1.1 Personal-account licence. Subject to compliance with the Terms, Ambry grants an individual User who has reached the age of majority where the User resides a limited, revocable, non-exclusive, non-transferable and non-sublicensable licence to use only the personal registration, authentication, account-security and setup functions actually enabled for that User. A personal User account may be created without owning, registering or joining an Organization. It is an authentication and setup credential only and does not establish business status, operating authority or authority to represent any Organization.
1.2 No marketplace access without an Organization. Until the User creates an eligible Organization or is duly admitted to an existing eligible Organization, and the applicable Organization acceptance, eligibility and authorization requirements are satisfied, the User has no licence or permission to access marketplace or Organization-level business functionality. Restricted functionality includes Service listings, Requests, bookings, Orders, Provider offers, counterparty messaging, Organization dashboards and records, commercial payments, transfers, payouts and related business features. Only the minimum functions necessary to sign in, verify or secure the personal account, manage personal settings, register an Organization or accept an Organization invitation may be enabled. A direct link, technical ability to request an endpoint or appearance of a feature does not confer authorization.
1.3 Organization-level licence. Once an eligible Organization has validly accepted the Organization Terms through a duly authorized representative, Ambry permits that Organization and its duly authorized Users to use only the business features, documentation and interfaces enabled for the Organization, solely for lawful Organization business purposes and within the User’s assigned permissions. Access remains conditional on applicable verification, eligibility, geographic and operational restrictions, processor capabilities, accepted Order Terms and law. Merely joining an Organization does not grant unrestricted access. A User may not bind an Organization, publish Services, submit or act on Requests, or confirm or accept Orders without sufficient Organization authority. A Request, Service publication, search result or payment authorization is not an Order; Order formation is governed by Platform Terms Sections 3.3 and 7.1.
1.4 Nature and scope. Access is licensed, not sold. This EULA does not transfer ownership of the Platform or grant any right to source code, protected algorithms, non-public databases, other Organizations’ information or features beyond those expressly authorized. The Platform is for B2B logistics activity through Organizations, not personal, family or household logistics transactions. Nothing in this licence represents that a particular feature, route, API, mobile client or integration is available.

2.1 If Ambry expressly enables API or integration access, an eligible Organization and its authorized Users must comply with the applicable documentation, issued permissions, authentication requirements, rate limits and security measures. API keys and tokens must be protected and may not be shared with unauthorized persons or used to circumvent Organization permissions or Platform access controls. No API licence exists merely because an individual has registered a personal account.
2.2 Each Organization is responsible for the permissions and use of API credentials it authorizes, subject to Ambry’s own actionable breach and non-excludable obligations. Ambry may reasonably restrict, rotate, suspend or revoke API credentials or access for security, legal, compliance or operational reasons, consistently with Platform Terms Sections 5.3, 17 and 20. API access does not authorize scraping, bulk extraction of counterparty data, unauthorized data sharing or access outside the relevant Organization’s granted scope. Lawful access to and export of an Organization’s own data remains subject to its rights, applicable Terms and law.

Except as expressly authorized by the Terms or permitted by non-waivable law, no User or Organization may: (a) copy, modify, reproduce, distribute or create derivative works of protected Platform software, designs or documentation; (b) reverse engineer, decompile, disassemble or attempt to obtain non-public source code, protected matching implementations, algorithms, data structures or security methods, without restricting mandatory interoperability or independent-development rights; (c) sell, resell, rent, sublicense, transfer or provide unauthorized third-party access to the Platform; (d) scrape, harvest, systematically extract or bulk-export non-public Platform data, another Organization’s rates, shipment details, contact lists or records; (e) bypass or interfere with authentication, Organization authorization, permissions, rate limits, security safeguards or usage restrictions; (f) conduct security testing other than good-faith research permitted by Section 4; (g) share passwords, access tokens, recovery credentials or API keys with another person, including another employee of the same Organization; (h) misuse protected Platform materials or Ambry Confidential Information to copy protected implementations or train, validate or benchmark an unauthorized product; (i) remove proprietary notices or misrepresent an affiliation with Ambry; (j) use an integration or another User’s account to obtain information or exercise privileges not granted to the acting User; or (k) unlawfully collect, disclose, market, sell or otherwise misuse personal information, non-public commercial data or another Organization’s content.

These restrictions must be read together with Platform Terms Sections 6.3–6.4 and 10–12. They do not prohibit lawful competition, independent development, use of lawfully obtained public information, or lawful future off-Platform relationships permitted by Platform Terms Section 6.3(e). They do not create ownership over general ideas or unprotectable functionality, prohibit conduct that mandatory law protects, or impose an automatic penalty.

Ambry will not pursue contractual claims under this EULA solely for good-faith security research that satisfies all of the following conditions: (a) the researcher promptly and privately reports the issue to security@ambry.io with sufficient reproducible detail; (b) the researcher accesses, copies, modifies or retains another person’s or Organization’s data only to the minimum extent necessary to demonstrate the issue and promptly and securely deletes any such data; (c) the research does not involve denial-of-service, material disruption, destructive testing, spam, phishing, social engineering, persistence in accounts, or intentional exposure of personal or confidential information; and (d) the researcher gives Ambry a reasonable opportunity, ordinarily at least ninety (90) days after a sufficiently detailed report, to investigate and remediate before public disclosure, unless a different timetable is required by law or agreed in writing. Ambry may request reasonable coordination on disclosure.

This limited contractual safe harbour does not authorize unlawful conduct, infringement of third-party rights, access beyond what is necessary for good-faith research, or conduct by a researcher acting outside the stated conditions. It does not bind third parties or waive mandatory legal rights. Reports may also be made through support@ambry.io if the security mailbox is unavailable.

Certain enabled Platform features may depend on third-party providers, including Google or other enabled authentication services, hosting, mapping, verification services and the Payment Processor. Their applicable terms and privacy notices may govern the relevant functionality. Stripe Connect Express onboarding, identity checks, banking information and connected-account bank payout settings are handled under Stripe’s agreements; Ambry’s separate payment-administration role is governed by Platform Terms Section 8. Use of a third-party sign-in method does not grant marketplace access or dispense with the User’s affirmative acceptance of the Terms. Ambry does not warrant uninterrupted operation of independent third-party services, without excluding its own enforceable obligations or mandatory rights.

If any Platform component includes open-source software, that component remains subject to its applicable open-source licence to the extent legally required. Nothing in this EULA restricts rights that a mandatory open-source licence grants in that component.

6.1 Ambry and its licensors retain all applicable rights in the Platform and protectable software, source code, original interface designs, documentation, trademarks, proprietary implementations, algorithms and confidential know-how, as described in Platform Terms Section 10.1. The limited licences in Section 1 confer no ownership interest. Ambry does not claim exclusive ownership of abstract ideas, general service concepts, public information or independently developed work.
6.2 Each Organization retains ownership of the content it lawfully submits, including Services, rates, shipment documents and messages, subject to the limited operational licence in Platform Terms Section 10.2. Neither an individual User’s personal account nor access under this EULA transfers that Organization’s content to the User or to Ambry. Users may access and use Organization information only while duly authorized and only for permitted purposes, subject to Platform Terms Sections 11–12 and applicable law.
6.3 Voluntary feedback and aggregated or appropriately de-identified logistics analytics are governed by Platform Terms Sections 10.3–10.4. Any permitted analytics use remains subject to confidentiality, privacy and competition laws, the Privacy and Cookie Policy and any applicable executed Data Processing Agreement. This EULA does not authorize disclosure of identifiable personal information, another Organization’s non-public rates or Order details, or Confidential Information contrary to those provisions.

7.1 Each Organization, acting through authorized administrators, is responsible for inviting, supervising, assigning permissions to and promptly removing its Users or revoking their Organization-level access when their employment, engagement, role or authority ends or changes. The User must stop acting for that Organization when authorization ends. To the extent permitted by law, the Organization bears the consequences of its own failure or delay to revoke access. Ambry has no independent duty to monitor an Organization’s personnel relationships, but remains responsible for its own applicable security or access-control obligations, including implementing revocations properly communicated or executed through available controls, and for liability that cannot lawfully be excluded. Platform Terms Sections 3.4–3.5 and User Account Terms Sections 2.3–2.4 and 7 apply.
7.2 Upon effective removal from an Organization, the User’s licence to access that Organization’s business functions, communications, data and records ends. If the User has no other eligible Organization association, all marketplace and business-feature access ends and only the limited personal authentication, security and Organization setup functions described in Section 1.2 may remain. Removal from an Organization does not, by itself, delete the personal User account or terminate access separately authorized by another eligible Organization.
7.3 The individual personal-account licence ends upon termination of the personal User account. Ambry may proportionately restrict, suspend or terminate an account or affected capabilities under Platform Terms Sections 5.3 and 17 and mandatory law, with notice, review and safeguards where applicable. Suspension or termination does not by itself cancel an Order, determine cargo liability, create an undisclosed fee, forfeit funds or erase accrued obligations; open Orders and payments remain governed by the applicable Order Terms and Platform Terms Sections 7–9 and 17.3. Sections 3, 4 (as to prior research and disclosure), 6 and 8 of this EULA survive to the extent relevant and lawful, together with any incorporated surviving Platform Terms.

Under Platform Terms Sections 2.2–2.3, Sections 8–9 (where relevant), 13–17, 19 and 20–24 of the Platform Terms apply to this EULA only to the extent relevant and permitted by applicable law. Organization-specific Service, cargo, insurance, payment, indemnification and release obligations do not become personal obligations of an individual solely because the individual creates a personal User account or accepts this EULA. The insurance requirements in Platform Terms Section 24 concern applicable Provider Organizations, not an unassociated individual User. The single aggregate liability cap in Platform Terms Section 16 is not multiplied by this EULA, and all mandatory exceptions remain effective.

The Platform Terms govern actual conflicts under their Section 2.2. Organization-level contractual commitments require duly authorized Organization acceptance; a personal account does not bind an Organization. Applicable Order Terms govern confirmed Orders, and the Beta Agreement applies only within its specified invitation-only scope. Privacy and Cookie Policy is a notice, not a contractual waiver. Platform Terms Sections 19–22 apply to dispute resolution, amendments, notices and language only to the extent their wording applies to the relevant User or Organization and mandatory law permits. Where affirmative acceptance of amended Terms is required by law, continued use alone is insufficient. This EULA grants no consumer logistics service or marketplace access without an eligible Organization.