Terms of Service

In these Terms, the following definitions apply:

By creating an account or using the Services you confirm that:

• You are at least 18 years of age and have legal capacity to enter into a binding contract.
• If acting on behalf of a company, you have authority to bind that company to these Terms.
• Your business is incorporated or registered in the United Kingdom or the European Economic Area, or you have obtained appropriate regulatory permissions to use open banking services in your jurisdiction.
• You are not on any sanctions list maintained by the UK Government, UN, EU, or OFAC.
• You will comply with all applicable laws, including the PSRs, UK GDPR, and anti-money laundering regulations.

Reflow reserves the right to refuse service to any entity at our sole discretion, including where we have regulatory concerns.

To access the Services you must register for an account and complete our know-your-business (KYB) onboarding process. You agree to:

• Provide accurate, current, and complete information during registration and keep it up to date.
• Maintain the security of your account credentials, API keys, and access tokens.
• Notify us immediately at security@reflowzone.io if you suspect any unauthorised access to your account.
• Not share API keys or credentials with third parties not authorised under your account.
• Accept responsibility for all activity that occurs under your account.

Reflow may require additional documentation to satisfy AML/CTF obligations. Failure to provide requested information within 10 business days may result in suspension of your account.

4.1 Scope of Services

Reflow grants you a non-exclusive, non-transferable, revocable licence to access and use the Services during the term of your subscription, solely for your internal business purposes in accordance with these Terms and all applicable documentation.

4.2 Service Availability

We target 99.9% API uptime (excluding scheduled maintenance windows, which are announced with at least 48 hours' notice where practicable). Current service status is available at status.reflowzone.io. Planned and unplanned maintenance may cause brief periods of unavailability.

4.3 Sandbox Environment

The sandbox environment is provided for testing purposes only. It simulates — but does not access — real bank accounts or process real payments. Sandbox data must not be used for production decision-making. We make no uptime commitment for the sandbox.

4.4 Changes to Services

We may modify, enhance, or discontinue features of the Services. For material changes that reduce functionality, we will provide at least 60 days' notice to active Customers. For deprecated API endpoints, we will maintain them for at least 90 days after deprecation notice.

You agree to use the Services only for lawful purposes. You must not, and must not permit any third party to:

• Access Open Banking Data beyond the scope of End-User consent, or retain it beyond the permitted retention period.
• Use the Services for any purpose that violates the PSRs, UK GDPR, Financial Services and Markets Act 2000, or any other applicable law or regulation.
• Attempt to circumvent rate limits, authentication mechanisms, or other technical controls.
• Reverse engineer, decompile, or derive the source code of any part of the Services.
• Use the Services to facilitate fraud, money laundering, terrorist financing, or any other financial crime.
• Scrape or harvest data from the Services beyond your authorised API usage.
• Resell, sublicense, or make the Services available to third parties (including as a white-labelled product) without prior written consent from Reflow.
• Test the Services with tools that simulate DDoS attacks, vulnerability scanners, or similar automated attack tooling without prior written permission under our responsible disclosure programme.
• Use the sandbox environment to make real payment initiations or access real account data.

We reserve the right to throttle or suspend API access that we reasonably determine constitutes abuse, excessive usage, or a security threat, without liability.

Where you use our Services to access End-User data or initiate payments, you accept the following obligations:

6.1 Consent Management

• You must obtain valid, explicit, granular, and informed consent from each End-User before making any API call that accesses their data or initiates a payment.
• Your consent flow must comply with the Open Banking Standard and the FCA's guidance on customer consent.
• You must not pre-tick consent boxes, use dark patterns, or otherwise coerce End-Users into granting broader consent than they intend.
• You must honour consent withdrawals immediately upon receipt and cease all API access to that End-User's data.
• You must provide End-Users with a clear, accessible mechanism to withdraw consent at any time.

6.2 Data Use Restrictions

• Open Banking Data may only be used for the specific purpose disclosed to the End-User at the point of consent.
• You must not use Open Banking Data to build credit scores, make lending decisions, or create profiles beyond what is explicitly consented to, unless you are separately authorised to do so by the FCA.
• You must maintain your own privacy policy that accurately describes your use of Open Banking Data and complies with UK GDPR.

6.3 Your Regulatory Status

You represent and warrant that, to the extent required by applicable law, you hold all necessary regulatory authorisations or exemptions for the activities you undertake using our Services. If your regulatory status changes, you must notify us within 5 business days.

Fees are as set out in the pricing plan you select at registration, or as agreed in a separate Order Form for enterprise arrangements. Unless otherwise stated:

• Subscription fees are billed monthly in advance on the anniversary of your start date, in GBP.
• Usage-based fees (e.g. per API call above plan limits) are billed in arrears at the end of each calendar month.
• All fees are exclusive of VAT, which will be added at the prevailing UK rate where applicable.
• Fees are non-refundable except where required by law or as expressly stated in these Terms.
• Invoices are due within 30 days of the invoice date. Late payments accrue interest at 8% per annum above the Bank of England base rate under the Late Payment of Commercial Debts (Interest) Act 1998.
• We reserve the right to suspend Services for accounts with overdue invoices after 14 days' written notice.

We may adjust pricing on 60 days' written notice. Continued use of the Services after the effective date of a price change constitutes acceptance.

As between you and Reflow:

• Reflow IP: All rights in the Services, API, platform software, documentation, trademarks, and trade secrets vest exclusively in Reflow. These Terms grant you a limited licence only — no ownership rights are transferred.
• Your IP: You retain all rights in your own applications, data, and content that you develop independently of the Services.
• Open Banking Data: You acknowledge that Open Banking Data belongs to the End-User and is accessed only under their consent. Neither you nor Reflow owns this data.
• Feedback: If you provide suggestions or feedback about the Services, you grant Reflow a royalty-free, perpetual, worldwide licence to use such feedback to improve the Services without obligation to you.

Each party may disclose confidential information to the other in connection with the Services. "Confidential Information" means any non-public information disclosed by one party to the other that is designated as confidential or that a reasonable person would consider confidential given its nature and the circumstances of disclosure.

Each party agrees to:

• Keep the other party's Confidential Information strictly confidential and use it only to exercise rights or fulfil obligations under these Terms.
• Disclose Confidential Information only to employees, agents, and sub-contractors who need to know it and who are bound by equivalent confidentiality obligations.
• Not disclose Confidential Information to any third party without prior written consent.

Confidentiality obligations do not apply to information that: (a) is or becomes publicly known through no breach of these Terms; (b) was already known to the recipient; (c) is independently developed; or (d) must be disclosed by law, regulation, or court order (provided prompt notice is given where legally permissible).

Confidentiality obligations survive termination of these Terms for a period of five years.

Where Reflow processes personal data on your behalf in the course of providing the Services, we do so as your data processor and you act as the data controller. Our Data Processing Agreement (DPA), which forms part of these Terms, sets out the subject matter, duration, nature, and purpose of such processing.

You agree to:

• Comply with all applicable data protection law, including UK GDPR and the Data Protection Act 2018, in connection with your use of the Services.
• Ensure you have a valid legal basis for processing End-User data, including obtaining consent that meets the requirements of UK GDPR and the PSRs.
• Maintain and make available to End-Users a privacy policy that accurately reflects your data processing activities.
• Promptly notify Reflow if you become aware of any personal data breach involving data processed through our Services.

Where Reflow acts as an independent data controller (e.g. for platform security, fraud prevention, and regulatory compliance), our Privacy Policy governs such processing.

Reflow warrants that:

• It holds all necessary FCA authorisations to provide the Services during the term.
• The Services will materially conform to the documentation under normal use.
• It will apply reasonable industry-standard security measures to protect data processed through the platform.

Except as expressly stated above, the Services are provided "as is" and "as available". To the fullest extent permitted by law, Reflow disclaims all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

In particular, Reflow does not warrant that:

• The Services will be error-free or uninterrupted;
• Data retrieved from bank APIs will be accurate, complete, or timely (as this is dependent on data provided by third-party banks);
• The Services will meet your specific business requirements.

To the maximum extent permitted by applicable law:

• Reflow's total aggregate liability to you under or in connection with these Terms (whether in contract, tort, breach of statutory duty, or otherwise) in any 12-month period shall not exceed the greater of: (a) the total fees paid by you to Reflow in the 12 months preceding the event giving rise to the claim; or (b) £10,000.
• Reflow shall not be liable for any indirect, special, incidental, consequential, exemplary, or punitive damages, including loss of profits, loss of revenue, loss of data, loss of goodwill, or business interruption, even if advised of the possibility of such damages.
• Reflow shall not be liable for any loss arising from the accuracy or completeness of Open Banking Data provided by third-party banks, or from the unavailability of bank APIs outside Reflow's control.

Nothing in these Terms limits or excludes liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited under applicable law (including the Consumer Rights Act 2015 where applicable); or (d) breach of obligations under the PSRs to the extent prohibited by law.

You agree to indemnify, defend, and hold harmless Reflow and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with:

• Your breach of these Terms or any applicable law or regulation;
• Your failure to obtain valid End-User consent or to comply with your data protection obligations;
• Any claim by an End-User or third party arising from your application, product, or service;
• Your use of Open Banking Data for a purpose not authorised by these Terms or End-User consent;
• Any misrepresentation you make to End-Users about the nature or scope of the Services.

14.1 Termination by You

You may terminate your account at any time by providing 30 days' written notice to support@reflowzone.io. You remain liable for all fees incurred up to the effective date of termination.

14.2 Termination by Reflow

Reflow may terminate your account with 30 days' written notice for any reason. We may terminate immediately (without notice) if:

• You commit a material breach of these Terms that is incapable of remedy, or that you fail to remedy within 14 days of written notice;
• You become insolvent, enter administration, or are subject to equivalent insolvency proceedings;
• We are required to do so by the FCA, a court order, or other legal obligation;
• We reasonably suspect your use of the Services involves financial crime or regulatory breach.

14.3 Effect of Termination

On termination: (a) all licences granted under these Terms cease; (b) you must immediately destroy or return any Reflow Confidential Information; (c) we will delete your data in accordance with our retention schedule, save where required by law; (d) provisions intended to survive termination (including §9, §10, §12, §13, and §16) shall continue in force.

We may amend these Terms from time to time. For material changes we will provide at least 30 days' written notice by email. For changes required by law or regulatory obligation, we will give as much notice as is reasonably practicable.

Continued use of the Services after the effective date of an amendment constitutes acceptance of the revised Terms. If you do not accept the revised Terms, you may terminate your account before the effective date without penalty.

The version of these Terms published at reflowzone.io/terms-of-service on the effective date governs your use from that date.

These Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes) shall be governed by and construed in accordance with the laws of England and Wales.

The parties agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim, save that either party may seek urgent injunctive or other interim relief in any competent jurisdiction.

Before commencing any legal proceedings, the parties agree to attempt to resolve disputes through good-faith negotiation for a period of 30 days following written notice of the dispute.

If you have a complaint about our payment services, you may also refer the matter to the Financial Ombudsman Service — see our FCA Disclosure for details.