Terms of Service

These Terms of Service (the “Terms”) are a binding agreement between [LEGAL ENTITY NAME] (“AcePOS,” “we,” “us”) and the business, organization, or individual that creates an account to use the AcePOS platform (“you,” the “Organization”).

By creating an account, publishing an event, or otherwise using the Service, you accept these Terms. If you are accepting on behalf of a company, you represent that you have authority to bind it. If you do not agree, do not use the Service.

These Terms govern the relationship between us and the Organization. They do not create rights for guests who check in at your events; guests are covered by our Privacy Policy and by whatever terms you present to them.

• Service: the AcePOS web application at acepos.com, including the guest check-in pages, the Organization dashboard, and any related tooling.
• Guest: an individual who submits a check-in form at one of your events.
• Guest Data: the information Guests submit through your check-in forms, together with the records of their check-ins and anything you add to their profiles (tags, notes, VIP flags).
• Organization Data: your account information: business name, staff user accounts and roles, event configuration, form definitions, uploaded images, and payment records.

You must be at least 18 years old and operating a legitimate business or organization. Account information must be accurate and kept current.

You are responsible for all activity under your account, including activity by staff you invite. The Service provides three Organization roles, org admin, manager, and staff, with progressively narrower permissions. Assigning roles appropriately is your responsibility, not ours. Notify us promptly at [CONTACT@YOURDOMAIN.COM] if you believe an account has been compromised.

We may access your account for support, billing, security, and maintenance. Access is logged.

As between you and us, Guest Data is yours. You determine what questions your check-in form asks, what consents it requests, and what you do with the answers. In privacy-law terms you act as the controller (or “business”) and we act as your processor (or “service provider”). Our processing commitments are set out in Annex A.

You are responsible for:

• Having a lawful basis to collect what you collect, and giving Guests whatever notice your jurisdiction requires.
• Obtaining valid consent before sending marketing communications, and honoring withdrawals of that consent.
• Responding to Guests who ask to access, correct, or delete their information. Guests deal with you, not with us. We will refer them to you and assist you as described in Annex A.
• The accuracy and legality of any custom questions you add to a form.

You grant us a limited, non-exclusive license to host, store, transmit, display, and process Guest Data and Organization Data solely to provide, secure, and support the Service. We claim no ownership of it.

Analytics date ranges are a display limit, not a retention limit. Your plan sets how far back the dashboard charts will look, up to 90 days on paid plans. That ceiling governs only what those charts draw: it never deletes anything, and your exports always include the full history for the events they cover. Upgrading widens the view of data that was there the whole time.

We may generate aggregated, de-identified statistics from platform usage (for example, median check-ins per event across all Organizations) to operate and improve the Service. Such statistics never identify you, your Guests, or any individual, and are never re-identified or sold.

You will not, and will not permit anyone else to:

Data you must never collect through the Service

• Government identifiers: Social Security numbers, driver's license numbers, passport numbers, or taxpayer IDs.
• Payment card numbers, bank account numbers, or financial account credentials. The Service is not PCI-scoped and no field is designed to hold them.
• Health, medical, or biometric information, including facial geometry, fingerprints, or voiceprints. Note that dietary restrictions and allergy questions can constitute health information in some jurisdictions. Ask about preferences, not conditions.
• Precise geolocation, login credentials for other services, or the contents of private communications.
• Information from children under 13. The Service is not directed to children and is not COPPA-compliant. If your event is child-attended, collect the accompanying adult's information instead.

Discrimination and protected classes

You will not use the Service to collect information about, or to make decisions on the basis of, race, color, national origin, religion, sex, gender, familial status, disability, age, sexual orientation, military status, or any other characteristic protected by federal, state, or local law.

This applies with particular force to real-estate Organizations, for whom such questions may violate the federal Fair Housing Act. The Service's question bank deliberately excludes these topics and warns you when a hand-written question trips a documented steering proxy. Those guardrails are a convenience, not a compliance guarantee, and overriding or working around them does not shift responsibility to us.

Conduct

• Send unsolicited commercial messages, or message anyone who has asked you to stop.
• Sell, rent, license, or otherwise transfer Guest Data to a third party, or merge it into a shared or brokered marketing list.
• Use the Service to collect data for an entity other than the Organization named on the account.
• Scrape, crawl, reverse-engineer, decompile, probe, or load-test the Service; circumvent rate limits, paywalls, or access controls; attempt to reach another Organization's data.
• Resell or white-label the Service, or provide access to a competitor for benchmarking, without our written consent.
• Upload malware, infringing content, or images you lack the rights to use.

We may suspend an account immediately, without notice, for conduct we reasonably believe violates this section or exposes Guests, other Organizations, or us to legal risk.

This section is the most important one in these Terms. Read it before you run a drawing.

The Service includes tooling to select winners from among checked-in Guests and to notify them. That tooling is a random-selection mechanism and nothing more. You are the sole sponsor and operator of any promotion you run. AcePOS is not a sponsor, co-sponsor, administrator, promoter, or judge of your promotion, and does not review, approve, or provide legal advice about it.

The structure your promotion must follow

A promotion that combines a prize, an element of chance, and consideration is a lottery. Private lotteries are illegal in every U.S. state. To stay lawful you must remove consideration, which means:

• Entry must be free. You may not require a purchase, a minimum spend, a reservation, a table booking, or any other payment as a condition of entry. If you offer entry to diners, you must offer an equivalent free alternative method of entry, available on equal terms, and disclose it.
• Say so plainly.“No purchase necessary. A purchase will not increase your chances of winning. Void where prohibited.”
• Publish your own Official Rules and make them available to entrants before they enter. At minimum they must identify you as sponsor and state eligibility and age requirements, the entry period with time zone, the free method of entry, the number of prizes and each prize's approximate retail value, the odds of winning or how they are determined, how and when winners are selected and notified, the claim deadline and what happens to unclaimed prizes, and where a winners list can be requested.
• Do not call it a raffle.A raffle is a form of gambling that in most states may only be conducted by a licensed nonprofit. A for-profit business advertising a “raffle” is describing an illegal lottery even if the underlying mechanics are a lawful sweepstakes. Use “sweepstakes” or “prize drawing.”

Registration and bonding

If the total value of your prize pool exceeds $5,000 and your promotion is open to residents of New York or Florida, you must register the promotion with that state and post a surety bond for the full prize value before the promotion opens. New York requires filing with the Department of State at least 30 days in advance; Florida requires filing with the Department of Agriculture and Consumer Services at least 7 days in advance. Rhode Island imposes additional requirements on retail promotions. These are your filings to make.

Prizes that need extra care

Alcohol as a prize is restricted or prohibited in many states and may jeopardize a liquor license, so consult counsel and your state liquor authority first. Cash, gift cards, and cash equivalents carry tax reporting obligations. You are responsible for issuing IRS Form 1099 where required and for informing winners that prizes are taxable income. Prizes must be awarded as advertised.

Allocation of responsibility

You will defend, indemnify, and hold AcePOS harmless from any claim, penalty, investigation, or loss arising out of a promotion you run through the Service, including claims by entrants, regulators, or state attorneys general. This obligation survives termination.

It is worth being precise about who sends what, because the legal obligations follow the sender.

AcePOS sends two kinds of message to Guests at the platform level: a notification to a Guest you have selected as a prize winner, containing their claim link, and a marketing message you compose and direct us to send on your behalf, described next. Both are sent from our own sending address, at your direction. If your business has a contact email on file, replies to either message go there. If not, a marketing reply falls back to us, and a prize-winner reply instead falls back to whichever staff member ran the drawing, putting that person's own address in front of the Guest.

You are the sender of every other message to a Guest, whether you send it yourself or through the Service on your behalf. The Service records marketing consent, including a timestamp and whether consent was explicit or implied, and makes it available on export. Recording consent is not the same as complying with the law governing its use. When you email or text your guest list, you are the sender and you are responsible for the following, whether you send it yourself or direct us to deliver it through the Service's campaign tool. The Service enforces some of these for you, for example refusing to send a campaign with no postal address on file, but the underlying compliance obligation is still yours:

• CAN-SPAM: a working unsubscribe mechanism in every commercial message, honored within 10 business days, a valid physical postal address, accurate headers, and a non-deceptive subject line.
• Bulk sender requirements at Gmail, Yahoo, Microsoft, and Apple: if you send through your own tools, SPF, DKIM, and DMARC on your sending domain and one-click unsubscribe headers (RFC 8058) honored within two days; for a message sent through the Service, we provide the sending domain's authentication and honor the one-click header immediately. Either way, a spam complaint rate held below 0.3%.
• TCPA: if you use collected phone numbers for calls or SMS, prior express written consent for marketing messages, and prompt honoring of revocation by any reasonable means. Note that a phone number collected on a check-in form is not by itself consent to be texted.

Guests who opt in to receiving event photos have consented to you sending them photos. The Service records that consent and does not store, process, or transmit event photographs. Obtaining any further permission needed to photograph and distribute images of identifiable people, including any minors, is your responsibility.

The Service offers a free tier and paid plans billed monthly or annually, and extra events may also be bought outright as one-time purchases. The current prices are shown on the pricing page and at checkout before you pay. A paid plan renews until you cancel it, which you can do at any time from the billing settings.

Payments are processed by Stripe and PayPal. We do not receive or store your card or bank details; those are handled entirely by the processor you choose, and its own terms and privacy policy govern that part of the transaction. You are responsible for any sales, use, or similar taxes applicable to your purchase, except taxes on our net income.

Refunds

These rules govern one-time event and credit purchases; a paid plan is ended by cancelling it as described above. Because an event's value is delivered on the day it runs, refunds for an event purchase work as follows; a purchased credit follows the same rules once it is redeemed to publish an event, and is refundable on request any time before that:

• Before any Guest checks in: full refund on request, up to the scheduled event date.
• After the first check-in: no refund, since the Service has been delivered.
• If the Service fails materially (for example, the check-in page is unavailable during your event due to a fault on our side): a full refund or a credit for a future event, at your election.

Refund requests go to [CONTACT@YOURDOMAIN.COM].

We aim to keep the Service available continuously but do not commit to a specific uptime percentage and offer no service level agreement. We may perform maintenance, and will try to schedule disruptive maintenance outside typical evening service hours.

Support is available by email at [CONTACT@YOURDOMAIN.COM]. We aim to respond within one business day; issues affecting a live event take priority.

We may modify or discontinue features. If we discontinue a feature you have paid for in a way that materially reduces the value of an unfulfilled one-time event or credit purchase, we will refund it; a paid plan is instead ended by cancelling it as described in Section 11.

The Service, including its software, design, question bank, templates, and brand, belongs to us and our licensors. These Terms grant you a limited, revocable, non-exclusive, non-transferable right to use the Service for your own business purposes. Nothing else is granted.

Images you upload (floor plans, branding) remain yours; you grant us a license to host and display them within the Service. You represent that you have the rights to any image you upload.

If you send us feedback or suggestions, we may use them without obligation or compensation.

You may stop using the Service at any time. If you are on a paid plan, cancel it from your billing settings; you keep access until the end of the period you have already paid for.

We may suspend or terminate your account for material breach of these Terms, non-payment, or conduct that creates legal or security risk. Except where immediate action is warranted under Section 5, we will give you notice and a reasonable chance to cure.

Deleting your own account. You can delete your account from your profile settings. Doing so signs you out everywhere and stops you signing in again immediately, and it frees the staff seat you occupied so your business can fill it. For 30 days afterwards the account is held rather than erased: ask us at [CONTACT@YOURDOMAIN.COM] within that period and we can usually restore it. We cannot restore it if your business has been suspended in the meantime, or if it has since filled every seat its plan allows and has no room to put you back. After the 30 days the account is erased permanently and cannot be recovered by anyone. Your email address stays reserved while the account is held, so it cannot be used to sign up again or be re-invited until the period ends or you ask us to release it.

On termination, you have 30 days to export your Guest Data using the built-in CSV and XLSX exports. After that period we may delete it, subject to the retention rules in the Privacy Policy. Ask us at [CONTACT@YOURDOMAIN.COM] if you need an export and can no longer sign in.

Sections 4, 5, 6, 10, 12, 13, 14, and 15 survive termination.

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE AGAINST EVERY ATTACK.

Specifically, and without limiting the above: the compliance guardrails in the Service, such as the Fair Housing question warnings, the question bank exclusions, consent-capture fields, and this document itself, are conveniences intended to help you notice problems. They are not legal advice, they are not a compliance program, and they do not make your use of the Service lawful. Retain your own counsel.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY.

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID US IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS.

These limits do not apply to your obligations under Sections 5, 6, and 14, to either party's gross negligence or willful misconduct, or to anything that cannot be limited under applicable law.

You will defend, indemnify, and hold harmless AcePOS and its officers, employees, and contractors from any third-party claim, demand, investigation, fine, or loss (including reasonable legal fees) arising out of: your Guest Data and how you collected or used it; any promotion you ran through the Service; your communications with Guests; your breach of these Terms; or your violation of any law, including privacy, marketing, fair housing, and gaming laws.

These Terms are governed by the laws of the State of New York, without regard to its conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply.

Talk to us first. Before filing anything, email [CONTACT@YOURDOMAIN.COM] with a description of the dispute and what you want. Most problems resolve here. If we have not resolved it within 30 days, either party may proceed.

The parties submit to the exclusive jurisdiction of the state and federal courts located in [COUNTY] County, New York, and each waives any objection to venue there and any right to a trial by jury.

Changes.We may update these Terms. For material changes we will give at least 30 days' notice by email or in-app, and the change takes effect for events you publish after the notice period. Continued use after that constitutes acceptance.

Assignment. You may not assign these Terms without our consent. We may assign them in connection with a merger, acquisition, or sale of assets, on notice to you.

Severability and waiver. If a provision is unenforceable, it is modified to the minimum extent necessary and the rest stands. A failure to enforce is not a waiver.

Entire agreement. These Terms, including Annex A, together with the Privacy Policy, are the entire agreement between us on this subject.

Force majeure. Neither party is liable for delays caused by events beyond its reasonable control, including infrastructure provider outages.

This Annex applies where you act as a controller or “business” with respect to Guest Data and we act as your processor or “service provider.” It is incorporated into the Terms. If you need a separately executed DPA for your procurement process, contact [PRIVACY@YOURDOMAIN.COM].

A.1 Roles and scope

You are the controller of Guest Data. We process it only on your documented instructions, which, absent a separate written agreement, means: as necessary to provide the Service, as configured by you through the dashboard, and as required by law. We will tell you if we believe an instruction violates applicable privacy law.

A.2 Our commitments as processor

• We will not sell or share Guest Data, retain it for any purpose other than performing the Service, or use it for our own commercial purposes, including advertising or model training.
• We will not combine Guest Data from your account with data from any other Organization, except in aggregated and de-identified form as described in Section 4.
• Personnel with access are bound by confidentiality obligations, and access is limited to those who need it to operate or support the Service.
• We maintain the security measures described in the Privacy Policy, including tenant isolation enforced at the database layer through row-level security.

A.3 Subprocessors

You authorize the subprocessors listed in the Privacy Policy. We remain responsible for their performance. We will give notice before adding a subprocessor that processes Guest Data, and you may object on reasonable data-protection grounds; if we cannot accommodate the objection, you may terminate: we will refund any unfulfilled one-time event or credit purchases, and a paid plan is ended by cancelling it as described in Section 11.

A.4 Assisting you

Taking into account the nature of the processing, we will assist you with Guest rights requests, security incident response, and any data protection impact assessment you must carry out. The Service's built-in guest search, edit, delete, and export functions are the primary mechanism; where they are insufficient, contact [PRIVACY@YOURDOMAIN.COM].

A.5 Security incidents

We will notify you without undue delay, and in any case within 72 hours, of becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Guest Data in your account. Notice will describe what we know, what we are doing, and what we recommend. Determining whether the incident triggers a notification duty to Guests or regulators is your call as controller; we will give you the information you need to make it.

A.6 Return and deletion

On termination you may export Guest Data for 30 days as described in Section 11. On your written request we will delete it, except where retention is required by law or for a limited period in encrypted backups, which expire on the ordinary backup cycle.

A.7 Audits

On reasonable written request, no more than once per year, we will provide the information reasonably necessary to demonstrate compliance with this Annex.

A.8 International transfers

The Service is operated from and stores data in the United States. If you direct Guest Data subject to the GDPR or UK GDPR to the Service, you are responsible for the lawfulness of that transfer, and the parties will execute Standard Contractual Clauses on request.