Terms of Service

Last updated October 18, 2026

1. Agreeing to these Terms

These Terms of Service ("Terms") are an agreement between Forth Holdings LLC, doing business as OrderCard ("OrderCard", "we", "us" or "our"), and the business that uses OrderCard ("you" or "your"). They cover the OrderCard website, dashboard, API, payment form, SDKs, documentation and support (together, the "Services").

You agree to these Terms when you create an account, accept an invitation to a Workspace, or use the Services. If you agree on behalf of a business, you confirm that you have authority to bind it, and "you" means that business. The Services are for business use only, not for personal, family or household use.

Our Privacy Policy explains how we handle personal information and is part of these Terms. If you have signed a separate written agreement with us for the Services, that agreement controls wherever it conflicts with these Terms.

2. Definitions

• "Workspace" means the team account your business uses in OrderCard. Each Workspace has an Owner and may have Admins, Developers and Members.
• "Users" means the people you invite to your Workspace, and anyone who uses your API keys.
• "Cardholders" means your customers whose payment cards you store or charge through the Services.
• "Cardholder Data" means card numbers, expiry dates and cardholder names that you or your Cardholders submit to the Services, together with the billing addresses, email addresses and phone numbers stored with them.
• "Customer Data" means all data that you, your Users or your Cardholders submit to the Services, including Cardholder Data, customer records, transaction records and metadata.
• "Gateway" means a payment gateway or processor account that you hold and connect to OrderCard.
• "Card Network Rules" means the rules of Visa, Mastercard, American Express, Discover and any other card network whose cards you accept.
• "PCI DSS" means the Payment Card Industry Data Security Standard, as updated from time to time.
• "Sandbox" and "live mode" mean the test and production environments of the Services. Each has its own API keys, Gateways, cards, transactions and webhooks, and they never share them.

3. What OrderCard does and doesn't do

OrderCard is a card vault. We store the payment cards you collect, give you tokens to use in their place, and send the charges, refunds and other requests you make to the Gateways you connect. Because your cards are stored with us rather than with a Gateway, you can charge them through any Gateway you connect.

OrderCard is not a bank, payment processor, acquirer, payment facilitator or money transmitter. We never receive, hold or move your funds. Your Gateways and their banks authorize, process and settle your payments under your own agreements with them, and we are not a party to those agreements. We are not responsible for what a Gateway or bank does, including declines, holds, reserves, fees, chargebacks, settlement timing, fraud screening or outages.

We decide which Gateways the Services support, and we may add or remove them. If we plan to stop supporting a Gateway you use in live mode, we will give you reasonable notice whenever we can.

4. Beta access

OrderCard is currently in beta. Accounts are by invitation only, and features may change, be limited or be withdrawn while we develop them. During the beta we may let your Workspace use live mode without a subscription. If we do, we will give you reasonable notice before that ends.

5. Accounts and security

• Give us accurate information and keep it up to date.
• Each account is for one person. Do not share sign-in details.
• Every account must use a second factor, such as an authenticator app, a passkey or email sign-in codes. We may require stronger factors for some accounts.
• You are responsible for everything done through your Workspace, whether by your Users or with your API keys. Give each User only the role they need.
• Keep secret API keys on your servers. Never put them in browsers, mobile apps or code repositories. Use publishable keys only on the website addresses you allow for them.
• If you suspect that an account or key has been compromised, revoke or rotate the key and tell us immediately at support@ordercard.io.

To protect the Services, we lock accounts after repeated failed sign-ins, lock sessions that have been idle, and turn off accounts that have not been used for 90 days. Contact us to restore access.

6. Sandbox and live mode

Sandbox is free and is for testing only. Use only test card numbers in Sandbox, and never enter real Cardholder Data there. Live mode requires an active subscription (Section 7) unless we have agreed otherwise.

7. Fees and payment

Subscriptions. Plans and prices are shown on the billing page of your dashboard or in a quote from us. Subscriptions are billed monthly in advance through our payment provider, Stripe, and renew automatically each month until cancelled. You authorize us to charge your payment method on file for each renewal.

Taxes. Fees do not include taxes. You are responsible for any sales, use, value-added or similar taxes on your subscription, other than taxes on our income.

Price changes. We will give you at least 30 days' notice before a price increase applies to your subscription.

Cancellation. You can cancel at any time from the billing page. Cancellation takes effect at the end of the current billing period, and live mode keeps working until then. Fees you have already paid are not refundable, except where the law requires or these Terms say otherwise.

Failed payments. If a payment fails, live mode stops until the subscription is paid. While it is stopped, live API keys cannot be used for any request, including refunds or voids of earlier charges, and the live payment form will not load. You can still issue refunds directly through your Gateway. Sandbox keeps working, and we do not delete your data because a payment failed.

8. Your responsibilities

8.1 Laws and network rules

You will comply with all laws that apply to your business and your payments, with the Card Network Rules, and with your agreements with your Gateways and banks.

8.2 PCI DSS

You remain responsible for the PCI DSS compliance of your own business and systems. The OrderCard payment form collects card details in a frame served by OrderCard, so card numbers do not pass through your servers. This reduces your PCI DSS scope but does not remove it; for example, you must still protect the pages that host the form. If you send card numbers to our API from your own servers, those servers store, process or transmit cardholder data and are fully in PCI DSS scope. Do this only if you are PCI DSS compliant.

8.3 Cardholder notices and consent

You are responsible for telling your Cardholders how you use their information, including that you use service providers such as OrderCard, and for having a lawful basis to collect it and share it with us. Before you store a card for later use, or charge a stored card in a payment the Cardholder did not start (such as a recurring or unscheduled payment), you must get the Cardholder's agreement, give the disclosures that the Card Network Rules and the law require, and honor cancellations.

8.4 Your instructions

Every request sent through the Services from your dashboard, your servers or your website is your instruction to us. You are responsible for the amount, currency and Cardholder of every charge and refund, and for resolving disputes with your Cardholders.

8.5 Surcharging

The surcharging feature applies some common limits: it surcharges credit cards only, caps the rate, and skips U.S. states that prohibit surcharges. These limits are not legal advice and may not cover every rule that applies to you, and some Gateways calculate the surcharge themselves. You alone are responsible for deciding whether to surcharge and for meeting every requirement that applies, including registering with card networks or your bank, disclosing the surcharge to Cardholders, and following state law.

8.6 3-D Secure

OrderCard does not authenticate Cardholders. If you use 3-D Secure, your own provider authenticates the Cardholder, and we pass its result on to Gateways that accept it. The card networks and your bank decide whether a result shifts fraud liability.

8.7 Systems that receive data

You are responsible for securing the systems that receive data from the Services, including your servers and webhook endpoints. Webhook events can contain Cardholder names, contact details, billing addresses and partial card details, though never full card numbers or security codes. Your endpoints should use HTTPS and verify our signatures.

8.8 Card numbers in the wrong places

Never put card numbers or security codes in metadata, support messages, attachments, screenshots or questions to the AI assistant. We block card numbers we can detect in text, but we cannot catch everything.

9. Acceptable use

You will not, and will not let anyone else:

• use the Services for anything illegal, or to sell goods or services that the Card Network Rules or your Gateway prohibit;
• submit card data that you are not authorized to collect, or that was obtained by fraud;
• use the Services for fraud, or to test, validate or guess card numbers;
• access accounts or data that are not yours, or try to get around security features, rate limits, website address restrictions on keys, or the separation between Sandbox and live mode;
• probe, scan or test the Services for vulnerabilities, except as allowed in Section 26;
• interfere with or overload the Services, or introduce malware;
• reverse engineer the Services, except where the law allows it despite this restriction;
• resell the Services, or provide them to others as a service bureau, without a written agreement with us; or
• use the Services or our non-public information to build a competing product.

10. How we protect Cardholder Data

We maintain administrative, technical and physical safeguards designed to protect Customer Data and to meet the PCI DSS requirements that apply to OrderCard as a service provider that stores cardholder data. Among other things:

• Card numbers are encrypted with AES-256, using keys held in a dedicated key management service, separately from the database.
• Card security codes are never written to a database or a log. A security code is held, encrypted, for at most 15 minutes so that it can be sent with the payment it was collected for, and it is deleted once used. 3-D Secure authentication values are never stored.
• The systems that hold card data are separated from our website and dashboard, and every decryption of a card number is logged.
• Full card numbers are never shown in the dashboard or returned by the API.
• Only authorized OrderCard staff can access Workspaces. When staff act inside your Workspace, they must give a reason, their access ends automatically, and every action appears in your activity log.

PCI DSS responsibility. OrderCard acknowledges that it is responsible for the security of the Cardholder Data it stores, processes or transmits on your behalf, to the extent that it could affect the security of your cardholder data environment. On request, we will tell you which PCI DSS requirements OrderCard manages and which remain yours, and share information about our PCI DSS compliance status.

Security incidents. If we confirm that your Cardholder Data has been accessed without authorization while in our systems, we will notify you without undue delay and tell you what we know. We will also take reasonable steps to contain the incident, and cooperate with you, the card networks and any forensic investigation they require.

11. Your data

Ownership. As between you and us, you own Customer Data. You give us a limited right to host, copy, transmit and process Customer Data only as needed to provide, secure and support the Services, to prevent fraud and abuse of the Services, and to comply with the law and the Card Network Rules.

Our role. We process Customer Data on your behalf and on your instructions, as your service provider. We do not sell Customer Data, use it for advertising, or use it to train AI models. We remain responsible for the service providers we use to process Customer Data, which are listed in our Privacy Policy.

Service data. We collect information about how the Services are used, such as request counts, errors and response times, to run, secure and improve the Services. We may use and share aggregated information that does not identify you, your Users or your Cardholders.

How long cards are kept. A card collected through the payment form stays pending until you save it (by default, its first successful charge saves it), and pending cards are redacted automatically after 24 hours. Saved cards stay in the vault until you redact them or delete their customer, or until your account ends (Section 17). Redacting a card permanently destroys its card number and cardholder details. A record of its token, brand, first six and last four digits and expiry date remains for your records. Transaction records keep the billing details sent with each transaction.

12. Moving your cards to another provider

Your cards are not locked in. Within OrderCard, a token can be charged through any Gateway you connect. To move your stored cards out of OrderCard:

• An Owner of your Workspace may ask us in writing to transfer your Cardholder Data to another payment processor, gateway or card vault (the "recipient"). You can ask at any time while your subscription is active, and for 30 days after your account ends.
• The recipient must show that it is PCI DSS compliant, for example with a current Attestation of Compliance.
• We will send card numbers, expiry dates and the cardholder details stored with them, along with your tokens so you can match each record. We will use a secure, encrypted transfer method agreed with the recipient.
• We cannot transfer card security codes, because we never store them.
• For security, we send card numbers only to a recipient that meets these requirements, and never by email.

We will complete a transfer within a reasonable time, normally within 30 days after we receive everything we need.

13. Third-party services

The Services work with services we do not control, including your Gateways, Stripe (for our own billing), fonts you choose for the payment form, and the AI provider behind our assistant. Your use of a third-party service is governed by your terms with that provider, and we are not responsible for it. The service providers we use to run OrderCard are listed in our Privacy Policy.

14. Support and the AI assistant

We provide support through the dashboard and at support@ordercard.io. Unless we agree otherwise in writing, we do not guarantee response times.

The AI assistant in the dashboard answers questions from our public documentation. It cannot see your Workspace's data, it can make mistakes, and its answers are not legal, tax or compliance advice. Check anything important against the documentation or with our team. Our staff may also use AI to help draft replies to your support messages, and a person reviews every reply before it is sent.

15. Changes to the Services

We improve the Services continually and may add, change or remove features. If a change would significantly reduce the core functionality you use or break a working integration, we will give you reasonable advance notice when we can, unless the change is needed for security, legal or Card Network Rules reasons. Unless we agree otherwise in writing, we do not commit to a specific level of uptime, and the Services may be unavailable during maintenance or because of events outside our control.

16. Suspension

We may suspend all or part of the Services, such as live mode or a specific API key, if we reasonably believe that:

• an account, key or system is compromised or poses a security risk to the Services or to others;
• you are breaching Section 8 or 9, or using the Services for fraud;
• the law, a court, a card network or a Gateway requires it; or
• your subscription is unpaid (live mode only, as described in Section 7).

We will tell you promptly, limit the suspension to what is reasonably needed, and lift it once the cause is resolved.

17. Term and termination

These Terms apply from when you first use the Services until your account ends.

• You may stop using the Services at any time. To close your Workspace and have its data deleted, an Owner can contact us at support@ordercard.io.
• Either party may end these Terms if the other materially breaches them and does not fix the breach within 30 days after written notice. We may end them immediately for a serious breach of Section 8 or 9, for fraud, or where the law requires.
• We may also end these Terms for any reason with at least 60 days' notice. If we do, we will refund any fees you prepaid for the period after the end date.

When your account ends, your access to the Services stops and any fees you owe become due. For 30 days afterwards you may still ask for a card transfer under Section 12. After that period, or once a transfer you asked for within it is complete, we will redact your Cardholder Data and delete your Customer Data within 90 days. We keep only the records we must keep by law, under the Card Network Rules or for our security and audit obligations, such as activity and access logs (kept for up to 400 days) and transaction records, which contain no card numbers.

Sections 7 (for amounts owed), 11, 12 and 18 to 27 survive the end of these Terms.

18. Confidentiality

Each party may receive non-public information from the other ("Confidential Information"). Your Confidential Information includes Customer Data. Ours includes non-public details of the Services, their security and our pricing. The receiving party will use the other's Confidential Information only to perform under these Terms, protect it with at least reasonable care, and share it only with people and service providers who need it and are bound to protect it.

Confidential Information does not include information that becomes public through no fault of the receiving party, or that it already had, develops independently or receives lawfully from someone else. If the law requires a party to disclose Confidential Information, it will tell the other party first where the law allows.

19. Intellectual property

We own the Services, including the software, SDKs, documentation and the OrderCard name and logo. While you use the Services under these Terms, we give you a limited, non-exclusive, non-transferable right to use them for your business. This includes embedding our payment form scripts in your websites and copying code samples from our documentation into your integration. We reserve all other rights. If you send us feedback or suggestions, we may use them without any obligation to you.

20. Disclaimers

Except as expressly stated in these Terms, the Services are provided "as is" and "as available". To the fullest extent the law allows, we disclaim all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Services will be uninterrupted or error-free, that any payment will be approved, or that using the Services will by itself make you compliant with any law, the Card Network Rules or PCI DSS. Beta features and the AI assistant are provided without any warranty.

21. Limitation of liability

To the fullest extent the law allows:

1. neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, business or goodwill, even if it was told they were possible; and
2. each party's total liability arising out of or relating to these Terms or the Services is limited to the greater of the fees you paid us for the Services in the 12 months before the event giving rise to the claim, or US$100.

These limits do not apply to your obligation to pay fees, to either party's obligations under Section 22, to your breach of Section 9, or to liability for gross negligence, willful misconduct or fraud.

22. Indemnification

You will defend OrderCard, its affiliates and their personnel against any third-party claim, including a claim by a Cardholder, Gateway, bank, card network or government authority, arising from:

• your products, services or dealings with Cardholders;
• Customer Data you submit without the necessary rights or consent;
• your breach of the law, the Card Network Rules or these Terms;
• your surcharging; or
• the security of your own systems.

You will also pay the resulting damages, fines, penalties, settlements and reasonable legal fees. We will tell you about the claim promptly, let you control its defense and cooperate at your expense. You may not settle a claim in a way that places an obligation on us without our consent.

23. Governing law and disputes

These Terms are governed by the laws of the State of Wisconsin, U.S.A., without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before starting a lawsuit, the party with a dispute will give the other written notice, and both will try in good faith to resolve it for 30 days. Any lawsuit must be brought only in the state courts of Milwaukee County, Wisconsin, or in the United States District Court for the Eastern District of Wisconsin, and both parties consent to those courts' jurisdiction. Either party may ask any court for an injunction to protect its intellectual property, its Confidential Information or the security of the Services.

24. Changes to these Terms

We may update these Terms. We will post the new version here and update the date at the top. If a change is material, we will tell Workspace Owners by email or in the dashboard at least 30 days before it takes effect, unless the law requires it sooner or it only concerns new features. If you keep using the Services after a change takes effect, you accept it. If you don't agree, you can cancel before then.

25. Notices

We send notices to your Workspace Owner's email address or in the dashboard. Send notices to us at support@ordercard.io, and send legal notices by mail to the address below as well. A notice sent by email counts as given when it is sent.

26. Reporting security issues

If you find a security vulnerability in OrderCard, email support@ordercard.io with "Security" in the subject line. When you research it:

• test only against your own accounts and Sandbox;
• do not access, change or delete data that is not yours;
• do not degrade the Services for anyone else; and
• give us reasonable time to fix the issue before you tell anyone else.

If you follow these rules in good faith, we will not treat your research as a breach of Section 9.

27. General

• Entire agreement. These Terms, the Privacy Policy and any written agreement or quote we sign with you are the entire agreement between us about the Services.
• Assignment. Neither party may transfer these Terms without the other's consent, except to a successor in a merger, acquisition or sale of all or substantially all of its relevant business, with notice to the other party.
• Events outside our control. Neither party is liable for delays or failures caused by events beyond its reasonable control, such as failures of the internet, cloud providers, Gateways or card networks, natural disasters, war or government action. This does not excuse paying fees.
• Relationship. The parties are independent contractors. These Terms do not create a partnership, agency or joint venture.
• No third-party beneficiaries. These Terms give no rights to anyone other than you and us, including your Cardholders.
• Severability and waiver. If a court finds part of these Terms unenforceable, the rest stays in effect and that part is enforced as far as allowed. A failure to enforce a provision is not a waiver of it.
• Sanctions and export. You confirm that you are not located in, or owned or controlled by anyone in, a country or on a list subject to U.S. sanctions, and that you will not use the Services in breach of export control or sanctions laws.
• Electronic communications. You agree to receive agreements, notices and other communications from us electronically.
• Interpretation. "Including" means "including without limitation". Headings are for convenience only.