Andamio Issuer Terms of Service

Part A: the terms

1. About these terms

1.1 Who we are. "Andamio", "we" and "us" mean Andamio, a corporation organised under the laws of the State of Wyoming, United States, with its registered place of business at 2232 Dell Range Blvd Ste 245, Cheyenne, WY 82009, filing number 2023-001360650.

1.2 Who you are. "You" and "Customer" mean the organisation named as the buyer on your order. The person who places the order confirms they are authorised to bind that organisation. Andamio Issuer is for organisations, not for personal use.

1.3 What makes up the agreement. These terms, including the Data Processing Schedule in Part B; your order (the order you place on issuer.andamio.io, including the plan you chose); and any signed order form (a separate order form signed by both of us). If they conflict, this order applies: a signed order form, then Part B on data protection, then these terms, then your order.

1.4 Accepting these terms. You accept these terms by ticking the box and placing your order. We record which version you accepted, when, and which member of your account accepted it. That record, and notices sent electronically, count as writing and signature.

2. The service

2.1 What Andamio Issuer does. Andamio Issuer is an API that lets you issue verifiable credentials from your own application. Andamio records each credential on the Cardano blockchain and pays the network fees for those transactions, so your learners and teachers don't need to buy or spend cryptocurrency. Anyone can verify an issued credential on the public blockchain.

2.2 What it doesn't do. Andamio Issuer doesn't host your learning content or your learners' work. You run your own programme and your own application.

2.3 Your account. Your account's members sign in at issuer.andamio.io with a social login that creates a non-custodial Cardano wallet for them; Andamio never holds that wallet's private key. There are no passwords. An admin can invite colleagues to the account. A wallet can belong to one Andamio Issuer account only.

3. Plans, orders and payment

3.1 Plans. Each plan runs for one year from the date your API key is first issued and includes allocations of users, credentials and courses. The plan and its price are on your order. A plan doesn't renew automatically. To continue after a year, place a new order; we'll remind you by email before your plan ends.

3.2 Allocations are limits. When an allocation is used up, the API refuses further requests that count against it. Unused allocations end with the plan. You can buy more capacity during the plan, at the rates on your order or our price list at the time; order it by email. Until we can add capacity to your existing API key, we issue it on a separate key that ends with your plan.

3.3 Ordering. You must give your organisation's legal name and an email address for billing and notices; billing address and tax or VAT ID are optional. Each order gets an invoice straight away. Billing details on an invoice are the ones you gave when you ordered; later changes apply to later orders only. You may cancel an order yourself until we have confirmed your payment.

3.4 Payment. Prices are in US dollars. You pay by bank transfer against our invoice, within 30 days of the invoice date. Prices exclude taxes; you pay any sales, use, VAT or withholding tax that applies, other than taxes on our income. Card payment isn't offered at launch.

3.5 When the service starts. We issue your API key after we have confirmed your payment and set up your login integration. We aim to do this within 3 business days of receiving payment.

3.6 Refunds. Fees are non-refundable once your API key is issued, except:

• if we haven't issued your API key within 30 days of receiving your payment, you may cancel and we refund in full;
• if we end the agreement without cause (§10.3), you end it for our breach (§10.2), you end it over a new sub-processor (Part B, B5), or either of us ends it under §13.9, we refund the fees for the unused part of the plan;
• as required by law, or as stated in a signed order form.

Refunds are paid by bank transfer.

4. Your API key

4.1 Revealing it. An admin of your account can reveal the API key once, in the dashboard. After that it can't be shown again, so store it securely when you reveal it.

4.2 Keeping it safe. You're responsible for keeping the key confidential and for all use of it. Tell us at once at support@andamio.io if you think it has been exposed. We will deactivate it and issue a replacement as soon as we reasonably can.

4.3 Deactivation. We can deactivate your key if we suspend the service under §9, or if it appears to have been compromised. A deactivated key stops working immediately and can't be reactivated; if the service continues, we issue a new key.

5. What goes on the blockchain

5.1 Public and permanent. These items are written to the Cardano blockchain when you use the API: each learner's and teacher's alias and wallet address, each course and credential definition, each submission text (up to 140 characters), each teacher's approval and each credential claimed. Anyone can read them, and no one, including Andamio, can change or delete them. A learner who signs in through Andamio's social login uses the same wallet with every organisation that uses Andamio, so the credentials they earn from different organisations are publicly linked to that one wallet. This is how the Andamio protocol is designed: a learner's credentials build into one portable record.

5.2 Your instruction, and your duties. Wallet addresses, aliases, approvals and credentials written on chain are personal data, even when pseudonymous. By using the API you instruct Andamio to publish the items in §5.1 permanently. Before you do, you will:

• (a) have a lawful basis for that publication. Don't rely on consent: it can't in practice be withdrawn from the blockchain;
• (b) carry out any data protection impact assessment the law requires;
• (c) tell your learners and teachers that these items will be public, worldwide and permanent, that credentials from different organisations are linked to the same wallet, and that rights such as correction and erasure can't be applied to them on chain;
• (d) keep names, contact details, special-category data and anything confidential out of aliases, course and credential definitions and submission texts, and check submission texts before you send them.

You're responsible for that content and for having the right to publish it.

5.3 Deletion requests. If a learner or teacher asks to have their data deleted, we can delete only what we hold off the blockchain. We can't remove anything already written on chain. If a learner or teacher asks, we take down our own page showing their credential. The credential stays on the blockchain, and anyone can still verify it there.

6. Your other responsibilities

6.1 Your learners and teachers. You decide who your learners and teachers are, what each credential means and what work earns it. You're responsible for telling them how their data is used and for having a lawful basis to send their data to us.

6.2 Acceptable use. You won't use the service to break the law, infringe anyone's rights, issue credentials that are false or misleading about what a person achieved, impersonate anyone, interfere with the service's security or operation, or try to get around the plan limits.

6.3 Compliance. You're responsible for complying with the laws that apply to your programme and your credentials.

7. Data protection

7.1 Your learners' and teachers' data. When we process personal data about your learners and teachers to provide the service, you're the controller and we're your processor, and Part B applies.

7.2 Your account members' data and billing records. We're the controller for your account members' wallet addresses and any email addresses they give us, and for orders, invoices and payment records. Our privacy policy at andamio.io/privacy-policy explains how we handle them.

7.3 Records we keep. We keep invoices and payment records for 7 years after the end of the tax year, for tax and accounting purposes, even after the agreement ends.

8. Intellectual property

8.1 Ours. Andamio owns the service, the API and its software. We give you a non-exclusive, non-transferable right to use them during your plan for your programme, including through your contractors and for your learners and teachers. You won't resell the API, copy it or reverse-engineer it.

8.2 Yours. You own your content. You give us a worldwide, royalty-free licence to use it to provide the service. For the items in §5.1 that licence is perpetual and irrevocable, so that they can stay on the blockchain and we may display them for verification.

8.3 Feedback. We may use suggestions you give us about the service without obligation to you.

9. Suspension

We can suspend the service, or part of it, if an invoice is unpaid 15 days after we've sent you a payment reminder, if your use breaks §6.2 or puts the service or other customers at risk, or if the law requires it. We'll tell you first when we reasonably can. While the service is suspended your API key may be deactivated. Once the reason is fixed, we issue you a new key for the rest of your plan. Suspension doesn't cancel any invoice or fees you owe.

10. Term and ending the agreement

10.1 Term. The agreement starts when you place your order and ends when your plan's year ends, unless it ends earlier under this section.

10.2 Ending for breach. Either of us can end the agreement by written notice if the other materially breaks it and doesn't fix the breach within 30 days of being told.

10.3 Ending without cause. We can end the agreement at any time with 60 days' written notice, refunding the fees for the unused part of the plan.

10.4 What happens at the end.

• Your API keys are deactivated.
• Credentials already on the blockchain stay there, and anyone can verify them on the public blockchain. We don't promise to keep running our own credential viewer.
• After the agreement ends, we may keep showing credentials on our credential pages in a generic design, without your logo or colours, still naming your organisation as the issuer.
• Within 90 days, we delete or anonymise the personal data of your account's members (wallet addresses, email addresses and invitations). We do the same within 90 days when a member is removed, or when a member asks.
• We return or delete the personal data about your learners and teachers that we hold off the blockchain, as Part B, B9 says.
• We keep invoices and the record of payment and settlement actions for the period in §7.3; they hold your organisation's billing details.

11. Warranties and disclaimers

11.1 We'll provide the service with reasonable skill and care.

11.2 Apart from that, the service is provided "as is". We disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement, to the extent the law allows. We don't promise the service will be uninterrupted or error-free. The Cardano blockchain is a public network that Andamio doesn't control. We aren't responsible for its delays, outages, forks or changes, or for transaction fees beyond those we've agreed to pay under §2.1.

12. Liability

12.1 Cap. Each party's total liability under or in connection with this agreement, whether in contract, tort (including negligence) or otherwise, is limited to the fees paid and payable in the 12 months before the claim arose.

12.2 No indirect losses. Neither of us is liable for indirect or consequential loss, or loss of profit, revenue, data or goodwill.

12.3 What's not limited. The limits don't apply to: your payment obligations; your duties under §5.2 for content you put on chain; fraud or wilful misconduct; breach of §13.7 (confidentiality); amounts due under §13.8 (indemnity); or liability that the law doesn't allow to be limited. Part B, B11 also takes precedence over this section.

13. General

13.1 Changes. We may update these terms. We'll give you 30 days' notice of a material change by email. A change doesn't affect a plan already paid for.

13.2 Notices. To us: legal@andamio.io. To you: the billing and notice email address on your order, or another address you give us in writing.

13.3 Assignment. Neither of us can transfer this agreement without the other's consent, except to a successor of the whole business.

13.4 Governing law and disputes. Wyoming law governs these terms. We'll first try to settle any dispute by talking for 30 days. If that fails, the dispute is decided by binding arbitration under the JAMS International Arbitration Rules, by one arbitrator. The seat is Cheyenne, Wyoming; the language is English; hearings may be held remotely. Either of us may go to court for urgent interim relief or to collect undisputed unpaid fees.

13.5 Entire agreement. The documents in §1.3 are the whole agreement about Andamio Issuer.

13.6 Independent contractors and third parties. We are independent contractors. No one else, including your learners and teachers, can enforce these terms.

13.7 Confidentiality. Each of us keeps the other's non-public information, including the API key and pricing, confidential during the agreement and for 3 years after it ends, and uses it only for this agreement.

13.8 Indemnity. You'll cover our losses from third-party claims arising from content you put on chain or from your breach of §5.2 or §6.

13.9 Force majeure. Neither of us is liable for delay or failure caused by events beyond our reasonable control, including failures of the Cardano network. If it lasts more than 90 days, either of us may end the agreement by written notice.

13.10 Sanctions. You confirm that you aren't, and aren't owned or controlled by, a person on a United States, European Union or United Kingdom sanctions list, or located in a country under comprehensive sanctions. We may end the agreement at once if that changes.

13.11 Survival. §§3.4, 5, 7.3, 8.2, 11, 12 and 13, and Part B as long as we hold your data, survive the end of the agreement.

13.12 Other terms. If a court or arbitrator finds part of these terms unenforceable, the rest stays in force. A waiver must be in writing. The English version governs.

Part B: Data Processing Schedule (GDPR and UK GDPR, Art. 28)

This schedule applies when Andamio processes personal data on the Customer's behalf under §7.1.

B1. Instructions. Andamio processes the Customer's personal data only to provide the service and on the Customer's documented instructions, which are these terms and the Customer's use of the API. These instructions include publishing the items in §5.1. If the law requires Andamio to process the data otherwise, Andamio will tell the Customer first, unless that law prohibits it. If Andamio thinks an instruction breaks data protection law, it will tell the Customer immediately.

B2. Details of processing.

B3. Confidentiality. People Andamio authorises to process the data are bound by confidentiality.

B4. Security. Andamio applies the measures in Annex 1 (Art. 32).

B5. Sub-processors. The Customer authorises the sub-processors in Annex 2. Andamio will give 30 days' notice of a new sub-processor by email. The Customer may object on reasonable data protection grounds; if we can't resolve the objection, the Customer may end the agreement and receive a refund of the fees for the unused part of the plan (§3.6). Andamio imposes data protection terms on each sub-processor that are no less protective than this schedule, and remains fully liable to the Customer for each sub-processor's performance. One exception: Blockfrost (Five Binaries OÜ, Estonia) has no data processing agreement with Andamio yet. We have requested one. Blockfrost receives only the signed transactions the API submits, which become public on the blockchain once submitted; reads don't go through it. By 31 March 2027 Andamio will either sign a data processing agreement with Blockfrost or stop submitting transactions through it.

B6. Data subjects' rights. Andamio forwards to the Customer any request it receives from a data subject, and doesn't answer it except on the Customer's instruction. Andamio helps the Customer answer such requests, so far as it can given §5.3.

B7. Breaches. Andamio will tell the Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting the Customer's data, and then provide the information in Art. 33(3), in phases where necessary.

B8. Help with compliance. Andamio gives reasonable help with the Customer's security obligations (Art. 32), data protection impact assessments and prior consultations, as far as they concern the service.

B9. End of processing. Andamio holds none of the Customer's personal data off the blockchain apart from logs, which are deleted after 30 days, so there is nothing further to return or delete. Data already published on the blockchain stays public, and Andamio may continue to display it for verification (§8.2).

B10. Audits. Andamio makes available the information needed to show compliance with this schedule, and allows reasonable audits on 30 days' notice, no more than once a year unless a breach or a supervisory authority requires otherwise.

B11. International transfers. Andamio is in the United States; it hosts the service in the EU (Google Cloud, europe-west4, the Netherlands). Where the Customer is subject to the GDPR, the Standard Contractual Clauses (Commission Decision (EU) 2021/914) are incorporated: Module 2, or Module 3 where the Customer is itself a processor, with Andamio as data importer. Clause 7 applies; Clause 9 Option 2 applies with 30 days' notice; under Clauses 17 and 18, the law and courts of Ireland apply. Annexes I to III of the Clauses are B2, Annex 1 and Annex 2. For data subject to the UK GDPR, the UK International Data Transfer Addendum applies. If these terms conflict with the Clauses, the Clauses prevail, including over §12 and §13.4.

Annex 1: security measures. Andamio receives no learner or teacher data that isn't meant to be published on the blockchain, apart from client IP addresses in logs, and stores none off the blockchain except those logs and an index of public blockchain data. API requests are authenticated with a customer API key, which is shown once and stored only in protected form, and are encrypted in transit over public networks; internal traffic stays on Andamio's private network. Each customer can reach only its own account and courses. Data is hosted in the EU, in databases not reachable from the internet, encrypted at rest and backed up. Logs are kept for 30 days. Access by Andamio staff is limited to authorised personnel. Personal data breaches are handled under B7. Dashboard: customers sign in with a social login through utxos.dev and Andamio operators with their own wallet; either way the app checks a wallet signature, and there are no passwords. Each customer can reach only its own account's data, enforced at the data layer. Andamio operator payment and access actions need a separate operator sign-in and are recorded in an append-only audit trail. API keys are envelope-encrypted with a key held in a cloud key-management service, revealed once, and deactivated at the gateway first when revoked. Hosting request logs are kept for 30 days in an EU log bucket.

Annex 2: sub-processors.

The Cardano blockchain is not a sub-processor: it is a public network that no one operates on Andamio's behalf. Data written there is published, as §5.1 says.