emly Terms of Service

Effective date: 1 October 2026

These Terms are an agreement between you and RetentionForce, Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, United States ("emly", "we", "us"). They have four parts:

• the General Terms, which apply to everyone;
• Part A — Customers, for people who book through the emly app or a business's web booking page;
• Part B — Businesses, for businesses and their staff who use the emly dashboard;
• Part C — Data Processing Addendum, which applies between emly and each business to the client records it keeps in emly.

If a Part conflicts with the General Terms, the Part prevails for the matters it covers. Our Privacy Policy explains how we handle personal information.

Nothing in these Terms limits rights you have under laws that cannot be excluded by contract, including the Australian Consumer Law, the New Zealand Consumer Guarantees Act and Fair Trading Act, the consumer laws of the EU, the UK and Armenia.

General Terms

1. Definitions

• Platform: the emly mobile app, the web booking pages, the business dashboard, the emly API and related services.
• Business: a salon, spa, studio, gym, clinic, practice or other provider that uses emly to offer its services.
• Customer: a person who finds, books or pays for a Business's services through the Platform.
• Business User: an owner, manager or staff member who uses the dashboard for a Business.
• Booking: an appointment, class place or other reservation with a Business made through the Platform.
• Distributor: RetentionForce AM LLC, our independent authorised distributor and representative in Armenia (section B3).

2. What emly does, and what it does not do

emly provides software: an app and booking pages where Customers find and book Businesses, and tools Businesses use to manage bookings, clients, sales and marketing.

emly does not provide the services you book; the Business does. When you book or buy from a Business, the contract for that service or product is between you and the Business. The Business is responsible for its services, prices, staff, premises, cancellation rules and anything it sells, including memberships, gift cards, vouchers and loyalty programmes. emly is not a party to that contract.

3. Accounts

• Give accurate information and keep it up to date.
• Keep your sign-in details and devices secure, and never share one-time codes. You are responsible for activity on your account unless it was caused by our failure or happened after you told us of a misuse.
• Tell us at once at [email protected] if you think your account has been used without permission.
• One emly app account per phone number. You must be at least 16 to create an account.

4. Acceptable use

You must not:

• break the law, or use the Platform to harm, deceive, harass or discriminate against anyone;
• make fake or speculative bookings, or book without intending to attend;
• post false, offensive or unlawful content, or reviews not based on your own experience;
• send spam, or send marketing without the consent the law requires;
• access data you are not authorised to see, probe or overload our systems, or bypass security or usage limits;
• copy, scrape, resell or reverse-engineer the Platform, except where the law allows it;
• impersonate anyone, or use someone else's account or phone number without permission.

5. Content

• The Platform, its software, design and brand belong to emly or its licensors. We give you a personal, non-exclusive, non-transferable right to use it under these Terms.
• You keep ownership of the content you submit (reviews, notes, photos, service descriptions). You give emly a non-exclusive, worldwide, royalty-free licence to host, copy, display and adapt it as needed to run the Platform, and for Businesses as set out in section B8. The licence ends when the content is deleted, except for backup copies until they are overwritten.
• You confirm you have the right to submit the content and that it does not infringe anyone's rights.

6. Reporting content, and how we moderate

• Anyone can report a review, profile, photo or other content they believe is unlawful or breaks these Terms by writing to [email protected] with the link or a description, and why. We confirm receipt, review the report diligently and objectively, and tell you what we decided.
• We do not check content before it is published, but we may remove or restrict content, or suspend an account, if it is unlawful or breaks these Terms. When we do, we tell the person affected what we did and why, and how to ask us to reconsider. We will not remove a genuine review only because it is negative.
• We report information about serious crimes to the authorities where the law requires it.

7. Third-party services

The Platform relies on third parties, such as the app stores, banks and payment providers, maps and messaging providers. Their terms may apply to your use of them. We choose them carefully, but we are not responsible for services we do not control.

8. Availability and changes to the Platform

We work to keep the Platform available and reliable, but cannot promise it will always be uninterrupted or error-free. We may carry out maintenance and improve, change or remove features. If a change significantly reduces a paid service for a Business, section B12 applies.

9. Our responsibility

• We provide the Platform with reasonable care and skill.
• To the extent the law allows, we give no other warranties about the Platform, and we do not guarantee the quality, safety or legality of any Business's services or the accuracy of content Businesses publish.
• Neither party is liable for losses that were not reasonably foreseeable, or for losses caused by events beyond its reasonable control.
• Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud, for wilful misconduct or gross negligence, or any liability that cannot be limited by law.
• Further limits apply to Businesses (section B14). They do not apply to Customers acting as consumers.

10. Suspension and termination

We may suspend or close an account, or restrict part of the Platform, only if you seriously or repeatedly break these Terms, if the law requires it, or to protect users, Businesses or the Platform from harm or fraud. We will tell you first and explain why, unless the law or an urgent risk prevents it, and you can ask us to reconsider. You can stop using the Platform at any time. Part A and Part B describe how to close an account.

11. Changes to these Terms

We may update these Terms when our service or the law changes. We publish the new version with a new effective date and, for changes that affect you materially, tell you at least 30 days before they take effect (less only where the law or a security need requires it): Businesses by email, and Customers by email or, if we have no email address for you, by SMS. If you do not agree, you may close your account before the change takes effect; a Business also receives the refund described in section B12. Changes do not apply to a dispute that arose before them.

12. Governing law and disputes

• Please contact us first at [email protected]; we will try to resolve the matter informally within 30 days.
• These Terms are governed by the law of the State of Delaware, United States, and disputes go to the state or federal courts in Delaware.
• If you are a consumer, you also keep the protection of the mandatory law of the country where you live, and you may bring a claim in its courts.
• For Businesses in Armenia that buy through the Distributor, the Distributor's own contract and the Payment Processing Terms are governed by the law of the Republic of Armenia (sections B3 and B4).

13. General

• If part of these Terms is invalid, the rest stays in force.
• If we do not enforce a right straight away, we do not give it up.
• You may not transfer your rights under these Terms without our consent. We may transfer them to a company that takes over the Platform, and will tell you; a Business may then end its subscription with a pro-rata refund.
• These Terms are published in English, Armenian and Russian. The English version prevails, except where the law requires the Armenian version to prevail.

14. Contact

RetentionForce, Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States Legal: [email protected] · Support: [email protected] In Armenia: RetentionForce AM LLC, Kanakertsi 173/5, Yerevan 0092, Armenia · WhatsApp +374 98 660833 · Phone +374 11 288 088

Part A — Customers (app and web booking pages)

A1. Signing in

• In the emly app you have an emly account, created with your phone number and confirmed with a one-time code by SMS or WhatsApp. One account works with every Business on emly.
• On a Business's web booking page you sign in to that Business's page with your phone number. This does not create an emly account: your details become that Business's client record.
• You can book services for a child or someone else with your own account; you are responsible for that Booking.
• In the app, we connect your account to the client records Businesses hold under your phone number, so your existing bookings, memberships and balances appear there. Only use a phone number that is yours. If you see items that are not yours, tell us at [email protected] and we will unlink them.

A2. Bookings

• A Booking is a contract between you and the Business, which confirms it, delivers the service and is responsible for it.
• Before you confirm, the Platform shows you the Business, the service, the time, the price or price range, any deposit and the Business's cancellation rules. Some Businesses also show their own booking terms, which you accept to book. Read them first.
• Prices, availability and descriptions are set by the Business. The final price may depend on what you actually receive, as agreed with the Business.
• A Business may change or cancel a Booking, for example if a specialist is unavailable. It should tell you as early as possible; any refund is the Business's responsibility (A6).

A3. Cancellations, deposits and no-shows

• Each Business sets its own cancellation policy, including any free-cancellation period. It is shown before you confirm and in your booking.
• Some Businesses let you cancel in the app or on the booking page; others ask you to contact them. Your booking shows which.
• Deposits. A Business may ask for a deposit to hold your place. If you cancel within the free-cancellation period, you do not lose it: it is refunded to your card or kept as a balance with that Business, as the Business offers. If you cancel later or do not attend, the Business may keep the deposit, as shown when you booked, to the extent the law allows.

A4. Payments

• Online card payments are made on the secure payment page of the payment provider. emly never receives your full card number or security code.
• In Armenia, online card payments are provided by RetentionForce AM LLC together with Ameriabank CJSC. The amount you pay is held by Ameriabank until it is paid out to the Business, less the fees agreed with the Business. Your successful payment settles what you owe the Business for that amount.
• You pay the amount shown when you confirm. We add no hidden charges. Your bank may charge its own fees, for example for currency conversion.
• Receipts are available in the app or by email. In Armenia, sales are registered in the fiscal (eHDM) system and the fiscal receipt is available to you where issued.
• Questions about a payment: contact the Business, or [email protected].

A5. Memberships, gift cards, vouchers, coupons and loyalty

• Memberships, packages, gift cards, vouchers, coupons, loyalty points and prepaid balances are issued by the Business and can be used only with that Business, under its terms (for example the services covered, the number of visits, the expiry date and the locations that accept them).
• The app shows them to you for convenience; the Business's records decide what is valid.
• If a Business stops operating or leaves emly, your claim for unused value remains a claim against that Business. emly does not guarantee value issued by a Business, but we will help you contact it where we can.
• A gift card you buy for someone is sent to them with the name, phone number, email address and message you enter, and they are added as a client of that Business. Make sure they are happy to receive it.

A6. Refunds and your right to withdraw

• Refunds are decided by the Business, under its policy and the law. You always keep your rights under consumer law, for example to a remedy when a service is not provided with due care and skill.
• Right to withdraw from online purchases. Where the law of your country gives you this right (for example in the EU, the UK and Armenia), you can withdraw from a gift card, membership or package bought online within 14 days of buying it, without giving a reason. If you asked for the service to start in that period, you pay for what you have used. The right does not apply to a Booking for a specific date or time, or where the law excludes it. To withdraw, tell the Business, or write to [email protected] and we will pass it on.
• A refund on a card payment that has not yet been paid out to the Business is returned to your card through the bank; after payout the Business refunds you directly. The time it takes to reach you depends on your bank.
• If you have a problem with a service, contact the Business first. If you cannot resolve it, write to [email protected] and we will try to help.

A7. Ratings and reviews

• After a visit, a Business may ask you to rate it. Reviews must be honest, based on your own experience, and must not contain offensive or unlawful content or other people's personal information.
• Reviews with a written comment may be published with your first name and last initial (no name for psychologists and medical or therapy clinics) and the first name of the staff member. See section 7.5 of the Privacy Policy. You can ask us to remove your review, and report other reviews (section 6).
• Businesses cannot pay to remove or change reviews.

A8. Messages from Businesses

• You will receive booking notifications, such as confirmations, reminders and changes, by push, SMS, WhatsApp or email.
• A Business may send you marketing where the law allows it, and offers by push only if you agreed to them in the app. Every marketing message identifies the Business and lets you opt out of that Business's marketing.

A9. Deleting your account

You can delete your emly account at any time in the app (Profile & settings → Delete account) or by writing to [email protected] with the account's phone number. Deletion is permanent.

Deleting your emly account does not cancel anything you have with a Business: its client record about you, with your bookings, balances, memberships, gift cards and deposits, stays with that Business and is unlinked from your account. Nothing is forfeited because of the deletion. If you will not attend an upcoming booking, cancel it first. The Privacy Policy explains what is deleted.

A10. Our responsibility to Customers

emly is responsible for the Platform working as described, with reasonable care and skill. emly is not responsible for the services a Business provides, or for a Business's refusal to honour a Booking, membership, gift card or other item it issued. Your rights under mandatory consumer law are not affected.

A11. How search results are ordered

By default, businesses are shown newest-added first. With "Near me" on (and location allowed), they are ordered by distance. A text search is ordered by how well businesses match it. You can also choose to sort by rating. The map shows the most recently added businesses in the area on screen. Businesses cannot pay for a higher position. Every business on emly is a trader offering its own services.

Part B — Businesses (dashboard)

"You" in this Part means the Business.

B1. Your business account

• By creating a business account, you confirm that you are authorised to act for the Business and accept these Terms on its behalf, and that you use emly for your trade or business.
• You are responsible for the Business Users you invite, the access you give them and their use of the dashboard. Remove access promptly when someone leaves.
• Keep your business, contact and payout details accurate.

B2. Plans, trial, fees and taxes

• Plans, prices and what each plan includes are shown in the dashboard and on our website before you buy. Prices depend on the plan and, for per-seat plans, on the number of locations, bookable staff and resources.
• New accounts start with a free trial of 14 days. To keep paid features after it, choose a paid plan.
• When you buy from us directly, subscriptions and SMS-credit bundles are billed through Stripe, in the currency shown at checkout. You authorise us, through Stripe, to charge your payment method for the plan, seats and add-ons you choose. Seat changes are charged or credited pro rata straight away. You manage invoices and your payment method in the billing portal linked from the dashboard.
• Subscriptions renew automatically for the same period until you cancel. We email you before an annual subscription renews.
• If a payment fails, we tell you by email. We do not retry a failed charge without you. If it stays unpaid, paid features stop until it is paid; your data is kept.
• We may change prices by telling you at least 30 days in advance. The new price applies from your next billing period after that; if you do not agree, you may cancel before it applies.
• Taxes. Fees exclude taxes unless stated otherwise. If you are in Australia and give us your ABN and confirm you are registered for GST, the supply is treated as business-to-business and you account for any GST under the reverse-charge rules; otherwise we may add GST and issue a tax invoice. The same applies to VAT and similar taxes elsewhere, as the law requires.
• Fees paid are not refundable, except as these Terms or the law provide.

B3. Businesses in Armenia and our Distributor

• In Armenia, emly is sold, invoiced and supported by RetentionForce AM LLC, an independent company and our authorised distributor and representative. It is not our employee, partner or agent in law, and it cannot change these Terms or make commitments on our behalf.
• If you buy through the Distributor, your commercial terms (price, invoicing in AMD, fiscal documents and local support) are in your agreement with it, and you pay the Distributor. Your use of the Platform, and the processing of your client records, are governed by these Terms and Part C, which prevail on those matters.
• If the Distributor stops distributing emly, we will offer you the chance to continue with us directly on the same plan, and we will not suspend your account for its failure to pay us without giving you that chance.
• We share your account and usage information with the Distributor so it can invoice and support you. The Distributor is the controller of its own customer records.

B4. Online card payments in Armenia

• Online card payments from your Customers are provided by RetentionForce AM LLC together with Ameriabank CJSC, under the Payment Processing Terms that you accept in the dashboard when you turn on card payments. They set out the fees, payout timing, refunds and chargebacks, and are an agreement between you and RetentionForce AM LLC under Armenian law.
• You remain the seller of your services and are responsible for your fiscal receipts.

B5. Your responsibilities to your Customers

You are responsible for:

• the services and products you offer, their quality and safety, and any licences or qualifications they require;
• accurate prices, descriptions, availability, photos and staff information;
• your cancellation, deposit, no-show and refund policies: showing them before booking and applying them fairly and lawfully;
• honouring the Bookings, memberships, gift cards, vouchers, coupons, loyalty points and balances you issue, including for Customers who delete their emly account;
• issuing receipts and meeting your tax, accounting and consumer-protection obligations. emly helps with fiscal receipts in Armenia, but you remain responsible for fiscal compliance;
• handling Customer complaints, refunds and withdrawals.

B6. Messaging and marketing to your clients

emly lets you send SMS, WhatsApp, email and push messages, campaigns and automated messages. You are the sender of these messages and are responsible for their content and for complying with the law, including anti-spam laws such as the Australian Spam Act 2003. In particular:

• send marketing only to clients who have given the consent the law requires (or where the law allows marketing to existing clients without it), and be able to show that consent;
• make sure each message clearly identifies your Business (by its sender name or in the text) and how to contact you. emly adds an unsubscribe link to marketing messages and records opt-outs automatically; do not remove it, and do not re-subscribe anyone without their new consent;
• do not send misleading, offensive or unlawful content, or content that reveals sensitive information about a client (for example the details of a medical or therapy visit);
• follow the channels' rules, including WhatsApp's business policies and sender-ID registration rules (for example the Australian SMS Sender ID Register);
• booking reminders and other service messages must not contain marketing unless the client has agreed to it.

We may pause a message or campaign that we reasonably believe breaks the law or these Terms, and tell you why. SMS credits are used as messages are sent and are valid for the period shown when you buy them.

B7. Health information and sensitive data

• If you offer health-related services (medical, esthetic-medicine, psychology or therapy), you are responsible for having the lawful basis and the consents that the law requires for any health information you record, for any registration or notification duties you have with a data-protection authority, and for your professional record-keeping duties.
• Record only what you need, only in client notes, forms and the fields meant for it, never in names, tags, service names or message templates that are shown to others.
• If you add your own Meta Pixel to your booking page, it receives page visits and bookings, as at any business; emly never loads it on the booking pages of psychiatric and other specialized medical clinics. You are responsible for having the lawful basis and any consent needed to share your clients' health-related bookings with Meta.

B8. Your public profile, listing and reviews

• If your Business is listed in emly's marketplace, your public profile (name, locations, hours, photos, services and prices, the staff you choose to show, ratings and reviews) is shown in the app and on the web.
• Eligibility. We list a Business at its request once its profile meets our listing requirements: accurate business details and address, bookable services with prices, working hours and photos of the business. You can ask us to unlist your Business at any time at [email protected].
• Removal. We may decline a listing, or remove or restrict it, if the profile no longer meets the requirements, contains inaccurate or misleading information, receives well-founded complaints, breaks these Terms or the law, or for other legitimate reasons relating to the safety or quality of the marketplace. We tell you why, at least 30 days in advance where we remove the listing for good, except where the law, a serious or repeated breach, or a risk to Customers requires us to act sooner, and you can ask us to reconsider. Removing a listing does not affect your booking pages or the rest of your subscription.
• Reviews come from your clients after their visits. Published reviews with a comment appear on your profile and your staff members' profiles, with the client's first name and last initial (no name at psychologists and medical or therapy clinics) and the staff member's first name. On free plans written reviews are not shown.
• If you bring reviews from a booking system you used before emly, you confirm that they are genuine and that you may publish them; they are shown in the same way.
• You must not post fake reviews, pay for or incentivise reviews without saying so, or pressure Customers about reviews. You can report a review that you believe is unlawful or breaks these Terms (section 6); we will not remove a review only because it is negative.
• Ranking is described in section A11. You cannot pay for a higher position.
• You allow emly to use your business name, logo and public profile to show your Business on the Platform and in the app stores and our materials about the Platform. Tell us at [email protected] if you do not want to be named in our marketing.

B9. Integrations and AI features

• If you connect third-party tools (your own SMS account, a fiscal-register provider, a Facebook page, a Meta Pixel, a phone system, data imports), you are responsible for your agreements with those providers and for the data you send them.
• The AI assistant, where included in your plan, uses a third-party AI provider to answer questions about your Business's figures. It is labelled as AI. Answers may be wrong; check important figures in the reports before relying on them. Your data is not used to train the provider's models.

B10. Availability and support

We aim to keep the dashboard available at all times, apart from planned maintenance, which we schedule outside busy hours where we can and announce in advance where it is long. Support is available at [email protected] and, in Armenia, through the Distributor.

B11. Your data

• You own the data you enter. You can export your client list, sales and reports at any time in CSV or Excel.
• Part C sets out how we process client records for you.

B12. Term, cancellation and termination

• These Terms apply from when you create a business account until it is closed.
• You can cancel your subscription at any time in the billing portal. It stays active until the end of the paid period; there are no exit fees.
• We can end your subscription for convenience by telling you at least 60 days in advance, and refund any prepaid fees for the period after it ends.
• If we make a change to these Terms, our prices or the Platform that materially harms you, you may end your subscription before the change applies and receive a pro-rata refund of prepaid fees for the unused period.
• Either party may end the subscription at once if the other seriously breaches these Terms and does not fix the breach within 14 days of being told. We may also suspend an account without that notice where there is an urgent security risk or unlawful use, and paid features stop while a payment we told you about remains unpaid (B2); we tell you why and restore access once the reason ends.
• To close your business account and delete its data, write to [email protected] from the owner's email. Export your data first: deletion cannot be undone and includes your sales, payment and fiscal records. We delete the account within 30 days of your confirmation, after any card payouts and refunds still due have been completed.
• Sections that by their nature continue after closure (fees due, B11, B14, Part C and the General Terms on liability and disputes) continue to apply.

B13. Australian and New Zealand Businesses

• If the Australian Consumer Law treats you as a consumer of our services, you have guarantees that cannot be excluded. Where our services are not of a kind ordinarily acquired for personal, domestic or household use, our liability for failing to meet a guarantee is limited, where the law allows, to supplying the services again or paying the cost of having them supplied again.
• If you are in New Zealand and use emly for business, the parties agree that the Consumer Guarantees Act 1993 does not apply, to the extent the law allows.

B14. Liability and indemnities

• To the extent the law allows, each party's total liability to the other under these Terms in any 12-month period is limited to the fees you paid for the Platform in the 12 months before the event that gave rise to the claim.
• Neither party is liable to the other for lost profits, lost revenue, loss of goodwill or indirect losses.
• These limits do not apply to your obligation to pay fees, to either party's indemnity below, to breach of Part C or of confidentiality, or to the cases in section 9.
• You will compensate emly for third-party claims, fines and reasonable costs arising from your services, your content, your messages to clients, or your breach of these Terms or data-protection law.
• We will compensate you for third-party claims, fines and reasonable costs arising from a claim that the Platform infringes their intellectual property, or from our breach of Part C.
• The party asking for compensation must tell the other promptly, let it handle the claim, and reasonably help.

Part C — Data Processing Addendum

This Part is our data processing agreement with each Business under Article 28 of the EU and UK GDPR, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020 and the Armenian Law "On Protection of Personal Data". It applies automatically when a Business accepts these Terms. A signed copy is available on request at [email protected].

C1. Roles

• For the client records a Business keeps in emly, the Business is the controller and emly is its processor (in Armenian law, the "authorised person"; in US state laws, the "service provider").
• emly is an independent controller, not a joint controller, for: emly app accounts; connecting client records to the emly app account with the same phone number and showing them to that Customer; filling in a new app profile from such records; publishing reviews; and Business User accounts and billing. When a Customer deletes their emly account, we unlink the Business's records from it and do not link them again automatically.
• emly may create anonymised, aggregated statistics from the Platform's use that identify no person or Business.

C2. Details of the processing

• Subject matter and duration: hosting and processing client records so the Business can run its operations with the Platform, while the Business account exists and until the data is deleted under C11.
• Nature and purpose: storage, organisation, retrieval, display, calculation of client statistics, sending messages the Business asks for, payments, receipts, reports, exports and support.
• Data subjects: the Business's clients and prospective clients, their contacts (for example gift-card recipients), and the Business's staff.
• Categories of data: those in section 4.4 of the Privacy Policy. Special categories: health-related information that the Business chooses to record, and the fact of a booking at a health-related business.

C3. Instructions

We process client records only on the Business's documented instructions (these Terms, its settings and its use of the Platform), including for transfers abroad, unless the law requires otherwise; we then tell the Business, unless the law forbids it. We tell the Business if we believe an instruction breaks data-protection law.

C4. The Business's obligations

The Business must have a lawful basis for the client records it collects and stores, give its clients the information the law requires (including a privacy notice that mentions emly), and obtain any consent needed, including written or explicit consent where the law requires it for health information, and consent for marketing (section B6).

C5. Confidentiality

Everyone at emly and at our sub-processors who can access client records is bound by confidentiality, and has access only as far as needed.

C6. Security

We maintain the technical and organisational measures in Annex 1, and review them regularly. We may improve them, but not reduce the overall level of protection.

C7. Sub-processors

• The Business gives general authorisation for the sub-processors listed in section 7.2 of the Privacy Policy.
• We tell Businesses by email, and in the list, at least 30 days before we add or replace a sub-processor that processes client records (sooner only in an emergency affecting the service, with notice as soon as possible).
• A Business may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, the Business may end the affected service and receive a pro-rata refund of prepaid fees for it.
• We impose data-protection obligations on each sub-processor that are at least as protective as this Part, and remain responsible for its performance.

C8. Help with requests and compliance

Taking into account the nature of the processing, we help the Business respond to its clients' requests to exercise their rights (most can be handled directly in the dashboard: view, correct, export and delete client records), and with security, breach notification, data-protection impact assessments and consultation with authorities.

C9. Breaches

We tell the Business without undue delay, and in any case within 72 hours, after becoming aware of a breach of security affecting its client records, with the information we have about its nature, likely consequences and the measures taken. We help the Business assess it, including within the 30 days allowed under the Australian Notifiable Data Breaches scheme, and to notify authorities and clients where required.

C10. Audits

We make available the information reasonably needed to show that we comply with this Part, including answers to security questionnaires and the certifications of our main sub-processors. Where that is not enough, or an authority requires it, a Business may, once a year and with 30 days' notice, have an independent auditor bound by confidentiality review our compliance, at its own cost and without disrupting the service.

C11. Deletion and return

The Business can export its data at any time. When the Business asks us to close its account, we delete its data within 30 days of confirmation (after any card payouts and refunds still due are completed), including sales, payment and fiscal records; the Business must export any records it is legally required to keep first. Backups are overwritten on their normal cycle. We keep only what the law requires us to keep, and protect it under this Part.

C12. International transfers

Client records are processed in the countries listed in section 7.2 of the Privacy Policy, mainly the United States.

• EU, EEA and Switzerland: for transfers from a Business in these countries, the parties agree to the Standard Contractual Clauses adopted by European Commission Decision (EU) 2021/914, Module 2 (controller to processor), which are incorporated into this Part by reference. Clause 7 (docking) applies; in Clause 9, option 2 (general authorisation) applies with the notice period in C7; in Clause 11 the optional wording does not apply; in Clauses 17 and 18 the law and courts are those of Ireland. The annexes are completed as follows: Annex I.A, the Business (data exporter) and RetentionForce, Inc. (data importer) as identified in these Terms; Annex I.B, C2; Annex I.C, the supervisory authority determined under Clause 13; Annex II, Annex 1; Annex III, the sub-processor list. For Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, and the competent authority is the FDPIC.
• United Kingdom: the International Data Transfer Addendum to those clauses, issued by the UK Information Commissioner, applies, with its tables completed from this Part; either party may end it as its Section 19 allows.
• If emly is certified under the EU–US Data Privacy Framework or its UK or Swiss extensions, transfers may rely on that certification, and the clauses above apply if it ceases to be valid.
• Australia: we handle the Business's personal information consistently with the Australian Privacy Principles, act only on the Business's instructions, and allow the Business to keep effective control of it.
• New Zealand: we protect personal information in a way that, overall, provides safeguards comparable to those in the New Zealand Privacy Act 2020.
• Armenia: this Part is the Business's written assignment to emly as its authorised person under the Law "On Protection of Personal Data": its purposes, the data, the data subjects, the recipients and the security measures are those set out in C2, section 7.2 of the Privacy Policy and Annex 1.

C13. Precedence

If this Part conflicts with the rest of these Terms on the processing of client records, this Part prevails; the Standard Contractual Clauses prevail over both. B14 applies to this Part as B14 itself provides; nothing limits a liability that the law or the Standard Contractual Clauses do not allow to be limited.

Annex 1 — Security measures

• Encryption: HTTPS (TLS) for all traffic; encryption at rest at the database and file-storage providers; tokens sealed with authenticated encryption.
• Access control for Businesses: role and permission levels, location scoping, session management with sign-out of other devices, sign-in rate limits and bot protection.
• Access control inside emly: least-privilege access to production systems for named staff; support sign-in to a Business account only at its request, time-limited and recorded.
• Authentication: passwords stored as salted scrypt hashes (older hashes upgraded); one-time codes limited in time and attempts; short-lived access tokens with rotating refresh tokens; API keys stored only as hashes.
• Payments: card data entered only on the bank's certified payment page; emly stores only a masked card number.
• Separation: every client record is tied to one Business account and every query is limited to it.
• Resilience: managed hosting with database replication and regular backups.
• Monitoring: error and performance monitoring with credentials and client details removed from reports.
• Development: code review, automated tests and dependency updates before release.
• Deletion: Business data is deleted on request as in C11; sign-in codes, sessions and devices expire automatically.
• People: confidentiality obligations for staff and contractors.