API Terms of Service

Scope and acceptance

Who we are

The KemyCard API is provided by Kemite Group, LLC, a limited liability company registered in the State of Delaware, United States (Delaware file number 20250007719), with its principal office at 111b South Governors Ave, STE 23648, Dover, DE 19904, USA ("KemyCard", "we", "us"). In the United States, KemyCard is registered with the Financial Crimes Enforcement Network (FinCEN) as a Money Services Business. KemyCard is a technology and program management platform, not a bank.

Who these Terms apply to

These API Terms of Service (the "Terms") apply to any person or organization that applies for, opens or uses a KemyCard API partner account ("you" or the "Partner"). If you register for a company, you confirm that you are authorized to bind that company, and both the company and the natural person who holds the account are bound by these Terms.

Acceptance

You accept these Terms when you submit your registration, when your account is approved, or when you first use your API keys or the partner dashboard, whichever comes first. If you do not accept them, do not use the API.

Other documents

These Terms incorporate by reference the API Privacy Policy and the official documentation of the API at docs.kemycard.com (the "Documentation"), including the Plans and Pricing page. If these Terms and the Documentation conflict, these Terms prevail, except for prices, fees, limits and technical specifications, for which the Documentation prevails. These Terms apply to the API partner programme; the general terms of kemycard.com apply to KemyCard's consumer services.

Definitions

• API: the KemyCard application programming interface, available at https://api.kemycard.com/v1, its test mode and its webhooks.
• Dashboard: the partner dashboard where you manage your account, keys, allowed IP addresses, webhooks, plan, balances and support tickets.
• Services: the API, the Dashboard and the products available through them, such as cards, crypto wallets, payouts, virtual accounts, gift cards and identity verification.
• Customer or Cardholder: a natural person, your own user, for whom you create a customer record, a card, a wallet or another product through the API.
• Ops balances: the prefunded operating balances of your account, one per service (for example cards_visa, cards_mastercard, others, payout_sepa and gift_cards), from which your operations and fees are paid.
• Plan: the plan that applies to your whole account: Découverte (free) or a paid plan (Starter, Business or Premium).
• Banking partners: the authorized banks, card issuers and financial institutions through which the cards and certain other products are provided.
• Live mode and test mode: live keys (sk_live_) carry out real operations; test keys (sk_test_) return simulated data without real money.

Eligibility and onboarding

Two tracks

You may register as an Individual / Freelancer, under your own name, or as a Company, under the name of your company, in which case company documents are requested in addition. Both tracks give access to the same API and the same products, subject to your Plan.

An identified, accountable person

A partner account is always opened in the name of an identified natural person, who is accountable for the programme, its API keys and its Customers. That person must be at least 18 years old and have full legal capacity. An account cannot be held anonymously or collectively, and you may not share it with, transfer it to or operate it for a third party.

Verification of the Partner

Before approval, we verify the identity of the account holder (an identity document with a liveness check) and their proof of address, and, for a Company, its registration and business documents. We may ask for additional information or documents at any time, including on the ownership, activity, website, source of funds or customers of your business. You must provide them promptly and keep your information accurate and up to date.

Our decision

We approve, refuse or limit applications at our discretion, in particular for compliance, risk or reputational reasons, and we are not required to give the reasons for a refusal. You may not apply again through another person or entity after a refusal or a closure.

The services

Licence to use the API

Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable and revocable right, during the term of your account, to access and use the API, the Dashboard and the Documentation to build and operate your own product for your Customers.

Cards

Cards are issued through our authorized banking partners under Visa and Mastercard licenses. The issuing entity is not disclosed. The characteristics of each card product (network, currency, limits, validity, fees, availability of 3-D Secure, ATM, Apple Pay and Google Pay) are those returned by GET /cards/products at the time of the request. The funds loaded on cards are held by our banking partner. We do not commit to a specific issuer, BIN or BIN country, and card products may change or be withdrawn.

Other products

Depending on your Plan, the Services may also include crypto wallets for your Customers (keys generated and kept by KemyCard, encrypted, never returned by the API), payouts to bank accounts, virtual accounts, gift cards and identity verification. Each product works as described in the Documentation. A product marked as "early access" or available only in test mode is provided as is, may change without notice and may not be available in live mode.

Your relationship with your Customers

You decide how your product works, how you present it and what you charge your Customers. You set your own prices and KemyCard pays you no commission. You are solely responsible for your own terms of service with your Customers, for your customer support and for your compliance with the laws that apply to your business and your marketing. You must not suggest that KemyCard or its banking partners endorse your product, or that you are a bank or a card issuer.

3-D Secure

When a merchant requests a 3-D Secure confirmation on a card that supports it, we send you the one-time code through the card.3ds_request webhook. You must relay it to your Customer immediately and securely, in your own interface. KemyCard does not send this code to your Customer, and a code that you do not relay in time will expire.

Refunds and disputes

Merchant refunds and reversals are credited to the card. We forward disputes (contestations) about card transactions to our banking partner, which processes them under the applicable card network rules. We do not guarantee the outcome of a dispute, and you must cooperate with any request for information.

Test mode

Test mode is free and unlimited on every Plan. Test keys return simulated data and never move real funds. Test data may be modified or deleted at any time.

Ops balances and funding

Prefunding

All live operations (card creation, loads and top-ups, payouts, verifications and the related fees) are paid from your ops balances, which you must fund in advance. Ops balances are funded in USDC on the Solana network only, to the deposit address shown in the Dashboard for each balance. A deposit sent in another asset, on another network or to a wrong address may be lost and is your responsibility. A deposit fee set by your Plan is deducted from each deposit. There is no minimum deposit, no security deposit, no reserve and no minimum volume.

Origin of funds and collection from your Customers

How you collect funds from your own Customers, and what you charge them, is your sole decision and responsibility, including the lawful origin of those funds. You must only fund your ops balances with funds that you lawfully own or are authorized to use, and you must give us, on request, information about the source of the funds you deposit.

Nature of ops balances

Ops balances are prepaid operating balances for the use of the Services. They are not bank deposits, do not bear interest and are not covered by deposit insurance. Funds cannot be moved from one ops balance to another; each balance is funded by its own deposit. Card balances are held by our banking partner.

Negative balance and suspension

Some charges, such as the annual fee of certain card products, are debited even if the balance is too low, and can make an ops balance negative. As soon as one of your ops balances is negative, your account is suspended as described in the Documentation: requests other than GET are refused, issued cards keep working, and webhooks stop after 24 hours. Access is restored automatically once no balance is negative. You must top up a negative balance without delay.

Holds and corrections

We may hold, delay or reverse a credit to an ops balance when required by law, by a banking partner or a competent authority, or when we reasonably suspect fraud, an error or a breach of these Terms, for as long as necessary to investigate. We may correct any amount credited or debited in error.

Plans, fees and billing

One plan for the whole API

Every new partner starts on the free Découverte plan, which gives access to the products and within the monthly limits stated in the Documentation. The paid plans, Starter, Business and Premium, give access to every product without monthly limits and differ by their fees and their level of support. The Plans and Pricing page of the Documentation is the reference for prices, fees, limits and billing cycles, and prevails over any other description.

Prices

Prices are fixed and the same for every partner; they are not negotiable. The only reductions are the discounts for longer billing cycles stated in the Documentation. Unless stated otherwise, prices and fees are expressed in US dollars and exclude any taxes, which are your responsibility.

Payment, renewal and cancellation

• The price of a paid plan is paid in advance for the chosen billing cycle, from your others ops balance.
• A paid plan renews automatically at the end of each cycle, and the next cycle is debited from your others balance. If that balance is insufficient on the renewal date, your account returns to Découverte.
• You may cancel at any time from the Dashboard. Your plan stays active until the end of the period already paid, then your account returns to Découverte.
• An upgrade applies immediately; the unused days of your current plan are deducted from the price of the new one. A downgrade applies at the next renewal.
• Amounts paid for a plan are non-refundable, including when you cancel or close your account before the end of the cycle, except where the law requires otherwise.

Operation fees

Operation fees (deposits, card creation, loads, withdrawals and termination, payouts, wallets, virtual accounts, verifications and others) are those of your Plan at the time of the operation, as listed in the Documentation, and are debited from the relevant ops balance or deducted from the amount concerned. Fees charged on the card itself, such as authorization and cross-border fees, are paid from the card balance.

Changes to prices

We may change prices and fees with at least 30 days' notice by email or in the Dashboard. A change to the price of a plan applies from your next renewal after the notice period. A reduction may apply immediately.

Amounts you owe

We may deduct from any of your ops balances any fee or amount you owe us under these Terms, including fees debited from a balance that became negative.

Your customers and their verification

Customer data

When you create a Customer, you submit their first name, last name, date of birth, real and working email address, phone number and full address. You are responsible for the accuracy and completeness of the data you submit and for having the right to submit it to us. You must update it when it changes. Changing identity or address data can lower the Customer's verification level, as described in the Documentation.

Identity verification by KemyCard

KemyCard verifies the identity of your Customers itself, through a hosted verification link returned by the API: a government-issued identity document with a liveness check, then a proof of address. A proof of address can be any document that proves the Customer's residential address, including in a local language, issued less than 3 months ago. No card is issued without identity verification. We alone decide whether a verification is approved or rejected, and we may request a new verification at any time.

What you must never do

• Present the cards, in your product or your marketing, as anonymous or as available without identity checks.
• Complete a verification on behalf of a Customer, submit documents that do not belong to the Customer, or help anyone circumvent a verification or a limit.
• Create a Customer for a person who has not asked for your product, or for a person other than the actual user of the card.

Supported countries

Cards are available to Customers residing in every country except Libya, Iran, North Korea and Iraq. Virtual accounts and other products follow their own lists, published in the Documentation. You must not offer the Services to any person who is subject to sanctions administered by the United States, the United Nations, the European Union or the United Kingdom, or who acts on behalf of such a person.

Third-party terms

Some products require your Customer to accept the terms of a banking partner personally (for example virtual accounts). You must direct your Customer to those terms and may never accept them on their behalf.

Acceptable use

Prohibited card uses

Cards must not be used with money transfer and remittance services, with casinos and gambling, or for drugs and any illegal goods or services. These payments are declined. A card that records 12 declined transactions within one week is terminated and its remaining balance is returned to your ops balance. You must inform your Customers of these restrictions.

Prohibited activities

You must not use the Services, or allow them to be used:

• for money laundering, terrorist financing, fraud, sanctions evasion or any other unlawful purpose, or to process proceeds of crime;
• to offer a regulated financial service that you are not authorized to offer, or to resell or sub-license access to the API itself to third parties as a platform;
• with false, misleading or stolen identities or data, or in a way that deceives Customers about who provides the Services;
• to test card numbers, run card-testing or enumeration attacks, or disrupt any merchant, network or system;
• to circumvent rate limits, Plan limits, verification requirements, allowed IP addresses or any other technical or compliance control;
• to reverse engineer, scrape or copy the Services, except where the law expressly allows it, or to access them other than through the documented interfaces.

Cooperation

You must cooperate with our compliance reviews and with requests from our banking partners and competent authorities, including by providing, within the time we reasonably specify, information about your business, your Customers and specific transactions. You must tell us without delay if you become aware of fraud, a security incident or a breach of these Terms involving the Services.

Security and API credentials

API keys

Your API keys are confidential and identify you. Any request made with your keys is deemed made by you, and operations carried out with them, including card loads and wallet withdrawals, are your responsibility. Keep your keys on your servers only, never in a browser or mobile application, a public repository or a message to us. If a key may be compromised, revoke it from the Dashboard immediately and create a new one. KemyCard will never ask you for a key, a webhook secret or card data.

Allowed IP addresses

The list of allowed IP addresses is mandatory: your keys only work from the IP addresses you declare in the Dashboard, in test and live mode. You must limit this list to servers under your control.

Your systems and webhooks

You are responsible for the security of your own systems, of the data that goes through them and of your webhook endpoint. You must verify the signature of each webhook before processing it, as described in the Documentation. You must protect the Dashboard account with a strong password and the two-factor authentication we provide.

Sensitive card data

The card number, expiry date and CVV returned by GET /cards/{code}/sensitive pass through your servers, and you are responsible for their security. Call this endpoint only when your Customer displays the card, never store or log the response, and apply security measures appropriate to card data. We do not require a PCI DSS certification to integrate the API, but you remain responsible for complying with any card network or legal requirement that applies to you.

Rate limits

The API applies the rate limits and the limits of your Plan stated in the Documentation. We may apply additional technical limits to protect the stability and security of the Services.

Data protection

We process personal data as described in the API Privacy Policy. Because KemyCard verifies your Customers itself and must meet its own legal obligations, it processes Customer data for its own compliance purposes in addition to providing the Services to you.

You must, in accordance with the law that applies to you: inform your Customers, before you submit their data, that it is shared with KemyCard and its service providers to provide the cards and other products, verify their identity and meet legal obligations, for example by linking to the API Privacy Policy from your own privacy notice; have a valid legal basis to submit their data to us; and only submit the data that the API requires. You must forward to us without delay any request from a Customer that concerns the data we hold.

We may use data about the use of the Services in aggregated or de-identified form, which does not identify you or your Customers, to operate, secure and improve the Services.

Availability, support and changes to the API

Availability

We make reasonable efforts to keep the Services available and secure, but we do not guarantee uninterrupted or error-free operation. The Services depend on banking partners, card networks, blockchains and other third parties beyond our control. We may carry out maintenance, preferably announced in advance.

Changes to the API

The API evolves. We may add, change or remove features. We will give at least 30 days' notice by email or in the Dashboard before a change that removes a documented feature or breaks backward compatibility of the API, unless the change is required by law, by a banking partner or a card network, or for security reasons, in which case we give as much notice as we reasonably can.

Support

Support is provided through tickets in the Support section of the Dashboard and by email at [email protected], at the level of your Plan.

Suspension and termination

Term

These Terms apply from your acceptance until your account is closed.

Suspension and restriction

We may suspend or restrict your account, your API keys, a product, a Customer or a card, in whole or in part, immediately and without prior notice where we reasonably believe that it is necessary: to comply with the law, a court order or a request of a competent authority or a banking partner; because of suspected fraud, money laundering, sanctions exposure or other illegal activity; to protect the security of the Services, your Customers or third parties; because you breach these Terms, do not answer a compliance request or a balance is negative; or because the information you gave us is inaccurate. Where the law allows it, we will tell you the reason and how to resolve it. While your account is restricted, the Support section of the Dashboard remains available.

Termination by you

You may close your account at any time by writing to [email protected] or through a support ticket. The rules in Leaving the programme apply.

Termination by us

We may terminate these Terms and close your account for any reason with 30 days' notice by email. We may terminate them immediately, by email, if you materially breach these Terms, in the situations that allow an immediate suspension, or when a banking partner or card network ends or restricts the programme that serves your account.

Effects of termination

On termination, your access to the API and your keys are revoked and the rules in Leaving the programme apply. The sections on fees owed, data protection, confidentiality, intellectual property, liability, indemnification, governing law and any other provision that by its nature should survive, survive termination.

Leaving the programme

Cards already issued

When you leave the programme, the cards already issued are not cancelled: your Customers can keep using the funds loaded on their cards until their balance is exhausted. Before you leave, you can terminate cards yourself through the API; the remaining balance of a terminated card is returned to your ops balance, minus the card termination fee of your Plan and any card provider fee.

Remaining ops balances

On request to [email protected], the remaining positive amount of your ops balances is paid to you in USDC on the Solana network, to an address in your name or under your control, within 7 to 14 days, because these funds must first be recovered from our banking and issuing partners. A fee of 1.5% of the amount applies, with a minimum fee of 50 USD. Amounts you owe us, and amounts held under a legal obligation or an ongoing investigation, are deducted or withheld.

Customer wallets

The balances of your Customers' crypto wallets remain withdrawable through the API, with the usual withdrawal fees, under the conditions described in the Documentation.

Records

After closure, we keep the records we are required to keep by law, as described in the API Privacy Policy.

Intellectual property

KemyCard and its licensors own all rights in the Services, the Documentation, the software, the KemyCard name and logos. Except for the limited right granted in these Terms, no right is transferred to you. You may state that your product uses the KemyCard API, in a factual way. You may not use our logos, or the Visa or Mastercard brands, other than as permitted by us and by the card network rules.

You keep all rights in your product, your brand and the data you submit. You grant us a non-exclusive, worldwide licence to use that data to provide the Services, to meet our legal obligations and as described in the API Privacy Policy. We will not use your name or logo in our marketing without your prior consent. If you send us feedback or suggestions, we may use them freely without obligation to you.

Confidentiality

Each party must keep confidential the non-public information of the other party that it receives in connection with the Services, including your API keys, our non-public documentation, pricing proposals and security information, use it only for the purposes of these Terms, and protect it with at least reasonable care. This obligation does not apply to information that is or becomes public without fault of the receiving party, was already known to it, or is independently developed. A party may disclose confidential information where required by law, a court, a competent authority or, in our case, a banking partner or card network, and to its advisers and service providers bound by confidentiality. This obligation continues for three years after the end of these Terms, and for as long as the information remains a trade secret or personal data.

Warranties and disclaimers

You represent and warrant that: the information you give us is true, accurate and complete; you have the authority to accept these Terms; you, your business and your beneficial owners are not subject to sanctions; and you will use the Services in compliance with these Terms and all applicable laws, including anti-money laundering, sanctions, consumer protection, data protection and marketing laws.

To the extent permitted by law, the Services are provided "as is" and "as available". KemyCard disclaims all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement, and does not warrant that the Services will be uninterrupted, error-free or meet your requirements, or that a card, payment, payout or verification will be accepted by a merchant, network or bank.

Limitation of liability

To the extent permitted by law, KemyCard, its affiliates and their officers, employees and agents will not be liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, business, goodwill or data, arising out of or in connection with these Terms or the Services, even if advised of the possibility of such damages.

To the extent permitted by law, the total liability of KemyCard arising out of or in connection with these Terms or the Services, whatever the cause, is limited to the total fees you paid to KemyCard during the three months preceding the event giving rise to the claim.

These limitations do not apply to liability for fraud or wilful misconduct, or to any liability that cannot be limited by law. They do not limit our obligation to return to you the positive balance of your ops balances, as described in Leaving the programme.

We are not liable for the acts or omissions of banking partners, card networks, merchants, blockchains or other third parties, nor for any failure or delay caused by events beyond our reasonable control, including outages of networks, blockchains or banking systems, cyberattacks, decisions of authorities, wars, natural disasters or strikes. Any claim against KemyCard must be notified in writing within one year after you became aware, or should have become aware, of the event giving rise to it.

Indemnification

You agree to defend, indemnify and hold harmless KemyCard, its affiliates and their officers, employees and agents from and against any claim, loss, damage, fine, penalty, chargeback, cost and expense (including reasonable legal fees) arising out of or in connection with: your breach of these Terms or of any law; your product, your marketing and your relationship with your Customers; inaccurate data you submitted; the use of your API keys, including by an unauthorized person; or a security incident affecting your systems. We will notify you of the claim, allow you to take part in its defence, and not settle it in a way that imposes an obligation on you without your consent, which you will not unreasonably refuse.

Changes to these Terms

We may change these Terms. We will publish the new version on this page with a new date and version number, and notify you of any material change by email or in the Dashboard at least 30 days before it takes effect. If you do not accept a change, you may close your account before its effective date, under the conditions of Leaving the programme. If you continue to use the Services after that date, you accept the new Terms. Changes required by law, by a banking partner or a card network, or for security reasons, may take effect sooner, with as much notice as we reasonably can give.

Governing law and disputes

These Terms and any dispute arising out of or in connection with them or with the Services are governed by the laws of the State of Delaware and the federal laws of the United States applicable there, without regard to conflict-of-law rules.

Before starting any proceedings, a party must notify the other in writing of the dispute, and the parties will try in good faith to resolve it within 30 days. Failing that, the state and federal courts located in the State of Delaware have exclusive jurisdiction, and each party submits to their jurisdiction. To the extent permitted by law, each party waives any right to a jury trial and agrees that claims may only be brought individually and not as part of a class or collective action. Nothing prevents a party from seeking urgent interim relief from any competent court.

General provisions

• Entire agreement. These Terms, the API Privacy Policy and the Documentation are the entire agreement between you and us about the API partner programme and replace any prior discussion on the same subject. A separate written agreement signed by both parties prevails over these Terms on the points it covers.
• Notices. We send notices to the email address of your partner account or in the Dashboard. You send notices to [email protected]. Email satisfies any requirement of a written notice.
• Assignment. You may not assign or transfer these Terms or your account without our prior written consent. We may assign them to an affiliate or to a successor in a merger, acquisition or sale of assets.
• Independent parties. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship, and you may not bind KemyCard.
• Severability and waiver. If a provision is held invalid, the rest of these Terms remains in force and the invalid provision is replaced by a valid one as close as possible to its purpose. Not enforcing a right is not a waiver of it.
• Records. Our electronic records of requests, operations and communications are evidence of their content, unless proven otherwise.
• Language. These Terms are written in English. A translation is for information only; the English version prevails.

Contact

Partners can also open a ticket from the Support section of the Dashboard.