Terms of Service

Last Updated: May 12, 2026

Welcome to {{COMPANY_NAME}}. These Terms of Service ("Terms") govern your access to and use of {{COMPANY_NAME}}'s website, services, and applications (the "Service"). Please read these Terms carefully before using the Service. By accessing or using the Service, you agree to be bound by these Terms and by our Privacy Policy. If you do not agree to these Terms, you may not access or use the Service.

1. PREAMBLE, ACCEPTANCE, AND DEFINITIONS

1.1. Introduction and Scope

These Terms of Service (the “Agreement” or “ToS”) constitute a legally binding contract entered into by and between {{COMPANY_NAME}}, a company registered under the laws of France with its registered office at {{COMPANY_ADDRESS}}, registered under SIRET {{COMPANY_SIRET}} (hereinafter referred to as the “Provider”, “we”, “us”, or “our”), and the business entity, merchant, or sole proprietor accessing or using the Platform (hereinafter referred to as the “Customer”, “Tenant”, “you”, or “your”).

1.2. B2B Nature of the Agreement

The Provider’s Platform is intended strictly for commercial and professional use. By accessing the Platform, the Customer explicitly acknowledges and agrees that they are acting in a professional capacity for purposes relating to their trade, business, craft, or profession. Consumer protection laws applicable to strictly B2C (Business-to-Consumer) transactions shall not apply to this Agreement.

1.3. Acceptance of Terms and Corporate Authority

By registering for an account on the Control Plane, clicking an "I Agree" button, checking a consent box, executing an Order Form, or otherwise accessing the Data Plane infrastructure, the Customer unconditionally accepts this Agreement. If the individual accepting this Agreement is doing so on behalf of a corporation, limited liability company, or other legal entity, that individual represents and warrants that they have the full legal authority to bind said entity to these Terms. If the individual lacks such authority, they shall be held personally legally and financially liable for all obligations herein.

1.4. Modification of Terms (Preservation of Economic Balance)

The Provider continuously evolves the Platform and may amend this Agreement over time. However, to preserve the economic balance of the contract and comply with applicable commercial laws, the Parties agree to the following framework for modifications:

1. Material Changes: Any material modifications to this Agreement—specifically including price increases or the removal of core e-commerce functionalities—shall only take effect upon the commencement of the Customer's subsequent billing cycle (e.g., at the start of the next quarter). Such changes will not retroactively alter the terms of a currently paid billing period.
2. Notice and Right of Refusal: The Provider shall provide the Customer with at least thirty (30) days’ prior written notice (via email or a notification within the Control Plane dashboard) of any material changes. If the Customer does not agree to the proposed modifications, they possess the absolute right to reject them by terminating their subscription and canceling their auto-renewal prior to the effective date of the changes.
3. Acceptance: The Customer’s continued use of the Platform following the start of the new billing cycle constitutes unconditional acceptance of the revised Agreement.
4. Imperative Exceptions: Modifications strictly necessary to comply with new legal/regulatory mandates or to deploy critical security updates to the Shared Infrastructure may take effect immediately upon notice.

1.5. Definitions

To ensure precision regarding the technical architecture and allocation of legal liability, the following capitalized terms shall have the specific meanings set forth below:

• "Platform" means the entirety of the Provider’s proprietary B2B2C e-commerce software-as-a-service, encompassing both the Control Plane and the Data Plane, all underlying Kubernetes infrastructure, APIs, dashboards, and associated documentation.
• "Control Plane" means the globally centralized administrative and operational environment operated by the Provider. This includes, but is not limited to, the marketing website, the SaaS registration portal, global billing systems, and the Provider’s internal Superadmin dashboard.
• "Data Plane" (or "Tenant Environment") means the logically isolated e-commerce instance provisioned specifically for the Customer. This encompasses the Customer's administrative dashboard, the public-facing digital storefront, and the logical database (tenant_db) utilized to process End-Consumer transactions.
• "End-Consumer" means the individual, natural person, or entity who visits, interacts with, or executes a commercial purchase on the Customer’s storefront within the Data Plane.
• "Customer Data" means all intellectual property, product catalogs, logos, texts, and financial configurations uploaded by the Customer into the Platform.
• "End-Consumer Data" means any personal data (as defined by the GDPR/CCPA), payment data, or behavioral data submitted by an End-Consumer on the Customer’s storefront.
• "Shared Infrastructure" means the standard operational tier wherein the Customer's Data Plane is logically isolated via network policies and namespaces, but resides on hardware shared with other tenants.
• "VIP Dedicated Infrastructure" means an enterprise-tier deployment wherein the Customer’s Data Plane is physically isolated on a single-tenant server environment, subject to overriding terms in an Enterprise Service Level Agreement.
• "Superadmin Access" means the Provider’s proprietary cryptographic token (JWT) generation system within the Control Plane, utilized solely to grant Provider’s technical support personnel temporary, logged, and secure access to the Customer's Data Plane for maintenance or troubleshooting purposes, strictly subject to the technical mandate provisions outlined in Chapter 7.
• "Malicious Code" means any viruses, malware, Trojan horses, ransomware, time bombs, or other destructive scripts designed to compromise, overburden, or breach the logical isolation of the Platform.

2. ACCOUNT REGISTRATION & SECURITY

2.1. Account Creation and Information Accuracy

To access the Platform and provision a Data Plane environment, the Customer must register for an administrative account via the Provider’s Control Plane. The Customer warrants that all information provided during registration—including, but not limited to, the legal entity name, primary contact email, billing address, and authorized representative details—is accurate, current, and complete. The Customer assumes a continuous obligation to update this information within the Control Plane promptly should any changes occur. The Provider reserves the right to suspend or terminate the Customer’s account without liability if any provided information is found to be false, fraudulent, or intentionally misleading.

2.2. Credential Security and Customer Liability

The Customer is solely and exclusively responsible for maintaining the confidentiality, security, and strict control of all usernames, passwords, API keys, and multi-factor authentication (MFA) tokens associated with their Control Plane account and their individual Data Plane administrative dashboard. While the Provider utilizes enterprise-grade secret management to secure internal infrastructure, the Provider does not have access to, nor does it store, the Customer's plaintext passwords. Consequently, the Provider shall bear absolutely no liability for any unauthorized access, data loss, or compromise of End-Consumer Data arising from the Customer’s failure to adequately secure their credentials, including but not limited to instances of phishing, social engineering, or the reuse of compromised passwords.

2.3. Multi-User Access and Authorization

If the Customer utilizes features within the Platform to grant access to secondary users, employees, or third-party contractors (e.g., creating staff accounts within their Data Plane dashboard), the Customer remains vicariously strictly liable for all actions, omissions, and platform configurations executed by those authorized users. The Customer is responsible for enforcing appropriate permissions and access controls for all internal users.

2.4. Unauthorized Access and Mandatory Breach Notification

In the event the Customer discovers or reasonably suspects any unauthorized use of their account, compromised credentials, or a security breach affecting their Data Plane environment, the Customer must notify the Provider immediately, and in no event later than seventy-two (72) hours following discovery. This notification must be sent to {{SECURITY_EMAIL}}. Failure to provide prompt notification constitutes a material breach of this Agreement. Upon receipt of such notification, the Provider reserves the right to unilaterally suspend the Customer's Data Plane environment to protect the integrity of the Shared Infrastructure, without such suspension constituting a breach of the Provider’s service level obligations.

2.5. Right to Deny Access

The Provider reserves the right to deny registration, refuse service, or restrict access to the Platform to any entity or individual, at its sole discretion, including but not limited to instances where the Provider determines that the Customer poses a security risk to the overarching Kubernetes architecture or violates the Acceptable Use Policy.

3. PLATFORM PROVISIONING & ARCHITECTURE

3.1. Standard Provisioning and Shared Infrastructure

Upon successful registration and payment of applicable fees via the Control Plane, the Provider shall automatically provision a Data Plane environment (the digital storefront and administrative dashboard) for the Customer. Unless otherwise explicitly agreed upon in a signed Enterprise Order Form, the Customer acknowledges and agrees that their Data Plane is deployed on the Provider’s Shared Infrastructure. Within this Shared Infrastructure, the Customer’s data and application environments are logically isolated utilizing industry-standard network policies and container orchestration namespaces (e.g., Kubernetes). The Customer explicitly acknowledges that "logical isolation" does not equate to physical hardware isolation, and their environment will operate on shared computational, storage, and networking resources alongside other tenants.

3.2. VIP Dedicated Infrastructure

Customers requiring physical isolation, single-tenant hardware, strict geographic data fencing, or custom compliance auditing must upgrade to the Provider’s VIP Dedicated Infrastructure tier. Access to dedicated infrastructure is governed entirely by a separate, customized Enterprise Agreement and an enhanced Service Level Agreement (SLA). None of the heightened security, uptime, or liability commitments associated with the VIP Dedicated Infrastructure shall apply to Customers utilizing the Standard Shared Infrastructure under this Agreement.

3.3. Continuous Development and Platform Modifications

The Platform is provided strictly as a Software-as-a-Service (SaaS). As such, the Provider maintains the overarching architecture and codebase centrally. Subject to the economic balance provisions outlined in Section 1.4, the Provider reserves the right to continuously develop, modify, update, patch, upgrade, or deprecate technical features of the Platform (including both the Control Plane and Data Plane environments) to maintain industry standards and system security. While the Provider will make commercially reasonable efforts to ensure that updates do not materially degrade the core e-commerce functionality of the Customer’s storefront, the Provider is under no obligation to maintain legacy versions of the software or custom configurations that conflict with architectural updates.

3.4. System Integrity, Resource Limits, and Automated Precautionary Measures

To protect the stability, security, and performance of the Shared Infrastructure for all tenants, the Provider imposes automated computational and networking resource limits on each Data Plane instance. The Customer agrees not to bypass, exploit, or engineer workarounds to these limits.

In the event that the Customer’s Data Plane experiences anomalous traffic spikes, sustained excessive resource consumption, or becomes the target of a Distributed Denial of Service (DDoS) attack that threatens the stability of the overarching cluster, the Provider’s systems may automatically deploy precautionary measures (mesures conservatoires), including temporarily throttling, rate-limiting, or suspending the Customer’s Data Plane.

Erroneous Suspensions (False Positives): The Customer acknowledges that these automated network-protection algorithms operate in real-time to protect the infrastructure. In the event of an erroneous automated suspension caused by the Provider's systems misidentifying legitimate traffic (e.g., a major promotional event) as a threat, the Provider’s immediate obligation is the prompt investigation and manual restoration of the Customer's Data Plane upon notification. Any verifiable period of unavailability resulting from an erroneous automated suspension shall be classified as "Downtime" and will be strictly governed by, and compensated through, the Service Credit mechanisms defined in the Service Level Agreement (SLA), subject to the overarching limitations of liability defined in this Agreement.

3.5. Automated Security Interventions

The Provider employs network-level security measures, including but not limited to automated anti-virus interception (e.g., ClamAV) and enterprise-grade secret management. The Customer explicitly authorizes the Provider’s systems to automatically scan, block, quarantine, or delete any file, payload, or transmission initiated by the Customer or their End-Consumers that the platform’s security protocols flag as Malicious Code, without prior notice. The Provider assumes no liability for the deletion of files reasonably flagged as malicious by these automated systems, provided such systems are operating under standard industry parameters.

4. DATA PROTECTION & PRIVACY

4.1. Legal Roles and Classifications

To ensure strict compliance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the California Consumer Privacy Act ("CCPA"), the Parties acknowledge and agree to the following distinct legal classifications based on the Platform’s architecture:

• The Control Plane (Provider as Data Controller): The Provider acts as the Data Controller regarding the personal data submitted by the Customer to register, bill, and administer their SaaS subscription (e.g., Customer’s name, professional email, billing details). The processing of this data is governed exclusively by the Provider’s Global Privacy Policy.
• The Data Plane (Provider as Data Processor; Customer as Data Controller): The Customer acts as the sole Data Controller—or the equivalent concept under applicable law—for all End-Consumer Data collected, processed, or stored within the Customer's public-facing digital storefront and tenant_db. The Provider acts strictly as a Data Processor, processing End-Consumer Data solely on the documented instructions of the Customer, which are executed automatically via the Customer's configuration and use of the Platform.

4.2. Incorporation of the Data Processing Agreement (DPA)

The Parties agree that the processing of all End-Consumer Data within the Data Plane shall be exclusively governed by the Provider’s Data Processing Agreement ("DPA"), located at Data Processing Agreement. The DPA is hereby incorporated by reference and forms an integral, legally binding part of this Agreement. In the event of any conflict or inconsistency between the terms of this Agreement and the DPA regarding the processing of personal data, the terms of the DPA shall strictly prevail.

4.3. Customer’s Obligations as Data Controller

As the Data Controller of the Data Plane, the Customer assumes full, absolute, and exclusive responsibility for complying with all applicable global privacy laws. The Customer explicitly represents, warrants, and agrees that they shall:

1. Provide legally adequate privacy notices to their End-Consumers.
2. Obtain and maintain all necessary legal basis, consents, and permissions required to collect, process, and transfer End-Consumer Data into the Platform.
3. Deploy legally compliant cookie banners and consent mechanisms on their storefront, specifically acknowledging that the Provider does not inject third-party marketing or tracking scripts into the Customer's Data Plane by default.
4. Handle all Data Subject Access Requests (DSARs), deletion requests, and inquiries from End-Consumers. The Provider disclaims all liability arising from the Customer’s failure to fulfill their obligations as a Data Controller. The Customer agrees to fully indemnify and hold the Provider harmless against any claims, fines, or regulatory actions resulting from the Customer’s privacy violations.

4.4. Data Sovereignty and Localization

The Provider recognizes the critical nature of data localization. For Customers utilizing the standard Shared Infrastructure and indicating a primary business address within the European Economic Area (EEA), the Provider guarantees that the physical hosting of the Data Plane (including the tenant_db and persistent storage via MinIO) shall remain entirely within data centers located in the European Union (e.g., France or Germany). Any transfer of data outside the prescribed region will solely occur upon the explicit technical instruction of the Customer or when mandated by law, and will be governed by the standard contractual clauses detailed in the DPA.

4.5. Aggregated and Anonymized Data

While the Provider claims no ownership over the raw End-Consumer Data, the Customer grants the Provider a perpetual, irrevocable, worldwide, royalty-free right to generate anonymized, de-identified, and highly aggregated statistical data relating to the operational performance and usage of the Platform. This anonymized data, which cannot under any circumstances be reverse-engineered to identify the Customer or any individual End-Consumer, shall be the exclusive property of the Provider and may be used for security analysis, infrastructure optimization, and capacity planning.

5. ACCEPTABLE USE & STOREFRONT RESPONSIBILITIES

5.1. Acceptable Use Policy (AUP) Incorporation

The Customer agrees to use the Platform strictly in accordance with the Provider’s Acceptable Use Policy ("AUP"), located at Acceptable Use Policy, which is hereby incorporated by reference. The Customer is strictly prohibited from utilizing their Data Plane environment to host, sell, transmit, or promote:

1. Counterfeit, pirated, or stolen goods, or any items that infringe upon third-party intellectual property rights.
2. Illegal, regulated, or dangerous goods, including but not limited to firearms, explosives, illegal narcotics, or unapproved pharmaceuticals.
3. Fraudulent schemes, pyramid schemes, or deceptive marketing practices.
4. Content that is defamatory, obscene, discriminatory, or promotes violence. The Provider reserves the right to immediately, and without prior notice, suspend or terminate the Customer’s Data Plane environment if it reasonably suspects a violation of the AUP.

5.2. Disavowal of the E-Commerce Relationship

The Provider is strictly a technology infrastructure vendor providing Software-as-a-Service. The Provider is not a marketplace, a merchant of record, an auctioneer, or an intermediary to the commercial transactions executed on the Platform. A contract of sale formed through the Customer’s Data Plane is strictly between the Customer and the End-Consumer. The Provider disclaims any and all liability arising from or related to the products, services, or digital goods offered by the Customer.

5.3. Customer’s Operational Responsibilities

The Customer acknowledges and agrees that they bear sole and exclusive responsibility for the operation of their digital storefront, including but not limited to:

1. Fulfillment and Delivery: Ensuring the timely processing, shipping, and delivery of all goods or services purchased by End-Consumers.
2. Customer Service: Acting as the sole point of contact for End-Consumers regarding product inquiries, complaints, returns, exchanges, and warranties.
3. Financial Disputes: Managing and resolving all payment disputes, chargebacks, and refund requests directly with their chosen payment gateway and the End-Consumer. The Provider shall not intermediate, arbitrate, or financially cover any chargebacks incurred by the Customer.

5.4. Mandatory Storefront Legal Documentation

To maintain compliance with global consumer protection laws, the Customer explicitly agrees to draft, prominently display, and enforce their own legal documentation on their public-facing Data Plane storefront. At a minimum, the Customer must maintain:

1. Terms and Conditions of Sale (e.g., Conditions Générales de Vente - CGV): Clearly outlining the rules of purchase, delivery timelines, consumer withdrawal rights (e.g., the 14-day right of withdrawal under EU law), and return policies.
2. Privacy Policy & Cookie Policy: As mandated in Section 4 of this Agreement.
3. Legal Notice (Mentions Légales / Impressum): Accurately displaying the Customer's corporate identity, registration number, physical address, and contact information, as required by the laws of the jurisdictions in which they operate and target End-Consumers.

5.5. Tax Liability and Regulatory Compliance

The Customer is solely and exclusively responsible for determining, calculating, collecting, reporting, and remitting all applicable taxes, duties, and fees (including but not limited to Value Added Tax (VAT), sales tax, and customs duties) arising from the sale of goods or services on their storefront. The Provider does not calculate, collect, or remit taxes on behalf of the Customer or their End-Consumers. The Customer warrants that their business operations fully comply with all local, regional, and international commerce, export control, and consumer protection laws applicable to their specific industry and target markets.

5.6. Indemnification by the Customer

The Customer agrees to fully indemnify, defend, and hold harmless the Provider, its officers, directors, employees, and infrastructure partners (sub-processors) from and against any and all claims, damages, liabilities, fines, regulatory penalties, costs, and expenses (including reasonable legal fees) arising directly or indirectly from: (a) the Customer’s breach of this Chapter 5; (b) any dispute between the Customer and an End-Consumer; (c) the sale of defective, illegal, or harmful products; or (d) the Customer’s failure to comply with applicable tax obligations or consumer protection laws.

6. FEES, BILLING, & PAYMENTS

6.1. Subscription Fees and Quarterly Billing Cycle

In consideration for the provision of the Platform and the hosting of the Customer’s Data Plane environment, the Customer agrees to pay the Provider the subscription fees explicitly displayed on the Control Plane at the time of registration or as otherwise agreed upon in an active Order Form. Unless explicitly stated otherwise, all standard SaaS subscriptions are billed on a quarterly basis (every three months). All subscription fees are billed and payable in advance of the applicable quarterly service period.

6.2. Payment Processing and Authorization

The Provider utilizes third-party payment processors (e.g., Payplug, Stripe) within the Control Plane to securely manage billing and recurring subscriptions. By providing a valid credit card, SEPA mandate, or other approved payment method, the Customer explicitly authorizes the Provider (and its designated third-party processors) to automatically charge the payment method on file for the full quarterly subscription fee at the beginning of each billing cycle. The Customer warrants that they are the authorized user of the provided payment method and that the account contains sufficient funds to cover the charges.

6.3. Auto-Renewal and No Prorated Refunds

To ensure uninterrupted operation of the Customer’s digital storefront, all quarterly subscriptions will automatically renew for successive three-month periods unless the Customer formally cancels their subscription via their Control Plane administrative dashboard prior to the end of the current billing cycle. Because the Provider incurs upfront infrastructure and provisioning costs for the Data Plane, all fees are non-cancellable and non-refundable. If the Customer terminates their subscription prior to the end of their current quarterly billing cycle, they will retain access to the Platform until the conclusion of that cycle, but no prorated refunds will be issued for unused time.

6.4. Late Payments and Graduated Service Suspension

Time is of the essence regarding payment, but the Provider acknowledges the importance of the Customer's ongoing business operations. If a payment fails or an invoice becomes past due, the Provider shall enforce a graduated suspension protocol to avoid an abrupt rupture of commercial relations:

1. Notice and Grace Period: The Provider will issue an automated electronic notice of default. The Customer shall have a grace period of seven (7) calendar days to clear the balance.
2. Step 1 - Control Plane Suspension (J+7): If payment is not received after seven (7) days, the Provider reserves the right to suspend the Customer's access to the Control Plane and Data Plane administrative dashboard. Crucially, the Customer’s public-facing digital storefront (Data Plane) will remain online and capable of processing End-Consumer transactions during this phase.
3. Step 2 - Formal Notice (Mise en Demeure): Prior to further action, the Provider shall send a formal written notice of default to the Customer.
4. Step 3 - Data Plane Suspension (J+30): If the outstanding balance remains unpaid thirty (30) days following the initial default and after the issuance of the formal notice, the Provider reserves the right to suspend the Data Plane entirely, rendering the public storefront offline. The Provider shall bear no liability for any lost revenue or End-Consumer claims arising from a storefront suspension executed in accordance with this graduated protocol.

6.5. Taxes and VAT (Value Added Tax)

All fees listed on the Provider's website or Order Forms are exclusive of all applicable taxes, levies, or duties imposed by taxing authorities. As a business-to-business (B2B) transaction governed under French law, the application of Value Added Tax (VAT) shall be determined by the Customer’s location and corporate status:

• French Customers: Standard French VAT will be applied to the subscription fees.
• EU Customers (Outside France): If the Customer provides a valid intra-community VAT number, the "reverse charge" mechanism will apply, and VAT will not be charged by the Provider. If no valid VAT number is provided, standard French VAT will apply.
• Non-EU Customers: Subscriptions are generally not subject to EU VAT, provided the Customer furnishes valid proof of their corporate establishment outside the European Union.

VAT Accuracy and Tax Indemnification: The Provider shall verify the Customer's intra-community VAT number via the European VIES database. However, the Customer explicitly warrants the legal validity, accuracy, and appropriate corporate ownership of the VAT information provided within the Control Plane. In the event that the French tax administration (Direction Générale des Finances Publiques) or any other competent tax authority assesses back taxes, penalties, or fines against the Provider resulting from the Customer furnishing an invalid, fraudulent, or misappropriated VAT number, the Customer agrees to fully indemnify and promptly reimburse the Provider for all such assessed costs.

6.6. Right to Modify Pricing (Preservation of Economic Balance)

The Provider reserves the right to adjust its subscription fees. However, to maintain the economic balance of the contract, the subscription price is locked for the duration of the Customer's currently paid quarterly cycle. Any price increases will only apply at the start of the Customer’s subsequent quarterly billing cycle. The Provider will notify the Customer of any upcoming price changes in writing at least thirty (30) days prior to the billing cycle in which the changes will take effect. If the Customer does not agree to the new fees, their sole remedy is to reject the increase by canceling their auto-renewal prior to the start of the new quarter.

7. TECHNICAL SUPPORT & SYSTEM ACCESS

7.1. Standard Support and Service Level Agreement (SLA)

The Provider offers technical support to assist the Customer with the configuration, operation, and troubleshooting of their Data Plane environment. For Customers on the Standard Shared Infrastructure, technical support is provided via email or the Control Plane ticketing system during standard business hours: Monday through Friday, 9

7.2. Zero-Knowledge Credential Architecture

To ensure the highest level of security and enforce the logical separation between the Control Plane and the Data Plane, the Provider employs a zero-knowledge architecture regarding Customer credentials. The Provider does not store, process, or possess the ability to retrieve the Customer’s plaintext administrative passwords for their individual Data Plane storefront.

7.3. Superadmin Access and "Express Technical Mandate" (Mandat Technique Exprès)

To facilitate effective technical support without compromising credential security, the Provider’s architecture utilizes a secure, cryptographically signed token system (JSON Web Tokens or "JWT"). By submitting a technical support request that requires backend intervention, the Customer grants the Provider an Express Technical Mandate (Mandat Technique Exprès) to generate a short-lived JWT, allowing the Provider’s authorized personnel to temporarily bypass the login screen and access the Customer’s administrative dashboard.

Liability during Mandated Access: The Parties explicitly agree that when the Provider's personnel utilize this Superadmin access to execute a Customer-Initiated Request, they act as technical experts executing a mandate on behalf of the Customer. The Provider commits to executing these interventions with standard professional care. The Provider shall not be held liable for any negative outcomes resulting directly from executing the Customer's explicit, flawed instructions. In the event of an error, omission, or standard negligence (faute simple) committed by the Provider's personnel during a mandated support session that results in data loss or configuration corruption, the Provider's total liability shall remain strictly governed by, and capped according to, the Limitation of Liability provisions set forth in Chapter 10 of this Agreement.

The Provider strictly limits the use of this Superadmin access to the following exclusive purposes:

1. Customer-Initiated Requests: Investigating, troubleshooting, or resolving a specific technical issue raised by the Customer via a support ticket.
2. Critical Maintenance: Deploying emergency security patches or resolving severe platform-wide anomalies.
3. AUP Enforcement: Investigating credible reports of severe violations of the Acceptable Use Policy.

7.4. Security Controls and Immutable Audit Logging

To protect the Customer’s privacy, demonstrate the exact boundaries of the Express Technical Mandate, and fulfill the Provider’s obligations as a Data Processor, the Provider maintains strict technical and organizational measures (TOMs):

• Short-Lived Expiration: All JWT tokens are technically configured to expire automatically after a brief, predefined period.
• Role-Based Access Control (RBAC): The ability to generate a token is heavily restricted to authorized senior technical personnel.
• Immutable Audit Trails: Every instance of Superadmin Access is automatically recorded in a secure, immutable audit log capturing the timestamp, personnel identity, Data Plane targeted, and actions performed. These logs serve as the definitive record of the Provider's actions during a mandated support session.

8. INTELLECTUAL PROPERTY RIGHTS

8.1. Provider Intellectual Property and Proprietary Rights

The Provider retains all right, title, and interest—including all patents, copyrights, trademarks, trade secrets, and other intellectual property rights—in and to the Platform. This includes, without limitation, the overarching Control Plane, the Data Plane architecture, the underlying Kubernetes orchestrations, source code, object code, APIs, database schemas, user interface designs (UI/UX) of the administrative dashboards, documentation, and any overarching software developed by the Provider. This Agreement is a subscription for access to a Software-as-a-Service (SaaS); it is not an agreement for the sale, transfer, or work-for-hire development of any software. The Customer is granted only a limited, non-exclusive, non-transferable, and revocable right to access and use the Platform for its intended commercial purpose during the term of their active subscription. The Customer shall not reverse-engineer, decompile, disassemble, or attempt to derive the source code or architectural framework of the Platform.

8.2. Customer Intellectual Property and Data Ownership

The Customer expressly retains all right, title, and interest in and to all Customer Data uploaded to or processed through the Platform. This explicitly includes the Customer’s trade names, trademarks, logos, custom storefront designs (e.g., custom CSS or HTML configurations), product catalogs, pricing data, multimedia assets, and proprietary lists of End-Consumers. By utilizing the Platform, the Customer grants the Provider a limited, non-exclusive, worldwide, royalty-free license to host, process, display, transmit, and create secure backups of the Customer Data strictly for the technical purpose of provisioning the Data Plane, rendering the digital storefront to End-Consumers, and fulfilling the Provider’s obligations under this Agreement. The Provider asserts no ownership claims over the Customer’s core business assets or End-Consumer relationships.

8.3. Feedback, Feature Requests, and Unsolicited Ideas

The Provider highly values Customer feedback to improve the Platform. However, to avoid any future disputes regarding intellectual property ownership, the Customer agrees that any suggestions, enhancement requests, bug reports, architectural recommendations, or other feedback provided to the Provider relating to the operation or functionality of the Platform (collectively, "Feedback") shall be given entirely voluntarily. By submitting Feedback, the Customer grants the Provider an absolute, perpetual, irrevocable, worldwide, royalty-free, and fully sub-licensable right to use, implement, commercialize, and incorporate such Feedback into the Platform. The Provider shall retain sole and exclusive intellectual property ownership over any newly developed features, codebases, or infrastructural updates resulting from Customer Feedback. The Customer expressly waives any right to claim authorship, equity, royalties, or ownership over modifications made to the Platform, even if those modifications were directly inspired by the Customer’s suggestions.

8.4. Protection Against Intellectual Property Infringement

The Customer warrants that they possess all necessary legal rights, licenses, and permissions to utilize and publicly display the Customer Data on their Data Plane storefront. The Customer explicitly agrees not to upload, sell, or distribute any materials, products, or digital assets that infringe upon the intellectual property rights (including copyrights, trademarks, or patents) of any third party. To comply with global copyright regulations (including the EU Copyright Directive and the US DMCA), the Provider reserves the right to immediately remove or disable access to any Customer Data or storefront that is the subject of a valid, legally binding notice of intellectual property infringement, without prior notice or liability to the Customer.

9. WARRANTIES, DISCLAIMERS, & SLA

9.1. Service Level Agreement (SLA) and Remedies

The Provider is committed to providing a reliable, highly available Platform. For Customers utilizing the standard Shared Infrastructure, the Provider agrees to make commercially reasonable efforts to maintain a monthly uptime percentage of 99.5% for the Customer’s public-facing Data Plane storefront. The specific metrics for calculating uptime, defining scheduled maintenance windows, and outlining the process for claiming downtime compensation are governed exclusively by the Provider’s Service Level Agreement ("SLA"), located at Service Level Agreement. In the event the Provider fails to meet the 99.5% uptime commitment, the Customer’s sole and exclusive remedy shall be the issuance of financial service credits to be applied against future quarterly billing cycles, as strictly defined within the SLA document. Under no circumstances will downtime result in a cash refund or constitute a material breach of this Agreement allowing for termination with cause.

9.2. "As-Is" and "As Available" Disclaimer

Except for the specific operational commitments explicitly outlined in the aforementioned SLA, the Platform—including both the Control Plane and Data Plane, underlying infrastructure, and all associated services—is provided on an "AS IS" and "AS AVAILABLE" basis. To the maximum extent permitted by applicable law, the Provider entirely disclaims all warranties, whether express, implied, statutory, or otherwise. The Provider specifically disclaims any implied warranties of merchantability, fitness for a particular purpose, non-infringement, and title. The Provider does not warrant that the Platform will be completely error-free, completely secure from unauthorized intrusion (despite the utilization of enterprise-grade security protocols like HashiCorp Vault and Kubernetes logical isolation), or that its operation will be completely uninterrupted.

9.3. No Guarantee of Commercial Success

The Provider supplies the technological infrastructure and administrative tools required to operate a digital storefront; however, the Provider makes absolutely no representations, warranties, or guarantees regarding the commercial viability of the Customer’s business. The Customer explicitly acknowledges that the Provider does not guarantee any specific level of web traffic, conversion rates, customer acquisition, or gross merchandise value (GMV). The Customer's e-commerce revenue and overall business success are strictly dependent on the Customer's own products, marketing efforts, pricing strategies, and market conditions. The Provider shall bear no liability whatsoever if the Customer fails to achieve expected financial results while utilizing the Platform.

9.4. Sub-processor Operations

The Platform’s architecture relies on critical third-party infrastructure providers (e.g., OVHcloud for hosting, Payplug for payment processing). While the Provider carefully selects its sub-processors, the Provider does not directly manage their internal networks. The Provider's liability regarding outages, data loss, or service degradation caused by these sub-processors is governed entirely, and strictly limited by, the provisions set forth in Chapter 10 of this Agreement.

10. LIMITATION OF LIABILITY

10.1. Exclusion of Indirect and Consequential Damages (Protection of the Essential Obligation)

To the maximum extent permitted by applicable French commercial law, in no event shall the Provider, its affiliates, directors, employees, or sub-processors be liable to the Customer, the End-Consumer, or any third party for any indirect, incidental, special, consequential, punitive, or exemplary damages. Given the nature of e-commerce, the Provider explicitly and absolutely disclaims any liability for:

1. Lost Profits or Revenue: Any loss of sales, anticipated savings, or commercial opportunities arising from the Customer's inability to process transactions during a storefront outage, including outages resulting from automated precautionary measures (Section 3.4) or SLA breaches.
2. Business Interruption: Any damages resulting from the suspension of the Data Plane due to scheduled maintenance, good-faith algorithmic interventions, or AUP enforcement.
3. Reputational Damage: Any loss of goodwill or brand value resulting from platform performance or data breaches.
4. Lost Customer Data: Any costs associated with the recovery, recreation, or loss of End-Consumer Data, product catalogs, or storefront configurations, except where explicitly governed by the Data Processing Agreement (DPA).

10.2. Absolute Cap on Direct Damages

Notwithstanding anything to the contrary contained in this Agreement, if the Provider is found legally liable for any direct damages arising out of or relating to this Agreement, the Platform, or the failure of the underlying infrastructure, the Provider’s total, cumulative financial liability shall be strictly and absolutely capped. Under no circumstances shall the Provider’s total liability exceed the total amount of subscription fees actually paid by the Customer to the Provider during the twelve (12) months strictly preceding the event giving rise to the initial claim. The existence of multiple claims or breaches shall not enlarge or extend this financial limit.

10.3. Sub-processor Liability and OVHcloud Exemptions

The Customer acknowledges that the Provider’s Platform (both the Control Plane and Data Plane) is logically built upon physical hardware and networking infrastructure owned, maintained, and operated by a third-party sub-processor, namely OVHcloud (OVH Groupe SAS). As the primary contractor, the Provider assumes legal responsibility for the delivery of the SaaS service, including the actions of its sub-processors. However, the Parties expressly agree that in the event of a prolonged outage, data loss, or hardware destruction caused directly by a physical catastrophe, network severance, or severe hardware failure at the OVHcloud infrastructure level, the Provider's liability to the Customer shall be strictly limited to:

1. The maximum financial cap defined in Section 10.2; and
2. The proportional passing-through of any Service Level Agreement (SLA) credits or financial compensation that the Provider successfully claims and recovers from OVHcloud for that specific incident. The Parties acknowledge that this limitation is a fundamental condition of the pricing of the SaaS subscription and does not empty the Provider's essential contractual obligation of its substance.

10.4. End-Consumer Claims

The Customer assumes total and sole liability for all interactions, transactions, and legal relationships with their End-Consumers. The Customer agrees that the Provider shall have no liability whatsoever for any claims, lawsuits, or demands brought against the Customer by an End-Consumer relating to product liability, failed deliveries, consumer protection violations, or the Customer's failure to process refunds.

10.5. Essential Purpose

The Parties acknowledge and agree that the limitations of liability, disclaimers of warranties, and caps on damages set forth in this Agreement form an essential basis of the bargain between the Provider and the Customer. The quarterly subscription fees for the Platform have been calculated and set in direct reliance upon these strict allocations of risk. These limitations shall apply even if an exclusive or limited remedy stated herein fails of its essential purpose.

11. TERM, SUSPENSION, & TERMINATION

11.1. Term of Agreement

This Agreement shall commence on the date the Customer first successfully registers an account on the Control Plane and shall continue in full force and effect for the duration of the Customer’s active subscription (the "Term"). As established in Chapter 6, standard subscriptions operate on an automatically renewing quarterly basis unless otherwise terminated in accordance with this Chapter.

11.2. Termination for Convenience (Customer Cancellation)

The Customer may terminate this Agreement and cancel their subscription at any time, for any reason, by executing the cancellation protocol within their Control Plane administrative dashboard. To prevent automatic billing for the subsequent quarter, the Customer must initiate this cancellation prior to the expiration of their current quarterly billing cycle. Upon cancellation, the Customer will retain full access to their Data Plane environment until the conclusion of the current, fully paid billing cycle. In accordance with Section 6.3, the Provider shall not issue prorated refunds for any unused portion of the quarter.

11.3. Suspension and Termination for Cause (Provider Rights)

To protect the integrity of the Shared Infrastructure and comply with French commercial law, the Provider’s right to suspend or terminate this Agreement for cause is categorized based on the severity of the Customer’s breach:

A. Termination with Notice (Standard Breaches & Non-Payment): For standard material breaches of this Agreement, including the failure to pay outstanding subscription fees, the Provider shall strictly adhere to the Graduated Service Suspension protocol defined in Section 6.4. The Provider may fully terminate this Agreement only if the Customer fails to cure the breach or clear the outstanding balance within thirty (30) days following the issuance of a formal written notice of default (mise en demeure).

B. Immediate Suspension and Termination (Critical Threats): Notwithstanding the above, the Provider reserves the right to immediately suspend access to the Customer’s Data Plane (rendering the digital storefront offline) or irrevocably terminate this Agreement without prior notice and without liability under the following critical circumstances:

1. Severe AUP Violation: The Customer clearly and severely violates the Acceptable Use Policy, such as selling illegal or prohibited goods, executing fraudulent schemes, or intentionally infringing upon third-party intellectual property rights.
2. Security Threat: The Customer introduces, intentionally or negligently, Malicious Code into the Platform, or the Provider's automated security systems (e.g., ClamAV) detect that the Customer’s Data Plane poses an imminent, real-time threat to the overarching Kubernetes Shared Infrastructure or OVHcloud network.
3. Legal Mandate: The Provider receives a binding subpoena, court order, or directive from a regulatory authority (e.g., the CNIL, DGCCRF, or law enforcement) requiring the immediate takedown of the Customer’s storefront.

11.4. Effect of Termination

Upon the effective date of termination (whether for convenience or for cause), all licenses and access rights granted to the Customer under this Agreement shall immediately cease. The Customer’s Data Plane environment, including the administrative dashboard and public-facing storefront, will be taken offline. The Customer shall immediately cease all use of the Platform and any associated Provider intellectual property.

11.5. Data Retrieval and Irreversible Deletion

The Provider strictly adheres to the principle of data minimization under the GDPR. Upon the effective date of termination, the Customer shall be granted a strictly limited, thirty (30) calendar day window to export their Customer Data and End-Consumer Data from the Platform. This export must be conducted via the standard export tools provided within the Control Plane or Data Plane interfaces prior to the termination date, or via a temporary retrieval link provided upon request.

Upon the expiration of this 30-day window, the Provider's automated orchestration systems will permanently and irrevocably delete the Customer's logical database (tenant_db), all associated object storage (MinIO), and all storefront configurations.

The Customer explicitly acknowledges that:

1. Once this automated purge occurs, the data cannot be recovered, restored, or provided to the Customer under any circumstances.

2. Residual copies of the data may persist in encrypted, inaccessible archival backups for up to an additional sixty (60) days, after which they will be automatically overwritten.

3. The Provider shall bear absolutely no liability for the deletion of Customer Data or End-Consumer Data executed in compliance with this timeline.

   12. GOVERNING LAW & DISPUTE RESOLUTION

12.1. Governing Law

This Agreement, the Data Processing Agreement (DPA), the Acceptable Use Policy (AUP), and any associated Order Forms, as well as any non-contractual obligations arising out of or in connection with them, shall be governed by, construed, and enforced exclusively in accordance with the laws of France. The Parties expressly agree that the application of the United Nations Convention on Contracts for the International Sale of Goods (CISG) and any international conflict of law principles that might dictate the application of the laws of another jurisdiction are entirely excluded from this Agreement.

12.2. Mandatory Informal Dispute Resolution

The Provider and the Customer agree that the most efficient and cost-effective method to resolve any claim, controversy, or dispute arising out of or relating to this Agreement, the Platform, or a breach thereof (a "Dispute"), is through direct, good-faith negotiation. Before initiating any formal legal proceeding, the initiating Party must first send a written "Notice of Dispute" to the other Party. If the Customer initiates the Dispute, the Notice must be sent to the Provider’s registered legal address and emailed to {{SUPPORT_EMAIL}}. The Notice must contain: (a) a detailed description of the nature and basis of the claim; (b) the specific technical or operational facts supporting the claim; and (c) the specific financial or operational relief sought. Upon receipt of the Notice, the Parties agree to designate authorized representatives (e.g., executives or founders) to negotiate in good faith to resolve the Dispute. Neither Party may commence formal legal action until at least thirty (30) calendar days have elapsed from the date the Notice of Dispute was officially received. 12.3. Exclusive Jurisdiction and Venue If the Parties are unable to resolve the Dispute through the mandatory informal negotiation period outlined in Section 12.2, the Parties irrevocably agree that all formal legal proceedings, lawsuits, or claims shall be brought exclusively before the Commercial Court of Lyon (Tribunal de Commerce de Lyon), France. The Customer expressly consents to the exclusive personal jurisdiction and venue of the Commercial Court of Lyon, and completely waives any objections to such jurisdiction or venue, including any arguments of forum non conveniens (inconvenient forum).

12.4. Exceptions to Informal Dispute Resolution (Injunctive Relief)

Notwithstanding the 30-day mandatory informal negotiation period set forth in Section 12.2, the Provider reserves the right to immediately seek urgent injunctive relief, restraining orders, or other equitable remedies from the Commercial Court of Lyon (or any other court of competent jurisdiction) without prior notice or delay, in circumstances where:

1. The Customer is actively infringing upon, misappropriating, or violating the Provider’s Intellectual Property Rights (as defined in Chapter 8).
2. The Customer’s actions pose an immediate, severe security threat to the Shared Infrastructure, the OVHcloud network, or the data integrity of other tenants.
3. The Customer is actively engaged in a severe violation of the Acceptable Use Policy (AUP) that necessitates immediate intervention to prevent irreparable harm to the Provider’s business operations or regulatory standing.

12.5. Severability and Waiver

If any provision of this Agreement is found by a court of competent jurisdiction to be invalid, illegal, or unenforceable, such provision shall be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law. The remaining provisions of this Agreement shall remain in full force and effect. The failure of the Provider to strictly enforce any right or provision of this Agreement shall not constitute a waiver of that right or provision, nor shall it establish a precedent precluding the Provider from enforcing that provision in the future.