These API Terms of Use ("API Terms") constitute a legally binding agreement between you, whether as an individual or on behalf of a legal entity ("Client," "you," or "your"), and Revenu Tecnologia e Serviços Ltda., a company organized under the laws of the Federative Republic of Brazil, registered under CNPJ No. 00.000.000/0001-00, with its principal office at Av. Brig. Faria Lima, 1811, Sala 1119, CEP 01.452-001, São Paulo - SP, Brazil ("Revenu," "we," "us," or "our"), governing your access to and use of Revenu's Application Programming Interfaces ("APIs"), related documentation, software development kits ("SDKs"), and associated services.

By accessing, registering for, or using the Revenu API, you acknowledge that you have read, understood, and agree to be bound by these API Terms in their entirety, as well as our Privacy Policy and any applicable Data Processing Agreement ("DPA"). If you do not agree to these API Terms, you must immediately cease all use of the API.

You represent and warrant that: (a) you are at least eighteen (18) years of age; (b) if acting on behalf of a legal entity, you have full authority to bind such entity to these API Terms; (c) you are not located in, under the control of, or a national or resident of any country subject to applicable trade sanctions or embargoes; and (d) you will comply with all applicable laws, regulations, and industry standards in connection with your use of the API.

These API Terms supplement and are in addition to any master services agreement, partnership agreement, or other commercial agreement between you and Revenu. In the event of a conflict between these API Terms and any such agreement, the terms of the other agreement shall prevail to the extent of such conflict, unless expressly stated otherwise.

For the purposes of these API Terms, the following terms shall have the meanings ascribed to them below:

• "API" means the Revenu Application Programming Interface, including all endpoints, resources, methods, protocols, and related tools made available by Revenu for programmatic integration with Revenu's banking infrastructure platform.
• "API Keys" means the unique credentials, including client identifiers, client secrets, access tokens, and any other authentication or authorization credentials issued by Revenu to the Client for the purpose of authenticating and authorizing API requests.
• "Client" or "Client Application" means any software application, service, or system developed, owned, or operated by the Client that integrates with the Revenu API.
• "Confidential Information" means any non-public information disclosed by either party to the other, whether orally, in writing, or electronically, including but not limited to API documentation, technical specifications, business plans, pricing, and customer data, that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information.
• "Data" means all information, content, and data transmitted to, from, or through the API, including transaction records, account information, and metadata.
• "Endpoints" means the specific URLs and URI paths through which the API resources and methods are accessed.
• "Production Environment" means the live operational environment in which API calls result in real financial transactions and affect actual accounts and balances.
• "Sandbox Environment" means the testing and development environment provided by Revenu that simulates Production Environment functionality without processing real financial transactions.
• "Rate Limits" means the maximum number of API requests permitted within a specified time period, as established by Revenu and communicated through API documentation or contractual agreements.
• "SLA" or "Service Level Agreement" means the service availability and performance commitments made by Revenu as set forth in Section 8 of these API Terms.
• "Webhook" means an HTTP callback mechanism through which Revenu delivers real-time event notifications to Client-specified endpoints.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection legislation, including the Brazilian General Data Protection Law (LGPD, Lei No. 13.709/2018), the European General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), and the California Consumer Privacy Act (CCPA).
• "Controller" means the natural or legal person that determines the purposes and means of the processing of Personal Data, as defined under applicable data protection law.
• "Processor" means the natural or legal person that processes Personal Data on behalf of the Controller, as defined under applicable data protection law.

Subject to the Client's compliance with these API Terms, Revenu hereby grants to the Client a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the API solely for the purpose of integrating banking and financial services into the Client's applications in accordance with Revenu's API documentation.

This license does not grant the Client any right, title, or interest in or to the API, the underlying software, infrastructure, or any intellectual property of Revenu. The Client shall not sublicense, distribute, sell, lease, or otherwise make the API or any derivative thereof available to any third party without the prior written consent of Revenu.

The license granted herein is conditioned upon the Client's ongoing compliance with these API Terms. Revenu reserves the right to revoke this license at any time, with or without cause, upon written notice to the Client. In the event of revocation for cause, Revenu may terminate access immediately without prior notice.

The Client acknowledges that the API may be updated, modified, or discontinued by Revenu at any time in accordance with the versioning and deprecation policies set forth in Section 17. The license granted herein extends to all updates and modifications made available to the Client during the term of these API Terms.

Nothing in these API Terms shall be construed as granting, by implication, estoppel, or otherwise, any license or right to use any Revenu trademark, service mark, trade name, or logo without the prior written consent of Revenu.

To access the API, the Client must register for a Revenu developer account and obtain valid API Keys. The Client is solely responsible for maintaining the confidentiality and security of all API Keys, credentials, and authentication tokens issued to the Client.

The Client shall be fully responsible for all activities that occur under or through the use of the Client's API Keys, regardless of whether such activities are authorized by the Client. The Client shall implement appropriate internal controls and access management procedures to ensure that API Keys are only accessible to authorized personnel.

All API requests to Production Environment endpoints must be authenticated using industry-standard protocols as specified in Revenu's API documentation, including but not limited to OAuth 2.0 authorization flows and mutual TLS (mTLS) certificate-based authentication where required by Revenu.

The Client shall immediately notify Revenu at security@revenu.tech upon discovering or suspecting any unauthorized access, use, or compromise of API Keys or credentials. The Client shall cooperate fully with Revenu in investigating and remediating any security incident involving compromised credentials.

Revenu reserves the right to rotate, revoke, or reissue API Keys at any time for security reasons. For non-emergency key rotations, Revenu shall provide the Client with at least thirty (30) calendar days'advance notice. The Client shall implement key rotation procedures capable of handling credential changes without service disruption.

The Client shall not embed API Keys, secrets, or credentials in client-side code, mobile applications, public repositories, or any location accessible to end users. The Client shall utilize secure server-side storage mechanisms and environment variable management for all API credentials.

The Client is authorized to use the API solely for the following purposes, subject to any additional restrictions set forth in the Client's commercial agreement with Revenu:

• Integrating banking-as-a-service (BaaS) capabilities into the Client's applications, including account management, balance inquiries, statement generation, and ledger operations through Revenu's Core Banking API.
• Initiating and processing payment transactions through supported payment methods, including but not limited to: PIX (instant payments), TED (interbank electronic transfers), and Boleto Bancário in Brazil; ACH (Automated Clearing House), Wire Transfers, and FedNow in the United States; and SEPA (Single Euro Payments Area) transfers in the European Union.
• Managing accounts, sub-accounts, virtual accounts, ledger entries, and performing transaction reconciliation using the API's financial infrastructure endpoints.
• Implementing KYC (Know Your Customer) and AML (Anti-Money Laundering) verification workflows through Revenu's onboarding and compliance API endpoints.
• Accessing the Sandbox Environment for development, testing, quality assurance, and integration validation purposes prior to deployment in the Production Environment.
• Receiving and processing Webhook event notifications for real-time transaction status updates, account events, and compliance alerts.

The Client shall not, and shall not permit any third party to, engage in any of the following activities in connection with the use of the API:

• Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, underlying algorithms, data structures, or architectural design of the API or any component thereof.
• Scrape, crawl, index, or systematically extract data from the API beyond the scope of the Client's authorized integration, or use automated means to access the API other than through the provided endpoints using authorized credentials.
• Conduct performance benchmarking, load testing, or stress testing of the API or the Production Environment without the prior written consent of Revenu.
• Circumvent, disable, or interfere with any rate limiting, throttling, security controls, access restrictions, or other technical measures implemented by Revenu.
• Use the API to facilitate, process, or conceal illegal transactions, money laundering, terrorist financing, sanctions evasion, fraud, or any other activity that violates applicable laws, including but not limited to the Brazilian Anti-Money Laundering Law (Lei No. 9.613/1998), the U.S. Bank Secrecy Act, and the EU Anti-Money Laundering Directive (AMLD6).
• Store, process, or transmit cardholder data, primary account numbers (PANs), or other sensitive payment data outside of PCI DSS-compliant environments and in violation of PCI DSS requirements.
• Resell, redistribute, sublicense, or otherwise commercially exploit direct access to the API without a valid partnership or reseller agreement with Revenu.
• Use the API or any data obtained through the API for the purpose of building competitive products or services, competitive intelligence gathering, or competitive analysis of Revenu's platform, technology, or business.

Revenu enforces rate limits on API requests to ensure platform stability, fair resource allocation, and optimal performance for all clients. Rate limits are applied on a per-endpoint, per-API-key basis and may vary depending on the endpoint category, the Client's subscription tier, and the applicable environment.

Sandbox Environment: The default rate limit for the Sandbox Environment is one hundred (100) requests per minute per API key, unless otherwise specified in the Client's agreement. Sandbox rate limits are intended to support development and testing activities and are not indicative of Production Environment capacity.

Production Environment: Production rate limits are established on a per-contract basis and are specified in the Client's commercial agreement or service order with Revenu. Production rate limits may include burst allowances permitting temporary exceedance of sustained rate limits for short periods, subject to platform capacity.

When a rate limit is exceeded, the API will return an HTTP 429 (Too Many Requests) response. The response will include a "Retry-After" header indicating the number of seconds the Client should wait before submitting additional requests. The Client must implement exponential backoff with jitter in retry logic to avoid exacerbating rate limit conditions.

Repeated or persistent violation of rate limits, including patterns indicative of abusive or excessive usage, may result in temporary throttling, suspension of API access, or permanent revocation of API Keys at Revenu's sole discretion.

The Client shall implement reasonable caching, request batching, and pagination strategies to minimize unnecessary API calls and optimize API consumption efficiency.

Revenu commits to maintaining a Production Environment API availability target of ninety-nine point ninety-nine percent (99.99%) measured on a calendar-month basis, which corresponds to a maximum permissible downtime of approximately four minutes and twenty-three seconds (4 min 23 sec) per month or approximately fifty-two minutes and thirty-six seconds (52 min 36 sec) per year.

Scheduled maintenance windows shall be communicated to the Client at least seventy-two (72) hours in advance via email notification and publication on the Revenu status page. Scheduled maintenance periods are excluded from availability calculations. Revenu shall use commercially reasonable efforts to schedule maintenance during periods of lowest API traffic.

The SLA availability calculation excludes the following: (a) periods of scheduled maintenance; (b) downtime caused by force majeure events, including natural disasters, acts of war, terrorism, pandemics, government actions, and Internet backbone failures; (c) issues caused by the Client's infrastructure, code, configuration, or network connectivity; (d) API unavailability resulting from DDoS attacks or other security incidents originating from third parties; and (e) Sandbox Environment availability.

In the event that Revenu fails to meet the SLA availability target, the Client may request service credits as follows, provided the claim is submitted in writing within thirty (30) calendar days of the affected period:

• Monthly availability below 99.99% but at or above 99.9%: a service credit equal to ten percent (10%) of the monthly API fees for the affected period.
• Monthly availability below 99.9% but at or above 99.0%: a service credit equal to twenty-five percent (25%) of the monthly API fees for the affected period.
• Monthly availability below 99.0%: a service credit equal to fifty percent (50%) of the monthly API fees for the affected period.

Both parties shall comply with all applicable data protection and privacy laws in connection with the processing of Personal Data through the API. The specific regulatory obligations vary by jurisdiction as set forth below.

Brazil - LGPD Compliance: With respect to Personal Data of data subjects located in Brazil, the parties shall comply with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais - LGPD, Lei No. 13.709/2018, as amended). In the context of API data processing, the Client typically acts as the Controller and Revenu acts as the Processor (Operador), unless otherwise specified in the applicable Data Processing Agreement (DPA). Revenu shall process Personal Data only in accordance with the Client's documented instructions and the purposes specified in the DPA.

Under the LGPD, the Client shall ensure a valid legal basis for processing (Art. 7), implement data minimization principles, and guarantee data subject rights including access (Art. 18, I), correction (Art. 18, III), anonymization, blocking, or deletion of unnecessary data (Art. 18, IV), data portability (Art. 18, V), and information about shared data (Art. 18, VII). The Client shall designate a Data Protection Officer (Encarregado) as required under Art. 41 of the LGPD.

In the event of a security incident involving Personal Data processed through the API, Revenu shall notify the Client without undue delay and within seventy-two (72) hours of becoming aware of the incident, enabling the Client to fulfill its obligation to notify the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados - ANPD) and affected data subjects as required under Art. 48 of the LGPD.

United States - CCPA/CPRA and Financial Privacy: With respect to Personal Data of consumers residing in the State of California, the parties shall comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Revenu acts as a "Service Provider" under the CCPA and shall not sell, share, or use Personal Data for any purpose other than providing the API services. The Client shall provide necessary disclosures and honor consumer rights requests as required under Cal. Civ. Code §§ 1798.100-1798.199.100.

For financial data processed through the API, the parties shall comply with the Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. §§ 6801-6809) and its implementing regulations, including the FTC Safeguards Rule (16 CFR Part 314). Revenu maintains SOC 2 Type II controls and undergoes annual third-party audits to verify the effectiveness of its security program.

Both parties shall comply with applicable state data breach notification laws, including but not limited to the laws of all fifty (50) states, the District of Columbia, and applicable U.S. territories.

Europe - GDPR Compliance: With respect to Personal Data of data subjects located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the parties shall comply with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable national implementing legislation. Revenu acts as a Processor under GDPR Art. 28, and the parties shall enter into a Data Processing Agreement incorporating the mandatory provisions of Art. 28(3).

The Client shall ensure compliance with data subject rights under GDPR Chapter III, including the right of access (Art. 15), right to rectification (Art. 16), right to erasure (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), and right to object (Art. 21). Where required, the Client shall conduct a Data Protection Impact Assessment (DPIA) pursuant to Art. 35.

For international transfers of Personal Data from the EEA to Brazil or other third countries, the parties shall rely on the European Commission's Standard Contractual Clauses (SCCs) as adopted by Commission Implementing Decision (EU) 2021/914, or other recognized transfer mechanisms under GDPR Art. 46. Revenu shall cooperate with the Client in implementing supplementary measures as recommended by the European Data Protection Board (EDPB).

Cross-Border Data Transfers: Primary data storage is located in Brazil. Content delivery and edge processing may utilize CDN nodes in multiple geographic regions. Revenu respects adequacy decisions issued by competent data protection authorities and implements appropriate transfer mechanisms, including SCCs for EU-to-Brazil transfers and compliance with the UK International Data Transfer Agreement (IDTA) for UK-to-Brazil transfers.

The Client shall implement and maintain the following security measures in connection with its use of the API:

Where the Client processes, stores, or transmits payment card data through the API, the Client shall maintain compliance with the Payment Card Industry Data Security Standard (PCI DSS) and shall provide evidence of compliance upon Revenu's request.

• Use TLS 1.2 or higher (TLS 1.3 recommended) for all API communications. Plaintext HTTP connections are not supported and will be rejected.
• Secure all API Keys, secrets, tokens, and credentials using server-side storage mechanisms such as hardware security modules (HSMs), secret management services (e.g., HashiCorp Vault, AWS Secrets Manager), or encrypted environment variables. API Keys shall never be embedded in client-side code, mobile applications, public repositories, or version control systems.
• Implement IP address allowlisting for Production API access where this feature is made available by Revenu, restricting API calls to known and authorized IP addresses or CIDR ranges.
• Continuously monitor API usage for unauthorized access, anomalous request patterns, and potential security threats. The Client shall maintain audit logs of all API interactions for a minimum period of twelve (12) months.
• Report any suspected or confirmed security incidents affecting the API, API Keys, or data processed through the API to Revenu at security@revenu.tech within twenty-four (24) hours of discovery.

• AES-256 encryption for all data at rest, including database storage, backups, and archival systems.
• TLS 1.3 encryption for all data in transit between Revenu's systems and external connections.
• Vault-managed secrets with automatic rotation for all internal credentials and encryption keys.
• Hash-chained (blockchain-anchored) audit trails providing immutable and tamper-evident records of all API transactions and administrative actions.

The Client acknowledges that use of the API involves financial services that are subject to extensive regulatory oversight in multiple jurisdictions. The Client shall comply with all applicable financial laws, regulations, and regulatory guidance in each jurisdiction in which the Client operates or in which the Client's end users are located.

Brazil: The Client shall comply with all applicable regulations issued by the Central Bank of Brazil (Banco Central do Brasil - BACEN), including but not limited to: Resolução BCB No. 85/2021 regarding cybersecurity policy and information security requirements for financial institutions and payment institutions; Resolução BCB No. 443/2024 regarding anti-money laundering (PLD/FTP) procedures for boleto bancário transactions; and Resolução BCB No. 497/2025 regarding PSTI (Transferência Especial PIX) limits and operational requirements.

The Client shall comply with all PIX regulations established by BACEN, including the PIX Regulation (Regulamento do PIX) and associated operational manuals. The Client shall implement the Mecanismo Especial de Devolução (MED 2.0) for PIX fraud prevention and refund processing as required by BACEN, ensuring adherence to the prescribed timeframes and procedures for dispute resolution and fund return.

The Client shall comply with Brazilian anti-money laundering legislation, including Lei No. 9.613/1998 (as amended by Lei No. 12.683/2012), and related regulations issued by COAF (Conselho de Controle de Atividades Financeiras), implementing customer due diligence (CDD), enhanced due diligence (EDD), suspicious transaction reporting (STR), and record-keeping obligations. Where applicable, the Client shall comply with CVM (Comissão de Valores Mobiliários) regulations governing securities-related activities.

United States: The Client shall comply with the Bank Secrecy Act (BSA, 31 U.S.C. §§ 5311-5332) and implementing regulations issued by the Financial Crimes Enforcement Network (FinCEN), including customer identification program (CIP) requirements, currency transaction reporting (CTR), and suspicious activity reporting (SAR) obligations.

The Client shall comply with all applicable sanctions programs administered by the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury, including screening all transaction parties against the Specially Designated Nationals and Blocked Persons List (SDN List) and other applicable sanctions lists.

The Client shall comply with applicable provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Pub. L. 111-203), including the Consumer Financial Protection Bureau (CFPB) regulations governing consumer financial products and services. The Client shall obtain and maintain all required state money transmitter licenses (MTLs) or applicable exemptions in each U.S. state in which the Client conducts money transmission activities.

Europe: The Client shall comply with the Payment Services Directive 2 (PSD2, Directive (EU) 2015/2366) and its successor PSD3 (proposed Directive on Payment Services), including strong customer authentication (SCA) requirements, open banking access provisions, and payment institution licensing requirements. The Client shall comply with applicable delegated and implementing regulations, including Regulatory Technical Standards (RTS) on SCA and common and secure communication.

The Client shall comply with the 6th Anti-Money Laundering Directive (AMLD6, Directive (EU) 2024/1640) and the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), including customer due diligence, beneficial ownership identification, and suspicious transaction reporting to the applicable Financial Intelligence Unit (FIU).

Where the Client's use of the API involves crypto-assets or digital assets, the Client shall comply with the Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), including licensing, disclosure, and operational requirements for crypto-asset service providers (CASPs).

Revenu retains all right, title, and interest in and to the API, including all associated documentation, SDKs, sample code, tools, libraries, infrastructure, and any updates, modifications, or derivative works thereof. All intellectual property rights, including patents, copyrights, trademarks, trade secrets, and any other proprietary rights in and to the API and Revenu's platform, are and shall remain the exclusive property of Revenu.

The Client retains all right, title, and interest in and to the Client's applications, including any software, content, or materials developed independently by the Client that integrate with the API. Nothing in these API Terms shall be construed as transferring any of the Client's intellectual property rights to Revenu.

The Client hereby grants Revenu a limited, non-exclusive, royalty-free license to process, store, transmit, and display Client data as reasonably necessary for Revenu to provide the API services, perform its obligations under these API Terms, and comply with applicable legal requirements. This license shall survive termination solely to the extent necessary for Revenu to fulfill its legal and regulatory obligations.

The Client shall not use Revenu's trademarks, service marks, trade names, logos, or other brand identifiers without the prior written consent of Revenu. Any permitted use of Revenu's marks shall comply with Revenu's brand guidelines as communicated to the Client.

All API documentation, technical specifications, endpoint schemas, authentication protocols, and non-public materials provided by Revenu to the Client shall be treated as Confidential Information of Revenu. The Client shall protect such Confidential Information using the same degree of care it uses to protect its own confidential information, but in no event less than a reasonable degree of care.

The obligations of confidentiality shall survive termination or expiration of these API Terms for a period of three (3) years following the date of termination or expiration, except with respect to trade secrets, which shall be protected for as long as they remain trade secrets under applicable law.

The confidentiality obligations set forth herein shall not apply to information that: (a) is or becomes publicly available through no fault or action of the receiving party; (b) was rightfully in the possession of the receiving party prior to disclosure by the disclosing party, without restriction on disclosure; (c) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information; or (d) is required to be disclosed by law, regulation, or court order, provided that the receiving party gives the disclosing party prompt written notice of such requirement (to the extent legally permitted) and cooperates with the disclosing party's efforts to obtain protective treatment for the information.

Each party acknowledges that unauthorized disclosure of Confidential Information may cause irreparable harm for which monetary damages would be an inadequate remedy, and agrees that the disclosing party shall be entitled to seek injunctive or other equitable relief in addition to any other available remedies.

Fees for API usage shall be calculated on a per-transaction, per-request, or subscription basis as specified in the Client's commercial agreement or service order with Revenu. Detailed pricing schedules are made available to the Client during the onboarding process and are incorporated herein by reference.

Revenu shall issue monthly invoices to the Client reflecting the API usage and applicable fees incurred during the preceding calendar month. Payment shall be due within thirty (30) calendar days from the date of invoice ("Net-30"), unless otherwise specified in the Client's commercial agreement.

Late payments shall accrue interest at a rate equal to the SELIC rate (Sistema Especial de Liquidação e de Custódia) as published by the Central Bank of Brazil for Client agreements governed by Brazilian law, or at a rate of one and one-half percent (1.5%) per month (or the maximum rate permitted by applicable law, whichever is lower) for Client agreements governed by the laws of other jurisdictions.

All fees for Brazil-based operations shall be denominated and payable in Brazilian Reais (BRL). Fees for international operations shall be denominated and payable in United States Dollars (USD) unless otherwise specified in the Client's commercial agreement. Currency conversion, where applicable, shall be calculated at the exchange rate published by the Central Bank of Brazil on the date of the invoice.

Revenu reserves the right to adjust pricing with at least sixty (60) calendar days' prior written notice to the Client. The Client may terminate the applicable service order without penalty within thirty (30) calendar days of receiving notice of a price increase, provided the Client has paid all fees accrued prior to the effective date of termination.

In the event of a billing dispute, the Client shall pay all undisputed amounts by the due date and shall submit a written notice of the disputed charges to billing@revenu.tech within fifteen (15) calendar days of the invoice date. The parties shall work in good faith to resolve any billing disputes within thirty (30) calendar days.

Revenu provides a Sandbox Environment subject to the following conditions:

• The Sandbox Environment is provided free of charge to registered API clients for development, testing, and integration validation purposes.
• No real financial transactions are processed in the Sandbox Environment. All transactions, accounts, balances, and entities within the Sandbox are simulated and do not affect any real financial systems or accounts.
• Data created within the Sandbox Environment is subject to a thirty (30) day retention period, after which it may be automatically purged without notice. The Client shall not rely on the Sandbox for persistent data storage.
• The Sandbox Environment is not covered by the SLA commitments set forth in Section 8. Revenu makes no guarantees regarding the availability, performance, or reliability of the Sandbox Environment.
• The Sandbox Environment is subject to rate limiting as described in Section 7. Default Sandbox rate limits are lower than Production Environment limits.
• The Client shall not use the Sandbox Environment for production workloads, live customer data processing, or any purpose other than development and testing. Revenu reserves the right to reset or clear Sandbox data at any time.

Revenu delivers real-time event notifications to the Client via Webhooks. The Client shall provide valid HTTPS endpoints (TLS 1.2 or higher) for receiving Webhook notifications. Revenu shall not deliver Webhook events to plaintext HTTP endpoints.

The Client shall implement idempotent event processing to handle the possibility of duplicate Webhook deliveries. Each Webhook event includes a unique event identifier that the Client should use for deduplication purposes.

In the event of a failed Webhook delivery (i.e., the Client's endpoint does not return an HTTP 2xx response), Revenu shall retry delivery up to three (3) times using an exponential backoff schedule (approximately 1 minute, 5 minutes, and 30 minutes after the initial failure). If all retry attempts fail, the event shall be made available through Revenu's event retrieval API for up to seven (7) days.

The Client's Webhook endpoint must respond with an HTTP 2xx status code within five (5) seconds of receiving a Webhook notification. Responses taking longer than five (5) seconds will be treated as delivery failures and will trigger the retry mechanism described above.

All Webhook notifications are signed using HMAC-SHA256 with a shared secret unique to the Client. The Client must verify the Webhook signature on every received event to ensure authenticity and integrity of the notification. The signature is included in the "X-Revenu-Signature" HTTP header.

The Revenu API is versioned using a major version scheme (e.g., v1, v2, v3). The API version is specified in the request URL path (e.g., /api/v1/accounts). Each major version represents a distinct API contract with its own set of endpoints, request/response schemas, and behaviors.

When a new major API version is released, the preceding version shall be supported for a minimum period of twelve (12) months from the date the deprecation notice is published. During the deprecation period, the deprecated version shall continue to function and receive security patches, but shall not receive new features or non-critical bug fixes.

Breaking changes, defined as changes that would cause existing Client integrations to fail or behave differently without code modifications, shall be announced at least ninety (90) calendar days in advance through email notification to registered API clients and publication on the Revenu developer documentation portal at docs.revenu.tech.

Non-breaking changes, including the addition of new optional request parameters, new response fields, new endpoints, and new event types, may be deployed without advance notice. The Client's integration should be designed to gracefully handle unknown response fields and new event types without errors.

Revenu maintains a public API changelog at docs.revenu.tech/changelog, documenting all changes to the API including new features, bug fixes, deprecations, and breaking changes. The Client is encouraged to subscribe to changelog notifications to stay informed of API changes.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL REVENU, ITS AFFILIATES, DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, REVENUE, GOODWILL, DATA, BUSINESS OPPORTUNITIES, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR IN CONNECTION WITH THESE API TERMS OR THE USE OF OR INABILITY TO USE THE API, REGARDLESS OF THE THEORY OF LIABILITY (WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE) AND EVEN IF REVENU HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

REVENU'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE API TERMS OR THE USE OF THE API SHALL NOT EXCEED THE TOTAL AMOUNT OF FEES ACTUALLY PAID BY THE CLIENT TO REVENU DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

The limitations of liability set forth in this Section 18 shall not apply to: (a) either party's indemnification obligations under Section 19; (b) either party's breach of confidentiality obligations under Section 13; (c) the Client's breach of the prohibited uses set forth in Section 6; or (d) liability arising from a party's gross negligence, willful misconduct, or fraud.

Neither party shall be liable for any failure or delay in performing its obligations under these API Terms (other than payment obligations) to the extent that such failure or delay results from a force majeure event, including but not limited to acts of God, natural disasters, pandemics, epidemics, war, terrorism, riots, government actions or orders, labor disputes, Internet backbone failures, power outages, or other events beyond the reasonable control of the affected party.

The Client acknowledges that the API fees reflect the allocation of risk set forth in these API Terms and that Revenu would not enter into these API Terms without the limitations of liability contained herein.

The Client shall defend, indemnify, and hold harmless Revenu, its affiliates, and their respective directors, officers, employees, agents, successors, and assigns from and against any and all third-party claims, demands, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or relating to:

Revenu shall promptly notify the Client of any claim subject to indemnification, provide the Client with reasonable cooperation in the defense of such claim, and grant the Client sole control over the defense and settlement of such claim, provided that the Client shall not settle any claim that imposes any obligation on Revenu or admits any liability on behalf of Revenu without Revenu's prior written consent.

• The Client's use of the API, including any integration, application, or service built by the Client using the API, and any data processed through the Client's use of the API.
• Any dispute between the Client and the Client's end users, customers, or business partners arising from the Client's products or services that utilize the API.
• The Client's violation of any applicable law, regulation, or regulatory requirement, including but not limited to data protection laws, financial regulations, and anti-money laundering requirements.
• Any data breach, security incident, or unauthorized access to Personal Data or financial data that results from the Client's failure to comply with the security obligations set forth in Section 10 or the Client's negligent or wrongful acts or omissions.

Either party may terminate these API Terms at any time upon thirty (30) calendar days' prior written notice to the other party, sent by email to the contact address on record or by registered mail.

Either party may terminate these API Terms immediately upon written notice if the other party commits a material breach of any provision of these API Terms and fails to cure such breach within fifteen (15) calendar days after receiving written notice specifying the nature of the breach and the actions required to cure it.

Revenu may terminate these API Terms and immediately revoke all API access, without prior notice or opportunity to cure, if the Client engages in illegal activity, violates the prohibited uses set forth in Section 6, poses an imminent threat to the security or integrity of Revenu's platform, or becomes subject to insolvency proceedings, bankruptcy, receivership, or liquidation.

Upon termination or expiration of these API Terms, regardless of the reason: (a) all licenses granted herein shall immediately terminate; (b) the Client shall immediately cease all use of the API and delete or destroy all copies of API documentation and Confidential Information in the Client's possession; (c) Revenu shall make the Client's data available for export for a period of thirty (30) calendar days following the effective date of termination, after which Revenu may delete such data; and (d) all fees accrued prior to termination shall become immediately due and payable.

The following sections shall survive termination or expiration of these API Terms: Section 2 (Definitions), Section 6 (Prohibited Uses), Section 12 (Intellectual Property), Section 13 (Confidentiality), Section 14 (Fees and Payment, with respect to accrued obligations), Section 18 (Limitation of Liability), Section 19 (Indemnification), Section 21 (Dispute Resolution), and Section 23 (General Provisions).

Brazil: For Clients domiciled in Brazil, these API Terms shall be governed by and construed in accordance with the laws of the Federative Republic of Brazil. Any disputes arising out of or in connection with these API Terms shall first be submitted to mediation for a period of thirty (30) calendar days. If mediation fails to resolve the dispute, it shall be submitted to binding arbitration administered by the Center for Arbitration and Mediation of the Chamber of Commerce Brazil-Canada (CAM-CCBC) in São Paulo, Brazil, in accordance with its arbitration rules then in effect. The language of the arbitration shall be Portuguese. Notwithstanding the foregoing, the courts of the Judicial District of São Paulo (Foro da Comarca de São Paulo), State of São Paulo, shall have exclusive jurisdiction for urgent injunctive or provisional relief.

United States: For Clients domiciled in the United States, these API Terms shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflicts of law principles. Any disputes arising out of or in connection with these API Terms shall be resolved by binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, with the seat of arbitration in New York, New York. The language of the arbitration shall be English. The courts of the State of Delaware shall have exclusive jurisdiction for any disputes not subject to arbitration.

Europe: For Clients domiciled in the European Economic Area (EEA), the United Kingdom, or Switzerland, these API Terms shall be governed by the laws of the Client's country of domicile, subject to the mandatory provisions of applicable EU law, including the GDPR. Any disputes arising out of or in connection with these API Terms shall be submitted to the competent courts of the Client's country of domicile. Consumers may also make use of the European Commission's Online Dispute Resolution platform (https://ec.europa.eu/consumers/odr).

Regardless of jurisdiction, no class action, collective action, or representative action or proceeding shall be brought in connection with these API Terms. All claims shall be resolved on an individual basis. The parties expressly waive any right to participate in a class action lawsuit or class arbitration against the other party.

Revenu reserves the right to modify, amend, or update these API Terms at any time. Revenu shall provide the Client with at least thirty (30) calendar days' prior written notice of any modifications via email to the Client's registered email address and by publishing the updated API Terms on the Revenu developer documentation portal at docs.revenu.tech.

Non-material modifications, such as corrections of typographical errors, formatting changes, or updates to contact information, may be made without advance notice. The Client's continued use of the API following the effective date of any modifications constitutes the Client's acceptance of the modified API Terms.

Material modifications, including changes that substantively affect the Client's rights or obligations, changes to pricing, SLA commitments, data processing practices, or liability provisions, shall require the Client's explicit written consent. If the Client does not consent to a material modification, the Client may terminate these API Terms without penalty by providing written notice within thirty (30) calendar days of receiving notification of the material change.

Entire Agreement: These API Terms, together with any applicable commercial agreement, service orders, Data Processing Agreement, and Privacy Policy, constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral.

Severability: If any provision of these API Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect any other provision of these API Terms, and these API Terms shall be construed as if such invalid, illegal, or unenforceable provision had never been contained herein. The parties shall negotiate in good faith a replacement provision that is valid and enforceable and that most closely approximates the original intent.

No Waiver: The failure of either party to enforce any right or provision of these API Terms shall not constitute a waiver of such right or provision. Any waiver of any provision of these API Terms shall be effective only if in writing and signed by the waiving party.

Assignment: The Client shall not assign, transfer, or delegate any of its rights or obligations under these API Terms without the prior written consent of Revenu. Revenu may assign these API Terms to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets without the Client's consent. Any purported assignment in violation of this section shall be null and void.

Notices: All notices required or permitted under these API Terms shall be in writing and shall be deemed effective upon delivery when sent by email to the parties' registered email addresses or by registered mail with return receipt to the parties' registered physical addresses.

Language: For Clients domiciled in Brazil, the Portuguese language version of these API Terms shall prevail in the event of any conflict or discrepancy between language versions. For all other Clients, the English language version shall prevail.

For questions, concerns, or notices regarding these API Terms, the Client may contact Revenu through the following channels:

• Legal Department: legal@revenu.tech
• Data Protection Officer (DPO / Encarregado): dpo@revenu.tech
• Security Incident Reporting: security@revenu.tech
• Registered Office: Av. Brig. Faria Lima, 1811, Sala 1119, CEP 01.452-001, São Paulo - SP, Brazil