Avonao ID Business Terms

Version 1 · Effective: 8 November 2026

1. Parties and scope

1.1 These terms are an agreement between AVONAO, INC., 254 Chapman Rd, Ste 208 #21918, Newark, DE 19702, United States ("Avonao") and the business, organisation or person acting in a trade or profession on whose behalf a business account is created (the "Business").

1.2 The person who creates the business account and ticks "I accept the Business Terms" confirms that they may bind the Business. These terms are for businesses only, not for consumers.

1.3 Part of these terms: the Data Processing Agreement (for the cases in section 7.3), the Acceptable Use Policy, the Ranking rules and Notice and action. The members' Terms of Service continue to apply to each person's own Avonao ID.

2. Words used here

• Business account: the account in the Avonao ID console that owns apps, domains and a public profile.
• App: a website or application the Business connects to Avonao ID as an OpenID Connect client.
• Member: a person with an Avonao ID.
• Avonao Business Circle (also "Avonao ID Business Circle"): the offering for businesses that put Avonao ID behind their own apps, including the public directory, the Launchpad and the business profiles on id.avonao.com (/network, /launchpad, /business/<profile>; decision D10).
• Development mode / live mode: see section 5.
• Beta: a feature labelled Beta in the console or the docs.

3. Business account and team

3.1 Any member can create a business account (decision D15). The creator becomes its first owner. Information you give (name, website, country, category) must be accurate and kept up to date.

3.2 Roles: owner (everything, including deleting the business and transferring ownership), admin (everything except ownership and deletion) and developer (apps and domains; read-only on members and profile). The Business is responsible for whom it invites and for everything done under its business account.

3.3 An invitation link can be used once, within 7 days, by whoever opens it, whatever email address they sign in with (decision D27). Send invitation links only to the intended person; the Business is responsible for whom it invites. A business account always has at least one owner.

3.4 The console keeps an audit log of business events (for example members joining, domains verified, apps going live). It is available to the Business in the console.

4. Domains

4.1 The Business may only verify domains it controls, by DNS TXT record or by a file at /.well-known/avonao-id.txt. A verified domain covers its subdomains. A domain can be verified by one business only.

4.2 If the Business loses control of a domain, it must remove it. Avonao may remove a verification if control is lost, disputed or was obtained by deception.

5. Apps, development mode and going live

5.1 A new app starts in development mode: it works at once, but only members of the Business and up to 100 testers the Business adds to the app's tester list can sign in to it (decision D04).

5.2 An app may go live when all of these are true (the go-live rule, decision D03):

• every redirect URI and the launch URL use https on a domain verified by the Business;
• the app has a privacy policy URL;
• the business account is active (not suspended).

The app goes live at once. Avonao reviews new live apps afterwards and may pause or disable an app, or restrict the Business under section 9, if it breaks these terms or the law.

5.3 A live app must keep meeting the go-live rule. The Business keeps its privacy policy (and terms, if linked) accurate and reachable.

5.4 Client secrets are shown once. The Business keeps them confidential, stores them securely, rotates them if they may have been exposed and tells Avonao at business-support@avonao.com about any suspected compromise. Avonao never asks for a client secret by email.

5.5 Current limits per business: 25 apps, 10 redirect URIs per app, 20 domains, 5 webhooks, 5 enterprise connections. Avonao may change limits and rate limits to protect the service.

6. Member data and consent

6.1 An app receives only the scopes a member allowed on the consent screen: openid (a member identifier), email (email address) and profile (name and language). The member identifier is pairwise: it is the same for all apps of one Business and different for every other business.

6.2 The Business must:

• use member data only for the purposes stated in its own privacy policy and in line with applicable data protection law;
• not ask members for their Avonao ID sign-in codes, links, passkeys or recovery codes, and not imitate the Avonao ID sign-in or consent screens;
• not try to link pairwise identifiers across businesses or otherwise re-identify members across the network;
• respect revocation: when a member revokes an app, stop using the access it gave; if the Business subscribes to the grant.revoked or member.deleted webhooks (Beta), act on them, and in any case delete a member's data when the law or its own privacy policy requires it;
• not sell member data obtained through Avonao ID, except as the Business is allowed to use data it receives from members who connected to its app under these terms;
• use a Verified Price proof (only when Verified is enabled, decision D08) only to check that the member is verified, once, at the moment it is presented.

6.3 Per-app statistics in the console show counts only (members, sign-ins, new members), not individual members.

7. Data protection roles

7.1 Avonao is the controller for each member's Avonao ID account: sign-in, sessions, security log, consent records and data receipts.

7.2 The Business is a separate controller for the member data it receives after the member consents. Its own privacy policy applies to that data. Avonao does not process that data on the Business's behalf.

7.3 Avonao acts as processor for the Business, under the Data Processing Agreement, when the Business uses (a) an enterprise connection (Beta) so that people on its verified domains sign in through its own identity provider, or (b) Avonao ID to sign in its own staff or workforce to its own apps and tools.

7.4 Analytics on Avonao's own sites (decision D46). Avonao plans to use analytics and measurement tools on its websites and, in aggregate form, on the business console, as described in the Privacy Policy section 9.1. Avonao is the controller for that data. These tools run only after consent where they use cookies or device storage, never on sign-in pages, and never receive a member's Avonao ID id, email address, name or IP address in Avonao's events. Avonao does not sell data and runs no advertising. The business console does not use session recording. The Business tells its own staff about this where the law requires it.

8. Listing in Avonao Business Circle

8.1 Once the Business has at least one live app, its profile is listed in the directory by default (founder decision F1) and appears on the Launchpad for 90 days from its first go-live. The Business can hide its profile at any time in its settings.

8.2 The profile shows what the Business enters (name, tagline, description, website, logo, category, country), its verified domain, its live apps and its follower count. The Business is responsible for that content: it must be accurate, lawful and not infringe anyone's rights.

8.3 The Business grants Avonao a non-exclusive, royalty-free, worldwide licence to host, display and reproduce its profile content and logo in Avonao Business Circle, in the consent screen and in members' dashboards, for as long as the profile is listed (and in records kept by law afterwards). Avonao will not use the Business's name or logo in its own marketing without the Business's permission.

8.4 Order and placement follow the published Ranking rules. No business can pay for a better position; the plan, early-adopter status and any payment to Avonao have no influence. The verified-domain label only means the Business proved control of that domain.

9. Reports, moderation and restrictions

9.1 Anyone can report a business. A person at Avonao reviews each report; no automated means are used to detect or decide (see Notice and action). Avonao may also act on its own review.

9.2 Avonao may take these measures if the Business, its profile or its apps are illegal or break these terms or the Acceptable Use Policy:

• unlist: the profile is removed from the directory, Launchpad and search, and the Business cannot list it again itself; its apps keep working;
• suspend: the profile is hidden and all apps are disabled, so members cannot sign in to them, and their access tokens are revoked; members' connections are kept and work again if the suspension is lifted;
• terminate the business account, with at least 30 days' notice, unless the law, a serious or repeated breach, or a risk to members requires immediate termination.

9.3 The owners receive a statement of reasons by email at the latest when a restriction takes effect. It explains what changed, its scope and duration, the facts, whether it followed a report, that a person decided, the contractual or legal ground and the ways to contest it.

9.4 The Business can contest a decision free of charge within six months by writing to business-support@avonao.com, quoting the reference in the email. A person who was not involved in the original decision reviews the complaint and replies with a reasoned decision. The Business can also use a certified out-of-court dispute settlement body (Digital Services Act Art. 21) or the courts.

10. Beta features

Webhooks and enterprise connections are Beta. They are provided as they are, may change or end, and are not covered by any service level. Avonao will give at least 14 days' notice before ending a Beta feature that the Business uses. For enterprise connections, the Business is responsible for configuring its identity provider correctly and for asserting only addresses on domains it controls; in the Beta, members on those domains can still sign in by other methods.

11. Early access, plans and the early-adopter offer

11.1 Plans and payment (decision D05): the plans are Free, Pro, Team, Scale and Enterprise; their limits and features are shown on the pricing page at https://avonao.com/pricing. The Free plan is free. Pro, Team and Scale are billed in advance per month or year through Stripe Managed Payments; Enterprise is agreed by contract. Under Stripe Managed Payments, Stripe is the seller of record for the payment; checkout shows the contract partner for the purchase, the invoice and the taxes. Prices are in US dollars, and Stripe may show them to you in your local currency at checkout. Prices are those on the pricing page when you subscribe; at launch Pro costs USD 49 a month, Team USD 149 and Scale USD 249, and a year costs ten times the monthly price (checkout shows the taxes that apply to your purchase). The plans differ in console seats and apps (Free 1 seat and 3 apps, Pro 1 and 10, Team 5 and 25, Scale 15 and 50) and in whether webhooks and enterprise connections are included; a new member or app above the limit of the plan is refused, and what already exists stays when a Business moves down. Avonao may ask a Business with a very high number of monthly active users to move to a higher plan; sign-ins are not interrupted.

11.2 Early-adopter offer (decision D06): a Business that starts a paid subscription gets 30% off the list price for the first 12 months of that subscription, counted from the start of the subscription. The offer applies once per business account, cannot be transferred, exchanged for cash or combined with other offers, and ends early if the subscription ends. Avonao may withdraw it from a business account that is terminated for breach.

11.3 Avonao will announce paid plans and their prices at least 30 days before any fee can apply. Nothing becomes payable unless the Business chooses a paid plan.

12. Fees and taxes (once paid plans exist)

12.1 Paid plans are billed in advance, per month or per year, as chosen at checkout. Payment is due at checkout and on each renewal.
12.2 Avonao announces a price change at least 30 days before it applies to an existing subscription. The Business can cancel before then.
12.3 Taxes: prices are shown before tax; checkout shows the taxes that apply. Stripe issues the invoice for each payment.
12.4 If a payment fails, Avonao asks the Business to update its payment method; if it is not paid after reasonable notice, the Business moves to the Free plan.
12.5 Mandatory consumer and withdrawal rights are not affected where they apply.

13. Service, support and changes

13.1 Support: business-support@avonao.com (businesses) or enterprise-support@avonao.com (enterprise connections). During early access there is no service level agreement unless agreed in writing.

13.2 Avonao may carry out maintenance and improve the service. Avonao will give at least 30 days' notice of changes that break a documented API used by a live app, except where security or the law requires a faster change.

14. The Business's responsibilities

The Business:

• complies with the law that applies to its apps and business, including data protection and consumer law;
• follows the Acceptable Use Policy and makes sure its team does;
• keeps its redirect URIs, domains, privacy URL and contact details current;
• tells Avonao without undue delay at business-support@avonao.com about security incidents that affect Avonao ID or its members.

15. Brand and intellectual property

15.1 Avonao grants the Business a non-exclusive, non-transferable, revocable licence to use the Avonao ID API and the "Sign in with Avonao ID" button for its apps, following the button kit rules (label, Avonao ID mark, no alterations). This licence ends when the business account ends.

15.2 Everything else stays with its owner. If the Business sends feedback, Avonao may use it freely.

16. Confidentiality

Each party keeps the other's non-public information confidential and uses it only for this agreement, unless the law requires disclosure. Client secrets and webhook secrets are confidential information of the Business.

17. Liability

17.1 Neither party limits its liability for intent, gross negligence, injury to life, body or health, or where the law does not allow a limitation.

17.2 Otherwise each party's total liability under this agreement in any 12-month period is limited to the fees the Business paid in the 12 months before the claim arose. While the service is free, the cap is USD 100.

17.3 Neither party is liable for indirect or consequential loss, or for lost profit, revenue or data, as far as the law allows.

18. Indemnity

Each party defends the other against third-party claims that its own content, app or service infringes that third party's intellectual property rights, or that arise from its misuse of member data in breach of these terms or the law, if the other party tells it promptly, lets it control the defence and cooperates. This section does not limit rights a consumer has by law.

19. Term and ending the agreement

19.1 This agreement runs until the business account is deleted or terminated.

19.2 An owner can delete the business account in the console at any time. Its apps are disabled, members' connections to them are revoked (each with a data receipt), and its members, invites, domains and profile are removed. A minimal record is kept so that members' data receipts and past reports keep their reference.

19.3 Avonao may end this agreement for convenience with at least 30 days' notice, and for cause under section 9.2.

20. Changes to these terms

Avonao will tell the Business about changes at least 15 days before they take effect (longer where the change needs technical work by the Business), unless the law or a security risk requires a faster change. The Business may end the agreement before the change takes effect.

21. General

Governing law: the State of Delaware, United States. Place of jurisdiction: Delaware. If a provision is invalid, the rest stays in force. The Business may not transfer this agreement without Avonao's consent, except with the sale of its business. Notices to Avonao: business-support@avonao.com; notices to the Business go to its owners' email addresses.