Business Terms of Service

"End User" means an individual whose identity is verified through the Services at your request. "Customer Data" means data you or your End Users submit to the Services, including documents, images, chip data and verification results. "Order Form" means any written order, quote or plan selection that refers to these Terms. "Sandbox" is the test environment and "Production" the live environment.

These Terms, the Data Processing Agreement ("DPA") and any Order Form form one agreement. If they conflict, the Order Form prevails on commercial terms, the DPA prevails on the processing of personal data, and these Terms prevail on everything else.

You are responsible for all activity under your account, API keys and panel users. Keep API keys on your servers: they must never be embedded in browsers or mobile apps — the WebSDK uses short-lived session tokens for that purpose. Tell us without undue delay at info@idotta.com if you suspect a key or account has been compromised. We may rotate or revoke credentials we believe are compromised.

You decide why and for which End Users a verification is performed, and you are the controller of End User personal data. You are responsible for:

• having a lawful basis for each verification;
• obtaining any consent the law requires, including explicit consent to biometric processing where applicable;
• informing End Users, including by making our Verification Privacy Notice available alongside your own privacy notice;
• handling End User rights requests;
• ensuring human involvement in decisions where the law requires it.

You must not, and must not allow anyone to:

• use the Services for any unlawful, discriminatory or deceptive purpose;
• verify individuals without a lawful basis or without giving them the information the law requires;
• submit documents or images you know to be forged, or test attack techniques against Production without our written agreement;
• reverse engineer, scrape or copy the Services, publish benchmarks of them, or use them to build a competing product;
• use outputs or Customer Data to train machine learning models except as the law and your End Users' consent permit;
• circumvent rate limits, security controls or usage metering;
• resell the Services without our written agreement.

The Sandbox is for integration and testing; do not submit real personal data to it unless you have a lawful basis to do so. Sandbox sessions are not charged. Production access is enabled after your integration has been reviewed.

The Services are paid from a prepaid balance. Each verification feature that runs in a Production session (for example document verification, NFC reading, liveness or AML screening) is charged at the price shown in your panel or Order Form when it runs. You top up the balance in advance; if it is insufficient, new Production sessions may be refused.

Prices exclude taxes, which are your responsibility. We may change prices with at least 30 days' notice; changes do not affect charges already incurred. Top-ups are non-refundable, except where we terminate without cause, where these Terms say otherwise, or where the law requires a refund.

We improve the Services continuously and may change or retire features. We give at least 30 days' notice before removing a feature you actively use or making a backwards-incompatible change to a versioned API, unless the change is required for security or by law. We aim to keep the Services available, but unless an Order Form includes a service level agreement, no specific uptime is guaranteed.

Results are risk signals produced by automated checks and, where you use it, human review. No identity verification method is infallible: results may include false acceptances and false rejections, and documents or chips from some issuers cannot be verified. You remain responsible for your decisions and your regulatory obligations, including customer due diligence and sanctions compliance; the Services support them but do not replace them.

When we process personal data on your behalf, we act as your processor under the DPA, which forms part of these Terms. We apply the technical and organisational measures described on our Security page. We do not sell Customer Data, do not use it to train machine learning models, and never share it with other customers.

We own the Services, including software, models, documentation and trademarks. You receive a non-exclusive, non-transferable right to use them during the term for your internal business purposes. You own Customer Data and grant us the rights needed to provide, secure and support the Services. We may use feedback you give us without obligation.

Each party protects the other's confidential information with at least reasonable care, uses it only to perform these Terms, and discloses it only to personnel and advisers who need it and are bound by confidentiality, or where the law requires. This obligation survives termination for 5 years, and indefinitely for trade secrets and personal data.

Each party warrants that it has authority to enter into these Terms. We warrant that we provide the Services with reasonable skill and care. Except as expressly stated, the Services are provided "as is" and, to the extent the law allows, all other warranties are excluded, including fitness for a particular purpose and error-free results.

Nothing limits liability for death or personal injury caused by negligence, for fraud, or any other liability that cannot be limited by law. Otherwise, neither party is liable for loss of profit, revenue, goodwill or data, or for indirect or consequential loss, and each party's total liability arising out of or in connection with these Terms is limited to the fees paid or payable by you in the 12 months before the event giving rise to the claim. This cap does not apply to your payment obligations or to breaches of the acceptable use section.

You will defend and indemnify us against third-party claims arising from your breach of the acceptable use section, from verifications you perform without a lawful basis or the notices the law requires, or from your breach of law. We will defend and indemnify you against third-party claims that the Services, as we provide them, infringe that party's intellectual property rights.

Either party may terminate for convenience with 30 days' written notice, or immediately if the other party materially breaches these Terms and does not remedy the breach within 14 days of notice. We may suspend access immediately where needed to prevent a security incident, unlawful use or a serious breach of the acceptable use section, and restore it once the cause is resolved. On termination your access ends, unused balance is refunded only as described under Fees and payment, and Customer Data is deleted as set out in the DPA and our Data Retention Policy.

These Terms and any dispute arising from them are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except that either party may seek urgent injunctive relief in any competent court.

You may not assign these Terms without our consent; we may assign them to an affiliate or a successor. Neither party is liable for delays caused by events beyond its reasonable control. If a provision is unenforceable, the rest remains in effect. These Terms are the entire agreement on their subject. We may update them by giving at least 30 days' notice of material changes; using the Services after the effective date means you accept the update. Notices to us: info@idotta.com.