Terms of Service

1. Acceptance of Terms

By accessing or using TokenUity (the “Platform”), you agree to be bound by these Terms of Service (these “Terms”). If you do not agree, you may not access or use the Platform. You accept these Terms electronically by accessing or using the Platform, by completing account registration, or by submitting payment. The operator maintains an electronic record of acceptance and of the version in effect at the time of your acceptance.

2. Defined Terms; Parties

In these Terms, “TokenUity,” “we,” “us,” and “Company” mean TokenUity LLC, a Maryland limited liability company, 1101 Silentglade Rd, Owings Mills, MD 21117, and its successors and assigns. “You” and “customer” mean the organization or individual that registers for or uses the Platform. “Member” means an individual your organization invites to use the Platform under your account. “Member ID” has the meaning given in Section 4. “Platform” means the TokenUity software-as-a-service offering, including its calculators, reviewers, reporting, and Sync Vault features. No member, manager, officer, employee, agent, or affiliate of TokenUity LLC has any personal liability to you or any third party for any act or omission arising out of or relating to the Platform or these Terms; all liability for acts or omissions of TokenUity LLC is borne solely by TokenUity LLC to the maximum extent permitted by applicable law.

3. Data Architecture

The Platform uses a tiered data architecture. You should understand exactly what is and is not end to end encrypted before relying on the Platform.

• 3.1 End to End Encrypted (Sync Vault). Report snapshots you choose to save to the Sync Vault are encrypted in your browser using AES GCM under a key derived from a passphrase you choose (PBKDF2 SHA 256). The passphrase and the derived key never leave your device. The Platform, its operator, and the underlying infrastructure store only the ciphertext, the initialization vector, the salt, and a one way content hash — they cannot decrypt your Sync Vault entries or recover a lost passphrase on your behalf. To protect your synchronized vault against replay attacks, every synced upload carries a monotonic sequence counter, and the relay rejects any upload whose sequence is not strictly greater than the stored high watermark, so a captured older encrypted blob cannot overwrite your current state.
• 3.2 Server Side, Access Controlled, Non End to End Encrypted. Certain other data you create is stored on Platform servers and is not encrypted by you. This includes: saved calculation records (including the input values and results you save), loaded labor and compensation profiles (base salary, benefits, payroll taxes, overhead, and derived loaded cost figures), aggregate organization metrics, alert records, organization membership and entitlement records, and reported issues. This server side data is access controlled (each user and administrator can read and modify only what they are entitled to) and is non personally identifying in the sense that it is not keyed to your name or email, but TokenUity LLC and its infrastructure can store, read, and process it in order to operate the Platform. You should not save to these server side stores any content you require to be unreadable by the operator; use the Sync Vault for content requiring end to end encryption.
• 3.3 Client Side Computation. All modeling, calculation, and detection logic runs client side in your browser. The raw inputs you enter into a calculator are processed locally; only the records described in Section 3.2 are transmitted to Platform servers when you choose to save a result.
• 3.4 Idle Auto Lock and Memory Cleansing. For the security of an unlocked Sync Vault, an idle session is automatically locked after fifteen (15) minutes of inactivity, with a non blocking warning presented before the lock. The idle timer is measured against a monotonic clock so changing the device system clock cannot extend the session. When the vault locks, all decrypted report buffers held in your browser memory are overwritten and cleared (their fields are nulled in place and the buffer is truncated) so that no decrypted content persists in the device heap. If you have enabled “Trust this device,” a derived device key (not your passphrase) is stored on that device to auto unlock the vault on later logins; clearing this only drops access on that device.

4. Member Identifiers

When your account is created, whether by self registration or by an administrator invitation, the Platform assigns you a system generated, opaque Member ID. You cannot enter or edit a personal display name. Your Member ID is the only identity shown to other members and to organization administrators.

5. Accounts & Authentication

Access requires a valid account and authentication credentials. You are responsible for safeguarding your credentials, for all activity under your account, and for keeping your vault passphrase secure. Because the Sync Vault is end to end encrypted, a forgotten vault passphrase cannot be recovered or read by the Platform or the operator, and any “Trust this device” auto unlock key stored on a lost or wiped device cannot be recovered. A sole organization administrator who forgets their passphrase may reset their own vault, which permanently deletes their existing encrypted saved reports and starts a fresh vault with a new passphrase, subject to a mandatory twenty four (24) hour cooling off period before deletion executes (during which the request may be cancelled by any administrator). Where an organization has more than one administrator, a forgotten passphrase is instead reset by another administrator, which executes immediately under dual control and likewise permanently deletes the member's existing encrypted saved reports. In either case the reset offers no grace window and no recovery of the prior encrypted reports: once executed, the deleted reports cannot be restored.

6. Use License

Subject to your purchased package and seat entitlements and to your compliance with these Terms, TokenUity grants you a nonexclusive, nontransferable, revocable license to access and use the Platform for your internal business purposes during your subscription term. TokenUity reserves the right to modify package contents and seat entitlements prospectively upon notice.

7. Acceptable Use

• You will not attempt to reverse engineer, decompile, or extract the Platform's underlying source, methodology, or trade secrets.
• You will not use the Platform to process unlawful, infringing, or abusive content.
• You will not overload, disrupt, or circumvent the Platform's access controls, entitlement limits, or anti abuse controls; provided, however, that an authorized headless agent session (under an Agentic plan or an enterprise organization's Bring Your Own Agent entitlement) minted through the Platform's designated headless session endpoint is an operator sanctioned exception that substitutes server side signed token verification for the human Turnstile widget, so the standing down of client side deterrents for that session is not a circumvention, while authentication, row level security, rate limits, and seat entitlements remain fully enforced.
• You will not attempt to reidentify or deanonymize members or to decode hashed or encrypted metadata.
• You will not resell, sublicense, rent, or lease access to the Platform or your seats, or use the Platform to develop, train, or offer a competing product or service.
• You will not scrape, crawl, or systematically extract data from the Platform; automated access via a sanctioned headless session (under an Agentic plan or an enterprise organization's Bring Your Own Agent entitlement) is permitted within your purchased seat entitlements to drive the Platform's calculators, reviewers, and reporting, but systematic or volumetric extraction of Platform data or content by any means remains prohibited.
• You will comply with all applicable laws in your use of the Platform, including export control and sanctions laws (Section 23).

8. Regulated Data Exclusions

The Platform is an internal decision support and modeling tool. It is not offered as, and is not, a compliant system of record for data subject to healthcare, financial services, or education privacy regulation. No PHI, HIPAA, GLBA, or FERPA regulated data is processed on the Platform. This includes protected health information (PHI) regulated by HIPAA, nonpublic personal information (NPI) regulated by the Gramm Leach Bliley Act, and student education records regulated by FERPA, together with any other regulated, special category, or sensitive personal data. The Platform does not provide a Business Associate Agreement, GLBA Safeguards Rule addendum, FERPA school official agreement, or any other compliance addendum for regulated data, and none will be deemed offered by implication. Your use of the Platform with any regulated data is a breach of these Terms and may result in immediate termination for cause under Section 16. The Platform adopts an exclusions based posture for regulated industries: regulatory compliance is achieved by not processing such data on the Platform, not by certifying the Platform to handle it; any regulated data that reaches the Platform is not stored — it is hashed and purged, never persisted. You are responsible for lawfully processing any compensation or workforce data you enter into loaded labor profiles, and you represent that you have the rights and consents required to do so.

9. Billing & Subscriptions

Paid packages are billed through a third party payment processor (card payments via Stripe) or, where you elect it, through digital asset payments as described in Section 10. Fees, term, and seat limits are governed by your selected package and size tier at the time of purchase. All fees are non refundable; except as expressly required by law, TokenUity will not issue refunds for any reason, including for unused time after cancellation, for termination for cause, or for periods during which you did not access the Platform. Subscriptions renew automatically at the end of each billing period (monthly or annually) until you cancel. You may cancel at any time; cancellation stops future billing but does not refund the current prepaid period, which remains accessible through the grace period described in Section 16. Enrollment requires a valid business (organizational) email address; orders placed with a personal or disposable email are automatically refunded and the associated subscription canceled, with no organization created. Seat and administrator limits for your tier are enforced server side at enrollment and on every member invitation, and cannot be raised by client side modification.

10. Digital Asset / Cryptocurrency Payments

As a co equal alternative to card payments, TokenUity accepts payment in USD Coin (USDC) on the Base network, facilitated through Coinbase CDP. The following terms apply to digital asset payments:

• 10.1 USD Denomination; USDC Settlement. All prices are denominated in U.S. dollars. When you elect to pay with USDC, the U.S. dollar amount due is settled by your transfer of the equivalent amount of USDC on the Base network at the time of payment. The U.S. dollar price is the amount owed; any network, gas, or exchange fees are your responsibility.
• 10.2 Wallet and Chain Responsibility. You are responsible for selecting the correct wallet, network, and deposit address, and for ensuring your transfer is completed on the Base network. TokenUity is not responsible for digital assets sent to an incorrect address or on an incorrect network, or for delays or failures in the underlying blockchain.
• 10.3 Finality. Digital asset payments are final and irreversible. Because blockchain transfers cannot be reversed, the no refund policy in Section 9 applies with full force to digital asset payments, and no refund, credit, or reversal will be issued in respect of a completed digital asset payment for any reason.
• 10.4 No Investment Advice; Digital Asset Risk. Nothing in the Platform constitutes an offer, solicitation, or recommendation to buy, sell, or hold any digital asset. Digital assets are volatile and may lose value; TokenUity is not your advisor or fiduciary with respect to any digital asset. You bear all risk associated with holding and transferring digital assets.
• 10.5 Taxes and Reporting. You are responsible for any tax consequences of your digital asset payments, including any gain or loss recognition, and for any required reporting. TokenUity makes no representation as to the tax treatment of digital asset payments in your jurisdiction.
• 10.6 Compliance. You represent that your use of digital asset payments complies with all applicable laws, including anti money laundering, sanctions, and digital asset regulatory requirements in your jurisdiction.

11. Chargebacks & Friendly Fraud

For card payments, all fees are billed through a third party payment processor. Before initiating a chargeback, you agree to first contact TokenUity through the Report an Issue channel and provide a good faith opportunity to resolve the dispute. A “friendly fraud” chargeback — a chargeback initiated by the cardholder who in fact authorized the purchase, including disputes on the grounds of “service not received,” “subscription not canceled,” or “unrecognized charge” where the purchase was in fact made by the cardholder or someone acting on their authority — is prohibited as a contractual remedy. The Platform applies a two-strike policy. A first occurrence of a friendly fraud chargeback results in a formal warning and a recorded strike against your account, email domain, payment instrument, and originating IP; access is retained and no termination or blacklisting occurs on the first occurrence. A second occurrence of a friendly fraud chargeback results in immediate and permanent termination of your account and organization under Section 16 (Termination for Cause), forfeiture of any remaining subscription fees as liquidated damages for the breach of this Section, and blacklisting of your account, email domain, IP address, and payment card fingerprint across the Platform and its payment infrastructure, in each case as a contractual remedy to protect the Platform from repeat abuse. This policy does not apply to a genuinely unauthorized charge (true fraud), which you should report to your card issuer and to TokenUity promptly upon discovery. The no chargeback obligation in this Section is in addition to, and does not limit, TokenUity's other rights and remedies.

12. Service Availability

TokenUity offers a service availability commitment and related service credits as set out in the Service Level Agreement available on the Platform (the “SLA”). The SLA is incorporated into these Terms by reference and forms part of your agreement with TokenUity. In the event of any inconsistency between these Terms and the SLA, the SLA controls with respect to availability and service credit matters only. Service credits, if any, are your sole and exclusive remedy for failure to meet the availability commitment.

13. Exports

You may export reports you have generated as PDF, CSV, or Excel files directly from the application. Exported files are produced and downloaded on your device; the Platform does not retain or transmit the contents of your exports. Once downloaded, you are responsible for securing and controlling access to your exported files.

14. ESG & FinOps Regulatory Disclaimer

The Platform provides ESG (environmental, social, and governance) and FinOps (cloud financial operations) intelligence, modeling, and attribution for your internal decision support. Outputs of the Platform, including cost estimates, carbon and energy figures, token usage, complexity indices, risk scores, and aggregate metrics, are modeled approximations generated from inputs you supply and the Platform's proprietary internal methodology; they are not audited, certified, or assured by an independent third party. The Platform is not a registered ESG assurance provider, a certified greenhouse gas accountant, a FinOps certified practitioner, or a regulatory filing agent. Nothing the Platform produces constitutes a regulatory disclosure, a statutory sustainability report, a compliance submission, or legal, tax, accounting, or audit advice. You are solely responsible for any external reporting, disclosure, or regulatory submission you choose to make, and for engaging qualified, licensed professionals where required. The Platform's metrics are designed to inform internal operational and financial decisions, not to satisfy any specific regulatory, exchange, or standards body reporting requirement.

15. Termination

We may suspend or terminate access for breach of these Terms, for unauthorized or abusive use, or as described in Section 16. The cancellation, grace period, and automated erasure process is described in Section 16. Encrypted report snapshots in your Sync Vault remain yours and are not retrievable without your passphrase; you may delete them at any time before, during, or after termination.

16. Subscription Cancellation, Grace Period & Automated Data Erasure

This Section governs cancellation of your subscription and the automated data erasure process that follows. It supplements Section 15 and the limitation of liability in Section 19, and your acknowledgment of the permanent and unrecoverable effect of erasure.

• 16.1 Cancellation by You. An organization administrator may cancel your subscription at any time from the Platform's subscription management interface. Cancellation stops future billing immediately (no further invoices are issued by the payment processor) but does NOT immediately revoke access: your organization retains full access to the Platform for a thirty (30) day grace period beginning at the moment of cancellation. You may continue to use the Platform, and log in, throughout the grace period.
• 16.2 Annual Term Forfeiture. If your subscription is on an annual term and you cancel before the term ends, the remainder of the prepaid annual period is forfeited as of the end of the 30 day grace period. No refund or credit is due for the unused annual portion (consistent with the no refund policy in Section 9), and the erasure in clause 16.4 proceeds at the end of the grace period regardless of any remaining annual days.
• 16.3 Undo Window & Warning. At any time before the end of the grace period, any organization administrator may undo the cancellation, which halts the erasure process and restores the subscription to active status. Because billing was stopped at cancellation, restoring active billing requires initiating a new subscription through the Platform's subscription management flow. Seven (7) days before the end of the grace period, the Platform will send a single notice to your organization administrators reminding them of the scheduled erasure date and their right to undo.
• 16.4 Automated Full Data Erasure. At the end of the grace period (cancellation date plus thirty (30) days), the Platform automatically and permanently erases all data associated with your organization. This automated process deletes all saved calculations, loaded labor profiles and groups, organization report metrics, alerts, and reported issues; all end to end encrypted sync vault entries; all dual control admin replacement and data wipe requests; and all organization membership, entitlement, and commercial records. The Platform permanently purges the cryptographic salts and one way hashes of your and your members' email addresses used for authentication. The Organization record is reduced to a minimal tombstone recording only that erasure occurred and when. Two categories are intentionally retained: (a) the processed Stripe webhook event ledger, which auto purges on its own 30 day retention schedule, and (b) procurement NDA acceptance attestation records, retained as tamper evident evidence of mutual confidentiality obligations.
• 16.5 Irreversible Erasure; Re Registration Required. BECAUSE THE PLATFORM DOES NOT POSSESS, STORE, OR HAVE ACCESS TO YOUR SYNC VAULT PRIVATE ENCRYPTION KEYS OR UNHASHED IDENTIFIERS, THE ERASURE OF DATA AND PURGING OF CRYPTOGRAPHIC SALTS IS PERMANENT AND COMPLETELY UNRECOVERABLE. THE PLATFORM CANNOT RESTORE ACCOUNTS, DATA, OR ACCESS ONCE THIS AUTOMATED PROCESS IS COMPLETE. Once complete, your organization, its members, and all data cannot be restored; to use the Platform again a new organization must be registered and a new subscription purchased, which will be assigned new unique identifiers.
• 16.6 Termination for Convenience by TokenUity. TokenUity may terminate this Agreement or suspend your account for convenience by providing thirty (30) days' advance written notice. In a termination for convenience by TokenUity, you are entitled to a pro rata refund of prepaid, unused subscription fees covering the remainder of the current billing term; this is the sole exception to the no refund policy in Section 9.
• 16.7 Termination for Cause by TokenUity. TokenUity may suspend or terminate access immediately for cause, including breach of these Terms, acceptable use violations, or a chargeback triggering the policy in Section 11 (Chargebacks & Friendly Fraud). In a termination for cause, all remaining fees are forfeited, no refund is due, and the automated erasure in clause 16.4 may be accelerated to run immediately upon the effective date of termination for cause.
• 16.8 Limitation of Liability. You bear sole responsibility to export all necessary data, logs, and cryptographic material before the end of the grace period (or before an accelerated effective date under 16.7). The Platform operator shall have no liability whatsoever to you, your administrators, invited users, or any third party for any damages, loss of data, loss of business, or proprietary key destruction resulting from the automated deletion and cryptographic erasure processes executed in accordance with this Section.

17. Customer Data & License Back

You retain all right, title, and interest in the data and report snapshots you generate. You grant TokenUity a limited, nonexclusive, royalty free license solely to store your encrypted Sync Vault snapshots and your server side records and hashed metadata as needed to provide the service. Because Sync Vault content is encrypted client side, the operator cannot access, view, or process your decrypted Sync Vault content; server side data described in Section 3.2 is accessible to the operator as stated there. You represent that you have the rights, consents, and lawful basis to input and process all data you submit to the Platform, and that doing so complies with these Terms and applicable law.

18. Indemnification

You agree to indemnify and hold harmless TokenUity LLC and its affiliates and their respective members, managers, officers, employees, and agents from any claims, damages, or expenses arising from your misuse of the Platform, your violation of these Terms, your infringement of third party rights, or the data you submit to the Platform, to the extent permitted by applicable law. You warrant that, before inviting any individual to join your organization on the Platform, you have obtained that individual's explicit consent to receive transactional system emails (including authentication, invitation, and account related notices) sent by the Platform. You agree to indemnify and hold harmless TokenUity LLC and its affiliates from any claims, damages, or expenses arising out of your invitation of individuals who have not provided such consent, to the extent permitted by applicable law. Your indemnification obligations are the customer's sole remedy and obligation for third party intellectual property claims arising from data you submit. TokenUity will notify you promptly of any claim for which indemnification is sought and will cooperate reasonably in the defense.

19. Disclaimer & Limitation of Liability

The Platform is provided “as is” and “as available” without warranties of any kind, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, title, and non infringement. To the maximum extent permitted by law, in no event will TokenUity be liable for any indirect, consequential, special, incidental, or punitive damages, or for any lost profits, lost data, or business interruption, arising out of or relating to these Terms or the Platform, whether in contract, tort, or any other theory, even if advised of the possibility of such damages. To the maximum extent permitted by law, TokenUity's aggregate liability for any claim arising out of these Terms or the Platform is limited to the fees you paid to TokenUity in the twelve (12) months preceding the event giving rise to the claim. The foregoing exclusions and limitations do not apply to (a) your indemnification obligations under Section 18, (b) claims of intellectual property infringement, (c) breach of confidentiality obligations, or (d) fraud or willful misconduct, and do not limit any liability that cannot be limited under applicable law. Where applicable law implies warranties or rights that cannot be excluded (for example, certain statutory rights of non business consumers in the EU and UK), those survive only to the minimum extent required by such law.

20. Governing Law & Disputes

These Terms are governed by the laws of the State of Maryland, United States, without regard to conflict of laws principles. The parties will attempt in good faith to resolve any dispute through negotiation for at least thirty (30) days before proceeding to binding dispute resolution. EXCEPT FOR THE CARVE OUTS BELOW, ANY DISPUTE ARISING OUT OF OR RELATING TO THESE TERMS OR THE PLATFORM WILL BE RESOLVED BY FINAL AND BINDING ARBITRATION ADMINISTERED IN BALTIMORE, MARYLAND, UNDER THE COMMERCIAL RULES OF THE AMERICAN ARBITRATION ASSOCIATION, BY A SINGLE ARBITRATOR, WITH JUDGMENT ON THE AWARD ENFORCEABLE IN ANY COURT OF COMPETENT JURISDICTION. THE PARTIES WAIVE ANY RIGHT TO A JURY TRIAL AND AGREE THAT ARBITRATION WILL BE ON AN INDIVIDUAL, NON CLASS BASIS, WITH NO CLASS OR CONSOLIDATED ARBITRATION PERMITTED. The following claims are carved out of arbitration and will be litigated exclusively in the state or federal courts located in the State of Maryland: (a) claims concerning the ownership, validity, or infringement of intellectual property, including the Platform's source, methodology, and trade secrets, and (b) claims to collect a debt owed by you to TokenUity. Either party may seek provisional injunctive or equitable relief in a court of competent jurisdiction to protect intellectual property or preserve the status quo pending arbitration. For users who are not businesses (for example, an independent contractor who is a consumer in the EU or UK), nothing in this Section deprives you of the protection afforded to you by mandatory provisions of the law of your country of residence, and where such mandatory consumer law conflicts with arbitration, the mandatory consumer law will govern the dispute resolution method. This dispute resolution clause survives termination of these Terms.

21. Export Controls, Sanctions & Force Majeure

You will comply with all applicable export control, economic sanctions, and anti money laundering laws when using the Platform. You represent that you are not located in, under the control of, or acting on behalf of any person or entity on any applicable sanctions or restricted party list (including OFAC, the EU, and HM Treasury), and TokenUity may suspend or terminate any account that it reasonably believes may breach this representation. TokenUity is not liable for any delay or failure to perform due to causes beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, governmental actions, labor disputes, and failures of third party infrastructure (such as payment processors or cloud providers); provided that (a) internet or network outages affecting the Platform do not relieve TokenUity of its availability commitments or service credit obligations under the SLA (Section 12), and (b) force majeure does not relieve you of your payment obligations. Force majeure does not extend or suspend your subscription term or the erasure schedule in Section 16.

22. Minimum Age

You must be at least 18 years of age (or the age of digital consent in your jurisdiction, if higher) to use the Platform. By using the Platform you represent that you meet this requirement. The Platform is not offered to anyone under 18, and we do not knowingly collect personal data from children, consistent with the Privacy Policy.

23. Taxes

Fees are exclusive of taxes. You are responsible for all taxes (including value added tax, goods and services tax, sales tax, and similar transaction taxes) imposed on your subscription or your use of the Platform, and for any required tax registration, reporting, and remittance. For customers in the European Union or United Kingdom who provide a valid business identification and where the reverse charge mechanism applies, VAT or GST may be reverse charged to you as the recipient. TokenUity is responsible only for its own income and corporate taxes. You are responsible for any tax consequences of digital asset payments as described in Section 10.

24. Notices

Legal notices to TokenUity must be sent by registered or certified mail to TokenUity LLC, 1101 Silentglade Rd, Owings Mills, MD 21117, United States, or to such legal notices email address as TokenUity may publish on the Platform. Routine operational notices will be sent to the email address or in app channel associated with your account. Notices to you may be given by email, in app message, or posting on the Platform and are deemed received when sent or posted.

25. Assignment

You may not assign or transfer these Terms or your account, by operation of law or otherwise, without TokenUity's prior written consent; any purported assignment without consent is void. TokenUity may assign these Terms freely, in whole or in part, in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, or otherwise. These Terms bind and inure to the benefit of the parties and their permitted successors and assigns.

26. General Provisions

These Terms constitute the entire agreement between you and TokenUity regarding the Platform and supersede all prior or contemporaneous agreements, proposals, and communications, whether oral or written, on that subject. If any provision of these Terms is held unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force. No waiver of any provision will be effective unless in writing, and no failure or delay by TokenUity in enforcing any right will be a waiver of that or any other right. Section headings are for convenience only and do not affect interpretation. These Terms may be accepted electronically and in counterparts, each of which is deemed an original. The following provisions survive termination: Sections 3, 7, 8, 11, 17, 18, 19, 20, 21, 23, and 26.

27. Changes to These Terms

We may update these Terms from time to time. Material changes will be reflected by the “Last updated” date and, where required, communicated to registered users. Continued use after a change constitutes acceptance of the revised Terms.