Terms of Service

These Terms of Service ("Terms") govern access to and use of the Digitrust online identity verification platform (the "Service") provided by DIGITRUST TECHNOLOGIES - FZCO, a free zone company incorporated in the International Free Zone Authority (IFZA), Dubai, United Arab Emirates ("Digitrust", "we", "us", or "our").

By creating an account, completing onboarding, purchasing credits, or using the Service, the business entity you represent ("Customer", "you", or "your") agrees to these Terms. If you do not agree, do not use the Service.

These Terms apply to business customers only. The Service is not intended for personal or consumer use.

Material changes will be notified by email to your account administrators and/or by in-app notice. The "Last updated" date at the top of these Terms indicates the current version. Continued use after the effective date of changes constitutes acceptance where permitted by applicable law.

"Account" means the Customer's registered organisation on the Service.

"Administrator" means a user designated as company admin with authority to manage the Account.

"Authorized User" means any individual invited to access the Service under the Customer's Account.

"Company" means the legal entity associated with the Account.

"Contact" means a person record stored by the Customer for verification purposes.

"Credits" means prepaid units used to pay for completed verifications as described in Section 9.

"Verification Request" means a request initiated by the Customer for a Subject to complete identity verification.

"Subject" means the individual invited to complete verification through a verification link.

"IDV Provider" means third-party identity verification services (including Didit) used to perform document, biometric, and compliance checks.

"Personal Data" has the meaning under applicable data protection law, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL").

"Controller" and "Processor" have the meanings under the PDPL and, where applicable, GDPR.

"Documentation" means guides and policies we publish for the Service, including the Privacy Policy and Data Processing Agreement ("DPA").

You represent that you are a validly formed business with authority to bind the Customer to these Terms, that registration information (company name, website, billing details) is accurate, and that you will keep it current.

You may not use the Service if you or your intended use is prohibited under applicable sanctions, export control, or anti-money laundering laws, or if we reasonably determine your use poses legal, security, or reputational risk.

Account access uses email-based authentication. You are responsible for securing access to email accounts of Authorized Users and for all activity under your Account.

The Service is not directed to individuals under 18 years of age as Subjects unless you have a lawful basis and comply with applicable law.

The Administrator who completes company onboarding accepts these Terms on behalf of the Customer.

Authorized Users act as agents of the Customer. The Customer is responsible for their acts and omissions, including creating Verification Requests, purchasing Credits, and inviting team members.

When you invite Authorized Users, you confirm they are permitted to access the Service on your behalf and that your acceptance of these Terms and the DPA binds the organisation for their use.

You must deactivate or remove users who should no longer access the Account. Permission grants (including billing and team management) are configured within the Service and remain your responsibility.

The Service enables Customers to send Verification Requests to Subjects, verify channel ownership (e.g. email or phone OTP), and complete identity verification through an IDV Provider. Results are made available to the Customer in the dashboard.

Digitrust provides software and workflow tools only. We do not provide legal, compliance, or regulatory advice. You remain solely responsible for your compliance program (including AML/KYC obligations) and for deciding how to rely on verification outcomes.

The Service may depend on third-party networks, telecommunications, cloud infrastructure, payment processors, and IDV Providers. We do not guarantee uninterrupted availability.

We may modify features, integrations, or verification flows with reasonable notice where practicable. Non-material changes may take effect immediately. If a change materially reduces core functionality, you may terminate the Account as described in Section 16.

You will use the Service only for lawful business purposes (such as verifying the identity of persons sending instructions, onboarding, or fraud prevention) and in compliance with these Terms, the DPA, and applicable law.

As Controller of Subject Personal Data, you are responsible for: (a) determining and documenting a lawful basis for verification; (b) providing clear notices to Subjects before initiating verification, including identity of the Controller and purposes of processing; (c) responding to data subject requests to the extent you are responsible; and (d) ensuring instructions you provide to Digitrust comply with law.

You will provide accurate recipient contact details and verification purposes. You will not use the Service to harass, discriminate, stalk, or verify individuals without appropriate notice or legal basis where required.

You will not reverse engineer, scrape, probe, or overload the Service, or circumvent technical or security controls.

You will cooperate with reasonable abuse investigations and comply with suspension requests relating to suspected misuse.

The DPA is incorporated by reference. In case of conflict between these Terms and the DPA regarding Personal Data processing, the DPA prevails.

For Subject Personal Data processed through the Service, you are the Controller and Digitrust acts as your Processor, except where Digitrust acts as Controller for its own account, billing, security, and analytics data as described in the Privacy Policy.

Processing is limited to providing the Service per your instructions, including storage of verification artifacts in our systems and subprocessors described in Schedule C and the DPA.

Retention: unless otherwise required by law or agreed in writing, verification records and related documents are retained for twenty-four (24) months after completion of the relevant Verification Request, then deleted or anonymised per our retention procedures (see Privacy Policy and DPA).

International transfers may occur to subprocessors in other countries. Transfers are addressed in the DPA, including appropriate safeguards where required.

See our Privacy Policy (/privacy) and Data Processing Agreement (/dpa). Sub-processors are listed in Schedule C.

We implement appropriate technical and organisational measures as described in the DPA. You must notify us promptly at legal@digitrust.ae if you become aware of a personal data breach involving the Service or credentials of Authorized Users.

You must not: send Verification Requests without required Subject awareness or consent where applicable law requires it; impersonate others; submit false or misleading purposes; use results to unlawfully discriminate; resell verification outcomes as a standalone service without our written consent; or use the Service in violation of sanctions or export laws.

We may warn, suspend, or terminate access for violations. Fees are non-refundable where termination results from your material breach.

Schedule B summarises prohibited conduct.

The Service uses prepaid Credits purchased in United Arab Emirates Dirhams (AED). Credits are not legal tender, e-money, or a stored-value facility; they confer a right to use the Service subject to these Terms.

Pricing is set out in Schedule A. Purchases are processed via Stripe Checkout. By purchasing, you authorise payment and agree to Stripe's terms where applicable.

Promotional Credits (including signup bonus credits) have no cash value, are non-transferable, and may be modified or discontinued for new Accounts.

Listed Credit prices include five per cent (5%) UAE VAT where applicable. Stripe Checkout and invoices show the total amount payable. Our tax registration number (TRN) will appear on invoices when registered.

Digitrust does not store payment card numbers; card payments are processed by Stripe.

Except as required by mandatory law or expressly below, all purchases are final. Refunds may be issued only for duplicate charges or proven billing errors reported within fourteen (14) days to support@digitrust.ae with reasonable evidence.

Credits are non-transferable between Accounts and are not redeemable for cash. Unless we state otherwise in writing, purchased Credits do not expire while your Account remains active.

If a card payment is charged back or disputed after Credits were added, we may suspend the Account, deduct or offset Credits, and require payment of outstanding amounts. Fraudulent payment activity may result in immediate termination and referral to authorities.

We may change Credit pricing, minimum purchase quantities, or bonus tiers with at least thirty (30) days' notice by email or in-app notice. Changes apply to new purchases only; Credits already on your balance remain governed by these Terms.

One (1) Credit is consumed for each Verification Request that reaches a completed identity verification outcome (whether approved or rejected by the IDV Provider), charged at the time of completion.

Verification Requests that are abandoned, expire, or never complete are not billed.

Our systems use idempotent billing; you will not be charged twice for the same completed verification.

Creating a Verification Request does not require a positive Credit balance at creation time. Credits are checked and deducted when verification completes. If your balance is insufficient at completion, billing may fail and you remain responsible for maintaining adequate Credits and for any use of the Service inconsistent with these Terms. You should maintain sufficient Credits before inviting Subjects at scale.

We will use commercially reasonable efforts to make the Service available. We do not guarantee uninterrupted or error-free operation.

Planned maintenance may occur with or without notice depending on urgency.

Support is available via support@digitrust.ae. Response times are commercially reasonable but not guaranteed unless agreed in a separate written SLA.

Digitrust and its licensors own the Service, software, branding, and Documentation. No rights are granted except as expressly stated.

You own Customer Data you submit. You grant Digitrust a limited licence to host, process, and transmit Customer Data to provide the Service and support security and compliance.

You may not copy, modify, or create derivative works of the Service except as permitted by law.

If you provide feedback, you grant us a perpetual, royalty-free licence to use it without restriction.

Verification outputs (including match scores, document metadata, AML signals, and images where provided) are licensed to you for internal business purposes related to your verification of Subjects. You may not resell raw verification outputs, build an unrelated commercial identity database, or use outputs in a manner that violates applicable law.

Where law requires human review before adverse decisions, you are responsible for implementing appropriate processes.

Each party may receive confidential information of the other. The receiving party will protect it with reasonable care and use it only for the purpose of the relationship.

Exclusions apply to information that is public, independently developed, or rightfully received without restriction. Confidentiality obligations survive for three (3) years after termination, except trade secrets which survive as long as protected.

You warrant that you have authority to enter these Terms, that your use will comply with law, and that you will provide required notices to Subjects.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE UAE LAW, WE DISCLAIM ALL IMPLIED WARRANTIES INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

IDV results depend on third-party systems and document quality. False positives and false negatives may occur. The Service is not a substitute for your own compliance, risk, or legal assessments.

We do not warrant that verification outcomes satisfy any specific regulatory requirement unless expressly agreed in a signed writing.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL.

DIGITRUST'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS SHALL NOT EXCEED THE GREATER OF: (A) AED 10,000; OR (B) THE TOTAL FEES PAID BY YOU TO DIGITRUST IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY.

Nothing in these Terms limits liability for death or personal injury caused by negligence, fraud, or wilful misconduct, or any liability that cannot be limited under UAE law.

If a court finds any limitation unenforceable, the parties intend the remaining limitations to apply to the fullest extent permitted.

You will defend, indemnify, and hold harmless Digitrust and its officers, directors, and affiliates from claims, losses, and expenses (including reasonable legal fees) arising from: your use of the Service; your breach of these Terms or the DPA; your failure to provide lawful notices or basis for processing Subject data; or claims by Subjects or third parties attributable to your instructions or conduct.

We will promptly notify you of claims and cooperate in defence. You will not settle without our prior written consent if settlement imposes obligations on Digitrust.

These Terms apply while you use the Service. Either party may terminate for convenience with thirty (30) days' written notice.

We may suspend or terminate immediately for non-payment, breach, legal requirement, security risk, or sanctions concerns.

On termination, access ends. You may export Customer Data for thirty (30) days after termination unless law requires earlier deletion; thereafter we delete or anonymise data per the DPA and retention policy.

Unused Credits are forfeited on termination for your breach; otherwise refund of unused prepaid Credits is at our discretion except where mandatory law requires refund.

Sections that by nature survive (including confidentiality, liability, indemnity, and governing law) survive termination.

You represent that you and your beneficial owners are not subject to sanctions prohibiting this relationship. You will not use the Service in embargoed jurisdictions or for prohibited end uses. We may block access to comply with law.

The Service integrates third parties including Supabase (hosting/database), Didit (IDV), Twilio (SMS OTP), Resend (email), Stripe (payments), Vercel (hosting), and analytics providers. Their terms and privacy practices apply to their services.

We are not liable for third-party failures beyond our reasonable control. Subprocessing is described in the DPA and Schedule C.

Legal notices to Digitrust: legal@digitrust.ae and our registered office address above. Notices to you: the primary Administrator email on the Account and billing email if provided.

We may send operational and transactional messages to Authorized Users. Marketing messages, if any, will include opt-out where required.

Electronic notices are effective when sent unless law requires otherwise.

These Terms are governed by the laws of the United Arab Emirates. The courts of Dubai, UAE have exclusive jurisdiction, except that either party may seek injunctive relief in any competent court.

Alternatively, if we elect in writing for a specific dispute, disputes may be referred to arbitration under the DIAC Rules, seat Dubai, language English, one arbitrator unless the rules provide otherwise.

Mandatory provisions of UAE law (including the PDPL) apply notwithstanding any choice of law or contract term to the contrary.

The parties will attempt good-faith negotiation for thirty (30) days before commencing litigation or arbitration.

These Terms, the DPA, the Privacy Policy, and any signed Order Form constitute the entire agreement regarding the Service and supersede prior discussions, except that a signed Order Form prevails over these Terms for the matters it covers.

You may not assign these Terms without our consent. We may assign to an affiliate or in connection with a merger or sale.

Failure to enforce a provision is not a waiver. If any provision is invalid, the remainder remains in effect.

Force majeure: neither party is liable for delay or failure due to events beyond reasonable control (including internet failures, IDV Provider outages, or government actions).

The parties are independent contractors. No partnership, agency, or employment is created.

We may use your name and logo only with your prior written consent.

English is the controlling language of these Terms.

We may label features as beta or preview. Such features are provided as-is and may be modified or withdrawn at any time.

Digitrust is not a bank, payment institution, government identity authority, or law firm. The Service facilitates identity verification workflows; you remain responsible for regulated activities you perform using results.

Document order of precedence: (1) signed Order Form or Master Services Agreement; (2) DPA; (3) these Terms; (4) Privacy Policy; (5) Documentation.

Self-serve online Terms apply unless you have executed a written agreement that expressly supersedes them.

Prohibited: unlawful verification; harassment; impersonation; circumventing security; malware; unauthorised resale of verification data; sanctions violations; use without Subject notices where required.