Terms of Use
Definitions
"Service" means Card Vault's tokenization vault, APIs/SDKs, and dashboard, including associated interfaces, systems, and documentation.
"Customer Data" means data you or your users submit to the Service, including payment information, token and transaction metadata, and logs tied to your use of the Service, but excluding Aggregated or De-identified Data.
"Personal Information" means information about an identifiable individual or information that can reasonably be linked to an identifiable individual, as interpreted under applicable laws (including Alberta PIPA and PIPEDA, where applicable).
"Aggregated Data" means information about groups or categories with results combined across multiple customers or over time such that no individual or customer is identified.
"De-identified Data" means information created by processing Customer Data to remove, obfuscate, or randomize personal identifiers such that it cannot reasonably be used to identify an individual.
"Confidential Information" means non-public information disclosed by one party to the other in connection with these Terms that is designated as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure, including Customer Data, the non-public features, architecture, security controls, and performance characteristics of the Service, pricing, and business plans. Confidential Information does not include information that: (i) is or becomes publicly available through no fault of the receiving party; (ii) was rightfully known to the receiving party without restriction before disclosure; (iii) is independently developed without use of the disclosing party's Confidential Information; or (iv) is rightfully obtained from a third party without a duty of confidentiality.
"Security Incident" means unauthorized access to or disclosure, alteration, or destruction of Customer Data in Card Vault's possession or control.
"Order Form" means an ordering document (including online sign-up flow) that specifies the Service plan, term, and pricing agreed between you and Card Vault.
"Subprocessor" means a third party engaged by Card Vault to process Personal Information on Card Vault's behalf to provide the Service.
1. About this Agreement
These Terms of Use (the "Terms") are a legal agreement between Card Vault Inc. ("Card Vault", "we", "us") and the customer identified in the account ("Customer", "you"). By creating an account, integrating our APIs/SDKs, or using the Card Vault dashboard and services (collectively, the "Service"), you agree to be bound by these Terms. If you are accepting on behalf of a company, you represent you have authority to bind that company.
2. Our Service and Role
Card Vault provides a platform to tokenize, store, and manage payment card data in a PCI DSS-compliant vault and to route transactions to third-party payment processors/gateways you choose. Card Vault is not a payment processor, acquiring bank, or merchant account provider and does not settle funds.
Your use of any processor, gateway, fraud or identity solution, or other third-party integration is governed by your agreements with those providers. You are responsible for enabling, configuring, and maintaining those relationships and for meeting their requirements. Features and integrations may be updated or deprecated from time to time.
3. Accounts, Access, and Support
You must provide accurate registration information and keep it current. You are responsible for all activities under your account and for safeguarding credentials, MFA devices, and API keys. Card Vault may, in its discretion, determine account ownership in the event of a dispute and may suspend access while ownership is being verified.
Card Vault provides technical support as described in the dashboard or documentation applicable to your selected plan.
4. Your Responsibilities
You will use the Service only for lawful purposes and in compliance with applicable laws and regulations, card-network rules, and the terms of any third-party services you enable.
You will maintain appropriate administrative, technical, and physical safeguards for your systems and environment, including maintaining your applicable PCI DSS scope and controls. You must never store CVV/CVC after authorization and must implement data minimization consistent with card-brand rules and law.
You will obtain all required notices and consents to provide personal data to Card Vault and to any third-party services you enable, and you will honor data subject requests where required.
5. Security, Privacy, and Data Processing
Card Vault will maintain commercially reasonable administrative, technical, and physical safeguards designed to protect Customer Data in its possession and to operate a PCI DSS-compliant vault. Where Card Vault processes personal information on your behalf, Card Vault acts as your service provider (processor).
Card Vault will notify you without undue delay after confirming a Security Incident affecting your data in Card Vault's possession and will provide information reasonably available to assist your obligations under applicable Canadian privacy laws, including PIPA/PIPEDA, to the extent applicable.
PCI DSS Acknowledgment. Card Vault acknowledges that it is responsible for the security of account data that it possesses or otherwise stores, processes, or transmits on your behalf, and for the security of account data to the extent that Card Vault could impact the security of your cardholder data environment, in each case in accordance with the PCI DSS requirements applicable to Card Vault as a third-party service provider. Upon your written request, and subject to reasonable confidentiality obligations, Card Vault will provide: (a) information regarding its current PCI DSS compliance status, including its Attestation of Compliance (AOC); and (b) a responsibility matrix describing the allocation of applicable PCI DSS requirements between Card Vault and its customers.
Confidentiality. Each party will protect the other party's Confidential Information with at least reasonable care, use it only to perform this Agreement, and not disclose it except to personnel, contractors, affiliates, and subprocessors with a need to know who are bound by written confidentiality obligations no less protective than these. Card Vault may use and process Customer Data solely to provide, maintain, and secure the Service, and as described in the Privacy Policy.
6. Subprocessors and Affiliates
Subprocessors and Affiliates. Card Vault may use affiliates and subprocessors to provide the Service. Card Vault remains responsible for their performance and will impose data-protection and confidentiality obligations no less protective than those in these Terms.
Notice of Material Changes. Card Vault will provide notice via the dashboard or email of any material addition of a subprocessor that processes personal information, describing the service category (e.g., hosting, email delivery, observability) and the primary processing region.
Confidential Identification on Request. Upon your written request and subject to reasonable confidentiality obligations (e.g., NDA or Trust Portal access), Card Vault will disclose the identity of the relevant subprocessor(s). If you reasonably object on data-protection grounds, the parties will discuss in good faith; if unresolved, you may terminate the affected portion of the Service and receive a pro-rata refund of prepaid fees for that portion.
7. Acceptable Use
You will not: (i) reverse engineer, decompile, or disassemble the Service or any component; (ii) access or monitor the Service using bots, scrapers, or other automated means without Card Vault's express written permission; (iii) attempt to bypass technical or access controls or test system vulnerabilities without Card Vault's prior written authorization; or (iv) publish or disclose non-public performance or benchmarking information about the Service.
CASL. If you initiate emails or SMS using the Service, you must comply with Canada's Anti-Spam Legislation (CASL), including consent, identification, and unsubscribe requirements.
8. Suspension
Card Vault may immediately suspend all or part of the Service if your use (i) is or may be harmful to Card Vault or any third party; (ii) presents an unacceptable level of risk (including security, fraud, chargeback, or regulatory risk); (iii) degrades or threatens the security, stability, or reliability of the Service or any third-party system; (iv) enables or facilitates illegal or prohibited transactions; or (v) otherwise breaches these Terms. Card Vault will restore access when the issue is resolved to Card Vault's reasonable satisfaction.
9. Fees and Taxes
You agree to pay the fees applicable to your plan or order. Card Vault may modify fees with at least thirty (30) days' prior notice via the dashboard or email. Fee changes take effect: (a) for subscriptions without a fixed term, on the effective date stated in the notice; and (b) for subscriptions purchased under an Order Form with a fixed term, at the start of the next renewal term. If you object to a fee change, you may terminate the affected subscription by notice before the change takes effect; your continued use of the Service after the effective date constitutes acceptance of the modified fees.
Fees are exclusive of taxes, duties, and similar governmental assessments of any nature. You are responsible for all such taxes associated with your purchases. Except where required by law or expressly stated otherwise, all fees are non-refundable.
10. Intellectual Property and Feedback
Card Vault and its licensors retain all rights, title, and interest in and to the Service, software, documentation, and all related intellectual property. No rights are granted except as expressly set out in these Terms. You retain all rights in your data. You grant Card Vault a non-exclusive license to process Customer Data to provide and secure the Service and as described in the Privacy Policy and any Data Terms Addendum (if separately agreed in an order form).
If you provide feedback or suggestions, Card Vault may use them without restriction or obligation to you.
11. Changes to these Terms
Card Vault may modify these Terms from time to time. Card Vault will provide notice of material changes at least thirty (30) days before they take effect, via the dashboard or by email to the address associated with your account. If you object to a material change, you may terminate these Terms by closing your account before the change takes effect; otherwise, your continued use of the Service after the effective date constitutes acceptance of the modified Terms. Changes required to comply with applicable law, card-network rules, or security requirements may take effect sooner, with notice provided as soon as reasonably practicable.
12. Service Changes; Trials and Beta Features
Card Vault may add, change, or deprecate features of the Service. Continued use after changes take effect constitutes acceptance. Card Vault will not be liable for the removal or deprecation of features.
Sandbox, trial, or beta features are provided AS IS, without service-level commitments and without data-retention guarantees. Do not store production data in such environments.
13. Representations and Warranties
Mutual. Each party represents that it has the authority to enter into these Terms.
Customer. You represent and warrant that: (a) you have full power and authority to enter into and perform these Terms; (b) your use of the Service complies with applicable law, card-network rules, and the terms imposed by any processor, gateway, or third party you enable; (c) you maintain applicable PCI DSS scope and controls for your environment; (d) the information, content, and data you provide (including personal data) are accurate and you possess all needed rights and consents to provide them; and (e) your use of the Service will conform to the applicable documentation.
14. Disclaimers
EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE, SOFTWARE, AND ALL RELATED MATERIALS ARE PROVIDED "AS IS" AND "AS AVAILABLE." CARD VAULT DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. CARD VAULT DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.
15. Indemnification
By Customer. You will defend, indemnify, and hold harmless Card Vault and its affiliates from and against any third-party claims, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from: (i) your breach of these Terms or applicable law; (ii) your misuse of the Service; (iii) your instructions or data; or (iv) your use of third-party services or integrations.
By Card Vault. Card Vault will defend and indemnify you against third-party claims alleging that the unmodified Service, as provided by Card Vault, infringes a third party's intellectual property right. Card Vault may (at its option and expense) procure the right for you to continue using the Service, modify or replace the Service to be non-infringing, or terminate the affected portion and refund prepaid, unused fees. Card Vault has no obligation for claims arising from your misuse, modifications, combinations with non-Card Vault technology, or use not in accordance with documentation. This section states your exclusive remedy for IP infringement.
16. Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, OR GOODWILL, OR FOR LOSS OF DATA (EXCEPT TO THE EXTENT SUCH LOSS OF DATA ARISES FROM A SECURITY INCIDENT CAUSED BY CARD VAULT'S BREACH OF SECTION 5), EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE.
General Cap. EXCEPT AS SET OUT BELOW, EACH PARTY'S TOTAL AGGREGATE LIABILITY UNDER THESE TERMS IS LIMITED TO THE GREATER OF: (A) THE FEES PAID OR PAYABLE BY YOU TO CARD VAULT FOR THE SERVICE IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY; AND (B) CAD $500 (THE "GENERAL CAP").
Enhanced Cap for Security Incidents. CARD VAULT'S TOTAL AGGREGATE LIABILITY FOR CLAIMS ARISING FROM A SECURITY INCIDENT CAUSED BY CARD VAULT'S BREACH OF ITS SECURITY OBLIGATIONS UNDER SECTION 5, OR FROM CARD VAULT'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS, IS LIMITED TO TWO (2) TIMES THE GENERAL CAP.
Uncapped Obligations. THE GENERAL CAP DOES NOT APPLY TO: (A) YOUR PAYMENT OBLIGATIONS; (B) YOUR BREACH OF SECTION 7 (ACCEPTABLE USE); (C) YOUR BREACH OF YOUR CONFIDENTIALITY OBLIGATIONS; OR (D) YOUR INDEMNIFICATION OBLIGATIONS.
17. Term, Termination, and Survival
These Terms commence upon your first use of the Service and continue until terminated. You may terminate by closing your account, subject to payment of all amounts due and completion of any in-flight transactions. Card Vault may terminate or suspend the Service for the reasons set out in Section 8 (Suspension) or for material breach not cured within thirty (30) days after written notice of the breach; provided that no cure period applies to breaches that by their nature cannot be cured or that create security, fraud, or compliance risk requiring immediate action.
Upon termination, your access will cease.
Data Export on Termination. Upon your written request made within thirty (30) days after termination, and subject to payment of all undisputed fees then due, Card Vault will make available: (a) your token and transaction metadata in a machine-readable format; and (b) vaulted payment card data, by secure transfer to a receiving entity designated by you that Card Vault has reasonably verified to be PCI DSS compliant, in accordance with card-network rules and a mutually agreed secure transfer procedure. Card-data transfers under clause (b) are subject to a migration fee equal to the greater of: (i) three (3) times your then-current base monthly plan fee (or the monthly equivalent, for plans billed on another cycle); and (ii) CAD $500. Network tokens provisioned through Card Vault's token requestor credentials are not transferable and will be deleted upon termination; the underlying payment credentials remain exportable as described above. Following the export window, Card Vault will delete Customer Data in its possession in accordance with the Privacy Policy, except where retention is required by law or card-network rules. The following Sections survive termination: Fees and Taxes; Security, Privacy, and Data Processing (with respect to Customer Data remaining in Card Vault's possession or control); Intellectual Property and Feedback; Confidentiality; Disclaimers; Indemnification; Limitation of Liability; Governing Law and Disputes; Notices; General; and Definitions.
18. Force Majeure
Neither party is liable for delay or failure to perform to the extent caused by events beyond its reasonable control, including natural disasters, acts of government, labor disputes, internet or telecommunications failures, third-party service or cloud outages, denial-of-service attacks, or utility failures. Payment obligations are not excused by force majeure.
19. Export Controls and Sanctions
You represent and warrant that you are not subject to Canadian or applicable international sanctions or embargoes and will not use the Service in or for sanctioned jurisdictions or restricted parties. You will comply with Canadian export controls and any other applicable export and sanctions laws.
20. Notices
Notices to you may be delivered via the dashboard or by email to the address associated with your account and are deemed received twenty-four (24) hours after sending unless Card Vault receives a delivery failure notification. Card Vault may also deliver notice by registered mail to your address of record, deemed received upon confirmation of delivery.
Notices to Card Vault must be sent by email to legal@cardvault.com and are deemed received twenty-four (24) hours after sending unless the sender receives a delivery failure notification; provided that notices of a claim, alleged breach, indemnification matter, or termination for cause must additionally be sent by registered mail to Card Vault Inc., Suite 3019, 103 9899-112 Avenue, Grande Prairie, Alberta, Canada, and are deemed received upon confirmation of delivery.
21. Governing Law and Disputes
These Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict-of-laws rules. The parties irrevocably submit to the exclusive jurisdiction of the provincial and federal courts of Alberta and waive any objections to venue and forum non conveniens.
22. General
Assignment. You may not assign these Terms without Card Vault's prior written consent, except to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets, provided the assignee assumes all obligations hereunder. Card Vault may assign to an affiliate or in connection with a corporate transaction.
Entire Agreement. These Terms, together with any order forms, any Data Terms Addendum (if separately agreed in an order form), and policies or documents referenced herein, constitute the entire agreement between the parties regarding the subject matter and supersede any prior or contemporaneous agreements. In the event of a conflict, the following order of precedence applies: (1) the applicable Order Form; (2) any Data Terms Addendum; (3) these Terms; (4) the documentation.
Severability; Waiver. If any provision is unenforceable, the remainder remains in effect. No waiver of any provision is effective unless in writing and signed by the waiving party.
No Third-Party Beneficiaries. These Terms do not create any third-party beneficiary rights.
Interpretation. Headings are for convenience only and do not affect interpretation.
Time to Bring Claims. To the maximum extent permitted by law, any claim, action, or proceeding arising out of or related to these Terms or the Service must commence within one (1) year after the cause of action accrues; otherwise, such claim, action, or proceeding is permanently barred.