Terms of Service

By accessing or using the CardStack platform ("Platform"), you agree to be bound by these Terms of Service ("Terms"), our Privacy Policy, and our Cookie Policy (collectively, the "Agreement"). If you do not agree, you must immediately cease using the Platform.

CardStack is operated by CardStack Technologies Ltd, registered in England and Wales (Company No. 12345678), with its registered office at 1 Platform Street, London, EC2V 8RF ("CardStack", "we", "us", "our").

Amendments: We may modify these Terms at any time. For material changes, we will provide at least 30 days' notice via email or a prominent in-app notice. Continued use after the effective date of any change constitutes your acceptance of the updated Terms. If you do not accept amended Terms, you must close your account before the effective date.

You must be at least 18 years of age and have full legal capacity to enter binding contracts in your jurisdiction. By registering, you represent and warrant that:

• You are at least 18 years old and legally competent to enter into this Agreement.
• You are not a resident of, or located in, any jurisdiction where use of the Platform is prohibited by applicable law or regulation, including jurisdictions subject to comprehensive sanctions by the UK (OFAC UK), the United Nations, the European Union, or the United States.
• You are not named on the UK Consolidated Sanctions List, the US OFAC SDN List, or equivalent restrictive measures lists.
• All information you provide to CardStack is accurate, complete, and not misleading.
• Your use of the Platform complies with all applicable laws in your jurisdiction.

CardStack reserves the right to refuse or terminate service to any person at any time without liability, including in response to regulatory direction.

Account Creation: To access most Platform features, you must create an account by providing accurate and complete information. You agree to keep your registration details current at all times.

Security: You are solely responsible for maintaining the confidentiality of your login credentials. You agree to:

• Use a strong, unique password and enable two-factor authentication (2FA) where offered.
• Not share your credentials with any third party.
• Notify us immediately at security@cardstack.app of any suspected unauthorised access or security breach.
• Accept responsibility for all activities conducted under your account.

CardStack will never request your password via email, telephone, or chat.

Identity Verification (KYC): In compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended), and the HMRC Cryptoasset Reporting Framework (CARF) effective January 2026, CardStack is required to verify the identity of users accessing certain features (including withdrawals, trading above threshold limits, and fiat on/off ramp services). You agree to:

• Provide accurate government-issued identity documents and proof of address upon request.
• Consent to electronic identity verification via third-party services (e.g. Onfido, Jumio).
• Undergo enhanced due diligence (EDD) if your activity is flagged as higher risk.

Failure to complete verification will result in account restrictions. CardStack may freeze accounts and report suspicious activity to the National Crime Agency (NCA) under the Proceeds of Crime Act 2002 (POCA 2002) without notifying you ("tipping off" prohibition under POCA 2002 s.333A).

CardStack provides the following services (collectively, "Services"):

Trading & Markets: A platform for trading digital collectibles, BBB Cards, and synthetic market instruments. All trading is conducted on a non-advised basis — CardStack does not make recommendations and does not execute orders in FCA-regulated financial instruments.

Digital Assets & Tokens: CardStack Tokens and BBB Cards are utility tokens for use within the CardStack Platform ecosystem. They are not transferable securities, bonds, or financial instruments regulated under the Financial Services and Markets Act 2000 (FSMA 2000). They do not represent equity, debt, or ownership in CardStack Technologies Ltd. Token values may fluctuate significantly and may fall to zero.

Marketplace: CardStack operates a peer-to-peer marketplace where users may list, buy, and sell digital items. CardStack acts as an intermediary facilitating transactions and is not a party to contracts between users. CardStack does not guarantee the quality, legality, or authenticity of listed items beyond the digital verification provided by the Platform.

AI-Powered Features: AI-generated content, recommendations, and tools are provided for informational and creative purposes only. In accordance with the EU AI Act (Regulation 2024/1689) and the UK Government's AI Assurance Framework, AI outputs do not constitute professional, financial, legal, or medical advice. You should not rely on AI outputs for consequential decisions.

Availability: We do not guarantee uninterrupted availability. We may suspend or modify Services at any time for maintenance, security, legal, or regulatory compliance reasons.

NOT REGULATED: CardStack Technologies Ltd is not authorised or regulated by the Financial Conduct Authority (FCA), the Prudential Regulation Authority (PRA), or any equivalent financial regulatory body to provide:

• Investment advice or recommendations regarding any financial instrument.
• Discretionary portfolio management.
• Dealing in, or arranging deals in, FCA-specified investments.
• Payment services governed by the Payment Services Regulations 2017 (PSR 2017).

Nothing on the Platform constitutes financial, investment, tax, or legal advice. You should seek independent professional advice before making any financial decision.

Consumer Duty Awareness: While CardStack is not a directly regulated firm, we are committed to the principles of the FCA's Consumer Duty (PS22/9, effective 31 July 2023) — we aim to deliver good outcomes for users, provide clear and fair communications, and not exploit behavioural biases.

Tax: You are solely responsible for all tax obligations arising from your Platform activity, including Capital Gains Tax (HMRC CRYPTO 1000 guidance), Income Tax on trading income, and VAT as applicable. CardStack does not provide tax advice.

Payments: Payment processing is facilitated by PCI-DSS-compliant third-party processors. By using payment features, you agree to the applicable processor's terms.

You must not use the Platform to engage in any activity that is unlawful, harmful, or violates these Terms, including:

• Market Manipulation: Wash trading, spoofing, layering, front-running, pump-and-dump schemes, or any practice intended to create a misleading impression of supply, demand, or price — contrary to the Criminal Justice Act 1993 (CJA 1993) and UK MAR.
• Money Laundering & Terrorist Financing: Using the Platform to layer, integrate, or conceal proceeds of crime, or to fund terrorist activity — contrary to POCA 2002 and the Terrorism Act 2000.
• Sanctions Evasion: Circumventing KYC/AML controls, using the Platform to breach applicable sanctions regimes — contrary to the Sanctions and Anti-Money Laundering Act 2018 (SAMLA 2018).
• Unauthorised Computer Access: Attempting to gain unauthorised access to Platform systems, databases, or infrastructure — contrary to the Computer Misuse Act 1990.
• Harmful or Illegal Content: Uploading, transmitting, or distributing content that is illegal, defamatory, fraudulent, harassing, or in breach of any third-party intellectual property rights — contrary to the Online Safety Act 2023.
• Automated Scraping: Using bots, scrapers, or automated tools to extract Platform data at scale without express written permission.
• Impersonation: Misrepresenting your identity or affiliation with any person or entity.

Violations may result in immediate account suspension, forfeiture of funds where legally permitted, and referral to relevant law enforcement or regulatory authorities.

All Platform content, including code, design, trademarks, logos, text, graphics, and databases, is owned by CardStack Technologies Ltd or its licensors and is protected under the Copyright, Designs and Patents Act 1988, the Trade Marks Act 1994, and applicable database rights.

Your Licence: CardStack grants you a limited, personal, non-exclusive, non-transferable, revocable licence to access and use the Platform for lawful personal purposes only. You may not copy, modify, distribute, sell, sublicense, or create derivative works from any Platform content without prior written consent.

User Content: Content you submit (including marketplace listings, profile data, and reviews) remains your intellectual property. By submitting content, you grant CardStack a worldwide, perpetual, royalty-free, sublicensable licence to use, store, reproduce, display, and distribute that content solely in connection with providing and improving the Services. You warrant that you own or have the right to grant this licence.

Feedback: Any feedback or suggestions you provide may be used by CardStack freely without obligation or compensation.

To the maximum extent permitted by applicable law, and subject to the mandatory exceptions below:

• CardStack, its directors, employees, contractors, agents, and affiliates shall not be liable for any indirect, incidental, consequential, special, exemplary, or punitive damages, including but not limited to: loss of profits, loss of revenue, trading losses, loss of data, loss of goodwill, or business interruption.
• CardStack's total aggregate liability to you for all claims arising under or in connection with these Terms shall not exceed the greater of: (a) the total fees paid by you to CardStack in the 12 months preceding the event giving rise to the claim, or (b) £100 GBP.
• CardStack does not warrant that the Platform is free from errors, interruptions, security vulnerabilities, or that any information provided is accurate or complete.

These limitations do not apply to: - Liability for death or personal injury caused by CardStack's negligence (UCTA 1977 s.2(1)). - Liability for fraud or fraudulent misrepresentation. - Any statutory rights you have as a consumer under the Consumer Rights Act 2015 that cannot be excluded. - Any other liability that cannot be lawfully excluded or limited.

If you are a consumer (as defined in CRA 2015 s.2), nothing in these Terms affects your statutory rights.

You agree to indemnify, defend, and hold harmless CardStack Technologies Ltd and its officers, directors, employees, and agents from and against any third-party claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of:

• Your breach of these Terms or any applicable law or regulation.
• Your fraud, willful misconduct, or gross negligence.
• Content or materials you submit to the Platform that infringe any third-party intellectual property, privacy, or other rights.

This indemnification obligation does not apply to losses caused by CardStack's own negligence or breach of statutory duty.

These Terms and any dispute arising from them are governed by and construed in accordance with the laws of England and Wales, without regard to conflict of law principles.

Business Users: Disputes shall first be subject to good-faith negotiation. If unresolved within 30 days, disputes shall be finally determined by binding arbitration under the London Court of International Arbitration (LCIA) Rules, seated in London, England, conducted in English.

Consumer Users: If you are a consumer (as defined in CRA 2015), you retain the right to bring claims before the courts of England and Wales (or your local courts in Scotland or Northern Ireland). You also have access to:

• The Financial Ombudsman Service (FOS) where applicable to regulated activities.
• The EU Online Dispute Resolution (ODR) platform at https://ec.europa.eu/consumers/odr (if accessing from the EU).
• Alternative dispute resolution via CEDR or other ADR bodies as may be agreed.

Nothing in these Terms prevents either party from seeking urgent injunctive relief before a competent court.

Termination by CardStack: We may suspend or terminate your account immediately and without notice if: (a) you materially breach these Terms; (b) we are required to do so by law or regulation; (c) your account shows signs of fraudulent, abusive, or suspicious activity; or (d) continuing the relationship would expose CardStack to legal or regulatory risk.

Note: In certain circumstances required by law (e.g. where an account is frozen pursuant to a suspicious activity report under POCA 2002), CardStack may be prohibited by the "tipping off" provisions (POCA 2002 s.333A) from disclosing the reason for account restriction.

Termination by You: You may close your account at any time by contacting support@cardstack.app with at least 30 days' notice, which allows sufficient time for fund withdrawal and account settlement.

Effect of Termination: Upon termination, your right to use the Platform ceases immediately. Sections 6, 7, 8, 9, 10, and any other provisions that by their nature should survive, shall continue in full force.

Entire Agreement: These Terms, together with the Privacy Policy and Cookie Policy, constitute the entire agreement between you and CardStack regarding the Platform and supersede all prior agreements, representations, and understandings.

Severability: If any provision of these Terms is found to be invalid or unenforceable by a court of competent jurisdiction, it shall be severed to the minimum extent necessary, and the remaining provisions shall continue in full force.

No Waiver: CardStack's failure to enforce any provision of these Terms shall not constitute a waiver of its right to enforce that provision in the future.

Assignment: CardStack may assign its rights and obligations under these Terms to any affiliate or in connection with a merger, acquisition, or sale of substantially all assets, with 30 days' notice to you. You may not assign your rights without CardStack's prior written consent.

Force Majeure: CardStack shall not be liable for failure to perform obligations where such failure results from events beyond CardStack's reasonable control, including natural disasters, government action, cyberattacks, or failures of third-party infrastructure.

Contact: For all legal enquiries: legal@cardstack.app | CardStack Technologies Ltd, Legal Department, 1 Platform Street, London, EC2V 8RF.