CrabTap Merchant Agreement

Last updated: August 16, 2026

This Merchant Agreement ("Agreement") governs your use of CrabTap as a business owner running a loyalty program ("Venue"). By creating a CrabTap business account, you agree to this Agreement, including the Data Processing Agreement attached as Section 10.

1. Service Description

CrabTap provides a software-as-a-service (SaaS) platform enabling you to run a digital loyalty program - stamp cards, points, and promotions - for your customers, accessible via subscription.

2. Subscription Terms

• Subscription price: $8.99/month plus applicable tax, billed via Stripe.
• New accounts receive a 30-day free trial before any charge applies.
• Once a paid period has been charged, no refunds are issued for that period - you may cancel at any time to stop future renewals.
• If your subscription lapses or is cancelled, your Venue is frozen: staff can no longer add stamps or points or send promotions, but your customers' existing cards and data remain untouched and unaffected.

3. Payments

Subscription payments are processed by Stripe. Your use of Stripe's payment services is also subject to Stripe's own terms. CrabTap does not store your payment card details.

4. Your Role as Data Controller

This is the most important section of this Agreement to understand. For the personal data of your own customers (their name, email, stamps, points, and activity at your Venue), you are the data controller, and CrabTap is the data processor, acting only on your instructions to provide the platform. You are responsible for:

• Having a lawful basis to collect and process your customers' data
• Responding to your customers' requests to exercise their data protection rights, with CrabTap's reasonable assistance as described in the attached DPA
• Using your customers' data only for the purpose of operating your loyalty program through CrabTap, not for unrelated purposes

5. Acceptable Use

You agree not to:

• Use CrabTap for any unlawful purpose
• Attempt to circumvent CrabTap to contact your customers outside the platform in ways inconsistent with their consent or expectations
• Abuse, overload, or attempt unauthorized access to CrabTap's systems

6. Intellectual Property

• Any branding, logos, or content you upload (e.g. your Venue's logo, custom stamp graphics) remain your property.
• The CrabTap platform, software, and branding remain the property of CrabTap and are licensed to you for use only as described in this Agreement.

7. Service Availability

CrabTap is provided on an "as is" and "as available" basis. While we aim for high reliability, we do not guarantee uninterrupted or error-free operation, and we are not liable for losses arising from temporary unavailability.

8. Limitation of Liability

To the maximum extent permitted by law, CrabTap's total liability to you arising from this Agreement is limited to the amount you paid to CrabTap in the 3 months preceding the claim. CrabTap is not liable for indirect, incidental, or consequential damages.

9. Termination

• You may cancel your subscription and/or delete your Venue account at any time.
• Deletion follows the same 30-day grace period described in our Privacy Policy: your Venue is frozen immediately, your subscription is scheduled to stop renewing, and after 30 days, your account and associated data are permanently deleted (with your subscription fully cancelled in Stripe at that point, if not already).
• CrabTap may suspend or terminate your account for material violation of this Agreement, including non-payment or abuse.

10. Data Processing Agreement (DPA)

This Section 10 forms the Data Processing Agreement between you ("Controller") and CrabTap ("Processor") required under applicable data protection law (including GDPR).

10.1 Roles

You are the Controller for your customers' personal data. CrabTap is the Processor, acting only on your documented instructions (as expressed through your use of the CrabTap platform and its standard features).

10.2 Subprocessors

CrabTap uses the following subprocessors to provide the service, consistent with those listed in our Privacy Policy:

CrabTap will notify you of any intended changes to this subprocessor list.

10.3 Security Measures

CrabTap implements appropriate technical and organizational measures to protect your customers' data, including Row Level Security (RLS) enforced at the database level - meaning a Venue's data is technically isolated and cannot be queried or returned by another Venue's account, not merely restricted by application logic alone.

10.4 Assistance with Data Subject Requests

CrabTap will provide reasonable assistance to help you respond to your customers' requests to exercise their data protection rights (access, correction, deletion, etc.), consistent with the platform's available functionality.

10.5 Breach Notification

CrabTap will notify you without undue delay upon becoming aware of a personal data breach affecting your customers' data.

10.6 Data Deletion

Upon termination of your account, CrabTap will delete your customers' personal data in accordance with the retention period described in our Privacy Policy (30-day grace period, then permanent deletion). If you require a copy of your Venue's customer data before deletion, contact us and we will provide reasonable assistance to help you export it prior to the deletion taking effect.

11. Governing Law, Changes, and Contact

• This Agreement is governed by the laws of Poland.
• We may update this Agreement from time to time; material changes will be communicated by email.
• Questions about this Agreement can be sent to support@crabtap.com.