Terms of Service.

These Terms of Service (the “Terms”) are a binding agreement between you and D3 Global, Inc. (“D3,” “we,” “us”) governing your access to and use of D3 Edge: the ai.d3.com website, the robots.txt grader, the agent index and feed, the D3 Edge SDK and edge adapters, the dashboard at ai.d3.com/app, and any related APIs, documentation, and support (together, the “Services”).

By accessing the Services, creating an account, or installing an adapter, you agree to these Terms. If you are agreeing on behalf of a company or other organization, you represent that you have authority to bind that organization, and “you” means that organization.

If we have signed a separate written agreement with you covering the Services, that agreement controls where it conflicts with these Terms.

You must be at least 18 years old and legally able to enter into a contract to use the Services. The Services are built for website operators and are not directed to consumers or to children.

You may not use the Services if you are barred from doing so under applicable sanctions, export-control, or trade laws, or if we have previously terminated your access.

D3 Edge helps you see and act on the automated traffic reaching your site. We publish an index of known agents together with verified identity and declared purpose, distribute it as a signed, versioned feed, and provide an SDK and edge adapters that read that feed inside your own infrastructure to classify requests and, where you choose, to enforce a policy.

Two properties of the Services are design commitments, not marketing:

• The adapter runs in your account, deployed by you. We do not require, request, or hold credentials to your infrastructure.
• Classification and enforcement fail open. A cache miss, a stale feed, or an outage on our side passes the request through rather than blocking it.

D3 Edge is not a bot-management, DDoS-mitigation, or web-application-firewall product, and it is not a substitute for one. Where a request arrives carrying a payment signal, we treat that signal as evidence of the request’s purpose.

We may change, add, or remove features of the Services. Where a change materially reduces functionality you are paying for, we will give you reasonable notice.

Access to the dashboard uses a sign-in link sent to your email address; we do not issue passwords. You are responsible for the security of the mailbox you register and for all activity under your account.

Adapter keys authenticate your deployment to the Services. A key is shown once, at creation, and we store only a hash of it. You are responsible for storing keys securely, scoping them to the deployments that need them, and revoking any key you believe to be exposed. We are not able to recover a lost key, and we are not liable for use of a key you failed to revoke.

Organization owners and administrators control membership, invitations, and key lifecycle for their organization. If you join an organization, its administrators can see and manage that organization’s keys, analytics, and policy configuration.

You retain all rights in your websites, your content, and the traffic data your deployment generates (“Your Data”). You grant us a non-exclusive, worldwide license to host, process, and transmit Your Data solely to provide, secure, and support the Services.

Observe mode is local-first: verification happens in your edge, and what reaches us is a narrowed record of each evaluation rather than the raw request. We do not keep request bodies or query strings, and IP addresses are kept only as salted hashes, or not at all.

We use traffic signals, anonymized, to build agent risk profiles and agent analytics across the organizations we serve, so the shared index and trust profiles improve for everyone. We do not use your content or your end users’ personal data for any other purpose, and we do not sell Your Data. The Privacy Policy describes this in detail.

You are responsible for having the rights and disclosures necessary for us to process Your Data, and for configuring your own policy in a way that complies with the laws that apply to your site.

The agent index records what we can observe and verify about automated clients: identity signals, declared purpose, and behavior over time. We read public registries and directories rather than asking agent operators to trust a registry of ours, we publish the basis for each verdict, and we publish negative results — including which operators do not yet sign their requests.

Classifications are evidence-based judgments, not certifications. An agent’s presence, absence, tier, or purpose in the index is not a warranty about that agent’s behavior, and you remain responsible for the policy decisions you make on the basis of it.

If you operate an agent and believe its entry is wrong, tell us and we will review it. Feeds are signed and versioned; you can pin a version and diff any two, and we do not silently rewrite history.

We may correct, reclassify, or remove entries at any time. Nothing in these Terms entitles any agent operator to a particular classification or to inclusion in the index.

You may not, and may not permit anyone else to:

• use the Services for any unlawful purpose, or in violation of any applicable law or third-party right;
• use the Services to surveil, profile, or discriminate against individuals rather than to classify automated traffic;
• misrepresent the identity or purpose of an agent you operate, or use the Services to help any agent evade another site’s policy;
• attempt to poison, forge, replay, or otherwise corrupt the agent index, the feed, or another customer’s analytics;
• resell, sublicense, or redistribute the feed or the index except as expressly permitted in writing;
• reverse engineer or attempt to derive source code from any non-open-source component of the Services;
• circumvent rate limits, access controls, or plan entitlements, or probe the Services for vulnerabilities outside a program we have authorized in writing; or
• use the Services to build a competing agent index using our classifications as the training or seeding source.

We may suspend access immediately where we reasonably believe continued access presents a security, legal, or integrity risk to the Services or to other customers.

A free plan provides observe-mode SDK access, the agent feed, the robots.txt grader, and the agent index, subject to rate limits we apply to keep the Services available and to prevent abuse. Paid plans add full analytics and policy enforcement, and are priced by agreement rather than by a published rate.

Where you subscribe to a paid plan, fees, billing period, and term are set out in the applicable order or written agreement. Fees are exclusive of taxes, which you are responsible for other than taxes on our income. Undisputed amounts are due as stated in the order.

Free-plan access is provided as-is and may be changed, rate-limited, or discontinued. We will not degrade the free plan in a way that leaves an existing deployment failing closed — the fail-open guarantee in Section 3 applies on every plan.

We own the Services, the agent index, the feed, the dashboard, our documentation, and all related intellectual property, other than Your Data and any third-party or open-source components. Subject to these Terms, we grant you a non-exclusive, non-transferable, revocable license to use the Services for your internal business purposes during your term.

Open-source components of the SDK and adapters are licensed under their own terms, which control for those components.

“D3,” “D3 Edge,” and our logos are our marks. These Terms do not grant you the right to use them except to accurately describe your use of the Services.

If you send us feedback or suggestions, we may use them without restriction or obligation to you.

Automated-traffic classification is probabilistic and adversarial. You should understand and accept the following before relying on the Services:

• Agents can be misclassified in both directions. An unsigned agent may be indistinguishable from a human browser, and a signed agent can behave inconsistently with its declared purpose.
• Enforcement can affect traffic you value. Enforcement is additive-only and every rule starts in log-only mode, but a policy you promote is your decision and can have effects on your traffic, your revenue, and your search visibility.
• The feed can go stale. The SDK reports feed age, and your policy can fall back to observe-only past a threshold you set.
• Identity standards in this area are young and changing. Signals we rely on today may be superseded, and coverage differs sharply between agent operators.

The Services inform your decisions. They do not make you compliant with any law, standard, or contract, and they are not legal advice.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS OR IN A SIGNED AGREEMENT WITH US, THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT ANY CLASSIFICATION IS ACCURATE OR COMPLETE, OR THAT THE SERVICES WILL DETECT OR PREVENT ANY PARTICULAR AGENT, SCRAPER, OR ATTACK.

Some jurisdictions do not allow the exclusion of certain warranties; in those jurisdictions the exclusions apply to the fullest extent permitted.

TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, OR LOSS OF GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY.

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICES WILL NOT EXCEED THE GREATER OF (A) ONE HUNDRED U.S. DOLLARS ($100) OR (B) THE AMOUNTS YOU PAID US FOR THE SERVICES IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM.

These limits do not apply to either party’s liability for fraud, willful misconduct, or death or personal injury caused by negligence, or to amounts you owe us under an order.

The parties agree these limits are a reasonable allocation of risk and a basis of the bargain, including for the free plan, where no fees are paid.

You will defend, indemnify, and hold us harmless from third-party claims arising out of Your Data, your websites, your policy configuration and its effects on your traffic, or your breach of these Terms — except to the extent the claim arises from our own breach, negligence, or willful misconduct.

We will notify you of any claim, give you control of the defense (subject to our right to participate with our own counsel), and cooperate reasonably at your expense.

We may update these Terms. We will post the updated version here with a new “last updated” date, and where the change is material we will give notice through the dashboard or by email to account administrators before it takes effect.

Continued use of the Services after the effective date means you accept the updated Terms. If you do not accept them, stop using the Services and, for paid plans, contact us to discuss termination.

You may stop using the Services at any time by removing the adapter from your infrastructure and closing your account. Paid plans terminate as set out in the applicable order.

We may suspend or terminate access for material breach of these Terms, for non-payment, or where required by law, and we may terminate a free-plan account on reasonable notice.

On termination, your license to the Services ends and your deployment stops receiving feed updates; because enforcement is edge-local and fails open, a terminated deployment passes traffic rather than blocking it. Sections on Your Data ownership, intellectual property, disclaimers, liability, indemnification, and governing law survive.

You can export your analytics before termination. We delete or de-identify Your Data as described in the Privacy Policy.

These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-law principles, and excluding the U.N. Convention on Contracts for the International Sale of Goods.

The parties will try in good faith to resolve any dispute informally for 30 days after written notice. Any dispute not resolved that way will be settled by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, before a single arbitrator, seated in Wilmington, Delaware, conducted in English. Judgment on the award may be entered in any court of competent jurisdiction.

Either party may seek injunctive relief in a court of competent jurisdiction to protect its intellectual property or confidential information. Disputes are resolved individually: there are no class or representative proceedings.

These Terms, together with the Privacy Policy and any order or signed agreement, are the entire agreement between the parties on this subject and supersede prior discussions.

If a provision is held unenforceable, it is modified to the minimum extent necessary and the rest remains in force. A failure to enforce a provision is not a waiver of it.

You may not assign these Terms without our written consent; we may assign them in connection with a merger, acquisition, or sale of assets. There are no third-party beneficiaries.

Neither party is liable for delay or failure caused by events beyond its reasonable control. Notices to us go to the address in Section 18; notices to you go to your account email.

Questions about these Terms: legal@d3.com.

D3 Global, Inc. — see d3.com for our current registered address.