Terms of Service

These Terms of Service govern ZadQ, a seller-verification service for x402 endpoints of Conectia OÜ, a private limited company (osaühing) incorporated in Estonia, registry code 16847069, entered in the Estonian Commercial Register (registration department of Tartu County Court), registered address Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, VAT number EE103042910. They apply, on one side, to the vendors that register their endpoints with it and, on the other, to anyone who checks an attestation. Where these terms refer to ZadQ as a party, they mean Conectia OÜ.

They reflect the standard contractual structure we apply. The particular conditions of the operator agreement signed with each vendor prevail, in case of discrepancy, over these general terms. How personal data is processed is explained in the Privacy Policy.

1. Definitions

• ZadQ: the seller-verification service described on this website, operated by Conectia OÜ. Contact: hello@zadq.net.
• Vendor (or Registered Operator): the legal entity, or the sole trader acting for their business or profession, that registers an x402 endpoint with ZadQ and whose Responsible Person passes identity verification. The word seller names the same party in its x402 role.
• Endpoint: the exact selling surface named in an x402 challenge (the payTo address and the resource URL) to which an attestation is tied.
• MintID identity network: the identity network ZadQ is built on, where attestations are issued and their status is published under rules any party can verify on its public record.
• Issuer: the issuer on the MintID identity network that verifies vendors and signs attestations. Conectia OÜ operates it under the same published admission, deposit and status rules as any issuer of the network.
• Attestation: a digitally signed statement, carried in the vendor's 402 Payment Required responses, tying an Endpoint to an accountable operator at a stated assurance grade: an identity-verified person stands behind it and, where the operator is a company, has declared to act for it.
• Verdict: the result of checking an attestation, expressed as verified, not verified or unknown, re-checked on a published cadence.
• Checking Party (or Buyer): any person, agent or platform that reads an attestation and obtains a Verdict.
• Guarantee Deposit: the deposit the Issuer holds on the MintID identity network under its published rules, forfeitable, which stands behind every attestation it signs.
• Assurance Grade: the published level that ties the depth of identity verification to what the attestation claims and to its re-verification cadence.
• Trust perimeter: the set of vendors and agents whose accountability is verified. Reading who is inside it is free to everyone.
• Agent Operator: the accountable party behind an agent that pays. Agent attestation opens with v1; nothing in these terms offers it before.
• Customer: the Vendor or the Agent Operator holding an Account.
• Account: the Customer's place in the dashboard, opened with a passkey, holding the Customer Record and the products the Customer uses.
• Responsible Person: the natural person who answers for the Account, signs in with a passkey and approves on the Customer's behalf.
• Customer Record: the Responsible Person's name and work e-mail, and the legal name, country, registered address, registration number and tax identifiers of the organisation or the sole trader, as kept on the Account.
• Confidential Information: all technical, commercial, financial, strategic or operational information to which either party has access under the agreement.

2. Description of the Service

ZadQ verifies that an accountable operator stands behind an x402 endpoint, without revealing who. At onboarding, the Customer creates an Account, binds the wallet that controls its payTo address, has its Responsible Person's identity verified (KYC) by the identity-verification provider inside the Issuer's boundary, acknowledges these terms for the endpoint with that wallet, and receives an attestation issued on the MintID identity network. Its middleware attaches the attestation to its 402 responses; ZadQ's verifier re-checks it on the published cadence and publishes the Verdict.

The Verdict states three things and nothing more: that an accountable, identity-verified person, at or above the named Assurance Grade, stands behind the Endpoint and, for a company, has declared to act for it; that the Guarantee Deposit behind the attestation is at or above the published minimum; and that the attestation is current. It says nothing about the quality of what is sold.

ZadQ operates over the open x402 standard and is independent of it. x402 payments are processed by the parties' own x402 tooling; ZadQ adds an optional verification layer and takes no part in the payment itself. Should no Verdict be available, integrations keep working: the status reads unknown, and nothing waits on ZadQ.

3. Eligibility and segment

The Service is intended for operators with meaningful commercial activity and regulated business counterparties: API and data providers, publishers and content sites charging machine readers, payments and financial infrastructure. Marketplaces, explorers and agents read Verdicts free of charge and are not customers. Registration is open to legal entities and, where the Assurance Grade admits it, to sole traders acting for their business or profession.

The Service is offered to businesses and professionals only and is not offered to consumers. By creating an Account the Customer declares that it acts for its trade, business or profession. ZadQ relies on that declaration and on the identity verification, and refuses or closes an Account opened by a consumer.

ZadQ may decline, suspend or withdraw a registration when identity verification cannot be completed, when the information provided is inaccurate, when the Endpoint is used for unlawful purposes, or when the Vendor breaches these terms.

4. Onboarding and identification

At account creation the Customer provides its Customer Record, which appears on its invoices, and its Endpoint identifiers when it registers them, with the information the Assurance Grade requires. Identity verification is performed by the identity-verification provider inside the Issuer's boundary: ZadQ receives outcome metadata only (an opaque session handle, the grade, the validity window) and never the documents or results themselves.

The Customer warrants that all information provided is accurate and complete, that it controls the Endpoint it registers, and that it will keep the Customer Record current and notify ZadQ without delay of any change in its corporate identity, representatives or Endpoint. Where the Customer is a company, the company's details in the Customer Record and the Responsible Person's role as the one who acts for it are the Customer's own declaration, on which ZadQ relies. In this phase, neither ZadQ nor the Issuer verifies the company, its representatives or its beneficial owners, and an attestation does not state that the company was verified. Business verification (KYB) is not available yet.

Access to the dashboard is authenticated by the Responsible Person's passkey; writes that touch a payTo address are also signed with the wallet that controls it. Access to the service's programmatic interfaces uses an API key or a short-lived session credential. The Customer keeps such credentials confidential and is responsible for their use, and for who it allows to act as its Responsible Person.

The Customer accepts these terms electronically when it creates its Account, by ticking the acceptance and creating its passkey; ZadQ records the version accepted, its fingerprint, the time and the Responsible Person, and keeps the accepted version available on the Account, where the Customer can download it at any time. As a business, the Customer agrees that this record serves as the confirmation of its acceptance and as evidence of the agreement. A new version is accepted in the dashboard in the same way (clause 20). These terms are concluded in English.

5. Fees and billing

Two tiers are offered to Vendors: Attested Vendor and Regulated / Compliance. Each carries an entry fee and an annual minimum, and a usage fee per settlement received at an attested Endpoint while its Verdict read verified, credited against the annual minimum and billed only above it. Amounts are set in the operator agreement. Prices exclude VAT.

Invoices are issued by Conectia OÜ to the Customer Record. Card payments run on the hosted page of the billing provider, Stripe, where card details are entered and never reach ZadQ. An invoice to a Customer established in another member state of the European Union whose VAT number is confirmed through VIES is issued without VAT under the reverse-charge mechanism, and states it; an invoice to a Customer established in Estonia carries Estonian VAT at the rate in force; an invoice to a Customer established outside the European Union is issued without EU VAT. For the first contracts, invoices may also be settled by bank transfer as agreed in writing. Fees are payable in advance for the period they cover.

Checking an attestation and obtaining a Verdict is free of charge for the Checking Party, always. No fee is charged to buyers, agents or platforms for verification, and the Verdict is never sold.

Late payment accrues the interest and the fixed compensation for recovery costs that the law sets for commercial transactions, and may lead to suspension of renewal; a suspended attestation reads not verified once past its renewal deadline. Fees already paid are not refunded on termination, save as provided in the operator agreement.

6. The Guarantee Deposit

Every attestation is backed by the Guarantee Deposit the Issuer holds on the MintID identity network under the network's published rules. While that deposit is below the published minimum, the positive Verdict is withheld and the status reads not verified or unknown; the Verdict says why.

Vendors place no deposit. ZadQ holds no funds of Vendors or of Checking Parties; the Guarantee Deposit is the Issuer's own.

7. Claims and recourse

The link between an attested party and the accountable operator behind it is sealed with the Issuer and readable by nobody at ZadQ. Release exists only through the dispute process of the MintID identity network, which is specified and not yet activated; until it is, every request for release is refused and recorded.

ZadQ operates no claims procedure of its own and pays no compensation out of the Guarantee Deposit or otherwise. Until the network's dispute process is activated, a Checking Party's remedies are those the law gives it against the Vendor it transacted with. Before that process applies to Vendors, ZadQ publishes how it works and gives them the notice set out in clause 20.

A dispute escalation is the only stage at which identity information about the parties may be shared, and only to the extent needed to resolve the claim. Any decision taken in that process is a contractual mechanism, not a judicial one, and leaves the parties' legal actions intact.

8. Attestation lifecycle, renewal and revocation

Attestations are re-verified on the cadence published for their Assurance Grade. A Vendor re-verifies its identity before the verification's reuse window ends; there is no grace period and nothing is extended. A re-verification completed in time keeps the attestation's reference; an overdue one suspends the attestation until the re-verification is bound.

An attestation is invalid, and the Verdict drops accordingly, when the Issuer no longer holds a current registration on the network, when the attestation is past its renewal deadline, or when the Guarantee Deposit behind it is below the published minimum.

ZadQ may revoke an attestation when it has reasonable grounds to believe that the Endpoint is used for unlawful purposes, that the Vendor no longer controls it, that identity verification was obtained by fraud, or that these terms are materially breached. A Vendor that withdraws its consent to the service has every attestation it holds revoked; the withdrawal is final.

9. Obligations of the Vendor

• Keep the Endpoint under its control and deliver what it sells through it.
• Attach the attestation only to Endpoints it has registered, and not alter, transfer or lend it.
• Describe its verified status accurately, using the wording provided by ZadQ, and not imply that ZadQ endorses the quality of its goods or services.
• Re-verify its identity before the reuse window ends, and keep its dashboard state current.
• When it holds its own credential in its infrastructure, protect the key it lives next to and revoke the credential itself if that key is compromised.
• Comply with the laws applicable to its activity, including consumer, data-protection, tax and anti-money-laundering rules.
• Cooperate in good faith in any dispute escalation.

10. Checking Parties

Anyone may check an attestation free of charge. The Verdict is information for the Checking Party's own decision. Whether to transact with an Endpoint, whatever its Verdict, remains the Checking Party's decision and responsibility.

Integrations keep working when no Verdict is available: the status reads unknown, and the Checking Party applies its own policy. To the extent the law allows, ZadQ is not liable for decisions taken on the basis of an unknown status, nor for losses arising from a transaction with an Endpoint, whatever its Verdict.

A Checking Party that relied on a verified status and suffered a loss has the recourse described in clause 7; that recourse does not create a contractual relationship with ZadQ.

11. Service levels

ZadQ operates the attestation, re-verification, key-publication and dashboard services with the levels of availability and support agreed in the operator agreement. The re-verification cadence is a published promise; a missed cycle is treated as an incident. Attestations are designed to be checkable against published keys so that a Checking Party never depends on the service being reachable at decision time.

Planned maintenance is announced in advance on the dashboard. ZadQ may modify technical interfaces, giving reasonable notice and keeping published headers, SDKs and response formats stable wherever possible.

12. Intellectual property

ZadQ, its software, documentation, marks, badges and the design of this website belong to Conectia OÜ and are protected by intellectual and industrial property rights. Vendors receive a non-exclusive, non-transferable licence to use the wording and marks provided to describe their verified status, for the term of the agreement.

Integration code published by ZadQ under the Apache-2.0 licence is governed by that licence. Nothing in these terms limits the rights granted by it.

The Vendor keeps all rights over its own Endpoint, goods, data and services. Feedback and suggestions may be used by ZadQ to improve the Service without obligation.

13. Confidentiality

Each party keeps the other party's Confidential Information in strict confidence and does not disclose it to third parties without prior written consent, save to the identity-verification provider, the billing provider and professional advisers bound by equivalent obligations, and where the law requires it.

The confidentiality obligation subsists during the agreement and for three years after its termination. It does not cover information that is in the public domain through no fault of the recipient, was independently developed, or was lawfully received from a third party.

14. Personal data

ZadQ keeps the Customer Record and attestation metadata. The Customer Record, the wallet addresses a Customer proves control of, its sessions and its acceptance of these terms are processed by Conectia OÜ as controller, under the Privacy Policy.

Identity verification of a Vendor's Responsible Person is performed by the identity-verification provider inside the Issuer's boundary, as the Issuer's processor; Conectia OÜ, as operator of the Issuer, is the controller of those data, which are kept separate from ZadQ and never enter its systems. The company details a Responsible Person declares for a Vendor are part of the Customer Record.

Where ZadQ processes personal data on behalf of a Customer, the parties enter into a data-processing agreement in accordance with Regulation (EU) 2016/679. The billing provider, Stripe Payments Europe, Limited, processes the part of the Customer Record an invoice needs as Conectia OÜ's processor, and acts as an independent controller for the payments made on its hosted page.

Between the parties to an attested payment, no personal data changes hands unless a dispute is escalated.

15. Limitation of liability

The total aggregate liability of ZadQ towards a Vendor arising from or related to the agreement is limited to the fees actually paid by that Vendor during the twelve months preceding the event giving rise to the claim.

In no event shall either party be liable for indirect damages, lost profits, loss of business opportunities, reputational damages or other consequential damages.

None of the limitations in this clause applies in cases of wilful misconduct or gross negligence, to death or personal injury, or where the law does not allow such limitation.

ZadQ does not warrant the goods, data or services sold through any Endpoint, nor the conduct of any Vendor beyond what the Verdict states.

16. Term and termination

The operator agreement is entered into for an indefinite term unless a minimum period is agreed. Either party may terminate it with at least 30 calendar days' written notice effective at the end of a calendar month. Attestations issued remain valid until their next renewal deadline unless revoked earlier.

Either party may terminate for material breach not cured within 15 calendar days of written notice. ZadQ may terminate immediately in the cases listed in clause 8 for revocation.

On termination, ZadQ revokes the Vendor's attestations and disables its credentials. Attestation metadata is retained for the periods set out in the Privacy Policy. No deposit is held for the Vendor, so none is released.

17. Force majeure

Neither party is liable for breaches arising from events beyond its reasonable control, including natural disasters, armed conflicts, acts of terrorism, governmental restrictions, or generalised failure of telecommunications networks, for as long as the event lasts.

18. The network and subcontracting

Conectia OÜ operates the Issuer on the MintID identity network as the network's first implementer, under the same published admission, deposit and status rules as any issuer, verifiable by anyone on the network's public record; that relationship is disclosed wherever it is relevant. Identity verification is entrusted to an identity-verification provider inside the Issuer's boundary, and invoicing to a billing provider, under written agreements that bind them to obligations consistent with these terms. ZadQ remains responsible towards the Vendor for the Service.

19. Governing law and jurisdiction

These terms and the operator agreements are governed by the laws of the Republic of Estonia. Any dispute arising from or related to them is submitted to the exclusive jurisdiction of Harju County Court (Harju Maakohus) in Tallinn, Estonia.

20. Modification of the terms

ZadQ may modify these terms, informing Vendors with at least 30 calendar days' notice by e-mail to the Responsible Person and on the dashboard, and publishing the new version on this website. A Vendor who does not accept the new terms may terminate without penalty within the notice period. Modifications required by law apply from their entry into force.

21. Contact

For any matter related to these terms, write to hello@zadq.net.