API Partner Terms of Service

These API Partner Terms ("Terms") are a binding agreement between olow, a Colorado LLC ("olow", "we", "us"), and the business entity completing the developer application or otherwise accessing the olow API ("Partner", "you"). "API" — the olow programmatic interface, including REST endpoints under api.olow.io, the OAuth 2.0 authorization endpoints, the embeddable verification badge, and any future programmatic surface published at olow.io/developers. "API Key" — credentials issued to Partner that authorize calls to the API, including all variants (test, live, badge). "Application" — Partner's software, website, mobile app, or other product that integrates with the API. "End User" — any individual whose olow credential is verified via Partner's Application, whether by token, link, OAuth flow, or otherwise. "Tier" — the billing plan Partner subscribes to (Developer, Starter, Growth, Scale, Pro, or Enterprise) as described at olow.io/developers and defined canonically in our pricing source-of-truth. "Verification Result" — any data returned by the API including credential state (verified, retest-due, unverified), test date, panel, issuer, or related metadata.

To access the API, Partner must: (a) be a business entity, governmental entity, or sole proprietorship engaged in lawful commerce — the API is not available to individual consumers for personal use; (b) be at least 18 years of age and have legal capacity to bind the entity Partner represents; (c) not be located in or controlled by a person located in any country subject to U.S. sanctions; (d) have a legitimate business purpose for verifying STI credentials that complies with Section 4 (Acceptable Use); and (e) agree to these Terms in their entirety. olow may decline any application at our sole discretion. Approval of an application is not a waiver of any other provision of these Terms.

Upon approval, we issue Partner one or more API Keys. Partner is solely responsible for: (a) keeping all API Keys confidential and rotating them on suspected compromise; (b) restricting use of API Keys to the Application and entity for which they were issued; (c) not embedding live API Keys in client-side code, mobile apps, public repositories, or any context where they may be extracted; (d) implementing reasonable security measures to prevent unauthorized use including, at minimum, server-side storage and TLS in transit; (e) all activity occurring under Partner's API Keys, whether authorized or not, until Partner reports compromise to security@olow.io and we revoke the affected keys. We may revoke any API Key immediately and without notice if we reasonably suspect compromise, abuse, or violation of these Terms. Revocation does not affect Partner's payment obligations for usage incurred prior to revocation.

The API exists to let Partner confirm whether an End User holds a current olow verification credential. Partner agrees the API will not be used, directly or indirectly, for any of the following: PROHIBITED USES: (a) Employment decisions — Partner may not use Verification Results to make hiring, firing, promotion, compensation, or other employment-related decisions. STI and HIV status are protected under the Americans with Disabilities Act (42 U.S.C. § 12101 et seq.) and equivalent state laws. (b) Insurance underwriting — Partner may not use Verification Results to set rates, determine eligibility, or deny coverage for any insurance product including but not limited to health, life, disability, or long-term care. (c) Lending and credit — Partner may not use Verification Results in any consumer or commercial credit decision. (d) Housing decisions — Partner may not use Verification Results to deny rental applications, evictions, or any housing access. (e) Immigration or visa determinations — Partner may not use Verification Results in any context that informs immigration, asylum, refugee, or visa eligibility decisions. (f) Minors — Partner may not solicit, accept, or verify credentials for any End User under 18 years of age. The Application must implement reasonable age-gating before any API call. (g) Denylists or blocklists — Partner may not maintain, share, or sell any list of End Users keyed on credential state, identity, or test history derived from the API. (h) Resale of raw Verification Results — Partner may display credential state within the Application but may not resell, syndicate, or relicense Verification Results to third parties without our prior written consent. (i) Public-shaming or doxxing — Partner may not publish, broadcast, or aggregate End User credential data in any context designed to identify or expose specific individuals. (j) Conditions of access that violate the law — Partner may not require an End User to surrender a credential as a condition of any benefit, service, or contract where doing so would violate any applicable law. (k) Reverse-engineering or scraping — Partner may not reverse-engineer the API, scrape verification data, or use the API for any purpose not expressly contemplated by these Terms. (l) Misrepresentation — Partner may not represent olow Verification Results as proof of current health status, freedom from disease, or absence of transmission risk. Partner must surface to End Users the same scope limitations stated in olow.io/terms Section 4 (No Warranty of Disease Status). We reserve the right to investigate suspected violations and, if confirmed, to suspend or terminate API access immediately, retain all paid fees, and refer the matter to appropriate authorities.

Partner selects a Tier at signup and may upgrade or downgrade subject to Section 7 (Payment Policy). Each Tier includes a number of API calls per calendar month. Calls beyond the included quota are billed at the per-call overage rate published at olow.io/developers and defined canonically in our pricing source-of-truth. There is no hard cap on API usage. Partner agrees to receive overage invoices for any usage above the Tier-included quota. To protect both parties from runaway costs, olow may implement quota alerts (at 100%, 200%, and 500% of Tier-included quota) and per-key rate limits. Partner may also configure spend-cap alerts in the developer dashboard. Tier features, included quotas, overage rates, and rate limits as of Partner's signup date are documented at olow.io/developers and incorporated by reference. olow may change these with notice per Section 7(j) (Price Changes).

Partners on Scale, Pro, and Enterprise Tiers agree to an annual revenue-share true-up in addition to the monthly Tier fee and overage charges. (a) Definition of olow-Attributable Revenue. "olow-Attributable Revenue" means net revenue Partner derives in a calendar year from any product feature, subscription tier, transaction, or upgrade that materially depends on olow Verification Results or olow Badge display. Where a product offering bundles olow-dependent features with non-olow features, Partner shall allocate revenue in good faith using a reasonable, consistently applied methodology. (b) Revenue-Share Rates. - Scale Tier: 5% of olow-Attributable Revenue, annually. - Pro Tier: 5% of olow-Attributable Revenue, annually. - Enterprise Tier: 8% of olow-Attributable Revenue OR $1,000,000 USD, whichever is greater, annually. The Enterprise floor is a minimum annual payment; revenue share is computed and credited against the floor, never reductive of it. (c) Reporting and Payment. Within 30 days of each calendar-year end, Partner shall provide olow a written statement of olow-Attributable Revenue for the prior year along with the methodology used. olow will invoice the true-up amount; Partner shall pay within 30 days of invoice. (d) Audit Rights. olow reserves the right to audit Partner's books and records relating to olow-Attributable Revenue, no more than once per calendar year, upon 30 days' written notice. Audits will be conducted during normal business hours by olow or its designated independent accountant. Partner agrees to maintain books and records sufficient to support its annual revenue-share statement for at least three years following each statement. (e) Audit Costs. olow bears its own audit costs unless the audit finds an underpayment of greater than 5% of the reported amount, in which case Partner shall reimburse olow's reasonable audit costs and pay the underpaid amount with interest at 1.5% per month from the date originally due. (f) Confidentiality. Information disclosed in connection with revenue-share reporting and audit is Partner's confidential information and will be used solely for purposes of administering this Section 6.

(a) Currency and Billing Cycle. All fees are in USD. Tier fees are billed monthly in advance via Partner's stored payment method. Overage fees are billed monthly in arrears for the prior calendar month's usage. Annual revenue-share true-ups are billed per Section 6(c). (b) Auto-Renewal. Tier subscriptions automatically renew each month. Partner may cancel for the next billing cycle with at least 14 days' notice via the developer dashboard or by email to billing@olow.io. (c) Payment Method Maintenance. Partner is responsible for maintaining a valid payment method on file. Partner consents to retries on the same payment method consistent with our payment processor's standard retry schedule. (d) Failed Payment — API Access Consequences. If a payment fails: - Day 0: payment attempt fails; Partner receives email notice. - Days 1-2: payment processor retries. - Day 3: API access is throttled to Developer-tier limits (150 calls per calendar month, no overage allowed); Partner receives email notice. - Day 7: API access is suspended; all API calls return HTTP 402 Payment Required; Partner receives email notice. - Day 30: account is closed, API Keys are revoked, and any annual commitment balance becomes immediately due; Partner receives email notice. Partner may cure failed payment at any time before Day 30 to restore access without penalty. olow sends one notification email per state transition; Partner is not separately notified of each payment processor retry attempt within the same failure window. (e) Late Fees. Past-due balances accrue interest at 1.5% per month (or the maximum permitted by applicable law, whichever is lower), beginning 30 days after the original invoice date. (f) Collection Costs. If a balance is referred to collection, Partner agrees to pay reasonable collection costs and attorneys' fees incurred by olow in addition to the principal and interest. (g) Chargebacks. A chargeback initiated by Partner — successful or not — constitutes a material breach of these Terms. Upon a chargeback, olow may: (i) immediately revoke all API Keys; (ii) terminate the account; (iii) accelerate any annual commitment balance; and (iv) report the chargeback to the relevant payment networks. Partner agrees that olow may dispute the chargeback with documentary evidence of services rendered. (h) Refunds. Tier fees are non-refundable once charged. Overage fees are non-refundable once incurred. Onboarding or setup fees, where charged, are non-refundable. (i) Service Credits (Downtime). If the API is unavailable for a continuous period exceeding 24 hours within a single calendar month — as measured by olow's monitoring and excluding planned maintenance, force-majeure events, and failures caused by Partner's misuse — Partner may request a pro-rated service credit against the affected month's Tier fee. Credits do not exceed the affected month's Tier fee, are not paid as refunds, and must be requested within 30 days of the affected period. (j) Price Changes. olow may change Tier fees, included quotas, overage rates, or revenue-share rates with at least 60 days' written notice via email to Partner's billing contact. If Partner does not agree to the change, Partner may cancel before the change takes effect; continued use after the effective date constitutes acceptance. (k) Tier Upgrades and Downgrades. Tier upgrades are effective immediately; the next billing cycle is pro-rated to reflect the upgraded fee. Tier downgrades are effective at the start of the next billing cycle; no refund or credit is issued for the unused portion of the current cycle. (l) Taxes. All fees are stated exclusive of applicable taxes. Partner is responsible for all sales, use, value-added, excise, or similar taxes imposed on the services Partner consumes, excluding taxes on olow's net income. (m) Disputed Charges. Partner must raise any disputed charge in writing to billing@olow.io within 30 days of the invoice date. Raising a dispute does not pause Partner's obligation to pay undisputed amounts. Disputes raised after 30 days are deemed waived. (n) Enterprise Floor. The Enterprise Tier annual minimum of $1,000,000 USD is a true floor: it is payable in full regardless of actual API usage, and revenue-share calculations under Section 6 are credited against, but never reductive of, the floor.

The API returns Verification Results to Partner in response to authorized calls. Partner agrees: (a) to use Verification Results solely within the Application and solely for the purpose of confirming credential state at the moment of the API call; (b) to retain Verification Results no longer than reasonably necessary for the immediate purpose, and in no event longer than 30 days after the API call, unless Partner has obtained explicit End User consent for longer retention and disclosed that retention in Partner's privacy policy; (c) not to combine Verification Results with personally-identifying information about the End User except as strictly required to fulfill the End User's request; (d) to maintain a publicly accessible privacy policy that accurately describes Partner's use of the API and Verification Results; (e) to honor any End User request to delete data Partner has collected in connection with olow within 30 days of the request, and to confirm such deletion to the End User in writing; (f) not to sell, license, or otherwise transfer Verification Results or any data derived from them to any third party without our prior written consent; and (g) to comply with all applicable privacy and data-protection laws including, where applicable, the California Consumer Privacy Act, the Colorado Privacy Act, the General Data Protection Regulation, and the Health Insurance Portability and Accountability Act. Partner is solely responsible for ensuring that End Users provide informed consent for Partner's use of the API in connection with their olow credential.

(a) olow IP. olow retains all right, title, and interest in and to the API, the olow platform, the olow name and logo, documentation, and all related intellectual property. No license is granted by implication or estoppel. (b) Limited Trademark License. Partner may use the olow name and logo solely to indicate that Partner's Application integrates with the olow API, subject to any brand guidelines we publish. Partner may not use the marks in a manner suggesting endorsement, partnership, or sponsorship beyond the integration itself. (c) Required Attribution. Where the Application displays Verification Results, Partner must include reasonable attribution to olow (e.g., "Verified by olow", a small olow logo, or equivalent). Partner may not present Verification Results as Partner's own credential system. (d) Partner IP. Partner retains all right, title, and interest in and to the Application, excluding any olow IP referenced therein. (e) Feedback. If Partner provides feedback, suggestions, or improvements regarding the API, Partner grants olow a perpetual, irrevocable, royalty-free, worldwide license to use that feedback without restriction.

Each party may disclose information to the other that is marked confidential or that a reasonable person would understand to be confidential ("Confidential Information"). Each party agrees to (a) use the other party's Confidential Information solely to perform under these Terms; (b) protect such Confidential Information with at least the same degree of care it uses for its own confidential information of similar sensitivity (and never less than reasonable care); and (c) not disclose such Confidential Information to any third party except to employees, contractors, and advisors who have a need to know and are bound by equivalent confidentiality obligations. Confidential Information does not include information that: (i) is or becomes publicly available without breach of these Terms; (ii) was rightfully known prior to disclosure; (iii) is independently developed without use of the other party's Confidential Information; or (iv) is rightfully obtained from a third party without restriction. This Section 10 survives termination for three years.

olow does not commit to a contractual service level for the Developer, Starter, or Growth Tiers — the API on these tiers is provided on a commercially reasonable best-effort basis. The Section 7(i) (Service Credits) downtime mechanism applies regardless of Tier. Scale, Pro, and Enterprise Tier customers may request a written Service Level Addendum specifying uptime targets, response times, and credits. Until executed, no other service level commitment applies. Planned maintenance, force-majeure events, and failures caused by Partner's misuse, integrations, or non-compliant traffic are excluded from all service-level calculations.

(a) Term. These Terms commence when Partner first accepts them and continue until terminated as provided in this Section. (b) Termination for Convenience. Either party may terminate for any reason on 14 days' written notice. Partner's obligation to pay fees through the end of the then-current billing cycle survives termination. (c) Termination for Cause. Either party may terminate immediately on written notice if the other party (i) materially breaches these Terms and fails to cure within 14 days of notice (or, for breaches not curable, immediately); (ii) becomes insolvent, files for bankruptcy, or has a receiver appointed; or (iii) ceases to do business. (d) Suspension. olow may suspend API access immediately and without prior notice if Partner: (i) violates Section 4 (Acceptable Use); (ii) fails to pay any fee when due, subject to Section 7(d) (Failed Payment); (iii) initiates a chargeback; (iv) appears to have suffered an API Key compromise; or (v) engages in activity that olow reasonably believes endangers the security, integrity, or availability of the platform or its users. (e) Effect of Termination. Upon termination: all API Keys are revoked; Partner shall cease all use of the API; Partner shall delete Verification Results from its systems within 30 days; and any outstanding fees, including accelerated annual commitments and revenue-share true-ups, become immediately due. Sections 4 (in part), 6, 7, 8, 9, 10, 13, 14, 15, and 16 survive termination.

THE API IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY LAW, OLOW DISCLAIMS ALL WARRANTIES INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. VERIFICATION RESULTS REPORT WHAT A TESTING PARTNER REPORTED TO OLOW ON A SPECIFIC DATE FOR A DEFINED PANEL. VERIFICATION RESULTS ARE NOT A WARRANTY OR GUARANTEE THAT ANY END USER IS FREE OF ANY DISEASE OR INFECTION. PARTNER ACKNOWLEDGES AND WILL CAUSE ITS APPLICATION TO COMMUNICATE TO END USERS THE LIMITATIONS DESCRIBED IN OLOW.IO/TERMS SECTION 4 (NO WARRANTY OF DISEASE STATUS). OLOW IS NOT A HEALTHCARE PROVIDER, LABORATORY, OR CLINIC AND DOES NOT PROVIDE MEDICAL ADVICE.

TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATING TO THESE TERMS OR THE API, WHETHER BASED ON CONTRACT, TORT, OR ANY OTHER LEGAL THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EXCEPT FOR PARTNER'S PAYMENT OBLIGATIONS, EITHER PARTY'S INDEMNIFICATION OBLIGATIONS UNDER SECTION 15, AND PARTNER'S BREACH OF SECTION 4 (ACCEPTABLE USE) OR SECTION 9 (INTELLECTUAL PROPERTY), EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS PAID BY PARTNER TO OLOW IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) $10,000 USD. Some jurisdictions do not allow certain limitations of liability; in those jurisdictions, our liability is limited to the fullest extent permitted by law.

(a) By Partner. Partner shall defend, indemnify, and hold harmless olow and its officers, directors, employees, and agents from and against any third-party claim, action, or proceeding, and any resulting losses, damages, costs, and expenses (including reasonable attorneys' fees), arising out of or relating to: (i) the Application; (ii) Partner's breach of these Terms, including any violation of Section 4 (Acceptable Use); (iii) Partner's use, retention, or disclosure of Verification Results or End User data in violation of Section 8; (iv) any claim that the Application infringes a third party's intellectual property or privacy rights; or (v) Partner's violation of applicable law. (b) By olow. olow shall defend, indemnify, and hold harmless Partner against any third-party claim that the API, as provided by olow and used in accordance with these Terms, infringes a U.S. patent, copyright, or trademark of the claimant. olow has no obligation under this Section 15(b) to the extent the claim arises from (i) Partner's use of the API outside the scope of these Terms; (ii) the Application; (iii) Partner's combination of the API with software or services not provided by olow, where the API alone would not infringe; or (iv) Partner's failure to use a non-infringing version of the API made available to Partner. (c) Process. The indemnified party shall (i) promptly notify the indemnifying party in writing of the claim; (ii) give the indemnifying party sole control over the defense and any settlement, provided the settlement does not impose any non-monetary obligation on the indemnified party without consent; and (iii) reasonably cooperate at the indemnifying party's expense.

(a) Governing Law. These Terms are governed by the laws of the State of Colorado, without regard to conflict-of-laws principles. (b) Binding Arbitration. Any dispute, claim, or controversy arising out of or relating to these Terms or the API ("Dispute") shall be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. Arbitration shall be conducted in Denver, Colorado, or remotely at the arbitrator's discretion. The Federal Arbitration Act governs this Section 16. (c) Class Action Waiver. PARTNER AND OLOW EACH AGREE THAT ANY DISPUTE WILL BE RESOLVED ONLY ON AN INDIVIDUAL BASIS. NEITHER PARTY MAY BRING A CLAIM AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, REPRESENTATIVE, OR CONSOLIDATED PROCEEDING. (d) Exceptions. Either party may (i) bring an action in court to seek injunctive or equitable relief to protect its intellectual property or confidential information, or (ii) bring an action in small claims court for any dispute within that court's jurisdiction. (e) Opt-Out. Partner may opt out of this arbitration agreement by sending written notice to legal@olow.io within 30 days of first accepting these Terms. The notice must include Partner's entity name, the account identifier, and a clear statement that Partner is opting out of arbitration. Opting out does not affect any other provision. (f) Backstop Venue. If this arbitration agreement is found unenforceable for any reason, any Dispute shall be brought exclusively in the state or federal courts of Douglas County, Colorado, and the parties consent to personal jurisdiction there.

olow may update these Terms from time to time. We will notify Partner of material changes at least 30 days before they take effect by email to Partner's billing contact and by notice on olow.io/developers. Continued use of the API after the effective date constitutes acceptance. If Partner does not agree to the updated Terms, Partner must cease using the API and may terminate per Section 12(b). Changes that benefit Partner (e.g., expanded quotas, lower prices) take effect immediately without the 30-day notice.

Entire agreement: These Terms, together with the pricing published at olow.io/developers and any executed Order Form or Service Level Addendum, constitute the entire agreement between Partner and olow regarding the API and supersede any prior agreements on the same subject. Order of precedence: In any conflict between these Terms, an Order Form, and a Service Level Addendum, the Order Form and Addendum control to the extent of the conflict. Assignment: Partner may not assign these Terms without our prior written consent, except to an acquirer of all or substantially all of Partner's business or assets in connection with a merger, acquisition, or sale, provided the acquirer is not a competitor of olow and agrees in writing to be bound. olow may assign these Terms freely. Severability: If any provision is held unenforceable, the remainder of the Terms continues in full force. No waiver: No waiver of any breach is a waiver of any prior or subsequent breach. Force majeure: Neither party is liable for failure to perform to the extent the failure results from causes beyond reasonable control, including natural disasters, war, terrorism, labor disputes, cyber attacks, internet or power outages, or governmental actions. Independent contractors: The parties are independent contractors. No agency, partnership, joint venture, or employment relationship is created. Notices: Notices to olow shall be sent to legal@olow.io. Notices to Partner shall be sent to the billing contact on file. U.S. Government end users: The API is "commercial computer software" and "commercial computer software documentation" as defined in FAR 12.212 and DFARS 227.7202. Government use is subject solely to these Terms.

Legal questions: legal@olow.io API support: api@olow.io Billing: billing@olow.io Security: security@olow.io olow · 10940 South Parker Road · Parker, CO 80134