Back to site

Legal

Terms of Service

The agreement between Codingraph S.A. and the business using Nomi. Written to be read: what we owe you, what you owe us, and what happens when something goes wrong. A signed order form or enterprise agreement, if you have one, sits on top of this and wins where the two disagree.

In effect since · Codingraph S.A. · Costa Rica

The agreement

These Terms of Service (the “Terms”) are a contract between Codingraph S.A., registered as 3-101-938304 Sociedad Anónima, a company organised under the laws of Costa Rica (“Codingraph”, “we”), and the organisation that creates an account or otherwise uses the Service (“ Customer”, “you”).

Nomi is the platform; Codingraph is the company that operates it. NOMI is a registered trademark held by its owner, separately from Codingraph, which uses the trademark and provides the Service under licence from that owner. Your contract, your invoices and your support relationship are with Codingraph S.A. Nothing in these Terms gives Codingraph — or you — ownership of the NOMI brand.

You accept the Terms by creating an account, signing an order form that references them, or using the Service. If you are accepting on behalf of a company, you confirm you are authorised to bind it. If you do not have that authority, or do not accept these Terms, do not use the Service.

Nomi is sold to organisations. It is not offered to consumers acting outside a trade or profession.

Definitions

  • Service — the Nomi API, console, connectors, credential rendering and delivery, documentation and support that we make available to you.
  • Credential — a digital membership, badge, identification, ticket or similar object issued through the Service.
  • Subject — the person a Credential is about, and the holder of it.
  • Customer Data — everything you or your Users send to the Service, including Subject records, artwork, credential designs and configuration.
  • User — someone you authorise to use the console or an API key on your behalf.
  • Wallet Platform — Apple Wallet, Google Wallet or another third-party wallet a Credential is delivered to.

The service and your account

Subject to these Terms and to payment of the applicable fees, we grant you a non-exclusive, non-transferable, worldwide right to use the Service during the term, for your own internal business purposes and for issuing Credentials to your own Subjects.

You are responsible for your account: keeping credentials and API keys secret, assigning roles sensibly, removing Users who leave, and for everything done under your account. Tell us at security@nomi-tech.com as soon as you suspect a key has leaked or an account is compromised — we can rotate keys and revoke sessions faster than you can undo the damage.

You may use the API programmatically within the rate limits published in the documentation. You may not resell the Service, or give access to a third party other than a contractor acting for you and bound to these Terms, whose acts and omissions remain your responsibility.

Fees and billing

Fees are those on your order form or, absent one, the plan you selected at sign-up. Unless stated otherwise, fees are quoted in United States dollars, are payable in advance, and are non-refundable except where these Terms or the law say otherwise.

Usage-based charges are billed in arrears on the metered counts our systems record. Fees exclude taxes; you pay any sales, use, value-added, withholding or similar taxes, other than taxes on our income. Late amounts may accrue interest at the lesser of 1.5% per month or the maximum the law allows, and we may suspend the Service for non-payment after giving you at least 10 days' written notice and a chance to cure.

We may change prices for a renewal term with at least 30 days' notice before the renewal date. If a free tier, trial or pilot is offered, it is provided as described in clause 9 and may be changed or withdrawn at any time.

Customer Data and your duties

Customer Data is yours. You grant us only the licence needed to run the Service for you: to host, copy, transmit, render, transform and display Customer Data in order to provide, secure, support and maintain the Service, and to comply with the law. We acquire no other rights in it.

You are responsible for ensuring that:

  • you have a lawful basis, and any consent or notice the law requires, to send us data about a Subject and to issue that Subject a Credential;
  • Customer Data is accurate, and that you correct or remove it when it stops being accurate — a Credential is only as truthful as the record behind it;
  • you have the rights to the artwork, logos, trade marks and fonts you upload, and that their use on a Credential does not infringe anyone;
  • your use of the Service complies with the laws that apply to you, including data protection, consumer protection, employment and sanctions laws.
Data you must not send us. The Service is not designed or certified for special categories of personal data or regulated payment data. Do not upload health or medical records, biometric templates used to identify a person, data revealing race or ethnic origin, religion, political opinions, sexual orientation or trade union membership, criminal convictions, government identity document numbers used as an identity credential, payment card numbers, or anything subject to HIPAA, PCI DSS or comparable regimes, unless we have agreed to it in writing beforehand. A Credential issued through Nomi is not a government-issued identity document and must not be presented as one.

You can export Customer Data through the console and the API at any time during the term.

Acceptable use

You must not, and must not permit anyone to:

  • issue Credentials that impersonate another organisation, or that misrepresent an entitlement, status or affiliation the Subject does not have;
  • use the Service for fraud, phishing, unlawful surveillance, or to deceive a Subject about what a Credential does;
  • probe, scan or test the security of the Service except under the disclosure programme on our Security page; interfere with its operation; or circumvent rate limits, quotas, or access controls;
  • reverse engineer, decompile or attempt to derive the source code of the Service, except to the extent that restriction is unenforceable by law;
  • use the Service to build a competing product, or benchmark it for publication without our written consent;
  • upload malware, or content that is unlawful, defamatory or infringing.

Report abuse of the Service to abuse@nomi-tech.com.

Data protection

For personal data in Customer Data, you are the controller and we are the processor. We process it only on your documented instructions — which these Terms, the console and the API constitute — keep it confidential, apply the measures described on the Security page, assist you with data subject requests and with security incidents, and delete or return it on termination as described in our Privacy Policy.

You authorise the subprocessors listed in the Privacy Policy and the appointment of replacements on notice, with a right to object on reasonable data protection grounds. Where the GDPR or another law requires a data processing agreement with specific terms, we will enter into our standard DPA on request to legal@nomi-tech.com; once signed, it forms part of these Terms and prevails over this clause.

Apple Wallet and Google Wallet

Wallet Platforms are third-party services, run by companies we do not control. Delivering a Credential to one means complying with that platform's own rules — the Apple Developer Program agreements and Apple's wallet guidelines, the Google Wallet API Terms of Service and Google's issuer and brand guidelines — and you agree to comply with them for Credentials you issue.

Where Credentials are issued under your own developer or issuer account, you keep that relationship and you authorise us to act on your behalf within it. A Wallet Platform may suspend an account, reject a design or change its rules at any time; if that prevents delivery, we will tell you and work around it where we reasonably can, but we are not liable for their decisions. Apple Wallet and Google Wallet are trade marks of their respective owners, and Nomi is not affiliated with, sponsored or endorsed by them.

Availability, support and beta features

We aim to keep the Service available and to fix faults promptly, and we provide support by email during business hours in Costa Rica. Any committed uptime, response times or credits apply only if they are set out in a service level agreement signed with you.

We may carry out maintenance, and will give advance notice of planned work that we expect to interrupt the Service, except in an emergency.

Features labelled beta, preview, pilot or early access, and any free tier, are provided as is, may change or disappear, and are excluded from any service level commitment. Do not put a critical process on them without a fallback.

Intellectual property

The Service — its software, documentation, design system and everything developed in the course of providing it — is owned by Codingraph or by its licensors, as their internal arrangements determine, and is licensed to you only as clause 3 sets out. The NOMI trademark, logo and product name belong to their proprietor, not to Codingraph, and are used by Codingraph under licence.

You own Customer Data and your own marks. No provision of these Terms, and no course of dealing under them, transfers ownership of the NOMI brand, the platform or any other intellectual property between the parties or to any third party. Neither party gets any rights in the other's intellectual property except the limited licences these Terms grant.

If you send us feedback or ideas, we may use them without obligation or compensation. We will not identify you as the source publicly without your consent. We may name you as a customer and use your logo in a customer list only with your prior written consent, which you may withdraw.

Confidentiality

Each party may receive information the other treats as confidential. The recipient will use it only to perform under these Terms, protect it with at least reasonable care, and disclose it only to people who need it and are bound to equivalent obligations. This does not cover information that is public through no fault of the recipient, was already known to it, or is independently developed. A party compelled by law to disclose may do so, after giving the other notice where it is lawfully able to.

Term, suspension and termination

These Terms run from your first use of the Service until the subscription ends. Subscriptions renew for successive terms of the same length unless either party gives notice of non-renewal at least 30 days before the end of the current term.

Either party may terminate for material breach that is not cured within 30 days of written notice, or immediately if the other becomes insolvent. We may suspend the Service, in whole or in part and with notice where practicable, if your use threatens the security or integrity of the Service or of a third party, breaches clause 6, or exposes us to legal liability — and we will restore it as soon as the cause is resolved.

On termination your access ends and outstanding fees fall due. Customer Data is available for export for 30 days, after which we delete or anonymise it in line with the Privacy Policy. Credentials already in a Subject's wallet stop being updated when the Service stops; how you communicate that to your Subjects is your call to make, and your responsibility. Clauses 5, 10, 11, 13, 14, 15, 17 and 18 survive.

Disclaimers

Except as expressly stated in these Terms, and to the fullest extent the law permits, the Service is provided as is and as available, and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the Service will be uninterrupted, error-free or secure against every attack.

We do not warrant the accuracy of Customer Data, the acts of a Wallet Platform or other third party, or that a Credential will be accepted by any particular verifier or device. Nothing in this clause excludes a warranty that cannot lawfully be excluded.

Indemnities

By us. We will defend you against a third-party claim that the Service, used as permitted, infringes that party's intellectual property rights, and pay the damages finally awarded or agreed in settlement. If the Service becomes, or we think it may become, the subject of such a claim, we may modify it, obtain a licence, or terminate the affected part and refund fees paid for the unused period. This does not apply to claims arising from Customer Data, from combination with things we did not supply, or from use in breach of these Terms.

By you. You will defend us against third-party claims arising from Customer Data, from the Credentials you issue and what they assert, from your breach of clauses 5 or 6, or from your breach of a Wallet Platform's terms, and pay the damages finally awarded or agreed in settlement.

In each case the indemnified party must notify the other promptly, give it control of the defence, and cooperate reasonably. No settlement that admits fault or imposes an obligation on the indemnified party may be made without its consent.

Limitation of liability

To the fullest extent the law permits, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, however caused and on any theory of liability, even if advised of the possibility.

Each party's total aggregate liability arising out of or related to these Terms is limited to the fees you paid or owed for the Service in the twelve months before the event giving rise to the liability. If no fees have been paid — a free tier, a trial, a pilot — that cap is one hundred United States dollars (US$100).

These limits do not apply to your obligation to pay fees, to either party's indemnity obligations, to a breach of confidentiality, or to liability for fraud, wilful misconduct, death or personal injury, or anything else that cannot lawfully be limited.

Changes to the service and these terms

We develop the Service continuously and may add, change or remove features. We will not materially degrade the core functionality you pay for during a paid term without giving you at least 30 days' notice and, if the change materially harms you, the right to terminate the affected subscription and receive a refund of prepaid fees for the unused period.

We may amend these Terms. Material changes take effect 30 days after we post them here and notify you by email or in the console; continued use after that is acceptance. If you do not accept a material change, you may terminate before it takes effect and receive a refund of prepaid fees for the unused period.

Governing law and disputes

These Terms are governed by the laws of the Republic of Costa Rica, without regard to conflict of law rules, and the United Nations Convention on Contracts for the International Sale of Goods does not apply. The parties submit to the exclusive jurisdiction of the courts of San José, Costa Rica, and each may still seek injunctive relief in any competent court to protect its intellectual property or confidential information.

Before filing, the parties will try in good faith to resolve the dispute at a senior level for 30 days after written notice.

General

These Terms, together with the Privacy Policy, any order form and any signed DPA or service level agreement, are the entire agreement between us and replace anything said before. Where they conflict, the order of precedence is: signed agreement or order form, then DPA, then these Terms, then the Privacy Policy. Your purchase order's pre-printed terms have no effect.

Neither party may assign these Terms without the other's consent, except that Codingraph may assign them, on notice to you and without your consent, to an affiliate or to another entity that becomes the operator of the Nomi platform — including on a transfer of the business, a reorganisation into a holding structure, or a change in who is licensed to operate the brand. Your terms do not change because the operator does. Either party may also assign to a successor of its business or assets on notice. Nothing here creates a partnership, agency or employment relationship. Neither party is liable for delay caused by events beyond its reasonable control, save for payment obligations. A failure to enforce a right is not a waiver of it. If a provision is held unenforceable, it is limited to the minimum extent necessary and the rest stands. Notices to us go to legal@nomi-tech.com; notices to you go to the email addresses on your account.

You confirm you are not located in, and will not use the Service on behalf of anyone in, a country or on a list subject to trade sanctions that would make the Service unlawful to provide.

These Terms are published in English, and the English text is the one that binds the parties if a translation of them differs.

Contact

Legal notices under these Terms go to legal@nomi-tech.com. Our registered address is on the company file held in Costa Rica under corporate ID 3-101-938304, and we provide it on request where service of process requires a physical address. Sales, support, privacy and security addresses are on the Contact page.