Privacy Policy & Terms of Use

Version 2.2 | Revised September 30, 2026

Invora is a product and brand operated by Blue Giant Labs, LLC, a Wyoming limited liability company. This document covers the Invora application, websites, invoice and payment pages, payment links, QR payment flows, and related support services.

Payment allocation: For a 100-token invoice, the payer sends 99.90 tokens, the seller receives 99.25 tokens, and Invora receives a 0.65-token service fee. The payer retains the 0.10-token discount in their own Solana account. Network fees are separate.

Document structure. Part I is the Privacy Policy. Part II is the Terms of Use. Appendix A is the biometric verification notice and separate consent text. Appendix B contains merchant data processing terms that apply when Blue Giant Labs processes customer personal information on a merchant's instructions.

Effective dates. The Privacy Policy takes effect when this version is published. The revised Terms apply when validly accepted, including through a clearly disclosed acceptance action. Required notice or consent for existing users must occur before a change applies to them. Creating or receiving this PDF does not, by itself, establish a user's acceptance or biometric consent.

1. Who we are, scope, and roles

Blue Giant Labs, LLC ("Blue Giant Labs," "we," "our," or "us") operates Invora. This Privacy Policy explains how personal information is collected, used, disclosed, protected, and retained in connection with the services described above (the "Services"). It applies to merchants, their authorized users and representatives, payers, website visitors, and people who contact support. A payer does not need an Invora profile for information associated with a payment or payment-page visit to be covered.

An Invora profile is a registration or service-access record. A Solana account is an account on the Solana network identified by a public key. These are different. Public keys and related transaction details may be personal information when they can be linked to an identifiable person.

For our own registration, verification, fraud prevention, security, billing, and business operations, we determine the purposes of processing and act as a controller or business where those legal concepts apply. Where a merchant uses Invora to process customer information solely on its instructions, we act as a processor or service provider for that activity; Appendix B applies. A provider's role can differ by service and purpose.

This Policy is a privacy notice. It does not make every processing activity consent-based, waive privacy rights, or replace a separate consent required for biometrics or optional features. Regional laws apply only where their scope and other requirements are met. Availability of a download or payment link does not establish authorization to use a feature in every jurisdiction.

Contact: hello@invora.us. Mailing address: 710 Lakeway Drive Suite 200 PMB 17023642, Sunnyvale, CA 94085, USA. Wyoming address: 30 N. Gould St. Ste. R, Sheridan, WY 82801, USA.

2. Information collected and sources

We collect the categories below only as relevant to the features used. Sources include information you or a merchant provide, device and service interactions, verification and other service providers, public Solana records, and lawful public sources. We do not collect private keys or recovery phrases on Blue Giant Labs systems.

Sensitive personal information may include government identifiers, information in identity documents, account access credentials, and biometric information used for identification. Collection varies by verification flow. We use sensitive information for permitted verification, service delivery, security, and legal purposes, and obtain additional permission where law requires it. Do not send recovery phrases, private keys, or unnecessary sensitive documents to support.

3. Persona partnership and identity verification

Blue Giant Labs partners with Persona Identities, Inc. ("Persona") to collect, process, handle, and store KYC/KYB information on our behalf. Verification information is submitted through Persona's verification flow. Persona acts as our processor or service provider for those instructed activities; Blue Giant Labs remains responsible for its own decisions and applicable obligations.

Depending on the flow, Persona may handle identity documents, government identifiers, birth and contact details, business and ownership documents, selfie/liveness inputs, and fraud or screening results. Blue Giant Labs receives results and relevant metadata. Access to underlying records through Persona is limited to authorized personnel and necessary verification, compliance, fraud review, or support purposes; this Policy does not suggest that status-only access is guaranteed in every case.

Verification may be required for merchants, businesses, representatives, or particular features. Payment from an external Solana account does not by itself require the payer to register an Invora profile or complete Persona verification. Any required additional verification is disclosed in the relevant flow, subject to law.

Persona's notices provide additional information about its processing. They supplement this Policy and do not transfer all of Blue Giant Labs' privacy obligations to Persona. See withpersona.com/legal/privacy-policy.

4. Biometric verification and separate consent

Some Persona flows may compare facial geometry from an identity document and a selfie or video, or perform liveness analysis. A photograph is not automatically a biometric identifier under every law; the analysis performed and applicable law determine the classification. Blue Giant Labs does not receive or store facial-geometry templates on its own systems. Persona handles any such processing for our verification purposes.

Where consent is required, the verification screen must disclose the data, purposes, provider, and retention period and obtain an affirmative written or electronic consent before biometric processing begins. General acceptance of the Terms, installing Invora, or signing a payment is not that consent. Appendix A provides the notice and consent text.

Biometric identifiers/templates are subject to a distinct destruction schedule: deletion when the initial verification and related fraud-prevention purpose has been satisfied, or within three years of the individual's last interaction with the entity holding them, whichever occurs first, with any shorter legally required period controlling. A binding retention order is handled under applicable law. Ordinary KYC document retention periods do not extend biometric retention. Source photographs and non-biometric verification records have separate, necessary retention rules.

We do not sell, lease, trade, use for advertising, or permit use of biometric data collected for Invora verification to train general-purpose AI models. Disclosures are limited to authorized verification processors, required legal disclosures, or another disclosure supported by the required consent and law. You may contact us to withdraw consent or ask about available alternative verification. Withdrawal affects future consent-based processing and may affect access to a feature that requires verification; mandatory rights remain intact.

5. Purposes and lawful bases

We use personal information to operate the Services; administer profiles and authorized access; prepare and reconcile invoices and user-authorized payments; conduct verification and screening; investigate fraud and security incidents; provide support; maintain records; meet actual legal requirements; and improve service reliability. We do not use KYC/KYB or biometric information for unrelated advertising or profiling.

Where the GDPR or UK GDPR applies, the applicable bases are contract performance for processing necessary to provide requested Services to the individual; legitimate interests for proportionate security, fraud prevention, support, and service administration; legal obligations where a specific obligation applies; and consent for optional communications, nonessential tracking, or biometric processing where required. Legitimate interests are subject to the individual's rights and a balancing assessment. Identity verification required by our risk policy is not automatically described as a statutory obligation.

Where biometric or other special-category information requires an additional legal condition, we use the condition permitted for the specific flow, including explicit consent where appropriate, and disclose it before processing. You may withdraw consent without affecting prior lawful processing. Withholding information needed for a service or verification may prevent us from providing that feature.

6. Disclosures and service providers

- Instructed service providers: Persona for verification; hosting and storage; communications; analytics and diagnostics; Solana RPC/connectivity; and reporting or pricing integrations as relevant. Contracts require appropriate confidentiality, restricted use, and security for instructed processing. Necessary subprocessors may assist those providers.

- Merchants and transaction participants: Information necessary to issue or pay an invoice, reconcile a payment, or handle an authorized refund. We do not make a payer's Persona records generally available to merchants or other payers.

- Public network: Solana account identifiers, amounts, times, token information, transaction signatures, and any information actually included in a network transaction are public. The public network is not our processor.

- Legal, security, and professional purposes: Necessary disclosures to comply with valid legal requirements, protect rights, investigate incidents, or obtain professional advice, subject to applicable restrictions.

- Business transactions: Necessary and protected disclosures during financing, restructuring, acquisition, or a transfer of the business. A recipient remains subject to applicable privacy obligations and required notice or consent for materially different uses.

We do not sell personal information or share it for cross-context behavioral advertising under California definitions. We do not knowingly sell or share children's personal information. A service-provider label alone does not determine whether a disclosure is legally a sale or sharing; actual contractual restrictions and use control. Material changes to those practices require updated notices and legally required choices before the new practice begins.

Information about providers used for a particular processing activity, their roles, and applicable processing locations is available through the relevant feature notice or by contacting us. We remain accountable for our instructed processing as required by law.

7. Public Solana records and off-chain privacy

Solana records can be searched, copied, and analyzed by anyone. Public keys may become linked to an identity through invoices, other services, or analysis. A pseudonymous identifier or hash does not guarantee anonymity. We cannot erase or change network records already settled, or control independent third-party indexing.

Identity-verification materials are handled through Persona and are not part of the information necessary to settle an Invora payment. Do not put identity documents, recovery materials, government identifiers, personal contact details, or sensitive invoice descriptions into public transaction memos or other on-chain fields. Invoice descriptions and customer information are handled off-chain unless a feature expressly explains a public disclosure and you authorize it.

A payment link or QR code can expose the information included in its payment page to someone who possesses it. Share it only with intended recipients. Public-link access does not confer general access to a merchant's other records or authorize changes to the merchant's receiving Solana account. A merchant is responsible for appropriate customer notices and for the lawful content it enters.

8. Retention and deletion

We retain information for the minimum period reasonably necessary for its stated purpose, subject to applicable law and justified legal holds. The schedules below are limits or criteria, not an instruction to retain every record for the maximum period. Records no longer needed are deleted, redacted, or de-identified where appropriate.

A valid deletion request is evaluated record by record. Network immutability is not a blanket reason to refuse deletion of removable information held by us or our instructed providers. We coordinate necessary redaction/deletion instructions with Persona and other processors. Residual backup data is protected from ordinary use and removed through its applicable backup cycle, except where law requires a different action. A retained record is restricted to the purpose supporting the exception.

9. Your privacy rights and request process

Depending on your location and applicable coverage, rights may include access or confirmation of processing; correction; deletion; a portable copy; withdrawal of consent; objection or restriction; opt-out of sale, sharing, targeted advertising, or qualifying automated decisions; limits on certain sensitive-data uses; and appeal of a denied request. We do not deny protected rights merely because a payer lacks an Invora profile.

Send requests to hello@invora.us with the subject "Privacy Request," or use a designated in-app method if provided. State the right requested and enough information to locate the relevant records. An authorized agent may act with evidence of authority as permitted by law. Do not send a recovery phrase or private key. We use proportionate verification for requests that require it; sale/share opt-outs are not subjected to identity verification contrary to law.

We respond within applicable legal deadlines, generally 45 days for covered U.S. state access/correction/deletion requests and one month for GDPR/UK GDPR requests, with only permitted extensions and notice. Faster deadlines apply where required. We explain a denial and available appeal process unless disclosure is prohibited. Where an appeal right applies, email "Privacy Appeal" to the same contact; further review and regulator-complaint information will be provided as required.

We do not unlawfully discriminate or retaliate for exercising rights. Exceptions may apply to specific records for legitimate legal obligations, fraud prevention, rights of others, or claims. If we process customer information on a merchant's instructions, we assist the merchant in responding and may direct the request to it without avoiding our own obligations.

California residents may request applicable information about collection, disclosure, correction, deletion, and sensitive-data uses. We use sensitive information for permitted service, verification, security, and legal purposes. If a practice requires an additional limitation or opt-out mechanism, it must be provided before that practice begins. Regional mandatory rights prevail over inconsistent contractual terms.

10. Analytics, tracking signals, and communication choices

We use service analytics and diagnostics for operation and reliability, with minimization of personal information and restrictions on provider use. We do not use advertising trackers for cross-context behavioral advertising. Where local law requires consent for nonessential cookies or similar technologies, those technologies require an appropriate choice before activation.

Traditional browser Do Not Track signals do not have a uniform implementation, and we do not treat them as the same signal as Global Privacy Control. We recognize legally applicable opt-out preference signals, including Global Privacy Control, for processing to which those signals apply. Our current no-sale/no-sharing practice does not justify ignoring a signal if a future practice triggers an opt-out obligation.

You can unsubscribe from optional marketing messages through the message instructions or by contacting us. Necessary service, security, transactional, and legal communications may continue. Operating-system permissions and notification choices may be managed on your device.

11. Security and incident response

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including access restrictions, least-privilege permissions, encryption for protected data in transit and storage as appropriate, logging, and vendor security obligations. Safeguards are proportionate to data sensitivity and processing risk. No security statement guarantees immunity from compromise, and this Policy does not claim that an independent audit or certification of Invora has occurred.

Private keys and recovery phrases for self-custodial Solana accounts used through Invora are managed on the user's device; they are not collected on Blue Giant Labs systems. Device protection, backup, synchronization, and recovery depend on the relevant device settings and account software. Blue Giant Labs cannot restore private keys, reset a recovery phrase, or sign an asset transfer from your account. With valid recovery materials, you can access the same Solana accounts through another compatible account application, independently of your Invora profile, subject to network conditions and any token-issuer restrictions described in Terms section 12.

Protect your device and recovery materials, use strong device authentication, and review account permissions and transactions before signing. Our support personnel will never ask for private keys or recovery phrases or ask you to send assets to "verify" them. Report suspected compromise or vulnerabilities to hello@invora.us with the subject "Security." Include only necessary, redacted information.

We investigate security incidents, take appropriate containment and remediation steps, and notify affected people, merchants, and authorities where required, within applicable deadlines. Provider involvement does not remove our own notice or reasonable-security duties. The Terms' disclaimers and liability limits do not waive non-waivable privacy or security rights.

12. International processing of personal information

Blue Giant Labs operates in the United States, and Persona or other providers may process personal information in other locations. This section concerns cross-border disclosure of, or access to, personal information, including KYC/KYB data; it does not describe Invora control over token transfers on Solana. Different jurisdictions can have different privacy laws. Where the GDPR, UK GDPR, or another applicable law restricts an international transfer of personal information, the responsible party must put a lawful mechanism in place before that transfer, such as a relevant adequacy decision, applicable standard contractual clauses and assessments, or another legally permitted safeguard.

This notice does not claim that Blue Giant Labs is certified under a data privacy framework or that every provider has a particular certification. Information about the applicable mechanism and how to obtain a copy is available at hello@invora.us, subject to necessary protection of confidential information. Required local representative details and any additional regional disclosures are provided through the applicable regional notice where law requires them. You may complain to your competent data protection authority without first contacting us.

13. Verification decisions and human review

Persona and other verification or security systems may produce automated verification results or risk signals. Blue Giant Labs may use those results to determine eligibility or request more information. A failed check is not a guarantee that an individual committed wrongdoing. Contact us to correct relevant information or request review of an adverse service decision. Where laws grant rights concerning qualifying automated decisions, we provide the required information, review, and choices. This Policy does not authorize a prohibited solely automated decision.

14. Children

Invora profiles and merchant features are intended for adults at least 18 years old and legally able to contract. The Services are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child's information has been submitted, contact us so we can investigate and take required steps. Children's information is not authorized for collection merely because a merchant enters it into an invoice.

15. Changes to this Policy

We update this Policy when practices or applicable requirements change and identify the revision date. Material changes are communicated through an appropriate service notice, email, or website notice before they apply where law requires advance notice. A new purpose requiring consent is not activated solely because we publish a revised notice or because you continue using an unrelated feature. We do not apply a material change retroactively to justify a previously unlawful use.

16. Contact and accessibility

For privacy, accessibility, verification, or security requests, contact hello@invora.us. Use the relevant subject line described above. Blue Giant Labs, LLC; mailing address: 710 Lakeway Drive Suite 200 PMB 17023642, Sunnyvale, CA 94085, USA; Wyoming address: 30 N. Gould St. Ste. R, Sheridan, WY 82801, USA. We provide an accessible alternative to this notice on request.

1. Contracting party, Services, and user roles

These Terms are between you and Blue Giant Labs, LLC, a Wyoming limited liability company. "Invora" is its product and brand, not a separate contracting entity. "Services" means the Invora application, websites, merchant/profile features, invoices, payment links, QR and payment pages, reporting features, and related support provided by Blue Giant Labs.

A "merchant" or "seller" issues an invoice or receives a payment. A "payer" pays an invoice, including from a compatible external Solana account application. A "business user" includes a merchant's authorized administrator or representative. An Invora profile and a Solana account are distinct. Supported networks, stablecoins, and optional features are identified in the relevant interface; this document does not promise support for every token or protocol.

If acting for a business, you represent that you have authority to bind it, and "you" includes that business. The business is responsible for its authorized users' access and instructions. No founder, officer, or employee becomes a personal guarantor merely because the business provides the Services.

2. Acceptance, incorporated terms, and changes

You accept these Terms through an affirmative action that clearly states acceptance, such as selecting an agreement checkbox or button displayed with a conspicuous link to these Terms. A payment authorization may also constitute acceptance only where the payment flow clearly discloses that legal effect before authorization. Merely scanning a QR code, receiving an invoice, or owning a Solana account does not, by itself, establish acceptance.

The Privacy Policy supplies notices, and Appendix B is incorporated for merchant processing within its scope. Appendix A requires separate biometric consent. Additional feature terms apply only when disclosed and validly accepted; mandatory law prevails. A record of the accepted version, time, user or profile identifier, and acceptance action may be retained under the Privacy Policy. For matters outside a valid acceptance, statutory rights and other applicable legal obligations still govern.

Material changes to these Terms, fees, or arbitration require appropriate prospective notice and valid acceptance where necessary. For existing users, we ordinarily give at least 30 days' advance notice of material changes, except where an earlier change is necessary for law or urgent security and legally permitted. Material arbitration changes require fresh affirmative acceptance where required and do not reopen a previously rejected arbitration agreement without agreement. Changes do not alter completed payment allocations or accrued rights. If you decline a change, you may stop using the affected feature and request available records subject to law and security.

3. Eligibility, lawful availability, and sanctions

You must be at least 18 and have legal capacity to contract. You must be authorized to use a business profile and the Solana accounts you connect. Use is permitted only where the relevant feature may lawfully be provided and used. We may limit availability by location, feature, verification status, or legal requirement; a globally accessible website does not override those limits.

You must not use the Services for prohibited sanctions dealings, evasion, or other unlawful activity, and must provide accurate eligibility information. We may use appropriate verification and screening and restrict access to Invora Services when legally necessary. Such a restriction does not freeze or close an independently controlled Solana account. User representations do not replace Blue Giant Labs' own applicable sanctions, licensing, or other legal duties. Applicable law and relevant authorizations determine those duties; a non-custodial description does not, by itself, determine a regulatory exemption.

4. Solana accounts, signing, and recovery

Invora supports user-authorized transactions involving self-custodial Solana accounts. You control the relevant private keys and recovery materials. Blue Giant Labs does not receive or hold them on its systems, cannot restore them for you, and does not hold customer assets for safekeeping. Using Invora does not grant Blue Giant Labs signing authority, a token-transfer delegation, or freeze authority over your Solana accounts. Invora or another compatible Solana account application prepares transaction instructions for your review. You authorize a transfer from your account by signing with the required authority. Invora may submit the signed transaction through network connectivity providers. Solana validators validate and execute transactions under the network and applicable program rules; the blockchain does not create or supply your authorization. Preparing or relaying instructions does not give Blue Giant Labs authority to sign for you, change a validly signed message, or independently move your assets.

You must inspect the recipient Solana account, supported token, network, amount, service fee, discount, and any other instructions before signing. Do not sign an unexplained request or rely on a display name alone. Account software may have different backup, recovery, or delegation features; you must understand the controls you enable. A lost device may be replaceable if you retain valid recovery materials. Loss of all access and recovery materials may cause irreversible loss of assets.

Use strong device authentication and protect recovery materials from disclosure, copying, and unauthorized access. Blue Giant Labs support will never request them. Notify us promptly of unauthorized Invora-profile access; contacting us does not itself cancel a signed transaction or revoke a network permission. We can restrict access to our own Services, but cannot freeze, seize, close, or independently transfer assets from your self-custodial Solana accounts, or reverse a finalized transfer.

Your Solana accounts exist independently of an Invora profile. With valid recovery materials and compatible account software, you can access the same accounts without Invora, including after profile suspension, closure, or service discontinuation. Separate token-issuer controls, third-party permissions you grant, and network or program conditions may limit what assets can be transferred. Changing account software does not remove those limitations. See sections 12 and 17.

5. Profiles, permissions, and KYC/KYB

Keep registration, business, and ownership information accurate and current. Use only permissions granted to you and promptly remove former representatives' access. Merchants are responsible for the authority of people issuing invoices or refund instructions through their profiles, without excluding liability that Blue Giant Labs cannot lawfully disclaim.

Blue Giant Labs partners with Persona to process, handle, and store KYC/KYB data as described in the Privacy Policy. We may require verification for merchant access, a particular feature, legal compliance, or legitimate risk controls. Required steps and notices are shown in the relevant flow. Where biometric processing is used, the separate notice and required consent must precede it. General agreement to these Terms is not a blanket biometric consent.

We may request corrections or additional information, deny an Invora registration, or suspend an Invora feature when necessary, subject to mandatory notice, review, and privacy rights. These actions concern access to our Services and do not freeze the user's independently controlled Solana accounts. Contact us to seek correction or review. A payer using an external Solana account need not create an Invora profile solely to make a supported payment; any additional requirement must be disclosed and lawful.

6. Invoices and payment authorization

A merchant is responsible for lawful goods/services, accurate invoice descriptions, receiving Solana accounts, tax and tip settings, required customer disclosures, and having a lawful basis to process customer information. Do not include unnecessary sensitive information in an invoice or public memo. Blue Giant Labs supplies software and is not the seller of the underlying goods/services unless separately and expressly identified as such.

An invoice, QR code, or link is a request for a transaction, not proof of a completed payment, merchant endorsement, or guaranteed refund. Review the actual transaction instructions in your account application. A request may expire, be cancelled, or require a fresh authorization; an expired or cancelled request is not authority for a new payment. A locally displayed signature or an initial submission is not, by itself, proof of successful settlement.

Disabling an Invora invoice, payment link, or payment feature affects that Service. It does not reverse an already finalized transfer, cancel a signed transaction already broadcast to the network, or block independent use of the same Solana accounts through other compatible account applications. An independent transfer may require separate merchant reconciliation and does not automatically satisfy an Invora invoice. Payment status depends on the relevant network result and the confirmation level shown by the Services. Wait for the appropriate successful status before treating an invoice as paid or retrying a pending payment. Separate authorizations or direct transfers can create duplicate or misdirected payments; they are not automatically reversed. Contact the seller and support with the transaction signature when reconciliation is needed.

7. Payment fees and payer discount

For an invoice total T denominated in a supported token, including any tax and tip within that invoice total, the standard allocation is:

Formulas: D = 0.0010 x T; A = T - D = 0.9990 x T;

F = 0.0065 x T; S = A - F = 0.9925 x T. Conservation: A = S + F, and T = D + S + F.

The 0.10% discount is a reduction in the amount the payer sends. The payer retains it in their own Solana account; there is no separate discount transfer or promotional credit. The service fee is calculated on T, not on the reduced payer payment. The seller accepts the allocation when issuing an invoice under these Terms. Merchant pricing, tax treatment, and disclosure obligations remain subject to applicable law.

Precision. Calculations use the token's native integer base units. If the invoice is N base units, the discount is floor(N x 10 / 10,000), the fee is floor(N x 65 / 10,000), the payer sends N minus the discount, and the seller receives that payment minus the fee. Fractional base units are rounded down for the discount and fee; the resulting allocation always reconciles exactly. Display rounding does not change the authorized base-unit amounts. Applicable minimums and the exact amounts must be shown before signing.

Network costs. SOL network fees, priority fees, or account-creation costs are separate. The transaction identifies the account paying those costs; the payer generally needs sufficient SOL unless a disclosed sponsor pays them. A seller's 99.25% allocation is not automatically reduced by the payer's separate network costs. A disclosed cost actually borne by the seller is separate from this allocation. Network costs may apply to failed transactions.

When earned. The Invora payment service fee is earned on successful settlement of the corresponding payment, not merely when an unsigned request is generated or a transaction is submitted. Except where law requires otherwise or we expressly agree, the fee for a successfully settled original payment is not returned because the seller later issues a refund. An unsuccessful payment does not earn the standard settlement fee; any other separately authorized service charge must be disclosed in advance.

Changes. Prospective changes to rates, eligibility, or the discount require the notice and acceptance rules in section 2 and display of the actual allocation before signing. They do not change completed transactions. Any separately offered subscription or optional-service fee must be disclosed before purchase and is not implied by the allocation above.

8. Refunds, mistakes, and merchant disputes

Blue Giant Labs cannot reverse a finalized Solana transfer. A refund is a new transfer from a Solana account the seller controls, requiring the seller's valid signing authorization. We may provide software to prepare or relay that transfer, but do not hold authority to sign it for the seller, compel a transfer from the seller's account, or guarantee recovery. Mandatory consumer remedies and Blue Giant Labs' own legal obligations, including any refund it must fund from its own assets, remain unaffected.

A "full refund" of a payment ordinarily means returning the amount actually paid, not the undiscounted invoice total, unless law or the seller's disclosed policy requires more. For a 100-token invoice under section 7, the payer paid 99.90 tokens. A seller returning all 99.90 may need to contribute 0.65 in addition to its original 99.25 proceeds if Invora's earned original fee is not returned. The payer's retained 0.10 discount is not an additional amount to be refunded by default.

The seller determines and funds full or partial refunds, including lawful tax and tip adjustments, subject to its advertised policy and mandatory law. A seller may choose to reimburse an amount corresponding to the original Invora fee from its own assets; that is different from Blue Giant Labs returning its fee. We return or reimburse our own fees where law requires it or we expressly agree.

Before signing, the seller must verify the refund request, amount, and intended receiving Solana account through a trusted process. Do not rely on a new account identifier supplied in an unverified support message; the original sending account also may not be an appropriate refund destination in every external service. Refund network costs are separate. Any additional Invora refund-service charge must be disclosed and authorized before signing; a refund is not automatically charged as a new invoice payment.

Payers should contact the seller about delivery, quality, pricing, or refund disputes and may contact Invora about its own service errors. Reporting a suspected issue does not itself stop settlement. You retain claims and reporting rights that applicable law makes non-waivable.

9. Taxes and records

You are responsible for your own tax obligations. Merchants must correctly configure taxes and tips, determine whether a discount changes the taxable base, issue required records, and collect/report/remit applicable amounts. A percentage split is not tax advice. The invoice total and the actual payment must both be reflected accurately where required. Keep independent records suitable for your obligations; public network records may not contain all required invoice or customer information.

10. Optional swaps and reporting features

When offered, swaps use supported third-party protocols or smart contracts with your authorization. Review input/output tokens, quotes, price impact, slippage limits, minimum output, permissions, expiration, routing, and all disclosed fees before signing. A displayed quote may change or expire; liquidity, price, and successful execution are not guaranteed. An account permission can create risk beyond a single transfer, and you should review and revoke unnecessary permissions through appropriate account tools.

Gain/loss, fiscal, and other reports are informational estimates based on available data and your inputs. They may be incomplete because of missing transactions, pricing gaps, tax-rule differences, token classification, or software errors. They are not investment, legal, accounting, or tax advice and do not replace independently verified records or professional review. We do not guarantee any tax outcome. Disclaimers and liability limits apply subject to section 19 and mandatory law.

11. Integration rebates, MEV, and optional promotions

Some transaction-routing integrations may pay a specific backrun or other integration rebate to a recipient designated by Blue Giant Labs. Where disclosed for the relevant integration before use, that integration rebate is service revenue retained by Blue Giant Labs. Routing incentives can present conflicts of interest and may affect execution economics; review the disclosed route, quote, and costs before signing. Receipt of such revenue does not guarantee favorable execution or immunity from front-running or other maximum extractable value (MEV) risks.

This provision assigns only the disclosed integration rebate payable to Blue Giant Labs. It does not claim every reward, discount, airdrop, or other entitlement associated with your Solana account, and does not remove the payer discount in section 7. Any optional loyalty, promotional, or token benefit requires separate disclosed eligibility and feature terms. Future benefits, token prices, returns, or liquidity are not promised merely by using Invora. Changes do not unlawfully remove accrued entitlements or authorize confiscation of assets in your account.

12. Third-party providers and network/asset risks

Solana connectivity, Persona verification, token issuers, external account applications, hosting, pricing feeds, swap protocols, and other integrations have their own roles and terms. We do not endorse every provider or guarantee its performance. Their involvement does not excuse our own contractual or non-waivable duties.

Risks include compromised devices or keys; phishing; incorrect recipients, networks, or token identifiers; public-data linkage; delays or failed transactions; forks; third-party program or oracle defects; third-party permissions or upgrade changes; congestion; slippage; MEV; and provider insolvency or outage. Stablecoins can lose their intended value, face reserve problems, or become subject to transfer or redemption restrictions. Self-custody and public network access do not remove those risks. USDC and EURC issuer authority. USDC and EURC are issued by Circle entities under their applicable issuer terms. Circle retains separate issuer controls that can block transfers of its tokens, including by using the mint's freeze authority over relevant Solana token accounts in accordance with its policy and applicable law. A frozen token account can retain a visible balance while receiving, transferring, or burning the affected tokens is restricted. The freeze does not itself transfer control of your private keys or freeze every other asset in your Solana accounts. Access through another account application does not bypass it. Issuer restrictions may also affect redemption rights. Freezing or unfreezing a token account changes its permitted future use; it does not, by itself, reverse a previously finalized Solana transfer or rewrite blockchain history. Blue Giant Labs is not the issuer of USDC or EURC, does not hold their mint freeze authority, cannot override an issuer restriction, and does not promise direct redemption, issuer unfreezing, asset recovery, or deposit insurance. Other supported tokens may have different issuer or program controls. Applicable issuer information is available at circle.com/legal/usdc-terms and circle.com/legal/eurc-terms.

Understanding these risks does not waive liability that law prohibits excluding. Invora does not provide a guaranteed investment return or an assurance that an asset is suitable for you.

13. User content, privacy, and intellectual property

You retain ownership of the lawful content you provide. You grant Blue Giant Labs a limited license to host, process, display to authorized recipients, and transmit that content only as reasonably necessary to provide, secure, support, and lawfully administer the Services. This license does not permit unrelated advertising use or ownership of your customer data and ends when those purposes and lawful retention needs end.

You must have the authority and lawful basis to provide customer, employee, representative, and beneficial-owner information and give required notices. Where we process customer data on your instructions, Appendix B applies. We remain responsible for our own controller activities and processor obligations; your responsibilities do not transfer all privacy duties to you.

Blue Giant Labs and its licensors retain the application, branding, software, and service intellectual property. Subject to these Terms, we grant a limited, nonexclusive, nontransferable license to use the Services for lawful personal or business purposes on supported devices. Open-source components remain subject to their own licenses, and mandatory interoperability or other legal rights are preserved. You may provide voluntary feedback for us to use without owing compensation; do not include confidential third-party information in feedback.

14. Prohibited conduct

You may not use the Services for unlawful goods, fraud, money laundering, terrorist financing, sanctions evasion, or other unlawful activity; submit false verification information; misuse another person's Solana account or Invora credentials; interfere with access controls; exploit programs to take assets; introduce malware; infringe rights; publish unauthorized personal information; or scrape, spam, or overload the Services. Restrictions on analysis, interoperability, or reverse engineering apply only to the extent lawful and are subject to the research permission in section 15.

15. Good-faith security reporting and permitted research

Report suspected vulnerabilities to hello@invora.us with the subject "Security." Give a concise description and safely redacted evidence. Do not include recovery phrases, private keys, identity documents belonging to others, or unnecessary personal information. You must promptly stop if a test exposes other people's information or risks affecting assets or availability.

We permit good-faith, non-disruptive analysis and testing confined to your own accounts, devices, and data through normally available interfaces. Do not access another person's records, bypass verification to gain service access, manipulate real user payments, exploit production programs to move assets, persist access, overwhelm infrastructure, or test third-party systems without their permission. Broader or more intrusive testing requires written authorization describing the scope.

Blue Giant Labs will not pursue a claim under these Terms solely because you conduct research within this permission and report it responsibly. This permission does not bind other parties or authorize unlawful acts, and it does not promise a reward. A separate written program may provide additional scope or reward terms. A good-faith report does not require giving up a legal right or claim.

16. Updates, beta features, and service availability

We may maintain, update, or change software and offer clearly identified beta features. Beta functionality may be less reliable and may change or end. We provide appropriate notice where practicable and legally required, especially for material fee or contractual changes. No clause permits avoiding a prepaid-service obligation, mandatory remedy, privacy duty, or required refund through an unannounced change.

Maintain independent recovery materials and legally necessary records. Service unavailability may affect Invora interfaces or invoice processing even where you retain independent access to the same Solana accounts through compatible account software. Emergency restrictions on Invora Services may be needed to address security incidents or legal requirements; they do not confer authority over assets in your self-custodial accounts.

17. Suspension, termination, and consequences

We may restrict or end access to Invora profiles, interfaces, invoice features, or other Invora Services for a material breach, failed required verification, suspected unlawful activity, significant security risk, or a legal requirement. Where lawful and appropriate, we give notice, explain available remediation or review, and allow a reasonable opportunity to resolve a remediable issue. We may act immediately where necessary to prevent harm or comply with law. These actions restrict our Services; they do not freeze or close your Solana accounts or their balances.

You may stop using the Services and request Invora profile closure through support or a designated in-app method. Closing an Invora profile does not close a Solana account, delete its public records, confiscate its tokens, or prevent you from accessing the same accounts through another compatible account application using valid recovery materials. Independent access remains subject to the network, applicable programs, token-issuer restrictions, and any third-party permissions you have granted. Closure does not revoke those permissions or remove an issuer freeze. Preserve your recovery materials before uninstalling or losing access to an application; Blue Giant Labs cannot restore them. We handle personal information under the Privacy Policy and preserve legally required access, deletion, and record-export rights. Profile closure does not erase all off-chain records automatically or remove a justified retention obligation. Earned fees, valid accrued obligations, confidentiality, necessary content-license retention, intellectual property, applicable liability limits, and an enforceable dispute agreement survive only to the extent appropriate and lawful.

18. Service warranties and disclaimers

TO THE EXTENT PERMITTED BY LAW, THE SERVICES AND OPTIONAL REPORTS ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, OR NON-INFRINGEMENT. WE DO NOT GUARANTEE UNINTERRUPTED AVAILABILITY, ERROR-FREE RESULTS, TRANSACTION FINALITY AT A PARTICULAR TIME, OR THE PERFORMANCE OF INDEPENDENT NETWORKS OR PROVIDERS.

We do not guarantee that any system is immune from security incidents. This does not negate reasonable-security obligations, specific express commitments, or mandatory rights. Consumer guarantees and remedies that cannot lawfully be excluded remain available. No statement in these Terms is investment, legal, or tax advice.

19. Liability limits and preserved rights

TO THE EXTENT PERMITTED BY LAW, BLUE GIANT LABS AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS (THE "PROTECTED PARTIES") ARE NOT LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR INDIRECT LOSS OF PROFITS, GOODWILL, OR DATA, ARISING FROM THE SERVICES, EVEN IF ADVISED OF THEIR POSSIBILITY.

TO THE EXTENT PERMITTED BY LAW, THE PROTECTED PARTIES' COMBINED AGGREGATE LIABILITY FOR CLAIMS ARISING FROM THE SERVICES WILL NOT EXCEED THE GREATER OF US$100 OR THE INVORA SERVICE FEES YOU PAID TO BLUE GIANT LABS FOR THE SERVICES DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. TOKEN SERVICE FEES ARE VALUED IN U.S. DOLLARS USING A REASONABLE CONTEMPORANEOUS RATE. THE INVOICE PRINCIPAL PAID TO A SELLER AND THIRD-PARTY NETWORK COSTS ARE NOT INVORA SERVICE FEES.

Mandatory exceptions. Nothing in these Terms excludes or limits liability for fraud, willful misconduct, gross negligence, personal injury, statutory privacy/security liability, or another matter to the extent applicable law prohibits the exclusion or limitation. Nothing waives a non-waivable consumer guarantee, remedy, reporting right, or right to public injunctive relief. If a limitation is unenforceable for a claim, it does not apply to that claim. Risk disclosures do not excuse Blue Giant Labs from its own non-waivable duties.

20. Merchant and business-user indemnification

To the extent lawful, a merchant or business user will defend and indemnify the Protected Parties against third-party claims and reasonable resulting losses or expenses to the extent caused by that business' unlawful goods/services, unauthorized or unlawful customer-data submissions, infringing content, fraud, or material breach of these Terms. This obligation does not arise merely because someone uses Invora, and excludes the portion caused by a Protected Party's own breach, negligence, willful misconduct, or other conduct for which indemnification is prohibited. An individual payer using the Services for personal purposes is not subject to this business indemnity.

The Protected Party must give reasonably prompt notice, allow the indemnifying business to control a competent defense, and cooperate reasonably at the business' expense. Delay relieves the obligation only to the extent it materially prejudices the defense. No settlement may admit a Protected Party's fault, impose an obligation on it, or fail to release it without its written consent, not unreasonably withheld. The Protected Party may participate with its own counsel at its own expense unless a conflict or applicable law requires otherwise.

21. Governing law and mandatory local protections

Wyoming law governs these Terms without its conflict-of-law rules, except that the Federal Arbitration Act governs the arbitration agreement to the extent applicable. This choice does not deprive a consumer or other person of mandatory protections of the law that would otherwise apply, including applicable California and regional privacy/security or consumer rules.

For a dispute properly proceeding in court rather than arbitration, the parties consent to courts with appropriate jurisdiction in Los Angeles County, California, except for small claims or a mandatory right to another forum. No advance court jury waiver is imposed independently of a valid arbitration agreement. A valid agreement to arbitrate ordinarily means the covered claim is heard by an arbitrator rather than a jury.

22. Individual arbitration, exceptions, and 30-day opt-out

22.1 Scope and applicable rules

Except for the exceptions below, you and Blue Giant Labs agree to resolve disputes arising from these Terms or the Services by binding arbitration before one neutral arbitrator administered by the American Arbitration Association (AAA). This provision applies only after valid acceptance of the arbitration agreement. The arbitrator may award relief available under applicable law, subject to lawful limits.

AAA Consumer Arbitration Rules apply to a qualifying personal, family, or household dispute, including where AAA's rules require them. AAA Commercial Arbitration Rules apply to an eligible business dispute. Applicable rules and fee schedules are available at adr.org/rules-forms-and-fees/, or from us on request. Mandatory law and AAA's consumer due-process requirements prevail over inconsistent procedural terms.

22.2 Optional informal resolution

Either party may propose good-faith informal resolution by emailing hello@invora.us with the subject "Dispute Notice" and identifying the issue and requested remedy. This is encouraged but is not a prerequisite to filing, seeking emergency relief, or protecting a deadline. Do not disclose private keys or recovery phrases in a notice.

22.3 Fees, location, and participation

For a consumer case, your filing cost does not exceed the applicable AAA consumer cap or a lower limit required by law. Blue Giant Labs pays the remaining required administrative fees and arbitrator compensation under those rules. Available hardship waivers apply. We will not shift our required consumer arbitration fees to you contrary to law. Business-case costs follow the applicable AAA rules and any lawful allocation in the award.

Hearings may occur remotely by agreement or as AAA permits. For a consumer in-person hearing, the location is reasonably convenient to the consumer and consistent with applicable law and AAA rules. The default legal seat is Los Angeles County, California, unless mandatory law or AAA requirements provide otherwise. Each party can present claims and evidence and receive a reasoned award where required. A competent court may enter judgment on the award.

22.4 Exceptions and preserved remedies

Either party may bring an eligible individual small-claims case. Either party may request lawful temporary or provisional court relief to preserve the status quo, prevent immediate harm, or protect confidential information or intellectual property, without surrendering the remainder of an enforceable arbitration agreement. Claims that law prohibits arbitrating remain outside this agreement. You may communicate with regulators or law enforcement and exercise other non-waivable reporting rights.

Nothing prohibits requesting or obtaining public injunctive relief available under applicable law. If such a claim must proceed in court, it may do so; this agreement does not waive it in every forum or limit its lawful public scope. Individual-proceeding requirements do not restrict the relief merely because it benefits other people.

22.5 Individual proceedings

To the extent lawful, arbitration proceeds in each party's individual capacity, not as a class or collective action. A class or representative procedure may be used only when legally required or the parties agree. This does not eliminate mandatory substantive remedies, public injunctive relief, or applicable AAA procedures for administering multiple individual demands. No separate court jury waiver applies to a claim outside a valid arbitration obligation.

22.6 Opt-out

You may opt out of this arbitration agreement and its class/collective-procedure waiver by emailing hello@invora.us with the subject "Arbitration Opt-Out" within 30 days after your first valid acceptance of this agreement, or after accepting a material amendment where a new opt-out period is required. Include your name, relevant Invora profile or contact identifier, and a clear statement that you opt out. No private key, recovery phrase, government ID, or explanation is required. A timely opt-out does not affect the rest of the Terms or deny service merely because you opted out. Blue Giant Labs is also not bound to arbitrate disputes with a person who validly opts out.

22.7 Administration failure and severability

Blue Giant Labs will submit its consumer clause for AAA review/registration as required and pay its required fees on time. If AAA cannot or will not administer a claim, the parties may agree to an appropriate substitute. If no suitable administrator is agreed within 30 days of notice, the affected claim may proceed in a competent court, subject to mandatory law; a party's nonpayment does not require the other party to wait out that period before exercising available remedies.

If a provision is unenforceable for a particular claim, sever it where lawful and allow that claim or remedy to proceed in the legally appropriate forum. Other enforceable provisions remain in effect. Class arbitration is not created by severing a waiver unless required by law or expressly agreed. Courts determine whether a valid arbitration agreement was formed and any question reserved to courts by law; other issues follow applicable AAA rules and law.

23. Apple App Store terms

For an iOS application obtained through Apple, the license is limited to Apple-branded products you own or control as permitted by the App Store usage rules, including eligible family or volume-purchase use. The agreement is between you and Blue Giant Labs, not Apple. Blue Giant Labs is responsible for the application and applicable support, warranties, product claims, legal compliance claims, and intellectual-property claims, subject to these Terms and mandatory law.

Apple has no obligation to provide maintenance or support. If the application fails to conform to an applicable warranty, you may notify Apple, which may refund the purchase price, if any, as required under its terms; Apple has no further warranty responsibility to the extent lawful. You must comply with applicable third-party terms and export restrictions. Apple and its subsidiaries are third-party beneficiaries of the application-license provisions and may enforce them as permitted by Apple's requirements. Mandatory law and Apple usage rules prevail where required.

24. Notices and electronic communications

We may send ordinary service and legal notices through the Services, your designated email, or another method permitted by law. Keep your contact information current. Notice methods must meet any applicable requirement for consent, prominence, timing, or delivery. A published notice does not prove that you consented to a change requiring affirmative acceptance. You may request a copy of the current Terms or a record of your accepted version at hello@invora.us.

25. Assignment, no waiver, and severability

You may not assign these Terms without our written consent, except where mandatory law permits. Blue Giant Labs may assign them with a genuine business transfer or restructuring, subject to applicable notices and rights; assignment does not eliminate accrued obligations or privacy safeguards. No assignment increases an individual's non-waivable burdens without required consent.

A failure to enforce a provision is not a waiver of a later breach. A waiver must be specific and given by an authorized representative. If a provision is invalid, the lawful remainder continues unless the essential bargain cannot lawfully remain or section 22 requires a different result. Mandatory law is not displaced by a general severability clause.

26. Events outside reasonable control

Neither party is liable for a delay caused by an event beyond its reasonable control to the extent performance is genuinely prevented, including a major network outage or natural disaster, provided it takes reasonable mitigation steps. This does not excuse fees already owed, a duty to refund where required, privacy/security obligations, or a failure caused by that party's inadequate safeguards. The affected party provides legally required notice and resumes performance when reasonably possible.

27. Entire agreement and survival

These Terms and validly incorporated feature or processing terms form the agreement for their subject matter and replace inconsistent prior terms only when the replacement is validly accepted. An individually signed agreement controls any stated conflict within its scope. The Privacy Policy provides disclosures and is not a waiver of privacy rights. Headings aid navigation. No clause excludes liability for a fraudulent statement or removes a mandatory remedy. Provisions survive termination only as stated in section 17 or as required by their lawful purpose.

28. Contact

Blue Giant Labs, LLC. Email: hello@invora.us. Mailing address: 710 Lakeway Drive Suite 200 PMB 17023642, Sunnyvale, CA 94085, USA. Wyoming address: 30 N. Gould St. Ste. R, Sheridan, WY 82801, USA. Use "Privacy Request," "Security," "Dispute Notice," or "Arbitration Opt-Out" as appropriate so your request can be routed correctly.

A1. Who requests and performs verification

Blue Giant Labs, LLC requests verification for the disclosed Invora feature. Persona Identities, Inc. performs biometric processing on its behalf. This notice must be presented with the relevant consent before the biometric step. It supplements the Privacy Policy; it does not rely on acceptance of the Terms as consent.

A2. Data and purpose

The selected flow may use identity-document images and your selfie/video to perform liveness analysis and create or compare facial-geometry scans or templates. The purpose is to confirm that the document and person match, detect impersonation or fraud, and make a verification decision for the requested service. Blue Giant Labs receives the result and relevant metadata; it does not receive or store the facial-geometry templates on its own systems. The notice shown for the flow must identify any materially different data or purpose before collection.

A3. Retention and permanent destruction

Covered biometric identifiers/templates are destroyed when the initial verification and related fraud-prevention purpose is satisfied, or within three years of your last interaction with the entity holding them, whichever occurs first. A shorter applicable legal deadline controls. A binding preservation order is handled as applicable law directs. Non-biometric source documents and verification-result records have distinct retention rules in Privacy Policy section 8; their retention does not authorize longer retention of biometric identifiers/templates.

A4. Storage, disclosures, and restrictions

Persona handles storage and processing under the applicable verification instructions and safeguards. Processing may involve authorized infrastructure subprocessors, with applicable confidentiality, security, and transfer safeguards. Covered biometric data is not sold, leased, traded, used for advertising, or used to train general-purpose AI models. A disclosure outside permitted processors requires the applicable consent or legal basis. Read Persona's additional notice at withpersona.com/legal/privacy-policy.

A5. Choice, withdrawal, and contact

You may decline the biometric method before it starts. Processing that requires consent will not begin unless you give the required separate affirmative consent. Contact hello@invora.us to ask about a non-biometric alternative or to withdraw consent for future consent-based processing. Alternatives are provided where required by law; a feature may otherwise be unavailable if its verification cannot be completed. Withdrawal does not make earlier lawful processing unlawful, and legally required retention is handled under the specific applicable rule.

A6. Separate affirmative consent text

"I have read the biometric verification notice. I expressly authorize Persona, acting for Blue Giant Labs, LLC, to collect and process the biometric information described for the selected verification method to verify my identity and prevent impersonation or fraud. I understand the disclosed retention and destruction schedule, permitted disclosures, and how to decline or withdraw consent. I agree to this biometric processing."

The checkbox or equivalent consent action must not be preselected. The verification flow must record the notice version, time, individual or verification identifier, and affirmative consent action. A payment signature or general service acceptance is not a substitute. This PDF supplies the notice and wording; presenting it alone does not record consent.

B1. Scope, roles, and duration

These terms form part of the merchant's agreement when Invora processes its customer or other business personal information solely on its instructions. The merchant is the controller/business and Blue Giant Labs is its processor/service provider for that activity. Blue Giant Labs remains an independent controller/business for its own profile administration, merchant KYC/KYB, fraud prevention, security, service-fee records, and legal obligations described in the Privacy Policy. These terms do not treat an independent public network or every third-party recipient as a processor.

Processing continues for the service relationship and any properly instructed, necessary retention period. The purpose is to provide invoice creation, payment-page display, reconciliation, reporting, support, and associated service security. Operations include collection, hosting, organization, access, transmission to authorized recipients, retrieval, correction, export, and deletion of the information needed for those purposes.

B2. Merchant obligations and lawful instructions

The merchant determines its lawful purposes, supplies accurate instructions, provides required notices, and obtains any necessary consent or other legal basis. It must minimize personal information and avoid public disclosure of sensitive information. Blue Giant Labs processes personal information only on documented lawful instructions, including instructions for international transfers of that information, unless law requires otherwise; in that case it informs the merchant before processing unless prohibited. We inform the merchant if a personal-information instruction appears to infringe applicable data protection law and may pause that processing pending resolution. Pausing instructed data processing does not give us authority to stop an independently authorized Solana token transfer.

B3. Restricted use and confidentiality

Blue Giant Labs will not sell or share instructed personal information for cross-context behavioral advertising, retain/use/disclose it outside the specified business purposes and direct service relationship except where legally permitted, or combine it with other personal information contrary to applicable service-provider restrictions. Personnel allowed to process it are subject to appropriate confidentiality duties and access restrictions. The merchant may take reasonable steps to verify compliance and require correction of unauthorized use. We notify it if we can no longer meet the applicable processing obligations.

B4. Security measures

We implement and maintain reasonable security appropriate to the nature and risk of the instructed information, including protected communications, appropriate encryption, least-privilege access, access logging, separation of access between business profiles, incident handling, and necessary provider safeguards. These commitments do not imply a particular certification or audit has occurred. Measures may evolve without materially reducing the protections required by law or this agreement.

B5. Subprocessors and recipients

The merchant generally authorizes necessary subprocessors for hosting/storage, communications, connectivity, diagnostics, and expressly used feature integrations, subject to equivalent applicable processing and confidentiality obligations. We remain responsible for our subprocessors' instructed processing as required by law. Persona is used for our merchant verification activities and is a processor for merchant-instructed data only where a particular feature actually puts it in that role.

A current list identifying relevant subprocessors and processing locations is available from hello@invora.us. We give the merchant prior notice of a material new or replacement subprocessor, ordinarily at least 30 days, and a reasonable opportunity to object on genuine data protection grounds. The parties work to resolve a valid objection; if no compliant alternative is reasonably available, the merchant may end the affected processing feature and receive any legally required adjustment of unused prepaid charges. Required advance notice is not replaced by a generic provider category.

B6. Assistance with rights and compliance

Taking account of the processing and information available, we reasonably assist with access, correction, deletion, portability, restriction, objections, impact assessments, consultations with authorities, and other required processor assistance. We promptly forward a relevant data-subject request to the merchant where appropriate and do not respond on its behalf without instruction unless required by law. The merchant may not instruct us to deny a right that the law makes mandatory.

B7. Personal information incidents

We notify the merchant without undue delay after becoming aware of a breach of instructed personal information. We provide available information reasonably needed for its legally required response, including the nature of the breach, affected categories, known effects, steps taken, and a contact for follow-up. Information may be supplied in phases as it becomes available. We reasonably assist containment and required notices. Each party remains responsible for its own legal notice duties; this paragraph does not extend a statutory deadline.

B8. International transfers of personal information

This section concerns cross-border disclosure of, or access to, personal information processed by the parties or their instructed providers. It does not give either party authority to approve, freeze, reverse, or block independently authorized token transfers on the public Solana network. Information actually included in a public transaction can still be personal information and remains subject to the privacy risks described in Privacy Policy section 7. Where applicable data-protection law restricts an international transfer of personal information, the responsible party must put the required lawful mechanism, assessments, and supplementary measures in place before that transfer. The parties must execute or validly incorporate applicable EU standard contractual clauses, a UK transfer instrument/addendum, or another valid safeguard with the required details where needed. These general terms do not replace a required completed transfer instrument or claim certification under a privacy framework. Mandatory personal-data transfer provisions prevail over inconsistent service terms.

B9. Return, deletion, and retention exceptions

At the end of the instructed processing, we return available personal information in a reasonable format or delete it as the merchant lawfully chooses, and require relevant subprocessor action, except for specifically justified retention required by law. Retained data is restricted to that purpose. Protected backup copies follow applicable deletion cycles unless law requires a different action. Public Solana records are independent of this return/deletion process, and do not excuse deletion of removable off-chain records and identity links. Independent-controller records remain governed by the Privacy Policy and applicable rights.

B10. Information and audits

We make available information reasonably needed to demonstrate compliance with applicable processor obligations. The merchant may first request relevant documentation and, where needed, arrange a proportionate audit by a qualified independent reviewer under confidentiality safeguards, reasonable notice, and protection of other customers' information and service availability. Ordinary audits are generally limited to one per year; a material incident, credible noncompliance concern, or authority/legal requirement can justify additional or expedited review. Practical audit conditions may not obstruct mandatory inspection or assistance rights.

B11. Liability, priority, and contacts

The lawful liability and indemnity provisions in the Terms apply, without overriding non-waivable data protection rights, required transfer instruments, or a party's mandatory duties. These processing terms control a conflict concerning instructed processing; a properly completed mandatory transfer instrument controls within its scope. They do not make the merchant liable for Blue Giant Labs' independent processing merely by labeling it a merchant instruction. Send processing, subprocessor, rights-assistance, or incident inquiries to hello@invora.us.