Terms of Service

1) Parties & Agreement; Clickwrap

By clicking Create Account, Continue with Google, Start trial, or similar; checking the acceptance box; or using the Services, you agree to these Terms, the Privacy Policy, the Messaging Compliance Addendum (Addendum A), the Data Processing Addendum (Addendum B), and the Acceptable Use Policy (Addendum C), and our Refund Policy (collectively, the "Agreement"). We log acceptance (name, email, IP, user agent, timestamp, version); see Section 6G. If you accept for an organization, you represent authority to bind it.

2) Definitions

• Account: your Zappycards tenant.
• Contact Data: end-customer data you upload/sync.
• GBP: Google Business Profile you connect.
• Integrations: third-party services you connect (Zapier/CRM/POS, email/SMS gateways).
• Laws: privacy/telecom/platform rules (PIPEDA, CASL, TCPA, CTIA, GDPR/UK GDPR, CPRA, Google policies).
• Services: our app/APIs that (i) connect to GBP to read/post authorized data (e.g., review replies), (ii) import Contact Data via Zapier/API, (iii) run review-request messaging, and (iv) provide analytics, logs, and compliance tooling.

3) Customer Responsibilities

3.1 Account security. Keep credentials confidential; tell us about suspected compromise.

3.2 Lawful inputs. You control your inputs and will message only contacts with valid consent appropriate to jurisdiction and message type.

3.3 Platform compliance. You must follow platform rules (e.g., Google Maps/UGC & Business Profile policies; no review gating or incentives).

3.4 Prohibited use. No illegal/deceptive/abusive content; no malware; no evasion of carrier vetting or use of grey routes; no scraping; no resale without permission.

3.5 Content repurposing (optional). If enabled, you warrant rights/permissions to reuse review content and images; we'll honor takedown requests consistent with platform policy.

4) Integrations, Dependencies, Support, API

4.1 Scopes. You authorize only the scopes you approve; we may adjust/suspend features if required by carriers/platforms/law.

4.2 Third-party dependencies. Features depending on Google/Yelp/Facebook/carriers are subject to their availability, rate limits, and rules; we're not liable for their outages/changes.

4.3 Support & onboarding. Standard email/in-app support. Typical onboarding: one session (~30–40 minutes) to connect GBP/integrations and publish templates; complex setups may require more.

4.4 API & fair use. Use documented endpoints and auth; we may throttle/suspend abusive or excessive calls.

5) Messaging Program Essentials (recipient-facing)

6) Fees & Taxes (Monthly and yearly billing)

Billing cycle. Subscriptions are billed monthly or yearly, as shown to you before you pay, to the payment method on file. The plan, price and billing period are shown at checkout, and each renewal is charged on the same day of the month (monthly plans) or year (yearly plans) as your first paid billing date.

Pass-through at cost. SMS/MMS, email delivery, A2P 10DLC/toll-free verification and surcharges, and carrier pass-throughs are rebilled at cost (no markup). Taxes are your responsibility.

Auto-renew; cancellation. Subscriptions renew automatically at the end of each monthly or yearly period unless you cancel first. See Section 6D (Automatic Renewal) for the full disclosure and how to cancel. Unless stated otherwise at checkout, cancellation takes effect at the end of the period you have already paid for.

Refunds. Refunds are governed by our Refund Policy, the 10-Review Guarantee (Section 6E) where it applies, and applicable law. Except as set out there or required by law, fees already charged are non-refundable.

6A) Payment; disputes; late fees; changes

Processor. We use a third-party processor (e.g., Stripe) for recurring charges; you agree to their terms.

Invoice disputes. Please notify us within 15 days of invoice/charge so we can resolve it quickly; undisputed amounts remain due. This does not shorten any longer period or any right you have under law or your card agreement.

Late fees; suspension. Overdue sums may incur 1.5%/month interest (or legal max) and service suspension; reactivation fees may apply. Unjustified chargebacks are a material breach (see Section 6F).

Changes. Base subscription fees may change with 30 days' notice (email/in-app). Carrier/email pass-throughs may change at any time and are rebilled at cost.

6B) Free Trials

What a trial is. A free trial lets you use the paid plan named at sign-up without charge for the trial period. The Free Review Kit trial (Section 6C) lasts 14 days from the moment you start it and is a trial of the plan you choose at checkout: yearly or monthly.

Card required; $0 today. A payment card is required to start a trial. Nothing is charged when you start. Unless you cancel before the trial ends (day 15), the plan converts to a paid subscription and the first charge is made to the card on file on day 15.

Cancelling. Cancel before day 15 and you pay $0. See Section 6D for how to cancel.

Limits. Trials are limited to one per business location and one per account, and we may decline or end a trial that is abused (Section 6C).

6C) Free Zappycards Offer (the "Free Review Kit")

What you get. We market this offer to customers as "free Zappycards". In these Terms we call it the "Free Review Kit" or the "kit". A business that starts the Free Review Kit trial receives 1 to 10 free NFC review cards (the quantity you choose at checkout), shipped free of charge to addresses in the United States and Canada only, plus the 14-day free trial of the plan you choose at checkout (yearly or monthly), described in Section 6B. The kit is the same with either plan.

Card required; price. A payment card is required to start. $0 is charged today. Unless you cancel before the trial ends (day 15), the plan you chose bills the card on file: the yearly plan $360 USD per year ($30/mo billed yearly), renewing every year, or the monthly plan $49.99 USD per month, renewing every month (or the price shown to you at checkout, if different), until you cancel (Section 6D).

Eligibility. The offer is for an operating business with a live Google Business Profile that you own or manage. It is limited to one kit per business location and one kit per account.

Shipping. We aim to ship cards within 48 hours of you starting the trial. You must give us a valid shipping address in the United States or Canada; we may use a shipping partner to fulfil your order (see our Privacy Policy).

Cancellation. You can cancel any time from the app (Account > Manage Subscription) or by emailing support@zappycards.com. If you cancel before the kit has shipped, we may cancel the shipment.

No cash value; no resale. The cards have no cash value, cannot be returned for credit, and may not be resold.

Refusal, cancellation and voiding. We may refuse, cancel or void a kit or trial (and cancel a shipment that has not been delivered) for duplicate accounts, fake or unowned listings, invalid shipping addresses, prepaid or virtual card abuse, or any fraud or misuse of the offer. This does not affect any right you have under applicable law.

6D) Automatic Renewal

Authorisation. By starting a trial or subscription you authorise us (and our payment processor) to charge your payment method for the amounts above, including renewals, until you cancel.

Effect of cancelling. If you cancel before the first charge you pay $0. If you cancel later, the cancellation takes effect at the end of the period you have already paid for, and no further renewals are charged. See the Refund Policy for refunds.

Price changes. Price changes are handled under Section 6A (30 days' notice). Where the law of your state or province requires additional notices or cancellation methods (including U.S. federal and state automatic-renewal laws and Canadian provincial rules), we comply with them, and they apply in addition to this Section.

6E) 10-Review Guarantee

The promise. This guarantee applies to the Free Review Kit offer. If your business does not get at least 10 new Google reviews within 90 days of your trial start, you can request a refund of the subscription fees you paid (the yearly fee, or the monthly fees, for the plan you chose).

Conditions. To qualify:

• your account must have linked its Google Business Profile;
• you must have activated at least one card;
• you must have sent review requests to at least 100 customers through the app within the first 30 days of your trial;
• you must request the refund by email to support@zappycards.com within 30 days after the end of the 90-day period; and
• only one claim may be made per business.

Integrity. Fraudulent, fake, purchased or incentivised reviews (including reviews offered in exchange for a discount, gift or other benefit) do not count toward the 10 reviews and void this guarantee.

Refund. An approved refund is paid to the original payment method within 10 business days. This guarantee is in addition to, and does not limit, any rights you have under applicable law.

6F) Chargebacks and Billing Disputes

Contact us first. If you have a question about, or believe there is an error in, a charge, you agree to contact support@zappycards.com first and give us a reasonable opportunity to resolve it before you dispute the charge with your bank or card issuer. We respond quickly and can often cancel, correct or refund a charge right away.

Authorised, disclosed charges. Disputing a charge that you authorised and that we disclosed (for example, the first charge after a trial that you did not cancel, or a renewal) is a breach of these Terms.

Evidence. We keep consent and billing records (see Section 6G), including your IP address, the timestamp, the text you accepted, and checkout and cancellation logs, and we will submit them to your card issuer or our payment processor to answer a dispute.

Consequences. If you file an abusive or unjustified chargeback, we may suspend or close your account, and, to the extent permitted by law, recover the disputed amount (where the dispute is decided in our favour or withdrawn) and the dispute or chargeback fees our processor charges us.

Your rights are not limited. Nothing in this Section or elsewhere in these Terms waives or limits any right you have that cannot be waived under applicable law, including consumer-protection and payment-card dispute rights for unauthorised transactions, billing errors, or goods or services not delivered.

6G) Consent Records and Electronic Agreement

Electronic signature. When you click "I agree", "Create my account", "Start trial" or a similar button, or check an acceptance box, you are signing this Agreement electronically. You agree that your electronic signature has the same legal effect as a handwritten signature, to the extent permitted by applicable law (including the U.S. E-SIGN Act and UETA and Canadian electronic-commerce laws).

What we log. We keep records of your acceptance and billing history, including your IP address, the timestamp, the text you accepted (and its version), and checkout and cancellation logs. We use these records to administer your account, prevent fraud and answer billing disputes, and we may provide them to our payment processor, card issuers and legal authorities where relevant.

Paper copies. You may request a copy of the text you accepted at any time by emailing support@zappycards.com.

7) IP; Publicity; Agencies

7.1 Ownership. You own your content and Contact Data; we own the Services. You grant us a limited licence to process data to provide/improve the Services, prevent fraud/abuse, and comply with law.

7.2 Publicity & feedback. Unless you opt out, we may identify you (name/logo) as a customer (no confidential info). Feedback may be used to improve the Services.

7.3 Agencies & multi-location. Agencies/franchises will (i) obtain downstream acceptance, (ii) separate locations/workspaces, (iii) ensure user compliance. We may require direct end-client acceptance for certain features.

8) Confidentiality; Security; Force majeure

8.1 Confidentiality. Each party protects the other's Confidential Information with reasonable care; use only for this Agreement.

8.2 Security program. We maintain administrative/technical/physical safeguards proportionate to risk (see Privacy & DPA).

8.3 Force majeure. Neither party is liable for delays/failures due to events beyond reasonable control (including platform/carrier outages, internet failures, DDoS, acts of God, labour disputes, government actions). Payment obligations excluded.

9) Suspension & Termination; Data Return

We may suspend immediately for violations of law/platform/carrier rules, security risk, or abuse. Either party may terminate for uncured material breach after 30 days' notice. On termination, we provide export for 30 days and then delete/de-identify Customer Personal Data per our retention schedule (we retain suppression logs to honor opt-outs). No guarantee of outcomes or deliverability (platform/carrier policies apply).

10) Warranties; Disclaimers; High-risk use

We warrant the Services will perform materially per documentation; exclusive remedy is re-performance or pro-rata refund for the affected period. Otherwise, the Services are provided "AS IS" and "AS AVAILABLE." We don't warrant deliverability, outcomes, or your legal compliance. We're not a law firm and don't provide legal advice. The Services aren't for life-support/safety-critical uses.

11) Indemnities

By Customer. You will defend/indemnify us against claims arising from (i) your content/instructions; (ii) your violation of law/platform/carrier rules; (iii) alleged lack of valid consent.

By Zappycards. We will defend/indemnify you against third-party claims that the Services themselves infringe IP (excluding your content, combinations we didn't supply, or non-current versions you decline to update).

12) Liability Cap

Nothing in these Terms excludes or limits any liability, warranty or consumer right that cannot be excluded or waived under applicable law.

13) Governing Law; Venue; Language

New Brunswick law and the federal laws of Canada apply. Venue: courts of New Brunswick, Canada. Class/representative actions are waived where permitted.

English language: The parties confirm that this Agreement and related documents are in English. Les parties confirment que la présente convention et tous les documents s'y rattachant sont rédigés en anglais.

13B) Dispute Resolution; Mediation

Before starting litigation, the parties will attempt in good faith to resolve disputes through a mediation in New Brunswick commenced within 30 days after written notice of the dispute. This does not limit either party's right to seek injunctive relief.

14) Notices; Assignment; Changes to Terms; Order

We may send notices to your account email or in-app. Assignment requires consent (not unreasonably withheld) except to an affiliate or in a merger/acquisition. We may update these Terms with 30 days' notice for material adverse changes; continued use after the effective date constitutes acceptance. Precedence: Order → these Terms (including the Refund Policy) → Addendum B (DPA) → Privacy Policy → Addendum A (Messaging) → Addendum C (AUP) → Documentation.

15) Betas; Open-Source; Export; Anti-Corruption; Entire Agreement; Survival

Betas are as-is and may be withdrawn without liability. Open-source components may be included and are licensed under their own terms (notices available on request).

Export & sanctions: You represent you're not on sanctions lists and will comply with Canadian/US/EU export laws; no use in embargoed countries.

Anti-corruption: Each party complies with anti-bribery laws (CFPOA, FCPA, UK Bribery Act). This Agreement is the entire agreement; if any term is unenforceable, the rest remains in effect. Sections intended to survive (Fees, Confidentiality, IP, Indemnities, Limitations, Governing Law, Messaging, AUP) survive termination.

16) Eligibility; Business Use; Authority

16.1 Age. You must be at least 18 years old, or the age of majority where you live if that is higher, to create an Account or use the Services.

16.2 Business use. The Services are for business use only. They are not offered for personal, family or household purposes.

16.3 Authority. If you accept the Agreement for a business or other organization, you represent that you have the authority to bind it, and "you" then means that organization. If you do not have that authority, do not create an Account or use the Services.

16.4 Accurate information. You will give us accurate, current and complete registration, business and billing information, and keep it up to date. You must own or be authorized to manage any Google Business Profile you connect.

17) Account Security

17.1 Credentials. You are responsible for keeping your login credentials (including passwords, verification codes and connected-account authorizations) confidential and secure, and for not sharing them with anyone who is not authorized to use your Account.

17.2 Responsibility for activity. You are responsible for all activity under your Account, including activity by your team members, agencies and anyone else you allow to use it, except to the extent the activity results from our breach of these Terms.

17.3 Notify us. Tell us promptly at support@zappycards.com if you suspect your Account or credentials have been compromised or used without permission. We may reset credentials, revoke integrations or suspend the Account to protect you, your contacts and the Services.

Nothing in this Section excludes or limits any liability, warranty or consumer right that cannot be excluded or waived under applicable law.

18) Testimonials & Likeness

18.1 Limited licence. You grant Zappycards a non-exclusive, royalty-free, limited licence to use your business name, logo, review counts and statistics, and any testimonial you give us (including the name and title of the person giving it) in our marketing, such as our websites, social media, advertising, emails and case studies. We will not use your Contact Data, or confidential information, in marketing, and we will not say that you endorse anything beyond what you actually said.

18.2 Opt-out. You may withdraw this permission at any time by emailing support@zappycards.com. After you do, we will stop making new uses of your name, logo, review counts and testimonials promptly, and remove them from materials we control. We cannot recall materials already printed or distributed, or content republished by third parties.

18.3 Truthful testimonials. Any testimonial, review or statement you give us must be truthful, reflect your honest opinion and actual experience, and not be misleading. If you have a material connection to us (for example, you received a free product, discount or other benefit), you must tell us so that it can be disclosed. You will comply with the U.S. Federal Trade Commission's Endorsement Guides (16 CFR Part 255), Canada's Competition Act and other applicable advertising and consumer-protection laws.

This Section supplements Section 7.2 and does not limit any privacy, publicity or consumer right you have that cannot be waived under applicable law.

19) Results Disclaimer; No Professional Advice; Your Compliance

19.1 Results vary. Review volume, ratings, rankings, response rates and revenue depend on factors outside our control, including your customers, your service quality, your industry and location, how and when you send requests, and decisions by Google and other platforms (which may filter, delay or remove reviews). Examples, statistics, testimonials and case studies we show are illustrative; they are not typical or guaranteed results.

19.2 No guarantee of results. We do not guarantee any particular number of reviews, star rating, search ranking, message deliverability, customer response or business outcome. The only exception is the 10-Review Guarantee, which applies to the Free Review Kit offer solely as, and on the conditions, written in Section 6E. Nothing elsewhere in the Agreement, our marketing or our support communications expands or adds to that guarantee.

19.3 No professional advice. The Services, our documentation, AI Features and compliance tooling are general tools and information. They are not legal, tax, accounting, regulatory or other professional advice, and we are not your adviser. Consult your own advisers about your obligations.

19.4 Your compliance. You are responsible for complying with Google's review and Business Profile policies and other platform rules, and with applicable law (including advertising, consumer-protection, privacy, anti-spam and telecommunications laws), in how you ask for, respond to and use reviews. In particular, you will not offer or give incentives for reviews and will not engage in review gating (for example, asking only satisfied customers to review, or steering unhappy customers away from leaving a review). See Section 3.3 and Addendum A, Section A3.

Nothing in this Section excludes or limits any liability, warranty or consumer right that cannot be excluded or waived under applicable law.

20) AI Features

20.1 What they are. Some features use artificial intelligence, including suggested replies to Google reviews and drafted review-request text messages ("AI Features").

20.2 Drafts; your responsibility. AI Features produce drafts and suggestions that may be inaccurate, incomplete, inappropriate or similar to outputs given to others. You are responsible for reviewing and approving any reply or message before it is published or sent, and for every reply or message you approve, publish or send through the Services (including any you configure the Services to send on your behalf), including its accuracy, its compliance with Google's policies, consent and messaging laws (Addendum A), and its truthfulness about your business.

20.3 Third-party AI providers. To provide AI Features, inputs (for example, the text of a review, your business name and your instructions) and the resulting outputs may be processed by third-party AI providers that we engage as subprocessors under confidentiality and data-protection obligations (see Addendum B and our Privacy Policy). Do not enter payment card numbers, government identifiers, health information or other sensitive data into AI Features.

20.4 No training of public models. We do not use customer data to train public AI models.

20.5 No automated decisions with legal effect. AI Features only generate drafts for you. We do not use them to make decisions that have legal or similarly significant effects on any person, and a person (you) decides whether to use any output.

Nothing in this Section excludes or limits any liability, warranty or consumer right that cannot be excluded or waived under applicable law.

21) Copyright Complaints (DMCA)

21.1 Notices. We respect intellectual property rights. If you believe content on or through the Services infringes your copyright, send a written notice to support@zappycards.com (subject line: "Copyright Notice") that includes:

• your physical or electronic signature (or that of a person authorized to act for the copyright owner);
• identification of the copyrighted work you claim is infringed;
• identification of the material you claim is infringing and enough information (such as a URL or message ID) for us to locate it;
• your name, mailing address, telephone number and email address;
• a statement that you have a good-faith belief that the use is not authorized by the copyright owner, its agent or the law; and
• a statement, under penalty of perjury, that the information in the notice is accurate and that you are the copyright owner or authorized to act on the owner's behalf.

21.2 Counter-notice. If your content was removed or disabled and you believe this was a mistake or the content is authorized, you may send a counter-notice to the same address with your signature, identification of the removed material and its former location, a statement under penalty of perjury that you have a good-faith belief it was removed by mistake or misidentification, your name, address and telephone number, and your consent to the jurisdiction of the courts of your address (or, if outside the United States, of New Brunswick, Canada) and to accept service of process from the person who sent the original notice. We may forward notices and counter-notices to the other party and may restore removed material as permitted by law.

21.3 Repeat infringers; misrepresentation. In appropriate circumstances we may suspend or terminate the accounts of users who repeatedly infringe copyright. Knowingly misrepresenting that material is infringing, or was removed by mistake, may expose you to liability. We also handle notices of claimed infringement as required by other laws that apply to us, including Canada's notice-and-notice regime.

This Section works together with the content complaint and takedown process in Addendum C. Nothing in it excludes or limits any right or remedy that cannot be excluded or waived under applicable law.

22) Disclaimer of Warranties

Some jurisdictions do not allow certain warranties to be disclaimed, so part of this Section may not apply to you. Nothing in these Terms excludes or limits any liability, warranty or consumer right that cannot be excluded or waived under applicable law.

23) Limitation Period

To the extent permitted by applicable law, any claim or cause of action by either party arising out of or relating to the Agreement or the Services must be commenced within one (1) year after the claim arose; otherwise it is permanently barred. Section 13B (mediation) does not extend this period unless the parties agree in writing.

If the law that applies to you does not allow a one-year period, or gives you a longer period that cannot be waived, the shortest period permitted by that law applies. This Section does not limit your card-dispute or billing-error rights (see Sections 6A and 6F), or any other right that cannot be waived under applicable law.

24) Force Majeure

This Section supplements Section 8.3. Neither party is liable for a delay or failure to perform (other than a payment obligation) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, government action, power or internet failures, failures or changes of carriers, platforms or other third-party providers (such as Google, Stripe, Shopify or messaging carriers), cyber-attacks and labour disputes.

The affected party will give notice where practicable, use reasonable efforts to resume performance, and its obligations are suspended for as long as the event continues. Nothing in this Section limits any refund or remedy to which you are entitled under Section 10, the Refund Policy or applicable law.

25) Severability; No Waiver

25.1 Severability. If a court or authority finds any provision of the Agreement invalid or unenforceable, that provision is limited or modified to the minimum extent needed to make it enforceable (or, if that is not possible, severed), and the rest of the Agreement stays in full effect.

25.2 No waiver. A party's failure or delay in enforcing a right or provision is not a waiver of it. A waiver is effective only if it is in writing and signed (including by email) by the waiving party, and applies only to the specific instance it describes.

26) Assignment; Relationship of the Parties

As stated in Section 14, neither party may assign or transfer the Agreement without the other party's prior written consent (not to be unreasonably withheld), except to an affiliate or to a successor in a merger, acquisition or sale of all or substantially all of the assets to which the Agreement relates. Any assignment in breach of this Section is void. The Agreement binds and benefits the parties and their permitted successors and assigns.

The parties are independent contractors. Nothing in the Agreement creates a partnership, joint venture, agency, employment or fiduciary relationship, and there are no third-party beneficiaries, except for persons entitled to indemnification under Section 11.

27) Entire Agreement

The Agreement (these Terms, its Addenda, the Privacy Policy, the Refund Policy and any Order, with the order of precedence in Section 14) is the entire agreement between you and Zappycards about the Services and replaces all earlier or contemporaneous agreements, proposals and understandings about the same subject. Any terms in your purchase orders or other documents are rejected and have no effect.

Nothing in this Section excludes or limits liability for fraud or fraudulent misrepresentation, or any liability, warranty or consumer right that cannot be excluded or waived under applicable law.

28) Changes to These Terms

We may update these Terms from time to time. We will post the updated Terms in the app with a new Last updated date. For material changes, we will also notify you by email to your account address (or in-app), and, as stated in Section 14, give 30 days' notice of material adverse changes, unless a shorter period is required by law or by a carrier or platform, in which case we will give as much notice as is reasonably possible.

If you do not agree to a change, you may cancel before it takes effect (see Section 6D); continued use of the Services after the effective date means you accept the updated Terms. Nothing in this Section limits any right you have under applicable law to withhold or withdraw consent to changes.

29) Contact

Questions, legal notices and requests under these Terms: Day Creatives Inc., d/b/a Zappycards, Riverview, New Brunswick, Canada (postal address available on request by email); email support@zappycards.com; phone +1 (506) 248-0216. Our web app is at app.zappycards.com. You can also reach us through our Contact Us page.

See also our Privacy Policy, Refund Policy, SMS Consent Policy and Cookie Policy.

Addendum A --- Messaging Compliance (CASL / TCPA / CTIA / GBP)

A1) Consent & Records

• CASL (Canada): express consent where required; implied consent limited to (i) existing business relationship (generally up to 24 months post-purchase/contract) or (ii) inquiry (6 months); each CEM must include sender identification and a working unsubscribe.
• TCPA (U.S.): prior express consent for informational; prior express written consent (one-to-one seller consent) for marketing texts sent via automated means; revocation by any reasonable means must be honored.
• CAN-SPAM (U.S. email): truthful headers/subjects, clear identification and postal address, and a functioning one-click unsubscribe honored within 10 business days.
• Maintain auditable consent logs (who/what/when/source/method/scope/expiry) and global suppression lists.

A2) Quiet Hours; Registration; STOP/HELP

• Configure per-jurisdiction quiet hours and frequency caps. Complete A2P 10DLC brand/campaign registration (or toll-free verification) before U.S. sends; carriers may block/throttle unregistered traffic.
• We support STOP keywords (STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT); after one confirmation, sending stops to that number (global suppression unless topic-level is configured). HELP returns program contact and opt-out instructions.

A3) Content & Review Integrity

• No illegal/deceptive content; no SHAFT categories; include clear sender identification and opt-out text.
• No review gating and no incentives for reviews. Comply with Google Business Profile/Maps UGC policies for replies/content.

A4) Multi-Platform; Monitoring; Fines

• If you direct review requests to Yelp/Facebook/industry sites, you must follow each platform's solicitation/branding rules.
• We and/or carriers may monitor for spam/abuse. We may suspend/modify messaging to comply with law and platform/carrier rules. Government fines, carrier penalties, and platform sanctions caused by your campaigns may be passed through at cost.

Addendum B --- Data Processing Addendum (Controller ↔ Processor)

B1) Roles & Scope. Customer is controller/business; Zappycards is processor/service provider. We process Customer Personal Data only on documented instructions to provide the Services.

B2) Subprocessors; change notice. We engage subprocessors under written contracts with equivalent protections; we remain responsible. We will give 30 days' notice of material subprocessor changes; you may object on reasonable grounds. If unresolved, we'll work in good faith on alternatives; if none, you may terminate affected Services.

B3) Security (TOMs). Access controls; MFA for admin access; encryption in transit; least-privilege; logging/monitoring; vulnerability management; secure SDLC; vendor risk review; backups/DR.

B4) Incidents; assistance; audits. We will notify you without undue delay of a breach affecting Customer Personal Data and cooperate on mitigation and legally required notices. We assist with data-subject requests, DPIAs, and regulator inquiries. On reasonable notice, we will provide information necessary to demonstrate compliance and allow audits under reasonable conditions and frequency limits.

B5) Transfers; deletion/return; CPRA; HIPAA. For restricted transfers we use EU SCCs (2021/914/EU) (Modules 2/3), UK IDTA/UK Addendum, and Swiss add-on. On termination or request we delete/return Customer Personal Data subject to legal retention and suppression obligations (reasonable fees may apply for bespoke exports). Under CPRA we won't sell or share personal information, won't use/disclose it beyond business purposes, won't combine data except as permitted, and will support verifiable consumer requests. HIPAA: PHI is prohibited unless a BAA is executed in advance.

Addendum C --- Acceptable Use Policy (AUP)

You will not:

• send unlawful, harmful, deceptive, defamatory, harassing, or discriminatory content
• promote illegal goods/services
• send malware, phishing, or exploit links
• attempt unauthorized access or burden the Services
• snowshoe/spam, use grey routes, or bypass registration
• impersonate others or misrepresent identity
• process children's data (<16) or special categories without lawful basis and configuration
• infringe IP or publicity/privacy rights

We may block, throttle, or remove content and suspend accounts to protect recipients, carriers, platforms, or the Service.

Content complaints / takedown. Email support@zappycards.com with the message ID/URL, your contact info, basis of complaint, and proof of rights (where relevant). We may remove content in our reasonable discretion, without waiving defenses.