Courtesy translation. In the event of any discrepancy, the Spanish version prevails and is the only binding one.

Version 1.0 · Last updated: July 24, 2026

Terms and Conditions of Use — BotanikTrace

Last updated: 24 July 2026 Version: 1.0 (draft for legal review prior to publication)

⚠️ Note on this document. This text was drafted as a thorough professional draft, following common standards of technology law, data protection (GDPR, CCPA/CPRA, LGPD, Argentina's Law 25.326 and equivalents) and of cannabis/cultivation traceability platforms. It does not replace review by a qualified lawyer in each jurisdiction where BotanikTrace operates or has users, particularly given the regulated nature of cannabis cultivation. Before publishing, complete the fields marked in brackets [ ] (legal name, registered address, tax ID, jurisdiction of incorporation, dispute resolution forum) and validate with local counsel in each country of operation.

Table of contents

1. Definitions
2. Acceptance of the Terms and capacity
3. Description of the Service
4. Nature of the Service and the User's legal responsibility
5. Geographic eligibility, sanctions and export controls
6. Accounts, registration and security
7. Roles, permissions and organisational governance
8. IoT devices, hardware and integrations
9. Plans, pricing and billing
10. User Data: ownership and licence to use
11. Personal data protection and privacy
12. Immutable audit trail and mandatory legal retention
13. Public passport (QR) and public exposure of data
14. Photographic evidence and geolocation
15. Third parties, communications and payment gateways
16. Intellectual property
17. Prohibited uses and acceptable use policy
18. Availability, maintenance and changes to the Service
19. Warranties and disclaimer
20. Limitation of liability
21. Indemnification
22. Suspension and termination
23. Force majeure
24. Governing law and dispute resolution
25. Changes to these Terms
26. General provisions
27. Contact

1. Definitions

• "BotanikTrace", "the Platform", "the Service", "we", "the Company": the software, websites (including botaniktrace.com and panel.botaniktrace.com), applications, APIs, reference firmware and other components offered by [FULL LEGAL NAME], with registered address at [REGISTERED ADDRESS], [TAX ID / REGISTRATION NUMBER], incorporated under the laws of [COUNTRY/JURISDICTION OF INCORPORATION].
• "User", "you", "the Customer": any natural or legal person who creates an account, accesses or uses the Service, including growers, administrators, laboratory analysts, auditors/inspectors and any other enabled role.
• "Organisation" / "Site": the workspace (tenant) under which a User or team manages rooms, plants, batches, devices and data, logically isolated from other Organisations (multi-tenant architecture).
• "Cultivation Data": all information recorded on the Platform relating to plants, batches, harvests, rooms, laboratory analyses, certificates of analysis (CoA), photographic evidence, destructions, licences, automation rules and sensor readings.
• "Personal Data": any information relating to an identified or identifiable natural person, as defined by the GDPR (EU/EEA), Law 25.326 (Argentina), the LGPD (Brazil), the CCPA/CPRA (California) and other applicable regulations described in the Privacy Policy.
• "Device": sensors, gateways (including RS-485 gateways running on Raspberry Pi), relays and other hardware that connects to the Platform using credentials (claim token, device_secret, API-Key, HMAC signature).
• "User Content": Cultivation Data, images, documents, comments and any other material uploaded by the User.
• "Parties": the Company and the User, jointly or individually.

2. Acceptance of the Terms and capacity

2.1. By creating an account, ticking the acceptance box, or using the Service in any way, the User declares that they have read, understood and fully accepted these Terms and Conditions ("Terms") and the Privacy Policy, which is incorporated by reference.

2.2. If you do not agree with these Terms, you must not access or use the Service.

2.3. Capacity. To use BotanikTrace you declare that:

• you are at least 18 years old, or the legal age of majority in your jurisdiction if higher, and have legal capacity to enter into contracts; and
• if you accept these Terms on behalf of a company, cooperative, civil association, NGO or any other entity ("Organisation"), you have sufficient authority to bind that entity, which then becomes the "User" for all purposes, jointly and severally with the person accepting the Terms on its behalf.

2.4. The Service is not directed at minors and we do not knowingly collect Personal Data from minors. If we become aware that an account belongs to a minor, we will suspend it and delete the associated data in accordance with applicable law.

3. Description of the Service

3.1. BotanikTrace is a software-as-a-service (SaaS) platform offering, among other features:

• real-time monitoring of environmental variables (temperature, humidity, CO₂, VPD, EC, N-P-K and others) through connected Devices;
• equipment automation (rules, relay control, closed-loop logic) via MQTT;
• management of plants, rooms, batches, harvests and a task calendar;
• documentary traceability: mass reconciliation, records of destructions, licences and certificates, laboratory analyses and generation of Certificates of Analysis (CoA);
• a cryptographically chained audit log (hash chain) to guarantee the historical integrity of records;
• generation of exportable files/reports for use before regulatory bodies, agnostic of jurisdiction;
• a public "passport", verifiable by QR code, for certain plants or batches;
• alerts and notifications by email, Telegram and/or Discord;
• management of accounts, roles, permissions and subscription billing.

3.2. The Service is provided "as is" and may evolve: we may add, modify or discontinue features in accordance with Section 18.

3.3. The detailed functional scope, with screenshots and operational flows, is documented in the User guide, which is informative and non-contractual in nature, and does not prevail over these Terms.

4. Nature of the Service and the User's legal responsibility

This section is essential given that BotanikTrace is used to track cannabis cultivation and other plants subject to regulation in numerous jurisdictions. Please read it carefully.

4.1. BotanikTrace is exclusively a software tool. We are not a seed bank, dispensary, pharmacy, distributor, carrier, producer, buyer or seller of cannabis, its derivatives, seeds, clones, or of any controlled or regulated substance. We do not take physical possession, custody or ownership of any plant, product or substance recorded by Users. We do not facilitate purchase or sale transactions of cannabis or controlled substances within the Platform.

4.2. User representations and warranties. By using the Service to record activities of cultivation, possession, processing, analysis, distribution or commercialisation of cannabis (or any other regulated plant or substance), the User represents and warrants that:

a) they hold all licences, authorisations, registrations, permits and approvals required by the applicable regulations in each jurisdiction where they operate (by way of example and not limitation: REPROCANN, INASE, ANMAT and provincial regulations in Argentina; state licences under systems such as METRC or BioTrack in the United States; the regulatory framework of Uruguay, Colombia, Mexico, Canada, Germany, Thailand, or any other applicable jurisdiction);

b) such licences and authorisations are in force and will be kept up to date on the Platform;

c) they will use the Service exclusively for lawful purposes in accordance with the law in force in the place or places where they cultivate, operate, reside or provide the Service to third parties; and

d) they are solely responsible for the accuracy, completeness and legality of the Cultivation Data they upload, as well as for any operational, health, commercial or regulatory decision based on such data.

4.3. No verification and no legal advice. We do not verify, validate, audit or guarantee the legality of the User's activities, the validity of their licences, or the accuracy of the information uploaded. The Platform's "compliance" features (regulatory checklist, per-batch reports, mapping to REPROCANN/INASE/ANMAT/METRC or other frameworks) are supporting administrative tools, agnostic of jurisdiction, and do not constitute legal, regulatory, accounting, tax or compliance advice. No content of the Service should be interpreted as such. Users are advised always to consult qualified professionals and the competent regulatory authority in their jurisdiction.

4.4. Prohibition in jurisdictions where cultivation is illegal. If the cultivation, possession, processing or commercialisation of cannabis (or any other plant or substance the User chooses to record) is illegal, or is not duly authorised, in the jurisdiction where the User resides or operates, the User is expressly prohibited from using the Service for such purposes. Use of the Service in breach of this clause is the User's sole responsibility.

4.5. Right of suspension and cooperation with authorities. We reserve the right to suspend or cancel accounts, restrict features, or retain/export data upon reasonable indications of unlawful use, fraud, falsification of traceability records or CoA, or upon request from a competent authority with jurisdiction, in accordance with Section 22. Where a valid legal obligation exists (court order, administrative request with a legal basis, etc.), we may disclose information to public authorities, notifying the User unless prohibited by law.

4.6. Independence of regulatory responsibility. The existence of traceability features, signed CoA or an immutable audit trail on the Platform does not, in itself, mean that the User complies with the applicable regulations, nor does it replace mandatory state traceability systems (for example, METRC in US jurisdictions, or the systems that REPROCANN/INASE/ANMAT may implement in Argentina in the future). It is the User's responsibility to verify whether they must report in parallel to official systems.

5. Geographic eligibility, sanctions and export controls

5.1. The User declares that they are not located in, nor a resident or national of, a country or territory subject to comprehensive economic sanctions by the European Union, the UN Security Council, the US Office of Foreign Assets Control (OFAC) or another competent authority, and that they do not appear on lists of sanctioned persons or entities (for example, OFAC's SDN list), unless they hold the specific authorisations or licences required.

5.2. The Service, its software and its documentation may be subject to export control regulations. The User undertakes to comply with them and not to export, re-export or make the Service available in breach of such regulations.

5.3. We do not warrant that the Service is appropriate or available for use in all jurisdictions. Those who access it from jurisdictions other than the Company's country of origin do so on their own initiative and are responsible for complying with applicable local law, including law relating to cannabis cultivation and data protection.

6. Accounts, registration and security

6.1. To use most features of the Service you must create an account with truthful, complete and up-to-date information (name, email address, organisation, time zone, etc.).

6.2. Credentials. You are responsible for keeping your password and access credentials confidential, and for all activity carried out under your account. Notify us immediately of any unauthorised use or suspected security breach, through the channels indicated in Section 27.

6.3. Two-factor authentication (2FA). We offer two-step verification (TOTP) using standard applications. We recommend enabling it. If you lose access to your second factor, resetting it requires validation by an administrator of your Organisation (superadministrator), in accordance with the procedure in force on the Platform.

6.4. Account protection measures. We implement access attempt limits (rate limiting) to mitigate brute-force attacks, and we store passwords using robust hashing algorithms (bcrypt), never in plain text. See also Section 11 (Information security).

6.5. Email verification. Certain features and critical notifications require verification of your email address.

6.6. One account, one person. Accounts are personal and non-transferable, except through the team invitation mechanisms provided in the Service to link multiple users to the same Organisation.

7. Roles, permissions and organisational governance

7.1. Within each Organisation there are roles with different levels of access (for example, administrator, standard user, laboratory analyst, read-only auditor/inspector, among others the Platform may offer). It is the responsibility of the Organisation's administrator to assign the minimum necessary role to each person (the "principle of least privilege").

7.2. The Platform may offer dual control/approval mechanisms for sensitive operations (for example, destruction or voiding of records). We recommend enabling them to strengthen operational and evidential integrity.

7.3. The Organisation's administrator is responsible towards the Company for the actions of the users they invite or manage within their Organisation, without prejudice to each user's individual responsibility for their own acts.

7.4. Where several people share an Organisation, it is the Organisation's responsibility to determine internally who acts as controller of the Personal Data processed and to ensure that it has a legal basis for each member to access the data corresponding to them (see Section 11).

8. IoT devices, hardware and integrations

8.1. Registration and credentials. Registering Devices (sensors, gateways, Raspberry Pi, relays) generates sensitive credentials (claim_token, device_secret, API-Key, hardware identifiers) that must be kept confidential. You are responsible for the physical and logical custody of your Devices and of those credentials.

8.2. Authenticity of readings. Measurements are transmitted signed with HMAC to guarantee their integrity and origin. The Company validates the signature, applies rate limiting and checks reasonable ranges before persisting the data, but cannot guarantee the physical accuracy of the measurements, which depends on the correct calibration, installation and maintenance of the hardware by the User.

8.3. Third-party hardware and firmware. The Service may interoperate with hardware, firmware or gateways that the User acquires or develops independently (including open-source references published by the Company). The Company does not warrant the compatibility, security or operation of hardware not supplied directly by it, nor of modifications to the reference firmware.

8.4. Revocation. We may revoke Device credentials upon indications of a security compromise, misuse, or at the User's request (for example, when deleting or transferring a Device).

8.5. Control of physical equipment (relays/automation). Closed-loop automation features control physical equipment (for example, extractors, lights, pumps). The User is responsible for configuring safe rules and for having adequate physical/electrical protections (thermal cut-outs, circuit breakers). The Company is not liable for damage arising from incorrect configuration of automation rules, connectivity failures, power outages, or malfunction of third-party hardware connected through the Service.

9. Plans, pricing and billing

9.1. Plans. We offer a free plan and paid plans with differentiated limits (number of plants, rooms, rules, alerts, sites, batches, users, etc.), with a monthly or annual billing cycle, as detailed in the Billing section of the Platform.

9.2. Payment gateways. Payments are processed through external providers (for example, MercadoPago or Stripe, subject to availability and country). We do not store full payment card details; such processing is subject to the terms, privacy policies and security standards (PCI-DSS) of each provider, which the User should review separately.

9.3. Renewal and cancellation. Paid plans renew automatically at the end of each cycle unless previously cancelled by the User. Upon cancellation, or when the paid period expires without renewal, the account automatically moves down to the free plan, potentially losing access to features or higher limits, without prejudice to the retention of Cultivation Data in accordance with Section 12.

9.4. Refunds. Unless applicable law provides otherwise (for example, cooling-off rights under consumer protection regulations in certain jurisdictions), payments are non-refundable once processed. Refunds, where applicable, are handled in accordance with the policy in force published on the Platform or with the mandatory consumer protection rules of the User's jurisdiction.

9.5. Taxes. Prices may not include applicable taxes, duties or levies (VAT, sales tax, etc.), which are the User's responsibility unless expressly stated otherwise.

9.6. Price changes. We may change prices or the content of the plans, giving reasonable advance notice to Users on paid plans before the change takes effect for their next billing cycle.

9.7. Non-payment. Non-payment may result in the suspension of premium features or automatic downgrade to the free plan, in accordance with Section 9.3.

10. User Data: ownership and licence to use

10.1. Ownership. As between the Parties, the User (or the Organisation, as applicable) retains all ownership rights over the Cultivation Data and the User Content uploaded to the Platform. These Terms do not transfer ownership of such data to the Company.

10.2. Licence to the Company. The User grants the Company a worldwide, non-exclusive, transferable (to providers/sub-processors in accordance with Section 11), royalty-free licence to host, store, process, reproduce, transmit and display the User Content strictly to the extent necessary to provide, maintain, back up, secure and improve the Service, and to comply with legal obligations (including the retention described in Section 12).

10.3. Aggregated and anonymised data. We may generate and use aggregated, statistical or anonymised data (which does not allow a User, Organisation or individual to be identified) derived from use of the Service, for product improvement, research, industry benchmarking or communication purposes, without restriction, including beyond the life of the account.

10.4. Data export. The User may export their Cultivation Data and audit history in standard formats (JSON/CSV) from the Platform, including before closing their account.

10.5. Responsibility for uploaded content. The User warrants that they hold the necessary rights over the User Content they upload (for example, photographs, documents, third-party laboratory results) and that such content does not infringe third-party rights or applicable regulations.

11. Personal data protection and privacy

11.1. The processing of Personal Data by the Company is governed by the Privacy Policy, which forms an integral part of these Terms and details, among other aspects: the categories of data processed, the purposes and legal bases, the recipients and processors, international transfers, retention periods, the security measures implemented and data subjects' rights under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), Brazil's Lei Geral de Proteção de Dados (LGPD), Argentina's Law 25.326, and any other applicable personal data protection regulation depending on the User's location.

11.2. Information security commitment. The Company implements reasonable technical and organisational measures to protect Personal Data and Cultivation Data, including (without limitation): encryption in transit, robust password hashing (bcrypt), optional two-factor authentication, secure session cookies (HttpOnly, SameSite), CSRF protection, HTTP security headers and a content security policy (CSP), logical multi-tenant isolation between Organisations, HMAC signing of Device readings, payment webhook signature verification, and a hash-chained audit log to detect unauthorised alterations of the history. Further detail is provided in the security guide (informative in nature).

11.3. No system is infallible. Despite the measures adopted, no method of electronic transmission or storage is 100% secure. In the event of a security breach affecting Personal Data, we will act in accordance with the incident notification procedures described in the Privacy Policy and with applicable regulations (for example, notification to supervisory authorities and to data subjects within the deadlines required by the GDPR or other applicable law).

11.4. For full details of rights (access, rectification, erasure/right to be forgotten, portability, objection, restriction of processing, not to be subject to automated decisions, and any other rights recognised by applicable law), the mechanisms for exercising them, international transfers and retention periods, please refer to the Privacy Policy.

12. Immutable audit trail and mandatory legal retention

12.1. BotanikTrace maintains a cryptographically chained audit log (hash chain) of relevant actions on plants, batches, analyses, destructions and other Cultivation Data, in order to evidence the historical integrity of the information before inspections, certifications or disputes.

12.2. Exception to the right of erasure. The User acknowledges and accepts that, by the very nature and purpose of regulatory traceability, certain records (in particular those forming part of the audit log, signed CoA, public passports issued and files exported for regulatory bodies) may be subject to legal retention obligations that prevail over a request for deletion or anonymisation, to the extent permitted by the exceptions to the right of erasure provided for, among other rules, in Article 17.3 of the GDPR, the CCPA/CPRA and Law 25.326. Consequently, the deletion of these specific records may not be immediate or complete, and may be limited to the anonymisation of the associated personal data, preserving the integrity of the traceable record.

12.3. When processing a deletion request, the Company will inform the User which categories of data could not be deleted for this reason and the legal basis relied upon.

13. Public passport (QR) and public exposure of data

13.1. The Service allows the generation, at the User's request, of a public "passport" accessible without authentication (via QR code or direct URL) for certain plants or batches, which may display information such as genetics, origin, batch, cultivation cycle, dry weight, cannabinoid/analysis results and an integrity verification seal (SHA-256 hash and signature).

13.2. User consent. By generating a public passport, the User expressly consents to the information included therein becoming publicly accessible on the internet, without access restrictions, to anyone holding the link or scanning the QR code, including consumers, inspectors or third parties. The User is responsible for not including in such passports Personal Data of third parties that should not be publicly disclosed, and for withdrawing or revoking the passport if they no longer wish the information to be public (as permitted by the functionality in force).

13.3. The Company does not control the use third parties make of the information contained in a public passport once accessed.

14. Photographic evidence and geolocation

14.1. The "Evidence" feature allows images to be uploaded in association with a cultivation phase, with a capture date, optional geolocation coordinates (latitude/longitude) and a description, calculating a SHA-256 hash as proof of the file's integrity.

14.2. Sensitive location data. Geolocation coordinates may reveal the physical location of a cultivation site, which may constitute sensitive information (for reasons of asset security and, in some jurisdictions, because it is associated with a regulated activity). The User voluntarily decides whether to include geolocation data and is responsible for assessing the physical security risks associated with its disclosure, including within exported reports or public passports (Section 13).

14.3. The Company treats these images and metadata as Cultivation Data and, where they correspond to an identifiable person or to sensitive personal data under applicable law, as Personal Data subject to the Privacy Policy.

15. Third parties, communications and payment gateways

15.1. Notifications. The Service may send notifications by email, Telegram and/or Discord, depending on the integration the User configures. Use of those channels is additionally subject to the terms and privacy policies of Telegram Messenger Inc. and Discord Inc. respectively, which the Company does not control.

15.2. Payment gateways. See Section 9.2. Payment processing by MercadoPago or Stripe involves sharing with those providers the minimum information necessary to process the transaction (for example, plan identifier, amount, contact details), as detailed in the Privacy Policy.

15.3. Third-party links and services. The Service may link to or integrate with third-party sites or services. We are not responsible for the content, privacy policies or practices of such third parties.

15.4. Impersonation. We warn that the Company will never request passwords, 2FA codes or card details by email, Telegram or Discord. If you receive suspicious messages, do not click on links: go manually to https://panel.botaniktrace.com.

16. Intellectual property

16.1. The Service, its proprietary source code, design, the "BotanikTrace" brand, logos, interfaces, documentation and other elements (with the exception of User Content and of components the Company publishes under open-source licences) are the property of the Company or its licensors, and are protected by intellectual and industrial property regulations.

16.2. Subject to compliance with these Terms, the Company grants the User a limited, non-exclusive, non-transferable and revocable licence to access and use the Service for the internal purposes of their Organisation.

16.3. The following are prohibited: reverse engineering, decompiling or disassembling the Service (except to the extent applicable law expressly and non-waivably permits); reselling, sublicensing or making the Service available to unauthorised third parties; extracting data through unauthorised automated scraping; removing proprietary notices; or using the "BotanikTrace" brand or name without prior written authorisation, except to the extent necessary to refer honestly to the Service (for example, to display the verification seal of a passport or CoA).

16.4. Firmware or software components distributed by the Company under open-source licences are governed by the terms of that licence, which prevail over these Terms in respect of those specific components.

17. Prohibited uses and acceptable use policy

In addition to the provisions of Section 4, the User undertakes not to:

a) use the Service for unlawful or fraudulent activities or activities that infringe third-party rights, including intellectual property, privacy or regulations on controlled substances;

b) falsify, adulterate or manipulate traceability records, photographic evidence, laboratory results, Certificates of Analysis (CoA) or any other data with the aim of misleading third parties, regulatory authorities, buyers or consumers;

c) attempt to breach, circumvent or compromise the authentication, encryption, HMAC signature or audit log mechanisms, or attempt to break the multi-tenant isolation between Organisations;

d) introduce viruses, malware or malicious code, or carry out denial-of-service attacks, unauthorised fuzzing, or penetration testing without prior written authorisation from the Company;

e) access or attempt to access accounts, Organisations or Devices that do not belong to them, without authorisation;

f) use the Service to harass, defame, discriminate against or infringe the rights of third parties;

g) use bots, scraping or automated tools to extract data from the Service without prior written authorisation, other than normal use of the documented API with the User's own credentials;

h) resell access to the Service without authorisation, except in arrangements expressly enabled by the Company (for example, Organisation accounts with multiple internal users).

17.2. If any security vulnerability is detected, we ask that it be reported responsibly through the channel indicated in Section 27, prior to public disclosure, so that it can be fixed.

18. Availability, maintenance and changes to the Service

18.1. We endeavour to keep the Service continuously available, but we do not guarantee uninterrupted or error-free availability. There may be interruptions due to scheduled or emergency maintenance, failures of our own or third-party infrastructure (cloud providers, connectivity, payment gateways, MQTT, etc.), or force majeure events (Section 23).

18.2. We may modify, suspend or discontinue features of the Service, in whole or in part, giving reasonable advance notice where the change is substantial and adversely affects the User, unless it concerns urgent security fixes.

18.3. We recommend that Users keep their own external backups of critical information, without prejudice to the safeguarding measures implemented by the Company.

19. Warranties and disclaimer

19.1. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT.

19.2. The Company does not warrant that: (a) the Service will be uninterrupted, timely, secure or error-free; (b) the results obtained through the Service (including sensor readings, alerts, reports or CoA) will be accurate, complete or reliable in all cases; (c) the Service will meet the specific regulatory requirements of the User's jurisdiction; or (d) defects will be corrected.

19.3. Nothing in this section limits non-waivable rights of the User under mandatory consumer protection or personal data protection regulations of their jurisdiction (for example, certain statutory guarantees cannot be excluded under Argentina's consumer protection law, Brazil's Consumer Defence Code, or other similar laws). In such cases, this section applies to the maximum extent permitted by that law.

20. Limitation of liability

20.1. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE COMPANY, ITS DIRECTORS, EMPLOYEES, PARTNERS AND SUPPLIERS SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, LOSS OF DATA, LOSS OF CROP, LOSS OF LICENCES OR REGULATORY PENALTIES ARISING FROM THE USE OF OR INABILITY TO USE THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

20.2. In no event shall the Company's total aggregate liability to the User, on any ground arising out of or relating to these Terms or the Service, exceed the greater of: (a) the amount actually paid by the User to the Company in the twelve (12) months preceding the event giving rise to the claim; or (b) [FIXED AMOUNT TO BE DEFINED, e.g. USD 100], except for free plan users, where the limit shall be that fixed amount.

20.3. These limitations do not apply to: (a) liability for wilful misconduct or gross negligence, to the extent it cannot be limited by law; (b) death or personal injury caused by the Company's negligence, where applicable law does not permit its exclusion; (c) breach of confidentiality or Personal Data protection obligations, where the applicable mandatory regulations (GDPR, LGPD, Law 25.326, CCPA/CPRA, etc.) prohibit its limitation; nor to any other liability that cannot be excluded or limited under the mandatory law applicable in the User's jurisdiction.

20.4. The User acknowledges that operational, health, commercial or regulatory decisions regarding their cultivation are their sole responsibility, and that the Service is a supporting tool, not a substitute for professional judgement or for the official traceability systems required by the competent regulator.

21. Indemnification

The User undertakes to indemnify and hold harmless the Company, its directors, employees, partners, agents and suppliers, against any claim, demand, loss, liability, damage, cost or expense (including reasonable legal fees) arising out of or relating to: (a) the User's breach of these Terms; (b) the violation of applicable laws through use of the Service, including regulations on the cultivation, possession or commercialisation of cannabis and regulated substances; (c) the User Content uploaded to the Platform; or (d) the User's infringement of third-party rights. This obligation does not apply to the extent that the claim arises from a breach directly attributable to the Company.

22. Suspension and termination

22.1. By the User. The User may stop using the Service and request closure of their account at any time, from the Platform settings or by contacting support, subject to the possibility of first exporting their data (Section 10.4) and to the legal retention described in Section 12.

22.2. By the Company. We may suspend or cancel a User's access, with or without prior notice depending on the seriousness of the case, where: (a) they breach these Terms, in particular Sections 4, 5 and 17; (b) there is reasonable suspicion of fraud, unlawful use or a security risk; (c) it is required by a competent authority; (d) the account remains inactive or unpaid for a prolonged period in accordance with Section 9; or (e) we discontinue the Service in accordance with Section 18, in which case we will give reasonable advance notice where circumstances permit.

22.3. Effects of termination. Upon termination of the account: (a) the right to access and use the Service ceases; (b) the User may request the export of their data within the period indicated in the closure notice (or the period provided by the Platform), after which the data may be deleted or anonymised, except for data subject to mandatory legal retention (Section 12); (c) provisions that by their nature must survive (intellectual property, limitation of liability, indemnification, governing law, confidentiality, data protection in respect of information already processed) shall remain in force.

23. Force majeure

Neither Party shall be liable for breaches or delays caused by circumstances reasonably beyond its control, including but not limited to: natural disasters, acts of government, pandemics, power or internet connectivity outages, third-party cyberattacks, failures of cloud infrastructure providers, armed conflict or civil unrest.

24. Governing law and dispute resolution

24.1. Governing law. These Terms are governed by the laws of [JURISDICTION TO BE DEFINED, e.g. the Argentine Republic], without regard to conflict-of-law rules, and without prejudice to the mandatory consumer protection or personal data protection provisions applicable by reason of the User's location that cannot be displaced by the parties' choice (for example, certain GDPR rights for EEA residents, CCPA/CPRA rights for California residents, or the consumer protection regulations of the User's jurisdiction).

24.2. Dispute resolution. The Parties shall endeavour to resolve any dispute in good faith through direct negotiation. If no solution is reached within [30] calendar days, the dispute shall be submitted to [the jurisdiction of the ordinary courts of (CITY), or arbitration administered by (INSTITUTION), to be defined], with the Parties waiving any other forum that might apply, unless the mandatory law applicable in the User's jurisdiction provides for a different forum on a non-waivable basis (for example, the forum of the consumer's domicile in consumer relationships).

24.3. Consumers. If the User qualifies as a "consumer" under the consumer protection regulations of their jurisdiction, nothing in this Section 24 is intended to deprive them of the mandatory protections (including the competent forum) that such regulations grant them on a non-waivable basis.

24.4. Waiver of class actions (where permitted by law). To the extent permitted by applicable law, disputes shall be resolved individually, and the User waives participation in class or collective actions against the Company, unless such waiver is invalid or unenforceable in the User's jurisdiction, in which case this subsection shall not apply to that User.

25. Changes to these Terms

25.1. We may amend these Terms from time to time to reflect legal, regulatory, security or Service changes. We will publish the version in force with the "Last updated" date on this same page.

25.2. In the event of substantial changes, we will give reasonable advance notice by email and/or a prominent notice within the Platform, indicating the effective date.

25.3. Continued use of the Service after the changes take effect constitutes acceptance of the new Terms. If you do not agree, you must stop using the Service and may request closure of your account in accordance with Section 22.

26. General provisions

26.1. Entire agreement. These Terms, together with the Privacy Policy and any specific service level agreement (SLA) or framework contract signed in writing between the Parties, constitute the entire agreement between the User and the Company regarding the Service, and supersede any prior agreement on the same subject matter.

26.2. Severability. If any provision of these Terms is declared invalid or unenforceable by a competent authority, that provision shall be interpreted so as to reflect as closely as possible the original intention of the Parties, and the remainder of the Terms shall remain in full force.

26.3. Waiver. The Company's failure to exercise any right provided in these Terms does not constitute a waiver of that right.

26.4. Assignment. The User may not assign or transfer these Terms or the rights and obligations arising from them without the Company's prior written consent. The Company may assign these Terms in the context of a merger, acquisition, corporate reorganisation or sale of assets, notifying the User.

26.5. Relationship between the Parties. Nothing in these Terms creates a partnership, employment, agency, franchise or joint venture relationship between the Parties.

26.6. Notices. Notices from the Company to the User shall be sent to the email address registered on the account or through notices within the Platform. Notices from the User to the Company shall be sent through the channels indicated in Section 27.

26.7. Language. These Terms may be translated into other languages (for example, English or Portuguese) for accessibility reasons. In the event of any discrepancy between versions, the Spanish version shall prevail, unless the mandatory law of the User's jurisdiction requires the local language version to prevail.

26.8. Headings. Section headings are included for convenience of reference only and do not affect their interpretation.

27. Contact

For queries about these Terms, exercise of rights, security reports or legal notices:

• General / support: [[email protected]]
• Legal queries: [[email protected]]
• Data protection / DPO: [[email protected]] (see also the Privacy Policy)
• Registered address: [FULL REGISTERED ADDRESS]

Related document: Privacy and Data Protection Policy.