VITAPOS Software and Device End User Licence Agreement

This VITAPOS Software and Device End User Licence Agreement (the "Agreement") is between Vitabyte, Inc., a New York corporation with its principal office at 3525 30th Ave, Suite 306, Astoria, NY 11103 ("Vitabyte", "we", "us"), and the business that accepts it (the "Customer", "you").

It governs your use of VITAPOS, which includes:

• the VITAPOS Android application, delivered as an APK, and every update, patch and build of it we make available;
• its device modes, including kiosk and device-owner mode on terminals and handhelds, kitchen display mode, and customer-facing display mode;
• the VITAPOS web back office and the services the app connects to;
• licence keys, enrollment codes, device certificates and attestation records we issue; and
• the documentation we publish for any of the above.

Together these are the "Software".

This Agreement is an addendum to the Vitabyte Terms of Service (the "Terms"), and the Acceptable Use Policy applies to all use of the Software. The Terms continue to govern everything this Agreement does not address, including governing law, venue, limits of liability, liquidated damages, injunctive relief and acceptance records. If this Agreement and the Terms conflict on a subject this Agreement covers, this Agreement controls on that subject.

You accept this Agreement by ticking the unchecked acceptance box shown in the back office, the enrollment flow or the app. If you accept as an administrator for an organization, you also type your full name and title. That typed name and title is your electronic signature, and it binds the organization you represent.

By accepting, you confirm that you are at least 18 years old and that you have authority to bind the organization. If you do not have that authority, do not accept and do not use the Software.

We keep a record of each acceptance: the document version, a SHA-256 hash of the text you were shown, the time, your IP address and your browser or device user agent. These records are append-only, and you agree they are reliable evidence that you accepted this version.

Subject to your compliance with this Agreement, the Terms and payment of the applicable fees, Vitabyte grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to install and run the Software, in object code form only, on the number of devices and at the locations covered by your subscription (the "Licensed Devices" and "Licensed Locations"), solely for your internal business operations at those Licensed Locations.

The licence is counted per device and per location as stated in your order or subscription. A device that is enrolled, or that has run the Software in the current billing period, counts as a Licensed Device until you de-enroll it in the back office. A device may not be moved between locations to avoid location counts.

You may make a reasonable number of copies of the documentation for internal training. You may not otherwise copy the Software.

We license the Software; we do not sell it. Vitabyte and its licensors keep all right, title and interest in the Software, including all copies, updates, derivative works and intellectual property rights. All rights not expressly granted are reserved.

Licence keys, enrollment codes, device enrollment, device certificates, app signing and device attestation are technological measures that control access to the Software and protect our copyrighted works. They are not mere conveniences.

You must not, and must not allow anyone to:

• share, sell, publish or reuse a licence key or enrollment code outside the device and location it was issued for;
• enroll more devices or operate more locations than your subscription covers;
• falsify, replay or spoof attestation results, device identifiers or location data;
• tamper with, disable or work around any licence check, usage count, kill switch or enrollment control; or
• use a device after we, or you, have de-enrolled it.

Circumventing these measures may violate 17 U.S.C. §1201 (the anti-circumvention provisions of the Digital Millennium Copyright Act) in addition to this Agreement. We reserve every remedy available under that statute and under the Terms.

Except to the extent this Agreement expressly permits, you must not, and must not allow any employee, contractor or third party to:

1. reverse engineer, decompile, disassemble, decode or attempt to derive the source code, structure, algorithms or design of the Software, including the APK, its dex bytecode, native libraries, resources, firmware images, configuration files or the protocols it uses;
2. modify, translate, adapt or create derivative works of the Software;
3. repackage, re-sign or redistribute the Software, or install or sideload any modified, patched or unofficial build of it;
4. root, jailbreak or unlock a device, or alter its operating system or bootloader, in order to bypass device-owner mode, kiosk restrictions or any control described in Section 4;
5. extract, copy or use any asset, image, font, embedded API key, client secret, certificate, signing key or credential contained in the Software;
6. intercept, proxy, inspect, record or alter traffic between the Software and Vitabyte services, including by installing your own root certificate, using a man-in-the-middle proxy or disabling certificate pinning;
7. access or call Vitabyte services by any means other than the Software or a documented interface under our Developer and API Terms;
8. rent, lease, lend, sell, sublicense, time-share or provide the Software as a service bureau to any third party;
9. remove, obscure or alter any proprietary notice, label or mark;
10. use the Software, or information learned from it, to build, train, benchmark against or improve a competing point-of-sale or restaurant management product; or
11. use the Software in breach of law, card network rules or the Acceptable Use Policy.

Narrow carve-out. If applicable law expressly forbids a restriction in item 1 for a specific purpose, such as achieving interoperability of an independently created program, that restriction does not apply to the extent of that law. Before you rely on it, you must first send a written request by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103 describing what you need and why. We will consider supplying the information on reasonable terms. You may proceed only if we do not supply it within a reasonable time, only as far as the law requires, and the results remain our confidential information.

The Software updates itself. You agree that we may deliver updates, patches, security fixes and configuration changes automatically to Licensed Devices, and that you will not block, delay or roll back them except through a setting we provide.

Some updates are required. We may stop a device that is running an outdated or unsupported build from connecting to our services until it updates. We may add, change or remove features, provided we do not materially reduce the core functionality of the Software during a paid subscription term without notice as described in the Terms.

The Software is designed to keep taking orders when a device loses its connection. While offline:

• the device stores transactions, orders and changes locally, encrypted at rest where the hardware supports it;
• some functions are limited or unavailable, including any card payment that needs a live authorization;
• data is sent to our services when the connection returns, in the order it was recorded.

You are responsible for restoring connectivity promptly, keeping devices powered and secure while they hold unsynced data, and not wiping, resetting or replacing a device before its data has synced. We are not liable for data lost because a device was reset, damaged, stolen or kept offline for longer than the documented offline window. Offline cash and non-card tenders are recorded at your risk until synced.

Customer-owned devices. If you run the Software on your own hardware, you are responsible for choosing devices and peripherals on our published compatibility list, keeping them in working order and keeping their operating systems supported. Placing a device in device-owner or kiosk mode may restrict other uses of it; you consent to that.

Devices supplied by Vitabyte. If we supply a device, its ownership, warranty and return terms are set by your order. Unless your order says it is sold to you, it remains our property; you must keep it in good condition, not modify it, and return it when your subscription ends. Any hardware warranty is the manufacturer's warranty, which we pass through to you as far as we are permitted.

Peripherals. Printers, cash drawers, scanners, scales, card readers and displays are made by third parties. We aim to detect and configure compatible peripherals, but we do not warrant third-party hardware or firmware, and we are not responsible for a peripheral's failure.

The Software accepts card-present payments only through processor and reader paths that we have certified for the Software and that your payment processor has approved for your merchant account. You must have your own merchant agreement with that processor, and that agreement governs the money.

A card-present path is not available for live payments until both your processor and the physical reader have completed acceptance testing with the Software. Passing our own software tests does not qualify a path for live use. You must not enable, configure or attempt live card-present acceptance on any path that has not completed that acceptance, and you must not connect unapproved readers or payment software.

Vitabyte is not a payment processor, does not hold your funds and is not a party to your merchant agreement. You remain responsible for chargebacks, refunds, surcharge and dual-pricing compliance, and card network rules.

You may allow your employees and contractors ("Staff") to use the Software on your behalf. You are responsible for:

• making sure each person who uses the Software has accepted, or has been told about and complies with, this Agreement and the Acceptable Use Policy;
• issuing and revoking Staff PINs, cards and roles, and setting permissions that suit their jobs;
• keeping PINs private and changing them when someone leaves; and
• giving any notice to Staff that law requires about timekeeping, monitoring or the data the Software records.

Staff act for you. Anything done in the Software with a Staff PIN, card or account is treated as done by you, whether or not you authorized that specific act. You are liable for your Staff's use and for any breach of this Agreement by them.

Data you or your Staff enter into the Software, and the transaction records it creates, is "Customer Data" and is handled under the Terms, our Privacy Policy and, where applicable, our Data Processing Addendum.

We also collect device and usage information such as device model, operating system version, app version, enrollment status, crash reports, performance measurements and licence usage. We use it to operate, secure, support and improve the Software, to enforce this Agreement and to measure licence counts. We do not sell it.

You must not enter full card numbers, card verification codes or PINs into any free-text field, note, item name or custom field.

Through the service. You agree that the Software reports enrollment, device, location and usage counts to us automatically, and that we may rely on those reports to measure your licence use and bill you.

Records review. Not more than once in any 12-month period, and on at least 30 days' written notice, we or an independent auditor bound by confidentiality may review your records reasonably needed to verify the number of devices and locations using the Software and your compliance with this Agreement. Reviews take place during normal business hours and in a way that does not unreasonably disrupt your business. You will cooperate and provide the records promptly.

Results. If a review or the service reports show you used more than you paid for, you will pay the shortfall at our then-current rates within 30 days. If the shortfall exceeds 5% of the fees due for the period reviewed, you will also reimburse our reasonable costs of the review. This does not limit our other rights for breach.

We may suspend any Licensed Device, licence key or your access to the Software, with or without notice, if we reasonably believe:

• you or your Staff have breached Section 4 or Section 5;
• a device or key has been compromised, cloned or used outside its location;
• continued use poses a security risk to you, us, other customers or cardholders; or
• fees are overdue as described in the Terms.

We will restore access promptly once the cause is resolved. Where safe to do so, we will let a suspended device finish syncing data it already holds.

This Agreement lasts as long as you have an active VITAPOS subscription, unless ended earlier. Either party may end it as described in the Terms. We may end it immediately on written notice if you materially breach Section 4 or Section 5.

When this Agreement ends, for any reason:

1. your licence ends and you must stop using the Software immediately;
2. you must uninstall the Software from every device and delete every copy in your possession or control;
3. you must de-enroll each device in the back office, or allow us to de-enroll it remotely, which may remove device-owner mode and reset kiosk settings;
4. you must return any device we supplied that remains our property;
5. you may export Customer Data for the period stated in the Terms, after which we may delete it under our retention schedule; and
6. on request, an officer will certify in writing that you have done the above.

Sections 3 (ownership), 4, 5, 9 (as to past transactions), 10, 12, 14, 16, 17 and 18 survive termination, together with any accrued payment obligations.

The Software may be subject to US export control and sanctions laws. You must not export, re-export or provide access to the Software in violation of those laws, including to any embargoed country or region or to any person on a US government restricted list. You confirm that you are not such a person.

The Software includes components licensed under open-source licences. A list of those components and their licences is available in the app's About screen and on request in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103. Where an open-source licence grants you rights that this Agreement would otherwise restrict for that component, that licence controls for that component only. Nothing in an open-source licence grants you any right in Vitabyte's own code or marks.

Except as expressly stated in the Terms, the Software is provided "as is" and "as available". To the fullest extent permitted by law, Vitabyte disclaims all implied warranties, including merchantability, fitness for a particular purpose, title and non-infringement, and any warranty that the Software will be uninterrupted, error-free or compatible with any particular hardware.

The limits and exclusions of liability in the Terms apply to this Agreement. Without limiting them, Vitabyte is not liable for losses caused by offline operation, unsynced data, third-party hardware, your processor, your network, or your Staff's acts.

You agree that a breach of Section 4 or Section 5 would cause Vitabyte irreparable harm for which money damages alone would not be adequate. Vitabyte may seek injunctive relief, specific performance and other equitable relief in addition to any other remedy, without posting a bond where the law allows. The liquidated damages provisions of the Terms apply to unauthorized use, copying, circumvention and over-deployment of the Software, in addition to the fees owed for that use.

You may not assign this Agreement without our written consent; any attempt to do so is void. We may assign it as described in the Terms. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the rest remains in effect. A failure to enforce a provision is not a waiver. This Agreement, the Terms, the Acceptable Use Policy and your order are the whole agreement about the Software and supersede earlier understandings on that subject.

We may update this Agreement. We will give notice of a material change and ask you to accept the new version before it applies to you, except where a change is required by law or for security.

Questions and notices about this Agreement: in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103

Signed for Vitabyte, Inc.: George Karabelas, Chief Executive Officer, Vitabyte, Inc.