Terms of service

Last updated October 4, 2026 Contact: support@venuestack.io These Terms govern the VenueStack software and related services. They distinguish the subscription relationship between VenueStack and a Business from a Guest's purchase from that Business. Schedule 1 contains binding data processing terms for information VenueStack processes on a Business's behalf. 1. Parties scope and definitions 1.1 These Terms are an agreement between you and 1001763609 Ontario Inc., which operates https://www.venuestack.io under the VenueStack name (“VenueStack,” “we,” “us,” or “our”). They cover our website, business dashboards, venue event pages, ticketing and checkout, table reservations and deposits, QR check-in, customer records, messaging, reporting, embeds, installed progressive web application, and related services we make available (the “Services”). 1.2 “Business” means a venue, event organizer, promoter, hospitality operator, or other commercial customer using the Services. “Business User” means a person authorized to act through a Business account. “Guest” means a person using a Business's customer experience, including a ticket buyer, reservation holder, or person making an inquiry. “Order” means a ticket, table, deposit, add-on, or other commercial transaction with a Business. “Business Content” includes listings, branding, menus, layouts, media, instructions, and other material supplied by or for a Business. “Business Data” includes its records and information processed through the Services; rights relating to personal information remain subject to applicable law. 1.3 A person using the Services for a Business represents that they have authority for the actions they take. Subscription fees, commercial obligations, and the Business indemnity bind the Business that contracts for the Services; an ordinary staff member does not become personally responsible for the Business's subscription merely by accepting an invitation. Business Users remain responsible for their own lawful use and the obligations applicable to them. 1.4 Mandatory law takes priority. Nothing in these Terms excludes a consumer guarantee, privacy right, cancellation or refund right, right to bring a claim, or other protection that cannot lawfully be excluded. A savings clause does not make an otherwise prohibited practice lawful. Sections expressly limited to Businesses do not apply to a Guest acting as a consumer. 2. Acceptance and contract documents 2.1 You accept the applicable version of these Terms when, after they have been clearly presented or linked for review, you indicate acceptance through an account, subscription, Order, or other affirmative acceptance process. If acting for a Business, you accept for that Business within your authority. A specific interface or signed agreement can identify the applicable version and additional terms. Merely visiting a page does not supply consent to optional advertising, marketing, or other processing requiring separate consent. 2.2 These Terms, Schedule 1, the applicable accepted subscription or order form, and any signed additional agreement form the service agreement. A signed agreement prevails to the extent it expressly varies these Terms. Schedule 1 prevails for venue-directed personal information processing. The Privacy Policy at https://www.venuestack.io/privacy explains our practices and privacy choices; acknowledging it is not blanket consent to every purpose described in it. 2.3 A Business's guest policies govern its event, sale, reservation, and fulfilment to the extent lawfully disclosed and accepted. They cannot amend VenueStack's own service agreement, authorize unlawful fees or data use, or reduce mandatory Guest rights. Payment providers and separately selected third-party services have their own applicable agreements. 3. Eligibility and account authority 3.1 A person establishing or owning a Business account must be at least the age of majority in their jurisdiction and have authority to bind the Business. Other Business Users must have the legal capacity and authorization needed for their duties. You must provide accurate identity, contact, business, and billing information and update it when it changes. 3.2 A Guest must have capacity to make the relevant transaction, or act through an authorized adult where the law requires. Guests must meet the event's lawful age, identification, and admission requirements. The Services are not directed to children under 13. A Business must not use them for child-directed data collection requiring protections the configured Services do not provide. 3.3 Business owners control staff membership and permissions. The Business must appoint a responsible account contact, promptly remove access when it is no longer authorized, and resolve internal ownership disputes. We may request proportionate evidence of authority before transferring control or making sensitive account changes. We may restrict disputed access while the evidence is assessed, subject to applicable law. 4. Right to use the Services 4.1 During the applicable subscription, trial, or other authorized use, we grant a limited, non-exclusive, non-transferable right to use the Services for their documented purpose and, for a Business, its own authorized operations. Staff may use the Business's account within their permissions. Guests may use the customer functions made available to them. 4.2 The included features, limits, integrations, billing cadence, and fees are those stated in the accepted commercial offer and enabled account. A provider integration, roadmap item, marketing illustration, or experimental capability is not a commitment that a feature is available for every account, country, or payment method. Separately agreed service levels, support hours, or recovery objectives apply only when expressly included in a signed agreement. 4.3 The supported mobile experience is a responsive website and progressive web application. Installation does not provide a separate native app or guarantee offline ticketing, payment, scanning, or sales. You need suitable devices, current supported browser functionality, connectivity, and any required camera or notification permission. 4.4 VenueStack's reports support operational decisions. They are not audited accounts, legal advice, tax advice, or a replacement for payment settlement and accounting reconciliation. The Business must verify figures needed for its books, tax returns, and financial decisions. 5. Account security and authorized access 5.1 You must protect your credentials, use individual staff access where provided, and notify support@venuestack.io promptly of suspected unauthorized access. Do not share an owner or administrator account as a substitute for staff permissions. The Business is responsible for its authorized users' instructions, permission choices, devices, and exports. This does not relieve VenueStack of responsibility for failures for which it is legally responsible. 5.2 VenueStack personnel may access a Business account or relevant records where reasonably necessary for authorized support, service administration, fraud or security response, or legal obligations. That access remains subject to confidentiality, appropriate authorization, and Schedule 1. It is not permission to use guest records for unrelated purposes. 5.3 Ticket codes, ticket download references, QR credentials, and deposit links must be kept private. Someone who obtains a valid credential may be able to retrieve associated information or use the linked ticket or payment function. Contact the relevant Business promptly if a ticket or booking credential is lost or compromised. 6. VenueStack's role and Business responsibilities 6.1 VenueStack provides software. The identified Business is the seller and provider of its events, tickets, reservations, deposits, add-ons, and venue services, except where a separate agreement expressly establishes a different role. VenueStack does not itself host the event, provide the venue, guarantee attendance, or promise that a Business will fulfil its obligations. Our own fees and service responsibilities remain ours. 6.2 The Business is responsible for accurate listings, inventory, dates, timezones, locations, prices, taxes, mandatory fees, performer information, table capacity, minimum spends, deposit treatment, arrival windows, admission rules, cancellation and refund policies, and other material terms. It must disclose those matters before the Guest commits and provide the information and contract confirmation required by law. 6.3 The Business is responsible for event and venue operations, staffing, security, accessibility duties, capacity, alcohol and other licences, age verification, insurance, safety, lawful admission decisions, permits, and fulfilment. It must maintain the rights and permissions needed for its promotional content and activities and must not use discriminatory or unlawful guest classifications or admission practices. 6.4 The Business must provide effective Guest support and contact information and address cancellations, complaints, refunds, payment disputes, and service failures promptly. It must keep enough funds and appropriate arrangements to meet its refund and dispute obligations. VenueStack assistance does not transfer those obligations to us unless expressly agreed. 6.5 The Business is responsible for tax settings, reporting, and remittance associated with its sales, subject to obligations the law assigns to VenueStack or a payment provider. A tax configuration or platform report does not establish the correct legal treatment. The Business must also comply with privacy, electronic marketing, advertising, and consumer rules applicable to it and its Guests. 7. Guest Orders tickets and reservations 7.1 Guests must supply accurate transaction information and have authority to use the selected payment method. Check the event, date, timezone, venue, ticket category, quantity, table or section, timeslot, deposit, minimum spend, total price, and applicable rules before confirming. Available inventory and offers can change before confirmation. 7.2 A reservation request, chat message, checkout page, or payment authorization is not by itself a final booking confirmation. A free request can require Business approval. A paid Order or deposit is confirmed through the applicable verification and confirmation process. If payment is taken but fulfilment fails, the responsible parties must resolve the payment and any refund required by law; a technical status does not remove that obligation. 7.3 A valid ticket is evidence of the purchased admission entitlement, subject to the terms lawfully disclosed for that event. The Business may impose lawful age, identification, conduct, and safety restrictions. These Terms do not permit arbitrary revocation of a paid entitlement or automatic forfeiture of a refund right. A successful QR validation confirms the credential's recorded state, not compliance with every event entry requirement. 7.4 Tables and sections can have capacities, deposits, spending commitments, service windows, assignment rules, and cancellation or no-show conditions. The Business must explain whether an upfront amount is a deposit, a reservation fee, or payment for an identified service; what it is credited against; what remains payable at the venue; and when it can be retained or refunded. VenueStack does not itself provide table service or automatically collect an undisclosed balance. 7.5 A promotion or add-on is subject to its disclosed eligibility and availability. Optional extras require an affirmative selection where the law requires it. A pricing or inventory error must be handled fairly and in accordance with law; it does not authorize an undisclosed extra charge after purchase. 7.6 Protect ticket credentials and follow the Business's disclosed transfer or resale rules. Do not copy, fabricate, reuse, or sell an invalid credential. If email delivery fails, check your details and contact the Business for assistance. Message delivery failure does not by itself cancel a confirmed Order or waive the Business's fulfilment duties. 8. Prices fees and currencies 8.1 The Business sets its sale prices and commercial conditions. Platform fees, payment fees, and taxes can apply as disclosed. A Business may absorb a permitted fee or assign it to a Guest only where the law and applicable payment rules allow. These Terms are not authorization for prohibited card surcharges or misleading fee descriptions. 8.2 Where all-in pricing is required, the advertised price must include all mandatory, reasonably calculable charges. Taxes or other amounts may be excluded only where the applicable law permits. A separate itemization must not obscure the required total. Before payment, the Guest must receive the final payable amount, currency, and the purpose and amount of any separately disclosed charge. Disclosing a mandatory fee only in these Terms does not meet an earlier price disclosure requirement. 8.3 Venue transactions use the Business's selected operating currency. VenueStack subscription billing is ordinarily in United States dollars, as stated in subscription checkout. A bank or payment method may apply its own exchange rate or charge; VenueStack does not set those external charges. Amounts in different currencies are not interchangeable. 8.4 The fees and rates in the accepted order, account configuration, or commercial agreement apply. Subscription price changes follow Section 11. Changes to a transaction fee must be communicated to the Business before they apply to new sales, with any legally required Guest disclosure. A completed Guest Order cannot be repriced merely because platform rates later change. 9. Payment services and settlement 9.1 Payments are processed through Stripe, the payment provider enabled for the account or transaction. The Business must complete the provider's onboarding and satisfy its terms, identification checks, restrictions, and ongoing requirements. Availability depends on the provider and enabled geography, currency, and payment method. 9.2 The Business authorizes VenueStack to send necessary payment instructions and records for verified purchases, deposits, refunds, platform fees, reconciliation, and disputes within the enabled payment arrangement. Only charges, deductions, debits, or recoveries authorized by that arrangement, an accepted commercial agreement, or law may be applied. These Terms do not grant VenueStack an unrestricted power to withdraw from a Business's bank account or control customer funds. 9.3 The payment arrangement determines the charge account, settlement, payout timing, reserves, negative balances, and provider dispute responsibilities. The Business owes properly disclosed VenueStack fees and amounts it is contractually responsible to reimburse. VenueStack is not a bank, insurer, or escrow service merely because it provides payment tools. A different expressly agreed funds-handling arrangement must be documented separately. 9.4 A provider or bank can delay, restrict, reverse, or decline payment or settlement. We do not guarantee a payout date or dispute outcome. We remain responsible for our own actions and instructions to the extent required by our agreement or law. Businesses must reconcile settled payments and refunds with provider records and report discrepancies promptly. 10. Refunds cancellations and payment disputes 10.1 The Business's lawfully disclosed policy governs voluntary refunds and cancellations of its Orders. It remains subject to applicable consumer, payment, and other law. If an event is cancelled, materially changed, not provided, or admission or service is unlawfully refused, the Business must provide the remedies required by law and its accepted commitments. These Terms do not make every sale final. 10.2 A payment processing cost that the provider does not return to the Business does not automatically become a lawful deduction from a Guest's refund. Processing or platform fees may be retained from a Guest only where that treatment was clearly disclosed, is permitted by law and provider rules, and does not reduce a required remedy. The responsible party must fund a legally required refund even if the standard software calculation or provider cost recovery does not cover it. 10.3 Authorized Business Users can submit refund instructions through available tools. The Business is responsible for valid approval, eligible amounts, funding, and correct instructions. VenueStack may require additional verification or decline an unlawful or unsupported instruction. Refund completion and bank posting can depend on the provider. We do not promise a particular posting time unless separately agreed. 10.4 A Guest can use lawful complaint and payment dispute processes. Contacting the Business or VenueStack for support is not a waiver of a chargeback or statutory right. Fraudulent disputes, false evidence, and duplicate recoveries are prohibited. A successful refund or dispute adjustment can affect the corresponding ticket or reservation only in accordance with its legal and commercial status. 10.5 The Business must cooperate with provider requests and maintain accurate supporting records. We may restrict affected payment or sales functions and coordinate with the provider where reasonably necessary to address fraud, excessive disputes, sanctions, or legal risk, within our actual contractual authority. Event cancellation, a platform outage, or a force majeure event does not automatically extinguish Guest refund rights. 11. Business subscriptions trials and renewal 11.1 The accepted subscription checkout or order form states the price, currency, taxes, billing interval, included Services, trial terms, and any separately chargeable usage. Fees are payable in advance unless that agreement states otherwise. An annual offer expressed as a monthly equivalent is charged for the stated annual term; it is not a monthly payment plan unless expressly stated. 11.2 A subscription automatically renews for the same billing interval until cancelled, if automatic renewal was clearly disclosed and authorized at purchase. The payment authorization covers the disclosed recurring charge and permitted taxes, not arbitrary unrelated charges. Any renewal reminders or additional consent required by law must be provided. 11.3 A trial lasts for the period shown when it starts. A trial converts to a paid subscription only if its conversion date, charge, renewal terms, and cancellation method were clearly disclosed and the required payment authorization was obtained. If conversion is authorized, cancel before that date to avoid the first paid period. A trial without the required payment authorization does not permit an automatic charge. 11.4 An authorized account owner can cancel through subscription settings or the billing portal. If the control is unavailable, email support@venuestack.io from the account contact with enough information to identify the Business and an unambiguous cancellation request. A verified request received before the renewal time will be treated as timely even if our processing is completed later. Unless law or the accepted order states otherwise, cancellation takes effect at the end of the already paid period, and access continues for that period subject to other valid restrictions. 11.5 Except as required by law, expressly promised, or provided in these Terms, subscription fees for an already started billing period are not refunded or prorated for a voluntary cancellation or unused capacity. This rule does not cover a duplicate or incorrect charge, a required statutory refund, or the refund rights in Sections 19 and 20. Cancel recurring billing separately from stopping use, removing a staff member, or uninstalling the PWA. 11.6 We give at least 30 days' advance notice of an increase to the recurring subscription price, or longer if law or a signed order requires. An increase applies at a renewal following that notice, not to the prepaid part of the current period. The Business may cancel before the affected renewal. A change requiring affirmative agreement will not be implemented merely by posting it. 11.7 If payment fails, the Business must correct its payment method and pay undisputed amounts due. Past-due subscriptions ordinarily receive a seven-day payment grace period; the actual recovery notice identifies the affected account status. After the applicable grace period, dashboard access can be restricted to billing recovery. Fraud, security, or legal restrictions can apply independently. A billing restriction does not erase Guest obligations or suspend a statutory privacy request. 11.8 A plan's lawful use and technical limits apply even if the plan is described as unlimited. No overage fee may be imposed unless its basis was separately disclosed and agreed. Sales, commission, messaging, implementation, or provider fees are not included in a subscription merely because a feature is included; each additional charge must have its own disclosed basis. 12. Content intellectual property and feedback 12.1 As between the parties, the Business retains its rights in Business Content and Business Data, subject to individual privacy rights and third-party rights. VenueStack and its licensors retain the Services, software, design, documentation, and other platform intellectual property. No ownership of a person's personal information is created by this allocation. 12.2 The Business grants VenueStack a non-exclusive, worldwide, royalty-free licence to host, copy, transmit, adapt for technical presentation, and display Business Content only as needed to provide, support, protect, and lawfully wind down the Services. This includes displaying authorized public listings and delivering content to intended recipients and configured providers. The licence does not authorize sale of customer lists, unrelated advertising use of guest records, or general-purpose AI training. 12.3 The Business warrants that it has the rights and permissions needed for its content and instructions, including branding, photographs, performer material, menus, and music-related content. Linking to a licensed music preview is not permission to upload or distribute a copyrighted recording independently. We may remove or restrict material reasonably believed to violate law or third-party rights and may ask for supporting evidence. 12.4 We may display the Business's identity and branding within its own authorized service experience. Separate use in VenueStack advertising, testimonials, or case studies requires the Business's permission, which can be withdrawn for future use. We do not acquire publicity rights over individual Guests through these Terms. 12.5 You may voluntarily give product suggestions. We may use those suggestions to improve the Services without a payment obligation, but this does not grant rights in confidential Business material or personal information included in a suggestion. Third-party and open-source components retain their applicable licence terms. 12.6 A Guest retains their rights in material they supply, subject to third-party rights. By supplying material for a transaction, chat, feedback, or support request, the Guest authorizes the limited hosting, copying, transmission, and display needed to handle that interaction and the lawful associated records. The Guest must have authority to supply it. This permission does not authorize unrelated advertising, public endorsement, or general-purpose AI training and does not waive privacy rights. 13. Personal information and Business instructions 13.1 Each party must comply with privacy laws applicable to its activities. The Business determines the lawful purposes and grounds for its guest data collection and use, supplies appropriate notices, obtains necessary consent or authorization, and answers controller requests. VenueStack performs venue-directed processing under Schedule 1 and remains accountable for its own processing and applicable duties. 13.2 The Business must limit collected information to what is necessary, maintain accurate records, apply appropriate staff permissions, and use lawful retention instructions. It must not place payment secrets, unnecessary identity documents, prohibited sensitive information, or unlawful customer classifications into notes, imports, messages, or files. Special-category or child information requiring safeguards not supported by the configured service must not be submitted without a separately agreed lawful arrangement. 13.3 Imports, customer tags, transaction history, or the existence of a booking do not establish marketing consent. The Business must keep appropriate evidence of notice, consent, exceptions, and opt-outs and prevent unlawful exports or use by staff or promoters. An affiliation with multiple Businesses does not authorize combining their guest lists. 13.4 The customer list's operational hide or delete function is not a complete privacy erasure process. Businesses must route access, correction, deletion, and related privacy requests through an appropriate documented process and contact VenueStack when assistance across platform or provider records is required. Privacy rights are not waived by a subscription lapse, account restriction, or contract termination. 14. Communications tracking and embedded use 14.1 The Business is responsible for the communications it instructs or sends, including post-visit messages, review requests, email or SMS campaigns, and chat responses. It must comply with applicable consent, sender identification, unsubscribe, suppression, and content rules. A message containing promotional material can be subject to marketing requirements even if labelled transactional. VenueStack may restrict sending to protect legal compliance, recipient choices, and service reputation. 14.2 Configured analytics, advertising pixels, tag managers, header scripts, and purchase-completion scripts require a lawful purpose and the required disclosures and controls. The Business must not load a tracker before required consent, circumvent an opt-out or recognized preference signal, or capture payment secrets or unnecessary sensitive information. VenueStack may reject, disable, or isolate scripts that create security, privacy, performance, or legal risk. VenueStack retains responsibility for processing that it controls or enables. 14.3 A Business embedding the Services must ensure that the host website is suitable, secure, and accessible for the relevant use and that its notices and consent signals work with the embedded functions. The Business must not obscure the seller identity, total price, material conditions, or relevant notices. Embedding does not alter who sells the event or shift all privacy obligations to the host website. 14.4 Guests and Business Users can manage applicable marketing and browser notification choices. Necessary service messages may continue for an existing account or Order. These Terms do not authorize optional marketing simply because someone accepts them. 15. AI concierge and automated assistance 15.1 The AI concierge is optional and depends on the Business's configuration and the available providers. Relevant messages, Business instructions, and retrieved event or service information can be processed by the chat and AI providers to generate responses, as described in the Privacy Policy and Schedule 1. 15.2 AI output can be incorrect or incomplete. The Business must review its instructions and important customer-facing behaviour, provide an appropriate route to human assistance, and verify material claims about availability, prices, minimum spends, policies, accessibility, or other conditions. A Guest should confirm a material or uncertain answer with the Business. AI guidance is not professional legal, medical, tax, or safety advice. 15.3 AI guidance does not independently finalize a paid reservation, authorize a refund, or bypass the normal confirmation and payment process. The Business remains responsible for its event and service decisions. Neither party may rely on the concierge for a legally significant solely automated decision about an individual without the separate legal basis, notices, review rights, and safeguards required for that use. 15.4 Venue-directed personal information may not be used by VenueStack for general-purpose model training or enabled for a provider's unrelated training without a separate lawful agreement, the Business's authorization, and any required individual notice or consent. These Terms do not provide that authorization. 16. Third-party services 16.1 Services can depend on hosting, database, payment, email, SMS, chat, AI, identity, mapping, media, analytics, or browser providers. The Business authorizes the relevant data exchanges needed for integrations it lawfully enables, subject to Schedule 1. Certain providers act independently for parts of their services and require separate agreements and privacy notices. 16.2 We do not control independent third-party outages, bank decisions, delivery filters, content availability, or changes to a provider's separate terms. We do not guarantee that every email, SMS, push notification, music preview, map, or integration will remain available. We remain responsible for obligations concerning providers we engage and actions within our own control. 16.3 Do not enable an integration if its data use, location, or terms are incompatible with your legal obligations. Separate regional, processing, or transfer arrangements may be necessary before the feature is used. A general disclaimer about third parties does not replace those arrangements. 17. Acceptable use 17.1 You must not use the Services for unlawful, fraudulent, deceptive, discriminatory, or infringing activity; fake or unfulfillable events; payment laundering; unauthorized financial activity; unlawful resale; or content that unlawfully threatens, harasses, or exploits a person. 17.2 You must not access another Business's records without authority; share or misuse credentials; defeat tenant or permission boundaries; copy or fabricate tickets; bypass inventory, payment, or scanner controls; send unsolicited or unlawful communications; or use imported or exported records without lawful authority. 17.3 You must not introduce malware, exploit vulnerabilities, disrupt the Services, overload them with abusive traffic, bypass rate limits, or reverse engineer or extract software except to the extent a mandatory law permits. Automated access requires our authorization unless expressly permitted by the service or law. These restrictions do not prohibit an individual's lawful privacy request or a security report made without unauthorized access or harm. 17.4 Report suspected security issues to support@venuestack.io. Testing that accesses another person's data, affects production transactions, or creates a material security risk requires prior written authorization. Stop if you encounter information you are not authorized to access and do not publicly disclose credentials or personal information. 18. Confidentiality 18.1 For the Business relationship, each party must protect the other's non-public information disclosed in circumstances reasonably indicating confidentiality. It may use that information only for the agreement, give access only to people or providers with an appropriate need and duty of confidentiality, and take reasonable steps to protect it. Personal information is additionally governed by privacy law and Schedule 1. 18.2 These duties do not apply to information the receiving party can demonstrate was already lawfully known, independently developed, public without breach, or lawfully obtained without confidentiality restrictions. Required disclosure is permitted only to the extent required by law, with prior notice where legally allowed and reasonably practicable. These duties continue after the relationship ends while the information remains confidential. 19. Suspension termination and data access 19.1 We may restrict affected functions or suspend an account where reasonably necessary for material breach, non-payment, fraud, unauthorized access, serious security risk, legal requirements, or provider restrictions. Where practicable and appropriate, we give notice explaining the issue and a reasonable opportunity to resolve it. Immediate action is permitted when delay would create material risk, violate law, or conflict with a provider requirement. Restrictions should be proportionate to the issue. 19.2 For a material breach that can be remedied without urgent action, we may terminate if the Business does not remedy it within 10 business days after written notice, or a longer cure period stated in a signed order. The Business may terminate for our material breach on the same basis. A party need not continue conduct that is unlawful while a cure period runs. 19.3 We may end a Business subscription for convenience on at least 30 days' notice. If we end it for convenience or permanently withdraw the paid service without a substantially equivalent alternative, we refund prepaid subscription fees for the unused affected period. If the Business terminates for our uncured material breach, the same unused-period refund applies, without limiting other non-excludable remedies. 19.4 The Business can request a standard export of available Business Data within 30 days after subscription termination. It must contact support if ordinary access is restricted. We will provide a reasonably usable export or explain lawful restrictions, taking account of authorization, other individuals' rights, and security. Expanded custom work can be separately quoted; statutory privacy assistance and any export required by law are not conditioned on buying custom services. 19.5 After the export window, we may remove service copies in accordance with Schedule 1, lawful retention requirements, and applicable instructions. The Business should export needed records before ending service and establish its own continuity arrangements. We do not promise indefinite retention. Legal records, narrowly necessary security records, and backups remain subject to purpose and retention limits rather than unrestricted ongoing use. 19.6 Termination does not cancel a Guest's valid entitlement, lawful refund right, or the Business's responsibility for outstanding Orders. The Business must make arrangements to support its Guests outside the platform when necessary. Accrued payment obligations, applicable intellectual property provisions, confidentiality, data protection while information is held, liability, indemnity, and dispute provisions survive to the extent relevant. 20. Service changes and changes to these Terms 20.1 We can maintain, update, and improve the Services, including addressing security or provider changes. We use reasonable efforts to avoid materially reducing the paid core functionality during a prepaid term. We give reasonable advance notice of a material discontinuation where practicable. Emergency, legal, or security changes can occur sooner, with notice when appropriate. 20.2 If a material reduction makes the paid service substantially unsuitable for its contracted purpose and we cannot provide a substantially equivalent alternative, the Business may end the affected subscription and receive unused prepaid subscription fees for the affected period. This does not impose a refund obligation for a minor interface change or an independent Business preference, and does not limit mandatory remedies. 20.3 Material changes to these Terms are notified at least 30 days before they apply to an existing Business subscription, except where an earlier change is legally required or necessary to address an urgent security issue. A revised version applies through the notice and acceptance process permitted by law. Where affirmative acceptance is required, it must be obtained. A Business that reasonably rejects a materially adverse change before it takes effect may terminate and receive unused prepaid fees for the affected period. 20.4 Changes do not retroactively alter the terms of a completed Guest Order or remove an accrued claim. A change to personal information use also requires the applicable notice, legal grounds, and consent independently of contractual acceptance. The posted last updated date identifies the document version; it does not, by itself, prove that an existing user accepted a change. 21. Warranties and limitations of the service 21.1 We will provide the Services with reasonable care and skill and fulfil express commitments in the accepted agreement. No financial outcome, sales volume, event success, uninterrupted operation, perfect data accuracy, complete message delivery, or error-free AI output is guaranteed. Planned maintenance, connectivity, provider dependencies, and service incidents can affect availability. 21.2 For Businesses, except for express contractual obligations and warranties that cannot lawfully be excluded, the Services are provided as available, and we exclude implied warranties of merchantability, fitness for a particular purpose, and non-infringement to the extent the law permits. This provision does not remove the express privacy and security obligations in Schedule 1 or excuse our fraud or unlawful conduct. 21.3 For consumers, applicable statutory guarantees remain in force. We are responsible for losses that the law makes our responsibility, including applicable duties concerning reasonable care. We are not responsible for a Business's event or independent conduct merely because it uses the platform, but this does not exclude a claim based on VenueStack's own actionable conduct. 22. Liability 22.1 For the Business relationship, and to the extent permitted by law, neither party is liable to the other for indirect, special, incidental, exemplary, punitive, or consequential loss, including consequential loss of profit, revenue, goodwill, or business opportunity. An otherwise recoverable direct loss is not made consequential merely because it concerns data recovery or service restoration. 22.2 Subject to Section 22.3, VenueStack's aggregate liability to a Business for all claims arising from or connected with the Services or agreement will not exceed the greater of: (a) subscription and platform fees paid or payable to VenueStack by that Business for the Services in the 12 months immediately before the first event giving rise to the claim; and (b) CAD 1,000. Ticket or table sale proceeds, taxes collected for others, and amounts passed through to independent providers are not VenueStack fees for this calculation. Related events are treated as one claim for the cap, regardless of the legal theory. 22.3 No exclusion or cap applies to fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence where exclusion is prohibited, or another liability that applicable law does not permit to be excluded or limited. The exclusions and cap do not reduce the Business's liability for fees properly owed or third-party amounts properly indemnified under Section 23. A regulatory authority's powers and an individual's non-excludable privacy rights are not waived by the Business agreement. 22.4 The Business exclusions and monetary cap in Sections 22.1 and 22.2 do not apply to a Guest acting as a consumer. Any applicable consumer liability limitation must satisfy the law governing that consumer. Nothing here excludes liability for our own failure where the law requires a remedy or shifts that responsibility entirely to a Business or payment provider. 22.5 Each party must take reasonable steps to reduce recoverable loss. A party cannot recover the same loss twice, and amounts actually reimbursed for that loss may be credited where law permits. Neither the cap nor an event disclaimer grants authority to retain money that must be refunded. 23. Business indemnity 23.1 The Business will indemnify VenueStack and its officers and personnel against third-party claims, damages, settlements, and reasonable defence costs arising from the Business's events or fulfilment; unlawful or infringing Business Content; unlawful collection, marketing, tracking, or data instructions; breach of its material obligations; or fraud or payment disputes for which it is legally or contractually responsible. The indemnity applies only to the extent the claim results from the Business or persons acting under its authority. It does not cover loss to the extent caused by VenueStack's breach, negligence, wilful misconduct, or violation of law. 23.2 VenueStack must give reasonably prompt notice, allow the Business to control the defence with competent counsel, and provide reasonable cooperation at the Business's expense. Late notice reduces the obligation only to the extent it materially prejudices the defence. The Business may not settle a claim in a way that admits fault by VenueStack, imposes a non-monetary obligation on it, or fails to give it a full release without its written consent. VenueStack may participate at its own expense, and the parties must reasonably cooperate to reduce loss. 23.3 This contractual indemnity does not apply to a Guest acting as a consumer. A person who deliberately commits fraud or unlawful misuse remains responsible for losses recoverable under applicable law; there is no general consumer duty to reimburse VenueStack for every claim involving use of the Services. 24. Governing law and disputes 24.1 For the Business agreement, the laws of Ontario and the federal laws of Canada applicable there govern, excluding conflict rules that would require another law. Subject to mandatory law, the parties submit to the courts of competent jurisdiction located in Toronto, Ontario, for Business agreement disputes. 24.2 For Guests and other consumers, this choice does not deprive them of mandatory protections or available courts in their home jurisdiction. These Terms do not impose mandatory arbitration, prohibit class proceedings where available by law, or shorten a statutory limitation period. Guest disputes about an event are ordinarily addressed to the selling Business; VenueStack remains a proper recipient for complaints about its own service or conduct. 24.3 Contact support@venuestack.io with the relevant account or Order and the requested resolution. We will use reasonable efforts to resolve a complaint. Attempting an informal resolution is not a condition that prevents an urgent court application, regulator complaint, privacy request, lawful payment dispute, or claim that would otherwise expire. 25. Notices 25.1 We may send ordinary service notices to the account contact, display them in the Services, or use another agreed channel. Material contractual, billing, suspension, or processing notices must use a method reasonably designed to reach the relevant contact; a website posting alone is not sufficient when direct notice is required. Keep your account contact information current. 25.2 Send legal and contractual notices to support@venuestack.io with the subject “Legal notice” and enough information to identify the sender, account, and matter. Contact us through that address for the responsible operator's mailing details. Service of court proceedings and notices requiring a particular statutory method must follow that law; this email clause does not replace it. 26. General provisions 26.1 The parties are independent contractors. No partnership, employment, fiduciary relationship, or authority for the Business to bind VenueStack is created by use of the Services. Any limited payment instruction authority is only that expressly documented in the payment arrangement. 26.2 A Business may not assign the service agreement without our consent, which will not be unreasonably withheld for a genuine reorganization or sale to a successor able to meet the obligations. VenueStack may assign it in a genuine corporate reorganization or transfer of its business, subject to the assignee assuming the obligations and applicable privacy and notice requirements. Assignment cannot remove mandatory consumer or privacy rights. 26.3 A party is not responsible for a delay to the extent caused by circumstances beyond its reasonable control that it could not reasonably avoid, provided it takes reasonable mitigation steps. This does not excuse amounts already due, unlawful data handling, a required refund, or duties that remain applicable by law. A prolonged inability to provide a paid service is addressed under Sections 19 and 20. 26.4 If a provision is invalid or unenforceable, it is severed or narrowed only to the extent lawful, and the remaining agreement continues. A failure or delay to enforce a right is not a waiver. A waiver must be sufficiently clear and apply only to the matter addressed. No person obtains a third-party contract right except where expressly stated or law requires. 26.5 The accepted documents identified in Section 2 are the entire service agreement on their subject, subject to non-excludable rights and liability for actionable misrepresentations. Changes to a signed special agreement require the agreed method. These Terms do not override a Business's separately promised Guest entitlement or an individual's statutory privacy rights. Schedule 1 Data processing terms A Scope and processing description A.1 This Schedule applies when VenueStack processes personal information for a Business in providing the Services. It forms part of the service agreement without a separate signature when that agreement is accepted. “Applicable Privacy Law” means the privacy and data protection law applicable to the processing, including relevant Canadian federal or provincial law, the EU or UK GDPR, and applicable United States state law. “Business Personal Information” means personal information processed on the Business's behalf. A “Security Incident” means a breach of security leading to unlawful or accidental destruction, loss, alteration, unauthorized disclosure of, or access to that information. A.2 The subject and purpose are the provision of the Business's event, ticketing, reservation, guest management, messaging, reporting, and support services. Processing includes collection, recording, organization, hosting, retrieval, display, use for authorized functions, transmission, export, correction, restriction, and deletion. It continues during the service term and the lawful return, deletion, or limited retention period described below. A.3 Individuals include Guests and prospective Guests, people included in group transactions, Business staff, and people communicating with the Business. Information includes identity and contact data; staff affiliations and permissions; orders, tickets, reservations, deposits, refunds, payment references, and attendance; communications and attachments; customer feedback, notes, and tags; and necessary device, interaction, campaign, and security records. Sensitive information is not required for ordinary use but can appear in a person's message or request; the Business must minimize and lawfully authorize it. Collection requiring unsupported child, biometric, health-record, or other specialized safeguards is excluded unless separately agreed. A.4 The Business is the controller or equivalent responsible party; VenueStack is its processor or service provider for this information. Where the Business itself acts as a processor, it must have the required authority from the relevant controller to appoint VenueStack and give instructions. VenueStack's genuinely independent processing must be limited to its separately lawful and disclosed purposes; this Schedule does not permit relabelling venue-directed processing as independent processing to evade the restrictions. B Instructions and permitted use B.1 The agreement, enabled lawful settings, and authorized service actions are the Business's documented instructions. VenueStack will process Business Personal Information only under those instructions to provide the specified Services, or as required by applicable law. If legally permitted, it will notify the Business before processing compelled by law. It will promptly inform the Business if an instruction appears to violate Applicable Privacy Law and may pause that instruction while it is resolved. B.2 VenueStack will not sell Business Personal Information, share it for cross-context behavioural advertising as a service provider, use it to market unrelated services to Guests, or use it to train a general-purpose AI model. It will not combine guest information across Businesses for an unrelated customer profile. Permitted internal security or quality work must remain within the limits of Applicable Privacy Law and must not become an unrelated use or a means of creating a reusable guest audience for another customer. B.3 The Business must provide lawful instructions, the required notices and consents, appropriate access permissions, and a valid basis for any sensitive information. It must not instruct unlawful marketing, tracking, retention, or disclosure. Its obligations do not reduce VenueStack's independent statutory duties. Any proposed additional purpose needs a separate lawful agreement; acceptance of this Schedule is not authorization for it. C Personnel confidentiality and safeguards C.1 VenueStack will limit access to personnel with a legitimate service need who are bound by confidentiality obligations. It will apply appropriate technical and organizational safeguards having regard to the information's sensitivity, the processing, available measures, and risks to individuals. The safeguards must include appropriate tenant and object authorization, role and privileged access controls, protection of credentials and secrets, encryption of service communications in transit, service and incident monitoring appropriate to the risk, and reasonable continuity and recovery measures. C.2 The Business is responsible for its own authorized users, devices, account permissions, exports, and independently selected systems. Each party must reasonably cooperate on a security concern affecting the other. No particular certification, zero-risk result, uptime percentage, recovery time, or restoration guarantee is created by this Schedule unless separately agreed. D Subprocessors and selected providers D.1 The Business generally authorizes the service subprocessors identified for its account and the relevant provider categories disclosed in the Privacy Policy, subject to this Section. Before giving a subprocessor Business Personal Information, VenueStack must identify the provider, service, relevant information, and processing locations in a register available to the Business, and enter a written agreement imposing appropriate confidentiality, purpose limitations, security, assistance, and deletion duties. VenueStack remains responsible for performance of its subprocessor obligations to the extent required by Applicable Privacy Law. D.2 The supported core or conditional service providers include Supabase for database and storage, Vercel for hosting, SendGrid for email, Twilio for chat and SMS, and OpenAI for an enabled AI concierge. The provider register must distinguish actual enabled providers from available but unused integrations. A payment, sign-in, mapping, media, or advertising provider may act independently for some processing; that activity must be assessed and disclosed rather than automatically treated as service provider processing. D.3 VenueStack will give at least 30 days' advance direct notice of a new or replacement subprocessor that will handle Business Personal Information. The Business may object on reasonable documented data protection grounds within 14 days of notice. The parties will work in good faith on a suitable alternative or protection. If the issue cannot reasonably be resolved, the Business may terminate the affected service before the new processing starts and receive unused prepaid subscription fees for that affected service. An urgent necessary change must still provide notice before new processing and a meaningful opportunity to address a lawful objection; affected processing may need to be suspended while the issue is resolved. D.4 A Business-selected integration does not authorize VenueStack to ignore its own provider assessment or transfer duties. The Business is responsible for its separate direct provider agreement and instructions; VenueStack remains responsible for the processing it undertakes. E Requests assessments and audit assistance E.1 VenueStack will promptly inform the Business of a request concerning Business Personal Information unless law prohibits it, and provide reasonable assistance for access, correction, deletion, portability, objection, restriction, and other applicable individual rights. It will not independently reject a controller request except as legally required or within the Business's authorized instructions. The parties must use proportionate identity and authority verification. E.2 Taking account of the processing and information available to it, VenueStack will assist the Business with required security, privacy impact assessments, prior consultations, and compliance information. It will make available information reasonably needed to demonstrate compliance with this Schedule and applicable processor obligations. E.3 The Business may conduct a proportionate review or appoint an independent auditor bound by confidentiality. Ordinarily, the parties will first use current documentation, relevant evidence, and remote review, followed by a necessary further inspection on reasonable notice. Reviews must protect other customers, service security, and confidential provider information. Routine reviews may be coordinated annually, but additional access must be allowed where an incident, credible compliance concern, or regulator requirement justifies it. Reasonable coordination or cost allocation must not defeat a right of audit required by law. F Security Incidents F.1 VenueStack will notify the Business without undue delay after becoming aware of a Security Incident affecting Business Personal Information. The notice will describe available facts about the information and individuals affected, likely consequences, mitigation, and a response contact. Information can be supplied in stages; initial notice must not be delayed until every fact is established. F.2 VenueStack will investigate, take appropriate containment and remediation steps, preserve relevant records, and cooperate with the Business's lawful response. Each party is responsible for the regulator and individual notices the law assigns to it. VenueStack will not issue a notice on the Business's behalf without authorization unless law requires it. Notification is not, by itself, an admission of liability. G Return deletion and retained records G.1 When the relevant service ends, or on a valid instruction, VenueStack will return or delete Business Personal Information at the Business's choice, subject to legal retention requirements and the standard export process in Section 19. Return includes reasonably usable available information and does not permit VenueStack to keep unrestricted operational copies indefinitely. Privacy assistance required by law continues even after the standard commercial export window. G.2 VenueStack will delete remaining service copies without undue delay after the applicable return or deletion process, except information required by law to be retained. It will identify the basis and purpose of a required retention where law permits and keep the retained information protected and limited to that purpose. Subprocessors must receive corresponding lawful deletion instructions. G.3 Backups may retain protected copies until the documented retention cycle expires if selective deletion is not reasonably practicable. They must remain limited to continuity or legally required purposes, be removed according to that cycle, and not be used as an alternative operational database. Applicable deletion instructions must be reapplied if information is restored. The Business can request confirmation of completed deletion and relevant lawful exceptions. H Locations and transfers H.1 Processing locations and remote access must be covered by the provider register and the Business's lawful instructions. Each party must meet its applicable transfer responsibilities. VenueStack must arrange the safeguards required for transfers it makes and provide reasonable supporting information to the Business. H.2 If a transfer requires a specific legal mechanism, the parties must record an applicable adequacy basis or enter the required transfer instrument before the restricted transfer starts, including completed EU standard contractual clauses or a valid UK mechanism where required. Any required risk assessment or supplementary measure must also be completed. This Schedule is a processing agreement, not a declaration that a transfer mechanism has already been executed or that all deployments satisfy regional law. I United States service provider terms I.1 To the extent the CCPA or a comparable applicable state law governs the processing, the specified business purposes are the Services described in Section A. VenueStack will not retain, use, or disclose Business Personal Information outside those purposes or the direct Business relationship except as that law permits; sell or share that information as those terms are defined by the applicable law; or combine it with information from another person or source except to the extent expressly permitted by that law. It will provide the required level of privacy protection and ensure legally required terms apply to its subprocessors. I.2 VenueStack certifies that it understands and will comply with the applicable restrictions. It will notify the Business if it determines that it can no longer meet them. The Business may take reasonable and appropriate steps to verify compliant use and stop and remediate unauthorized processing. This provision does not convert a separately enabled advertising disclosure into service provider processing or eliminate a required Guest opt-out. J Duration priority and mandatory rights J.1 This Schedule continues while VenueStack or its subprocessors hold Business Personal Information subject to it. The general agreement's liability provisions apply to contractual claims to the extent law permits, but do not waive individual statutory rights, regulator powers, mandatory processor obligations, or a required transfer instrument's precedence. J.2 If the parties enter a legally required transfer instrument, that instrument prevails to the extent of a conflict concerning the transfer. A signed processing addendum can supply additional deployment-specific details and safeguards. No instruction, order form, or general service disclaimer can authorize unlawful processing.