Commercial Terms, Refund Policy, Privacy & Zero-Code-Retention DPA

1.1 Scope of Service & License Grant. QShield (“Provider”) grants Customer a non-exclusive, worldwide, revocable commercial license during the Subscription Term to use the QShield Post-Quantum Cryptography Readiness Platform, including the compiled pqc-scan CLI binary, GitHub Actions CI/CD workflows, RFC 8446 TLS 1.3 handshake prober, and Executive Control Plane according to the selected plan tier:

• Growth Tier ($199/mo monthly or $159/mo billed annually at $1,908/yr): Up to 10 repositories, full 6-language AST + constant propagation scanner, and CycloneDX v1.6 CBOM export.
• Business Tier ($499/mo monthly or $399/mo billed annually at $4,788/yr): Up to 50 repositories, daemonless OCI Docker container & ELF/Mach-O binary inspector, live TLS 1.3 ML-KEM-768 endpoint probing, and automated Tier-1/Tier-2 Pull Request remediation.
• Enterprise Tier ($999/mo monthly or $799/mo billed annually at $9,588/yr): Unlimited repositories, air-gapped self-hosted CLI binary license, custom NIST IR 8547 / CNSA 2.0 policy gates, and 99.9% uptime SLA.

1.2 Authorized Security Testing & Acceptable Use. Customer represents and warrants that it has lawful authorization to scan the source code repositories, container images, and public TLS 1.3 domains submitted to QShield. QShield’s live TLS 1.3 prober performs a single non-intrusive, standards-compliant RFC 8446 ClientHello handshake on port 443 advertising IANA group 0x11EC (X25519MLKEM768) and immediately closes the socket without transmitting application payload data.

1.3 Intellectual Property & Audit Artifact Ownership. Customer retains all right, title, and interest in and to its proprietary source code, binaries, and infrastructure. Customer owns 100% of all CycloneDX v1.6 CBOM reports, SARIF 2.1.0 outputs, Executive Risk Dossiers, and codemod patches produced by QShield for Customer’s organization, which may be freely shared with Customer’s auditors, regulators, and enterprise buyers even after subscription termination.

1.4 Warranty Disclaimer & Limitation of Liability. QShield provides deterministic cryptographic discovery aligned with NIST FIPS 203, FIPS 204, FIPS 205, and NIST IR 8547 standards. Tier-1 and Tier-2 automated codemod patches are provided as pull-request recommendations subject to Customer’s CI/CD test suite and engineering review. To the maximum extent permitted by law, Provider’s aggregate liability under this Agreement shall not exceed the total subscription fees paid by Customer in the twelve (12) months preceding the claim.

2.1 14-Day Free Trial Policy. All new self-serve organizations receive a fourteen (14) calendar day evaluation period. No subscription fees are charged during the 14-day trial window. If Customer cancels at any time prior to 11:59 PM UTC on Day 14 using the Self-Serve Portal below, Customer will be charged $0.00.

2.2 Frictionless 1-Click Self-Serve Cancellation. Subscriptions may be canceled at any time, 24/7, without speaking to a sales representative:

• Option A (Instant Web Portal): Submit your Work Email or Organization ID (org_...) in the Self-Serve Cancellation & Refund Portal immediately below.
• Option B (Stripe Customer Portal): Click “Manage Billing / Cancel Subscription” in any Stripe invoice receipt email.
• Option C (Direct Email): Email billing@qshield-security.com with your domain or email address.

Upon cancellation, recurring billing stops immediately and your workspace remains accessible through the end of the current paid billing period.

2.3 14-Day Money-Back Satisfaction Guarantee & Refund Policy. We stand behind the accuracy of our Rust cryptographic scanner and CycloneDX v1.6 CBOM reports:

• Initial Subscription Charge (Monthly or Annual): If you are unsatisfied with QShield for any reason—or if you forgot to cancel before your 14-day trial converted—you may request a 100% full refund within fourteen (14) calendar days of your initial payment.
• Renewal & Billing Errors: Any accidental duplicate charge or billing error is refunded 100% immediately upon notification. Annual plan holders who cancel within 14 days of an annual renewal date are also eligible for a full refund of the renewal charge.
• Refund Processing Timeline: Approved refunds are issued back to the original payment method via Stripe within 1 business day (typically appearing on corporate credit card statements within 3–5 business days).

3.1 Zero-Source-Code-Retention Guarantee (Technical Architecture). Unlike cloud SAST tools that clone and store your entire private Git repositories on multi-tenant servers, QShield’s pqc-scan CLI and GitHub Action execute AST parsing (pqc-ast) and container binary inspection (pqc-binary) locally on your machine or ephemerally inside your own GitHub Actions runner. QShield never transmits, logs, or stores your proprietary source code, private cryptographic keys, `.env` secrets, or internal application payloads.

3.2 Data We Collect. We collect only the minimum B2B account and telemetry data required to operate the service:

• Account & Billing Metadata: Full name, work email address, company name, primary domain, and subscription tier (payment card details are processed and tokenized directly by Stripe, Inc. under PCI-DSS Level 1 and never touch QShield servers).
• Public TLS 1.3 Handshake Telemetry: When a public domain is tested on the landing page or via `/report/[domain]`, QShield records the publicly negotiated TLS 1.3 KeyShare group (e.g., 0x11EC vs. 0x001D) and public X.509 leaf/intermediate signature algorithms.
• CBOM Finding Summaries (Optional): Rule IDs, ASN.1 OIDs, file paths, and line numbers included in exported CycloneDX v1.6 CBOM reports.

3.3 GDPR, CCPA & Enterprise Data Processing Addendum (DPA). Customer acts as the Data Controller and QShield acts as the Data Processor with respect to business contact information. Upon written request or self-serve cancellation, QShield permanently purges Customer’s organization record and API keys within 72 hours. Subprocessors are limited to Stripe (PCI-DSS Level 1 payment processing), Resend (transactional email delivery), and SOC 2 Type II certified cloud infrastructure.