Terms of Service — OneVault

1. About these Terms

These Terms of Service ("Terms") govern your access to and use of OneVault ID, the OneVault account site at account.onevault.org, the public OneVault websites (including onevault.org and regional sites such as onevault.us, onevault.ae and onevault.lk), the OneVault sign-in, consent and account-recovery services, and any related support or communications (together, the "Services"). The Services are provided by OneVault LLC ("OneVault", "we", "us" or "our").

By creating a OneVault account, ticking the agreement box during registration or re-acceptance, or using the Services, you agree to these Terms. If you do not agree, do not create an account or use the Services.

The following documents form part of these Terms and are incorporated by reference:

the Acceptable Use Policy, which sets out rules of conduct that apply to everyone who uses the Services;
the Privacy Policy, which explains how we handle personal data; and
the Cookie and Advertising Policy, which explains cookies and similar technologies.

If you register or operate an app that uses OneVault sign-in, the Developer Terms also apply to that activity. If a supplemental document conflicts with these Terms, these Terms control unless the supplemental document expressly says otherwise.

2. Definitions

"Account" means your OneVault ID account and its associated profile, credentials and settings.
"Connected app" means a website, mobile app or other online service that lets you sign in with OneVault using OpenID Connect.
"OneVault App" means a connected app operated by OneVault LLC or one of its subsidiaries or affiliates, such as Tweely, Gloodz, Wiredly and ToyoSuper, including OneVault Apps added in the future. The current list is maintained in Section 5 of the Privacy Policy.
"Third-party app" means a connected app operated by an independent developer that OneVault has approved.
"Developer" means a person or organization that registers or operates a third-party app.
"Content" means any information, data, text, file or other material submitted, stored, transmitted or made available through or in connection with the Services.

3. Eligibility and minimum age

You may use the Services only if:

you are at least 13 years old, and you also meet any higher minimum age that applies where you live. In particular, if you live in a country that sets a higher age of digital consent (for example, some European Union member states set this at 14, 15 or 16), you must meet that age. OneVault does not currently offer a parental-consent process, so you must not register if you are below the minimum age that applies to you;
if you are under the age of legal majority where you live, your parent or legal guardian has reviewed and agreed to these Terms on your behalf and supervises your use of the Services where local law requires it;
you are able to form a binding contract with OneVault and are not barred from using the Services under the laws of the United States or any other applicable jurisdiction;
you are not located in, ordinarily resident in, or organized under the laws of a country or territory that is subject to comprehensive United States sanctions, and you are not a person identified on, or owned or controlled by a person identified on, any United States or other applicable sanctions or restricted-party list (see Section 24); and
we have not previously terminated your Account or banned you from the Services, unless we have given you written permission to register again.

We may apply additional eligibility requirements by country or region, may decline to make the Services available in certain places, and may ask you to confirm your eligibility. If we learn that an Account belongs to someone who does not meet these requirements, we may suspend or close it and delete the associated data as required by law.

4. Your OneVault account

Accurate information. When you register you provide a username (8 to 32 lowercase letters or digits), your first and last name, country, date of birth, gender and an email address that you verify. You must provide truthful, accurate and complete information, keep it current, and not impersonate any person or misrepresent your identity, age or affiliation. Your username cannot be changed after it is created.

Supported email addresses. To reduce spam, automated sign-ups and fraud, registration currently accepts only Gmail and iCloud email addresses. We may change the accepted email providers at any time. Your email address is used for verification, security messages and account recovery; it is not your sign-in name.

One person, one account. Each Account is personal to one individual. Unless we expressly permit it in writing, you may hold only one Account. You must not create an Account for another person, create Accounts using automated means, or create, sell, buy, rent, lend, trade or transfer Accounts or usernames.

Optional phone verification. You may choose to verify a mobile phone number with OneVault ("Silver" verification). This is initially offered for Sri Lankan mobile numbers, by SMS sent through a Sri Lankan SMS provider, and may be extended to other countries. Phone verification confirms control of a phone number at the time it was verified; it does not verify your legal identity. A verified phone number is shared with OneVault Apps as described in Section 7, and you can remove it from your Account at any time.

What verification means. A verified email address or phone number means only that the address or number was shown to be under your control when it was verified. OneVault does not verify your legal name, age, nationality or identity documents unless a specific product feature expressly says so, and profile details other than verified contact points are self-declared.

Staff actions. To protect you, other users and the Services, authorized OneVault staff may, for a documented support, security or legal purpose, review account and sign-in activity, correct inaccurate profile details, end active sessions, require a password change, place a temporary hold on an Account, restrict access, or suspend or terminate an Account. Staff access is role-restricted and audited. Staff cannot see your password and will never ask you for it.

5. Account security and your responsibilities

You are responsible for all activity that occurs under your Account, except activity caused by OneVault's own breach of these Terms. You must:

keep your password, passkeys, recovery codes, verification codes and devices secure and confidential;
not share your credentials or allow any other person to use your Account;
use a strong, unique password and keep your email account and any verified phone number secure, because they are used for recovery;
review security emails we send you (for example, a notice that your password was changed) and act on them promptly;
review your active sessions and connected apps regularly; and
tell us immediately through the contact form if you believe your Account has been compromised or used without permission.

Your password and passkeys are processed by OneVault's authentication system and are never shared with connected apps. OneVault staff never see your password. Nobody from OneVault will ask you to reveal your password, recovery codes or one-time codes; treat any such request as fraudulent.

We may require additional verification, block sign-in attempts, or temporarily restrict an Account when we detect suspicious activity. We are not liable for loss or damage arising from your failure to comply with this Section.

New-device sign-in protection. If a sign-in comes from a device or browser we do not recognize, we may send a one-time code by email from [email protected] and ask you to enter it before the sign-in completes. Enter such a code only on the OneVault sign-in page, and never share it with anyone.

6. Signing in to connected apps

OneVault lets you sign in to connected apps using OpenID Connect. When you choose to sign in to an app with OneVault:

you authenticate with OneVault, not with the app, and the app never receives your OneVault password or passkey;
for third-party apps, OneVault shows you a consent screen that identifies the app and lists all of the information it is requesting, and you decide whether to connect; OneVault Apps do not show a consent screen and receive the information described in Section 7; and
OneVault then sends the information described in Section 7 to the app so that the app can create or sign you in to your account with that app.

A OneVault sign-in establishes who you are to the app. The app decides what you can do inside it. Each connected app is responsible for its own services, accounts, roles, permissions, transactions, content and data handling, under its own terms and privacy policy. You should read those documents before using the app.

You can review and remove app connections at any time in Connected apps in your Account. Removing a connection stops OneVault from sharing your information with that app in the future. It does not delete information the app already received, and it does not close your account with that app. To delete information held by an app, contact the app directly; its own privacy policy governs that information.

7. Information shared with connected apps

OneVault does not sell your personal data. What a connected app receives depends on whether it is a OneVault App or a third-party app.

OneVault Apps. When you use OneVault ID to sign in to a OneVault App, OneVault shares your OneVault profile information with that app, without a separate consent screen:

a user identifier, which is the same for all OneVault Apps so that they recognize the same account;
your first and last name and your username;
your email address and whether it is verified;
your country, date of birth and gender;
if you have verified a phone number with OneVault, that phone number and its verification status; and
your assurance level (for example, Basic or Silver verification).

One phone verification for all OneVault Apps. If you verify your phone number once in OneVault, including when the verification starts from inside a OneVault App, the verified number and its status become available to every OneVault App you use. You can remove the number from your Account at any time; removing it stops future sharing of the number, but does not delete a number that a OneVault App has already received. OneVault may also tell OneVault Apps when your profile information changes or your Account is disabled, so that they can keep your details current.

Third-party apps. A third-party app receives only the information it requests and you approve on the consent screen. The consent screen lists all of the information the app is requesting, which may include any of the items listed above. The app decides which information it needs for its service, and your approval covers everything listed on the screen. If you do not want to share any of the requested information, you can decline to connect; you then cannot use that app with OneVault. If an app later asks for more information, you will see a new consent screen. A third-party app receives a user identifier that is shared only with other apps of the same developer, so that apps of different developers cannot use it to match you with each other. You can review and remove approvals at any time in Connected apps.

What apps never receive. Connected apps never receive your password, passkeys, recovery codes, one-time codes, sign-in history or OneVault security records through OneVault sign-in.

Each app's own privacy policy applies. Each connected app, including each OneVault App, handles the information it receives under its own terms and privacy policy.

8. OneVault Apps and third-party apps

OneVault Apps are operated by OneVault LLC or its subsidiaries or affiliates. Each OneVault App may have its own terms and privacy policy in addition to these Terms, and its privacy policy governs the information it receives.

Third-party apps are operated by independent developers. Before a developer may offer OneVault sign-in, OneVault conducts an authenticity review of the developer, which may include its business name, address, website, verified official email address, social media profiles and WhatsApp number, and may request further evidence. Approval means only that the developer passed that review at the time. OneVault does not operate, control, endorse or guarantee third-party apps, their content, products, services, security or data practices, and is not responsible for them. Your relationship with a third-party app is solely between you and its developer.

OneVault may suspend, restrict or revoke any developer or app at any time, including without notice where we suspect abuse, fraud, a security risk or a breach of our Developer Terms. If an app is suspended or removed, you may lose the ability to sign in to that app with OneVault; your relationship with that app, and any data it holds, remain matters between you and the app.

If you have a concern about a third-party app, you may report it to us through the contact form.

9. Acceptable use

You must comply with the Acceptable Use Policy and all applicable laws. Without limiting that policy, you must not:

use the Services for any fraudulent, deceptive, harmful or unlawful purpose;
impersonate any person or organization, or misrepresent your identity, age or affiliation;
share your credentials, let others use your Account, or sell, buy, rent or transfer Accounts;
create Accounts by automated means, in bulk, or to evade a restriction, suspension or ban;
access or attempt to access another person's Account or any non-public part of the Services;
probe, scan or test the vulnerability of the Services, or breach or circumvent any security, rate limit, bot protection or authentication measure, except as permitted by a published OneVault security disclosure program;
reverse engineer, decompile, disassemble or attempt to derive source code, except to the extent that this restriction is prohibited by applicable law;
scrape, crawl, harvest or collect data from the Services by automated means, other than through documented public interfaces and in accordance with any robots.txt instructions;
interfere with or disrupt the Services, including by transmitting malware or placing an unreasonable load on our systems; or
use the Services to store, transmit or distribute illegal material, or to facilitate illegal activity through a connected app or otherwise.

10. Illegal content, investigations and law enforcement

OneVault does not tolerate illegal activity. If we suspect or become aware of fraud, impersonation, identity theft, child sexual abuse material or child sexual exploitation, terrorism or violent extremism, malware, money laundering, sanctions evasion, harassment, intellectual property infringement, or the storage or distribution of illegal material through or in connection with the Services or any connected app, we may, to the extent permitted by applicable law:

investigate, including by reviewing relevant account, security and sign-in records;
preserve relevant records, including records that would otherwise be deleted under our retention practices;
immediately suspend or terminate the Accounts involved, revoke related connected-app access and remove relevant Content;
cooperate with law enforcement, regulators and other competent authorities, and respond to valid legal process; and
report the matter to the appropriate authorities where we are legally required or permitted to do so, including reporting apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC) as required by United States law.

We may disclose information about you as described in the Privacy Policy when we believe in good faith that disclosure is required by law or reasonably necessary to prevent harm or illegal activity. We may be legally prohibited from telling you about a request or an investigation.

11. How we enforce these Terms

If we reasonably believe that you have breached these Terms or any incorporated policy, that your Account poses a risk to OneVault, other users, connected apps or third parties, or that we must act to comply with law, we may, at our discretion and with or without prior notice, take any one or more of the following actions:

issue a warning;
require you to verify information, change your password or complete additional security steps;
end your active sessions or revoke connected-app access;
restrict features, place a temporary hold on your Account, or limit your ability to sign in to connected apps;
suspend your Account for a period of time or indefinitely;
permanently terminate your Account and refuse future registration; and
take any other action described in Section 10.

In deciding what to do, we consider the severity of the conduct, its effect on others, whether it was intentional or repeated, and our legal obligations. We may act immediately where we believe it is necessary to protect people or the Services. Where appropriate and lawful, we will tell you the reason for our decision and how you can ask us to review it through the contact form. We are not required to reinstate an Account, and our decision on review is final to the extent permitted by law. Nothing in this Section limits any right you have under mandatory law to challenge a decision.

12. Security practices and standards

OneVault's authentication and authorization services are designed to follow recognized global standards and guidance, including OpenID Connect, current OAuth 2.0 security best practices, and authentication practices aligned with guidance published by the United States National Institute of Standards and Technology (NIST). Staff access to account data is role-restricted and audited. These statements describe our design goals; they are not a certification or a guarantee. No system is completely secure, and we cannot guarantee that unauthorized access, loss or disclosure will never occur. If we become aware of a security incident that affects your personal data, we will notify you and the relevant authorities where the law requires.

13. Communications

By creating an Account, you agree that we may send you essential messages about the Services by email (and by SMS if you have verified a phone number), including verification codes, one-time codes to confirm sign-ins from unrecognized devices, security alerts (for example, a notice that your password has changed or a new sign-in occurred), account and connected-app notices, notices of changes to these Terms or our policies, and responses to your requests. These messages are part of the Services and you cannot opt out of them while you hold an Account. You agree that such electronic communications satisfy any legal requirement that a communication be in writing. Essential emails are sent from [email protected].

We will not send you marketing messages unless you have agreed to receive them where the law requires consent, and you can opt out of any marketing messages at any time. Standard carrier message and data rates may apply to SMS.

14. Privacy, cookies and advertising

Our Privacy Policy explains how we collect, use, disclose and protect personal data, and the rights you may have. Our Cookie and Advertising Policy explains how we use cookies and similar technologies. Our public marketing websites may display advertising, including advertising delivered by third parties such as Google. The signed-in account area (account.onevault.org) does not display advertising, and your OneVault account data is never sold and never used for third-party advertising targeting.

15. Fees

OneVault ID is currently offered to individual users free of charge. If we introduce paid features, we will tell you the price and terms before you are charged, and you will not be charged unless you agree.

16. Ownership and license

The Services, including all software, designs, text, graphics, logos, the OneVault name and marks, and all related intellectual property rights, are owned by OneVault LLC or its licensors and are protected by law. Subject to your compliance with these Terms, we grant you a personal, limited, revocable, non-exclusive, non-transferable, non-sublicensable license to access and use the Services for your own personal, non-commercial use as permitted by these Terms. All rights not expressly granted are reserved. You may not use the OneVault name, logos or marks without our prior written permission.

You keep any rights you have in Content you submit. You grant OneVault a worldwide, non-exclusive, royalty-free license to host, store, process, transmit and display that Content only as necessary to provide, secure and improve the Services, to comply with law and to enforce these Terms. This license does not permit us to sell your personal data.

If you believe material available through the Services infringes your copyright or other intellectual property rights, please contact us through the contact form with enough detail for us to identify the material and your rights. We may remove material and terminate the Accounts of repeat infringers where appropriate.

17. Feedback

If you send us suggestions or feedback about the Services, you grant us the right to use them without restriction or compensation to you. We are not obliged to use any feedback.

18. Changes to the Services

We continually develop the Services. We may add, change, suspend or discontinue any feature, connected-app capability, supported email provider, supported country or the Services as a whole, temporarily or permanently. Where a change materially and adversely affects you, we will give you reasonable advance notice where practicable, except where the change is required for security, legal or regulatory reasons or to prevent abuse. If we discontinue the Services entirely, we will try to give you reasonable notice and an opportunity to export your data.

19. Changes to these Terms

We may update these Terms from time to time, for example to reflect changes in the Services, the law or our business. We will post the updated Terms with a new version number and effective date. If a change is material, we will give you notice before it takes effect, for example by email or by asking you to review and accept the updated Terms when you next sign in. Unless the law requires otherwise, updated Terms take effect on the date stated in them, which will be at least 14 days after notice for material changes that are not required by law or for security. If you do not agree to updated Terms, you must stop using the Services and may close your Account. Your continued use after the effective date, or your acceptance when asked, means you accept the updated Terms. Changes to Section 26 are subject to the additional rules in Section 26.11.

20. Closing your account

By you. You may request deletion of your Account at any time from Privacy & data in your Account. After you confirm the request, there is a 7-day cancellation window during which you can cancel it. After that window ends, we process the deletion. Some records are retained after deletion where necessary for legal obligations, security, fraud prevention, dispute resolution, legal holds, consent and audit records, and in backups until they are overwritten on their normal rotation, as described in the Privacy Policy. Deleting your OneVault Account does not delete accounts or data held by connected apps; contact each app for that.

By us. We may suspend or terminate your Account as described in Sections 10 and 11, or if we discontinue the Services. We may also close Accounts that have been inactive for an extended period after giving notice to the email address on the Account.

Effect of closure. When your Account is closed, your right to use the Services ends and you will no longer be able to sign in to connected apps with OneVault. Sections 10, 16, 17 and 20 to 28, and any other provisions that by their nature should survive, survive closure.

21. Disclaimer of warranties

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY. ONEVAULT, ITS SUBSIDIARIES AND AFFILIATES, AND THEIR OFFICERS, MEMBERS, MANAGERS, EMPLOYEES, AGENTS AND LICENSORS (THE "ONEVAULT PARTIES") DISCLAIM ALL WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND ACCURACY, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

WITHOUT LIMITING THE FOREGOING, THE ONEVAULT PARTIES DO NOT WARRANT THAT: (A) THE SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE OR ERROR-FREE; (B) DEFECTS WILL BE CORRECTED; (C) THE SERVICES WILL BE COMPATIBLE WITH ANY DEVICE, BROWSER OR CONNECTED APP; (D) ANY FRAUDULENT, AUTOMATED OR ABUSIVE ACTIVITY WILL BE DETECTED OR PREVENTED; (E) ANY PROFILE INFORMATION PROVIDED BY OTHER USERS IS ACCURATE; OR (F) ANY CONNECTED APP, INCLUDING ANY THIRD-PARTY APP THAT PASSED OUR AUTHENTICITY REVIEW, IS SAFE, LAWFUL, RELIABLE OR TRUSTWORTHY.

Some jurisdictions do not allow the exclusion of certain warranties, so some of these exclusions may not apply to you. In that case, those warranties are limited to the shortest period and minimum extent permitted by law.

22. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

THE ONEVAULT PARTIES WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, DATA OR ACCESS TO CONNECTED APPS, ARISING OUT OF OR RELATING TO THE SERVICES OR THESE TERMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES;
THE ONEVAULT PARTIES WILL NOT BE LIABLE FOR ANY LOSS OR DAMAGE ARISING FROM: (A) THE ACTS, OMISSIONS, SERVICES, CONTENT OR DATA HANDLING OF ANY CONNECTED APP OR OTHER THIRD PARTY; (B) YOUR FAILURE TO KEEP YOUR CREDENTIALS, DEVICES, EMAIL ACCOUNT OR PHONE SECURE; (C) UNAUTHORIZED ACCESS THAT WAS NOT CAUSED BY OUR BREACH OF THESE TERMS; OR (D) EVENTS BEYOND OUR REASONABLE CONTROL; AND
THE TOTAL AGGREGATE LIABILITY OF THE ONEVAULT PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE SERVICES OR THESE TERMS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE OR OTHERWISE, WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID TO ONEVAULT FOR THE SERVICES IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED UNITED STATES DOLLARS (US$100).

These limitations apply even if a remedy fails of its essential purpose, and they reflect an allocation of risk between you and OneVault that is an essential basis of the bargain, particularly because the Services are provided free of charge.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for gross negligence or wilful misconduct where the law does not permit such limitation. Some jurisdictions do not allow certain limitations, so some of the above may not apply to you.

23. Indemnification

To the maximum extent permitted by applicable law, you agree to defend, indemnify and hold harmless the OneVault Parties from and against any claims, demands, actions, losses, liabilities, damages, fines, penalties, costs and expenses (including reasonable legal fees) brought by a third party or a public authority arising out of or relating to: (a) your breach of these Terms or any incorporated policy; (b) your violation of any law or the rights of any third party; (c) Content you submit or make available; (d) any use of your Account that results from your failure to keep your credentials secure; or (e) your use of any connected app. We may assume the exclusive defence of any matter subject to indemnification, in which case you agree to cooperate. This Section does not require you to indemnify us for our own negligence or misconduct and applies to consumers only to the extent permitted by the law of their country of residence.

24. Export controls and sanctions

The Services are subject to United States export control and economic sanctions laws, and may be subject to the laws of other countries. You represent and warrant that you are not (a) located in, ordinarily resident in, or organized under the laws of any country or region subject to comprehensive United States sanctions; (b) identified on, or owned or controlled by a person identified on, any sanctions or restricted-party list maintained by the United States (including the Specially Designated Nationals and Blocked Persons List administered by the Office of Foreign Assets Control), the United Nations, the European Union, the United Kingdom or any other applicable authority; or (c) otherwise prohibited from receiving the Services. You must not use the Services to evade sanctions, to benefit a sanctioned person, or in violation of any export control or sanctions law. We may block access from sanctioned locations and suspend or terminate Accounts without notice to comply with these laws.

25. Governing law and courts

Except as provided in Section 27 and to the extent not preempted by federal law, these Terms and any dispute arising out of or relating to them or the Services are governed by the laws of the United States, including the Federal Arbitration Act, and the laws of the State in which OneVault LLC is organized, without regard to conflict-of-law rules. Subject to Section 26, any dispute that is not subject to arbitration must be brought exclusively in the state or federal courts located in that State, and you and OneVault consent to the personal jurisdiction of those courts. On request through the contact form, we will tell you the State in which OneVault LLC is organized. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

26. Dispute resolution and binding arbitration for United States users

This Section applies if you reside in the United States. Please read it carefully. It affects your legal rights, including your right to go to court and to participate in a class action.

26.1 Informal resolution first. Before starting arbitration or a court case, you and OneVault agree to try to resolve any dispute informally. The party raising the dispute must send a written notice describing the dispute, the relief requested and the sender's contact details. You must send your notice through the contact form (choose "Other question" and the subject "Legal notice"); we will send ours to the email address on your Account. The parties will negotiate in good faith for 60 days after the notice is received, and, if either party asks, will hold an individual telephone or video conference. Limitation periods are suspended during this 60-day period.

26.2 Agreement to arbitrate. If the dispute is not resolved within 60 days, you and OneVault agree that any dispute, claim or controversy arising out of or relating to these Terms, the Services, or your relationship with OneVault, including disputes about the scope, validity or enforceability of this agreement to arbitrate (except as stated in 26.6 and 26.7), will be resolved by final and binding individual arbitration, and not in court.

26.3 Exceptions. Either party may (a) bring an individual claim in small claims court if it qualifies and stays there; and (b) bring an action in court to protect or enforce its intellectual property rights or to stop unauthorized access to or abuse of the Services, including seeking injunctive relief.

26.4 Rules and administrator. The arbitration will be administered by the American Arbitration Association ("AAA") under its Consumer Arbitration Rules then in effect (available at adr.org), as modified by this Section. A single arbitrator will decide the dispute. If the AAA is unavailable, the parties will agree on another administrator or a court will appoint one. The arbitration will take place in the county where you live, or by video or written submissions if you prefer. Payment of filing, administration and arbitrator fees will follow the AAA Consumer Arbitration Rules, and OneVault will pay any fees that those rules allocate to the business. The arbitrator may award the same individual relief a court could award, including attorneys' fees where the law allows, but only in favour of the individual party seeking relief and only to the extent necessary to provide relief for that party's individual claim.

26.5 Class action and jury trial waiver. YOU AND ONEVAULT EACH AGREE TO BRING CLAIMS AGAINST THE OTHER ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, PRIVATE ATTORNEY GENERAL OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate the claims of more than one person or preside over any form of representative or class proceeding, except as stated in 26.8. YOU AND ONEVAULT EACH WAIVE THE RIGHT TO A TRIAL BY JURY.

26.6 If the class waiver is unenforceable. If a court decides, after all appeals, that the class action waiver in 26.5 is unenforceable for a particular claim or request for relief, that claim or request (and only that one) will be severed and decided by a court under Section 25, and will be stayed until the individual claims are resolved in arbitration. This agreement to arbitrate does not permit class arbitration.

26.7 Public injunctive relief. To the extent a claim seeks public injunctive relief that cannot lawfully be waived or arbitrated under applicable law, that request will be decided by a court after the individual arbitration concludes.

26.8 Mass filings. If 25 or more similar demands for arbitration are filed against OneVault by or with the assistance of the same or coordinated counsel or organizations, the demands will be administered in batches of no more than 25 demands, with only one batch proceeding at a time, and with one arbitrator appointed per batch where the administrator's rules permit. Limitation periods for demands in later batches are suspended until their batch begins. A court may enforce this provision. The parties will cooperate in good faith to implement a batch process under the administrator's mass-arbitration rules and fee schedule.

26.9 Time limit. To the extent permitted by law, any claim must be brought within one year after the claim arises; otherwise it is permanently barred.

26.10 Your right to opt out. You can opt out of this agreement to arbitrate within 30 days after you first accept these Terms by sending a notice through the contact form (choose "Other question" and the subject "Arbitration opt-out"), stating your name, your OneVault username, the email address on your Account and that you opt out of arbitration. If you opt out, Section 25 applies to all disputes, and the rest of these Terms continue to apply. Opting out does not affect any other agreement to arbitrate you may have with us.

26.11 Changes to this Section. If we make a material change to this Section 26, we will give you at least 30 days' notice. You may reject the change by sending an opt-out notice as described in 26.10 within 30 days after the change takes effect, in which case the previous version of this Section will continue to apply to you. A change will not apply to a dispute of which we had written notice before the change took effect.

26.12 Survival and severability. This Section survives the closure of your Account. Except as provided in 26.6, if any part of this Section is found unenforceable, the rest of it remains in effect.

27. Users outside the United States

Mandatory rights are preserved. If you are a consumer who lives outside the United States, nothing in these Terms deprives you of the protection of mandatory provisions of the law of your country of residence that cannot be excluded by contract, and where those provisions conflict with these Terms, those provisions apply.

European Union, European Economic Area, United Kingdom and Switzerland. If you live in one of these places:

Section 26 (arbitration and class action waiver) does not apply to you;
you may bring proceedings in the courts of your country of residence, and the choice of law in Section 25 applies only to the extent it does not deprive you of the protection of the mandatory law of your country of residence;
the limitations in Sections 21 and 22 do not limit our liability for damage caused intentionally or by gross negligence, for death or personal injury, or for breach of material contractual obligations to the extent of reasonably foreseeable loss, and do not affect your statutory rights, including rights relating to digital content or digital services that are not in conformity with the contract; and
Section 23 applies only to the extent that you are legally responsible for the loss in question under your local law.

Other countries (including Sri Lanka and the United Arab Emirates). Section 26 applies to you only where binding arbitration and class-action waivers are permitted under the mandatory law of your country of residence. Where they are not, disputes will be resolved in the courts identified in Section 25 unless mandatory local law gives you the right to bring proceedings in your local courts, in which case you may do so.

28. General terms

Entire agreement. These Terms, together with the incorporated policies and any additional terms you accept for a specific feature, are the entire agreement between you and OneVault about the Services and supersede any prior agreements on that subject.

Severability. If any provision of these Terms is found to be invalid or unenforceable, it will be enforced to the maximum extent permissible and modified only as necessary to make it enforceable, and the remaining provisions remain in full force and effect.

No waiver. Our failure to enforce any right or provision is not a waiver of that right or provision.

Assignment. You may not assign or transfer these Terms or your Account without our prior written consent. We may assign or transfer these Terms, in whole or in part, to a subsidiary or affiliate or in connection with a merger, acquisition, reorganization, financing or sale of assets, provided your rights under mandatory law are not reduced.

Force majeure. We are not liable for any delay or failure to perform caused by events beyond our reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, labour disputes, failures of utilities, networks, hosting or third-party service providers, cyberattacks, or government action.

No third-party beneficiaries. These Terms do not create any third-party beneficiary rights, except that the OneVault Parties may rely on Sections 21 to 23.

Relationship. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.

Language. These Terms are written in English. If we provide a translation, the English version controls to the extent permitted by law.

Headings. Headings are for convenience only. The words "including" and "for example" mean "including without limitation".

29. Contact

OneVault LLC United States

For support, privacy requests, abuse reports and legal notices, please use our contact form. For legal notices, choose "Other question" and use the subject "Legal notice". If you need a postal address for service of formal legal process, ask through the contact form and we will provide one.