Cardog API Platform Terms

Version: 2026-07-30 Effective: upon acceptance for new customers; August 15, 2026 for customers whose API access predates this version. Contracting entity: Cardog Inc. · Governing law and forum: Ontario, Canada

These API Platform Terms (the "Terms") govern access to and use of Cardog's application programming interfaces, developer portal, software development kits, command-line tools, model-context-protocol tools, documentation, and related developer services (collectively, the "API Platform").

By creating an API account, generating or using an API key, or otherwise using the API Platform, the person accepting these Terms represents that they have authority to bind the company or other legal entity for whose benefit the API Platform is used ("Customer"). If you use the API Platform as an individual for your own business, professional, or development purposes, you are the Customer and these Terms bind you personally. If neither is true, do not use the API Platform.

These Terms are for business use. Cardog's consumer Terms of Service govern Cardog's consumer websites and applications and do not grant API rights. Use of Cardog-hosted consumer surfaces that happen to be built on MCP or the API remains governed by the consumer Terms of Service; access authenticated with an API key is governed by these Terms. If Customer and Cardog have signed an order form, master services agreement, or other agreement that expressly covers the API Platform (an "Enterprise Agreement"), that Enterprise Agreement controls to the extent of a direct conflict with these Terms.

1. Definitions

"API Content" means data, records, identifiers, references, scores, metadata, links, text, and other content returned through the API Platform. API Content does not include Customer Data.

"Approved Use" means a use expressly permitted by these Terms, the Documentation, and, where required, an Enterprise Agreement or Product/Data Use Schedule.

"Authorized Application" means a website, application, internal workflow, model, agent, or service owned or controlled by Customer and identified to Cardog where the applicable plan or Documentation requires identification.

"Credits" means the API Platform billing unit described in Section 12. Credits are distinct from, and not interchangeable with, any consumer product credit, report credit, or mobile in-app purchase, none of which grant API Platform access.

"Customer Data" means information submitted to the API Platform by or for Customer, including request payloads and vehicle identifiers, and account, configuration, and support information relating to Customer. Customer Data does not include usage records that Cardog generates to secure, meter, and operate the API Platform or API Content returned by the API Platform.

"Documentation" means Cardog's then-current technical documentation, schemas, lifecycle notices, and use instructions for the API Platform. Marketing pages and informal statements are not Documentation.

"Personal Information" means information about an identifiable individual and any equivalent concept under applicable privacy or data-protection law.

"Rate Card" means the price, credit cost, unit, plan allowance, overage rate, and other billing information Cardog presents through the API Platform, checkout flow, or developer portal. An Enterprise Agreement may replace the Rate Card.

"Response Metadata" means any source, authority, confidence, granularity, freshness, observation-time, effective-time, asOf, or unresolved-state fields returned with API Content.

2. Contract documents and precedence

The following documents form the agreement between Cardog and Customer to the extent they apply:

  1. an Enterprise Agreement;
  2. an executed or expressly incorporated Insurance or Product/Data Use Schedule, solely for the products and uses it covers;
  3. an executed or expressly incorporated data processing addendum ("DPA"), solely for a conflict about processing Personal Information;
  4. an executed or expressly incorporated service-level, security, or support schedule ("SLA"), solely for a conflict about service levels or support;
  5. these Terms;
  6. Cardog's API Acceptable Use Policy, once published, for the protections it describes;
  7. the published OpenAPI specification, solely for documented technical request and response shape; and
  8. the Documentation and Rate Card.

The document higher in the list controls a direct conflict unless it expressly states otherwise. A later or more specific Order Form controls an earlier Order Form. A purchase order, vendor portal, or Customer document does not modify the agreement merely because Cardog processes or does not reject it.

The machine-readable Rate Card controls the credits charged for a self-serve request when processed, but does not replace negotiated enterprise pricing. Examples, SDK descriptions, documentation prose, and marketing materials do not expand a licence, Approved Use, warranty, or service level.

3. API access and licence

Subject to the agreement and the applicable plan, Cardog grants Customer a limited, non-exclusive, non-transferable, non-sublicensable right during the subscription or access term to:

  • access the API Platform programmatically through approved interfaces;
  • use API Content in Authorized Applications for Customer's internal business purposes and to provide Customer's own products or services to its end users;
  • reproduce and display API Content as a subordinate part of an Authorized Application, preserving any attribution and Response Metadata the Documentation requires for the data family; and
  • retain API Content to the extent permitted by the Documentation, an Enterprise Agreement, and applicable law.

Customer may permit its employees and contractors to exercise these rights on its behalf, but Customer remains responsible for them. No right is granted to resell API access, distribute API Content as a standalone product or bulk dataset, operate a data brokerage, or sublicense Cardog's database except where an Enterprise Agreement expressly permits it.

Cardog may provide open-source SDKs or sample code under separate licences. The separate licence controls that code, but not the API Platform or API Content.

4. API credentials and account security

Customer must:

  • keep API keys and other credentials confidential and use reasonable technical and organizational safeguards to protect them;
  • not embed secret keys in public source code, client-side applications, model prompts, or other locations accessible to unauthorized persons, except where a Cardog interface expressly requires a key in a request URL, in which case Customer must protect that URL as a credential;
  • restrict each credential to the minimum necessary environments and personnel;
  • promptly rotate and revoke any credential that is or may be compromised;
  • keep account and billing information accurate; and
  • promptly notify Cardog at the security contact identified in the Documentation of suspected unauthorized access or use.

Customer is responsible for requests authenticated with its credentials until it notifies Cardog and revokes or Cardog disables the affected credential. Cardog may rate-limit, rotate, reject, or disable credentials to protect Customer, Cardog, the API Platform, or third parties. Customer is not responsible to the extent unauthorized use was caused by Cardog's breach of its security obligations.

5. Permitted automation and restrictions

Automation is an intended use of the API Platform. Customer may call the API through its Authorized Applications, agents, SDKs, and approved tools in accordance with the Documentation. Passing API Content into a third-party language model or agent runtime at inference time as part of an Authorized Application, and evaluating Customer's own applications and agents, are permitted uses.

Customer must not, and must not allow another person to:

  • access the API Platform through an interface or credential not authorized by Cardog;
  • exceed or evade rate, credit, plan, security, or access limits, including by creating accounts or rotating credentials for that purpose;
  • probe, scan, or test a vulnerability except with Cardog's written authorization;
  • interfere with the integrity, availability, or performance of the API Platform or introduce malicious code;
  • reverse engineer non-public elements of the API Platform, except to the limited extent a prohibition is not permitted by law;
  • remove or obscure Response Metadata, source attribution, legal notices, or technical safeguards;
  • misrepresent API Content as more current, precise, authoritative, or vehicle-specific than its Response Metadata indicates;
  • use the API Platform or API Content to create a substitute for, or materially replicate, Cardog's API, reference graph, or automotive data product, including by using API Content to train a model intended to replicate or substitute for the API Platform or Cardog's dataset, except as an Enterprise Agreement expressly permits;
  • sell, license, publish, scrape, or distribute API Content in bulk or as a standalone dataset except as an Enterprise Agreement expressly permits;
  • use source links or URIs returned by the API to scrape a source or violate the source's access controls or terms;
  • use the API Platform to violate law, infringe rights, facilitate fraud, or cause material harm; or
  • represent that Cardog sponsors, certifies, underwrites, appraises, inspects, or guarantees Customer, an application, a vehicle, or a transaction without Cardog's written authorization.

An API Acceptable Use Policy, once published, may add reasonable protections against abuse, fraud, security threats, unlawful discrimination, and harmful or deceptive use. It may not materially reduce purchased usage rights during a committed term except where reasonably necessary to address law, security, third-party rights, or material harm.

6. Customer obligations and end users

Customer is solely responsible for:

  • its Authorized Applications, business rules, notices, explanations, and decisions;
  • obtaining all rights, consents, and lawful bases required to submit Customer Data and use API Content;
  • assessing whether a VIN or other vehicle data becomes Personal Information when combined with Customer's policyholder, claimant, driver, owner, location, or account information;
  • giving its end users legally required notices and a means to exercise applicable rights;
  • maintaining human review, correction, appeal, and recordkeeping appropriate to the consequences of its use;
  • independently testing whether the API Platform is suitable for its intended purpose; and
  • complying with insurance, consumer-protection, privacy, anti-discrimination, accessibility, sanctions, export, and other laws applicable to Customer.

Customer may not state or imply that Cardog is the insurer, broker, adjuster, appraiser, consumer reporting agency, decision maker, or other regulated actor in Customer's service unless an Enterprise Agreement expressly establishes that role.

7. Insurance and other consequential uses

The API Platform can support vehicle research and Customer workflows, but self-serve API Content is not validated as the sole basis for underwriting, rating, eligibility, coverage, claims, total-loss, fraud, appraisal, financing, employment, housing, credit, or other decisions that materially affect an individual.

For any such consequential use, Customer must:

  • use an Enterprise Agreement or a Cardog pilot or evaluation agreement that identifies the approved use case and required data, support, security, audit, and service levels;
  • validate the relevant fields and error rates for its population and purpose before production use and on an ongoing basis;
  • consider Response Metadata and preserve unresolved or unknown states;
  • use qualified human review where required by law or reasonably appropriate;
  • provide legally required reasons, notices, correction paths, and appeals;
  • monitor for unlawful discrimination and proxy effects; and
  • avoid using API Content as the sole source of truth where Cardog or the Documentation requires confirmation from an official or primary source.

Unless an Enterprise Agreement expressly says otherwise, Cardog does not make a decision for Customer, determine the purpose or means of Customer's regulated processing, or provide legal, actuarial, appraisal, mechanical, safety, compliance, or insurance advice.

8. Meaning of vehicle, market, and recall data

8.1 Response Metadata is part of the answer

Customer must interpret API Content together with its Response Metadata. unknown, unresolved, null, confidence, authority, source, granularity, effective-time, observation-time, and freshness values are substantive data, not decorative fields. Customer must not silently replace an unresolved value with a guess or treat a model-year-level observation as proof about an individual vehicle.

An authority label describes the source category Cardog assigns to a field. It applies to that field rather than the response as a whole. It does not mean that the source, Cardog's extraction, or Customer's use is error-free.

8.2 Vehicle identity and specifications

VIN decoding and vehicle specifications may be incomplete, inconsistent, or incorrect because source records, manufacturer conventions, model-year changes, vehicle modifications, and matching methods vary. A syntactically valid VIN is not proof that the vehicle exists, retains factory equipment, has a particular condition, or matches every returned attribute.

8.3 Listings, observations, instruments, and quotes

Listings and observations describe information observed from third parties at a particular time. They may be stale, duplicated, withdrawn, erroneous, or unavailable. A quote, benchmark, index, range, or market statistic is an analytical estimate based on its stated cohort, sample, method, and asOf time. It is not an offer, transaction price, certified appraisal, fair-value opinion, or guarantee of a vehicle's value, availability, or condition.

8.4 Recalls and safety information

Unless an API response expressly states a finer granularity, a VIN recall result identifies campaigns associated with a decoded make, model, and model year. It does not establish that the individual VIN falls within a manufacturer's affected VIN range, has an open remedy, has not already been repaired, or is safe to operate. Customer must confirm vehicle-specific recall status and safety instructions with the responsible manufacturer, dealer, or government authority.

The API Platform is not an emergency or safety service. Customer must not delay contacting emergency services, a manufacturer, a regulator, or a qualified professional because of API Content.

9. Customer Data and privacy

As between the parties, Customer retains its rights in Customer Data. Customer grants Cardog a non-exclusive right to host, copy, transmit, transform, and otherwise process Customer Data only as needed to:

  • provide, secure, support, and meter the API Platform;
  • prevent fraud and enforce the agreement;
  • comply with law and binding legal process; and
  • create aggregated or de-identified service analytics that do not identify Customer or an individual.

Cardog will not use API request content or Customer Data to train general-purpose, foundation, generative, predictive, vehicle-data, or customer-facing models for Cardog or third parties unless Customer affirmatively opts in through a separate written or in-product control. Cardog will not sell Customer Data. This restriction does not prevent abuse detection, security analysis, de-identified service analytics, evaluation requested by Customer, or processing needed to return the requested API result.

Each party will comply with privacy and data-protection law applicable to its role. If Cardog processes Personal Information on Customer's behalf and applicable law requires a processor or service-provider agreement, the parties will enter Cardog's DPA before that processing. Customer must not submit special categories of Personal Information, claims narratives, driver records, government identifiers other than vehicle identifiers, or payment-card data unless an Enterprise Agreement and DPA expressly permit it.

Cardog may process Customer Data in Canada, the United States, and other locations identified in the DPA or subprocessors notice, subject to the agreement and applicable law.

10. Ownership, third-party sources, and feedback

Cardog and its licensors retain all rights in the API Platform, Documentation, database organization, schemas, software, models, and improvements. Customer and its licensors retain all rights in Customer Data and Authorized Applications. Underlying sources and licensors may retain rights in third-party content.

No ownership of factual vehicle information is transferred merely because it is returned through the API. Customer receives the contractual use rights in Section 3, subject to source-specific notices or restrictions expressly identified in the response, Documentation, or Enterprise Agreement.

If Customer voluntarily gives Cardog feedback, Customer grants Cardog a perpetual, irrevocable, worldwide, royalty-free right to use it without restriction or attribution. Feedback does not include Customer Data or Customer's Confidential Information.

11. Caching, retention, attribution, and corrections

Customer may store stable Cardog entity references for the duration of its use of the API Platform and may retain them after termination as identifiers within Customer's historical records, without any right of continued dereference. Cardog will not intentionally reassign an issued reference to a different entity. Cardog may correct, merge, alias, or retire a reference to address duplicate or erroneous identity and will provide a machine-readable alias or successor where reasonably practicable.

Other caching, retention, refresh, and attribution rules are set out by data family in the Documentation or an Enterprise Agreement. Customer may retain an immutable evidence snapshot as reasonably necessary for a claim, dispute, regulatory response, audit, or other legal recordkeeping obligation. Customer must preserve enough Response Metadata and Cardog version information to show the source context and time of API Content used in a consequential workflow. Customer may disclose an authorized snapshot to its regulator, auditor, professional adviser, insured, claimant, or other affected person where reasonably necessary to explain or challenge a decision, subject to confidentiality, privacy, and source-specific restrictions.

Customer must not present cached API Content as current after the stated freshness period or asOf time. When Cardog identifies a material correction, withdrawal, or source restriction and gives Customer reasonable notice, Customer must stop using or refresh the affected API Content within the time reasonably specified. Legal hold, audit, dispute, and regulatory copies may be retained but not used operationally.

12. Fees, credits, taxes, and billing

12.1 Rate Card and metering

Customer will pay the fees shown in its Enterprise Agreement or, for self-serve use, per the Rate Card: recurring subscription fees at the price presented at purchase, and metered usage at the Rate Card in effect at the time of the request, subject to the change-notice rules in Section 12.4. The Rate Card may price requests by route family, request, VIN, batch item, record, or another disclosed unit. API credits are a billing unit only: they are not currency, stored value, property, or transferable between customers.

Metering applies to the API routes the Rate Card prices. A successfully served metered response — one with a 2xx status code, or a 304 Not Modified status where disclosed, including responses served from cache — consumes credits at the applicable rate even where the response indicates an unresolved, empty, or valid: false result. Responses with other status codes, and routes the Rate Card does not price (including legacy routes identified in the Documentation), do not consume credits.

The developer portal, billing records, and applicable X-Credits-* headers provide usage information, but Cardog's ledger is the system of record. Customer must report a good-faith billing dispute within 60 days after the applicable invoice or usage record. Customer must timely pay undisputed amounts, and Cardog will not suspend service solely for amounts subject to a timely, good-faith dispute while the parties work to resolve it.

12.2 Allowances, packs, and overage

A monthly allowance resets at the time stated in the plan. Unused monthly allowance does not roll over. Prepaid credit packs are applied after the allowance in purchase order (first purchased, first used) and expire 12 months after purchase. Promotional or granted credits follow the same application and expiry rules and may be revoked for abuse. Packs are not transferable and are non-refundable except where required by law or where Cardog expressly states otherwise.

Where Customer selects a paid plan with metered overage, authorized requests continue after the allowance and unexpired packs are exhausted and Customer will be charged the disclosed overage rate. Cardog will invoice overage no later than three billing cycles after it accrues; overage Cardog does not invoice within that period is waived. Cardog may elect not to invoice accrued overage. The free plan may stop serving metered requests when its allowance and packs are exhausted; Cardog does not intentionally interrupt paid service for exhausted allowance. An Enterprise Agreement may establish different limits, overage treatment, or invoicing.

Customer is responsible for setting available usage and budget controls. Unless the product expressly labels a control as a hard cap, an alert, displayed balance, estimate, or threshold is informational and may not prevent charges already incurred or requests served concurrently.

12.3 Subscriptions, renewal, taxes, and payment

Paid self-serve subscriptions automatically renew for successive periods of the same length until Customer cancels through the developer portal's subscription management or another method Cardog identifies. Cancellation takes effect at the end of the current paid period unless law requires otherwise. Cardog will disclose the recurring price, billing interval, cancellation method, and any overage rate before purchase.

Fees are in the currency identified at checkout or in the Enterprise Agreement and exclude applicable taxes. Customer authorizes Cardog and its payment processor to charge the selected payment method for recurring fees, packs, overage, and taxes. Past-due amounts may accrue interest at the lesser of 1.5% per month (19.56% per annum) and the maximum lawful rate, plus reasonable collection costs.

Except where the agreement or law says otherwise, committed fees and properly consumed credits are non-cancellable and non-refundable. Cardog may issue a credit or refund for verified material metering error.

12.4 Price changes

Cardog may change self-serve prices on at least 30 days' advance notice. A subscription price increase takes effect no earlier than the next renewal after the notice period. A usage or overage price change takes effect on the date stated in the notice and Rate Card, but does not change charges incurred before that time. Customer may cancel before a change takes effect. Enterprise pricing changes only as its Enterprise Agreement permits.

13. Changes, versions, beta features, and service operation

Cardog may improve and change the API Platform. For API major versions Cardog designates as generally available in the Documentation, Cardog will use commercially reasonable efforts to provide advance notice of a material backward-incompatible change and a reasonable migration period, and will give at least 12 months' notice before ending that major version. The v1 API is a legacy surface, is not designated generally available, and follows the deprecation schedule in the Documentation. A notice period may be shorter where continued operation would create a material legal, security, third-party-rights, or safety risk.

Features identified as preview, alpha, beta, experimental, release candidate, evaluation, or similar ("Preview Features") may change or end at any time, may be subject to lower limits, and are not covered by an SLA. Preview Features must not be used in production consequential workflows unless an Enterprise Agreement expressly permits it. Except in an emergency, Cardog will give at least 30 days' notice and reasonable migration information before a material backward-incompatible change to a Preview Feature.

Cardog may use subcontractors and subprocessors to operate the API Platform. Cardog remains responsible for their performance to the extent required by the agreement and applicable law.

14. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or should reasonably be understood as confidential, including credentials, security information, non-public Customer Data, product plans, and pricing in an Enterprise Agreement. It excludes information the recipient can document: (a) is public through no breach; (b) was lawfully known without restriction; (c) is received lawfully from another source without confidentiality duty; or (d) is independently developed without use of the discloser's Confidential Information.

The recipient will use Confidential Information only to perform or exercise rights under the agreement, protect it using at least reasonable care, and disclose it only to personnel, professional advisers, and contractors who need to know and are bound to protect it. A recipient may disclose information where law or binding process requires it and, where legally permitted, will give advance notice and reasonable assistance.

15. Security

Cardog will maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the API Platform and Customer Data. Specific security commitments apply only if stated in an Enterprise Agreement or security schedule. Cardog does not represent that it has a certification or audit unless the applicable report has been completed and Cardog makes it available as such.

Customer acknowledges that no internet service is completely secure. Customer is responsible for securely configuring its Authorized Applications, minimizing Customer Data, and maintaining its own incident response and business continuity measures.

16. Suspension

Cardog may suspend affected access if reasonably necessary to:

  • respond to a security incident, compromised credential, or credible threat;
  • prevent unlawful, fraudulent, abusive, or materially harmful use;
  • enforce a rate, plan, or technical limit;
  • comply with law, binding process, or a source restriction;
  • address fees more than 10 days overdue after notice; or
  • stop a material breach of the agreement.

Where practicable, Cardog will give advance notice and limit suspension to the affected credential, application, data family, or feature. Cardog will restore access promptly after the reason is resolved. These limits do not prevent immediate action reasonably needed to protect security, persons, or systems.

17. Term and termination

These Terms start when Customer first accepts them or uses the API Platform and continue until terminated. Customer may terminate by ceasing use, revoking its keys, and cancelling active subscriptions. Either party may terminate for a material breach not cured within 30 days after written notice, or within 10 days for non-payment. A party may terminate immediately if the other becomes insolvent, where continued performance would violate law, or for a breach that cannot be cured.

Cardog may discontinue a free plan or Preview Feature on reasonable notice where practicable. Termination does not relieve either party of accrued payment obligations. On termination, Customer must stop calling the API and using API Content except for copies it may retain under Section 11 or an Enterprise Agreement. Sections that by their nature should survive do survive, including payment, confidentiality, ownership, disclaimers, indemnity, limits of liability, dispute terms, and permitted audit or legal-hold retention.

18. Warranties and disclaimers

Each party warrants that it has authority to enter the agreement. Cardog warrants that it will provide paid API Platform services in a professional and workmanlike manner and that the hosted API will materially conform to the published OpenAPI specification for the applicable major version as of the time of the request. Customer's exclusive remedy for breach of that warranty is re-performance or, if Cardog cannot re-perform, termination and a pro-rated refund of prepaid fees for the affected service period.

EXCEPT FOR THE EXPRESS WARRANTY ABOVE AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE API PLATFORM, API CONTENT, PREVIEW FEATURES, AND THIRD-PARTY CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE." CARDOG DISCLAIMS ALL IMPLIED, STATUTORY, AND OTHER WARRANTIES AND CONDITIONS, INCLUDING MERCHANTABILITY, QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. CARDOG DOES NOT WARRANT THAT THE API PLATFORM OR API CONTENT WILL BE UNINTERRUPTED, SECURE, ERROR-FREE, COMPLETE, CURRENT, OR SUITABLE FOR CUSTOMER'S PARTICULAR DECISION OR REGULATORY OBLIGATION.

No SLA, support level, security certification, data coverage, source continuity, or response-time commitment applies unless stated in an Enterprise Agreement or Documentation expressly incorporated into the agreement.

19. Indemnification

Customer will defend Cardog and its affiliates, officers, directors, and personnel against a third-party claim arising from:

  • an Authorized Application or Customer Data;
  • Customer's regulated decision, transaction, representation, or end-user relationship;
  • Customer's material breach of Sections 3 through 6 or Section 9; or
  • Customer's violation of law or third-party rights.

Customer will indemnify those parties against damages, settlements, penalties, and reasonable legal fees finally awarded or agreed in a settlement approved by Customer. Cardog must promptly notify Customer, give Customer control of the defence and settlement, and provide reasonable cooperation at Customer's expense. Customer may not settle a claim in a way that admits fault by or imposes a non-monetary obligation on Cardog without Cardog's written consent. Cardog may participate with its own counsel at its own expense.

Any Cardog intellectual-property indemnity is available only where stated in an Enterprise Agreement.

20. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE UNDER THE AGREEMENT FOR LOST PROFITS, REVENUES, GOODWILL, OR DATA, OR FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, EVEN IF ADVISED THEY WERE POSSIBLE.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE AGREEMENT WILL NOT EXCEED THE GREATER OF (A) CAD $100 AND (B) THE FEES CUSTOMER PAID OR OWED FOR THE API PLATFORM DURING THE 12 MONTHS BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY.

The exclusions and cap do not apply to Customer's payment obligations, a party's fraud or wilful misconduct, Customer's breach of Cardog's intellectual property rights, or liability that law does not permit the parties to limit. Any different cap or additional carve-out must be stated in an Enterprise Agreement.

The limitations apply in the aggregate across all legal theories and even if a remedy fails of its essential purpose. The parties entered the agreement in reliance on this allocation of risk.

21. Changes to these Terms

These Terms replace Cardog's consumer Terms of Service for API Platform use. For Customers whose API access predates this version, these Terms become binding on the effective date above; Cardog will have given notice by email and through the developer portal, and continued use of the API Platform after that date constitutes acceptance.

Cardog may update these Terms. Cardog will give at least 30 days' advance notice of a material change by email, the developer portal, or another reasonable account notice. A change may take effect sooner where reasonably necessary for law, security, third-party rights, or to prevent material harm, in which case Cardog will give as much notice as practicable.

Changes do not retroactively alter accrued fees or rights in API Content already received. Continued use after the effective date constitutes acceptance. If Customer objects, its remedy is to stop use and cancel before the effective date. Changes to an Enterprise Agreement require a writing signed or otherwise accepted as that agreement provides.

22. Disputes and governing law

Before filing a claim, each party will give written notice describing the dispute and allow at least 30 days for good-faith escalation between business representatives, unless immediate relief is reasonably necessary.

The agreement is governed by the laws of Ontario and the federal laws of Canada applicable there, without regard to conflict-of-laws rules. The parties irrevocably submit to the exclusive jurisdiction of the courts located in Toronto, Ontario. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Either party may seek injunctive or other equitable relief for actual or threatened misuse of intellectual property, Confidential Information, or credentials without completing informal escalation.

23. General

Customer may not assign the agreement without Cardog's written consent, except to an affiliate or in connection with a merger, reorganization, or sale of substantially all assets relevant to the agreement, provided the assignee assumes the agreement and is not a direct competitor of Cardog. Cardog may assign the agreement to an affiliate or in connection with a merger, reorganization, or sale of substantially all relevant assets. Any other attempted assignment is void.

Neither party is liable for delay or failure caused by events beyond its reasonable control, except Customer's payment obligations. The parties are independent contractors. The agreement does not create an agency, partnership, joint venture, fiduciary, insurer, broker, or employment relationship, and neither party may bind the other.

Cardog may identify Customer as a customer or use Customer's marks only with Customer's prior written consent. Notices must be in writing. Operational notices may be sent to the account email or through the developer portal. Legal notices to Cardog must be sent to legal@cardog.app; notices to Customer may be sent to its account or Order Form contact.

If a provision is unenforceable, it will be modified to the minimum extent necessary and the remaining provisions remain effective. A waiver must be in writing and applies only to the stated instance. Headings are for convenience. "Including" means "including without limitation." Electronic acceptance and counterparts are valid. The agreement is the entire agreement about its subject and supersedes prior or contemporaneous proposals and statements.