Terms of Service

Preamble

Welcome to noauth.sh. This document constitutes a legally binding agreement (hereinafter, the "Agreement") between the legal entity operating noauth.sh ("Provider," "We," "Us") and the natural person or legal entity that subscribes to, accesses, or uses our service ("Customer," "You").

This Agreement governs your access to and use of the noauth.sh passwordless authentication platform, including any software, software development kits (SDKs), application programming interfaces (APIs), documentation, and related services (collectively, the "Service").

By accessing, registering for, or using our Service in any manner, You accept and agree to be bound by all the terms and conditions set forth herein. If You are entering into this Agreement on behalf of a company or other legal entity, You represent and warrant that you have sufficient authority to bind such entity in accordance with the terms and conditions of this Agreement.

If you do not agree with these terms, you must not access or use the Service.

In accordance with best practices and principles of good faith in digital contracting, it is established that consent to be bound by this Agreement is understood to be formed only if You have had prior, clear, comprehensible, and unequivocal access to these conditions, as well as the ability to store or print them.

Section 1: Definitions

For the purposes of these Terms and Conditions, the following terms shall have the meanings ascribed to them below:

Section 2: The Service and License to Use

The Service consists of a next-generation authentication solution designed to provide modern, secure, and simple authentication, passwordless and powered by biometrics, to be integrated into the Customer's web and mobile applications.

Subject to compliance with the terms and conditions of this Agreement, the Provider grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable, and revocable license to access and use the Service during the term of the contract. This license is granted for the sole purpose of integrating and using the authentication functionalities of the Service within the Customer's commercial applications for their End Users.

This license does not constitute a sale of the underlying software or any copy thereof. The Provider retains ownership of all software. The license explicitly covers the use of the provided SDKs and documentation, which are core elements of the Service's value proposition. However, this permission is strictly limited to integration purposes, and any other use, such as creating derivative or competing products, is expressly prohibited under Section 4 of this Agreement.

Section 3: Accounts and Customer Responsibilities

To use the Service, the Customer must create an account, providing true, accurate, current, and complete registration information. The Customer is solely responsible for maintaining the confidentiality and security of their access credentials, including passwords and API keys.

The Customer is entirely responsible for all activity that occurs on or through their account. They agree to notify the Provider immediately of any unauthorized use of their account or any other breach of security of which they become aware.

The most critical responsibility of the Customer under this Agreement relates to the privacy of their End Users. The Customer represents, warrants, and undertakes to:

• Be solely responsible for the legality of the collection and processing of their End Users' Personal Data.
• Obtain and record prior, explicit, informed, and unequivocal consent from each End User for the collection, processing, and storage of their Personal Data, including Biometric Data, through the Service. This consent must comply with all requirements of Article 4 of Law No. 19.628 and any other applicable regulations.
• Provide their End Users with a clear and accessible privacy policy that describes how and for what purposes their data will be used through the noauth.sh Service.

By contractually imposing this obligation, it is established that any damages, fines, or legal costs that the Provider may suffer as a result of the Customer's failure to obtain valid consent will be the responsibility of the Customer. This mechanism protects the Provider by ensuring that the entity with the direct relationship with the End User (the Customer) assumes the legal responsibility that corresponds to it as the Data Controller.

Section 4: Acceptable Use and Restrictions

The Customer agrees to use the Service only for lawful purposes and in accordance with this Agreement. The Customer is strictly prohibited from, and will not permit third parties to:

• Reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code, underlying ideas, or algorithms of the Service.
• Sell, resell, license, sublicense, rent, lease, or distribute the Service to third parties, or use it as part of a white-label or service bureau offering.
• Use the Service to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy rights.
• Interfere with or disrupt the integrity or performance of the Service or third-party data contained therein.
• Conduct or disseminate penetration tests, network discovery, vulnerability scanning, or any security testing of the Service environment or its associated infrastructure without the prior, express, and written authorization of the Provider.
• Remove, modify, or obscure any proprietary notices (including copyright and trademark notices) of the Provider or its licensors contained in the Service.
• Use the Service or any Intellectual Property of the Provider to develop a product or service that competes with the Service.

Section 5: Intellectual Property

The Provider and its licensors are and will remain the exclusive owners of all rights, titles, and interests in and to the Service, including its software, source and object code, algorithms, design, "look and feel," documentation, trademarks, and any other associated Intellectual Property. This Agreement does not grant the Customer any ownership rights in the Service, but only the limited license to use described in Section 2.

The Customer, for its part, retains all rights, titles, and interests in and to the Customer Data. However, the Customer grants the Provider a worldwide, non-exclusive, royalty-free license to host, process, transmit, and use the Customer Data for the sole and exclusive purpose of providing, maintaining, and improving the Service in accordance with this Agreement.

Additionally, the Provider reserves the right to collect, analyze, and use aggregated and anonymized data derived from the use of the Service by the Customer and its End Users. This data will not identify the Customer or any End User and will be used for purposes of analysis, product improvement, development of new features, and industry reporting. In accordance with Law No. 19.628, this "statistical data" is not considered personal data. Therefore, the Provider will be the exclusive owner of such aggregated and anonymized data, allowing it to generate value and innovation without compromising individual privacy.

Section 6: Personal Data Processing and Security

The Provider undertakes to comply with the provisions of Law No. 19.628 on the Protection of Private Life and any other applicable data protection regulations in Chile.

Roles of the Parties

In the context of processing End Users' Personal Data, the parties agree that:

• The Customer acts as the Data Controller. It is the one who determines the purposes and means of the processing of its End Users' Personal Data by deciding to implement the authentication Service.
• The Provider (noauth.sh) acts as the Data Processor. It processes Personal Data on behalf of and for the account of the Customer, following its documented instructions through this Agreement and the Customer's use of the Service.

Obligations of the Data Processor

As the Data Processor, the Provider undertakes to:

• Process Personal Data solely for the purpose of providing the Service and in accordance with the Customer's documented instructions.
• Implement and maintain appropriate technical and organizational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
• Ensure that all personnel authorized to process Personal Data are subject to strict confidentiality obligations.
• Notify the Customer without undue delay after becoming aware of any security breach affecting Customer Data, in anticipation of the stricter requirements of future data legislation in Chile.
• Provide reasonable assistance to the Customer, through the functionalities of the Service, so that it can fulfill its obligation to respond to requests from End Users exercising their rights (access, rectification, cancellation, opposition).
• Upon termination of the Agreement, and at the Customer's choice, delete or return all Customer Data from its systems, unless the law requires the retention of such data.

International Data Transfer

If the servers used to provide the Service are located outside the territory of the Republic of Chile, the Customer expressly authorizes the international transfer of Customer Data to such locations. The Provider guarantees that such transfers will be carried out with adequate safeguards to ensure a level of data protection equivalent to that required by Chilean law.

Data Processing Responsibility Matrix (According to Law No. 19.628)

For greater clarity, the following table summarizes the division of key responsibilities in data protection matters. This table not only simplifies the understanding of the obligations but also functions as a precise contractual annex that delineates the legal responsibility of each party.

Section 7: Confidentiality

Each party agrees to maintain in strict confidence all Confidential Information of the other party and not to use it for any purpose outside the scope of this Agreement. Each party agrees to limit access to the other party's Confidential Information to those employees, contractors, and agents who need such access for purposes consistent with this Agreement and who have signed confidentiality agreements with obligations no less protective than those contained herein. This confidentiality obligation will survive the termination of this Agreement for a period of five (5) years.

Section 8: Fees and Payment

Access to and use of the Service are subject to the payment of applicable fees according to the subscription plan selected by the Customer. Fees will be billed in advance on the agreed billing cycle (monthly or annual). All payments are non-refundable.

Fees do not include taxes, levies, duties, or similar governmental assessments of any nature, including, for example, Value Added Tax (VAT), which will be the responsibility of the Customer. In case of non-payment, the Provider reserves the right to suspend access to the Service until the amounts due are paid in full.

Section 9: Disclaimer of Warranties and Limitation of Liability

Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE." THE PROVIDER DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. THE PROVIDER DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE PROVIDER, ITS AFFILIATES, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO THE USE OF, OR INABILITY TO USE, THE SERVICE.

THE PROVIDER'S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER LEGAL THEORY, SHALL IN NO EVENT EXCEED THE TOTAL AMOUNTS PAID BY THE CUSTOMER TO THE PROVIDER FOR THE USE OF THE SERVICE DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

Section 10: Termination

Either party may terminate this Agreement if the other party commits a material breach of any of its provisions and fails to cure such breach within thirty (30) days of receiving written notice.

The Customer may cancel their subscription at any time through their account interface. Termination will be effective at the end of the current billing cycle.

Upon termination or expiration of this Agreement, all rights and licenses granted to the Customer will immediately cease. The Provider will have no obligation to maintain or provide Customer Data and, unless prohibited by law, will delete all Customer Data in its systems or in its possession or control after a grace period of thirty (30) days.

Section 11: Modifications to the Terms

The Provider reserves the right, at its sole discretion, to modify or replace any part of this Agreement at any time. It is the Customer's responsibility to review these Terms periodically for changes. The Provider will notify the Customer of significant changes at least thirty (30) days in advance, either by email to the address associated with the account or through a prominent notice within the Service. The Customer's continued use of the Service after the posting of any changes to this Agreement constitutes acceptance of those changes.

Section 12: Governing Law and Jurisdiction

This Agreement shall be governed by and construed in all respects in accordance with the laws of the Republic of Chile.

For all legal purposes arising from this Agreement, the parties establish their domicile in the city and commune of Santiago, Chile, and expressly submit to the jurisdiction and competence of its ordinary courts of justice.

Section 13: General Provisions