Legal Center

Terms of Use

Version 1.0 · Effective October 15, 2026

This is a translation. In case of any discrepancy, the Portuguese version prevails.

These Terms govern the use of the SecurityPag platform by those who receive payments through it. By creating an account or using any functionality, the User declares that it has read, understood, and accepts these Terms and the documents listed in Clause 1.3.

CONTRACTOR: RGST TECNOLOGIA LTDA, a limited liability company registered under CNPJ No. 47.993.283/0001-83, headquartered at Av. Paulista, 302, Conj. 10, Bela Vista, São Paulo/SP, CEP 01310-000, which operates the SecurityPag platform ("SecurityPag").

CLIENT: the individual or legal entity that completes registration on the Platform and has its account approved ("User").

Clause 1 — Acceptance, structure, and interpretation

1.1. This instrument is an adhesion contract entered into electronically. Acceptance occurs by clicking "Create account" or "I accept," or by using the Platform, and has the validity of a written expression of intent, pursuant to Article 10, § 2, of Provisional Measure No. 2,200-2/2001.

1.2. SecurityPag records the date, time, IP address, and version of the document accepted. The current and previous versions are available in the Legal Center on the website.

1.3. The following form part of these Terms as if transcribed herein: (a) Privacy Policy; (b) Cookie Policy; (c) Acceptable Use Policy and Prohibited Activities; (d) Chargeback, Refund and MED Policy; (e) AML/CFT and Know Your Customer Policy; (f) Information Security Policy; (g) Buyer Terms; (h) Fee and Timeframe Schedule displayed on the dashboard; and (i) the Annexes to these Terms.

1.4. In case of conflict, the following prevail, in this order: applicable legislation and regulations; the rules of the Payment Schemes; specific commercial conditions signed between the Parties; these Terms; the other policies.

1.5. In interpreting these Terms: "including" is illustrative; the singular includes the plural; periods are counted in calendar days, unless business days are mentioned; periods that expire on a non-business day are extended to the next Business Day; a reference to a rule includes its amendments and replacements.

Clause 2 — Definitions

• Acquirer: an authorized payment institution that enables card acceptance and takes part in the settlement of Transactions.
• Affiliate: a User that promotes another User's products in exchange for a commission.
• Payment Scheme: the set of rules governing a payment service, such as those of Visa, Mastercard, Elo, American Express, Hipercard, and Pix, pursuant to Law No. 12,865/2013.
• Members Area: the Platform environment for hosting and delivering digital content.
• Card Network/Scheme Owner: the legal entity responsible for a Payment Scheme.
• Chargeback: a dispute of a card Transaction made by the cardholder with the issuer, which may result in reversal of the amount.
• Checkout: the Platform's payment page or component.
• Buyer or Payer: the person who pays a Transaction to the User.
• SecurityPag Account: the User's account on the Platform, with dashboard, statement, and Balance.
• Co-producer: a User that receives part of a product's revenue under a Split rule defined by the Producer.
• Credentials: the User's login, password, authentication factors, API keys, and tokens.
• Business Day: a day with banking hours in Brazil.
• Partner Institution: an institution authorized by the Central Bank of Brazil that provides payment account, Pix, settlement, foreign exchange, or virtual asset services within the Platform.
• MED: the Pix Special Return Mechanism (MED), provided for in the Pix Regulations of the Central Bank of Brazil.
• Platform: the website, dashboard, app, APIs, SDKs, plugins, and other systems of SecurityPag.
• Producer: the User that owns the product or service offered.
• Security Reserve: the portion of the Balance kept unavailable to cover risks, pursuant to Clause 15.
• Pending Balance: amounts from approved Transactions that have not yet met the release period.
• Available Balance: amounts free for withdrawal.
• Split: the automatic division of a Transaction's amount among recipients.
• Transaction: each payment operation processed by the Platform.
• User: anyone who engages the Platform to receive payments, including Producers, Co-producers, Affiliates, and merchants.

Clause 3 — Purpose and nature of the services

3.1. SecurityPag licenses the User, on a non-exclusive, non-transferable, and revocable basis, to use the Platform and provides payment technology and management services, which may include: domestic and international checkouts; payment links; Pix; domestic and international credit and debit cards; Apple Pay and Google Pay; subscriptions; Smart Retry; Split; Members Area; affiliate program; APIs, webhooks, and integrations; app; withdrawals; and Crypto Withdrawal.

3.2. Regulatory nature. SecurityPag is a technology company that acts as a payment gateway and intermediary. It provides the technological infrastructure that connects the User to Acquirers and Partner Institutions authorized by the Central Bank of Brazil, which provide the services of acquiring, payment account, Pix, settlement, and, where applicable, currency conversion. SecurityPag is not a payment institution authorized by the Central Bank of Brazil nor a scheme owner of a Payment Scheme. It participates in the Payment Schemes through the Partner Institutions and, when acting as a sub-acquirer, observes the rules of each scheme, including centralized settlement.

3.2.1. The Partner Institutions vary according to the payment method, the currency, and the profile of the operation. The identity of the institution responsible for a Transaction or for holding the User's funds is provided upon request by e-mail at compliance@securitypag.com.

3.3. SecurityPag is not a bank or a financial institution, does not take deposits, does not extend credit, and does not pay interest on the Balance. Amounts held on the Platform are not covered by the Credit Guarantee Fund (FGC).

3.4. Funds held in a payment account constitute segregated assets, do not answer for obligations of the institution that holds them, and cannot be subject to judicial attachment for its debts, pursuant to Article 12 of Law No. 12,865/2013.

3.5. SecurityPag is not a party to the sale and purchase relationship between User and Buyer, is not the supplier of the User's products or services, and does not guarantee their existence, quality, delivery, or lawfulness. This clause does not exclude liabilities that the law attributes directly to SecurityPag toward the Buyer.

3.6. The payment methods, currencies, installment plans, limits, and functionalities available depend on the User's risk analysis. SecurityPag may expand, reduce, or disable them on a reasoned basis, with notice on the dashboard.

3.7. The User undertakes to comply with the rules of the Card Networks, Acquirers, Partner Institutions, Apple, Google, and other providers whose services it uses through the Platform, to the extent applicable to merchants. Fines, penalties, and costs imposed by such third parties as a result of the User's conduct will be passed on to the User, with supporting evidence.

Clause 4 — Registration, eligibility, and verification

4.1. The following may register: (a) individuals over 18 years of age, with full legal capacity, with a regular CPF; (b) duly incorporated legal entities, with an active CNPJ, represented by someone with powers to contract; and (c) foreign individuals and companies, when accepted by SecurityPag following its own analysis and applicable legislation.

4.2. SecurityPag may request, among others: photo ID; selfie with liveness check; proof of address; bank account details in the same name; articles of association and amendments; documents of directors and of ultimate beneficial owners who hold 25% or more of the capital or exercise control; politically exposed person declaration; description of the activity, websites, and social networks; estimated revenue; and licenses required for the activity.

4.3. The analysis takes place after complete submission of the documents, within the period stated on the dashboard. Additional information may be requested at any time, including for limit increases.

4.4. The User authorizes SecurityPag and the Partner Institutions to consult public and private databases, credit and anti-fraud bureaus, and national and international sanctions lists, and to share data on fraud indicators with other institutions, pursuant to Joint Resolution No. 6/2023.

4.5. SecurityPag may refuse or condition registration based on its risk and AML/CFT policies. The reason will not be disclosed when doing so could compromise a legal obligation, such as reports to COAF.

4.6. The User keeps its data up to date and reports changes in corporate structure, address, activity, or ultimate beneficial owner within 10 days. SecurityPag may require periodic re-registration.

4.7. Each Account has a single holder. Stores, brands, and domains registered must belong to the holder or be licensed to it. It is prohibited to lend, assign, or operate the Account on behalf of third parties.

4.8. False or incomplete data or tampered documents authorize refusal, suspension, or termination of the Account and notification of the competent authorities.

Clause 5 — Credentials and account security

5.1. Credentials are personal and non-transferable. The User is responsible for operations carried out with them, except in case of a proven failure by SecurityPag.

5.2. Two-factor authentication is mandatory for withdrawals, changes to bank details, creation of API keys, and addition of new users.

5.3. The holder may grant access to employees with specific permissions and is responsible for the acts they perform.

5.4. API keys are separated by environment (testing and production). The User must store them in a secure location, never publish them in open source code, and replace them at the slightest sign of exposure.

5.5. The User must immediately report any suspicion of unauthorized access by e-mail at security@securitypag.com. SecurityPag may block the Account preventively to protect the User.

5.6. SecurityPag never requests a password, authentication code, or API key by phone, e-mail, WhatsApp, or social media.

Clause 6 — Products, stores, and offers

6.1. The User may sell digital products, physical products, services, and subscriptions that are lawful and permitted by the Acceptable Use Policy. Restricted categories require prior approval.

6.2. Each offer must state, clearly and before payment: identification of the seller (name or corporate name, CPF or CNPJ, address, and support channel); description of the product; total price in cash and in installments, with any surcharges; shipping; period and method of delivery or access; warranty; refund policy and right of withdrawal; and, for subscriptions, the information in Clause 11. The Consumer Protection Code and Decree No. 7,962/2013 apply.

6.3. Order bumps, upsells, and additional items require the Buyer's express and separate consent, without pre-checked boxes, with the total amount displayed before confirmation.

6.4. Social proof, testimonials, reviews, and scarcity counters must be true and verifiable. It is prohibited to create fictitious testimonials, reviews, or numbers.

6.5. Misleading or abusive advertising is prohibited, including promises of financial gain, cure, or guaranteed results.

6.6. SecurityPag may review products, pages, ads, and materials at any time, including by sampling and test purchases, and require adjustments or suspend the offer.

6.7. The descriptor displayed on the Buyer's statement varies according to the Acquirer: it may show only the User's trade name or the Acquirer's name followed by it, in the format ACQUIRER*STORENAME. The User may not use a descriptor that the Buyer does not recognize.

Clause 7 — Payment methods

7.1. Pix. Charges by dynamic QR Code or Pix copy-and-paste, confirmed in real time. Pix is, as a rule, irrevocable and is returned only at the User's initiative or in the cases of the MED (Clause 16).

7.2. Domestic cards. Credit and debit cards of the enabled Card Networks, in cash or in installments. When installments carry a surcharge for the Buyer, the Checkout displays the amount of each installment and the total before confirmation. The surcharge forms part of the User's price and does not constitute a credit operation by SecurityPag.

7.3. International and multi-currency cards. The Checkout may display the price and charge in the Buyer's currency. The Acquirer receives the payment in that currency, performs the conversion, and settles the amount in reais. SecurityPag does not carry out foreign exchange or take part in the conversion: for the User, the sale is recorded and paid in reais, in the amount actually settled by the Acquirer. Tax obligations on sales abroad are the User's responsibility. The Buyer's card issuer may charge its own fees and taxes.

7.4. Digital wallets. Apple Pay and Google Pay are subject to the terms of Apple and Google. Card data is replaced by a token and is not accessible to the User.

7.5. 3-D Secure. SecurityPag may require 3DS authentication according to the Transaction's risk. The fraud liability shift provided by the Card Networks applies only to the dispute reasons and conditions defined by them and does not eliminate Chargebacks for commercial disagreement or non-delivery.

7.6. Saved cards and charges without the Buyer. The card may be saved only with the Buyer's consent. Charges initiated by the User without the Buyer present require prior and specific authorization, pursuant to the Card Networks' stored credential rules.

7.7. Price by payment method. The User may offer different prices depending on the payment method, provided that it clearly discloses this, pursuant to Law No. 13,455/2017.

7.8. Decline. Approval depends on the issuer, the Card Network, the Partner Institution, and the anti-fraud analysis. SecurityPag does not guarantee approval and may decline high-risk Transactions.

7.9. International sales. The User may sell only to countries where its product or service is permitted and must comply with the legislation of each country in which it operates, including consumer rules, taxes, advertising, and data protection. SecurityPag and the Acquirers may restrict countries, currencies, and payment methods according to local laws, sanctions lists, and Card Network rules.

Clause 8 — Receipt, settlement, balance, and withdrawals

8.1. The flow of each Transaction is: approval, Pending Balance, release within the period in Annex I, Available Balance, and withdrawal. The dashboard statement shows the status of each Transaction.

8.2. Release periods are defined in the User's commercial conditions, displayed on the dashboard, and governed by Annex I. Card receivables follow the centralized settlement schedule of the respective Payment Scheme.

8.3. Card receivables may be registered with a registrar entity. The User authorizes the consultation and registration and must inform SecurityPag of any assignment, lien, or lock on its receivables contracted with third parties. Receivables prepayment, when offered, is contracted separately with an authorized Partner Institution.

8.4. By default, withdrawals are made via Pix to a key or account held in the User's own name. Withdrawals to third-party keys, Pix copy-and-paste payments, and other outflows to third parties depend on the Account's verification level, daily and nighttime limits, and AML/CFT monitoring. The fees in the Schedule may apply.

8.5. Crypto Withdrawal. It is provided exclusively by partner virtual asset service providers, with an authorization request filed with the Central Bank of Brazil, under their own terms which the User must accept. The User acknowledges that: (a) the quote is provided before confirmation and may vary; (b) blockchain transfers are irreversible; (c) an incorrect address or network may cause permanent loss; (d) the operation may require identification of the holder of the destination wallet; (e) some of these operations may be treated as foreign exchange operations under the regulations; and (f) the function may be suspended at any time due to regulatory requirements.

8.6. The Balance is not an investment and does not earn interest.

8.7. SecurityPag may offset, against the Balance or future receivables, amounts owed by the User, such as fees, refunds, Chargebacks, MED returns, Card Network fines caused by the User, and negative balances, pursuant to Article 368 of the Civil Code.

8.8. An amount credited in error must be returned and may be debited from the Account, with notice to the User.

8.9. If the Balance becomes negative, the User must cover it within 5 business days of notification. After that period, monetary adjustment by the IPCA, interest of 1% per month, and a 2% penalty apply. SecurityPag may collect the debt judicially or extrajudicially and, after prior notice, include it in credit protection registries.

8.10. Upon termination of the Account, the remaining Balance, less pending obligations and the Security Reserve, is transferred to an account held in the User's own name.

Clause 9 — Fees, taxes, and invoices

9.1. Fees are set out in the Fee and Timeframe Schedule on the dashboard or in specific commercial conditions and are deducted at the time of the Transaction or withdrawal.

9.2. Fee changes are notified 30 days in advance. If it does not agree, the User may terminate the Account without penalty before the changes take effect.

9.3. The following are passed on to the User when originating from its Transactions: Chargeback fees, dispute alerts, and fines and charges from Card Network monitoring programs.

9.4. Each Party is responsible for its own taxes. SecurityPag issues an invoice for the fees it charges. The User issues the tax documents for its sales to Buyers.

9.5. When the collection of IBS and CBS at the time of settlement (split payment) becomes mandatory, pursuant to Complementary Law No. 214/2025 and its regulations, SecurityPag or the Partner Institution may segregate and remit the taxes to the tax authorities, crediting the net amount to the User.

9.6. The User acknowledges that information about its transactions is provided to the Federal Revenue Service, including through e-Financeira, and to the Central Bank of Brazil, as required by law.

Clause 10 — Routing and Smart Retry

10.1. SecurityPag may route each Transaction to the Acquirer or Partner Institution with the highest chance of approval and, if declined, retry with another, up to 5 other institutions.

10.2. The retry complies with the rules of the Card Networks and Pix, in particular: (a) it does not repeat declines that the issuer indicates as final, such as canceled or stolen cards or cards with a do-not-retry instruction; (b) it observes the limits on the number and timing of retries; (c) it maintains the same User identification (name, descriptor, and activity category) across all institutions; and (d) it never generates more than one approved charge for the same order.

10.3. If a duplicate charge occurs due to a Platform failure, SecurityPag reverses the improper charge as soon as it is identified.

10.4. The User may disable Smart Retry on the dashboard. Per-attempt fees, if any, are set out in the Schedule.

Clause 11 — Subscriptions and recurring charges

11.1. Before signing up, the Checkout states: amount of each charge; frequency; date of the first charge; minimum term, if any; automatic renewal; and how to cancel.

11.2. Enrollment requires the Buyer's express consent, without pre-checked boxes.

11.3. For free periods or promotional prices, the Buyer must be notified before the first full charge, with the advance notice required by the Card Networks and with a link to cancel. Annual renewals must also be notified in advance.

11.4. The Buyer may cancel at any time, online, by a means as simple as the one used to sign up. Cancellation takes effect from the following cycle, unless the User has a more favorable policy. The User may not condition cancellation on a phone call, a justification, or payment of outstanding amounts.

11.5. Declined charges are retried within the limits of Clause 10. Once the attempts are exhausted without success, the subscription is suspended or canceled according to the User's configuration.

11.6. Automatic card updater services of the Card Networks may be used to keep the subscription active, provided that the Buyer has accepted the recurring charge.

11.7. Automatic Pix, when available, depends on the Payer's authorization in the app of the Payer's institution, which the Payer may revoke at any time, pursuant to the Pix Regulations.

11.8. The User is responsible for the notices and for honoring cancellations. Non-compliance authorizes suspension of the subscriptions functionality.

Clause 12 — Split, co-production, affiliation, and marketplace

12.1. Split. The Producer defines the percentages or amounts for each recipient, displayed to them before the sale. Each recipient must have its own verified Account. SecurityPag performs the division at settlement and informs the final recipients to the settlement systems when required.

12.2. The Producer is the supplier to the Buyer and is responsible for delivery and support. Refunds, Chargebacks, and MED returns are debited from each recipient in proportion to the Split, unless the Producer configures otherwise. If a recipient's Balance is insufficient, the difference may be debited from the Producer.

12.3. Each recipient issues its own tax documents and pays its own taxes on the portion it receives.

12.4. Affiliates. The Affiliate joins each Producer's program, which defines the commission, promotion rules, and sale attribution criteria (for example, last click and cookie validity). These rules are displayed before joining.

12.5. The commission is released after the product's warranty period and the period in Annex I, and is reversed in case of refund, Chargeback, MED return, or fraud.

12.6. The Affiliate is prohibited from: self-purchase or purchase by related persons to generate commission; cookie stuffing, forced clicks, link hijacking, or any manipulation of attribution; spam or unsolicited messages; misleading ads or promises not made by the Producer; use of the Producer's or SecurityPag's brand in ads without authorization; pages that imitate the Producer; and fake testimonials.

12.7. The Affiliate is responsible for its advertising before Buyers and authorities, including under the Consumer Protection Code and CONAR rules.

12.8. Violation of the affiliation rules results in forfeiture of commissions on irregular sales, removal from the program, and, depending on severity, termination of the Account.

12.9. Marketplace. A User that operates a marketplace may not receive on behalf of unregistered sellers. Each seller needs its own verified Account, and transfers occur through Split. The operator informs the Buyer who the seller of each item is.

Clause 13 — Members Area and hosted content

13.1. The User may host courses, videos, files, and communities in the Members Area. The Buyer's access is released automatically after payment approval.

13.2. The User is solely responsible for the content and declares that it holds all necessary rights, including copyrights, third-party image and voice rights, and licenses for music and supporting materials.

13.3. The User grants SecurityPag a non-exclusive, royalty-free license, limited to the term of these Terms, to store, convert, display, and distribute the content to authorized Buyers.

13.4. The User defines and discloses the access period for each product. "Lifetime access" means access for as long as the product is maintained by the User and the Platform is active. The User must notify Buyers at least 30 days in advance before discontinuing a product.

13.5. Access is revoked when the purchase is refunded, disputed by Chargeback, or returned through the MED.

13.6. Storage and transmission limits are set out in the Schedule. SecurityPag keeps backup copies for operational reasons, which does not replace the User's own backup.

13.7. SecurityPag acts as an application provider. Upon receipt of a reasoned notice regarding unlawful content, it may remove it or make it unavailable, subject to Articles 19 and 21 of Law No. 12,965/2014 (Brazilian Internet Civil Framework (Marco Civil da Internet)), as interpreted by the Federal Supreme Court. Intimate content disclosed without authorization and content involving minors are removed immediately upon notice. The User is notified, unless prohibited by law, and may submit a counter-notice.

13.8. Copyright infringement notices must be sent to complaint@securitypag.com by the rights holder or its representative, identifying the rights holder, the work, the location of the content (URL), and proof of ownership. Notices lacking these elements or that are abusive may be dismissed.

Clause 14 — Integrations, API, webhooks, and third-party services

14.1. The REST API, webhooks, SDKs, and plugins are licensed under these Terms and must be used in accordance with the technical documentation, observing request limits.

14.2. The User must validate the webhook signature and handle repeated notifications without duplicating effects. SecurityPag is not liable for losses arising from releasing a product based on an unconfirmed status or an unvalidated webhook.

14.3. Card data must be captured only by the Checkout or by SecurityPag's tokenizer. A User that transmits clear card data in its systems must be PCI DSS certified and provide annual proof.

14.4. Incompatible API changes are notified at least 90 days in advance, except for security reasons or regulatory requirements.

14.5. Third-party integrations, such as Shopify, WooCommerce, Utmify, Reportana, Meta, Google, TikTok, and Pinterest, are subject to those third parties' terms. SecurityPag is not liable for their unavailability or for changes made by them.

14.6. Pixels and tracking tools installed by the User on the Checkout are the User's responsibility, including obtaining the consent required by law. SecurityPag may block scripts that compromise the security or PCI compliance of the Checkout.

14.7. The following is prohibited: reverse engineering the Platform; performing load or penetration tests without authorization; using the Platform to test cards; scraping data; and circumventing technical limits.

Clause 15 — Risk management: monitoring, reserve, withholding, and blocking

15.1. SecurityPag continuously monitors Transactions and the Account to prevent fraud, money laundering, and non-compliance with these Terms, including dispute ratios, complaints, and product compliance.

15.2. Security Reserve. SecurityPag may keep part of the processed volume unavailable as a Security Reserve. The percentage and period are defined according to each User's risk profile and may be adjusted by SecurityPag at any time, upward or downward. The following are considered, among other factors: activity history, sales with future delivery, dispute and complaint ratios, volume variation, and restricted categories. The percentage, period, and reason are visible on the dashboard.

15.3. Precautionary withholding. SecurityPag may withhold amounts, in whole or in part, when there is: (a) reasoned indication of fraud or prohibited activity; (b) Chargeback ratios above the limits in the Chargeback Policy; (c) a relevant volume of complaints or refund requests; (d) non-compliance with these Terms; (e) a court order or order from a competent authority; (f) a precautionary block or return through the MED; or (g) termination of the Account with disputes still possible.

15.4. The withholding is proportional to the risk identified and lasts as long as it exists. After the last Transaction, it may extend only until the end of the dispute periods applicable under the Card Networks, the MED, and the Partner Institutions. Once the reason ceases, the amounts are released.

15.5. The withholding is communicated to the User with the reason and the amount, except where the law prohibits such information, as in reports to COAF. The User may submit documents and clarifications, and SecurityPag responds within 10 business days.

15.6. Judicial and administrative blocks, such as orders via SISBAJUD, notices from the Secretariat of Prizes and Bets, and asset freezes ordered under Law No. 13,810/2019, are complied with in accordance with the terms and deadlines of the order.

15.7. Instead of suspending the entire Account, SecurityPag may limit specific functionalities, such as cards, withdrawals to third parties, or Crypto Withdrawal.

15.8. In the face of attacks, such as mass card testing, SecurityPag may block Transactions and require 3DS or additional verification to protect the User and Buyers.

Clause 16 — Chargebacks, refunds, and MED

16.1. The User is liable for the amounts of Chargebacks, refunds, and MED returns on its Transactions, plus applicable fees, including after termination of the Account.

16.2. SecurityPag may dispute the Chargeback on the User's behalf with the evidence available or request evidence, which must be sent within 3 business days. The final decision rests with the issuer and the Card Network.

16.3. Refunds are processed by the User on the dashboard. SecurityPag may refund the Buyer directly in the cases set out in the Chargeback, Refund and MED Policy, such as non-delivery, lack of support, fraud, authority order, or an unanswered complaint filed with a consumer protection agency.

16.4. The User authorizes the precautionary block and debit of amounts received via Pix in the cases of the Pix Regulations, including funds that passed through other accounts before reaching its own, as traced by the MED.

16.5. The Chargeback ratio limits and the applicable measures, from warning to termination, are set out in the Chargeback, Refund and MED Policy.

16.6. The pre-dispute alert services are described in Annex III.

Clause 17 — Prohibited and restricted activities

17.1. It is prohibited to use the Platform for the activities listed in the Acceptable Use Policy, which include: unlawful activities; fixed-odds betting and games of chance; pyramid schemes; sale of personal data; sexual content involving minors or without consent; intellectual property infringement; products without sanitary authorization; weapons; drugs; unauthorized financial or virtual asset services; and receiving on behalf of unregistered third parties.

17.2. Restricted categories require prior approval and may have their own conditions, such as Security Reserve and limits.

17.3. Violation authorizes, depending on severity: suspension; withholding of the amounts needed to refund Buyers and cover fines and losses; termination of the Account; and notification of the authorities and the Card Networks.

17.4. Amounts originating from unlawful activity are returned to Buyers, kept at the disposal of an authority, or allocated as legally ordered. SecurityPag does not appropriate such amounts.

Clause 18 — Protection of personal data

18.1. The Parties comply with Law No. 13,709/2018 (LGPD) and, where applicable, foreign data protection laws, such as the European Union General Data Protection Regulation (GDPR).

18.2. SecurityPag is the controller of the User's data. With respect to Buyers' data, it is a controller for processing payments, preventing fraud, complying with legal and regulatory obligations, and exercising rights, and is a processor when it processes them on the User's behalf in functions chosen by the User, such as the Members Area, sales recovery e-mails, remarketing, and integrations.

18.3. The User is the controller of its Buyers' data for the consumer relationship and for its marketing purposes. It is responsible for the legal basis, transparency, and responding to data subjects for those purposes.

18.4. SecurityPag's obligations as a processor are set out in Annex II.

18.5. The User may use Buyer data obtained through the Platform only for the sale, delivery, support, and compatible purposes disclosed to the data subject. It is prohibited to sell, assign, or compile lists with such data.

18.6. The details of the processing carried out by SecurityPag are set out in the Privacy Policy.

Clause 19 — Confidentiality

19.1. Commercial conditions, documents, technical data, code, and risk criteria exchanged between the Parties are confidential.

19.2. The following do not breach confidentiality: public information; compliance with an authority order; and sharing with Partner Institutions, Card Networks, auditors, and advisors bound by a duty of secrecy. SecurityPag observes the legal secrecy applicable to payment operations, including Complementary Law No. 105/2001 where applicable.

19.3. The duty of confidentiality lasts 5 years after the end of these Terms and, for personal data and trade secrets, for as long as they exist.

Clause 20 — Intellectual property

20.1. The Platform, the SecurityPag brand, the software, the layouts, and the documentation belong to SecurityPag or its licensors. These Terms grant no right beyond the license of use in Clause 3.

20.2. The User may use the "Payment protected by SecurityPag" seal only to indicate use of the Platform, in accordance with the brand manual, without suggesting partnership, endorsement, or that SecurityPag is the seller.

20.3. The User retains ownership of its brand and content and authorizes SecurityPag to display them on the Checkout, the dashboard, receipts, and the Members Area.

20.4. Suggestions and feedback about the Platform may be used by SecurityPag freely and without compensation.

20.5. It is prohibited to copy, decompile, create derivative works of the Platform, use unauthorized bots, or circumvent technical protection measures.

Clause 21 — Availability, maintenance, and support

21.1. SecurityPag uses its best efforts to keep the payments API and the Checkout available 24 hours a day, excluding scheduled maintenance and third-party failures, such as Card Networks, the Instant Payment System, Acquirers, and cloud providers.

21.2. Scheduled maintenance is notified at least 48 hours in advance and carried out, whenever possible, during periods of lower activity.

21.3. Relevant incidents are communicated at https://securitypag.com and by e-mail.

21.4. Fortuitous events and force majeure exclude the Parties' liability, pursuant to Article 393 of the Civil Code, including failures of the Pix system or of the Card Networks, large-scale cyberattacks, and government determinations.

Clause 22 — Liability and limitation

22.1. SecurityPag is liable for direct damages caused by a proven failure of the Platform, such as an error in processing, crediting, or transfer.

22.2. SecurityPag is not liable for: (a) the User's products, content, advertising, and customer support; (b) acts of Buyers, Affiliates, and third parties; (c) declines by issuers, Card Networks, or Partner Institutions; (d) use of Credentials due to the User's fault; (e) loss of profits, loss of opportunity, or indirect damages; and (f) unavailability of third-party services beyond its control.

22.3. In business relationships, SecurityPag's total liability per event is limited to the amount of fees paid by the User in the preceding 12 months. The limitation does not apply to willful misconduct or gross negligence, to the obligation to transfer amounts owed to the User, to personal data breaches caused by SecurityPag's fault, or to cases in which the law prohibits it.

22.4. The User indemnifies SecurityPag for losses, fines from Card Networks and authorities, judgments, and fees arising from its products, content, conduct, non-compliance with these Terms, or violation of third-party rights. SecurityPag notifies the User of the claim and allows the User to take part in the defense.

22.5. Where the User is a consumer within the meaning of the Consumer Protection Code, the limitations in this Clause apply only to the extent permitted by law.

Clause 23 — Communications

23.1. Communications to the User are made through the dashboard, the app, or the registered e-mail.

23.2. A communication is deemed received on the day it is sent to the registered e-mail or published on the dashboard.

23.3. The User keeps its e-mail and phone number up to date. Formal notices to SecurityPag must be sent to compliance@securitypag.com.

Clause 24 — Term, suspension, and termination

24.1. These Terms remain in force for an indefinite period from acceptance.

24.2. The User may terminate the Account at any time through the dashboard, without penalty, subject to pending obligations.

24.3. SecurityPag may terminate the Account without cause upon 30 days' prior notice.

24.4. SecurityPag may terminate the Account immediately, for cause, in case of: serious violation of these Terms; prohibited activity; fraud; false information; Chargeback ratios above critical limits; a determination by an authority, Card Network, or Partner Institution; or concrete regulatory or reputational risk.

24.5. Upon termination: new Transactions are discontinued; the Members Area remains active for 30 days so that the User can notify Buyers, except in case of termination for unlawful content; the Balance is released pursuant to Clauses 8.10 and 15.4; and data is kept for the legal periods.

24.6. In case of termination for cause, the User may be included in the terminated merchant lists maintained by the Card Networks, such as Mastercard's MATCH and Visa's VMAS, in accordance with their rules.

24.7. Obligations relating to Chargebacks, refunds, MED, negative balances, confidentiality, data protection, and indemnification survive termination.

Clause 25 — Amendments to these Terms

25.1. SecurityPag may amend these Terms. Relevant amendments are notified 30 days in advance by e-mail and on the dashboard.

25.2. Amendments required by law, regulation, a Card Network, or security may take effect immediately, with notice to the User.

25.3. A User that does not agree may terminate the Account without penalty before the amendments take effect. Use of the Platform after they take effect constitutes acceptance.

Clause 26 — General provisions

26.1. The User may not assign its rights and obligations without SecurityPag's written consent. SecurityPag may assign them to a company in its group or to a successor in a corporate reorganization, with notice to the User.

26.2. Tolerance of non-compliance with any obligation is neither a waiver nor a novation.

26.3. The invalidity of one clause does not affect the others.

26.4. These Terms do not create an employment, partnership, agency, or mandate relationship between the Parties, except for the powers expressly granted to dispute Chargebacks and execute Splits.

26.5. The Parties comply with Law No. 12,846/2013 (Anti-Corruption Law) and neither offer nor accept undue advantages.

26.6. The User declares that neither it nor its partners, directors, or ultimate beneficial owners appear on sanctions lists of the UN Security Council, OFAC (US), the European Union, or the United Kingdom, and undertakes not to sell to sanctioned persons or regions.

26.7. The English and Spanish versions of these Terms are translations. In case of discrepancy, the Portuguese version prevails.

Clause 27 — Customer service, ombudsman, and official channels

27.1. SecurityPag's official channels are:

27.2. Support responds within 2 business days. The Ombudsman acts as a second tier, after regular service, and responds within 10 business days.

27.3. SecurityPag's Customer Service (SAC) operates through the User Support and Buyer Support channels, with human assistance every day from 8 a.m. to 8 p.m., and receipt of messages 24 hours a day, pursuant to Decree No. 13,135/2026. Access to the SAC is free of charge, the cancellation option is available at any stage of the service, and complaints are answered within 7 days. Urgent requests that represent a relevant risk to the consumer receive immediate human assistance. The history of requests, recordings, and messages is preserved for at least 90 days.

Clause 28 — Governing law and venue

28.1. These Terms are governed by the laws of the Federative Republic of Brazil.

28.2. The Parties will attempt to resolve disputes amicably for 30 days before legal action and may resort to mediation.

28.3. The venue of the Judicial District of São Paulo/SP is elected, except where the User is a consumer, in which case the venue of the User's place of residence prevails.

Annex I — Partner Institutions, timeframes, and limits

I.1. The Partner Institutions that provide acquiring, payment account, Pix, settlement, international processing, and Crypto Withdrawal services vary according to the payment method and the profile of the operation. They are institutions authorized to operate by the Central Bank of Brazil or, in the case of virtual asset service providers, with an authorization request filed. The identity of each is provided upon request by e-mail at compliance@securitypag.com.

I.2. Release periods are defined in each User's commercial conditions and displayed on the dashboard. They may range from immediate release to release after clearing and settlement of the amounts by the Partner Institution, depending on the payment method, the Partner Institution, and the risk profile.

I.3. Amounts received via Pix are subject to precautionary block and the MED. Card receivables follow the settlement schedule of the Payment Scheme. Commissions of Affiliates and Co-producers are released after the product's warranty period and may be reversed in case of dispute.

I.4. Withdrawal limits, including minimum, daily, nighttime, and third-party amounts, are defined by the Account's verification level and risk profile and displayed on the dashboard.

I.5. Periods, limits, Security Reserve, and fees may be adjusted by SecurityPag as the risk profile evolves, with display on the dashboard, subject to Clauses 9.2 and 15.

Annex II — Personal Data Processing Agreement

II.1. This Annex applies when SecurityPag processes Buyers' data on the User's behalf, in the functions of Clause 18.2.

II.2. SecurityPag processes the data according to the User's documented instructions, which are these Terms and the settings made on the dashboard. If an instruction violates the law, SecurityPag notifies the User and may refuse it.

II.3. SecurityPag employees with access to the data are subject to a duty of confidentiality.

II.4. SecurityPag applies the technical and administrative measures described in the Information Security Policy.

II.5. SecurityPag may use sub-processors, such as providers of cloud, e-mail and SMS delivery, video hosting, anti-fraud, and customer support, whose list is provided upon request by e-mail at compliance@securitypag.com. New sub-processors are notified 15 days in advance, and the User may object and terminate the Account without penalty.

II.6. International transfers observe Article 33 of the LGPD and the standard contractual clauses of CD/ANPD Resolution No. 19/2024 and, for data subject to the GDPR, the European Commission's standard contractual clauses.

II.7. SecurityPag forwards to the User, within 5 business days, data subject requests relating to functions under the User's responsibility, and assists the User in responding to them.

II.8. SecurityPag notifies the User, within 48 hours of becoming aware, of a security incident that may create a relevant risk or harm to data subjects, with the information available. This allows the User to meet the 3-business-day deadline for notifying the ANPD and data subjects provided in CD/ANPD Resolution No. 15/2024.

II.9. At the end of the processing, SecurityPag deletes or returns the data, except for data it must keep due to a legal or regulatory obligation.

II.10. SecurityPag makes security reports and certifications available. An on-site audit may be carried out once a year, with 30 days' notice, at the User's expense.

Annex III — Pre-dispute alerts and early resolution

III.1. SecurityPag may enroll the User's Transactions in services that give notice of disputes before they become Chargebacks, such as Ethoca Alerts, Visa Order Insight, Visa Rapid Dispute Resolution (RDR), and Visa Compelling Evidence 3.0.

III.2. Upon receipt of an alert, SecurityPag may automatically refund the Buyer, avoiding the Chargeback and its effect on the Card Networks' monitoring ratios.

III.3. Each alert or early resolution carries the fee set out in the Fee and Timeframe Schedule or in the User's commercial conditions, defined according to its risk profile.

III.4. The User may define criteria for automatic refunds, such as maximum amount and reasons, when the program allows.

III.5. Transactions refunded by an alert cannot be charged again to the Buyer.

Other Legal Center documents