Terms of Service

1. About these Terms

1.1 Who we are. The VU Credentials service (the “Service”) is provided by VU Credentials Ltd (“VU”, “we”, “us”). It is registered in England and Wales under company number 17527869, and its registered office is at 20 Wenlock Road, London, England, N1 7GU.

1.2 Who you are. These Terms are a contract between VU and the organisation that holds a VU account (the “Customer”, “you”). The person who accepts them confirms that they have authority to bind that organisation.

1.3 Business use only. The Service is provided only to businesses and other organisations acting in the course of their business, not to consumers. By accepting these Terms you confirm that you are not acting as a consumer.

1.4 What makes up the agreement. These Terms, including the data processing terms in section 10, together with the prices on our pricing page and in the dashboard. Our Privacy Policy explains how we handle personal data about your users as a controller. A separate written agreement signed by both of us, such as an enterprise agreement, takes priority where it says so.

2. The Service

2.1 What it does. The Service lets you:

• issue W3C Verifiable Credentials to holders’ wallets over the OpenID for Verifiable Credential Issuance protocol;
• define credential types, their schemas and how they are displayed;
• request and verify credential presentations;
• revoke and suspend credentials you have issued;
• manage your team, API keys and webhooks through a dashboard and an API.

2.2 How credentials are signed. Unless we agree otherwise in writing, credentials are signed with VU’s key, under VU’s platform identifier (did:web:issuer.vucredentials.com), on your behalf, and are presented to holders under your organisation’s name and display details. You decide what each credential says and who receives it.

2.3 Changes to the Service. We develop the Service continually and may change it. We will give you at least 30 days’ notice of a change that materially reduces what the Service does for you.

2.4 The face check at the counter. Where we offer it, Schedule 1 applies to your use of it.

3. Your account

3.1 Applying. Accounts are opened by application, and we decide whether to approve one. We will ask for your organisation’s legal name, country, company registration number and, if you have one, VAT number. Before approving, and from time to time afterwards, we may check public company registers and sanctions lists, and we keep a record of those checks.

3.2 Keeping it accurate. You must keep your organisation’s details accurate, and tell us within 30 days of any change in who owns or controls your organisation.

3.3 Signing in. You sign in with links sent to your email and with passkeys. Some actions, such as creating an API key, ask you to confirm with a passkey. You must keep your team’s email accounts and devices secure. You are responsible for everything done through your account, including by team members you invite.

3.4 API keys. Keep API keys confidential: never in code that runs in a browser or app, in public repositories, or anywhere an unauthorised person can read them. Give each key only the scopes it needs, and revoke a key you believe is exposed.

3.5 Tell us about misuse. Contact support@vucredentials.com as soon as you become aware of unauthorised access to your account.

4. Your responsibilities as the issuer

4.1 What credentials say. You are solely responsible for the accuracy, completeness and lawfulness of everything in the credentials you issue. We do not check, verify or endorse their content.

4.2 Personal data in credentials. You must have a lawful basis under data protection law, including UK GDPR and, where it applies, EU GDPR, for the personal data you put into credentials. For that data you are the controller and we are your processor (section 10).

4.3 Revocation and suspension. You can revoke or suspend credentials you have issued through the Service. Revocation is permanent: a revoked credential cannot be made valid again. Suspension can be reversed. A credential delivered to a holder’s wallet stays in the holder’s control, and neither of us can delete it from the wallet.

4.4 What you must not issue. Credentials that are false, misleading, defamatory or unlawful, or that impersonate another person or organisation.

5. Acceptable use

You must not use the Service to:

• break any law or regulation, or infringe anyone’s rights;
• issue credentials for fraudulent or deceptive purposes;
• benefit a person subject to sanctions (section 8);
• try to gain unauthorised access to the Service, another customer’s account or our infrastructure;
• interfere with the Service’s security, integrity or performance, including by sending more requests than our published limits allow;
• reverse engineer the Service, except as far as the law allows despite this term;
• resell or sublicense access to the Service without our written consent.

We may limit request rates to keep the Service stable for every customer. Webhook endpoints must use HTTPS; we are not responsible for deliveries that fail because an endpoint is unreachable or misconfigured.

6. Fees, prepayment and VAT

6.1 Prices. Prices are shown on our pricing page and in the dashboard. They are in US dollars and exclude VAT and other taxes.

6.2 How issuance is paid for. The Service is prepaid. Each credential you issue is paid for, in this order, from your free monthly allowance, then your bundle balance, then your USD balance at the per-credential price on the pricing page. If none of these covers an issuance, it is refused.

6.3 Free allowance. It resets on the first day of each calendar month and does not roll over. We may change it on 30 days’ notice.

6.4 Bundles. A bundle adds a number of issuances to your bundle balance. Bundles are used before your USD balance, and do not expire while your account is open.

6.5 USD balance. Your USD balance is a prepaid credit, in US dollars, for VU’s services.

• It can be used only to pay for VU’s services.
• It cannot be withdrawn, paid out, transferred to another account, or used to pay anyone else.
• It is not a deposit, not electronic money and not a cryptoasset held for you, and it earns no interest.
• A single top-up is at least US$10 and at most US$5,000, or the limits shown in the dashboard.

6.6 Refunds of prepaid value. Bundles and USD balance are not refundable, except:

• (a) if we close your account without cause, or under section 15.3, we refund your unused USD balance, and your unused bundle issuances in proportion to the price you paid for them;
• (b) where the law requires; or
• (c) at our discretion.

Refunds are made as described in section 7.7, or by another method we agree. Returns of payments that were never credited are covered by section 7.

6.7 VAT.

• If you are in the United Kingdom, we add UK VAT at the applicable rate once we are registered for VAT.
• If you are outside the United Kingdom, our supply is made to you as a business, and you account for any VAT or similar tax under the reverse charge or your local equivalent.
• Give us your country and VAT or tax number, and keep them up to date. If you do not, we may charge UK VAT where the law allows.
• If you must by law withhold or deduct tax from a payment, you pay us whatever more is needed for us to receive the full amount.

6.8 Invoices. We issue an invoice for every paid order. It shows the price in US dollars and the sterling equivalent at HMRC’s published monthly exchange rate. Once we are registered for VAT, it also shows either the VAT charged or the reverse-charge statement. An order is treated as paid, for VAT, on the day it is credited.

6.9 Price changes. We may change prices on 30 days’ notice. A change does not affect an order already credited.

7. Paying with stablecoins

7.1 What we accept. We accept the stablecoins and networks shown in the dashboard when you pay. On the date of these Terms, that is USDC on Polygon, Base and Ethereum, and EURC on Base and Ethereum.

• We identify each token by its network and contract address, never by its name or symbol. No other token credits anything, even if it uses the same name.
• We may stop accepting a token or a network at any time, for example if it stops holding its value.
• Stablecoin payments open in stages, and the dashboard shows whether they are available to your account. Until they are, we can agree another way to pay with you in writing.

7.2 Registered wallets. You may pay only from a wallet that you control and have registered to your account. To register one, you send a small amount we specify from it, once on each network you will pay on.

• We keep that amount.
• A wallet can be registered to only one VU account at a time.
• Payments from an exchange account, a swap or “pay with any token” service, or anyone else’s wallet come from an address that is not yours, and cannot be credited.

7.3 Payment orders. When you pay, we give you a payment order showing the exact amount, the token, the network and our receiving address.

• The amount is fixed for 30 minutes. For EURC it is converted from US dollars at the rate shown, which is fixed for that time.
• Check the token, network and address before you send, and copy the address only from the order page.
• You pay the network fee for your transfer.

7.4 When a payment is credited. We credit a payment only after we have verified it on the blockchain and it has become final on its network. That takes from a few seconds to about 20 minutes, depending on the network.

7.5 Amounts that do not match.

7.6 Mistakes. Blockchain transfers cannot be reversed, and you are responsible for sending the right token, on the right network, to the right address. If you send a token we do not accept, use a network we do not support, or pay from a wallet that is not registered, we have no obligation to return it. We will try where we reasonably can, and only to the address it came from.

7.7 Returns. We return funds only to the address that sent them, on the same network, in the same token, and after the sanctions checks in section 8. We never send them anywhere else, whoever asks. We pay the network fee for a return, and aim to make it within 10 business days of identifying it or receiving your request.

7.8 What we will never ask you to do. We will never ask you to approve a token allowance, sign a “permit”, or send funds anywhere other than the address on the order page, and we will never contact you to change our payment address. Treat any such request as fraud, and tell us.

7.9 Stablecoin and network risk. Stablecoins are issued by third parties, such as Circle, and run on public networks that we do not control. We are not responsible for anything an issuer or a network does before a payment is credited, including freezing or pausing a token. Once credited, the value is fixed in US dollars as bundle issuances or USD balance, and later changes in the token’s value do not affect it.

7.10 What we do not do. We accept stablecoins only as payment for our own services. We do not hold cryptoassets for you, exchange or transfer them on your behalf, or provide any investment service.

8. Sanctions

8.1 Your confirmation. You confirm, and will keep confirming while you hold an account, that neither your organisation nor any of its directors, owners or controllers is designated under United Kingdom sanctions or appears on the US Office of Foreign Assets Control’s Specially Designated Nationals list, and that you will not use the Service for the benefit of anyone who is.

8.2 Our screening. We screen applicants, registered wallets, payments and returns against the UK Sanctions List and the US OFAC list.

8.3 If there is a match. If a payment, wallet or account is linked to a sanctioned person or address:

• we will not credit or return the funds, and will hold them as the law requires;
• we may suspend your account;
• we will report it to the authorities where the law requires, or where we consider it appropriate.

We are not liable for any loss caused by our complying with sanctions law.

9. Intellectual property and your data

9.1 Ours. VU and its licensors own all rights in the Service, including its software, APIs, documentation and brand. These Terms give you a right to use the Service while your account is open, and nothing more.

9.2 Yours. You own the data you put into the Service, including your credential schemas, the claims in your credentials and your organisation’s details. You give us a non-exclusive licence to use that data only to provide the Service to you.

9.3 Feedback. If you send us suggestions, we may use them without obligation to you.

10. Data protection

10.1 Roles. For personal data in credential claims, and about holders and verifiers, that you submit to or generate through the Service (“Customer Personal Data”), you are the controller and VU is your processor. For personal data about your own users of the dashboard, VU is a controller, as our Privacy Policy describes.

10.2 Instructions. We process Customer Personal Data only on your documented instructions, which are these Terms and your use of the Service, unless the law requires otherwise. If it does, we will tell you before processing, unless the law forbids that.

10.3 Confidentiality. Everyone we authorise to process Customer Personal Data is bound to keep it confidential.

10.4 Security. We keep appropriate technical and organisational measures to protect Customer Personal Data, including encryption in transit, database-enforced separation between customers, signing keys held in a cloud key-management service, and access limited to those who need it.

10.5 Sub-processors. You authorise the sub-processors listed in our Privacy Policy. We will give you at least 30 days’ notice of a new one. You may object on reasonable data protection grounds and, if we cannot resolve the objection, close your account and receive a refund under section 6.6(a). We impose data protection terms on each sub-processor equivalent to these.

10.6 International transfers. The Service is hosted on Google Cloud in the United States. We transfer Customer Personal Data outside the United Kingdom only under a mechanism that UK GDPR recognises, such as the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Agreement or Addendum.

10.7 Assistance. Taking into account the nature of the processing, we will reasonably help you respond to requests from individuals exercising their rights, and meet your obligations on security, breach notification, impact assessments and consultation with regulators.

10.8 Breaches. We will tell you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own obligations.

10.9 When your account closes. We will delete Customer Personal Data within 30 days, except what the law requires us to keep, such as billing records. If you ask before closing, we will first return it to you in a standard format.

10.10 Audit. We will make available the information reasonably necessary to show that we comply with this section, and allow an audit on reasonable notice, at your cost, no more than once a year unless a regulator requires one or we have had a breach.

11. Availability and support

We aim to keep the Service available, but do not guarantee uninterrupted access. It may be unavailable for maintenance, which we will announce in advance where we reasonably can, or because of problems with our hosting provider or other events beyond our control. A service level commitment is available only under a separate written agreement.

12. Liability

12.1 What is never limited. Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded.

12.2 What we exclude. We provide the Service with reasonable skill and care; otherwise, as far as the law allows, we give no warranties. We are not liable for:

• loss of profits, revenue, business, goodwill or anticipated savings;
• loss or corruption of data, except our obligations under section 10;
• any indirect or consequential loss;
• the content, accuracy or legal effect of credentials you issue;
• losses caused by sending the wrong token, using the wrong network or address, or paying from a wallet that is not registered;
• anything a stablecoin issuer or a blockchain network does before a payment is credited;
• anything we do to comply with sanctions law.

12.3 Our cap. Our total liability arising out of or in connection with these Terms, in any twelve-month period, is limited to the greater of the fees you paid us in the twelve months before the event giving rise to the claim, and £100. The cap does not apply to refunds and returns we owe you under sections 6.6 and 7, or to your obligation to pay for the Service.

13. Indemnity

You will indemnify us against claims, losses and reasonable costs, including legal fees, arising from the credentials you issue (including any claim by a holder or a third party), from personal data you submit without a lawful basis, and from your breach of these Terms or of the law.

14. Suspension and closure

14.1 By you. You may close your account at any time by emailing support@vucredentials.com.

14.2 By us. We may suspend or close your account:

• immediately, if you materially breach these Terms, if your use poses a security risk to the Service or to other customers, if section 8 applies, or if the law or a competent authority requires it;
• after 30 days’ notice, if your account has been inactive for twelve months;
• after 30 days’ notice, for any other reason, in which case section 6.6(a) applies.

14.3 What happens next. When your account closes, your access and API keys end, section 10.9 governs your data, and refunds follow section 6.6. Sections 4, 6.6, 7, 8, 9, 10, 12, 13, 16 and 17 continue to apply.

15. Changes to these Terms

15.1 We may update these Terms. We will tell you of a material change by email, and in the dashboard, at least 30 days before it takes effect.

15.2 If you keep using the Service after a change takes effect, you accept it.

15.3 If a change materially disadvantages you, you may close your account before it takes effect, and we will refund unused prepaid value under section 6.6(a).

16. General

• Entire agreement. These Terms are the whole agreement between us about the Service, and replace anything said before. Neither of us relies on any statement that is not in them.
• Assignment. You may not transfer your rights or obligations without our written consent. We may transfer ours to a company in our group, or to a successor to our business, after telling you.
• Third parties. No one other than you and VU has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.
• Notices. We send notices to the email addresses of your account’s owners. You send notices to legal@vucredentials.com.
• Events beyond control. Neither of us is liable for failing to perform because of events beyond its reasonable control, except for obligations to pay.
• Severability. If a provision is found unenforceable, the rest continue in force.
• No waiver. Not enforcing a right now does not waive it.
• Relationship. Nothing in these Terms creates a partnership, agency or employment relationship between us.

17. Law and disputes

These Terms, and any dispute about them or the Service, including non-contractual disputes, are governed by the law of England and Wales. Before going to court, either of us will notify the other of a dispute in writing, and we will try in good faith to resolve it for 30 days; we may agree to mediation. The courts of England and Wales have exclusive jurisdiction.

18. Contact

• Legal: legal@vucredentials.com
• Support: support@vucredentials.com

Schedule 1. The face check at the counter

S1.1 What it is. Once a customer has answered your check with their VU ID, a member of your team may ask, on VU’s screens, to check that the customer’s face matches the photo on their passport’s chip: in VU’s app, or in your own app through VU’s SDK where we have opened that to you. The customer agrees or declines on their own phone. You receive only the result: “It’s them”, “Not them” or “Couldn’t confirm”, never an image or a score.

S1.2 Who is responsible. VU is the controller of the face check, and handles the customer’s rights in it: their consent, their questions and their requests. You are a separate controller of the result you receive and of what you decide with it. You never receive the customer’s biometric data.

S1.3 Where you may use it. You may ask a customer for a face check only at premises in a country where VU offers it. VU decides which countries those are, by the country your organisation is registered in, and may add or remove one at any time. Your team sees on VU’s screens whether the face check is available to you.

S1.4 Another way, always. You must offer every customer a way to prove who they are that does not use their face, such as your staff checking their physical document, and treat it as equal to the face check. You must not refuse service, or treat a customer less favourably, because they decline the face check where you would accept another proof. You may still refuse someone who cannot prove who they are in any way you accept, where the law or your own policy requires that proof.

S1.5 What the result means. The result informs your staff. It is never on its own a reason to refuse service. “Couldn’t confirm” means the check could not tell; it does not mean the customer is someone else. If a customer says the result is wrong, let them show another form of ID, and decide on that.

S1.6 How your team uses it. Only members of your team may ask for a face check, on VU’s screens, with the customer present: in VU’s app, or in your own app through VU’s SDK, whose screens you must run as we supply them, unaltered; never through an API key alone. You must not photograph or record a customer during it, or press them to agree or to try again once they have declined.

S1.7 Checks for your merchants. Where you ask on behalf of a merchant you serve, you name the merchant and the country of its premises to us for each check, and you are responsible for both being true. The customer sees the merchant’s name beside yours, and the face check is available only where that country allows it under S1.3. This Schedule binds you for every check you run for a merchant.