Octet SDK License Agreement.

The “Software” is comprised of the Octet software development kit (including wrapper software, APIs and sample code) provided to you in source and/or object code format that is designed to enable you to utilize the Octet location verification service. Octet may also provide technical documentation to you in relation to the Software (the “Documentation”). In addition, “Distributable Components” means (a) any sample code included in the Software (“Sample Code”) and any modifications you make thereto (“Modified Sample Code”). “Models” means the positioning, propagation, signal, or other reference models, including any machine-learned models, included in or used by the Software to generate, process, or verify location proofs.

In order to access and use the Software and Documentation, you must follow the registration and/or credentialing requirements established by Octet for access and use to the Software and Documentation. Where applicable, you will pay the fees as set forth in the Octet Pricing List. You will pay invoices within thirty (30) days from the date of the invoice. All payment obligations are non-cancelable and all amounts paid are non-refundable. The fees are exclusive of taxes, levies, or duties imposed by taxing authorities, if any, and you will be responsible for payment of all such taxes, levies, or duties, excluding taxes based on Octet’s income. You represent and warrant that the billing and contact information provided to Octet is complete and accurate, and Octet will have no responsibility for any invoices that are not received due to inaccurate or missing information provided by you. You will pay interest on all payments past due at the rate of 1.5% or the maximum rate allowed by law, whichever is less. Octet may terminate this Agreement and revoke your license if your non-payment has not been cured within thirty (30) days of Octet’s written notice of non-payment. You will remain responsible for your payment obligation regardless of any termination for non-payment.

The Software and Documentation are licensed and not sold. Subject to your compliance with this Agreement, Octet hereby grants you a limited, non-exclusive, non-sublicensable, non-transferable, license to: use the Sample Code and create Modified Sample Code solely to internally evaluate and integrate your applications (“Your Applications”) with the Software; distribute the Distributable Components (in object code format only) solely as integrated in Your Applications for internal use by end users of Your Applications; and use the Documentation internally solely in order to develop and support Your Applications that interoperate with the Software.

You acknowledge that any components provided with the Software that are licensed under an open source software license (“Open Source Components”) are not part of the Software licensed hereunder and are subject to and governed solely by the terms of the applicable license(s) or other terms and conditions for those components, and not by this Agreement.

Except as otherwise expressly authorized herein, you will not directly or indirectly: use, disclose, modify, sublicense, sell, assign, distribute or otherwise exploit in any manner the Software or Documentation (or any modifications or derivative works thereof), including that you will not directly or indirectly use the Software or Documentation (or any modifications or derivative works thereof) to create or facilitate the creation of, or otherwise incorporate any portion of the Software or Documentation in, any product or service that is competitive with any Octet products or services, use the Software to perform comparisons or other “benchmarking” activities, remove any proprietary notices or branding from the Software or Documentation and/or use in violation of any applicable laws or regulations or otherwise outside of the scope of the license granted in Section 3. You will protect the confidentiality of the Software and Documentation using those measures that you use to protect your most sensitive software and information (which must be at least reasonable measures) and will provide copies of the Software and Documentation only to your employees who have a need-to-know for the purposes of developing and supporting Your Applications. You will immediately notify us of any unauthorized use, access to or disclosure of the Software or Documentation of which you become aware.

You must not modify, distribute or convey the Software so that the Software or any application to which it links, or of which it is a part, becomes subject to an Excluded License. An “Excluded License” is one that requires, as a condition of license, use, modification, distribution or conveyance, that the code be disclosed or distributed in source code form, others have the right to modify or create derivative works of it and/or it becomes redistributable at no charge.

The Software is a location verification tool whose output may be inaccurate, delayed, or unavailable. The Software is not designed, intended, or authorized for use in any application where failure, inaccuracy, or unavailability of the Software could reasonably be expected to result in death, personal injury, or severe physical or environmental damage, including without limitation: (a) aviation, aerospace, or air traffic control systems; (b) autonomous vehicle navigation or control, including self-driving cars, drones, or unmanned aerial vehicles where positioning data informs flight or driving decisions; (c) life support, surgical, or other medical devices; (d) nuclear facilities; (e) weapons systems or military targeting; or (f) any other application in which the output of the Software is used as a primary or sole source of positioning, location, or timing data for safety-critical decisions (collectively, “High-Risk Use”). You will not use the Software for any High-Risk Use, and you will include in the end user terms for Your Applications a prohibition on High-Risk Use by your end users substantially equivalent to this Section. You assume all risk of, and will defend, indemnify and hold Octet harmless from and against, any claims arising from or relating to any High-Risk Use of the Software, whether or not such use was authorized under this Agreement.

As between you and Octet, all right, title and interest in and to the Software, Modified Sample Code (which will be deemed part of the Software for purposes hereof) and Documentation, including portions thereof (collectively, “Octet IP”), shall be and remain with Octet. To the extent you obtain any right, title or interest in or to any Octet IP, you hereby assign all right, title and interest in and to such Octet IP to Octet, and you hereby waive any moral or similar rights in such Octet IP, to the maximum extent permitted by applicable law. You understand that Octet may modify or discontinue offering the Software at any time without notice. The Software and Documentation is protected by the copyright laws of the United States and international copyright treaties. Nothing in this Agreement gives you a right to use any of Octet’s trade names, trademarks, service marks, logos, domain names, or other distinctive brand features. Octet does not grant any and reserves all rights not expressly and unambiguously granted herein.

If Octet provides you with any updates, upgrades, patches, enhancements or fixes for the Software or Documentation that it makes generally available free of charge in connection with the Software, then the items that are provided will become part of the Software or Documentation, as applicable, and subject to this Agreement.

You shall, at your own expense, be solely responsible for providing technical support and training to your customers for Your Applications, and Octet shall have no obligation with respect thereto. You shall be solely responsible for, and Octet shall have no obligation to honor, any warranties that you provide to your customers or to end users with respect to the Software, Your Applications, Models or Open Source Components.

You agree that Octet shall have no liability whatsoever for any use you make of the Software, Your Applications, Models or Open Source Components, including in relation to any warranties you provide with respect thereto. You hereby agree to indemnify, defend and hold harmless Octet and its affiliates, and each of their directors, officers, employees and agents, from any and all claims, demands, actions, proceedings, damages, liabilities, losses, costs, and expenses (including reasonable attorneys’ fees) arising from or relating to: (a) Your Applications or any product or service into which the Software is incorporated; (b) your use, distribution or other exploitation of the Software or Open Source Components; (c) your breach of this Agreement, including without limitation Section 4 (Restrictions) and Section 4A (High-Risk Use); (d) any High-Risk Use of the Software, whether or not authorized; (e) your violation of any law or regulation, including without limitation export control, sanctions, anti-corruption, and data protection or privacy laws (including GDPR, CCPA, BIPA, and any analogous law); (f) any claim by your end users or any third party arising from data collected, processed, or transmitted by Your Applications; (g) any combination of the Software with hardware, software, services, or data not provided by Octet; and (h) any Caller Content (as defined in Section 7C), including any claim that you lacked a lawful basis to commit, upload, or otherwise process it, or that it is unlawful.

You are solely responsible for: (a) all data collected, processed, transmitted, or stored by Your Applications, including any location, device identifier, IP address, or other personal data of your end users (“End User Data”); (b) providing all notices to and obtaining all consents from your end users required under applicable law for the collection, processing, and transmission of End User Data; (c) maintaining a privacy policy that accurately describes the data practices of Your Applications; and (d) complying with all applicable data protection and privacy laws, including without limitation the EU General Data Protection Regulation (“GDPR”), consumer privacy and consumer protection laws such as the California Consumer Privacy Act (“CCPA”), the Illinois Biometric Information Privacy Act (“BIPA”), wiretapping and electronic eavesdropping laws such as the California Invasion of Privacy Act (“CIPA”), and any analogous law. As between you and Octet, you are the controller (or equivalent) of all End User Data. Octet does not warrant that the Software is, by itself, compliant with any specific privacy law, and your use of the Software in a manner that complies with such laws is your sole responsibility.

This Section 7B is operative as of the effective date of this version of the Agreement.

From and after the activation of this Section 7B, the Software may transmit to Octet a cryptographic proof generated on the end user device (a “Proof”).

Octet will retain each Proof solely for the purpose of generating Derived Data (defined below) and will destroy or render permanently inaccessible the original Proof within twenty-four (24) hours of receipt.

“Derived Data” means data, signatures, statistics, and other outputs that Octet generates from or based on Proofs, including without limitation device-linked signatures derived from the location elements of Proofs and counts of adherence by a given device identifier to particular Proof patterns. Derived Data does not include the original Proofs themselves.

You hereby grant, and you represent and warrant that you have obtained from your end users all rights necessary to grant, Octet a perpetual, irrevocable, worldwide, royalty-free, sublicensable license to: receive, store (subject to the 24-hour limit above), and process Proofs for the purpose of generating Derived Data. As between you and Octet, Octet owns all right, title, and interest in and to Derived Data and may use and commercialize Derived Data without restriction. For the avoidance of doubt, Octet's ownership of Derived Data is absolute and includes the right to create, modify, retain, use, sublicense, commercialize, and otherwise exploit Derived Data without further consent from, payment to, or obligation to you or your end users. The destruction of Proofs under this Section does not require destruction of Derived Data.

You will, prior to enabling the Proof transmission, obtain from each affected end user all consents required under applicable law for: (a) the transmission of Proofs to Octet; (b) Octet’s use of Proofs to generate Derived Data; and (c) Octet’s ownership and unrestricted use of Derived Data linked to the end user’s device identifier.

As between you and Octet with respect to Proofs and Derived Data, you and Octet are independent controllers (and not joint controllers or processor/controller). Each party is responsible for its own compliance with applicable privacy laws with respect to its own processing activities.

If an end user exercises a right of deletion under GDPR, CCPA, or any analogous law, you will use commercially reasonable efforts to identify the relevant device identifier and notify Octet within fifteen (15) business days. Upon receipt of such notice, Octet will use commercially reasonable efforts to cease further generation of Derived Data linked to that device identifier; provided, that Octet is not obligated to delete Derived Data that has been incorporated into aggregate statistical products from which the individual contribution cannot reasonably be isolated.

This Section 7C applies when Your Applications use the Software to commit content into a Proof or to upload content to storage you designate. Octet makes these features available for your license only after you have expressly accepted this version of the Agreement in the manner Octet provides; your continued use of the Software alone does not enable them.

“Caller Content” means any content, file, or value that Your Applications pass to the Software to be committed into a Proof, such as a photograph, document, note, or identifier. A “Commitment” is the cryptographic digest of an item of Caller Content, together with its key, content type, and size, and any locator you set for it, as recorded in a Proof. A “Salt” is the random value that is combined with an item of Caller Content before its digest is computed.

You represent and warrant that you have, and will maintain, all rights, consents, and lawful bases required under applicable law to collect, process, commit into a Proof, and (where you use the upload feature) upload each item of Caller Content, including Caller Content that relates to identified or identifiable persons. Your obligations under Section 7(h) apply to all Caller Content.

The Software computes each Commitment on the end user device. Caller Content and Salts are not transmitted to Octet. Understone Ltd, a subsidiary of Octet (“Octet UK”), receives and stores Proofs, and with respect to the Commitments contained in them, you are the controller and Octet UK acts as your processor. Octet UK processes Commitments only as set out in Annex A (Data Processing), which forms part of this Agreement. Neither Octet nor Octet UK attempts to recover, infer, or otherwise derive Caller Content from any Commitment. Notwithstanding Section 7B, Commitments are excluded from Derived Data: Octet UK removes all Commitments from any Proof data before that data is made available to Octet for any purpose under Section 7B, and Octet does not process Commitments. Section 7B otherwise continues to apply to Proofs. If Annex A conflicts with any other provision of this Agreement as to Commitments, Annex A prevails.

You will not commit or upload, and will not permit your end users to commit or upload, any Caller Content that is unlawful or that infringes the rights of any third party. If Octet receives a credible report concerning Caller Content committed through Your Applications, Octet will notify you and give you two (2) business days to respond before suspending your license to the Software. Octet may suspend your license immediately, without that notice period, where it receives a legal order or reasonably believes that waiting would cause serious harm. On suspension, Octet may delete any affected Proofs or data that Octet or Octet UK still holds.

A Commitment is not an encryption or confidentiality mechanism. A Commitment of a short or predictable value (for example a telephone number or an identifier) computed without a Salt can be reversed by guessing. You will use a Salt for every item of Caller Content that is or contains personal data. The Software generates a Salt for each item by default and makes it available to Your Applications; if you disable this default for an item, you are responsible for ensuring that the item is not personal data or is protected by a Salt you supply. You are responsible for keeping each Salt with the Caller Content it protects.

A Commitment shows only that an attested device asserted a specific item of Caller Content at the time and place recorded in the Proof. A Commitment does not show that the Caller Content is authentic, accurate, unaltered before it was committed, or captured by the device’s camera or other sensor. You will not represent to your end users or to any third party that a Commitment shows more than this.

A Commitment cannot be resolved to its Caller Content without that Caller Content and its Salt. If an end user exercises a right of erasure with respect to Caller Content, you will handle the request, and deleting the Caller Content and its Salt is sufficient with respect to the Commitment. Octet and Octet UK do not alter Proofs, because altering a Proof invalidates its signature.

If you use the Software to upload Caller Content, the Software sends it only to the storage location that Your Applications designate for each upload. Neither Octet nor Octet UK receives, stores, or has access to uploaded Caller Content. Until an upload finishes, the Software keeps the Salt and any in-memory Caller Content in encrypted storage on the end user device and deletes them when the upload succeeds or fails for good. Octet does not guarantee that an upload reaches your storage: the Software retries an upload for up to seven (7) days and then reports it as failed. The Proof that contains the Commitment remains valid whether or not the upload succeeds. You are solely responsible for the storage you designate, the upload locations and credentials you issue, and the Caller Content stored there.

This Agreement will be in effect for so long as you are using the Software. You may terminate this Agreement and the license granted herein at any time. In addition to all other available remedies, Octet may terminate this Agreement and the license granted herein immediately if you breach any provision of this Agreement, provided that this Agreement and the license granted herein will immediately terminate upon your breach of Section 4 or Section 4A. Upon termination, you must destroy or remove from all hard drives, networks, and storage media, all copies and extracts of the Software and Documentation. All remedies for breach, and Sections 4 through 14 (but not 6.1), and Annex A (for as long as Octet UK holds any Commitment for you), shall survive any termination of this Agreement.

You shall comply with all laws, rules and regulations of the Department of Commerce, the United States Department of the Treasury Office of Foreign Assets Control (“OFAC”), and other United States or foreign agency or authority, and not export, or allow the export or re-export of the Software or Documentation in violation of any such restrictions, laws or regulations. By downloading or using the Software or Documentation or exercising any of the rights granted in this Agreement, you are agreeing to the foregoing and representing and warranting that you are not located in, under the control of, or a national or resident of any country to which the United States has embargoed good or services or similar restrictions, and you are not identified as a “Specially Designated National” by OFAC, you are not placed on the U.S. Commerce Department’s Denied Persons List or any similar lists, and you will not access or use the Software or Documentation if any applicable laws in your country prohibit you from doing so in accordance with this Agreement or limit the terms of this Agreement.

All Software is deemed to be “commercial computer software” and “commercial computer software documentation,” respectively, pursuant to DFAR Section 227.7202 and FAR Section 12.212, as applicable. Any use, modification, reproduction, release, performance, display, transfer or disclosure of the Software by any agency, department or other entity of any government, shall be governed solely by the terms of this Agreement and shall be prohibited except to the extent expressly permitted by the terms herein or in a writing signed by an authorized signatory on behalf of Octet. No other rights are granted.

This Agreement contains the complete agreement between you and Octet regarding the Software and Documentation and supersedes all prior agreements and representations between you and Octet regarding the Software and Documentation. This Agreement may be amended by Octet from time to time. Octet will provide notice of material amendments by posting the updated Agreement at the URL designated by Octet and updating the version identifier. Your continued use of the Software thirty (30) days after such notice constitutes your acceptance of the amended Agreement. Notwithstanding the foregoing, your use of any Software, feature, or service first made available on or after the date an amendment is posted constitutes immediate acceptance of the amended Agreement. If you do not agree to an amendment, your sole remedy is to cease use of the Software and terminate this Agreement under Section 11. Any waiver of any provision of this Agreement must be in a writing signed by an authorized representative of the waiving party. You agree to promptly provide Octet with all information and documentation that Octet requests to verify your compliance with this Agreement. If any provision of this Agreement is held to be invalid or unenforceable, it shall be reformed to the limited extent necessary to make it enforceable. This Agreement shall be governed by and construed in accordance with the laws of California, without regard to its conflicts of laws provisions. The courts located in the County of Santa Clara, California, will have exclusive jurisdiction and venue under this Agreement.

You may not assign or transfer any part of this Agreement to any third party. Octet may assign and transfer this Agreement without consent to an affiliate or successor to all or substantially all of its business or assets to which this Agreement relates. Any breach of this Agreement by you would cause irreparable injury to Octet for which no adequate remedy at law exists, and you agree that equitable remedies, including injunctive relief and specific performance, are appropriate remedies to redress any such breach or threatened breach, in addition to all other remedies available. As used herein, “including” means “including without limitation”.

This Annex A is between you and Understone Ltd (company number 16785531), a subsidiary of Understone, Inc. By accepting these Terms, you also enter into Annex A directly with Understone Ltd which agrees to be bound by Annex A. Understone Ltd processes Commitments as your processor. Understone, Inc. does not process Commitments.

In this Annex A, “Octet UK” means Understone Ltd. This Annex A sets out the terms on which Octet UK processes the Commitments described in Section 7C as your processor under Article 28 of the UK GDPR and, where it applies, the GDPR (together, “Data Protection Law”). Terms such as “controller”, “processor”, “personal data”, “data subject”, “personal data breach”, and “processing” have their meanings in Data Protection Law. This Annex A applies for as long as Octet UK holds any Commitment for your license.

You are the controller and Octet UK is the processor of Commitments. Octet UK processes Commitments only on your documented instructions, which are this Agreement, including this Annex A, and your use of the Software under your license, unless Data Protection Law or other law to which Octet UK is subject requires otherwise; in that case Octet UK will inform you of that legal requirement before processing, unless that law prohibits it. Octet UK will inform you if, in its opinion, an instruction infringes Data Protection Law.

The subject matter is the Commitments contained in the Proofs that Your Applications upload to Octet UK under your license. Its sole purpose is to receive, store, and verify those Proofs as part of the service you requested. Octet UK does not process Commitments for any other purpose, including marketing, analytics, advertising, or training or improving Octet’s models, never attempts to recover Caller Content from them, and never combines them across licenses.

Automated receipt, encrypted storage, verification of the Proofs that contain them, removal before any use under Section 7B, and erasure. Octet UK discloses Commitments only to you and to the persons you authorise to verify your Proofs, and to no other third party.

Persons to whom Caller Content committed by Your Applications relates.

For each item of Caller Content committed into a Proof: its key, its content type, its size, the digest of the item combined with its Salt, and any locator you set for it. Octet UK does not receive Caller Content or Salts. Octet UK does not intend to process special categories of personal data, but cannot exclude that a Commitment is derived from such data.

Octet UK deletes each Proof, with the Commitments in it, within twenty-four (24) hours of receipt, as set out in Section 7B. Proofs are stored encrypted with keys that Octet UK destroys each hour, so that no copy of a Proof, including any copy in a backup, can be read more than twenty-six (26) hours after receipt.

You are responsible for responding to requests by data subjects to exercise their rights under Data Protection Law in respect of Commitments. Erasure is given effect by your deleting the Caller Content and its Salt, as set out in Section 7C. Octet UK provides no interface to retrieve or alter Commitments and provides no further assistance with those requests. If Octet or Octet UK receives such a request directly, it will only refer the data subject to you, where it can identify you as the controller.

When this Agreement terminates, Octet will revoke your license, and Octet UK will delete any Commitment it still holds for it within thirty (30) days after your license ends. You instruct Octet UK to delete Commitments and not to return them. Octet UK keeps no copy of a Commitment after deletion, unless law to which it is subject requires it.

Octet UK stores Commitments in the European Economic Area and the United Kingdom, in the Belgium (europe-west1) and London (europe-west2) regions of Google Cloud. Octet UK does not transfer Commitments outside the United Kingdom and the European Economic Area. Understone, Inc. has no access to Commitments.

You authorise Octet UK to engage Google Cloud EMEA Limited to host Proofs and the Commitments in them. Octet UK has no other sub-processor for Commitments. Octet UK will notify you, by email to your license contact, at least thirty (30) days before it adds or replaces a sub-processor for Commitments, and you may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, you may terminate this Agreement under Section 11. Octet UK imposes on each sub-processor, by contract, data protection obligations that are no less protective than those in this Annex A, and remains responsible to you for each sub-processor’s performance of them.

Octet UK maintains these technical and organisational measures for Commitments:

• Proofs reach Octet UK over TLS, authenticated with a short-lived upload token for your license;
• Proofs are stored encrypted, with keys held in a managed secret store and destroyed each hour, in a database reachable only over a private network;
• Commitments are removed from any Proof data before that data is made available to Understone, Inc.;
• administrative access requires an individual, authenticated account and is limited to the United Kingdom and the European Economic Area; and
• retention is enforced by the deletion and key destruction described above.

Octet UK ensures that the persons it authorises to process Commitments are bound by an appropriate obligation of confidentiality.

Octet UK will notify you without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Commitments, and will provide the information about the breach that is reasonably available to it, to assist you in meeting your own obligations under Articles 33 and 34 of Data Protection Law.

Taking into account the nature of the processing and the information available to Octet UK, Octet UK assists you in meeting your obligations under Articles 32 to 36 of Data Protection Law by providing the information in this Annex A and in the Documentation. Octet UK has no further obligation of assistance.

On request, Octet UK will give you the information reasonably necessary to demonstrate its compliance with this Annex A, including any independent security report it holds (such as a SOC 2 report). If that information is insufficient, after a personal data breach affecting Commitments, or where a supervisory authority requires it, Octet UK will allow for and contribute to audits, including inspections, by you or an auditor you mandate: on at least thirty (30) days’ written notice; no more than once in any twelve (12) months, except after such a breach or where a supervisory authority requires it; during normal business hours; subject to reasonable confidentiality obligations; and at your cost.

Notwithstanding Section 9, the total liability of Octet, Octet UK and their affiliates for breach of this Annex A is limited to two (2) times the amount that would otherwise apply under Section 9. The exclusion in Section 9 of indirect, special, incidental and consequential damages continues to apply.

Where the CCPA or another US state privacy law applies to Commitments, Octet UK is your “service provider” or “processor” under that law, and the business purpose for which you disclose Commitments to Octet UK is the purpose set out under “Subject matter and purpose”. Octet UK: (a) does not “sell” or “share” (as such terms are defined in US state privacy laws) Commitments; (b) does not retain, use, or disclose them for any purpose other than that business purpose, including any other commercial purpose, or outside its direct business relationship with you; (c) does not combine them with personal information that it receives from or on behalf of any other person or collects from its own interactions with consumers; (d) complies with the obligations that apply to it under those laws and provides Commitments the same level of privacy protection that those laws require of you; and (e) will notify you if it determines that it can no longer meet those obligations. You may take the reasonable and appropriate steps as described under “Audits” where necessary to ensure that Octet UK uses Commitments consistently with your obligations under those laws and, on notice, you may request Octet UK to stop and remediate any unauthorised use. Octet UK understands and will comply with this paragraph.