Terms and Conditions

Effective Date: January 01, 2026

This website (the “Site”) is operated by myMemory Vault Co., (“we,” “us,” “our,” “MV” or “myMemory Vault Co.”). The following Terms & Conditions, together with any documents referred to in them, (collectively, these “Terms”) apply to our users’ (“you” or “your”) use of our website, other services offered at the Site, and our mobile application (together, the “Platform”).

Please read these Terms & Conditions and our Privacy Policy carefully before downloading the Mobile Application, enrolling for an account, and/or using any part of the platform. If you do not accept these terms, you may not download, use, or access any portion of the platform.

These Terms are between you and myMemory Vault Co. only. myMemory Vault Co. is solely responsible for the Platform. By using the Platform, you agree to the Terms & Conditions. If you do not agree to these Terms or our Privacy Policy, do not use or access the Platform.

Revision to the Terms & Conditions

We may revise and update these Terms & Conditions in our sole discretion, and will post any updates to the Terms on the Platform. Your continued use of our Platform, or any other service provided through the Platform, means that you accept and agree to the modified Terms & Conditions.

A. Disclaimer

The Platform is not a substitute for the professional judgement of an attorney, mediator or other professional. We do not give legal advice, nor do we provide legal services. You acknowledge that your reliance upon the Platform is solely at your own risk.

B. License Grant; Site Access; Information You Provide

Subject to these Terms, we hereby grant, and you hereby accept, a limited, non-exclusive, non-transferable, revocable license to download the mobile application and use the Platform. As a condition of your use of the Platform, you warrant that you will not use the Platform for any purpose that is unlawful or prohibited by these Terms. You may not use the Platform in any manner that could damage, disable, overburden, or impair the Platform, or interfere with any other party’s use and enjoyment of the Platform. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available or provided for through the Platform.

All content included as part of the Platform, such as text, graphics, logos, images, as well as the compilation thereof, and any software used on the Platform is our property or the property of our suppliers and protected by copyright and other laws that protect intellectual property and proprietary rights. You agree that you will not copy, modify, alter, revise, paraphrase, display, store, timeshare, sublicense, publish, transmit, sell, rent, lease or otherwise transfer or distribute any content, in whole or in part, found on the Platform or any portion thereof, or create derivative works thereof, except as specifically authorized herein. You further agree not to modify in any way, or delete, any warnings, notices, liability limitations, or other license provisions contained on the Platform. Your use of the Platform does not entitle you to make any unauthorized use of any protected content, and in particular, you will not delete or alter any proprietary rights or attribution notices in any content.

Your use of the Platform does not entitle you to make any unauthorized use of any protected content, and in particular, you will not delete or alter any proprietary rights or attribution notices in any content. You will use protected content solely for your personal use, and will make no other use of the content without our express written permission. You agree that you do not acquire any ownership rights in any protected content. We do not grant you any licenses, express or implied, to our intellectual property or our licensors, except as expressly authorized by these Terms.

Effective Date: January 01, 2026

In the event of any third-party claim that the Platform infringes that third party’s intellectual property rights, myMemory Vault Co. will be solely responsible for the investigation, defense, settlement and discharge of any such intellectual property infringement claim.

All information you provide to us through the Platform must be current, accurate, and complete. If we at any time discover any error or omission in the information you provide to us, we may, at our option, terminate your right to access and use the Platform. You represent and warrant that you have all rights necessary to receive, use, transmit, and disclose all data that you use in any way with the Platform.

C. Subscription and Cancellation

A subscription to the Platform can be purchased through the Site (the “Subscription”). Your use of the Platform is subject to your payment of a subscription fee, inclusive of applicable taxes (the “Subscription Fee”) for the term selected (the “Subscription Period.”) By purchasing a Subscription, you authorize myMemory Vault Co. or its service provider to charge you via your selected payment method immediately. You may enjoy our free 30-day trial and as such, there is a no refund policy for our paid subscription plan.

Your Subscription will automatically renew for additional Subscription Period of the same length unless you cancel the auto-renewal. You may cancel the auto-renewal of a Subscription or through your account settings, or by contacting customer service at info@mymvgateway.com

Upon expiration of your Subscription, you will no longer have access to your account. Thereafter, a renewal payment is required before further access to the Platform is granted.

D. User Content on the Platform

To the extent portions of the Platform allow you to comment or otherwise post regarding content on the Site (“User Content”), you may not post User Content that:

  • Violates any copyright, trade mark rights, patent rights, rights in know-how, privacy or publicity rights, trade secret rights, confidentiality rights, contract rights, or other rights of any individual or legal entity;
  • Is harmful; hateful; threatening; abusive; harassing; defamatory or libelous; sexually explicit, vulgar, lewd, obscene, or pornographic; racially, ethnically, or otherwise objectionable or offensive; inappropriate; or inflammatory;
  • You know (or reasonably should know) is false, deceptive, or misleading;
  • Contains information that could be used for identity theft purposes, such as social security numbers, credit card, bank account, or other financial information, driver’s license numbers, security codes, passwords, or other authentication methods;
  • Links to materials or other content, directly or indirectly, to which you do not have a right to link or that violates these restrictions; or
  • Violates any applicable local, state, national, or international law.

By posting User Content on the Platform, you represent and warrant that the posting of your User Content does not violate these Terms & Conditions or applicable laws.

myMemory Vault Co. does not and shall not have any obligation to review User Content, and therefore we do not guarantee the accuracy, integrity, or quality of User Content and we cannot assure you that harmful, inaccurate, deceptive, offensive, threatening, defamatory, unlawful, or otherwise objectionable User Content will not appear on our Platform. We do, however, reserve the right to review any or all User Content in our sole discretion. In addition, we reserve the right to alter, edit, or remove any User Content, in whole or in part, at our sole discretion.

UNDER NO CIRCUMSTANCES SHALL myMEMORY VAULT CO. OR ITS AFFILIATES BE LIABLE IN ANY WAY FOR ANY USER CONTENT POSTED ON OR MADE AVAILABLE THROUGH THE PLATFORM. We do not control, have no obligation to monitor, and are not responsible for what users post, and are not responsible for any offensive, inappropriate, obscene, unlawful, infringing, or otherwise objectionable or illegal User Content on the Platform.

E. Security and Updates

A password or another form of authentication (“Authentication Method”) is required to access and use the Platform. You are solely responsible for (1) maintaining the strict confidentiality of the Authentication Method assigned to or created by you, (2) instructing any individual to whom you disclose your Authentication Method not to allow another person to use your Authentication Method to access the Platform without your express permission, (3) any charges, damages, or losses that may be incurred or suffered as a result of your failure, or the failure of any individual using your Authentication Method, to maintain the strict confidentiality of the Authentication Method, and (4) promptly informing us in writing of any need to deactivate an Authentication Method due to security concerns. We are not liable for any harm related to authorization, disclosure or theft of your Authentication Method. You agree to immediately notify us of any unauthorized use of your Authentication Method. You will be liable for any use of the Platform through your Authentication Method. Additionally, you are liable for any unauthorized use of the Platform until you notify us of any security breach.

myMemory Vault Co. may from time to time, in its sole discretion, develop and provide mobile application updates, which may include upgrades, bug fixes, patches, other error corrections, and/or new features (collectively, including related documentation, “Updates”). Updates may also modify or delete in their entirety certain features and functionality. You agree that myMemory Vault Co. has no obligation to provide any updates or to continue to provide or enable any particular features or functionality. Based on your mobile device settings, when your mobile device is connected to the internet either: (a) the mobile application will automatically download and install all available Updates; or (b) you may receive notice of or be prompted to download and install available Updates. You shall promptly download and install all updates and acknowledge and agree that the mobile application or portions thereof may not properly operate should you fail to do so. You further agree that all updates will be deemed part of the mobile application and be subject to these Terms.

F. Security Protocol

MV makes available to following security features, procedures and tools:

  • Security Fact Sheet including 2-Factor Authentication process
  • Corporate Information Security Policy
  • Network Access Control Policy
  • Business Continuity and Disaster Recovery Plan

The MV team provides guidance to MV employees, consultant and associates on how to recognize and report suspicious activity in order to improve MVs ability to detect attacks against our infrastructure, product, service, and employees. From time-to-time, MV assesses its infrastructure and applications for vulnerabilities and makes every effort to remediate those that could impact the security of user data.

G. Transport Encryption

MV uses industry standard encryption to protect user data in transit. This is generally referred to as transport layer security (“TLS”) or secure socket layer (“SSL”) technology. If your mail service provider supports TLS, your email will be encrypted in transit, both to and from the MV platform.

H. How MV provide Notices to Users?

MV may provide notices by email (to the email address associated with your account) or postings on the MV website(s) related to the affected MV Service.

I. How Can Users Send a Notice to MV?

Any notice to must be delivered by email to info@mymvgateway.com. This email address may be updated as part of any update to these Terms. If you are unable to deliver notice via email, you may send a notice to us at the following address:

myMemory Vault Co. Inc.
45 – 209 Wicksteed Ave.
Toronto, Ontario, Canada, M4G 0B1
Attention: Legal Notice

J. Are There Countries Where MV Does Not Allow Its Service?

MV operates its platform in countries as authorized by Canadian and United States (“U.S.”) law and the laws of the jurisdiction in which the MV platform is hosted or where one uses the MV platform. In particular, but without limitation, the MV platform may not be (i) exported or re-exported into any countries that are subject to Canadian and U.S. economic sanctions or (ii) provided to or used by anyone on the Treasury Board of Canada or U.S. Department of the Treasury’s lists of Foreign Sanctions Evaders or Specially Designated Nationals or the Canadian Department of Trade and Commerce and the U.S. Department of Commerce Denied Persons, Unverified, or Entity lists. By using the MV platform, users represent and warrant that they are not located in any such country or on any such list, and shall not use the MV platform, or provide access to or use of the MV platform to anyone, in any such country. In addition, users are responsible for compliance with applicable export control, economic sanctions and related laws when travelling across international borders and accessing MV platform.

K. What Law Applies to the Use of the MV Platform?

Terms and conditions shall be governed in all respects by the laws of the province of Ontario, Canada, as they apply to these Terms and Conditions.

If any provision of these Terms is found by a court of competent jurisdiction to be invalid, the parties nevertheless agree that the court should endeavor to give effect to the parties’ intentions as reflected in the provision, and the other provisions of the Terms remain in full force and effect.

L. User’s Data

  • MV does not own user’s data. Creating memories and other content on the MV platform does not change that content’s ownership or copyright status. If the data was the users to begin with, it remains user’s after uploaded into MV platform. Keep in mind, if the data wasn’t the users to begin with, uploading it in MV platform doesn’t make it the users.
  • By using the MV platform, users give MV permission to do certain things with user’s data so that MV can run the platform. For example, user gives MV permission to back it up, send it over a network, index it for searching, display it on user’s various devices, etc. Some of these operations may require MV to send user’s data to MV’s business partners–such as a network operator–that MV has contracted with to provide parts of the MV platform service.
  • The MV platform is available worldwide, but user data is stored primarily in Canada and the United States, as described in our Privacy Policy. If you use the MV platform, you acknowledge that you may be sending electronic communications (including your Subscription Information and Content), through computer networks owned and operated by myMemory Vault Co. Inc., its Service Providers, and other third parties located in Canada and the United States. As a result, your use of the MV platform will likely result in interstate and possibly international data transmissions, and your use of the platform shall constitute your consent to permit such transmissions.

M. How is User Data Protected

Every memory created in MV platform is private by default. MV systems automatically analyze user data in order to power MV features, such as search and related notes, and to tell users about important features and products that MV thinks will enhance user experience.

In addition, MV takes many precautions to protect user data from accidental loss and theft. All memories are stored in a secure data center with multiple redundant servers, storage devices and off-site backups. Communications between users and servers are all encrypted. MV provides industry-leading security technologies, like two-factor authentication, to all users, and we’re constantly investing in ways to improve data protection. We take the utmost care in protecting your password and no one at MV will ever ask you for it.

N. User Data is Portable

There is no data lock-in with MV. MV is committed to making it straightforward for users to get all data into, and out of, MV at any time. MV’s software allows users to export all memories and content in human-readable HTML, as well as a fully documented machine-readable XML format.

O. MV Platform and Kids

The MV platform is not directed to minors, and any use by minors should only be done with the guidance, supervision and consent of their parents and/or guardians. In addition, MV relies on parents and guardians to ensure minors only use the MV platform if they can understand their rights and responsibilities as stated in these Terms and Conditions and MV Privacy Policy.

P. Feedback

You agree to reasonably cooperate with us in providing any comments and other feedback with respect to use of the Platform or any component thereof. By submitting information to us, you grant to us and our affiliates a royalty-free, perpetual, irrevocable, non-exclusive, worldwide license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform and display such information, subject to applicable laws and regulations, these Terms & Conditions, and our Privacy Policy.

Q. Confidential Personal Information

The platform enables you to transmit, store, and receive confidential personal information regarding you, your family or other persons. You represent and warrant that you will, at all times during the term of these Terms and thereafter, comply with all laws directly or indirectly applicable to you that may now or hereafter govern the gathering, use, transmission, processing, receipt, reporting, disclosure, maintenance, and storage of the confidential personal information. You further represent and warrant that you will use your best efforts to cause all persons or entities under your direction or control to comply with such laws. You are, at all times during the term of these Terms and thereafter, solely responsible for obtaining and maintaining all legally necessary consents or permissions, required or advisable, to disclose, process, retrieve, transmit, and view the confidential personal information you transmit, store, or receive in connection with the Platform. You agree that we, our licensors, and all other persons or entities involved in the operation of the Platform, have the right to monitor, retrieve, store and use confidential personal information in connection with the operation of the Platform, and that we are acting on your behalf in transmitting confidential personal information. We agree to use commercially reasonable efforts to maintain the confidentiality of such information and prevent the disclosure of such information to third parties except in connection with the transmission, storage, retrieval, and disclosure of such information on your behalf and as may be required or permitted by law. WE CANNOT AND DO NOT ASSUME ANY RESPONSIBILITY FOR YOUR USE OR MISUSE OF CONFIDENTIAL PERSONAL INFORMATION OR OTHER INFORMATION TRANSMITTED, MONITORED, STORED OR RECEIVED WHILE USING THE SITE OR ANY SERVICES OFFERED THEREON.

R. Warranty Disclaimers

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PLATFORM IS PROVIDED TO YOU ON AN “AS IS, WITH ALL FAULTS” BASIS, AND YOUR USE IS AT YOUR OWN RISK. WE MAKE NO WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND ANY WARRANTIES ARISING BY COURSE OF DEALING, CUSTOM OR TRADE. WE MAKE NO REPRESENTATION OR WARRANTY THAT ANY CONTENT IS ACCURATE, COMPLETE, APPROPRIATE, RELIABLE, OR TIMELY. WE MAKE NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO INFORMATION MARKED AS ‘PRIVILEGED’ BY USERS, AS THE DETERMINATION AS TO WHETHER OR NOT ANY GIVEN INFORMATION SHARED BETWEEN CLIENTS AND PROFESSIONALS IS PROTECTED BY ATTORNEY-CLIENT PRIVILEGE IS A FACT-SPECIFIC LEGAL QUESTION. FURTHER, WE ALSO MAKE NO REPRESENTATIONS OR WARRANTIES THAT YOUR ACCESS TO AND USE OF THE PLATFORM: (1) WILL BE UNINTERRUPTED OR ERROR-FREE, (2) IS FREE OF VIRUSES, UNAUTHORIZED CODES, OR OTHER HARMFUL COMPONENTS, OR (3) IS SECURE. YOU ARE RESPONSIBLE FOR TAKING ALL PRECAUTIONS YOU BELIEVE NECESSARY OR ADVISABLE TO PROTECT YOURSELF AGAINST ANY CLAIM, DAMAGE, LOSS OR HAZARD THAT MAY ARISE BY VIRTUE OF YOUR USE OF THE PLATFORM.

S. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, UNDER NO CIRCUMSTANCES WILL WE, OR ANY OF OUR PROVIDERS BE RESPONSIBLE OR LIABLE TO YOU OR ANY OTHER INDIVIDUAL OR ENTITY FOR ANY DIRECT, COMPENSATORY, INDIRECT, INCIDENTAL, CONSEQUENTIAL (INCLUDING LOST PROFITS AND LOST BUSINESS OPPORTUNITIES), SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES OR ANY DAMAGES WHATSOEVER THAT RESULT FROM OR RELATE IN ANY MANNER WHATSOEVER TO (1) USE OF THE PLATFORM OR ANY SERVICES OFFERED THEREON, (2) RELIANCE ON THE CONTENT BY YOU OR ANYONE USING YOUR AUTHENTICATION METHOD, OR (3) ERRORS, INACCURACIES, OMISSIONS, DEFECTS, UNTIMELINESS, SECURITY BREACHES, OR ANY OTHER FAILURE TO PERFORM BY US OR OUR CONTENT PROVIDERS. THE FOREGOING EXCLUSION SHALL APPLY REGARDLESS OF WHETHER WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME STATES/JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

IF, NOTWITHSTANDING THESE TERMS & CONDITIONS, WE SHOULD HAVE ANY LIABILITY TO YOU OR ANY THIRD PARTY FOR ANY LOSS, HARM OR DAMAGE, YOU AND WE AGREE THAT SUCH LIABILITY SHALL UNDER NO CIRCUMSTANCES EXCEED THE LESSER OF $250 OR THE FEES YOU PAID TO US DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE DAY THE ACT OR OMISSION OCCURRED WHICH GAVE RISE TO YOUR CLAIM. YOU AND WE AGREE THAT THE FOREGOING LIMITATION OF LIABILITY IS AN AGREED UPON ALLOCATION OF RISK BETWEEN YOU AND US WHICH CONSIDERS THE FEES, IF ANY, WE CHARGE YOU TO USE THE PLATFORM. YOU ACKNOWLEDGE THAT ABSENT YOUR AGREEMENT TO THIS LIMITATION OF LIABILITY, WE WOULD NOT PROVIDE THE PLATFORM TO YOU.

T. Indemnity

You agree to defend, indemnify and hold us harmless from any claims, losses, expenses, costs or damages (including reasonable attorneys’ fees, expert fees; and other costs of litigation) arising from, incurred as a result of, or in any manner related to (1) your breach of these Terms & Conditions, (2) use of the Platform and any services offered thereon by you or any other person using your Authentication Method, (3) the unauthorized or unlawful use of the platform by you or any other person using your Authentication Method, and (4) any claim that your content violates the intellectual property rights of a third party. We reserve the right, at our own cost, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you, in which event you will fully cooperate with us in asserting any available defenses.

U. Term and Termination

These Terms remain in force for the duration of your Subscription Period, including renewal Subscription Periods, or until terminated by any party. Upon termination, your access to the platform will cease.

Your right to access and use the platform immediately terminates without further notice upon your breach of these Terms. We may terminate these Terms and/or your right to use the platform at any time, with or without cause.

Paragraphs A, B, G, H, I, J and K of these Terms survive the expiration or termination of these Terms for any reason whatsoever. We reserve the right to discontinue or make changes to the Platform at any time.

V. Links to Other Websites and Connecting through Social Media

The platform may contain hyperlinks to websites operated by third parties. We do not control such websites and will not be responsible for their content, or for any breach of contract, or any intentional or negligent action on the part of such third parties, which results in any loss, damage, delay, or injury to you or your companions. Inclusion of any linked website on the Platform does not imply or constitute approval or endorsement of the linked website by us. If you decide to leave the Platform to access these third-party sites, you do so at your own risk. All rules, policies (including privacy policies), and operating procedures of websites operated by third parties will apply to you while on such sites. We are not responsible for information provided by you to third parties.

W. Assignment/Waiver and Governing Law

We may assign these Terms, in whole or in part, in our sole discretion. You may not assign your rights under these Terms without our prior written permission. Any attempt by you to assign your rights under these Terms without our permission shall be void. The waiver by us of a breach of any provision of these Terms shall not operate or be construed as a waiver of any other or subsequent breach. If any provision of these Terms is held by a court of competent jurisdiction to be contrary to law, the remaining provisions of these Terms shall remain in full force and effect.

These Terms are governed by the laws of the Province of Ontario, Canada without giving effect to any principles of conflicts of law. Any claim or dispute related to the Platform or under these Terms & Conditions, the Privacy Policy, and any legal notices on this Platform, must be instituted within one (1) year after the claim arose (if multiple claims, from the date the first claim arose), or be forever waived and barred. You agree that you will bring any claims in, and submit to the exclusive jurisdiction of, the province and federal courts located in the City of Toronto, in the province of Ontario, Canada.

X. What Happens to My Account when I Die?

“Trusted Contact(s)” who have been assigned to your MV account may contact MV in order to take over the account subject to MV’s verification process. As a general rule, MV deletes all accounts after 60 days for non-payment. In the event of death, the “Trusted Contact” has 60 days to contact MV to make arrangement to access the deceased MV account and decide on whether they wish to maintain the account or simply export the deceased vault content to an external location of their choosing. If you have assigned “Trusted Contact(s)” to have access to your vault in the event of death or incapacitation, you need to implement a process for providing your information to them. If there are no assigned “Trusted Contact(s)” on your account, MV will not provide your information, or your Content, to anyone, even next of kin, unless MV determines that we are legally obligated to do so.

Y. MV Partner Program

MV Partner program works with companies and organizations to offer MV benefits to their members, customers and employees. If the organization is offering a Free MV account to its members, MV will invoice the organization directly for payment. Each organization will be issued a unique “promo code” that they will provide to their members for MV sign up purposes. The MV system will be able to track the “promo code” to the specific partner organization. The MV Partner program provides for special rates for participating partners.

If an individual terminates their membership, relationship or employment with the specific partner organization, the organization will not be responsible for paying any future subscription for that individual. MV will contact the individual, via SMS or email, to make them aware that the next subscription due is their responsibility and that they will need to login to their account and update their payment method. Failure to pay will result in the MV system deleting the MV account after 3 months of non-compliance.

Z. User Account Deletion Policy

Memory Vault provides users with the ability to delete their account and associated personal data directly within the app.

Users may request deletion of their account using one of the following methods:

1. In-App Deletion Request

  1. Open the Memory Vault App
  2. Navigate to Settings
  3. Select Privacy & Data Management
  4. Tap Delete My Account
  5. Confirm your request

2. Email Request

You may also request deletion by emailing our support team:

Email: support@memoryvault.com
Subject: Account Deletion Request
Please include the email address associated with your Memory Vault account.

What Happens When You Delete Your Account

When your account deletion request is confirmed:

  • Your Memory Vault account will be permanently closed
  • Your personal data stored in the vault will be deleted
  • Any connections with partner organizations will be terminated

Deletion requests are typically processed within 30 days.

Data Retention

Certain limited information may be retained where required for:

  • Legal or regulatory compliance
  • Fraud prevention
  • Security and audit requirements

Any retained data will be securely stored and only kept for the minimum period required by law.

If you experience any issues deleting your account, please contact: support@mymvgateway.com

Entire Agreement

These Terms contain the entire agreement between you and us relating to the subject matter hereof, and supersedes any other oral or written communications relating thereto. You agree that you have not relied on any other verbal or written statements, actions or representations by us, our employees, or Members in consenting to these Terms. These Terms may not be amended or supplemented by any document originated by you relating to the subject matter hereof, or any statements of any of our employees and Members.

Contact Information

To contact us with any questions or inquiries about these Terms & Conditions, please contact us at:

myMemory Vault Co.
info@mymvgateway.com

Terms and Conditions

Terms & Conditions for ID Verification and Proof of Life Services

If this Policy is translated into any language other than English, in the event of a conflict, the English language version shall govern to the fullest extent permitted by applicable laws.

These Terms and Conditions (“Agreement”) govern the enrollment and use of the Proof of Life and Identity Verification Service (“Service”) provided by myMemory Vault Co. Inc. (“Provider”), and powered by Plaid Inc. to the subscribing business entity (“Participating Organization”). By enrolling in the Service, accessing the platform, or submitting customer data for Proof of Life or identity verification processing, the Participating Organization agrees to be bound by this Agreement.

1. Definitions

1.1 “Service” refers to the digital Proof of Life and identity verification platform, APIs, dashboards, and related tools offered by the Provider.

1.2 “Participating Organization” means the business entity registering for the Service.

1.3 “End User” or “Customer” means any individual that the Participating Organization requests to complete Proof of Life or identity verification through the Service.

1.4 “End User Data” means any personal information, images, documents, video, biometric samples, or submission data provided by the End User to complete verification.

1.5 “Platform” refers to the Provider’s systems, software, interfaces, and supporting infrastructure used to deliver the Service.

2. Scope of Service

2.1 The Provider will supply digital Proof of Life verification capabilities, which may include:

  • Identity document capture and validation
  • Liveness detection checks
  • Biometric matching
  • Timestamped Proof of Life confirmation
  • Verification result delivery to the Participating Organization

2.2 The Provider may enhance, modify, or update components of the Service at any time, provided such changes do not materially degrade functionality.

2.3 The Service is provided solely for lawful Proof of Life and identity verification purposes.

3. Responsibilities of the Participating Organization

3.1 The Participating Organization is responsible for ensuring it has the lawful basis to request Proof of Life or ID verification from End Users, including obtaining any required End User consent.

3.2 The Participating Organization must ensure that End Users receive all required notices regarding:

  • Data collected and processed
  • Purpose of the Proof of Life verification
  • How verification results will be used
  • Data retention policies

3.3 The Participating Organization agrees not to misuse the Service, including prohibitions on:

  • Using verification results for unrelated purposes
  • Attempting to reverse-engineer provider technology
  • Uploading false or manipulated data

3.4 The Participating Organization is responsible for the accuracy of any information it provides to the Provider.

4. Provider Responsibilities

4.1 The Provider will process End User Data strictly for the purpose of delivering the Proof of Life and ID verification Service.

4.2 The Provider will maintain industry-standard security controls, including:

  • Encryption at rest and in transit
  • Monitoring for suspicious activity

4.3 The Provider will deliver verification results (pass/fail or detailed status) to the Participating Organization through designated secure channels.

4.4 The Provider does not guarantee that all submissions will result in successful verification, nor is it responsible for the Participating Organization’s acceptance or rejection decisions.

5. Data Protection and Privacy

5.1 Both parties shall comply with applicable privacy laws and other regional regulations as applicable.

5.2 The Provider’s ID Verification Vendor (Plaid Inc.) stores identity-verification data on Plaid’s systems for as long as the user’s relationship with the Plaid remains active.

  • Plaid stores this data as part of fraud prevention, regulatory/compliance and audit needs, and to support product functionality and model improvement
  • Data is transmitted over encrypted channels and stored on Plaid’s infrastructure with industry security controls

5.3 The Provider may retain anonymized, aggregated data for statistical or service improvement purposes, but only if:

  • End User identifiers are removed; and
  • Such use does not identify the Participating Organization or any End User

5.4 Neither party shall disclose personal data to unauthorized third parties except as required by law.

6. Access and Security

6.1 The Participating Organization is responsible for securing its credentials and access points.

6.2 The Provider may suspend or restrict access in the event of:

  • Suspicious activity
  • Security risks
  • Misuse of the Service
  • Non-payment

6.3 The Participating Organization must promptly notify the Provider of any unauthorized access or security breach.

7. Fees and Billing

7.1 The Participating Organization agrees to inform end users that end user is responsible for paying the applicable usage fee/per-verification fee directly to Provider.

7.2 Alternatively, the Participating Organization may choose to pay the applicable usage fee/per-verification fee, on behalf of end users, via a “Promo Code” issued to Participating Organization.

7.3 The Provider may adjust fees with 30 days’ notice, except for commitments under a fixed-term contract.

8. Verification Results and Limitations

8.1 The Provider uses industry-leading verification technologies via Plaid Inc.; however, the Provider:

  • Does not guarantee verification accuracy
  • Does not determine eligibility or benefit entitlement
  • Does not provide legal or compliance advice

8.2 Verification results are advisory and should not be used as the sole basis for high-impact decisions without additional review.

9. Intellectual Property

9.1 All technology, models, software, APIs, trademarks, and documentation are owned by the Provider except that technology owned by Plaid Inc. in delivering the ID Verification and Proof of Life Service.

9.2 The Participating Organization receives a non-exclusive, non-transferable license to engage its end users for the service provided by Provider.

9.3 No rights to Provider IP (Plaid Inc. and myMemory Vault Co. Inc.) are transferred beyond what is explicitly stated.

10. Confidentiality

10.1 Each party shall protect the other’s confidential information using commercially reasonable measures.

10.2 Confidential information shall not be used for purposes other than fulfilling this Agreement.

10.3 Obligations survive termination.

11. Term and Termination

11.1 The Agreement begins on the Effective Date and continues until terminated by either party.

11.2 Either party may terminate with 30 days’ written notice.

11.3 Immediate termination may occur if:

  • The Participating Organization misuses the Service
  • Legal violations are detected
  • Payment obligations remain unmet

11.4 Upon termination:

  • Access to the Service will cease
  • Provider will delete End User Data as required by law
  • Aggregated, anonymized data may be retained

12. Warranties and Disclaimers

12.1 The Service is provided “as is” without warranties of any kind.

12.2 The Provider disclaims all implied warranties including merchantability, fitness for a particular purpose, and non-infringement.

12.3 The Provider is not liable for:

  • Delays or failures caused by third-party services
  • Incorrect customer data
  • Network outages or force majeure events

13. Limitation of Liability

13.1 To the maximum extent permitted by law, the Provider’s total liability shall not exceed CDN$100 paid by end users (collectively) or the Participating Organization in the previous 12 months.

13.2 The Provider shall not be liable for indirect, incidental, or consequential damages.

14. Governing Law

This Agreement is governed by the laws of Ontario, Canada without regard to conflict-of-law principles.

15. Amendments

The Provider may update this Agreement with notice. Continued use of the Service constitutes acceptance of updated terms.

16. Entire Agreement

This Agreement, together with the Order Form and any supplemental documents, constitutes the entire agreement between the parties.

Exhibit A - Plaid Inc. End Client Flow Down Terms

1. Restrictions

Unless Plaid specifically agrees otherwise in writing, End Client will not, and will not enable or assist any third-party to:

  1. attempt to reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, object code, or underlying structure, ideas, or algorithms of the Plaid services described at https://www.plaid.com (“Plaid Services”);
  2. modify, translate, or create derivative works based on the Plaid Services;
  3. make the Plaid Services or information and data of End Client’s end users (“End Users”) provided to End Client via the Plaid Services (such information and data, the “Plaid-Provided Data”) or any derivative work thereof available to, or use the Plaid Services or Plaid-Provided Data (or any derivative work thereof) for the benefit of, anyone other than End Client or End Users;
  4. sell, resell, license, sublicense, distribute, rent, or lease any Plaid Services or Plaid-Provided Data (or any derivative work thereof) to any third-party, or include any Plaid Services or Plaid-Provided Data (or any derivative work thereof) in a service bureau, time-sharing, or equivalent offering;
  5. publicly disseminate information from any source regarding the performance of the Plaid Services or Plaid-Provided Data; or
  6. attempt to create a substitute or similar service through use of, or access to, the Plaid Services or Plaid-Provided Data.

End Client will use the Plaid Services and Plaid-Provided Data only in compliance with: (a) the End Client application, use case, and other restrictions agreed between Plaid and Partner; (b) the Plaid developer policies (available at https://www.plaid.com/legal); (c) Plaid’s applicable technical user documentation (available at https://www.plaid.com/docs); and (d) any agreements between End Client and End Users (for clarity, including any privacy policy or statement).

Notwithstanding anything to the contrary, as between Plaid and End Client, End Client accepts and assumes all responsibility for complying with all applicable laws and regulations in connection with End Client’s activities involving any Plaid Services, Plaid-Provided Data, or End User data.

End Client acknowledges and agrees that: (I) Plaid is neither a “consumer reporting agency” nor a “furnisher” of information to consumer reporting agencies under the Fair Credit Reporting Act (“FCRA”); and (II) the Plaid-Provided Data is not a “consumer report” under the FCRA. End Client represents and warrants that it will not, and will not permit or enable any third party to, use the Plaid Services (including Plaid-Provided Data) as a or as part of a “consumer report” as that term is defined in the FCRA, or otherwise use the Plaid Services (including Plaid-Provided Data) such that the Plaid Services (including Plaid-Provided Data) would be deemed “consumer reports” under the FCRA.

Notwithstanding anything to the contrary, End Client will be bound by, and will only use the Plaid Services and Plaid-Provided Data in compliance with, the terms and conditions set forth in this agreement.

2. Secondary Investors

Subject to this Section 2 (Secondary Investors), End Client may request that Plaid or Partner disclose Plaid-Provided Data or a Partner product or service including or incorporating Plaid-Provided Data (collectively, the “Shared Data”) to End Client’s Secondary Investors. “Secondary Investor” means a third-party investor or purchaser of a financial product originated by End Client and provided to an End User (e.g., a loan), with which investor or purchaser Plaid maintains a separate technical integration.

(i) End Client represents and warrants to Plaid that, before disclosure of Shared Data to any Secondary Investor, End Client will provide and obtain all required (including under applicable law) notices and consents from the applicable End User with respect to disclosure of Shared Data to such Secondary Investor by Plaid or Partner.

(ii) Notwithstanding anything to the contrary: (a) as between Plaid and End Client, solely End Client is responsible for its relationships with Secondary Investors and with Partner, including any related billing matters, technical support, or disputes; (b) End Client will enter into legally binding written agreements with each Secondary Investor that are consistent with this Section 2 (Secondary Investors) and all applicable terms and conditions of this Exhibit A (End Client Flow Down Terms), including Section 1 (Restrictions); and (c) as between Plaid and End Client, End Client will remain responsible for the Secondary Investors’ compliance with all of the terms and conditions of this Exhibit A (End Client Flow Down Terms) (including terms relating to use of Plaid-Provided Data or Shared Data).

(iii) As between Plaid and End Client, End Client will be fully liable for: (a) any breach by End Client of this Section 2 (Secondary Investors); (b) any acts or omissions of Secondary Investors; and (c) any dispute arising among End Client, Partner, Secondary Investors, and/or End Users relating to the disclosure or use of Shared Data as contemplated in this Section 2 (Secondary Investors).

3. Privacy and Authorizations

Before any End User engages with Partner products or services which include, are derived from, or incorporate the Plaid Services, End Client warrants and will ensure that it provides all notices and obtains all consents required under applicable law to enable Plaid to process End User data in accordance with Plaid’s privacy policy (currently available at https://www.plaid.com/privacy).

End Client will not: (i) make representations or other statements with respect to End User data that are contrary to or otherwise inconsistent with Plaid’s privacy policy; or (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent.

4. Disclaimer; Enforcement

THE PLAID SERVICES, PLAID-PROVIDED DATA, AND ANY OTHER INFORMATION, SOFTWARE, PRODUCTS, SERVICES AND MATERIALS PROVIDED BY PLAID IN CONNECTION WITH THIS AGREEMENT ARE PROVIDED “AS IS.” TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR ANY WARRANTY THAT THE SERVICES ARE FREE FROM DEFECTS.

WITHOUT LIMITING THE FOREGOING IN THIS SECTION 4 (DISCLAIMER; ENFORCEMENT), NEITHER PLAID NOR ITS AFFILIATES, SUPPLIERS, LICENSORS, OR DISTRIBUTORS MAKE ANY REPRESENTATION OR WARRANTY AS TO THE PLAID-PROVIDED DATA THAT MAY BE OBTAINED FROM USE OF THE PLAID SERVICES OR THAT ANY PLAID SERVICES WILL BE UNINTERRUPTED, OR THAT ANY DATA PROVIDED BY OR THROUGH ANY PLAID SERVICES WILL BE TIMELY, ACCURATE, OR COMPLETE.

PLAID WILL BE AN INTENDED THIRD-PARTY BENEFICIARY OF THE AGREEMENT BETWEEN PARTNER AND END CLIENT AND MAY DIRECTLY ENFORCE SUCH AGREEMENT AGAINST END CLIENT, WITHOUT PARTNER’S CONSENT OR PARTICIPATION, BUT SOLELY RELATING TO THE PLAID-PROVIDED DATA (INCLUDING FI DATA) AND PLAID SERVICES THAT ARE PROVIDED BY PLAID TO PARTNER OR END CLIENT.

5. FI Data

Through the Partner Services or Plaid Services, End Client may have access to information about or of End Users provided to Plaid by a bank, financial institution, or other data source (each, as designated by Plaid, “FI”, and such information, the “FI Data”).

(i) End Client Obligations

a. End User Consents. End Client will provide all notices to, and obtain all express consents from, each End User as required under applicable laws in connection with End Client’s use, storage, and other processing of any FI Data (such notices and consents, the “Express Consents”). Express Consents will: (A) be clear and conspicuous; (B) generally specify the categories of FI Data that End Client will receive and how End Client will use, store, and otherwise process FI Data; (C) be valid, enforceable, and expressly accepted by each End User; (D) identify any and all third parties or categories of third parties to whom End Client may provide FI Data for processing; (E) specify how End Users may exercise their right to revoke their Express Consent; and (F) include any other required disclosures under applicable laws. End Client will maintain records (which may include technical logs, screenshots, versions of Express Consents obtained) sufficient to demonstrate End Client’s compliance with this Section 5(i)(a) (End User Consents) and will promptly provide such records to Plaid upon request.

b. Scope of Access. End Client will only access FI Data for which it has obtained Express Consents from the End User for the use case reviewed and permitted by Plaid in writing and consented to by the applicable End User (such use case, the “Permitted Use Case”). For clarity, key factors Plaid will consider during its review of a potential Permitted Use Case include whether the use case is appropriate and useful to provide the End User with the End Client application that the End User has enrolled in, whether the End Client application provides a direct benefit to the End User, whether the use case directly supports the development of new or improved product features for the benefit of End Users, and the jurisdiction(s) in which the End Client operates and/or stores FI Data.

If End Client possesses FI Data that exceeds the scope of the End User’s Express Consents, End Client will use industry-standard means to permanently and securely delete (“Delete”) such FI Data; provided that End Client may retain such FI Data to the extent required by applicable laws. If End Client becomes aware that any data it receives from Plaid does not relate to the End User that End Client originally requested FI Data for, End Client will promptly notify Plaid and will Delete such data.

i. Information Security Program. End Client will maintain a comprehensive written information security program approved by its senior management (“Infosec Program”). The Infosec Program will include administrative, technical and physical measures designed to: (a) ensure the security of FI Data, (b) protect against unauthorized access to or use of FI Data and anticipated threats and hazards to FI Data and (c) ensure the proper disposal of FI Data. The Infosec Program will be appropriate to End Client’s risk profile and activities, the nature of the End Client application, and the nature of the FI Data received by End Client. In any event, the Infosec Program will meet or exceed applicable control objectives captured in industry standards and best practices, such as AICPA Trust Service Criteria for Security, NIST 800-53, or ISO 27002, and will comply with applicable laws. End Client will use up-to-date antivirus software and anti-malware tools designed to prevent viruses, malware, and other malicious code in the End Client application or on End Client’s systems.

c. Data Use. End Client will use, store and otherwise process FI Data solely in accordance with the End User’s Express Consents and applicable laws.

d. Data Disclosure. End Client will not disclose, transfer, syndicate or distribute FI Data to any third party (including its Permitted Service Providers) (“Data Sharing”) except in each case with the End User’s Express Consent and in accordance with applicable laws. Notwithstanding anything to the contrary, End Client will not sell FI Data.

e. Data Deletion. End Client will promptly Delete any FI Data upon request by the applicable End User; provided that End Client may retain copies of FI Data solely to the extent required by applicable laws.

f. No Attribution. End Client will not charge End Users any fees attributable to an FI for (a) access to its FI Data or (b) use of End User’s account with an FI in connection with the End Client application. In addition, End Client will not suggest or imply a partnership, sponsorship, or other relationship with an FI based on End Client’s receipt of FI Data under the Partner-Client Agreement or this Section 5 (FI Data).

g. No Other Access. During the term of the Agreement, End Client will only access FI Data through the Plaid Services or another manner that uses the FI’s authorized APIs. End Client will not “screen scrape” data from FIs or collect an End User’s log-on credentials for FI accounts, and will not otherwise knowingly obtain from a third party FI Data that was originally sourced through screen scraping an FI. End Client will immediately Delete any such End User log-on credentials in its possession. End Client will maintain records to demonstrate compliance with this Section 5(i)(g) (No Other Access). For the avoidance of doubt, nothing in this Section 5(i)(g) (No Other Access) will prohibit End Client from engaging any third party to obtain services similar to the Plaid Services, provided that such third-party services enable End Client’s access to FI Data solely via the FI’s authorized APIs.

h. Compliance with Laws. End Client will comply with all applicable privacy, security, and other laws pertaining to FI Data. End Client will not use, store, disclose, or otherwise process any FI Data for any purpose not permitted under applicable laws. For the avoidance of doubt, End Client acknowledges that Section 1033 of the Dodd-Frank Act may include obligations on End Client relating to processing, handling, and protecting FI Data. End Client will maintain a program designed to ensure compliance with applicable laws, including appropriately training End Client personnel.

j. Security Breach Obligations. End Client will notify Plaid promptly (and in any event within twelve (12) hours) via an email to security@plaid.com, following End Client becoming aware of any Security Breach, providing a description of all known facts, the types of End Users affected, and any other information related to such Security Breach that Plaid may reasonably request. End Client will reasonably cooperate with Plaid in investigating and remediating Security Breaches. End Client will be responsible for the costs of investigating, mitigating, and remediating the Security Breach. “Security Breach” means any event that compromises the End Client application or End Client’s systems or that does or reasonably could compromise the security, integrity or confidentiality of FI Data or result in the unauthorized use, disclosure, or loss of FI Data.

k. FI Confidential Information. If Plaid discloses to End Client any confidential or proprietary materials of an FI pertaining to the provision of FI Data hereunder (such materials, “FI Confidential Information”), such materials will be subject to the same obligations that apply to Partner’s Confidential Information under the Partner-Client Agreement, which will in no event be less protective of such information than a reasonable standard of care. FI Confidential Information will also be subject to the same obligations as FI Data under this Section 5(i) (End Client Obligations). End Client will promptly Delete FI Confidential Information in its possession upon Plaid’s request and will provide a written certification regarding such Deletion.

l. Oversight and Cooperation. Toward assessing End Client’s material compliance with this Section 5 (FI Data), End Client will promptly provide all reasonably necessary information and cooperation requested by Plaid, an FI, or any entity with examination, supervision, or other legal or regulatory authority over Plaid or an FI. In the event that Plaid has a good faith reason to believe that End Client is not in material compliance with this Section 5 (FI Data), Plaid will notify End Client and, upon Plaid’s request, End Client will promptly provide sufficient documentation to demonstrate such material compliance. If the documentation provided by End Client in accordance with the immediately prior sentence is insufficient (in Plaid’s reasonable discretion) to demonstrate such material compliance, End Client will submit to a third-party audit by a firm selected by End Client from a list of audit firms reasonably approved by Plaid to verify such compliance. Plaid and FIs may also conduct technical or operational assessments of End Client, which will be subject to advance notice and will not occur more than once per year unless legally required and materially different in scope from a preceding audit.

m. Information Sharing. Where required by an FI or relevant to an End Client’s access or use of FI Data from that FI, Plaid may share with such FI certain information related to End Client’s compliance with this Section 5 (FI Data), including with respect to End Client’s Infosec Program. Plaid will use commercially reasonable efforts to require that such FI treat any such information in a confidential manner.

n. Insurance. End Client will maintain insurance coverage appropriate to End Client’s risk profile and activities, the nature of the End Client application, and the nature of the FI Data received by End Client; provided that such coverage will be no less than industry standard and will include cybersecurity liability insurance.

o. Access Frequency. The parties acknowledge that as of the effective date of the Partner-Client Agreement, no guidelines regarding End Client’s frequency of “batch” pulls of FI Data (such guidelines, the “Guidelines”) apply to Plaid end clients. Notwithstanding the foregoing in this paragraph: (1) End Client will comply with any Guidelines provided in writing by Plaid (including via Partner); and (2) Plaid and Partner may enforce such Guidelines to the extent necessary in accordance with Plaid’s standard practices, which may include throttling, suspension or termination of End Client’s access.

p. End Client Marks License. End Client hereby grants to Plaid and each FI (and each of their third-party service providers) the non-exclusive and non-transferable right and license to use End Client’s trademarks and service marks solely in connection with consent management activities, including use associated with End User facing consent management portals operated by Plaid or an FI.

(ii) Suspension

Plaid may suspend End Client’s access to the Plaid Services or FI Data, in whole or in part, if Plaid determines or reasonably believes that: (a) End Client has breached this Section 5 (FI Data); (b) End Client’s use of the Plaid Services or FI Data will or has materially violated an agreement between Plaid and an applicable FI; (c) End Client’s use of the Plaid Services or FI Data will or does pose a risk of material harm, including material reputational harm, to End Users, an FI, or the Plaid Services. In addition, an FI may suspend End Client’s access to FI Data with respect to such FI. Plaid will use commercially reasonable efforts to: (1) notify Partner prior to any suspension described in this paragraph; (2) discuss with Partner in good faith any such suspension; and (3) resume End Client’s access to the Plaid Services and FI Data as promptly as is practicable after the basis for such suspension is cured to Plaid’s (and, as applicable, the relevant FI’s) reasonable satisfaction.

(iii) Indemnity

End Client will indemnify, defend and hold harmless each FI, Plaid, and the affiliates of each of the foregoing from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs, and expenses arising from or in connection with: (a) any Security Breach resulting in unauthorized disclosure of FI Data provided to End Client hereunder; or (b) End Client’s unauthorized or improper use of FI Data provided to End Client hereunder (including any unauthorized Data Sharing, transmission, access, display, storage, or loss). This Section 5(iii) (Indemnity) is not subject to any limitation of liabilities set forth in the Partner-Client Agreement. Each FI is a third-party beneficiary of this Section 5(iii) (Indemnity).

(iv) Modifications

End Client acknowledges that continued access to FI Data provided by certain FIs may necessitate modifications to this Section 5 (FI Data) pertaining to all applicable Plaid end clients. End Client will accept such modifications to continue accessing or using the Plaid Services with respect to such FIs. Plaid will use commercially reasonable efforts to notify Partner of the modifications and the effective date of such modifications. If End Client objects to the modifications, its exclusive remedy is to cease any and all access and use of the Plaid Services as it relates to the applicable FI(s). Continued access to or use of such Plaid Services after the effective date of such modifications to this Section 5 (FI Data) will constitute End Client’s acceptance of such modifications.

(v) Miscellaneous

In the event of a conflict with any other agreement or provision (including other provisions within the Partner-Client Agreement), the terms and conditions of this Section 5 (FI Data) will govern and prevail. Capitalized terms used in this Section 5 (FI Data) and not otherwise defined will have the meanings ascribed to them in the Agreement. All provisions of this Section 5 (FI Data) will remain in force in the event of the termination or expiration of this Section 5 (FI Data), the Agreement, or the Partner-Client Agreement.



“IDV Services” Product Specific Exhibit

THE PROVISIONS IN THIS EXHIBIT WILL APPLY TO PLAID’S IDV SERVICES.

1. DEFINITIONS

1.1. “IDV Data”

means data in electronic form that is transmitted through the IDV Services by, on behalf of, from, or to
Partner, End Client, or End Users. For the avoidance of doubt: (i) IDV Data (including IDV Data returned to Partner or
End Client) is not Plaid-Provided Data; and (ii) IDV Data is not the Confidential Information of either party.

1.2. “Identity Verification”

means Plaid’s Identity Verification services, including such services’ fraud detection and prevention features.

1.3. “Monitor”

means Plaid’s anti-money-laundering screening services.

1.4. “IDV Services”

means the Services comprised of Identity Verification and Monitor, as applicable, and the Dashboard.

1.5. “Dashboard”

means the Partner facing and End Client facing dashboard functionality and dashboard display services within the IDV Services.

1.6. “GLBA”

means the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, et seq. and the United States Federal Trade Commission rules
promulgated thereunder, as may be interpreted from time to time by a competent regulatory authority.

1.7. “IDV Privacy Statement”

means the end user privacy statement for the IDV Services available at https://plaid.com/legal/#idv-privacy-statement.

1.8. “PII”

means IDV Data that relates to an End User and is deemed “personal data” or “personal information” (or analogous
variations of such terms) under applicable privacy or data protection laws.

1.9. “Process”

means collect, disclose, use, store, or otherwise process.

1.10.

For the purposes of this Exhibit, the terms “controller,” “processor,” and “subprocessor” have the meanings ascribed
to them, and are hereby deemed references to the relevant defined terms with analogous meanings, under applicable
law. For example, these terms will be deemed references, as applicable, to the terms “business” and “service provider”
as such terms are used in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights
Act of 2020.

2. IDV SERVICES

2.1. Access

Partner may use the IDV Services, and only enable End Clients to use the IDV Services, in accordance with applicable
law, the Agreement (including this Exhibit), the Partner-Client Agreement, and any agreements between Partner and End
Users (for clarity, including any privacy policy or terms of service) to:

  1. (i) verify, via Identity Verification’s matching of IDV Data provided by End Users, applicable End User identities in
    the normal course of Partner’s or End Client’s business, as applicable; and
  2. (ii) assess, via Monitor, the IDV Data for certain screening purposes (e.g., to confirm that End Users do not appear
    on any watchlist, to provide antifraud or anti-money laundering screening services, etc.).

Without limiting the generality of the foregoing, Partner agrees that:
(a) neither it nor End Client will enable or use the “autofill” functionality of the IDV Services if Partner or End Client,
respectively, is located outside of the United States; and
(b) any violation of this sentence will be deemed a material breach of this Exhibit.

2.2. Instructions

To enable Plaid to provide the IDV Services to Partner and End Clients, Partner will (and will enable End Client, as applicable,
to) submit instructions to Plaid via the Dashboard (the “Instructions”).

The Instructions will include direction to Plaid regarding:

  1. (i) the applicable categories or types of IDV Data that will be processed by the IDV Services on behalf of Partner,
    End Client (as applicable), and End Users;
  2. (ii) when such processing will occur; and
  3. (iii) the categories or types of Docusign Envelope ID: 10153AB7-B8EA-4975-957D-69295A08B7E2 Plaid Confidential
    Information 23 End Users who will provide IDV Data through the IDV Services.

2.3. Consent

Partner represents and warrants that Partner and End Client (as applicable) will provide all notices and obtain all consents
as required under applicable law, regulations, and third-party agreements for:
(i) Partner and End Client to Process IDV Data, as applicable; and
(ii) Plaid (and its subprocessors and data sources) to provide or enable the IDV Services by Processing such IDV Data,
and to otherwise exercise the applicable rights described in this Exhibit.

Partner will maintain records sufficient to demonstrate its compliance with this Section 2.3 and will promptly provide such
records to Plaid upon request.

2.4. IDV Data

Partner grants to Plaid and its subprocessors a limited and non-exclusive license to:
(i) Process IDV Data as necessary to provide or enable the IDV Services; and
(ii) Process anonymized, de-identified, or aggregated IDV Data (i.e., IDV Data that is not PII) to maintain, improve,
optimize, or develop the IDV Services and to prevent and detect fraud in the IDV Services in accordance with the IDV
Privacy Statement.

Without limiting the generality of the foregoing, Plaid will:
(a) use IDV Data at the direction of Partner and End Client, as applicable;
(b) disclose IDV Data to subprocessors, if any, subject to restrictions at least as restrictive as those in this Exhibit; and
(c) remain responsible for such Plaid subprocessors’ breaches of the applicable provisions of this Exhibit.

Notwithstanding anything to the contrary, Plaid may disclose IDV Data as required by law or court order; provided that, to the
extent legally permissible, Plaid will promptly notify Partner of such requirement and use commercially reasonable efforts to
limit such disclosure.

Subject to the foregoing in this paragraph, each of Partner and End Client, as applicable, will retain its existing rights (if any,
including any ownership rights) in and to IDV Data.

3. COMPLIANCE

3.1. GLBA

Partner certifies that all of its and End Clients’ and Permitted Service Providers’ uses of, and purposes pertaining to, the IDV
Services are and will be in accordance with and solely comprised of uses and purposes described in Section 6802(e) of GLBA.

3.2. Processing on the Controller’s Behalf

Partner acknowledges and agrees that, solely with regard to the IDV Data:
(i) End Client or Partner, as applicable, will determine via the Instructions the purpose and means by which Plaid will process
IDV Data;
(ii) Plaid will act on such applicable Instructions with respect to the details of Plaid’s processing of IDV Data (i.e., how, what,
when, and why such IDV Data is processed by Plaid);
and that therefore
(a) Partner or End Client, as applicable, will be deemed a controller with regard to IDV Data;
(b) Partner (for clarity, where Partner services End Client) or Plaid, as applicable, will be deemed a processor with regard to
IDV Data; and
(c) where Partner services End Client, Plaid will be deemed a subprocessor with regard to IDV Data where Plaid is
facilitating, via the IDV Services, the applicable activities described in Section 2.1.

Partner will direct End Users to the relevant controller’s (meaning, Partner’s or End Client’s, as applicable) privacy policy for
any queries or requests regarding End User rights with respect to, and the processing of, PII applicable to the IDV Services.

For the avoidance of doubt, Partner acknowledges and agrees that:
(I) such applicable controller’s privacy policy will control and apply with respect to the processing of all PII applicable to the
IDV Services; and
(II) Partner will make available and maintain all data retention policies and provisions as required under applicable law
pertaining to Plaid’s storage of PII on Partner’s and End Client’s behalf, as applicable, in relation to the IDV Services provided
under this Exhibit.

Plaid will not:
(A) process PII for any purpose (including any commercial purpose) other than as necessary to perform the IDV Services for
Partner or End Client, as applicable (which performance includes the activities described in Section 2.4);
(B) sell any PII;
(C) process PII outside of the relevant direct business relationship described in this Exhibit; or
(D) combine PII with any other personal information that Plaid collects (directly from end users or via any third party) other
than as expressly permitted for processors or subprocessors under applicable law.

3.3. Details of Processing

Plaid and Partner acknowledge and agree that Partner or End Client, as applicable, will control, via the Instructions, the types
and categories of PII that may be Processed in connection with the IDV Services.

For clarity, such types and categories may include names, addresses, dates of birth, phone numbers, identification documents,
and images/videos (e.g., photos or selfies). This PII processing will continue, as applicable, in accordance with this Exhibit.

3.4. FCRA

Partner acknowledges and agrees that:
(i) Plaid is neither a “consumer reporting agency” nor a “furnisher” of information to consumer reporting agencies under the
FCRA; and
(ii) the IDV Data is not a “consumer report” under the FCRA.

Partner represents and warrants that it will not, and will not permit or enable any End Client or other third party to, use the
IDV Services or any IDV Data:
(a) as a, or as part of a, “consumer report” as that term is defined in the FCRA; or
(b) such that the IDV Services or any IDV Data would be deemed “consumer reports” under the FCRA.

3.5. Partner Responsibilities

Notwithstanding the applicability or details of any non-Partner (or any other) technical integration involving the IDV Services,
and notwithstanding anything to the contrary in this Exhibit, the Agreement, or the Partner-Client Agreement, Partner is
solely responsible for its relationships with End Clients and End Users, including any related billing matters, technical
support, and disputes.

Without limiting anything in this Exhibit or the Agreement, where Partner services End Users directly, Partner will publish and
maintain an easily accessible and legally sufficient:
(i) terms of service regarding all applicable End User use of Partner’s services; and
(ii) privacy policy.

Partner will promptly notify Plaid upon making any material changes to such terms of service or privacy policy.

Partner is, and will remain, solely responsible and liable for the use of and access to the IDV Services by or on behalf of each
End Client (as applicable), End User, and Permitted Service Provider.

Partner shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all IDV
Data, and for verifying the same.

3.6. Plaid Responsibilities

In connection with its processing of any IDV Data, Plaid will comply with all obligations (including privacy protection
obligations) applicable to it as a processor or subprocessor under applicable law.

Where Partner is the controller with respect to IDV Data:
(i) Partner reserves the right to take reasonable and appropriate steps towards stopping and remediating any unauthorized
use of PII by Plaid; and
(ii) Plaid will reasonably cooperate with Partner to facilitate such steps, including by making available to Partner all
information reasonably necessary to demonstrate Plaid’s compliance with its obligations under this Exhibit and applicable
law, to the extent such information relates to the IDV Services.

4. DISCLAIMER; UPDATES

Plaid makes no warranty with respect to, and disclaims all liability pertaining to:
(i) the Instructions and Plaid’s acts and omissions in accordance therewith; and
(ii) the accuracy of any IDV Data and all other data
(a) uploaded or otherwise provided to or for the IDV Services by or on behalf of Partner, End Client, or End Users, and
(b) Processed or provided by, or otherwise originating from, Plaid or Plaid’s data sources in relation to the IDV Services.

With respect to the IDV Services, Plaid disclaims all liability for the errors and omissions of it and its data sources.

Plaid may update the IDV Services from time to time. In the event that any such update is material, Plaid will notify Partner
of any Partner or End Client actions required to enable Partner’s and End Clients’ (as applicable) continued use of the IDV
Services, including any such materially additional or alternative terms so required for execution by Partner (which terms, as
of their effective date, will supersede this Exhibit).

5. SECURITY

5.1. Plaid InfoSec Program

Plaid will use commercially reasonable efforts to develop, implement, maintain, and enforce a written information security
program (“Plaid InfoSec Program”) that contains administrative, technical, and physical controls that are appropriate to
Plaid’s size and the complexity, nature, and scope of the IDV Services.

The Plaid InfoSec Program will be reasonably designed to:
(i) ensure the security and confidentiality of IDV Data;
(ii) protect against any anticipated threats or hazards to the security or integrity of IDV Data; and
(iii) protect against unauthorized access to or use of IDV Data.

The Plaid InfoSec Program will comply with all information and data security requirements promulgated by applicable state
and federal laws and regulations in the U.S.

Plaid will review and test the design and operational effectiveness of the Plaid InfoSec Program at least annually.

Additionally, Plaid will:
(a) maintain SSAE No. 18 SOC 2; and
(b) upon reasonable request from Partner (no more than once per calendar year), provide to Partner a copy of the Executive
Summary of Plaid’s then-current SOC 2 report conducted by a third-party assessor.

5.2. Security Incident

If Plaid becomes aware of any event that:
(i) compromises the security, integrity, or confidentiality of PII; and
(ii) results in the unauthorized access, use, disclosure, or loss of PII Docusign Envelope ID:
10153AB7-B8EA-4975-957D-69295A08B7E2 Plaid Confidential Information 25
(collectively, a “Security Incident”),
then to the extent that such Security Incident occurred on or affects any systems or facilities owned or operated by Plaid,
and unless prohibited by applicable law, Plaid will promptly:
(a) notify Partner and use commercially reasonable efforts to assist Partner in satisfying any of Partner’s notification
obligations imposed under applicable law in connection with the Security Incident; and
(b) investigate and use commercially reasonable efforts to remedy and mitigate the effects of the Security Incident.

6. EFFECT OF TERMINATION

Upon termination or expiration of an Order relating to the IDV Services:
(i) Partner will destroy or return to Plaid all IDV Services documentation provided to Partner relating to such Order; and
(ii) following Plaid’s receipt of the Partner’s request in writing, Plaid will delete (rather than return) all IDV Data stored on
Plaid’s servers relating to such Order, unless retention of the IDV Data is required under applicable law.

Without limiting the foregoing, Partner (on behalf of End Client, as applicable) and Plaid may mutually agree upon the
retention periods for various types or categories of IDV Data.

Notwithstanding anything to the contrary, Plaid disclaims all liability pertaining to:
(a) Plaid’s deletion of IDV Data after the termination or expiration of an Order; and
(b) Partner’s or End Client’s use of the IDV Services and IDV Data after any Order termination or expiration.

7. INDEMNITY

Partner will indemnify, defend, and hold harmless Plaid and its affiliates from any claims, actions, suits, demands, losses,
liabilities, damages (including taxes), costs and expenses arising from or in connection with:
(i) breaches of this Exhibit by Partner or End Clients;
(ii) acts or omissions of Partner or End Clients or its or their employees, affiliates, clients, or contractors relating to the IDV
Services;
(iii) the Processing of IDV Data by Partner, End Client, or Permitted Service Providers; and
(iv) the Instructions and Plaid’s acts or omissions in accordance therewith.

8. END CLIENT FLOW DOWN TERMS

Exhibit A (End Client Flow Down Terms) of the Agreement is hereby amended to include the Section 6 (IDV Services) that is
attached to this Exhibit as Exhibit I.

9. MISCELLANEOUS

This IDV Services Exhibit (the “Exhibit”) is a part of the Agreement. Capitalized terms used and not otherwise defined in
this Exhibit have the meanings ascribed to them in the Agreement.

The Plaid Services include the IDV Services. The effective date of this Exhibit is the Effective Date, provided that Partner
may only access, and enable End Client access to, the IDV Services during the term of each Order that includes IDV
Services.

In the event of a conflict between the terms and conditions of the Agreement (or any other agreement, including the
Partner-Client Agreement) and the terms and conditions of this Exhibit, the terms and conditions of this Exhibit shall
prevail.

 

Exhibit I End Client Flow Down Terms [continued]

6. IDV Services

Through the Partner Services, End Client may have access to IDV Services (as defined below). When providing the IDV Services to End Client through the Partner Services, Partner is acting as End Client’s processor and Plaid is acting as Partner’s subprocessor, as further described below. The provisions of this Section 6 (the “IDV Terms”) set out terms and conditions in connection with the IDV Services.

i. Definitions

a. “End Client Data” means data in electronic form that is transmitted through the IDV Services by, on behalf of, from or to End Client or End Users. For the avoidance of doubt: (i) End Client Data (including End Client Data returned to End Client) is not Plaid-Provided Data; and (ii) End Client Data is not the confidential information of either party.

b. “Identity Verification” means Plaid’s Identity Verification services, including such services’ fraud detection and prevention features.

c. “Monitor” means Plaid’s anti-money laundering screening services.

d. “IDV Services” means the services: (i) comprised of Identity Verification and Monitor, as applicable, and the Dashboard; and (ii) that End Client may have access to through the Partner Services. For the avoidance of doubt, the IDV Services are Plaid Services.

e. “Dashboard” means the End Client facing dashboard functionality and dashboard display services within the Identity Verification and Monitor services.

f. “GLBA” means the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801, et seq. and the United States Federal Trade Commission rules promulgated thereunder, as may be interpreted from time to time by a competent regulatory authority.

g. “IDV Privacy Statement” means the end user privacy statement for the IDV Services available at https://plaid.com/legal/#idv-privacy-statement.

h. “PII” means End Client Data that relates to an End User and is deemed “personal data” or “personal information” (or analogous variations of such terms) under applicable privacy or data protection laws.

i. “Process” means collect, disclose, use, store, or otherwise process.

j. For the purposes of these IDV Terms, the terms “controller,” “processor,” and “subprocessor” have the meanings ascribed to them, and are hereby deemed references to the relevant defined terms with analogous meanings, under applicable law. For example, these terms will be deemed references, as applicable, to the terms “business” and “service provider” as such terms are used in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020.

ii. IDV Services

a. Access. End Client may use the IDV Services subject to, and only in accordance with, applicable law, these IDV Terms, the Partner-Client Agreement, the agreed use cases therein, and any agreements between End Client and End Users (for clarity, including any privacy policy or terms of service) to: (i) verify, via Identity Verification’s matching of End Client Data provided by End Users, applicable End User identities in the normal course of End Client’s business; and (ii) assess, via Monitor, the End Client Data for certain screening purposes (e.g., to confirm that End Users do not appear on any watchlist, to provide antifraud or anti-money laundering screening services, etc.). Without limiting the generality of the foregoing, End Client agrees that: (a) End Client will not enable or use the “autofill” functionality of the IDV Services if End Client is located outside of the United States; and (b) any violation of this sentence will be deemed a material breach of these IDV Terms.

b. Instructions. To enable Partner to provide the IDV Services to End Client, End Client will submit instructions via the Dashboard (the “Instructions”). The Instructions will include direction regarding: (i) the applicable categories or types of End Client Data that will be processed by the IDV Services on behalf of End Client and its End Users; (ii) when such processing will occur; and (iii) the categories or types of End Users who will provide End Client Data through the IDV Services.

c. Consent. End Client represents and warrants that End Client will provide all notices and obtain all consents as required under applicable law, regulations, and third-party agreements for: (i) End Client to Process End Client Data; and (ii) Partner (and its subprocessors and data sources) to provide or enable the IDV Services by Processing such End Client Data, and to otherwise exercise the rights described in these IDV Terms. End Client will maintain records sufficient to demonstrate its compliance with this Section 2.3 and will promptly provide such records to Partner upon request.

d. End Client Data. End Client grants to Partner’s IDV Services subprocessor (i.e., Plaid) and its subprocessors a limited and non-exclusive license to: (i) Process End Client Data as necessary to provide or enable the IDV Services; and (ii) Process anonymized, de-identified, or aggregated End Client Data (i.e., End Client Data that is not PII) to maintain, improve, optimize, or develop the IDV Services and to prevent and detect fraud in the IDV Services in accordance with the IDV Privacy Statement. Without limiting the generality of the foregoing, Partner’s IDV Services subprocessor (i.e., Plaid) may disclose End Client Data to its subprocessors subject to restrictions similar to those in these IDV Terms. Notwithstanding anything to the contrary, Partner’s IDV Services subprocessor (i.e., Plaid) may disclose End Client Data as required by law or court order. Subject to the foregoing in this paragraph, End Client will retain its existing rights (if any, including any ownership rights) in and to End Client Data.

b. Processing on End Client’s Behalf. End Client acknowledges and agrees that, solely with regard to the End Client Data: (i) End Client will determine, via the Instructions, the purpose and means by which Partner’s IDV Services subprocessor (i.e., Plaid) will process End Client Data; (ii) Partner will require Partner’s IDV Services subprocessor (i.e., Plaid) to act on End Client’s Instructions with respect to the details of such subprocessor’s processing of End Client Data (i.e., how, what, when, and why such End Client Data is processed by such subprocessor); and that therefore (a) End Client will be deemed a controller with regard to such End Client Data; (b) Partner will be deemed a data processor with regard to End Client Data; and (c) Partner’s IDV Services subprocessor (i.e., Plaid) and its subprocessors will be deemed subprocessors with regard to End Client Data where such subprocessors facilitate, via the IDV Services, the End Client activities described in Section 2.1. End Client will direct End Users to End Client’s privacy policy for any queries or requests regarding End User rights with respect to, and the processing of, PII applicable to the IDV Services. For the avoidance of doubt, End Client acknowledges and agrees that: (I) End Client’s privacy policy will control and apply with respect to the processing of all PII applicable to the IDV Services; and (II) End Client will make available and maintain all data retention policies and provisions as required under applicable law pertaining to subprocessor storage of PII on End Client’s behalf in relation to the IDV Services provided under these IDV Terms. Partner agrees that its IDV Services subprocessor will not: (A) process PII for any purpose (including any commercial purpose) other than as necessary to perform the IDV Services for the End Client (which performance includes the activities described in Section 2.4); (B) sell any PII; (C) process PII outside of the business relationship described in these IDV Terms; or (D) combine PII with any other personal information that subprocessor collects (directly from end users or via any third party) other than as expressly permitted for processors or subprocessors under applicable law.

c. Details of Processing. The parties acknowledge and agree that End Client will control, via the Instructions, the types and categories of PII that may be Processed in connection with the IDV Services. For clarity, such types and categories may include names, addresses, dates of birth, phone numbers, identification documents, and images/videos (e.g., photos or selfies). Partner agrees that such Processing will continue, as applicable, in accordance with these IDV Terms.

d. FCRA. End Client acknowledges and agrees that: (i) neither Partner nor its IDV Services subprocessor (i.e., Plaid) is a “consumer reporting agency” or a “furnisher” of information to consumer reporting agencies under the FCRA; and (ii) the End Client Data is not a “consumer report” under the FCRA. End Client represents and warrants that it will not, and will not permit or enable any third party to, use the IDV Services or any End Client Data: (a) as a, or as part of a, “consumer report” as that term is defined in the FCRA; or (b) such that the IDV Services or any End Client Data would be deemed “consumer reports” under the FCRA.

e. End Client Responsibilities. Notwithstanding the applicability or details of End Client’s integration involving the IDV Services, and notwithstanding anything to the contrary in these IDV Terms or any other terms of the Partner-Client Agreement, End Client is solely responsible for its relationships with End Users, including any related billing matters, technical support, and disputes. Without limiting anything in these IDV Terms, End Client will publish and maintain an easily accessible and legally sufficient: (i) terms of service regarding all applicable End User use of End Client’s services; and (ii) privacy policy. End Client will promptly notify Partner upon making any material changes to such End Client terms of service or privacy policy. End Client is, and will remain, solely responsible and liable for each End User’s and each Permitted Service Provider’s use of and access to the IDV Services. End Client shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all End Client Data, and for verifying the same.

iii. Compliance

a. GLBA. End Client certifies that all End Client’s and Permitted Service Providers’ uses of, and purposes pertaining to, the IDV Services are and will be in accordance with and solely comprised of uses and purposes described in Section 6802(e) of GLBA.

f. Unauthorized Use. In connection with its processing of any End Client Data, Partner will comply with all obligations (including privacy protection obligations) applicable to it as a processor under applicable law. End Client reserves the right to take reasonable and appropriate steps towards stopping and remediating any unauthorized use of PII. Partner will reasonably cooperate with End Client to facilitate such steps, including by making available to End Client all information reasonably necessary to demonstrate Partner’s compliance with its obligations under these IDV Terms and applicable law.

iv. Disclaimer

Partner’s IDV Services subprocessor (i.e., Plaid) makes no warranty with respect to, and disclaims all liability pertaining to: (i) the Instructions and any acts or omissions in accordance therewith; and (ii) the accuracy of any End Client Data and all other data (a) uploaded or otherwise provided to or for the IDV Services by or on behalf of End Client or End Users, and (b) Processed or provided by, or otherwise originating from, Plaid or its data sources in relation to the IDV Services. With respect to the IDV Services, Plaid disclaims all liability for the errors and omissions of it and its data sources.

v. Effect of Termination

Upon termination or expiration of an Order relating to the IDV Services: (i) End Client will destroy or return to Partner all IDV Services documentation provided to End Client relating to such Order; and (ii) following Partner’s receipt of End Client’s request in writing, Partner will facilitate the deletion (or return, per such request) of all End Client Data stored on Partner’s and its subprocessor’s servers relating to such Order, unless retention of the End Client Data is required under applicable law. Without limiting the foregoing, Partner and End Client may mutually agree upon the retention periods for various types or categories of End Client Data. Notwithstanding anything to the contrary, Partner’s IDV Services subprocessor (i.e., Plaid) disclaims all liability pertaining to: (a) deletion of End Client Data after the termination or expiration of an Order; and (b) End Client’s use of the IDV Services and End Client Data after any Order termination or expiration.

vi. Indemnity

End Client will indemnify, defend, and hold harmless Partner’s IDV Services subprocessor (i.e., Plaid) and its affiliates from any claims, actions, suits, demands, losses, liabilities, damages (including taxes), costs and expenses arising from or in connection with: (i) breaches by End Client of these IDV Terms; (ii) acts or omissions of End Client or its employees, affiliates, clients, or contractors relating to the IDV Services; (iii) the Processing of End Client Data by End Client or its Permitted Service Providers; and (iv) the Instructions and any acts or omissions in accordance therewith.

vii. Miscellaneous

In the event of a conflict between these IDV Terms and any other terms and conditions of the Partner-Client Agreement or any agreements between End Client and End Users (for clarity, including any privacy policy or terms of service), the terms and conditions of these IDV Terms will govern and prevail with respect to the IDV Services. Partner may update the IDV Services and these IDV Terms from time to time.