API Terms of Use

AQNOVA MARKETPLACE

Global Legal Footer Framework

Comprehensive Compliance & Platform Governance Reference

API TERMS OF USE

Terms Governing Third-Party Integrators, Developers & API Partners

Rate Limits | IP Ownership | Data Use | Security | Global Compliance

Effective Date: April 7, 2026 | Version 1.0 | Arivon Holding Corporation

These API Terms of Use ("API Terms," "this Agreement," or "these Terms") govern all access to and use of the AqNova Application Programming Interface ("API"), API documentation, software development kits (SDKs), sample code, developer tools, webhooks, and all related technical resources (collectively, the "AqNova API" or "API") made available by AqNova Marketplace, operated by Arivon Holding Corporation ("AqNova," "we," "us," "our").

These Terms apply to all Developers, third-party integrators, technology partners, enterprise API consumers, and any individual or entity ("Developer," "you," "your") that accesses or uses the AqNova API for any purpose, including building third-party applications, automating Platform operations, extracting data for analytics, integrating AqNova's marketplace functionality into external systems, or any other programmatic interaction with AqNova's Platform infrastructure.

These Terms are a supplemental agreement to the AqNova Platform Terms & Conditions (Section 2 of the Platform Governance Documents). In the event of a conflict between these API Terms and the Platform Terms & Conditions on API-specific matters, these API Terms govern. Developers who are also registered Vendors on the Platform are additionally subject to the Seller Agreement & Vendor Terms (Section 2.2).

8.1 Definitions & Scope

"AqNova API" or "API": The entirety of AqNova's application programming interface(s), including REST APIs, webhook endpoints, streaming APIs, GraphQL endpoints (where available), SDKs, sample code libraries, API documentation, developer console, and all related technical tools made available by AqNova to registered Developers.

"API Key": A unique alphanumeric credential issued to a Developer upon registration that authenticates API requests and links all API activity to the Developer's account. API Keys are confidential and must not be shared, published, or embedded in publicly accessible code.

"Developer": Any individual, company, organization, or other legal entity that has registered for an API Key and agreed to these Terms for the purpose of accessing the AqNova API.

"Developer Application" or "App": Any software application, website, mobile application, automation script, bot, data pipeline, or other tool built by a Developer that uses the AqNova API to interact with AqNova's Platform.

"End User": Any individual who uses a Developer Application that in turn accesses the AqNova API. End Users are AqNova Platform users (buyers or vendors) whose data and interactions may be accessed through the API on their behalf.

"API Endpoint": A specific URL path through which the API exposes a functionality, resource, or data object. Examples include endpoints for product catalog, order management, inventory, analytics, and vendor account data.

"Rate Limit": The maximum number of API requests a Developer may make within a defined time window, as specified in Section 8.4.

"Quota": The cumulative maximum volume of API calls, data transferred, or resources consumed within a billing period, beyond which overage charges may apply or access may be throttled.

"API Data": Any data retrieved from, submitted to, or generated through the AqNova API, including product data, order data, buyer data, vendor data, analytics data, and Platform metadata.

"Sensitive Data": Any API Data that constitutes personal information, financial data, payment card data, health information, or other categories of data subject to heightened protection under applicable law.

"Webhook": An outbound HTTP callback initiated by AqNova to a Developer's designated URL upon occurrence of specified Platform events (e.g., new order placed, payment confirmed, inventory update).

"SDK" (Software Development Kit): Client libraries, code samples, wrappers, and toolkits provided by AqNova to facilitate API integration in specific programming languages or frameworks.

"API Documentation": AqNova's technical reference materials, integration guides, changelog, and developer resources available at [developer.aqnova.co].

"Production Environment": The live AqNova Platform accessed through the production API base URL, processing real transactions and real user data.

"Sandbox Environment": AqNova's isolated test environment for developer testing, accessible through the sandbox API base URL, using synthetic test data that does not affect live Platform operations.

"Throttling": AqNova's automatic reduction of the API request rate for a Developer who is approaching or has exceeded applicable rate limits, without suspending access entirely.

8.2.1 Registration Requirements

To access the AqNova API, Developers must complete the API Developer Registration process at [developer.aqnova.co/register]. Registration requires:

A valid AqNova Platform account (buyer, vendor, or dedicated developer account) in good standing.

Full legal name or business entity name, country of establishment, and intended use case for the API.

Acceptance of these API Terms of Use and the Platform Terms & Conditions.

A valid email address for technical communications and security alerts.

For applications handling personal data of EU, UK, or other jurisdictions' users: confirmation that the Developer has a Privacy Policy that accurately describes data processing activities performed through the API.

For Production API access: submission and approval of an API Application Review (Section 8.10). Sandbox access is available immediately upon registration without Review.

8.2.2 Authentication — OAuth 2.0 & API Keys

The AqNova API uses the following authentication mechanisms, each appropriate for different integration architectures:

8.2.3 API Key Security Obligations

Developers bear sole and complete responsibility for the security of their API Keys, OAuth client credentials, and webhook secrets. The following security obligations apply to all API credentials:

API Keys and Secrets must never be embedded in client-side code, mobile application binaries, public GitHub repositories, public documentation, or any other publicly accessible location.

API Keys must be stored encrypted at rest using industry-standard key management practices (e.g., environment variables, secrets management services such as AWS Secrets Manager, HashiCorp Vault, or equivalent).

Each Developer Application or integration environment (development, staging, production) must use separate API credentials.

Developers must rotate API Keys immediately upon suspected or confirmed compromise and notify AqNova at api-security@aqnova.co within 24 hours of discovering a credential leak.

AqNova may revoke any API Key at any time where it suspects compromise, abuse, or policy violation. Revoked keys are disabled immediately; the Developer is notified by email.

Developers must maintain a current record of all API credentials issued to their organization and revoke credentials associated with departing employees or contractors within 24 hours of their departure.

8.2.4 OAuth Scope Management

When implementing OAuth 2.0 authorization flows, Developers must request only the minimum OAuth scopes necessary for their application's stated and approved functionality. Requesting scopes beyond the minimum necessary ('scope creep') is a violation of these Terms. The following table sets out the principal OAuth scopes available on the AqNova API:

8.3 API Tiers & Access Levels

The AqNova API is structured in three access tiers, each reflecting the Developer's registration status, application review status, and commercial relationship with AqNova. Rate limits, available endpoints, and data access scope vary by tier.

8.4.1 Standard Rate Limits by Tier

The following rate limits apply to all AqNova API integrations. Rate limits are applied per API Key (not per IP address) and are enforced using a sliding window algorithm unless otherwise specified.

8.4.2 Rate Limit Response Headers

Every API response includes the following rate limit headers to enable Developers to monitor their usage and implement appropriate back-off logic:

8.4.3 Rate Limit Exceeded — HTTP 429 Response

When a Developer exceeds the applicable rate limit, AqNova returns HTTP status code 429 (Too Many Requests) with the following response body structure. Developers must implement exponential back-off with jitter when handling 429 responses and must not retry requests immediately:

8.4.4 Fair Use Policy

Rate limits are designed to ensure fair and equitable access to AqNova's API infrastructure for all Developers. The following practices are prohibited under AqNova's Fair Use Policy, regardless of whether they technically remain within rate limits:

Polling patterns: Making repeated requests to the same endpoint at maximum frequency without using webhooks or caching when real-time updates are not required. Developers should use AqNova's webhook system for event-driven updates and cache responses where data does not change frequently.

Data hoarding: Systematically requesting and storing all available API data without a specific operational purpose, particularly bulk export of product catalog data, pricing data, or user data for competitive intelligence.

Parallel key abuse: Creating multiple API accounts to aggregate higher effective request volumes in circumvention of per-key rate limits.

Artificial traffic: Generating API requests from automated systems that simulate user behavior to manipulate search rankings, review systems, or recommendation algorithms.

Cascading failures: Implementing retry logic without back-off that causes request storms when the API returns errors, amplifying infrastructure pressure during incidents.

AqNova monitors API usage patterns for fair use violations. Developers found to be in violation may have their rate limits reduced, be moved to a lower API tier, or have their API access suspended pending review.

8.4.5 Quota & Overage Handling

For Tier 2 Developer accounts, daily request quotas reset at midnight UTC. When a Tier 2 Developer approaches their daily quota (>80% consumed), AqNova sends an alert to the Developer's registered email address. When 100% of the daily quota is consumed: API requests return HTTP 429 for the remainder of the day; webhook delivery continues (webhooks are not subject to the request quota); and the quota resets at midnight UTC. Developers requiring higher quotas should submit a Quota Increase Request through the developer console at [developer.aqnova.co/quota].

8.5 Permitted Uses of the AqNova API

Subject to compliance with these Terms and all applicable laws, AqNova grants Developers a limited, non-exclusive, non-sublicensable, revocable license to access and use the AqNova API for the following permitted purposes:

8.6.1 Absolute Prohibitions

The following uses of the AqNova API are strictly prohibited and constitute a material breach of these Terms, regardless of stated purpose or intent:

Building competing marketplaces: Using AqNova API data — including product listings, vendor information, pricing, or buyer data — to build, populate, or enhance a competing e-commerce marketplace or price comparison engine that competes directly with AqNova's Platform.

Data resale: Selling, licensing, sublicensing, or otherwise commercially distributing API Data (including catalog data, analytics data, vendor data, or buyer data) to third parties without AqNova's prior written consent.

Training AI/ML models: Using AqNova API Data to train, fine-tune, or validate machine learning models, large language models (LLMs), recommendation engines, or any artificial intelligence system, without AqNova's prior written consent and a separately executed AI Data License Agreement.

Scraping & systematic extraction: Using the API to systematically extract, copy, or replicate substantially all of AqNova's product catalog, pricing database, or any other proprietary database, regardless of whether individual requests comply with rate limits.

Circumventing marketplace monetization: Using the API to redirect AqNova buyers or vendors to off-platform transactions, bypassing AqNova's payment processing, commission structure, or Buyer Protection Program.

Unauthorized personal data processing: Using the API to collect, aggregate, or process personal data of AqNova users (buyers or vendors) for any purpose not expressly authorized by the data subject and not disclosed in the Developer's Privacy Policy.

Impersonation: Creating applications that impersonate AqNova, misrepresent their affiliation with AqNova, or mislead users about the source of data or functionality.

Interference with Platform operations: Using the API in a manner that interferes with, disrupts, or degrades AqNova's Platform infrastructure, including denial-of-service attacks, resource exhaustion attacks, and exploitation of API vulnerabilities.

Fraudulent activities: Using the API to facilitate fraudulent transactions, fake reviews, listing manipulation, account takeover, chargeback fraud, or any other dishonest conduct.

Sanctions evasion: Using the API to facilitate transactions with sanctioned parties or in violation of applicable export control and trade sanctions regulations.

8.6.2 Conditional Restrictions

The following uses require AqNova's prior written consent or a separately executed agreement before proceeding:

White-labeling AqNova's API or reselling API access to third parties.

Building applications that handle payment card data (PCI-DSS scope) or financial services regulated by national financial authorities in any jurisdiction.

Integrations involving health product claims, pharmaceutical products, or regulated medical devices.

Applications that use AqNova Platform data for academic research, journalism, or public interest investigations.

Any integration involving cross-border data transfers of personal data of EU/UK users to countries without an adequacy decision or applicable transfer mechanism under GDPR/UK GDPR.

8.7.1 AqNova's IP — API, Documentation & Platform

The AqNova API, all API documentation, SDKs, sample code, developer tools, endpoint architecture, data schemas, response formats, and all underlying technology are owned by or licensed to Arivon Holding Corporation and are protected by applicable intellectual property laws worldwide, including copyright, trade secret, patent, and trademark law. Nothing in these Terms transfers any ownership of AqNova's intellectual property to any Developer.

The limited license granted in these Terms (Section 8.5) is strictly confined to using the API for permitted purposes. Developers may not: (a) reverse engineer, decompile, or disassemble the AqNova API or Platform software; (b) create derivative works of the API documentation except for their own integration documentation; (c) remove or alter copyright notices, proprietary legends, or attribution in API responses, documentation, or SDKs; or (d) patent any invention that incorporates or relies upon the AqNova API or API Data.

8.7.2 SDK & Sample Code License

AqNova makes SDKs and sample code available to Developers under the terms of the Apache License 2.0 (or such other open-source license as specified in the SDK repository). The Apache 2.0 license permits: commercial use; modification; distribution; patent use; and private use — subject to the conditions of that license. AqNova's trademark ("AqNova," its logos, and the "Powered by AqNova" badge) are NOT covered by the SDK open-source license and are subject to AqNova's Trademark Policy.

8.7.3 Developer Application IP

AqNova does not claim ownership of Developer Applications. The intellectual property in a Developer Application (the application's own code, design, and functionality, excluding any AqNova IP incorporated therein) belongs to the Developer. By making a Developer Application available to End Users who are AqNova Platform users, the Developer grants AqNova a non-exclusive, worldwide, royalty-free license to reference, display, and describe the Developer Application in AqNova's developer ecosystem, marketplace integrations directory, and promotional materials, subject to the Developer's prior consent for specific marketing uses.

8.7.4 API Data Ownership

API Data retrieved through the AqNova API is owned as follows: (a) AqNova's Platform data (catalog infrastructure, proprietary database compilations, algorithmic recommendations, curated collection metadata) is owned by Arivon Holding Corporation; (b) Vendor-submitted data (product listings, images, descriptions, pricing) is owned by the respective Vendor, with a license granted to AqNova under the Platform Terms & Conditions; (c) User-generated data (reviews, preferences, order history) is subject to applicable privacy law and user consent; and (d) API output (formatted responses, aggregated analytics) reflects AqNova's proprietary data processing and is owned by AqNova.

Developers may use API Data only for the permitted purposes described in Section 8.5. Upon termination of API access, Developers must delete all API Data within 30 days, except as required for legal retention obligations.

8.7.5 "Powered by AqNova" Badge & Brand Integration

Developers who wish to display the "Powered by AqNova" badge or reference AqNova's brand in their Developer Application must comply with AqNova's Brand Guidelines available at [developer.aqnova.co/brand-guidelines]. Permitted uses include: attributing the data source as AqNova in product listings displayed within a Developer Application; displaying the "Powered by AqNova" badge to indicate API integration. Prohibited uses include: implying AqNova endorses or is affiliated with the Developer Application beyond the API integration; using AqNova's brand in a manner that could cause confusion about AqNova's products or services.

8.8.1 Developer as Independent Data Controller

Where a Developer Application collects, processes, or stores personal data of End Users obtained through the AqNova API, the Developer is an independent data controller (or equivalent under applicable law) responsible for that processing. AqNova is not responsible for the Developer's data processing activities. Developers must:

Maintain a publicly accessible Privacy Policy that accurately and completely describes all personal data collected, the purposes for processing, legal bases, retention periods, and third-party recipients (including AqNova as the API provider).

Obtain all necessary consents, authorizations, and legal bases required by applicable law before collecting or processing personal data through the API.

Implement and maintain appropriate technical and organizational security measures consistent with the sensitivity of the personal data processed.

Comply with all applicable data protection laws in the jurisdictions where they operate and where their End Users are located.

Honor End Users' data protection rights (access, correction, erasure, portability, objection) in relation to data processed through the Developer Application.

Notify affected End Users and AqNova at api-security@aqnova.co without undue delay in the event of a personal data breach involving API Data.

8.8.2 Data Protection Obligations by Jurisdiction

Developer Applications processing personal data of users in the following jurisdictions must comply with the applicable data protection law:

8.8.3 Data Minimization & Retention

Developers must implement data minimization principles in their API integrations: request only the OAuth scopes necessary for the application's stated purpose; cache API Data only as long as necessary for the immediate operational purpose; and delete or anonymize personal data obtained through the API when it is no longer required for the stated purpose. AqNova will audit Developer Applications for data minimization compliance as part of the API Application Review and periodic compliance checks.

8.8.4 Children's Data

AqNova's Platform is not directed at children under 13 (or the applicable age of digital consent in the Developer's target jurisdiction). Developer Applications must not be designed to collect personal data from children or to provide services that are primarily directed at children without AqNova's prior written approval and implementation of age-appropriate design requirements. COPPA (US), the UK Children's Code, and equivalent frameworks apply to Developer Applications that serve children.

8.9.1 Minimum Security Requirements

All Developer Applications that access the AqNova API in Production must implement the following minimum security requirements:

Transport security: All API communications must use TLS 1.2 or higher. TLS 1.0 and 1.1 are not supported. Certificate pinning is recommended for mobile applications handling Sensitive Data.

Credential storage: API Keys, OAuth client secrets, and webhook secrets must be stored using industry-standard secrets management. Hardcoding credentials in source code is prohibited.

Input validation: All data received from the AqNova API must be validated and sanitized before being processed or stored. Developers are responsible for protecting their own systems against injection attacks using AqNova-sourced data.

OAuth token storage: Access tokens obtained through OAuth flows must be stored securely (e.g., encrypted device storage; HttpOnly cookies for web applications) and must not be stored in browser localStorage, sessionStorage, or URL parameters.

Webhook verification: All incoming webhook requests from AqNova must be verified using the X-AqNova-Signature header before processing. Unverified webhooks must be rejected with HTTP 401.

Principle of least privilege: Developer Applications must request only the minimum OAuth scopes necessary. Access to End User data must be authorized by the End User through the OAuth consent flow and must not exceed the authorized scope.

Incident response: Developers must maintain an incident response capability to detect, contain, and respond to security incidents involving API credentials or API Data. AqNova must be notified at api-security@aqnova.co within 24 hours of any security incident involving AqNova API credentials or API Data.

Dependency management: Developers must keep API client libraries, SDKs, and application dependencies up to date with security patches. Use of SDKs or dependencies with known critical vulnerabilities is a material breach of these Terms.

8.9.2 Vulnerability Disclosure Policy (VDP)

AqNova maintains a responsible disclosure program for security vulnerabilities discovered in the AqNova API. If a Developer discovers a security vulnerability in the AqNova API, they must:

Report the vulnerability to AqNova's security team at security@aqnova.co with the subject line "API Security Disclosure" immediately upon discovery and before any public disclosure.

Provide sufficient information to allow AqNova to reproduce and assess the vulnerability, including: vulnerability type; affected endpoint(s); steps to reproduce; potential impact; and any proof-of-concept code.

Allow AqNova a minimum of 90 days from acknowledgment of the report to investigate, triage, and deploy a fix before any public disclosure ('coordinated disclosure').

Not exploit the vulnerability beyond what is necessary to demonstrate its existence.

Not access, modify, or exfiltrate any data that does not belong to the reporting Developer.

AqNova acknowledges valid vulnerability reports within 5 Business Days and maintains a Security Hall of Fame for credited researchers who report valid, previously unknown vulnerabilities. AqNova does not currently offer financial bounties but reserves the right to do so at its discretion.

8.9.3 Penetration Testing & Security Assessments

Developers may not conduct penetration testing, vulnerability scanning, load testing, or security assessments against AqNova's production API infrastructure without prior written authorization from AqNova. Unauthorized testing against production systems is a material violation of these Terms and may be reported to law enforcement. Authorized testing against the Sandbox environment does not require prior written authorization, provided it is limited to the Developer's own sandbox credentials and does not interfere with other Developers' sandbox environments.

8.10.1 Review Requirements

All Developer Applications seeking Production API access (Tier 2 and Tier 3) must complete an API Application Review before being granted production credentials. The review evaluates:

Application purpose and functionality: Does the application have a clear, legitimate purpose consistent with Section 8.5 (Permitted Uses)?

Data handling practices: Does the application's Privacy Policy accurately describe how End User data obtained through the API will be processed?

Security implementation: Does the application implement the minimum security requirements in Section 8.9.1?

Compliance with applicable law: Does the application comply with consumer protection, data protection, and advertising standards law in its target markets?

Brand compliance: Does the application accurately represent its relationship with AqNova and comply with AqNova's Brand Guidelines?

Sustainability alignment: Is the application's purpose consistent with AqNova's mission of sustainable commerce? Applications designed to undermine sustainability standards or facilitate greenwashing are not approved.

8.10.2 Review Process & Timeline

8.10.3 Changes to Approved Applications

Developers must notify AqNova at api-review@aqnova.co before making any material change to an approved Developer Application, including: changes to the application's core functionality; changes to the OAuth scopes requested; changes to data handling or storage practices; changes in application ownership or controlling entity; and expansion into new jurisdictions where different data protection or consumer protection laws apply. AqNova may require a revised Application Review for material changes.

8.11.1 API Version Policy

The AqNova API is versioned using URL-based versioning (e.g., /v1/, /v2/). Each major API version is maintained for a minimum of 24 months from the release date of the next major version. Minor versions and patch updates are backward-compatible and do not require Developer action. The current production API version is v1 (released April 7, 2026).

8.11.2 Deprecation Policy

AqNova will provide the following advance notice before deprecating any API endpoint, field, or major version:

Major version deprecation (e.g., v1 → v2 transition): Minimum 24 months' notice from the date the new major version is released as generally available (GA). Deprecation notices are communicated via: email to all registered Developers; in-API deprecation headers; and the AqNova API changelog at [developer.aqnova.co/changelog].

Individual endpoint or field deprecation: Minimum 6 months' notice. Deprecated endpoints include X-AqNova-Deprecated: true and X-AqNova-Sunset-Date response headers from the announcement date.

Emergency deprecation: Where AqNova must deprecate an endpoint immediately due to security vulnerabilities, legal compliance requirements, or critical infrastructure issues, AqNova will provide as much notice as practicable and will prioritize migration support for affected Developers.

8.11.3 Backward Compatibility Guarantee

Within a major API version (e.g., v1), AqNova guarantees the following backward compatibility commitments: existing API endpoints will not be removed; existing response fields will not be removed or renamed; existing HTTP status codes and error codes will not change their meaning; and OAuth scopes will not be removed. AqNova may: add new endpoints; add new optional response fields; add new optional request parameters; add new OAuth scopes; and add new webhook event types — all without advance notice, as these are additive (non-breaking) changes.

8.12.1 API Service Level Agreement

AqNova targets the following API uptime levels by tier:

8.12.2 Service Credits — Tier 2

Where AqNova fails to meet the Tier 2 monthly uptime SLA, Developers on a paid API tier may claim service credits as follows:

Service credit claims must be submitted to api-support@aqnova.co within 30 days of the end of the month in which the SLA breach occurred. Service credits are applied to future API billing; they are not refundable as cash. The maximum service credit in any single month is 100% of the monthly API fee. Service credits do not apply to downtime caused by: Developer error or misuse; force majeure events; third-party service provider outages beyond AqNova's control; or denial-of-service attacks targeting the Developer's specific API Key.

8.12.3 Incident Communication

AqNova communicates API incidents through the following channels:

Status Page: real-time incident status at [status.aqnova.co]. Developers are encouraged to subscribe to status page notifications.

Email: incident notifications to all affected Developers' registered email addresses for incidents exceeding 15 minutes.

API Response Headers: During degraded service, AqNova may include X-AqNova-Incident: true and a link to the status page in API responses.

Developer Slack / Community Forum: Incident updates posted to AqNova's developer community channel at [developer.aqnova.co/community].

8.13.1 Tier 1 Sandbox — Free

The Sandbox environment is provided free of charge to all registered Developers for testing and development purposes. No payment method is required for Sandbox access. Sandbox access does not include an SLA and is subject to these Terms and to AqNova's right to terminate or modify access at any time.

8.13.2 Tier 2 Developer — Pricing

Tier 2 Production API access is available under the following commercial models:

Included with Seller Plan: Vendors on the Premium Seller Plan and above have API access included in their seller subscription, subject to the rate limits in Section 8.4. This access covers the read:catalog, write:catalog, read:orders, write:orders, read:inventory, write:inventory, and read:analytics scopes for the Vendor's own data.

Standalone Developer Access: Developers without an associated Vendor subscription may access the Production API on a consumption-based pricing model. Pricing details are published at [developer.aqnova.co/pricing] and are subject to the fee modification policy in Section 8.15.

Overage pricing: Requests above the included daily quota are billed at overage rates published at [developer.aqnova.co/pricing].

8.13.3 Tier 3 Partner — Negotiated

Tier 3 Partner API access is governed by a separately executed API Partner Agreement. Commercial terms are negotiated based on the Partner's use case, expected request volume, data requirements, and commercial relationship with AqNova. Partner agreements may include: fixed monthly API access fees; revenue-sharing arrangements; minimum commitment periods; and custom SLA terms. Contact api-partnerships@aqnova.co for Tier 3 Partner inquiries.

8.13.4 Billing & Payment Terms

API fees are billed monthly in arrears for consumption-based pricing and in advance for fixed-fee plans. Billing currency is USD unless otherwise agreed. Failed payments result in API access suspension after 5 Business Days' notice. AqNova issues invoices electronically to the Developer's registered billing email. Tax obligations on API fees are the Developer's responsibility and vary by jurisdiction.

8.14.1 Disclaimer of Warranties

THE AQNOVA API, API DOCUMENTATION, SDKS, SAMPLE CODE, AND ALL RELATED DEVELOPER TOOLS ARE PROVIDED ON AN 'AS IS' AND 'AS AVAILABLE' BASIS WITHOUT WARRANTIES OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO: IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, OR COMPLETENESS. AQNOVA DOES NOT WARRANT THAT: (A) THE API WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE; (B) API DATA WILL BE ACCURATE, COMPLETE, OR CURRENT; (C) DEFECTS WILL BE CORRECTED; OR (D) THE API IS FREE OF VIRUSES OR MALICIOUS CODE.

These disclaimers do not apply to express SLA commitments set out in Section 8.12 or to implied warranties that cannot be excluded under mandatory consumer law in applicable jurisdictions.

8.14.2 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AQNOVA'S TOTAL AGGREGATE LIABILITY TO ANY DEVELOPER FOR ALL CLAIMS ARISING FROM OR RELATING TO THESE API TERMS, THE AQNOVA API, OR ANY DEVELOPER APPLICATION SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL API FEES PAID BY THE DEVELOPER TO AQNOVA IN THE THREE (3) CALENDAR MONTHS IMMEDIATELY PRECEDING THE CLAIM; OR (B) ONE HUNDRED UNITED STATES DOLLARS (USD $100).

IN NO EVENT SHALL AQNOVA BE LIABLE FOR ANY: INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES; LOSS OF DATA, PROFITS, REVENUE, GOODWILL, OR BUSINESS OPPORTUNITY; COST OF SUBSTITUTE SERVICES; OR SYSTEM DOWNTIME — EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND EVEN IF A LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

These limitations apply to all causes of action, whether in contract, tort (including negligence), strict liability, or otherwise. They do not apply to: (i) AqNova's liability for death or personal injury caused by AqNova's negligence; (ii) fraud or fraudulent misrepresentation; or (iii) any other liability that cannot be excluded by applicable mandatory law.

8.14.3 Developer Indemnification

Developers agree to indemnify, defend (with counsel acceptable to AqNova), and hold harmless Arivon Holding Corporation, AqNova, and their respective officers, directors, employees, contractors, and agents ("Indemnitees") from and against all third-party claims, liabilities, damages, costs, and expenses (including reasonable legal fees) arising from or relating to:

The Developer's breach of these API Terms, the Platform Terms & Conditions, or any applicable law.

The Developer Application's non-compliance with applicable data protection, consumer protection, or advertising standards law.

The Developer's collection, use, or disclosure of personal data obtained through the AqNova API.

Infringement by the Developer Application of any third-party intellectual property, privacy, or other rights.

Any security breach or credential leak attributable to the Developer's failure to maintain adequate security standards.

Any harm to End Users caused by the Developer Application's functionality, misrepresentations, or failure to disclose material information.

8.15.1 Suspension by AqNova

AqNova may suspend a Developer's API access immediately and without prior notice where:

The Developer has breached a security obligation (Section 8.9) or a credential compromise has been detected.

The API is being used in violation of the prohibited uses in Section 8.6, including suspected data harvesting, denial-of-service activity, or facilitation of fraud.

The Developer Application is causing or is at risk of causing material harm to AqNova's Platform infrastructure, other Developers, or End Users.

AqNova receives a valid court order, regulatory directive, or law enforcement request requiring suspension.

The Developer's seller account (where applicable) has been suspended.

For non-emergency policy violations, AqNova will provide the Developer with written notice of the alleged violation and a 10-Business-Day opportunity to cure before suspending production access. During a cure period, Sandbox access remains active. AqNova will notify the Developer of any suspension by email to the registered address within 24 hours of the suspension action.

8.15.2 Termination by AqNova — For Cause

AqNova may terminate a Developer's API access and these Terms for cause upon 30 days' written notice for material policy violations (unless the violation requires immediate termination per Section 8.15.1). Grounds for immediate termination without notice include: confirmed fraudulent activity; confirmed data theft; sanctions violations; child safety violations; and conduct creating criminal liability for AqNova.

8.15.3 Termination by Developer

Developers may terminate their API access at any time by: (a) deleting all API Keys through the developer console; and (b) submitting a termination notice to api-support@aqnova.co. Termination takes effect within 5 Business Days. Upon termination, the Developer must delete all API Data within 30 days and must ensure their Developer Application ceases to access the AqNova API.

8.15.4 Effects of Termination

Upon termination: (a) the license to access the API is immediately revoked; (b) all API Keys are disabled; (c) any outstanding API fees become immediately due and payable; (d) the Developer must delete all API Data within 30 days; and (e) provisions of these Terms that by their nature should survive (IP rights, liability limitations, indemnification, data deletion obligations, and dispute resolution) continue in full force and effect.

8.16 Global Regulatory Compliance

Developer Applications accessing the AqNova API must comply with all applicable laws in every jurisdiction where the application operates or where its End Users are located. The following regulatory frameworks are particularly relevant to Developer Applications building on the AqNova API globally:

8.16.1 Export Control & Sanctions Compliance

Developers must ensure that their use of the AqNova API complies with all applicable export control regulations and trade sanctions. This includes the US Export Administration Regulations (EAR), OFAC sanctions, the EU Dual-Use Regulation, and equivalent national export control frameworks. Developers must not use the AqNova API to process transactions, transfer data, or provide services to sanctioned parties, sanctioned countries, or in violation of applicable export control law.

8.16.2 Accessibility Compliance

Developer Applications that use AqNova API data to build user-facing interfaces must meet applicable accessibility standards in their target markets, including WCAG 2.1 Level AA, the EU Accessibility Act (Directive 2019/882), the ADA Title III (USA), AODA (Ontario, Canada), and equivalent national frameworks. AqNova's API does not guarantee accessibility of the data it returns; accessibility compliance of the Developer Application's UI is the Developer's sole responsibility.

8.17 Dispute Resolution & Governing Law

Disputes arising from or relating to these API Terms are subject to the dispute resolution framework set out in Section 2.14 of the Platform Terms & Conditions, which is incorporated herein by reference. The tiered process (informal negotiation → mediation → binding arbitration) applies. For EU and UK Developers, P2B Regulation requirements apply to the extent AqNova's API service qualifies as an online intermediation service for the purposes of that Developer's commercial activities.

These API Terms are governed by the laws of the State of Delaware, United States, and applicable US federal law, without regard to conflict-of-law principles, subject to mandatory consumer and vendor protection law carve-outs as described in Section 2.14.4 of the Platform T&C. For commercial API disputes between AqNova and enterprise Developer partners (Tier 3), the preferred arbitration forum is the American Arbitration Association (AAA) Commercial Rules, seat in Wilmington, Delaware, unless an alternative is specified in the API Partner Agreement.

8.18 General Provisions

Entire Agreement: These API Terms, together with the Platform T&C, applicable Seller Agreement (for Vendor-Developers), and any executed API Partner Agreement, constitute the entire agreement between AqNova and the Developer with respect to the AqNova API.

Modifications: AqNova may modify these API Terms upon 30 days' advance notice (60 days for EU/UK Developers). Continued API access after the effective date constitutes acceptance of the modified Terms.

Severability: If any provision is held invalid, it shall be modified to the minimum extent or severed, and the remainder continues in full force.

No Waiver: AqNova's failure to enforce any provision does not waive the right to enforce it in the future.

Assignment: Developers may not assign API access rights or these Terms without AqNova's prior written consent. AqNova may assign these Terms in connection with a merger, acquisition, or reorganization.

Independent Contractors: AqNova and Developers are independent contractors. These Terms do not create an employment, agency, partnership, or joint venture relationship.

Force Majeure: AqNova is not liable for API unavailability caused by circumstances beyond its reasonable control. Force majeure periods do not suspend the Developer's obligations under these Terms.

Notices: Legal notices to AqNova must be sent to legal@aqnova.com. Technical and support notices to api-support@aqnova.co. AqNova sends notices to the Developer's registered email address.

Third-Party Beneficiaries: These Terms do not create any rights for End Users as third-party beneficiaries. End Users' rights against AqNova are governed by the Platform Terms & Conditions and applicable law.

8.19 API Support & Contact Information

AqNova Marketplace | Global Legal Footer Framework | Section 8: API Terms of Use

© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.