Terms of Service

1. Entity Identification and Parties

1.1 CariHub is a cloud-based business management platform operated by CariHub Business Link, a company registered and operating in the Republic of Trinidad and Tobago.

1.2 For the purposes of these Terms, "CariHub Business Link" refers to the legal entity that owns, operates, and maintains the CariHub platform, including all software, websites, applications, and related services provided under the CariHub brand.

1.3 "You" or "Business" means the individual, sole trader, partnership, limited liability company, corporation, or other legal entity that registers for and uses the CariHub Platform. If you are using the Platform on behalf of an organisation, you represent and warrant that you have the authority to bind that organisation to these Terms.

1.4 Throughout these Terms, "Platform" refers collectively to: (a) the CariHub web application accessible at carihub.com and any subdomains; (b) the CariHub mobile applications for iOS and Android; (c) any embedded widgets, booking interfaces, or customer-facing components; (d) any APIs, integrations, or developer tools; and (e) all associated documentation, support services, and updates.

2. Acceptance of Terms

2.1 By clicking "I Agree," checking a consent box, creating an account, or otherwise accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by these Terms and our Privacy Policy, which is incorporated herein by reference.

2.2 You represent and warrant that you are at least eighteen (18) years of age, or the age of legal majority in your jurisdiction of residence or incorporation, whichever is greater. If you are under the age of majority, you may not use the Platform.

2.3 Electronic Acceptance. You agree that your electronic acceptance of these Terms has the same legal force and effect as a physically signed agreement. The use of electronic signatures, click-to-accept mechanisms, and continued use of the Platform following the posting of updated Terms all constitute valid acceptance under the Electronic Transactions Act of Trinidad and Tobago and equivalent legislation in other Caribbean jurisdictions. This Agreement and all accepted orders are governed by the Electronic Transactions Act, 2000 of Trinidad and Tobago, the Electronic Transactions Act, 2006 of Jamaica, the Electronic Transactions Act, Cap 325A of Barbados, the Electronic Communications and Transactions Act of Guyana, the Electronic Transactions Law, 2017 (revised) of the Cayman Islands, and the Electronic Communications and Transactions Act, 2003 of The Bahamas, which establish the legal framework for electronic acceptance and electronic signatures in their respective territories.

2.4 These Terms apply to all users of the Platform, including but not limited to: business owners, managers, staff members, independent contractors, and any other persons authorised by the Business to access the Platform ("Authorised Users"). You are responsible for ensuring that all Authorised Users comply with these Terms.

2.5 If these Terms are translated into any language other than English, the English version shall prevail in the event of any conflict or inconsistency between versions.

3. Description of Service

3.1 CariHub is a multi-tenant Software-as-a-Service ("SaaS") platform designed to help small and medium-sized businesses ("SMBs") in the Caribbean region manage their operations. The Platform provides a comprehensive suite of tools including, but not limited to:

• Appointment Booking and Scheduling: Online booking, calendar management, waitlists, recurring appointments, and booking series management for salons, spas, clinics, restaurants, and professional service providers.
• Point of Sale ("POS"): In-person and online payment processing, receipt generation, tip management, and transaction history.
• Customer Relationship Management ("CRM"): Client profiles, communication history, visit tracking, preferences, notes, and client segmentation.
• AI-Powered Assistant: An artificial intelligence assistant that helps with scheduling, drafting communications, answering customer queries, generating insights, and providing operational recommendations. The AI assistant uses third-party models from OpenAI, Anthropic, Google, xAI, Mistral, and OpenRouter.
• Marketing and Communications: Email marketing via Resend and Brevo, SMS messaging via Twilio (including WhatsApp), campaign management, and communication templates. Businesses on supported plans may optionally connect their own Resend and/or Twilio account ("Bring Your Own Key" or "BYOK") to route outbound communications through their own provider account, as further described in Sections 10.9 and 11.6 below.
• Events Management: Event creation, ticketing, registration, and promotion tools.
• Gift Cards and Loyalty Programs: Digital gift card issuance and redemption, loyalty point tracking, rewards management, and customer retention tools.
• E-Signatures: Electronic signature collection for consent forms, waivers, intake forms, and other documents.
• Financial Reporting and Accounting: Revenue tracking, expense management, financial reports, tax summaries, and integration with external accounting systems.
• Bookable Resources: Reservation management for rentable assets — rooms, venues, vehicles, equipment — with availability calendars, deposits, cleaning fees, maintenance windows, and guest reservations.

• Bookable Resources: Reservation management for rentable assets — rooms, venues, vehicles, equipment — with availability calendars, deposits, cleaning fees, maintenance windows, and guest reservations.

• Inventory and Stock Management: Product tracking, stock level monitoring, low-stock alerts, and purchase order management.
• Staff Management: Role-based access, permission controls, staff scheduling, and performance tracking.
• Business Listings and Directory: Public-facing business profiles, service listings, and search visibility within the CariHub marketplace.
• Landing Page Builder: A drag-and-drop page editor for creating custom business storefront pages with SEO (Search Engine Optimization) settings, including meta tags, structured data (JSON-LD), search aliases, and social media sharing (Open Graph) configuration.
• SEO and Search Optimization: Tools for managing search aliases on services, products, events, and business profiles to improve discoverability in both internal search and external search engines. Includes AI-powered optimization scanning that analyzes content and recommends improvements.
• Multi-Factor Authentication ("MFA"): Optional and mandatory security features including authenticator app (TOTP), email verification codes, SMS codes, and backup codes. Platform administrators may configure MFA bypass modes for development and testing environments.
• Feedback and Support: A structured feedback system allowing users to submit bug reports, feature requests, and questions. Feedback can be routed to business-level or platform-level administrators, with response threads, attachments, and promotion to formal feature requests or issue tracking.
• Development and Testing Tools: Platform administrator tools for simulating payments, bookings, communications, AI responses, and MFA flows in sandbox environments. These tools are disabled in production by default and require explicit environment configuration to enable.
• Communication Quotas: Plan-tier monthly limits on outbound emails, SMS, WhatsApp messages, marketing emails, and web push notifications. Quotas protect platform cost and are enforced per business per month. Marketing communications exceeding the quota are blocked; transactional communications (booking confirmations, payment receipts) are still delivered but logged for review.
• Web Push Notifications: Optional browser-based push notifications that deliver alerts to your device even when the Platform is not actively open. Requires explicit browser permission and a supported browser. Push subscription data (device endpoint, public key, auth secret) is stored to deliver notifications.
• Platform Broadcasts: The Platform's administrators may send broadcast messages (such as outage notices, security advisories, or product updates) to all businesses or to specific plan tiers. These appear in your in-app notification feed and may also be delivered via email and push notification.
• Audit Logging: Comprehensive audit logging of user and system actions with configurable retention profiles. Audit logs record the user identity, timestamp, action, IP address, and user agent. Three default retention profiles are available (Minimal, Standard, Comprehensive), and custom profiles can be created.

3.2 Feature Tiers. The Platform is offered in three feature tiers:

• SIMPLE: Core booking and scheduling, basic client management, payment processing, email and SMS notifications, and standard support. Suitable for small businesses needing essential operational tools.
• INTERMEDIATE: All SIMPLE features, plus CRM with client segmentation, marketing campaigns, gift cards, loyalty programs, events management, basic AI assistant capabilities, and priority support. Suitable for growing businesses seeking to enhance client engagement and revenue.
• ADVANCED: All INTERMEDIATE features, plus advanced AI assistant with multi-model support, comprehensive financial reporting, accounting integrations, e-signatures, advanced automation, custom fields, advanced staff management, API access, and dedicated support. Suitable for established businesses requiring full operational control.

3.3 The specific features, limits, and capabilities available at each tier are described on our pricing page at carihub.com/pricing and may be updated from time to time. We will provide reasonable notice of any material changes to feature availability.

3.4 Certain features may be offered as optional add-on modules, including but not limited to advanced marketing tools, accounting and bookkeeping integrations, and premium AI capabilities. Add-on modules are subject to additional fees as described in Section 6.

3.5 We reserve the right to modify, suspend, or discontinue any feature or aspect of the Platform at any time, with reasonable notice to affected users, provided that such action does not materially impair your ability to use the core features of your subscribed tier.

4. Account Registration and Security

4.1 Account Registration. To use the Platform, you must create a business account by providing accurate, current, and complete information, including but not limited to: business name, business registration number (if applicable), physical address, email address, phone number, and the name and role of the primary account holder.

4.1.1 Launch-Mode Registration Restrictions. The Platform is rolled out in phases, including a waitlist phase ("WAITLIST"), a closed beta phase ("CLOSED_BETA"), a soft launch phase ("SOFT_LAUNCH"), a full launch phase ("FULL_LAUNCH"), and a growth phase ("GROWTH"). During the WAITLIST and CLOSED_BETA phases, public self-service registration may be disabled by CariHub Business Link, in which case the public registration page will display a notice explaining that registration is currently closed and, where applicable, will offer a waitlist sign-up form instead.

4.1.2 Closed-Beta Invite Codes. During the CLOSED_BETA phase, registration requires a valid invite code issued by CariHub Business Link. Invite codes are:

• (a) Non-Transferable: Each invite code is intended for the named recipient or recipient organisation identified by CariHub Business Link at the time of issuance. You may not share, publish, post, sell, barter, gift, or otherwise transfer an invite code to any other person or entity.
• (b) Limited Use: Each invite code has a maximum number of permitted redemptions and may expire on a specified date. A code that has reached its redemption limit or its expiry date will no longer be accepted.
• (c) Revocable: CariHub Business Link may revoke, disable, or invalidate any invite code at any time and for any reason, including suspected misuse, leakage, or fraud. Redemption of a revoked code will be rejected at registration.
• (d) Logged: The creation, redemption, disablement, re-enablement, and deletion of each invite code are recorded in the Platform audit log for security and compliance purposes.

4.1.3 Invite Code assignRole Field. Each invite code includes an assignRole field that determines the type of account that will be created upon redemption:

• (a) BUSINESS_ADMIN: The redemption creates a full business administrator account, which must complete the standard business setup workflow (business profile, services, staff, payment configuration, and subscription selection). A BUSINESS_ADMIN account has full access to the business-side features of the Platform.
• (b) TESTER: The redemption creates a lightweight tester account as described in Section 4.1.4 below. The redeeming user does not create a Business and does not have access to business-side features.

You acknowledge that the type of account you receive is determined by the invite code you redeem and that CariHub Business Link is not obligated to convert a TESTER account into a BUSINESS_ADMIN account. To obtain a BUSINESS_ADMIN account, you must obtain a BUSINESS_ADMIN invite code.

4.1.4 Tester Accounts. Accounts created with the TESTER role ("Tester Accounts") are lightweight, quality-assurance-only accounts. Tester Accounts:

• (a) Do not create a Business and do not have access to any business-side features (such as bookings, POS, CRM, marketing, financial reporting, or staff management).
• (b) Are restricted to the QA Test Tracker and audit log areas of the Platform's admin panel.
• (c) Are intended solely for internal quality assurance, product testing, and verification of Platform behaviour on behalf of CariHub Business Link.
• (d) May be terminated, suspended, or converted to a different role by CariHub Business Link at any time, with or without notice.
• (e) Are not entitled to any subscription, support, or service-level commitments.

You acknowledge that a Tester Account is not a substitute for a BUSINESS_ADMIN account and confers no rights to use the Platform for any commercial or business purpose.

4.2 Business Email Verification. You must register using a business email address associated with your organisation. We may require additional verification of your business identity, including but not limited to: business registration documents, proof of address, or government-issued identification of the account holder.

4.3 Account Security. You are solely responsible for:

• (a) Maintaining the confidentiality and security of your account credentials, including your password and any multi-factor authentication ("MFA") tokens or recovery codes.
• (b) All activities that occur under your account, whether or not you authorised such activities.
• (c) Ensuring that all Authorised Users have appropriate access levels and that access is promptly revoked when an individual's employment or authorisation ends.
• (d) Notifying us immediately of any unauthorised use of your account or any other breach of security.

4.4 Password Requirements. You must choose a strong password that meets our minimum security requirements, which include a minimum length, complexity requirements, and restrictions on commonly used passwords. We strongly recommend enabling MFA for all accounts.

4.5 Multi-Factor Authentication. We may require or offer MFA as an additional security layer. Where MFA is enabled, you are responsible for securely storing your MFA recovery codes and ensuring that your MFA device is available when needed.

4.6 Authorised Users. You may grant access to the Platform to staff members, contractors, or agents ("Authorised Users") subject to the following conditions:

• (a) Each Authorised User must have their own unique login credentials; shared credentials are not permitted.
• (b) You are responsible for each Authorised User's compliance with these Terms.
• (c) You grant Authorised Users only the minimum level of access necessary for their role (principle of least privilege).
• (d) Upon termination of an Authorised User's relationship with your business, you must promptly revoke their access.

4.7 Account Suspension and Termination by Us. We reserve the right to suspend or terminate your account if: (a) we reasonably believe there has been a breach of these Terms; (b) your account has been inactive for an extended period; (c) required by law or legal process; or (d) as otherwise described in Section 14 of these Terms.

4.8 Platform Admin Impersonation. We reserve the right to enable Platform Administrators to access your account via an "Impersonation" feature for the purposes of technical support, troubleshooting, and onboarding assistance. When impersonation is used: (a) a separate session is created in a new browser tab — your own session is not affected; (b) all actions taken during impersonation are audit-logged with the administrator's identity; (c) Platform Administrators cannot impersonate other platform admin accounts; (d) impersonation sessions are time-limited and require a one-time-use token. You consent to this access as a condition of using the Platform. If you do not consent to impersonation access, you must contact us to request that it be disabled for your account, understanding that this may limit our ability to provide technical support.

4.9 Web Push Notifications and Device Subscriptions. If you enable web push notifications, the Platform stores a push subscription record for your device, including the browser-provided push endpoint URL, an ECDH public key (p256dh), and an authentication secret. This data is used solely to deliver push notifications to your device. You may disable push notifications at any time through your browser settings or through the Platform's notification preferences, which will delete the push subscription record. Push notifications are delivered through your browser's push service (such as Mozilla Push Service, Google Firebase Cloud Messaging, or Apple Push Notification service) and are subject to those services' respective terms and privacy policies.

4.10 Session Duration. Your login session persists for up to thirty (30) days from your last activity, after which you will be required to re-authenticate. This extended session duration enables push notification click-throughs to land directly on the relevant alert without requiring re-login. If you wish to end your session sooner, you may sign out manually at any time. For security-sensitive operations (such as changing your password, modifying payment methods, or accessing billing information), we may require re-authentication regardless of the session duration.

4.11 Third-Party Login Providers (Sign in with Google). We offer "Sign in with Google" as an optional authentication method. The following terms apply to your use of third-party login providers:

• (a) Data received: When you sign in with Google, we receive your name, email address, and profile photo URL from Google. For sign-in, we do not request or receive your Google password, contacts, email contents, or file data. The scope of data we request for sign-in is limited to the minimum necessary for account authentication (openid, email, and profile). An optional Google Calendar two-way sync feature is planned but currently disabled — it is gated behind platform feature flags and Google's sensitive-scope verification. The terms that will apply to that integration when it launches are set out in Section 4.12 below.
• (b) Account creation: If you sign in with Google and no existing CariHub account is associated with your Google email address, we will automatically create a new CariHub account using the data Google provides. This account is subject to all terms of these Terms of Service.
• (c) Account linking: If you sign in with Google and an existing CariHub account is already associated with your Google email address, we will link the Google identity to that account and grant you access. To prevent unauthorised account access, we only link accounts when Google has verified your email address.
• (d) Provider terms: Your use of "Sign in with Google" is subject to Google's Terms of Service and Privacy Policy. We are not responsible for any actions taken by Google in connection with your Google account, including suspension, termination, or changes to Google's services.
• (e) Disconnecting: You may disconnect Google sign-in from your account at any time through your account settings. If you disconnect Google sign-in and have not set up an alternative authentication method (such as a password), you may lose access to your account. We recommend setting up a password before disconnecting Google sign-in.
• (f) Provider availability: We are not responsible for any outages, errors, or disruptions in Google's authentication service. If Google's sign-in service is unavailable, you may need to use an alternative authentication method.
• (g) Security: You are responsible for maintaining the security of your Google account. We are not liable for any unauthorised access to your CariHub account that results from a compromise of your Google account credentials.

4.12 Connected Accounts and Integrations. The Platform supports optional integrations with third-party services via OAuth ("Connected Accounts"). Currently, no third-party integrations are available to end users; the integrations described in this Section are disclosed prospectively so that you understand the terms that will apply when each is enabled. The currently-planned integration is Google Calendar Sync, described below.

• (a) Google Calendar Sync (planned, currently disabled). We are developing an optional Google Calendar two-way sync integration that will be made available to Business users only after (i) Google completes its sensitive-scope verification for our OAuth client, and (ii) CariHub enables the integration via a two-gate feature flag (an engineering-controlled environment variable and an admin-controlled database flag). Until both gates are open and verification is complete, the integration is invisible to users, no calendar scope is requested, and no calendar data is collected.
• (b) OAuth connection and tokens. When a user opts in to a Connected Account integration, CariHub redirects the user to the third party's OAuth consent screen. CariHub never receives or stores the user's third-party password. Following consent, CariHub stores an encrypted OAuth refresh token (AES-256-GCM at rest, using a platform-managed key) so the connection persists across sessions. Short-lived access tokens are requested on demand and are not persisted at rest.
• (c) Dedicated "CariHub" calendar pattern. For the Google Calendar integration, CariHub creates a single, clearly-labelled calendar named "CariHub" on the user's Google account. CariHub writes booking events to this calendar and reads back event changes the user makes to this calendar only. CariHub does not read, import, modify, or sync events from or to the user's personal calendars or any other Google Calendar data.
• (d) Data flow. From CariHub to the Connected Account: booking events (created, updated, cancelled) for the Business. From the Connected Account to CariHub: event changes the user makes directly to the CariHub calendar (e.g. moving a booking to a new time, deleting an event) are applied back to the underlying booking record in CariHub. No other Google data flows back to CariHub.
• (e) User control and disconnection. A user may disconnect a Connected Account at any time via Settings. Disconnection (i) revokes CariHub's OAuth grant with the third party via that party's token-revocation endpoint, (ii) deletes the stored encrypted refresh token from CariHub's database, and (iii) for the Google Calendar integration, removes the dedicated "CariHub" calendar from the user's Google account. Disconnection takes effect immediately.
• (f) Scope and re-grants. CariHub requests only the OAuth scopes necessary for the integration's stated purpose. If a future integration enhancement requires additional scopes, CariHub will request a fresh OAuth consent from the user for the new scopes; existing refresh tokens will not be silently expanded to cover broader scopes.
• (g) Provider terms. Use of any Connected Account integration is also subject to the third-party provider's terms of service and privacy policy. CariHub is not responsible for the provider's acts or omissions, including outages, scope-policy changes, or suspension of the provider's API access.
• (h) Integrations Policy. Further detail on current and planned integrations, data flows, sub-processors, and security controls is set out in our Integrations and Connected Accounts Policy, available at carihub.com/legal/integrations-policy, which is incorporated into these Terms by reference.

4.13 Account Types — Business, Client, and Dual-Role. The Platform supports the following account types:

• (a) Business Account. A Business Account is used to operate a business on the Platform. A Business Account holder (a Business Administrator, role BUSINESS_ADMIN) may create business profiles, manage services, staff, schedules, bookings, clients, payments, and the other business-side features described in Section 3. A Business Account may be created at registration or, if you initially registered as a Client, may be added later from Settings → Profile → Account Types.
• (b) Client Account. A Client Account is used to browse, book, and pay for services offered by businesses on the Platform. A Client Account holder (role CLIENT) accesses the client-facing portal. A Client Account may be created at registration or, if you initially registered as a Business Administrator, may be enabled later from Settings → Profile → Account Types.
• (c) Dual-Role Account. A Dual-Role Account is a single user account that has both a Business Account and a Client Account enabled at the same time. You may elect a Dual-Role Account at registration by selecting "Also sign me up as a client", or you may enable the second account type from Settings → Profile → Account Types after registration. In a Dual-Role Account, you can switch between the Business view (the business dashboard) and the Client view (the client portal) at any time using the header toggle. The underlying account — including your email address, password, multi-factor authentication settings, and login session — is shared across both roles.

4.13.1 Responsibility for Dual-Role Accounts. If you operate a Dual-Role Account, you are responsible for: (a) maintaining the security of both your business data (bookings, client records, financial data, staff management data) and your client data (your own bookings, payments, and communications with other businesses); (b) ensuring that activity performed in one role does not improperly affect the other role (for example, a booking you make as a Client of another business must not be modified using your Business Administrator privileges on your own business); and (c) all activity that occurs under your account in either role, whether or not you authorised such activity.

4.13.2 Disabling an Account Type. You may disable one of the two account types at any time from Settings → Profile → Account Types. Disabling a role removes your ability to act in that role but does not delete the underlying user account or the data associated with the disabled role (which is retained in accordance with Section 14.5 and the Privacy Policy §8).

4.14 Account Verification. Users who register with an email address and password must verify their email address before accessing most Platform features. Until verification is complete, the user's access is restricted to:

• (a) Account dashboard (view-only for most data);
• (b) Quick setup workflows (business profile, service catalog setup);
• (c) Business details configuration (branches, contact information);
• (d) Profile settings (including the ability to change the email address); and
• (e) The email verification page itself.

All other features — including but not limited to booking, client management, invoicing, point-of-sale, marketing, and staff management — are inaccessible until the email is verified. State-changing API requests from unverified accounts are rejected with a 403 EMAIL_NOT_VERIFIED error.

Users who register via Google OAuth are automatically verified at sign-in and are not subject to this gate.

"Verification tokens" (OTP codes and magic links) expire twenty-four (24) hours after issuance and are single-use. Resend requests are rate-limited to one (1) per sixty (60) seconds to prevent abuse. See the Privacy Policy §8.6 for data retention applicable to unverified accounts.

4.15 Business Registration Information, Trust Badges, and Compliance Reminders.

4.15.1 Optional, Self-Declared Information. The Platform lets a Business optionally state that it is legally registered and provide its legal business name, legal structure (for example sole trader, partnership, limited company, non-profit or co-operative), country of registration, date of registration, and registration number ("Registration Details"). Providing Registration Details is optional. All Registration Details are declared by the Business itself.

4.15.2 No Verification Against an Official Registry. CariHub Business Link does not verify any legal business name, registration number, legal structure, country of registration, or registration status against any official company, business-name, charity, tax, or other government registry. We have no access to such registries and make no representation that a Business is validly registered, exists as a legal entity, is in good standing, is licensed or authorised to carry on its business, or is compliant with any law.

4.15.3 Trust Badges. Where a Business has provided complete Registration Details, the Platform may display a badge on that Business's public directory listing and booking pages. There are two kinds:

• (a) "Registered · self-declared": the Business states that it is registered under the displayed legal name in the displayed country. It has not been verified by CariHub Business Link.
• (b) "Verified registration": a CariHub Business Link administrator reviewed documents supplied by the Business and marked the registration as verified as at the date shown. This is a limited, point-in-time review of the documents provided. It is not a registry search, an endorsement, a certification, or a guarantee of legal existence, good standing, licensing, tax status, quality, or the Business's conduct. We may decline to verify, and may remove a verified badge at any time, including if we have reason to doubt the information. A verified badge is removed automatically if the Business changes its legal name, legal structure, country of registration, or registration number.

Your registration number is visible only to you and to CariHub Business Link and is never shown publicly. Your legal name, legal structure, and country of registration are shown publicly next to the badge.

4.15.4 Your Responsibilities. You represent and warrant that all Registration Details you provide are accurate, complete, and not misleading, and that you are entitled to use the legal name you declare. You must not declare a registration, legal name, or verification status that does not belong to you, and you must keep your Registration Details up to date. We may remove any badge or Registration Details, and may suspend or terminate the account under Section 4.7, where we reasonably believe they are false or misleading.

4.15.5 No Reliance; Independent Verification. Customers and other third parties should not treat a badge as proof of registration or of any legal status and should verify a business independently with the relevant official registry before relying on it. To the fullest extent permitted by law, CariHub Business Link excludes all liability arising from any reliance on Registration Details or badges, subject to Section 12.

4.15.6 Business Names Are Not Unique. Business names, and legal names, are not required to be unique on the Platform. Two or more unrelated businesses, including businesses in different countries, may use the same or similar names, and a business may be registered in more than one country. Each Business's web address (slug) on the Platform is unique. We do not adjudicate disputes over names or trademarks; see the Intellectual Property Policy for how to report infringement.

4.15.7 Compliance Dates and Reminders. The Platform lets a Business create key dates and reminders (for example annual returns, tax filings, licence and permit renewals, and registration anniversaries) and suggests common items for the Business's country and legal structure. Suggestions are indicative only. Filing deadlines, licence terms, and legal requirements vary by country, legal structure, financial year-end, and circumstances and change over time, and we do not guarantee that any suggestion is complete, current, or applicable to you. Reminders are a convenience; delivery is not guaranteed (for example if a notification channel is disabled or unavailable), and they do not file, pay, renew, or check anything for you. Compliance dates, reminders, and any related content are not legal, tax, or accounting advice. You remain solely responsible for identifying and meeting your legal, tax, and licensing obligations and for confirming all dates with the relevant authority.

5. Subscription Plans and Pricing

5.1 Subscription Plans. The Platform is offered on a subscription basis with the following billing cycles: monthly, six-month ("semi-annual"), and yearly ("annual"). Subscriptions are billed in advance — the subscription fee for each billing period is due at the start of the period and covers your use of the Platform for that period. Longer billing periods may be offered at a discounted rate compared to monthly billing.

5.1.1 Prices and Currencies. Subscription prices are quoted and charged in Trinidad and Tobago Dollars (TTD) or United States Dollars (USD), as displayed at checkout. The currency in which you are charged is determined by your business's configured currency and the payment gateway you select. Where your payment method is denominated in a different currency, the payment processor will apply its prevailing exchange rate, and you may be subject to foreign-transaction fees charged by your bank or card issuer. The exact price for each plan, tier, and billing cycle is displayed at carihub.com/pricing and on the checkout page before you confirm your subscription.

5.2 Plan Selection. At the time of registration, you will select a subscription plan and tier. You may upgrade or downgrade your tier at any time, subject to the following:

• (a) Upgrades: Take effect immediately after payment confirmation. For gateway-processed payments (Stripe, PayPal, Fygaro, PayWise, LuniPay), the upgrade takes effect immediately upon successful authorisation at the gateway. For manual bank transfer payments, the upgrade takes effect immediately upon admin approval of the uploaded receipt (see Section 6.8). You will be charged a prorated amount for the remainder of your current billing period, and your new billing cycle will begin at the end of the current period.
• (b) Downgrades: Take effect at the start of your next billing period. You will retain access to your current tier features until the end of the current billing period.

5.3 Free Trial. We may offer a free trial period for new accounts. During the trial period, you will have access to features of a specified tier at no charge. At the end of the trial period, your account will automatically convert to a paid subscription at the tier and billing period you selected during signup, unless you cancel before the trial ends. We will send you a reminder email before the trial period expires.

5.4 Pricing. Current pricing for all plans and tiers is displayed on our pricing page at carihub.com/pricing. Prices are quoted in United States Dollars (USD) unless otherwise specified. We reserve the right to adjust pricing with at least thirty (30) days' advance written notice (via email or in-app notification). Price increases will not take effect until the start of your next billing period following the notice period.

5.5 Taxes. Prices do not include applicable taxes, duties, or similar charges ("Taxes"). You are responsible for all Taxes associated with your use of the Platform. Where we are legally required to collect Taxes (such as value-added tax or goods and services tax in certain Caribbean jurisdictions), we will add the applicable Tax to your invoice and remit it to the relevant tax authority on your behalf.

5.6 Marketing Add-On. An optional marketing add-on module may be available, providing enhanced campaign management, A/B testing, advanced segmentation, and additional communication credits beyond the base plan allocation.

5.7 Accounting Add-On. An optional accounting add-on module may be available, providing advanced financial reporting, tax filing assistance, general ledger integration, and automated bookkeeping features. The accounting module supports accounting periods: closing a period locks it so that no new or back-dated journal entries (including AI-agent financial actions and payment or refund records) can be posted into it; periods can be reopened by administrators for corrections, and every close, reopen, and reversal is audit-logged. Corrections to posted entries are made through reversing entries (mirrored entries that reference the original), never by editing or deleting posted records. Per-territory VAT/GST rate configuration and output-VAT splitting are provided as bookkeeping tooling only and do not constitute tax advice (see Section 12.6). The accounting module supports accounting periods: closing a period locks it so that no new or back-dated journal entries (including AI-agent financial actions and payment or refund records) can be posted into it; periods can be reopened by administrators for corrections, and every close, reopen, and reversal is audit-logged. Corrections to posted entries are made through reversing entries (mirrored entries that reference the original), never by editing or deleting posted records. Per-territory VAT/GST rate configuration and output-VAT splitting are provided as bookkeeping tooling only and do not constitute tax advice (see Section 12.6).

5.8 Communication Quotas. Each subscription plan includes monthly quotas for outbound communications, including emails, SMS messages, WhatsApp messages, marketing emails, and web push notifications. Quota limits vary by plan tier and are displayed on our pricing page and within your account settings. A value of "-1" indicates unlimited usage for that channel; a value of "0" indicates the channel is disabled for that plan. Quotas reset on the first day of each calendar month. If you exceed your quota for marketing communications, additional marketing messages will be blocked until the next reset. Transactional communications (booking confirmations, payment receipts, security alerts) will continue to be delivered even if the quota is exceeded, but the over-quota usage will be logged. You may upgrade your plan to obtain higher quotas.

5.9 Promotional Pricing. From time to time, we may offer promotional pricing, discounts, or special offers. Promotional pricing is valid for the initial subscription period only unless otherwise stated. After the promotional period ends, the standard pricing will apply.

6. Payment Terms

6.1 Accepted Payment Methods. We accept payment via credit and debit cards (Visa, Mastercard, American Express), as well as through the following Caribbean payment gateways: Stripe, Fygaro, LuniPay, PayWise, and other regional gateways as made available on the Platform. Payment is processed securely through these third-party payment processors; we do not store your full card details on our servers.

6.1.1 Multiple Active Payment Gateways (v1.9.0). The Platform may have multiple payment gateways (Stripe, PayPal, Fygaro, PayWise, and the SIM test adapter) active simultaneously at the platform level. There is no mutual exclusivity: activating one gateway does not deactivate the others. At subscription checkout, the payment-method picker shows all gateways the platform admin has activated, and you may select whichever gateway you prefer for that checkout. Your selection is recorded on your SubscriptionPayment row and your Subscription.gatewayName field; the selected gateway's subscription adapter handles the recurring billing flow for your subscription. If you upgrade or change plans later, you may select a different gateway for the new payment — your prior gateway choice is not binding. The platform reserves the right to activate, deactivate, or restrict gateways at any time based on territory availability, gateway uptime, gateway fee changes, or regulatory requirements; we will notify you of any material change to the gateways available in your territory at least thirty (30) days before the change takes effect, except where the change is required for security, fraud-prevention, or regulatory-compliance reasons (in which case the change may take effect immediately).

6.2 Billing Cycle. Your subscription fee will be billed at the start of each billing period (monthly, semi-annually, or annually) on the anniversary of your subscription start date. If your billing date falls on a date that does not exist in a given month (e.g., the 31st), billing will occur on the last day of that month.

6.3 Auto-Renewal. Your subscription will renew at the end of each billing period unless you cancel your subscription before the renewal date. You may cancel your subscription at any time through your account settings or by contacting our support team. For gateway-processed subscriptions (Stripe, PayPal, Fygaro, PayWise, LuniPay), renewal requires a fresh payment authorisation for each billing cycle — CariHub will send you a renewal reminder email not less than seven (7) days before the renewal date, and you must complete the payment before the renewal date to maintain uninterrupted access. For manual bank transfer subscriptions, see Section 6.8 — manual bank transfer subscriptions do not auto-renew.

6.3.1 Future Auto-Renew Feature (Gateway-Native Tokenisation). CariHub plans to launch an optional auto-renew feature for subscriptions paid through Stripe and PayPal, using gateway-native tokenisation. This feature is not yet active. When it launches, the following terms will apply:

• (a) Token storage. When you opt in to auto-renew, the gateway will issue a payment-method token (for example, a Stripe PaymentMethod ID or a PayPal vault payment_token) that CariHub stores encrypted at rest. CariHub will never store your full card number, CVV, or any gateway login credentials.
• (b) Billing date. The renewal charge will be processed automatically on the anniversary of your subscription start date, using the stored payment-method token.
• (c) Renewal notice. We will send you a renewal reminder email not less than seven (7) days before each renewal date, disclosing the renewal amount and the payment method to be charged.
• (d) Consent. Before enabling auto-renew, we will obtain your affirmative-action consent (an unchecked checkbox that you must check) together with a snapshot of the disclosure text shown at the time of consent.
• (e) Cancellation. You may cancel auto-renew at any time from Settings → Subscription → Cancel Auto-Renew. Cancellation takes effect at the end of the current billing period (you retain access through the end of the period you have already paid for). Cancellation is click-to-cancel in the same medium used to subscribe (online, no phone call required), in compliance with the California Auto-Renewal Law (Cal. Bus. & Prof. Code § 17600 et seq., including the 1 July 2025 amendments) and the Federal Trade Commission's negative-option rule principles.
• (f) Failed-payment dunning. If an auto-renew charge fails, we will follow the dunning process described in Section 6.4.
• (g) Fygaro, LuniPay, and manual bank transfer. Auto-renew will not be available for Fygaro, LuniPay, or manual bank transfer subscriptions, because these gateways do not expose a public auto-charge API or, in the case of manual bank transfer, require manual customer action. For these payment methods, the existing renewal-reminder + manual-payment flow described in Section 6.3 (above) continues to apply.
• (h) Compliance. The auto-renew feature will comply with PCI DSS v4.0.1 SAQ A, PSD2 Strong Customer Authentication (applicable to EU-issued card transactions processed by EEA-acquired payment service providers — CariHub itself is not a PSD2-regulated payment service provider), Regulation E (12 CFR Part 1005.10) for preauthorised electronic fund transfers, the California Auto-Renewal Law, and the Trinidad and Tobago Data Protection Act 2011. Further detail is documented in our internal Auto-Renew Analysis.

6.4 Dunning Process. If a payment fails, we will follow a dunning process as follows:

• (a) First Attempt Failure: We will retry the payment within three (3) business days and send you a notification of the failed payment.
• (b) Second Attempt Failure: If the retry fails, we will send a second notification and attempt payment again within five (5) business days.
• (c) Third Attempt Failure: If the second retry fails, we will send a final notification and attempt payment one last time within seven (7) business days.
• (d) Account Suspension: If all payment attempts fail, your account may be suspended, restricting access to paid features. Your data will be retained for a period of thirty (30) days following suspension, after which it may be deleted in accordance with Section 14.
• (e) Reactivation: You may reactivate a suspended account at any time by updating your payment information and paying any outstanding balance.

6.5 Currency. All subscription fees are charged in United States Dollars (USD) unless otherwise agreed in writing. If your payment method is denominated in a different currency, the payment processor will apply its prevailing exchange rate, and you may be subject to foreign transaction fees charged by your bank or card issuer.

6.6 Refunds. Subscription fees are non-refundable except as expressly stated in these Terms or as required by applicable law. We do not provide partial refunds for unused portions of a billing period unless such refunds are required by applicable law (for example, where a consumer-protection statute of the jurisdiction in which you reside mandates prorated refunds for cancelled subscriptions). Refund requests related to payment processing errors will be investigated and, if valid, processed within fourteen (14) business days. Gateway-processed refunds follow the gateway's refund policy and typically appear on your card or bank statement within three (3) to ten (10) business days from the date we initiate the refund. Manual bank transfer refunds are processed by reversing the original bank transfer or by issuing a credit note toward a future billing cycle, at your election, and typically appear on your bank statement within five (5) to ten (10) business days.

6.6.1 California Auto-Renewal Law Compliance. For subscriptions paid through the future auto-renew feature described in Section 6.3.1, and to the extent required by California Business and Professions Code § 17600 et seq. (the California Auto-Renewal Law, as amended effective 1 July 2025), we will: (a) present clear and conspicuous disclosure of the auto-renewal terms before obtaining your consent; (b) obtain your affirmative consent to the auto-renewal terms (via an unchecked checkbox that you must check); (c) provide an acknowledgement email or other notification after your consent that includes the auto-renewal terms, the cancellation policy, and instructions on how to cancel; (d) permit you to cancel auto-renew in the same medium you used to subscribe (online, click-to-cancel, no phone call required) as further described in Section 14.2.1; and (e) retain your consent record for three (3) years from the date of consent. Other jurisdictions' consumer-protection statutes that provide greater protections (including the consumer-protection statutes of other US states and the consumer-protection statutes of Trinidad and Tobago, Jamaica, Barbados, and other Caribbean jurisdictions) are honoured to the extent they apply to you.

6.6.2 Caribbean Consumer Protection Compliance. Our auto-renewal and recurring billing practices also comply with applicable Caribbean consumer protection legislation, including: the Consumer Protection and Safety Act, 2006 of Trinidad and Tobago; the Consumer Protection Act, 2005 of Jamaica; the Consumer Protection Act, Cap 336B of Barbados; and the Consumer Affairs Act, 2006 of Guyana. These statutes govern unfair contract terms, misleading advertising, and recurring billing disclosure requirements in their respective territories.

6.7 Invoicing. Invoices are generated electronically and made available in your account dashboard. You may request a formal tax invoice by contacting our support team. Invoices will include a description of services, the billing period, the amount charged, applicable taxes, and payment method information.

6.8 Manual Bank Transfer Payments. Where you select manual bank transfer as your payment method for a CariHub subscription (the "MANUAL" gateway), the following terms apply:

• (a) Free plan during pending upgrade. When you select a paid plan and pay by manual bank transfer at registration or via a plan upgrade, your subscription starts (or continues) on the Free plan. The paid plan you selected activates only after a CariHub platform administrator approves your uploaded payment receipt.
• (b) Bank-transfer initiation. You initiate a bank transfer to the CariHub platform bank account whose details (account name, masked account number, routing/SWIFT/IBAN where applicable, and reference) are disclosed in the manual-payment instructions presented at checkout and in your billing page after login.
• (c) Receipt upload. You upload a receipt (bank-transfer confirmation, deposit slip, or screenshot) via the receipt-upload endpoint (sourceType = PLATFORM_SUBSCRIPTION, sourceId = your SubscriptionPayment ID). The uploaded receipt is reviewed by CariHub's platform administrative team at the manual-payments review queue.
• (d) Seven-day upload window. You must upload a receipt within seven (7) days of selecting manual bank transfer. If you do not upload a receipt within seven (7) days, the pending upgrade is cancelled and you remain on the Free plan. You may re-initiate the upgrade at any time.
• (e) Admin approval. CariHub aims to review manual payment receipts within two (2) business days of upload. Upon approval, the corresponding SubscriptionPayment record is marked paid, the recurring-invoice schedule's first invoice is settled, and applyPendingPlanUpgrade is invoked to flip your subscription from the Free plan to the paid plan you selected. Best-effort and idempotent: a failure in the upgrade step does not roll back the approval (the payment is already recorded as paid), and admin retries are safe.
• (f) Receipt rejection. If CariHub rejects the uploaded receipt (for example, because the receipt is illegible, the transfer amount does not match, or the transfer was not received), you may request a refund of the transferred amount within fourteen (14) days of the rejection notice as described in the Cancellation, No-Show and Refund Policy §13.
• (g) Receipt retention. Uploaded receipts are retained for seven (7) years for tax and accounting compliance (see Privacy Policy §8).
• (h) No auto-renew. Manual bank transfer subscriptions do not auto-renew. You must initiate a new bank transfer and upload a new receipt for each billing cycle. CariHub will send a renewal reminder email not less than seven (7) days before the subscription expires.
• (i) Caribbean primary path. Manual bank transfer is acknowledged as a primary (not fallback) payment path for Caribbean SMBs, as further described in our Caribbean Scope Addendum §7.

7. Intellectual Property

7.1 CariHub Platform. All right, title, and interest in and to the CariHub Platform, including but not limited to: the software code, database structure, user interface design, visual elements, logos, trademarks, service marks, trade names, documentation, and any modifications, enhancements, or derivatives thereof (collectively, "CariHub IP"), are and shall remain the sole and exclusive property of CariHub Business Link or its licensors.

7.2 Limited License. Subject to your compliance with these Terms and payment of all applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Platform solely for your internal business operations during the term of your subscription. This license does not include the right to: (a) modify, adapt, or create derivative works of the Platform; (b) reverse engineer, decompile, or disassemble any part of the Platform; (c) sell, resell, lease, or redistribute the Platform; or (d) use the Platform for the benefit of any third party.

7.3 Your Content and Data. You retain all right, title, and interest in and to all content, data, and materials you upload, input, or generate through the Platform ("Your Content"). This includes but is not limited to: business listings, service descriptions, pricing, client information, appointment records, transaction data, marketing materials, images, logos, and communications.

7.4 License to Your Content. By using the Platform, you grant us a limited, non-exclusive, worldwide license to access, process, store, transmit, and display Your Content solely to the extent necessary to provide the Platform services, including: (a) storing your data in our databases; (b) processing payments on your behalf; (c) displaying your business listing to potential customers; (d) sending communications on your behalf; and (e) generating AI-assisted outputs based on your data. We do not use Your Content to train AI models or for any purpose beyond providing the Service, unless you explicitly opt in.

7.5 AI-Generated Content. Content generated by the AI assistant within the Platform is provided for your use. You are responsible for reviewing all AI-generated content before using it in any external communication or business process. We do not claim ownership of AI-generated outputs based on Your Content, but you acknowledge that such outputs may not be protectable under intellectual property laws to the same extent as human-authored content.

7.6 Feedback. You may voluntarily provide feedback, suggestions, or ideas regarding the Platform ("Feedback"). You hereby grant us a perpetual, irrevocable, royalty-free, worldwide license to use, modify, and incorporate any Feedback into the Platform without any obligation to compensate you.

7.7 Third-Party Content. The Platform may include or link to content, software, or services provided by third parties, including AI models from OpenAI, Anthropic, Google, xAI, Mistral, and OpenRouter. Third-party content is subject to the terms and conditions of the respective third-party providers, and we make no representations or warranties regarding such third-party content.

8. Acceptable Use

8.1 You agree to use the Platform only for lawful purposes and in accordance with these Terms. You shall not, and shall not permit any Authorised User or any third party to, engage in any of the following prohibited activities:

8.2 Prohibited Activities:

• (a) Illegal Activities: Using the Platform for any purpose that is unlawful, fraudulent, or violates any applicable law, regulation, or order in any jurisdiction, including but not limited to the laws of Trinidad and Tobago, Jamaica, Barbados, and other Caribbean nations.
• (b) Spam and Unsolicited Communications: Sending unsolicited bulk emails, SMS messages, or other communications in violation of the CAN-SPAM Act, the Privacy and Electronic Communications Regulations, or equivalent Caribbean legislation.
• (c) Data Scraping and Extraction: Using automated tools, bots, scrapers, or similar technology to extract, harvest, or collect data from the Platform, other businesses' listings, or customer information.
• (d) Malicious Code: Uploading, distributing, or transmitting any malware, viruses, trojans, worms, ransomware, or other malicious or harmful code.
• (e) Unauthorised Access: Attempting to gain unauthorised access to any part of the Platform, other users' accounts, or any systems or networks connected to the Platform.
• (f) Interference: Interfering with or disrupting the integrity or performance of the Platform, including through denial-of-service attacks, overloading infrastructure, or introducing corrupted data.
• (g) Reselling: Reselling, sublicensing, or redistributing access to the Platform without our prior written consent.
• (h) Reverse Engineering: Reverse engineering, decompiling, disassembling, or otherwise attempting to discover the source code of the Platform.
• (i) Quota Circumvention: Attempting to circumvent communication quotas by splitting messages across multiple accounts, using external email systems to bypass the Platform's sending infrastructure while still referencing Platform data, or otherwise evading the plan-tier communication limits.
• (j) Invite Code Misuse: Sharing, publishing, posting, selling, bartering, gifting, transferring, or otherwise disclosing a CLOSED_BETA invite code to any person other than the named recipient for whom the code was issued. Public disclosure of an invite code (including posting on social media, forums, paste sites, code repositories, or any publicly accessible location), selling or attempting to sell an invite code for monetary or other consideration, or redeeming an invite code that you obtained from a source other than CariHub Business Link or its authorised representatives is strictly prohibited and will result in immediate account termination and may result in legal action.

8.3 AI Usage Restrictions:

• (a) You must not use the AI assistant to generate content that is illegal, defamatory, discriminatory, harassing, threatening, or otherwise harmful.
• (b) You must review all AI-generated content before sending it to customers or using it in your business operations. AI-generated content must not be sent to customers without human review.
• (c) You must not use the AI assistant to make automated legal, medical, or financial decisions that could affect the rights or welfare of individuals.
• (d) You must respect opt-out requests and do-not-contact preferences when using AI-generated communications.

8.4 For a complete listing of acceptable use requirements, please refer to our Acceptable Use Policy, which is incorporated herein by reference and available at carihub.com/acceptable-use.

9. User-Generated Content

9.1 As a business using the Platform, you are responsible for all content you create, upload, publish, or transmit through the Platform ("User-Generated Content" or "UGC"). This includes, but is not limited to:

• (a) Business name, description, and listings.
• (b) Service descriptions, pricing, and availability.
• (c) Images, videos, logos, and branding materials.
• (d) Reviews and ratings of your services.
• (e) Email and SMS communications sent to your clients.
• (f) E-signature documents, consent forms, and waivers.
• (g) Social media posts and marketing content.
• (h) SEO aliases, meta tags, structured data, and other search optimization content associated with your services, products, events, and business profile.
• (i) Landing page content created using the page editor, including FAQ entries, testimonials, and custom text.
• (j) Feedback submissions, including bug reports, feature requests, questions, and any attachments uploaded through the feedback system.

9.2 Content Accuracy. You represent and warrant that all User-Generated Content is accurate, truthful, and not misleading. Specifically:

• (a) Your business listing must accurately represent your business, including its name, location, contact information, services offered, and pricing.
• (b) Pricing displayed on the Platform must reflect your actual prices at the time of display.
• (c) You must not impersonate another business or individual.
• (d) Reviews and testimonials must reflect genuine customer experiences and must not be fabricated or incentivised in a misleading manner.

9.3 Content Rights. You represent and warrant that you have all necessary rights, licences, and permissions to use and authorise us to process all User-Generated Content, including intellectual property rights in images, logos, and written content.

9.4 Content Moderation. We reserve the right, but not the obligation, to review, monitor, and remove User-Generated Content that we reasonably believe violates these Terms, applicable law, or the rights of any third party. We are not liable for any failure to detect or remove objectionable content.

9.5 Customer Reviews. Customers of your business may leave reviews and ratings through the Platform. You agree that: (a) reviews represent the personal opinions of the reviewers; (b) you may request the removal of reviews that you believe are defamatory, fraudulent, or violate our review guidelines; and (c) we reserve the right to remove reviews that violate our policies.

10. Data Protection and Privacy

10.1 We are committed to protecting your privacy and the privacy of your customers. Our collection, use, storage, and sharing of personal data is governed by our Privacy Policy, which is available at carihub.com/privacy and is incorporated herein by reference.

10.2 Data Controller and Processor. With respect to your business data and your customers' personal data, you are the data controller and we act as your data processor. Our obligations as a data processor are set out in the Data Processing Agreement ("DPA"), which is available at carihub.com/dpa and forms part of these Terms.

10.3 With respect to data we collect about you as a user of our Platform (such as your account information, payment data, and usage data), we act as a data controller, and our Privacy Policy applies.

10.4 Caribbean Data Protection. We comply with applicable data protection legislation across the Caribbean region, including the Data Protection Act, 2011 (Act No. 12 of 2011) of Trinidad and Tobago (partially proclaimed), the Data Protection Act, 2020 of Jamaica (fully enforceable since 1 December 2023), the Data Protection Act, 2019-29 of Barbados (in force since 26 March 2021), the Data Protection Act, 2017 of the Cayman Islands (in force since 30 September 2019), the Data Protection (Privacy of Personal Information) Act, 2003 of The Bahamas (in force), the Data Protection Act, 2023 (Act No. 18 of 2023) of Guyana (commencement pending), the Data Protection Act, 2021 (Act No. 45 of 2021) of Belize (commencement pending), the Data Protection Act, Cap 8.18 of Saint Lucia (partially in force since January 2023), the Privacy Act, 2003 of St Vincent and the Grenadines (in force), the Data Protection Act, 2018 of St Kitts and Nevis (commencement pending), and noting that the Turks and Caicos Islands have no standalone comprehensive data protection legislation (the Electronic Transactions Ordinance permits the Governor to make data-processing regulations), and that Antigua and Barbuda, Dominica, Grenada, and Montserrat have not enacted the OECS Model Data Protection Bill. Where local legislation provides greater protections than are described in our Privacy Policy, the local legislation shall prevail.

10.5 Cross-Border Data Transfers. Given that certain service providers we use are based outside the Caribbean (primarily in the United States), some personal data may be transferred internationally. Such transfers are made in accordance with applicable data protection laws, including through the use of Standard Contractual Clauses, adequacy decisions, or other legally recognised transfer mechanisms.

10.6 Data Retention. We retain your data for as long as your account is active and for a reasonable period thereafter as described in our Privacy Policy. Upon termination of your account, we will delete or return your data as described in Section 14 of these Terms.

10.7 Platform Broadcasts. The Platform's administrators may send broadcast messages to you and other business admins regarding service outages, security advisories, product updates, or other important platform-wide information. These broadcasts are delivered via in-app notifications, email, and web push (if enabled). Broadcast messages are retained in your notification feed and may be dismissed but are logged in our systems for delivery verification.

10.8 Audit Log Retention. Audit log entries are retained according to the retention profile configured for your business. The default retention periods are: seven hundred and thirty (730) days for critical-severity events, three hundred and sixty-five (365) days for high-severity events, and one hundred and eighty (180) days for standard business operations. You may configure a more restrictive retention profile, but not a more permissive one than applicable law allows. Audit logs containing personal data are processed in accordance with this Privacy Policy and the DPA.

10.9 Business-Connected Communication Providers (BYOK). The Platform offers an optional Bring Your Own Key (BYOK) feature that allows you to connect your own Resend account or Twilio SendGrid (Twilio Email) account (for email) and/or your own Twilio account (for SMS and WhatsApp) so that outbound messages route through your own provider account rather than the Platform's shared sub-processor accounts. The following terms apply:

• (a) You Are the Contracting Party. When you connect your own Resend, Twilio SendGrid, or Twilio account, you — not CariHub Business Link — are the contracting party with that provider. The BYOK provider becomes a sub-processor engaged by you (the Data Controller), not by CariHub Business Link. CariHub Business Link has no contract with your BYOK provider and is not a party to that relationship.
• (b) CariHub Business Link' Limited Role. CariHub Business Link' role is limited to: (i) transmitting message content and recipient data to the BYOK provider's API on your behalf at send time; (ii) storing your BYOK API credentials encrypted at rest using AES-256-GCM and transmitting them to the BYOK provider only at send time or webhook signature verification; and (iii) receiving bounce, complaint, delivery, and inbound-message webhooks from your BYOK provider account and acting on them (per-business suppression-list writes, delivery-status updates) in accordance with your instructions.
• (c) Plan-Gated Premium Feature. BYOK is a plan-gated premium feature. Each BYOK channel (email via Resend, email via Twilio SendGrid, SMS, WhatsApp) is gated by an independent feature key (COMM_BYOK_RESEND, COMM_BYOK_TWILIO_EMAIL, COMM_BYOK_TWILIO_SMS, COMM_BYOK_TWILIO_WHATSAPP) that may be enabled on your Plan by a Platform Administrator. BYOK feature keys are not included in any Plan by default. For the email channel, you may select between Resend and Twilio Email (SendGrid) as your BYOK email provider.
• (d) Quota and Policy Gates. BYOK sends are exempt from the Platform-wide send-limit counter (which protects the Platform's shared sub-processor quota) but your plan-tier communication quota and the Platform's policy gates (consent, suppression list, quiet-hours) remain enforced upstream of the BYOK routing decision. BYOK does not exempt you from any consent, frequency-cap, or suppression obligation under these Terms, the AUP, the DPA, or applicable law.
• (e) Force-Fallback. CariHub Business Link may, at its sole discretion, force-fallback outbound routing from your BYOK provider to the Platform's shared account (or suspend BYOK routing entirely) if your BYOK credentials fail authentication, your BYOK provider account is suspended or terminated, the plan feature gating the BYOK channel is downgraded or removed, or CariHub Business Link reasonably believes continued BYOK routing would violate these Terms, the AUP, the DPA, applicable law, or the BYOK provider's acceptable use policy. CariHub Business Link will use reasonable efforts to notify you of any forced fallback.
• (f) Email Routing Switch. For the email channel, with an active, verified BYOK Resend or Twilio Email (SendGrid) configuration, you may flip outbound email routing between your own BYOK account and the Platform's shared account at any time without disconnecting the BYOK configuration. You may also select which BYOK email provider (Resend or Twilio Email) carries your outbound email when BYOK routing is active. The routing selection applies only to your outbound email.
• (g) Business Communication Usage Panel. The Platform provides a read-only Business Communication Usage Panel showing your per-channel send counts, plan-tier limits, BYOK-active status per channel, provider route (byok / platform / dry-run), and recent CommunicationLog entries. The panel does NOT include your BYOK provider's own usage counters; you must consult your BYOK provider's dashboard for provider-side usage and billing.
• (h) Cross-References. BYOK use is also governed by: (i) the Acceptable Use Policy §6.5 (Bring Your Own Communication Provider); (ii) the Subscription and Billing Agreement §15.2 (Bring Your Own Communication Provider (BYOK)); (iii) the Privacy Policy §6.5 (Business-Connected Communication Providers); and (iv) the Data Processing Agreement §4.6 (Business-Connected (BYOK) Sub-Processors). In the event of any conflict between this Section 10.9 and those cross-referenced provisions, the more Business-protective provision regarding BYOK provider responsibility shall apply as to your BYOK provider's acts or omissions, and the more CariHub Business Link-protective provision shall apply as to CariHub Business Link' acts or omissions.

11. Service Availability and Service Level

11.1 We strive to provide a reliable and available Platform, but we do not guarantee uninterrupted or error-free service. The Platform is provided on an "as is" and "as available" basis.

11.2 No Guaranteed Uptime. We do not provide a guaranteed service level agreement ("SLA") with minimum uptime commitments as part of the standard subscription. We use commercially reasonable efforts to maintain the availability of the Platform, but we do not warrant that the Platform will be available at all times, without interruption, or free from errors or defects.

11.3 Scheduled Maintenance. We may perform scheduled maintenance on the Platform during reasonable hours, typically during low-traffic periods. We will provide at least forty-eight (48) hours' advance notice of scheduled maintenance via email or in-app notification. Scheduled maintenance is not considered downtime or a service interruption.

11.4 Emergency Maintenance. We may perform emergency maintenance without prior notice when necessary to address security vulnerabilities, critical bugs, or other urgent issues that could affect the Platform's functionality or security.

11.5 Service Degradation. Temporary degradation of service, including but not limited to slower response times, limited functionality, or intermittent outages, may occur and does not constitute a material breach of these Terms.

11.6 Third-Party Dependencies. The Platform relies on third-party services for hosting (Vercel), databases (Supabase/PostgreSQL), file storage (Cloudflare R2), payment processing (Stripe, Fygaro, LuniPay, PayWise, and others), email (Resend, Brevo), SMS (Twilio), AI services (OpenAI, Anthropic, Google, xAI, Mistral, OpenRouter), and browser push services (Mozilla Push Service, Google Firebase Cloud Messaging, Apple Push Notification service) for web push notification delivery. These third-party services are engaged by CariHub Business Link and operate under the shared sub-processor arrangement described in the Privacy Policy §6 and the DPA §4. We are not responsible for outages, errors, or failures caused by these third-party services.

Where a Business has enabled Bring Your Own Key (BYOK) under Section 10.9, that Business's outbound communications for the BYOK channel route through the Business's own Resend or Twilio account, which is engaged by the Business (not CariHub Business Link) as described in Section 10.9, the Privacy Policy §6.5, the DPA §4.6, and the Subscription and Billing Agreement §15.2. CariHub Business Link is not responsible for outages, errors, account suspensions, AUP violations, sender-reputation damage, carrier throttling, or any other failure originating with a Business's BYOK provider. Forced fallback from a BYOK provider to the Platform's shared account is governed by Section 10.9(e).

11.7 Force Majeure. We shall not be liable for any failure or delay in performing our obligations under these Terms to the extent that such failure or delay is caused by circumstances beyond our reasonable control, including but not limited to: natural disasters, pandemics, wars, terrorism, riots, government actions, internet outages, power failures, or third-party service failures.

12. Limitation of Liability

12.1 TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, STRATA CREATIONS AND ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AFFILIATES, SUCCESSORS, AND ASSIGNS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO: LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, LOSS OF BUSINESS OPPORTUNITY, BUSINESS INTERRUPTION, LOSS OF GOODWILL, OR COST OF SUBSTITUTE SERVICES, REGARDLESS OF THE CAUSE OF ACTION OR THE THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

12.2 Liability Cap. In no event shall our total aggregate liability to you for all claims arising out of or relating to these Terms or the Platform, whether in contract, tort, or otherwise, exceed the total fees paid by you to us during the twelve (12) month period immediately preceding the event giving rise to the claim, or Five Hundred United States Dollars (USD $500.00), whichever is greater.

12.3 Exclusions from Liability Cap. The liability cap in Section 12.2 shall not apply to: (a) our obligation to indemnify you under Section 13; (b) our liability for death or personal injury caused by our negligence; (c) our liability for fraud or fraudulent misrepresentation; or (d) any liability that cannot be limited by applicable law.

12.4 No Warranty of Merchantability or Fitness. THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO: IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE PLATFORM WILL MEET YOUR REQUIREMENTS, BE ERROR-FREE, OR OPERATE WITHOUT INTERRUPTION.

12.5 No Responsibility for Your Content. We are not responsible for the accuracy, legality, or appropriateness of any User-Generated Content, nor are we liable for any loss or damage arising from your reliance on User-Generated Content or AI-generated outputs.

12.6 No Financial Advice. The Platform's financial reporting and accounting features are provided for informational purposes only. Nothing on the Platform constitutes financial, tax, accounting, or legal advice. You should consult with a qualified professional advisor for matters specific to your business and jurisdiction.

12.7 No Responsibility for Payment Processing. While we facilitate payment processing through third-party gateways, we are not a party to the transaction between you and your customers. We are not liable for any payment processing errors, chargebacks, fraud, or other issues arising from the use of third-party payment gateways.

13. Indemnification

13.1 You agree to indemnify, defend, and hold harmless CariHub Business Link and its officers, directors, employees, agents, affiliates, successors, and assigns from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) ("Claims") arising out of or relating to:

• (a) Your use of the Platform in violation of these Terms or applicable law.
• (b) Your User-Generated Content, including any claim that such content infringes the intellectual property rights, privacy rights, or any other rights of any third party.
• (c) Your breach of any representation, warranty, or obligation under these Terms.
• (d) Any dispute between you and your customers, employees, or third parties arising from your use of the Platform.
• (e) Any AI-generated content that you publish, send, or otherwise use without adequate human review.
• (f) Any taxes, duties, or other government charges imposed on you in connection with your use of the Platform.
• (g) Any claims arising from the products or services you offer through the Platform.

13.2 Indemnification Procedure. We will notify you promptly of any Claim for which we seek indemnification. You shall have the right to control the defence and settlement of such Claim, provided that: (a) you keep us reasonably informed of the status of the defence; (b) you do not settle any Claim without our prior written consent if such settlement would impose any obligation on us or admit any fault on our part; and (c) you cooperate fully with us in the defence of the Claim. We may participate in the defence at our own expense with counsel of our choosing.

13.3 Survival. Your indemnification obligations under this Section shall survive the termination or expiration of these Terms and your use of the Platform.

14. Term and Termination

14.1 Term. These Terms take effect when you accept them and continue for as long as you maintain an active account on the Platform, unless terminated earlier in accordance with this Section.

14.2 Termination by You. You may terminate your subscription and close your account at any time by: (a) contacting our support team; or (b) using the account cancellation feature in your dashboard (Settings → Subscription → Cancel Subscription). Termination by you will take effect at the end of your current billing period, unless you request immediate termination.

14.2.1 Click-to-Cancel. To the extent required by California Business and Professions Code § 17600 et seq. (as amended 1 July 2025) and equivalent consumer-protection laws in other jurisdictions, you may cancel your subscription in the same medium you used to subscribe. If you subscribed online, you may cancel online (via Settings → Subscription → Cancel Subscription) — no telephone call, chat, or in-person visit is required. The online cancellation flow does not require you to speak with a retention agent, does not require you to provide a reason for cancellation (although you may optionally provide one), and is effective immediately upon confirmation. A confirmation email is sent to the address associated with your account. For the avoidance of doubt, this Section 14.2.1 applies to all subscription cancellations, whether or not the subscription was on auto-renew.

14.2.2 Manual Bank Transfer — Pending Payment. If you have a pending manual bank transfer (a SubscriptionPayment with status pending for which a receipt has not yet been approved) at the time you cancel your subscription, cancelling your subscription does not cancel the pending payment. If the bank transfer has not yet been initiated by you, no payment is due. If you have already initiated the bank transfer but have not uploaded a receipt, you may upload a receipt and CariHub will review it; if approved, the paid plan activates for the remaining billing period after which the cancellation takes effect. If the bank transfer has been initiated and a receipt uploaded but not yet reviewed, CariHub's review proceeds on the normal timeline; if the receipt is approved, the payment is non-refundable (it has already been collected and the plan was activated); if the receipt is rejected, you may request a refund of the transferred amount as described in the Cancellation, No-Show and Refund Policy §13. To request a refund of an unprocessed manual payment, contact support@carihub.com.

14.2.3 Effect of Cancellation on Data. Upon cancellation, your business data is retained for ninety (90) days after the cancellation effective date, after which it is permanently deleted from our active production systems in accordance with Section 14.5. You may export your data before cancellation from Settings → Data Export. After the 90-day retention window, you may request a Certificate of Deletion from privacy@carihub.com.

14.3 Termination by Us. We may suspend or terminate your account and access to the Platform: (a) immediately and without notice if we reasonably believe you have violated these Terms in a manner that causes harm to other users, the Platform, or third parties; (b) upon thirty (30) days' written notice for any other material breach of these Terms, if such breach is not cured within the notice period; (c) if we are required to do so by law, regulation, or legal process; (d) if we cease to offer the Platform or a material component thereof; or (e) if your account has been suspended for non-payment for more than thirty (30) days.

14.4 Effect of Termination. Upon termination of your account:

• (a) Your right to access and use the Platform will cease immediately.
• (b) All outstanding fees owed by you will become immediately due and payable.
• (c) Your Authorised Users will lose access to the Platform.
• (d) Any public-facing business listings may be removed or marked as inactive.

14.5 Data Return and Deletion. Following termination:

• (a) Data Export: You may request a complete export of your data in a structured, machine-readable format (such as JSON or CSV) within thirty (30) days of termination. This export will include all business data, client records, transaction history, and other content you have uploaded.
• (b) Data Deletion: If you do not request a data export within the thirty (30) day period following termination, or upon your written request, we will permanently delete all of your data from our systems, including backups, within ninety (90) days of the earlier of: (i) the expiration of the thirty-day data export period; or (ii) your written request for deletion.
• (c) Certification of Deletion: Upon request, we will provide written confirmation that your data has been permanently deleted from our active systems and will be deleted from backup systems within the standard backup rotation cycle (not to exceed one hundred and eighty (180) days).
• (d) Residual Data: Notwithstanding the above, we may retain: (i) anonymised, aggregated, or statistical data derived from your usage; (ii) records required for legal compliance or to resolve disputes; and (iii) copies of data in backup systems that are overwritten in the ordinary course of business.

14.6 Survival. Sections 7 (Intellectual Property), 8 (Acceptable Use), 9 (User-Generated Content), 10 (Data Protection), 12 (Limitation of Liability), 13 (Indemnification), and 15 (General Provisions) shall survive the termination of these Terms.

15. Dispute Resolution

15.1 Governing Law. These Terms shall be governed by and construed in accordance with the laws of the Republic of Trinidad and Tobago, without regard to its conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply.

15.2 Jurisdiction. Any dispute arising out of or relating to these Terms shall be subject to the exclusive jurisdiction of the courts of the Republic of Trinidad and Tobago. Each party irrevocably submits to the jurisdiction of such courts and waives any objection based on venue or forum non conveniens.

15.3 Informal Resolution. Before initiating any formal legal proceedings, you agree to first contact us at legal@carihub.com to attempt to resolve the dispute informally. We will attempt to resolve the dispute within thirty (30) days of receiving your notice. If the dispute is not resolved within this period, either party may proceed with formal dispute resolution.

15.4 Arbitration. If the dispute is not resolved through informal resolution, you and we agree to submit the dispute to binding arbitration administered under the Arbitration Act of Trinidad and Tobago. The arbitration shall be conducted by a single arbitrator appointed in accordance with the rules of the Chartered Institute of Arbitrators (Caribbean Branch). The arbitration shall be conducted in English, and the venue shall be Port of Spain, Trinidad and Tobago, unless otherwise agreed by the parties.

15.5 Arbitration Procedure. The arbitrator shall have the authority to grant any remedy or relief that would be available from a court of competent jurisdiction. The arbitrator's decision shall be final and binding, and judgment upon the award may be entered in any court of competent jurisdiction.

15.6 Waiver of Class Action. YOU AGREE THAT ANY DISPUTE ARISING OUT OF OR RELATING TO THESE TERMS SHALL BE RESOLVED ON AN INDIVIDUAL BASIS ONLY. YOU WAIVE ANY RIGHT TO BRING OR PARTICIPATE IN A CLASS ACTION, COLLECTIVE ACTION, OR REPRESENTATIVE PROCEEDING. You may not seek to represent or act on behalf of a class or group of similarly situated users.

15.7 Exceptions. Notwithstanding the above, either party may seek injunctive or equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of intellectual property rights or confidentiality obligations.

16. General Provisions

16.1 Severability. If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court or arbitrator of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, shall be severed from these Terms. The remaining provisions shall continue in full force and effect.

16.2 Entire Agreement. These Terms, together with the Privacy Policy, Acceptable Use Policy, Cookie Policy, Data Processing Agreement, and any other policies or agreements expressly incorporated by reference, constitute the entire agreement between you and us regarding the subject matter hereof, and supersede all prior or contemporaneous negotiations, representations, warranties, understandings, and agreements between the parties, whether written or oral.

16.3 Amendments. We reserve the right to amend or update these Terms at any time. We will provide at least thirty (30) days' advance notice of material changes by: (a) posting the updated Terms on the Platform and updating the "Last Updated" date; (b) sending an email notification to the address associated with your account; and/or (c) displaying a prominent in-app notification. Your continued use of the Platform after the effective date of the amended Terms constitutes acceptance of the updated Terms. If you do not agree to the amended Terms, you must terminate your account before the effective date.

16.4 Notices. All legal notices required or permitted under these Terms shall be in writing and delivered: (a) by email to legal@carihub.com (for notices to us) or to the email address associated with your account (for notices to you); (b) by registered mail to our registered address; or (c) by in-app notification. Notices shall be deemed received upon sending if by email, upon delivery if by registered mail, and upon display if by in-app notification.

16.5 Assignment. You may not assign, transfer, or delegate these Terms or any rights or obligations hereunder without our prior written consent. We may assign these Terms and our rights and obligations hereunder to any affiliate, successor in interest, or acquirer without your consent, provided that the assignee assumes all of our obligations under these Terms.

16.6 Waiver. The failure of either party to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision. Any waiver must be in writing and signed by the waiving party to be effective.

16.7 No Agency. Nothing in these Terms creates an agency, partnership, joint venture, or employment relationship between you and us. You are an independent contractor, and nothing in these Terms shall be construed to make you our agent, partner, joint venturer, or employee.

16.8 Third-Party Beneficiaries. Except as expressly stated herein, these Terms do not create any rights in any third party. The third-party service providers referenced in these Terms are intended third-party beneficiaries only to the extent necessary to enforce the limitations of liability and disclaimers of warranties applicable to their respective services.

16.9 Headings. The section headings in these Terms are for convenience only and shall not affect the interpretation of these Terms.

16.10 Counterparts. These Terms may be executed in counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. Electronic counterparts, including PDF and email copies, shall be deemed original counterparts for all purposes.

17. Contact Information

If you have any questions, concerns, or feedback regarding these Terms of Service, please contact us at:

CariHub Business Link (Operator of CariHub)

• Email: legal@carihub.com
• General Support: support@carihub.com
• Website: carihub.com

For data protection and privacy inquiries, please contact our Data Protection Officer at privacy@carihub.com.

By using the CariHub Platform, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service.