an unpublished page shows. When a DPP page is unpublished (whether at the end of a grace period, on suspension, on termination, or otherwise), the page no longer displays your DPP data. In its place, the URL serves a neutral notice that the passport is no longer available, and the page is de-indexed from search engines. The URL is not turned into a generic error and does not continue to serve live DPP data.

(d) Suspension and non-payment. Where access is suspended (Section 12.7) or paid features are suspended for non-payment (Section 5.2(d)), the affected DPP pages may be unpublished and will then behave as described in paragraph (c) for the duration of the suspension. Pages may be restored on restoration of access under Section 12.7(e). However, where the only basis for suspension is a chargeback or payment reversal that you have initiated and that remains unresolved (Section 5.10), PassportCraft will not unpublish your published public DPP pages on that basis alone unless and until the dispute is resolved against you, even where it restricts your access to other features of the Service; this reflects that the continued public availability of a page is severable from gating your editing access.

(e) No paid continued-hosting option. PassportCraft does not currently offer a paid option to keep DPP pages live, or to keep PassportCraft-hosted resolvable URLs resolving to live data, after your access to those pages ends. The resolvable URL is not portable (Section 7.4(c)).

(f) Your responsibility for ongoing ESPR availability. You, not PassportCraft, are the economic operator and the party responsible for ensuring that a Digital Product Passport remains available for as long as required under the ESPR and any applicable delegated act (see Section 14.5). You are solely responsible for maintaining ESPR-compliant availability of your DPP data after your access to PassportCraft-hosted pages ends — for example, by exporting your Customer Data within the window in Section 13.2 and arranging a backup copy or alternative means of making the passport available (such as through another provider). The risk and consequences of any public DPP page or resolvable URL ceasing to be available are allocated to you, consistent with Sections 6.4 and 14.2. The allocation in this paragraph (f) does not apply to unavailability caused by PassportCraft's wrongful suspension or unpublication of a page that was not attributable to your breach or non-payment; PassportCraft's liability for any such unavailability is governed by Section 10 (and, for Customers in the European Economic Area, Section 10.7).

(g) Reactivation and return to compliance. You may return affected pages to published status — restoring their public availability and helping you return to ESPR compliance — by resolving the cause (for example, upgrading your plan or restoring payment) and re-publishing the affected pages from your account, subject to your plan's published-page limit.

13.6 Business Continuity and Wind-Down

This Section describes what we will endeavor to do if PassportCraft itself decides to cease operations, or becomes insolvent or subject to receivership. It supplements, and does not replace, your standing export rights in Sections 13.1 through 13.4 and your termination rights in Section 12.2.

(a) Advance notice and export window. If we make a decision to cease operating the Service, or on our insolvency or the appointment of a receiver, we will use commercially reasonable efforts to give you as much advance notice as is practicable in the circumstances and to keep the self-service export described in Sections 13.1 and 13.2 available for the export window before the Service is shut down, so that you can retrieve your Customer Data and product identifiers.

(b) Automatable export path. We maintain a documented, automatable bulk-export path for Customer Data and product identifiers that is designed to be operable with minimal staffing, so that export remains practical even during a wind-down.

(c) No escrow. PassportCraft does not provide source-code escrow or data escrow, and does not warrant that the Service or hosted DPP pages will remain available following our cessation of operations or insolvency. Consistent with Section 13.5(e) and (f), there is no paid continued-hosting option, the resolvable URL is not portable (Section 7.4(c)), and you remain solely responsible for ensuring the ongoing ESPR availability of your DPP data after the Service ends — including by exporting your Customer Data in good time and arranging an alternative means of making the passport available.

(d) Insurance. PassportCraft does not warrant that it maintains any specific cyber, errors-and-omissions, or technology-liability insurance coverage. Each party is responsible for maintaining whatever insurance it considers appropriate for its own business and risks.

14. No Compliance Guarantee

14.1 Tools, Not Legal Advice

The Service provides tools and templates to help you structure product data for Digital Product Passports. The Service does not constitute legal, regulatory, or compliance advice. PassportCraft is not a law firm, consultancy, or notified body, and no attorney-client or advisory relationship is created by your use of the Service.

14.2 Regulatory Compliance Is Your Responsibility

While PassportCraft strives to align the Service with current ESPR requirements and published guidance, we do not and cannot guarantee that your use of the Service will result in full compliance with the ESPR, any delegated act, the EU General Product Safety Regulation (Regulation (EU) 2023/988) (the "GPSR"), or any other product or product-safety regulation. Specifically:

(a) EU regulatory requirements for Digital Product Passports are still evolving. Delegated acts for specific product categories may not yet be finalized.

(b) Compliance depends on the accuracy and completeness of the data you provide.

(d) You should seek qualified legal counsel in the relevant jurisdictions for compliance advice.

(e) The Service hosts a digital information layer (the hosted DPP page and its GS1 Digital Link QR code). A Digital Product Passport, hosted page, or QR code does not by itself satisfy, and is not a substitute for, any physical product-labelling, marking, safety-warning, instruction, traceability, or responsible-person/economic-operator obligation that applies to your products under the GPSR, the ESPR or its delegated acts, or other applicable product law. You remain solely responsible for meeting all such physical and operational obligations.

14.3 Regulatory Changes

We make commercially reasonable efforts to update the Service to reflect published regulatory changes. However, we do not guarantee that the Service will be updated within any specific timeframe after a regulatory change is published. We will communicate known regulatory developments that affect the Service through our blog, email notifications, or in-platform notices.

14.4 Decision-Support Only — No Critical Reliance

The Service, including any output generated by the AI-Assisted Tools (Section 3.1(f)), is a decision-support tool only. It is not a substitute for independent verification or for qualified legal, regulatory, or compliance counsel.

(a) You must not rely on the Service or any AI output as the sole or final basis for any regulatory submission, public Digital Product Passport, legal determination, or other decision with legal or regulatory consequences.

(b) Before relying on any output, you must independently review and verify it and, where appropriate, seek qualified legal counsel in the relevant jurisdictions (consistent with Section 14.2(d)).

(c) You assume all risk arising from your reliance on the Service or any AI output. This Section reinforces the exclusion of regulatory fines and penalties in Section 10.2(e) and the disclaimers in Section 10.5.

14.5 ESPR Roles

With respect to Digital Product Passports created, managed, or hosted through the Service:

(a) You are the economic operator. You (or the entity on whose behalf you act) are the economic operator — the manufacturer, importer, authorised representative, or other responsible party — for each product for which a Digital Product Passport is created through the Service. You are the sole party responsible for compliance with the ESPR and any applicable delegated act, including for the accuracy, completeness, currency, legality, and ongoing availability of DPP content.

(b) PassportCraft is a software and hosting provider. PassportCraft provides software and hosting tools that enable you to create, manage, and host Digital Product Passports. PassportCraft is not, and does not assume the role or obligations of, an economic operator, responsible person, or other party with primary regulatory responsibility under the ESPR.

(c) Allocation of the "DPP service provider" role. As between the parties, the Customer is the economic operator and bears all primary regulatory responsibility under the ESPR, and PassportCraft acts only as the Customer's software and hosting provider. To the extent any function PassportCraft performs causes it to be treated as a "digital product passport service provider" within the meaning of Article 2(32) of the ESPR (an independent third party authorised by the economic operator to process DPP data in order to make it available), PassportCraft performs that function solely as the Customer's contractor on the Customer's instructions, and the Customer remains responsible for all economic-operator obligations and indemnifies PassportCraft under Section 11.1(e). This allocation between the parties applies regardless of how that role is characterised under applicable law.

(d) Data use. PassportCraft will not sell DPP data or reuse it beyond what is necessary to provide the Service to you. This paragraph is consistent with Sections 6.3 and 6.5.

15. Confidentiality

15.1 Definition

"Confidential Information" means any non-public information disclosed by one party ("Disclosing Party") to the other party ("Receiving Party") that is designated as confidential or that a reasonable person would understand to be confidential, including but not limited to:

(a) Customer Data.

(b) Business plans, pricing, product roadmaps, and financial information.

(d) The terms of any order or agreement between the parties (but not the existence of the relationship).

15.2 Obligations

The Receiving Party agrees to:

(a) Use Confidential Information only for the purposes of fulfilling its obligations under these Terms.

(b) Protect Confidential Information with at least the same degree of care it uses for its own confidential information, and in no event less than reasonable care.

(c) Limit access to Confidential Information to employees, contractors, and agents who need to know it and who are bound by confidentiality obligations at least as protective as those in this Section.

(d) Not disclose Confidential Information to any third party without the Disclosing Party's prior written consent, except as permitted under the DPA for sub-processors.

15.3 Exceptions

Confidential Information does not include information that:

(a) Is or becomes publicly available through no fault of the Receiving Party.

(b) Was already known to the Receiving Party before disclosure, without any obligation of confidentiality.

(d) Is rightfully received from a third party without restriction on disclosure.

15.4 Required Disclosures

The Receiving Party may disclose Confidential Information if required by law, regulation, or court order, provided it:

(a) Gives the Disclosing Party prompt notice (to the extent legally permitted) so the Disclosing Party may seek a protective order.

(b) Discloses only the minimum information required.

15.5 Duration

Confidentiality obligations survive termination of these Terms for a period of three (3) years, except that: (a) Confidential Information that constitutes a trade secret remains protected for as long as it qualifies as a trade secret under applicable law; and (b) Customer Data, and any personal data within Confidential Information, remain protected under this Section for as long as they remain non-public, consistent with PassportCraft's confidentiality and security obligations for personal data under the DPA (including DPA Articles 5.3 and 11), which prevail under Section 1.4.

16. Force Majeure

16.1 Excused Performance

Neither party shall be liable for any failure or delay in performing its obligations under these Terms (other than payment obligations) to the extent that such failure or delay is caused by events beyond the party's reasonable control ("Force Majeure Events"), including but not limited to:

(a) Natural disasters, fires, floods, earthquakes, or severe weather events.

(b) Epidemics, pandemics, or public health emergencies.

(d) Labor disputes or strikes (other than those involving the affected party's own employees).

(e) Failure of third-party telecommunications or power infrastructure.

(f) Government actions, regulations, or embargoes enacted after the date of these Terms.

(g) Cyberattacks or distributed denial-of-service attacks, provided the affected party maintained commercially reasonable security measures.

16.2 Obligations During Force Majeure

The affected party must:

(a) Notify the other party promptly of the Force Majeure Event and its expected duration.

(b) Use commercially reasonable efforts to mitigate the impact and resume performance.

16.3 Extended Force Majeure

If a Force Majeure Event prevents performance for more than 90 consecutive days, either party may terminate the affected portion of these Terms by written notice, with a pro-rated refund of any prepaid fees for the period of non-performance.

17. Modifications to These Terms

17.1 Changes by PassportCraft

We may modify these Terms from time to time. For material changes, we will:

(a) Provide at least 30 days' prior notice via email to the address associated with your account.

(b) Clearly identify what has changed and when the changes take effect.

17.2 Your Right to Object

If you do not agree with a material change, you may:

(a) Object in writing within 30 days of receiving notice.

(b) Terminate your subscription effective at the end of the then-current billing period without penalty.

If you do not object or terminate within the 30-day notice period and continue using the Service after the changes take effect, you are deemed to have accepted the updated Terms. We will include a reminder of this consequence in the change notification.

17.3 Non-Material Changes

We may make non-material changes (such as correcting typographical errors, updating contact information, or clarifying existing provisions) at any time by posting the updated Terms on our website.

18. Governing Law and Disputes

18.1 Governing Law

These Terms are governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of laws principles, and subject to Section 18.4 (Local Mandatory Law and Savings of Limitations). The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to these Terms.

18.2 Dispute Resolution — United States Customers

For Customers domiciled in the United States:

(a) Informal Resolution. Before initiating formal dispute resolution, both parties agree to attempt to resolve any dispute informally by contacting each other in writing and negotiating in good faith for at least 30 days.

(b) Binding Arbitration. If informal resolution fails, any dispute, controversy, or claim arising out of or relating to these Terms shall be settled by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules then in effect. The arbitration shall:

Be conducted by a single arbitrator.
Take place in New York County, New York, or remotely by agreement of the parties.
Be conducted in English.
Result in a written award that includes findings of fact and conclusions of law.

(c) Arbitration Award. The arbitrator's award shall be final and binding. Judgment on the award may be entered in any court of competent jurisdiction.

(d) Class Action Waiver. To the maximum extent permitted by applicable law, you agree that any dispute resolution proceedings will be conducted only on an individual basis and not in a class, consolidated, or representative action.

(e) Exceptions to Arbitration. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of intellectual property rights or confidentiality obligations.

(f) Small Claims Carve-Out. Notwithstanding the agreement to arbitrate, either party may bring an individual claim in a small claims court of competent jurisdiction if the claim qualifies for that court and is brought on an individual (non-class, non-representative) basis.

(g) Right to Opt Out of Arbitration. You may opt out of the agreement to arbitrate in Section 18.2(b) and the class action waiver in Section 18.2(d) by emailing legal@passportcraft.com with the subject line "ARBITRATION OPT-OUT" within 30 days after you first accept these Terms. Your notice must include your name, account email, and a clear statement that you wish to opt out of arbitration. A timely opt-out does not affect any other provision of these Terms, and any dispute will instead be resolved in the courts identified in Section 18.3(b). For this purpose, the forum-selection, consent-to-jurisdiction, and venue-waiver provisions of Section 18.3(b)–(c) apply to you as if set out in this Section 18.2, notwithstanding the chapeau of Section 18.3.

(h) Costs for small-value claims. For any claim seeking less than ten thousand US dollars (USD $10,000), the arbitration will, at your election, be conducted on a documents-only basis or by telephone or videoconference without an in-person hearing, and PassportCraft will pay any AAA filing and administrative fees and arbitrator compensation that exceed the filing fee you would have paid to commence the same claim in a court of competent jurisdiction, except where the arbitrator determines the claim is frivolous or brought for an improper purpose. This paragraph does not affect the class action waiver in Section 18.2(d).

18.3 Dispute Resolution — International Customers

For Customers domiciled outside the United States:

(a) Informal Resolution. The parties agree to attempt to resolve any dispute informally by negotiating in good faith for at least 30 days.

(b) Jurisdiction. If informal resolution fails, then, subject to Section 18.4 (Local Mandatory Law and Savings of Limitations): (i) any dispute that PassportCraft brings against you shall be subject to the exclusive jurisdiction of the state and federal courts located in New York County, New York, United States, to the extent such an exclusive choice of court is permitted by the law applicable to you (including, where applicable, Article 25 of Regulation (EU) No 1215/2012 (Brussels Ia) and the 2005 Hague Convention on Choice of Court Agreements); and (ii) any dispute that you bring against PassportCraft shall be subject to the non-exclusive jurisdiction of those same courts. This Section does not purport to override Article 25 of Brussels Ia, the Hague Convention, or any mandatory rule that entitles you to bring proceedings, or requires proceedings against you to be brought, in the courts of your country of establishment; where such a rule applies, New York is an additional permitted forum to the extent that rule allows.

(c) Consent to Jurisdiction. You consent to the personal jurisdiction of the courts identified in paragraph (b) and waive any objection to venue in those courts, to the extent permitted by the law applicable to you.

18.4 Local Mandatory Law and Savings of Limitations

(a) Nothing in this Section 18 limits any rights that Customers established in the European Union, the European Economic Area, the United Kingdom, or Switzerland may have under mandatory provisions of the law of their country of establishment that cannot be waived by contract.

(b) Where any limitation, exclusion, jurisdiction, arbitration, modification, or renewal provision in these Terms is unenforceable, deemed unwritten, or otherwise invalid under the mandatory law of the Customer's country of establishment — including, by way of example, the Unfair Contract Terms Act 1977 (United Kingdom), Articles 1171 and 1245 of the Code civil (France), Articles 1341 and 1342 of the Civil Code (Italy), and the Code of Obligations (Switzerland) — that provision applies only to the maximum extent that mandatory law permits, and the remainder of these Terms continues in full force and effect.

(c) In particular, where a limitation of liability or an exclusion of damages in Section 10 would be invalid as written under such mandatory law but a more limited restriction would be enforceable, the provision is to be read down and applied to the maximum extent that law permits, rather than disregarded in its entirety. This paragraph supplements the severability provision in Section 19.2 and, for Customers in the European Economic Area, operates alongside Section 10.7. Where, however, the applicable mandatory law voids such a provision in its entirety rather than permitting it to be partially upheld — for example, under the Unfair Contract Terms Act 1977 (United Kingdom), or where a clause is réputée non écrite (deemed unwritten) under French law — the read-down in this paragraph does not apply to that provision, and the fallback limitation in Section 18.4(d) applies instead.

(d) Fallback limitation. As a separate and severable term, and only where and to the extent the primary limitations and exclusions in Section 10 are held wholly unenforceable (and not merely read down) under the mandatory law applicable to you, PassportCraft's total aggregate liability to you for all claims arising out of or related to these Terms or the Service is instead limited to the greatest sum that is enforceable under that law, and in any event PassportCraft is not liable for the categories of indirect and consequential damages described in Section 10.2, in each case except for liability that cannot be limited or excluded under applicable law (including, for Customers in the European Economic Area, the matters in Section 10.7(a)). This paragraph is intended to operate as an independent term distinct from Section 10, so that the invalidity of a provision in Section 10 does not affect this paragraph.

18.5 Locating the Customer

(a) The dispute-resolution tracks in Sections 18.2 and 18.3 are determined by where the Customer is domiciled. The mandatory-law and savings provisions in Sections 18.4, 10.7, and 12.5 are determined by the Customer's country of establishment. A Customer may be domiciled in one country and established in another.

(b) Tie-break. A Customer that is both domiciled in the United States and established in the European Union, the European Economic Area, the United Kingdom, or Switzerland is treated as a United States Customer for purposes of Section 18.2 (and is therefore subject to the arbitration agreement in Section 18.2), except that the mandatory rights preserved by Section 18.4(a) and any liability provisions required by Section 10.7 continue to apply to that Customer according to its country of establishment. For the avoidance of doubt, a Customer that is domiciled in the United States is treated as domiciled in the United States for purposes of Section 18.2, whether or not it is also domiciled or established elsewhere; a Customer is treated as domiciled outside the United States under Section 18.3 only if it has no domicile in the United States.

19. Miscellaneous

19.1 Entire Agreement

These Terms, together with the DPA, the Acceptable Use Policy, and any applicable order forms or service-specific terms, constitute the entire agreement between you and PassportCraft with respect to the Service. They supersede all prior or contemporaneous communications, proposals, and agreements, whether oral or written, relating to the subject matter hereof.

Non-reliance. You acknowledge that, in entering into these Terms, you have not relied on any representation, statement, warranty, or assurance — whether in marketing materials, the website, sales communications, demonstrations, or otherwise — that is not expressly set out in these Terms, and any implied or extra-contractual warranty is disclaimed to the maximum extent permitted by law. This Section does not exclude or limit any liability for fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited under applicable law (including the mandatory statutory rights referred to in Section 10.5).

19.2 Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, severed from these Terms. The remaining provisions shall continue in full force and effect.

19.3 Waiver

The failure of either party to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision. Any waiver must be in writing and signed by the waiving party.

19.4 Assignment

You may not assign or transfer these Terms, or any rights or obligations hereunder, without PassportCraft's prior written consent. PassportCraft may assign these Terms to an affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, provided the assignee agrees to be bound by these Terms. Any attempted assignment in violation of this Section is void.

19.5 Notices

All notices under these Terms must be in writing and delivered by email:

To PassportCraft: legal@passportcraft.com
To Customer: The email address associated with your account.

A notice sent by email is deemed received on the day it is sent if sent on a business day before 5:00 p.m. in the recipient's time zone, and otherwise on the next business day, provided the sender does not receive an automated bounce or non-delivery message. However, for a Customer established in the European Economic Area, this deeming does not apply to notices of a price change (Section 5.4), of a material modification to these Terms (Section 17), or of termination or suspension (Sections 12.2, 12.4, and 12.7); any time period that runs from such a notice runs from the Customer's actual receipt of it. Day-sent deeming applies only to routine operational notices. The sender bears the burden of proving transmission (for example, by a sent-mail record); a delivery or read receipt is not required.

19.6 Independent Contractors

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between the parties.

19.7 No Third-Party Beneficiaries

These Terms are for the benefit of the parties and their permitted successors and assigns only. Nothing in these Terms confers any rights on any third party, except that the indemnified parties identified in Section 11 (each party's officers, directors, employees, and agents) are intended third-party beneficiaries of the indemnities in Section 11 and may enforce them.

19.8 Language

These Terms are drafted in English. If these Terms are translated into any other language, the English version controls in the event of any discrepancy or inconsistency.

19.9 Export Compliance and Sanctions

You agree to comply with all applicable export control and trade sanctions laws and regulations in your use of the Service. In addition, you represent, warrant, and covenant that you and your Authorized Users:

(a) are not located in, ordinarily resident in, or organized under the laws of any country or territory that is the subject of comprehensive economic sanctions or trade embargoes;

(b) are not identified on, and are not owned (50% or more) or controlled by any person identified on, any restricted-party list maintained by the United States (including the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons List and the U.S. Commerce Department's Bureau of Industry and Security Entity List), the European Union, the United Kingdom, or the United Nations;

(c) will not export, re-export, or otherwise provide access to the Service, directly or indirectly, to any such person, jurisdiction, or territory; and

(d) will not use the Service for any end-use prohibited by applicable export control or sanctions laws.

A breach of this Section 19.9 is a material violation of these Terms and entitles us to suspend or terminate your access under Section 12.7 and Section 12.4.

19.10 Government Use

If you are a government entity, additional terms may apply. Contact us at legal@passportcraft.com before using the Service.

19.11 Publicity

You grant PassportCraft a limited, non-exclusive, royalty-free, worldwide license to use your name and logo solely to identify you as a customer of PassportCraft on our website and in our marketing materials. This license is subject to your published trademark-usage guidelines, and all goodwill arising from such use inures to your benefit. This Section does not permit us to use any Customer Data, or to publish any quotation, testimonial, or case study about you, without your separate prior written consent. You may opt out of, or revoke, this use at any time by emailing legal@passportcraft.com, and we will discontinue the relevant use within a reasonable period. This Section is consistent with, and does not override, the confidentiality carve-out for the existence of the relationship in Section 15.1(d).

20. Contact Information

If you have questions about these Terms, contact us at:

PassportCraft LLC 418 Broadway, Ste N Albany, NY 12207 United States

Email: legal@passportcraft.com Website: https://www.passportcraft.com