Terms of Service

1.1 Parties. The service provider is Legichain. Address and tax details are stated in customer agreements and provided on request. The organisation that opens an account, places an order or uses the service is the “Customer”.

1.2 Scope. Legichain provides only the services included in the selected plan or order, within the purpose of use, region, credit, capacity and term limits stated there. A feature that is not selected, a paid extension of a supported feature or a roadmap feature is not automatically in scope. Resale to the Customer's affiliates or to its own customers is permitted only where agreed in writing.

1.3 Precedence of a signed custom agreement. Where the Customer and Legichain have signed an Enterprise Service Agreement and its annexes (commercial terms, service scope, processing of personal data, retention and deletion, service level), the provisions of the signed agreement apply in every matter where they conflict with these terms. A unilateral update on the website, the pricing page, a presentation or the panel does not change a signed price, credit tariff, data-use purpose, retention period or liability limit. In matters not regulated by the signed agreement, these terms apply as a supplement. Mandatory law is reserved in all cases.

1.4 Technical documentation. The technical documentation published by Legichain governs integration.

3.1 Identity verification. Document, OCR/MRZ, NFC, liveness and face-matching checks are separate features; which of them apply is defined in the selected scope. Integrity and signature checks of an NFC chip do not by themselves prove the real-time presence of the person presenting the chip, that they are the person on the document, or their legal authority to transact. A check that is switched off is never presented as if it had been performed.

3.2 AML screening. Sanctions, PEP and, where included, adverse media screening is limited to the defined source and update scope. Similar names, missing attributes, transliteration and source errors can produce false positives or false negatives. A match is not, on its own, a conclusive finding of crime, of the application of sanctions or of customer rejection; the absence of a match does not show that a person is risk-free. The Customer performs its own risk-based review and, where needed, human assessment; Legichain investigates reported technical or matching errors and corrects those attributable to it.

3.3 Blockchain address screening. Scope is limited to the supported network, address format, dataset and relationship depth. Screening an address does not verify control of the private key, the beneficial owner, the full transaction history or the lawful origin of assets. Live chain monitoring, transaction monitoring, multi-hop fund tracing, Travel Rule, asset custody and transfer execution are in scope only where expressly purchased separately. An unsupported network or a failed query cannot be read as a “clean” result.

3.4 Reports and audit trail. Reports reflect the inputs, selected checks and accessible results at the time they were produced; unless continuous monitoring is selected, an old report is not updated automatically. Record-integrity mechanisms that support change detection do not replace a qualified electronic signature, an official time stamp or notarisation.

3.5 Regulatory boundary. The service provides technical decision support. The Customer's regulatory status, customer acceptance decision, risk appetite, suspicious transaction reporting, application of sanctions and statutory record-keeping obligations remain with the Customer. No regulatory approval or guarantee of full sectoral compliance is deemed given unless verified documents and scope are stated in writing.

5.1 Lawfulness. The Customer uses the service for lawful purposes; establishes the processing condition required for the data it transfers, informs End Users properly and, where required, obtains valid explicit consent and keeps it provable. Acceptance of these terms or signature of an enterprise agreement does not constitute the End User's explicit consent. The service is not used for special-category data, children or vulnerable persons unless the applicable additional obligations are met. Where legally required, the Customer provides the ability to contest an automated result and obtain human re-assessment; Legichain makes the available findings and reasons accessible to support that review.

5.2 Access security. The Customer protects access keys and secrets; server keys are never placed in mobile applications, browsers or public repositories. The Customer defines permissions at minimum scope, validates user/session/application matching in its own backend, reports suspicious access without delay and rotates affected keys. Ordinary transaction fees for unauthorised use caused by a breach of the Customer's own systems, staff or integrator are borne by the Customer; Legichain's fault or failure to take reasonable measures after notification reduces this outcome in proportion to its contribution.

5.3 Integration. The Customer provides network and device compatibility, native NFC components and its own software according to the agreed division of tasks. Provision of an SDK does not mean that every operating system and device combination or a third-party NFC engine is included.

5.4 Webhooks. A Customer receiving webhooks verifies the signature and timestamp on the raw request body, prevents duplicate processing using delivery/event identifiers, returns a successful HTTP response only after durably recording the notification, and reconciles the final state with the authoritative status query. Exactly-once, ordered or guaranteed delivery is not promised; a notification failure does not invalidate the existing query result.

5.5 Own archive. The Customer lawfully exports the data it needs into its own systems before the retention period expires and determines its own statutory retention needs. Unless a separate archiving or recovery service is expressly purchased, Legichain is not the Customer's statutory archive or backup; agreed lawful deletion does not by itself constitute a breach by Legichain.

7.1 Plan, term, price, currency, tax treatment, payment due date, renewal, additional credit and overage conditions are determined by the selected plan or the signed agreement. Credit-consuming events and credits per check are published on the Pricing page; a service without a defined price is not opened as a paid service in production.

7.2 A credit is consumed when the chargeable operation takes place. In the model where creating a session is chargeable, rejection, abandonment or expiry of the session is not by itself a ground for refund. Credits are corrected for duplicate charges or paid operations not delivered due to Legichain's fault. Re-submission of the same operation under idempotency does not create a new charge. Switching a biometric check off does not automatically lower the same session tariff.

7.3 Unless agreed otherwise, plans are prepaid. Credits are valid for one year; they do not renew automatically, cannot be transferred to another account and are not converted to cash at the end of the term. Additional credit availability depends on the plan; where no overage entitlement is defined, overage is closed and no debt or additional package arises automatically.

7.4 The Customer pays the undisputed amount of an invoice when due. A technical consumption dispute is reported with transaction identifiers within 30 days of becoming known; Legichain provides a review response and record summary within 10 business days. The service is not suspended solely because of a portion disputed in good faith while it is under review. Statutory commercial default rules apply to late payment; taxes, exchange rates and payment arrangements follow mandatory law.

9.1 Legichain may develop the service, but may not materially reduce the core function, security level or data protection purchased for the term.

9.2 At least 90 days' notice, a migration document and a reasonable testing opportunity are provided before a backwards-incompatible API or SDK removal. Changes that cannot wait because of a security vulnerability or binding law may be made in a narrow scope with notice given without delay. The Customer applies reasonable security updates.

9.3 If a material part of the scope is permanently reduced because of the loss of a third-party source or a change in law, Legichain proposes a substantially equivalent alternative or transition solution within a reasonable time; if none can be provided, the affected service may be terminated without penalty and Section 13.4 applies only to the undelivered part. External source cost increases are not passed on unilaterally to the current term's price.

11.1 Roles, security measures, use of sub-services, transfers, breach notification and retention in the processing of personal data are governed by the Privacy Notice and, where one exists, the data processing annexes of the Customer's signed agreement. Where Legichain notices an unlawful instruction, it reports this with reasons and stops processing the unlawful part.

11.2 Identity verification content and screening data are processed and stored in the selected region; the operation of account, permission and billing management in a separate control system is not a permission to copy End User data to another region.

11.3 When Legichain becomes aware of a personal data breach, it gives the Customer initial information without delay and at the latest within 24 hours, completes missing details in stages and takes the necessary measures; the Customer manages notification to authorities and data subjects, with Legichain's support.

11.4 Service Data is deleted from active systems at the end of the retention period defined in the selected plan or agreement; backup copies are destroyed within the regular backup cycle. Anonymous audit records that contain no personal data, and invoices, agreements and mandatory accounting records, are kept for the statutory period; this exception is not a general permission to retain raw identity content.

13.1 Term and renewal. The plan term and credit validity are stated in the selected plan or agreement. Automatic renewal applies only where expressly selected; in that case notice of non-renewal may be given at least 30 days in advance, and a price increase is proposed at least 60 days in advance and is not binding for the new term unless accepted.

13.2 Material breach. In the event of a material breach, the other party notifies the breach and its remediation expectation in writing; if the breach is not remedied within 30 days, the affected service may be terminated. A remedied minor error or a single negative result is not automatically a material breach. Mandatory rights of immediate termination are reserved.

13.3 Discontinuation. If Legichain permanently discontinues a service by commercial decision, it gives 90 days' notice unless binding law or an urgent security requirement prevents this, provides a reasonable transition opportunity and refunds the undelivered part under Section 13.4.

13.4 Refunds. In the event of Legichain's unremedied material breach, discontinuation or a legally mandatory refund, only the net amount actually paid for the undelivered part of the ended service is refunded. No refund arises for delivered service, completed set-up or custom development, consumed credits, promotions or free credits. A refund that is due is made within 30 days of termination; the same amount is never paid twice.

13.5 Exit. On termination, where data has not yet been lawfully destroyed, free export in a standard format is available for 30 days; this period does not extend the retention period. Custom conversion, migration and consultancy are subject to a written work order.

Events beyond a party's reasonable control that cannot be prevented with due care even if foreseen and that prevent performance, such as earthquake, war, a binding public measure or a widespread infrastructure outage, may constitute force majeure to the extent of their concrete effects. The affected party notifies the event, the affected function and the estimated duration without delay and continues mitigation measures. Not every cyber attack or supplier failure is force majeure by itself; ordinary lack of capacity, financing difficulties or a known vulnerability left unaddressed are not excuses. If the impediment exceeds 30 days, either party may end the affected service without penalty. Mandatory data security and notification obligations continue.

17.1 Operational notices are made through the registered email addresses and the support channel ([email protected]). Applicable formal requirements for default, termination and rescission notices are reserved; where required, a notary, registered mail or a secure electronically signed registered email (KEP) is used. Publication in the panel alone does not replace a legally required notice.

17.2 The agreement may not be assigned without the other party's written consent, which is not withheld without reasonable cause. In a merger or business transfer the transferee assumes all obligations and the security and data-transfer conditions are preserved. Use of sub-services is not an assignment.

17.3 These terms are governed by the laws of the Republic of Türkiye. The parties first attempt to resolve a dispute at the level of authorised representatives within 15 business days; mandatory mediation and statutory rules on jurisdiction and competence are reserved. Where a signed agreement selects a competent court, that selection applies; otherwise statutory jurisdiction rules apply.