Terms of Use

1.1 Agreement Welcome to Dataflag. These Terms of Use ("Terms," "Agreement") constitute a legally binding agreement between you ("User," "Partner," "Customer," "you," or "your") and Dataflag, operated through the website dataflag.in ("Dataflag," "Company," "we," "us," or "our"). 1.2 Nature of Business Dataflag operates as an Application Programming Interface (API) aggregator and reseller platform. We procure APIs from various third-party vendors ("Vendors") and make them available to our partners and customers ("Partners") for integration into their applications and services. 1.3 Acceptance of Terms By accessing, browsing, or using the Dataflag website or any of our API services, you acknowledge that you have read, understood, and agree to be bound by these Terms. If you do not agree to these Terms, you must immediately discontinue use of our services. 1.4 Capacity to Contract By entering into this Agreement, you represent and warrant that: - You are at least 18 years of age - You have the legal capacity to enter into binding contracts under the Indian Contract Act, 1872 - If acting on behalf of an organization, you have the authority to bind that organization to these Terms

For the purposes of this Agreement: - "API" means Application Programming Interface, including all associated documentation, SDKs, and related materials. - "API Key" means the unique authentication credential issued to Users for accessing API services. - "API Call" or "API Request" means each individual request made to an API endpoint. - "Documentation" means technical specifications, integration guides, and usage instructions provided for APIs. - "Downstream User" means any end-user or customer of a Partner who indirectly uses Dataflag APIs through the Partner's application. - "Fair Use" means usage patterns consistent with normal business operations as determined by Dataflag. - "Partner" means any individual or entity that purchases or uses API services from Dataflag. - "Service Level Agreement" or "SLA" means the performance commitments outlined in Section 8. - "Vendor" means third-party API providers from whom Dataflag procures API services.

3.1 Services Provided Dataflag provides access to various APIs including but not limited to: - Financial and Banking APIs - KYC and Verification APIs 3.2 Service Availability Services are provided on an "as-is" and "as-available" basis, subject to the SLA commitments outlined in Section 8. 3.3 Right to Modify Services Dataflag reserves the right to modify, suspend, or discontinue any API service with prior notice as specified in Section 19.

4.1 Account Creation To access our services, you must create an account by providing accurate and complete information including: - Legal name (individual or business) - Valid email address - Contact number - Business registration details (for companies) - GST registration number (if applicable) - PAN details (for KYC compliance) 4.2 Account Security You are solely responsible for: - Maintaining the confidentiality of your account credentials - All activities that occur under your account - Immediately notifying Dataflag of any unauthorized access or security breach - Ensuring API Keys are stored securely and not shared publicly 4.3 Account Verification Dataflag reserves the right to verify your identity and business credentials through KYC procedures as mandated under applicable Indian laws including the Prevention of Money Laundering Act, 2002 (PMLA).

5.1 License Grant Subject to your compliance with these Terms and payment of applicable fees, Dataflag grants you a limited, non-exclusive, non-transferable, revocable license to: - Access and use the APIs solely for your internal business purposes - Integrate APIs into your applications - Make API calls within your subscribed quota 5.2 License Restrictions You shall NOT: - Sublicense, resell, or redistribute APIs without written authorization from Dataflag - Reverse engineer, decompile, or disassemble any API or related technology - Use APIs to create competing products or services - Exceed usage limits or circumvent rate limiting mechanisms - Use APIs for any unlawful purpose - Share, publish, or expose API Keys publicly - Use automated systems to abuse API quotas 5.3 Intellectual Property All intellectual property rights in the APIs, Documentation, and Dataflag platform remain with Dataflag and/or the respective Vendors. This Agreement does not transfer any ownership rights.

6.1 Prohibited Uses You agree NOT to use Dataflag services for: - Any activity that violates Indian laws or regulations - Transmission of malware, viruses, or malicious code - Unauthorized access to systems or data - Spamming, phishing, or fraudulent activities - Activities that infringe third-party intellectual property rights - Money laundering or financing of illegal activities - Bulk SMS/communications in violation of TRAI regulations - Collection of personal data without proper consent under DPDP Act 2023 - Any purpose that may bring disrepute to Dataflag 6.2 Compliance Requirements You must comply with: - Information Technology Act, 2000 and its amendments - Digital Personal Data Protection Act, 2023 (DPDP Act) - Prevention of Money Laundering Act, 2002 (if applicable) - RBI regulations (for financial APIs) - TRAI regulations (for communication APIs) - UIDAI guidelines (for Aadhaar-based services) - All other applicable Indian laws and regulations 6.3 Data Protection Obligations When processing personal data through our APIs, you must: - Obtain valid consent from data principals as required under DPDP Act 2023 - Process data only for lawful purposes - Implement appropriate security measures - Honor data subject rights including right to erasure - Notify Dataflag immediately of any data breach

7.1 Usage Quotas API usage is subject to the quotas specified in your subscription plan. Quotas may include: - Daily/Monthly API call limits - Requests per second (rate limiting) - Data transfer limits - Concurrent connection limits 7.2 Rate Limiting To ensure fair access for all users, APIs may be subject to rate limiting. Exceeding rate limits may result in temporary blocking of requests (HTTP 429 errors). 7.3 Fair Use Policy Dataflag operates a Fair Use Policy. Usage patterns that significantly deviate from normal business operations, as determined by Dataflag, may be investigated and may result in: - Temporary service suspension - Requirement to upgrade to a higher tier - Account termination for egregious violations 7.4 Overage Charges If your usage exceeds subscribed quotas, overage charges may apply as specified in your pricing plan.

8.1 Uptime Commitment Dataflag commits to a target uptime of 99.5% for core API services, calculated on a monthly basis. Uptime % = ((Total Minutes in Month - Downtime Minutes) / Total Minutes in Month) × 100 8.2 Origin Source Downtime Dataflag sources APIs from third-party Origin Sources (Vendors). In the event of any downtime, outage, or service disruption from the Origin Source side: - Dataflag shall promptly inform the Customer about the Origin Source downtime through email, dashboard notification, or other appropriate communication channels - Dataflag shall NOT be held responsible or liable for any downtime, service disruption, or unavailability caused by the Origin Source - The Customer acknowledges that Dataflag has no control over the uptime, availability, or performance of Origin Source APIs - Dataflag's responsibility is limited to notifying Customers and coordinating with the Origin Source for resolution 8.3 Non-Billable Hits During Origin Source Downtime During periods of Origin Source downtime or unavailability: - API calls made during the downtime period shall NOT be counted as billable hits - Failed API requests due to Origin Source unavailability will be excluded from the Customer's usage quota - Dataflag will adjust the billing accordingly for the affected time period - Customers may request a usage report showing excluded non-billable hits during downtime periods - The determination of downtime periods shall be based on Dataflag's monitoring systems and logs 8.4 Exclusions from Uptime Calculation The following are excluded from Dataflag's uptime calculations: - Scheduled maintenance (with 48 hours prior notice) - Force majeure events - Issues caused by Origin Source/Vendor API providers - Issues arising from User's systems or networks - Suspension due to User's breach of Terms - Third-party infrastructure failures beyond Dataflag's control

9.1 Pricing API services are provided on a paid subscription basis. Current pricing is available on our website and may vary based on: - API type and tier - Usage volume - Subscription duration - Enterprise arrangements 9.2 Payment Terms - All fees are payable in Indian Rupees (INR) - Payment is due in advance for subscription plans - Pay-as-you-go charges are billed monthly in arrears - Payment methods: UPI, Net Banking, Credit/Debit Cards, Bank Transfer 9.3 Taxes All fees are exclusive of applicable taxes. You are responsible for: - Goods and Services Tax (GST) at prevailing rates - Any other applicable taxes or duties - Withholding taxes (if applicable) Dataflag will provide GST-compliant invoices. 9.4 Late Payment - Late payments attract interest at 1.5% per month - Services may be suspended after 15 days of non-payment - Accounts may be terminated after 30 days of non-payment 9.5 Payment Gateway All payments are processed through secure third-party payment gateways. By making payments, you agree to the payment processor's terms. Dataflag does not store your payment card information.

10.1 Cancellation by User - You may cancel your subscription at any time through your account dashboard or by emailing [email protected] - Cancellation takes effect at the end of the current billing period - No prorated refunds for unused portion of subscription period 10.2 Non-Refundable Items The following are non-refundable: - API calls already consumed - Setup or onboarding fees - Custom development charges - Services accessed or utilized 10.3 Termination by Dataflag Dataflag may terminate or suspend services immediately for: - Breach of these Terms - Non-payment of fees - Fraudulent or illegal activity - Violation of Acceptable Use Policy - Request by law enforcement

11.1 Vendor APIs APIs provided through Dataflag may be sourced from third-party Vendors. Your use of such APIs may also be subject to: - Vendor-specific terms and conditions - Vendor privacy policies - Vendor acceptable use policies 11.2 Vendor Changes Dataflag reserves the right to change API Vendors without prior notice, provided substantially similar functionality is maintained. 11.3 No Warranty for Vendor Services Dataflag does not warrant or guarantee Vendor API performance, accuracy, or availability beyond the commitments in Section 8. 11.4 Pass-Through Liability For issues arising directly from Vendor APIs, Dataflag's liability is limited to passing through any remedies obtained from the Vendor. 11.5 Vendor Data Accuracy and Accountability Dataflag sources API data and services from third-party Vendors in good faith. In the event that any Vendor provides inaccurate, incorrect, misleading, or erroneous data or information through their APIs: - The concerned Vendor shall be solely responsible for any damages, losses, claims, or liabilities arising from such inaccurate or wrong data - Dataflag shall not be held liable for any consequences resulting from incorrect information provided by Vendors - Dataflag acts solely as an intermediary and does not independently verify the accuracy of data provided by Vendors - Users acknowledge that Dataflag has no control over the data generated or provided by Vendor APIs - Any claims related to data accuracy shall be directed to the respective Vendor, and Dataflag shall assist in facilitating communication where reasonably possible - Dataflag reserves the right to discontinue any Vendor's APIs upon discovery of persistent data accuracy issues

12.1 Customer Responsibility for API Usage The Customer/Partner shall be solely and entirely responsible for any and all consequences arising from: - Misuse, abuse, or improper use of Dataflag APIs - Any unlawful, illegal, or unauthorized activities conducted using Dataflag services - Violation of any applicable laws, regulations, or third-party rights through API usage - Any harm caused to third parties, end-users, or Downstream Users through the Customer's application or services 12.2 Sole Liability of Customer In the event of any misuse or wrongful use of Dataflag APIs by the Customer, the Customer agrees and acknowledges that: - The Customer shall bear sole and complete liability for all damages, losses, penalties, fines, legal costs, and claims arising therefrom - Dataflag shall be fully indemnified and held harmless from any such liability - Dataflag shall not be responsible for any direct, indirect, incidental, consequential, or punitive damages resulting from Customer's misuse - The Customer shall defend Dataflag against any legal proceedings initiated by third parties due to Customer's actions 12.3 Examples of Misuse (Non-Exhaustive) Customer misuse includes but is not limited to: - Using APIs for fraudulent transactions, identity theft, or financial crimes - Sending spam, phishing messages, or unsolicited communications via Communication APIs - Conducting unauthorized KYC verification or identity checks - Violating data protection laws or mishandling personal data - Using APIs to harm, harass, or deceive end-users - Circumventing security measures or exploiting API vulnerabilities - Reselling or redistributing APIs without authorization - Using APIs for any purpose prohibited under Indian law 12.4 Consequences of Misuse Upon detection or report of API misuse, Dataflag may: - Immediately suspend or terminate the Customer's account without prior notice - Withhold any refunds or pending payments - Report the matter to appropriate law enforcement authorities - Pursue legal action to recover damages and costs - Cooperate with authorities in any investigation against the Customer 12.5 Customer Acknowledgment By using Dataflag services, the Customer expressly acknowledges and agrees that: - They understand the legal implications of API misuse - They accept full responsibility for all activities under their account - They will ensure their employees, agents, and Downstream Users comply with these Terms - Dataflag's role is limited to providing API access and does not extend to monitoring Customer's end-use

13.1 AI and Machine Learning Disclaimer The Customer acknowledges and agrees that: - Many APIs provided by Dataflag utilize Artificial Intelligence (AI) and Machine Learning (ML) models, whose output is probabilistic in nature and not guaranteed to be accurate - Services provided under this Agreement shall under no circumstances be construed or deemed to be a due diligence (legal or otherwise) of any individual, person, customer, or end-user - Dataflag shall not be held liable or responsible for any document, information, or other details of any individual/person/end-user forwarded by the Customer as being accurate, true, correct, or otherwise - The Customer shall be solely responsible for further evaluation of the accuracy of AI/ML-based Services, including but not limited to employing human review and verification - Dataflag is not providing any advice or recommendation for the Customer to onboard any individual/end-user or to enter into any type of transaction (monetary or otherwise) with any individual/end-user - The Customer shall make their own independent decisions based on their own evaluation and shall not rely solely on Dataflag's AI/ML outputs 13.2 "As-Is" Service EXCEPT AS EXPRESSLY PROVIDED IN THESE TERMS, DATAFLAG PROVIDES SERVICES ON AN "AS-IS" AND "AS-AVAILABLE" BASIS WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. 13.3 Disclaimer of Warranties TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, DATAFLAG DISCLAIMS ALL WARRANTIES INCLUDING: - Merchantability - Fitness for a particular purpose - Non-infringement - Accuracy or reliability of results - Uninterrupted or error-free service 13.4 No Guarantee of Results Dataflag does not guarantee that: - Services will meet your specific requirements - Services will be uninterrupted, timely, or error-free - Results obtained will be accurate or reliable - Defects will be corrected 13.5 Third-Party Dependency Disclaimer The Customer is aware, understands, and agrees that Services provided by Dataflag via its platform and APIs are subject to the availability of certain services and/or websites maintained by third parties including but not limited to: - Banks and financial institutions - Government agencies and regulatory bodies - Hosting service providers - Telecom operators - Data providers and verification agencies Dataflag shall in no event be liable for any non-availability of Services caused due to delays, errors, interruptions, loss, damage, or non-availability of services and/or websites provided or maintained by these third parties. Dataflag does not warrant prior notice commitment of such delays or interruptions but may, on a best-effort basis, inform the Customer about such instances as and when it comes to Dataflag's knowledge.

14.1 Exclusion of Consequential Damages TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL DATAFLAG, ITS DIRECTORS, EMPLOYEES, OR AFFILIATES BE LIABLE FOR ANY: - Indirect, incidental, special, or consequential damages - Loss of profits, revenue, or business - Loss of data or data breach costs - Loss of goodwill or reputation - Costs of procurement of substitute services 14.2 Maximum Liability DATAFLAG'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING FROM OR RELATED TO THESE TERMS OR SERVICES SHALL NOT EXCEED THE AMOUNT PAID BY YOU TO DATAFLAG IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE CLAIM. 14.3 Essential Purpose THE LIMITATIONS IN THIS SECTION SHALL APPLY EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE. 14.4 Statutory Rights Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable Indian law, including liability for fraud or willful misconduct.

15.1 Your Indemnification Obligations You agree to indemnify, defend, and hold harmless Dataflag, its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising from: - Your use of Dataflag services - Your violation of these Terms - Your violation of any applicable law or regulation - Your infringement of third-party rights - Actions of your Downstream Users - Data breaches resulting from your negligence - Any misrepresentation made by you 15.2 Indemnification Process Dataflag will: - Promptly notify you of any claim - Allow you to control the defense (subject to Dataflag's approval of counsel) - Provide reasonable cooperation at your expense Dataflag reserves the right to participate in the defense at its own expense.

16.1 Governing Law This Agreement shall be governed by and construed in accordance with the laws of India, without regard to conflict of law principles. 16.2 Informal Resolution Before initiating formal dispute resolution, parties agree to attempt informal resolution by: - Sending written notice of the dispute to the other party - Engaging in good faith negotiations for 30 days - Escalating to senior management if initial discussions fail 16.3 Jurisdiction Subject to the arbitration clause, courts in Surat, Gujarat, India shall have exclusive jurisdiction over any disputes. 16.4 Injunctive Relief Notwithstanding the above, either party may seek injunctive or other equitable relief from competent courts to protect intellectual property rights or confidential information.

17.1 Confidential Information "Confidential Information" includes: - API documentation and technical specifications - Pricing and business terms - User data and usage statistics - Any information marked as confidential - Trade secrets and proprietary information 17.2 Obligations Both parties agree to: - Maintain confidentiality of the other party's Confidential Information - Use Confidential Information only for purposes of this Agreement - Not disclose to third parties without prior written consent - Protect Confidential Information with reasonable security measures 17.3 Exceptions Confidentiality obligations do not apply to information that: - Is publicly available through no fault of the receiving party - Was known to the receiving party prior to disclosure - Is independently developed without use of Confidential Information - Is required to be disclosed by law or court order 17.4 Duration Confidentiality obligations survive termination of this Agreement for a period of three (3) years.

18.1 Privacy Policy Your use of Dataflag services is also governed by our Privacy Policy, available at dataflag.in/privacy-policy, which is incorporated into these Terms by reference. 18.2 Data Controller/Processor For personal data processed through APIs: - You act as the Data Fiduciary (Controller) for your end users' data - Dataflag acts as a Data Processor on your behalf - Processing is limited to providing the contracted services 18.3 Data Security Dataflag implements appropriate technical and organizational measures including: - Encryption of data in transit and at rest - Access controls and authentication - Regular security assessments - Incident response procedures 18.4 Data Localization Where required by Indian law, personal data of Indian citizens shall be stored within India.

19.1 Right to Modify Dataflag reserves the right to modify these Terms at any time. Modifications will be effective upon: - Posting updated Terms on our website 19.2 Continued Use Your continued use of services after modifications constitutes acceptance of the updated Terms.

20.1 Entire Agreement These Terms, along with the Privacy Policy and any service-specific terms, constitute the entire agreement between you and Dataflag, superseding all prior agreements. 20.2 Severability If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. 20.3 Waiver Failure to enforce any right or provision shall not constitute a waiver of such right or provision. 20.4 Assignment You may not assign or transfer these Terms without Dataflag's written consent. Dataflag may assign its rights and obligations without restriction. 20.5 Force Majeure Neither party shall be liable for delays or failures due to circumstances beyond reasonable control, including natural disasters, war, terrorism, pandemics, government actions, or infrastructure failures. 20.6 Notices Notices shall be sent to: To Dataflag: Email: [email protected] To User: Email address registered with the account 20.7 Relationship Nothing in these Terms creates a partnership, joint venture, employment, or agency relationship between the parties. 20.8 Survival Provisions relating to intellectual property, confidentiality, limitation of liability, indemnification, and dispute resolution shall survive termination of this Agreement. 20.9 Non-Solicitation During the term of this Agreement and for a period of three (3) years thereafter, the Customer shall not, either directly or indirectly, on its own behalf or in the service or on behalf of others: - Solicit or attempt to solicit any employees, consultants, or contractors of Dataflag or its affiliates - Divert or hire away any employees, consultants, or contractors of Dataflag or its affiliates - Induce or attempt to induce any employee of Dataflag to leave their employment - Offer employment or engagement to any person who is or was employed by Dataflag within the preceding twelve (12) months Any breach of this clause shall entitle Dataflag to seek injunctive relief and claim damages equivalent to twelve (12) months' compensation of the solicited employee, in addition to any other remedies available under law. 20.10 Non-Disparagement The Customer agrees that during the term of this Agreement and at all times thereafter: - The Customer shall not make any statements or representations, or otherwise communicate, directly or indirectly, in writing, orally, or through any medium (including social media), any information or content that may disparage, defame, or damage the reputation of Dataflag, its affiliates, partners, directors, officers, employees, or services - The Customer shall not take any action which may, directly or indirectly, harm the goodwill, reputation, or business interests of Dataflag - The Customer shall not publish negative reviews, comments, or feedback about Dataflag's services with the intent to cause harm or damage to Dataflag's business Exceptions: This clause shall not restrict the Customer from: - Making truthful disclosures before a court, tribunal, or regulatory authority - Providing honest feedback directly to Dataflag for service improvement - Making disclosures required by law or to the Customer's auditors or legal counsel Any violation of this clause may result in immediate termination of services and Dataflag reserves the right to pursue legal remedies for damages to its reputation and business. 20.11 Third-Party Rights No third party shall have the right to enforce the provisions of this Agreement. This Agreement is entered into solely for the benefit of the Parties hereto and their permitted successors and assigns.

21.1 Information Technology Act, 2000 Dataflag operates in compliance with the Information Technology Act, 2000 and its amendments. As an intermediary: - We observe due diligence requirements - We cooperate with law enforcement as required 21.2 Intermediary Guidelines In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021: - Users must not upload prohibited content - Dataflag may remove or disable access to unlawful content 21.3 Consumer Protection Users who qualify as "consumers" under the Consumer Protection Act, 2019 retain their statutory rights notwithstanding any terms herein.

For questions, support, or concerns regarding these Terms: Dataflag Website: https://dataflag.in Email: [email protected] Support: [email protected] Acknowledgment BY USING DATAFLAG SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS OF USE. © 2026 Dataflag. All rights reserved.