Platform Terms of Service and Data Privacy Statement

1. Acceptance of Terms & Scope of Infrastructure

By accessing portafino.co, integrating our SDK/API, connecting a digital wallet, or authenticating via device Passkeys (Apple / Google), you (a "Client" or a "Supplier", each individually a "User" and collectively "Users") enter into a legally binding agreement governed by these Terms of Service. If you do not agree, you must immediately cease accessing our infrastructure.

2. Non-Custodial Nature & Architecture

Portafino provides software orchestration infrastructure, milestone escrow engines, smart contract rails, and Online Dispute Resolution (ODR) tools. User explicitly acknowledges and agrees to the following:

• No Custody of Funds: Portafino is a non-custodial software provider and orchestration layer. We never take possession, custody, or title of user fiat, cryptocurrencies, stablecoins, or private keys. All financial transactions are processed by regulated payment providers.
• Smart Contract Locking: Escrowed funds are locked directly into immutable smart contracts deployed on public blockchain networks. Release of funds is triggered strictly by programmed milestone condition fulfillments, cryptographic signatures, or ODR arbitrations.
• Self-Custody Responsibility: Users maintain sole control over their private keys, Passkeys, hardware keys, and biometric authentication devices. Portafino cannot recover lost private keys or override smart contract logic outside specified ODR governance parameters.

3. Biometric Onboarding & Device-Native Passkey Authentication

To enhance platform security and curb fraudulent account creation, Portafino utilizes device-native Passkey authentication (FIDO2 / WebAuthn standards provided by Apple or Google). Biometric data is authenticated locally on the user's device and is never transmitted to or stored on Portafino's platform. Users agree to maintain exclusive control of their authentication devices.

4. Milestone Escrow Engine & Online Dispute Resolution (ODR)

When executing milestone-based transactions (P2P, B2B, P2A, A2A):

• 4.1 Milestone Binding: Upon fund deposit into the milestone contract, conditions are locked. Fulfilling milestone criteria requires verification by specified oracle feeds, counterparty signatures, or AI agent proofs.
• 4.2 Portal Dispute Flow, Geo-Arbitration, and AI Resolution: Upon escrow setup via the Portafino Portal, Portafino automatically assigns the designated neutral Arbitrator based on the Buyer’s registered geographic location ("Geo"), which the Service Provider explicitly accepts upon agreement sign-up. For disputes under $75,000 USD, parties may mutually consent to resolution via Portafino’s AI Dispute Agent; absent mutual consent, or for disputes equal to or exceeding $75,000 USD, the matter escalates directly to the assigned Geo Arbitrator. All dispute proceedings follow a single-submission model with one opportunity per party to submit evidence. The Arbitrator shall apply the legal or equitable standards designated by Portafino, which may differ from those of the Buyer’s Geo, is not required to provide a written explanation for their award, and all determinations are final, binding, and programmatically executed via smart contract.
• 4.3 Binding ODR Determination: Dispute resolutions rendered by the designated arbitrator or programmatic dispute algorithm in accordance with the pre-agreed terms are final, binding, and programmatically executed by releasing funds to the awarded party via the smart contract.

5. Autonomous AI Agent Commerce (P2A / A2A)

Where Users deploy or interact with autonomous AI agents executing payments or escrow agreements on Portafino rails:

• Principal Liability: The User or legal entity deploying the AI agent acts as legal Principal and assumes full liability for all smart contract interactions, financial obligations, and milestone commitments initiated by the AI agent.
• Agent Verification: AI agents must operate under API keys tied to an authenticated Tier 1 or Tier 2 account. Unidentified AI bots will be disconnected.

6. Fees & Payment Terms

Portafino charges protocol execution fees, milestone escrow fees, and ODR filing fees as detailed on portafino.co or agreed upon in written enterprise contracts. Fees are automatically deducted by smart contracts at the time of milestone settlement.

7. Disclaimers, Limitation of Liability & Indemnification

PORTAFINO INFRASTRUCTURE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PORTAFINO SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING BLOCKCHAIN NETWORK CONGESTION, FORKS, SMART CONTRACT EXPLOITS OUTSIDE OUR DIRECT CONTROL, OR LOSS OF PRIVATE KEYS.

Portafino's maximum aggregate liability shall not exceed the total fees collected by Portafino from the User during the three (3) months preceding the claim.

8. Governing Law & Arbitration

Portafino, Inc. is a Delaware, USA corporation. These Terms of Service, and any non-contractual obligations arising out of or in connection with them, shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without giving effect to any conflict of law principles. Except for milestone and escrow disputes between Users, which are resolved exclusively under Section 4.2, any dispute, controversy, or claim arising out of or relating to these Terms or the breach, termination, or invalidity thereof shall be settled by final and binding arbitration in the State of Delaware in accordance with the Commercial Arbitration Rules of the American Arbitration Association (AAA).

Part 2 · 1. Data Controller & Privacy Regime

Portafino, Inc. acts as the Data Controller responsible for processing your personal data under the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), Delaware Personal Data Privacy Act, and applicable data protection statutes.

Part 2 · 2. Categories of Data Collected

We collect and process the following categories of information under strict Personally Identifiable Information (PII) regulatory standards:

Part 2 · 3. Legal Basis for Processing

We process personal data under the following lawful bases:

• Contractual Necessity: Executing milestone settlements, operating the ODR platform, and fulfilling Terms of Service.
• Compliance with Legal Obligations: Mandatory AML, CFT, sanctions screening, and statutory accounting requirements.
• Legitimate Interests: Fraud prevention, smart contract security, platform optimization, and preventing malicious AI agent activity.
• Explicit Consent: User authorization via device-level authentication protocols.

Part 2 · 4. Sub-Processors & Third-Party Sharing

Portafino shares data only with vetted third-party service providers operating under strict Data Processing Agreements (DPAs):

• Regulated Payment Providers: BVNK, Bridge, or equivalent licensed partners holding PII data.
• Blockchain Analytics: Chainalysis, Elliptic, TRM Labs.
• Cloud & Hosting Infrastructure: Amazon Web Services (AWS EU/US regions), Google Cloud Platform, Microsoft Azure.
• Legal & Regulatory Authorities: FIUs, regulatory bodies, or law enforcement solely pursuant to valid court orders or mandatory SAR requirements.

Part 2 · 5. Special Notice Regarding Blockchain Immutability

Users acknowledge that public blockchain networks are inherently immutable. Transaction data, public wallet addresses, and smart contract event logs recorded on-chain cannot be modified, rectified, or erased by Portafino. By using Portafino, you accept that GDPR/CCPA "Right to be Forgotten" applies to off-chain databases but cannot alter historical public blockchain blocks.

Part 2 · 6. Your Data Subject Rights

Under GDPR, CCPA, and Delaware privacy legislation, users hold rights to request access, correction, data portability, and deletion of off-chain personal data. To exercise these rights, submit a request to our privacy team:

• Compliance Office: contact@portafino.co