Breach Notification Requirements
Effective Date: October 15, 2026 Version: 1.0 Applies to: All Developers and Partners that hold, store, process, or transmit Platform Data.
Article 1: Introduction and Scope
1.1 This document states the Developer's duty to notify the Company of a security incident affecting Platform Data, the content and timing of the notice, the containment and cooperation duties that accompany notice, and the Company's reciprocal duty where the Company's own systems are the source of the incident. Notification to individuals and regulators for Platform Data is governed by the Privacy Policy; reporting of a vulnerability that has not been exploited is governed by the Vulnerability Disclosure Policy. The moment evidence of exploitation of a vulnerability appears, this document governs.
1.2 The Developer shall notify on confirmation and investigate in parallel. The Developer shall not wait to finish an investigation before notifying; the Developer notifies, updates as facts develop, and closes with the report Article 3.4 requires.
1.3 If a provision of this document conflicts with the Terms of Use, this document controls for the subject it governs. If a provision of this document conflicts with the terms of a program in which the Developer participates, the program terms control for that program. Policies and help pages explain this document; they do not amend it, and in any conflict this document prevails.
Article 2: Definitions
2.1 Account: the account a person or business establishes with the Company to use the Platform.
2.2 Application: a software application, integration, or service the Developer offers through the Platform or the App Marketplace.
2.3 Breach: unauthorized acquisition, access, use, or disclosure of Platform Data, or any compromise of a Developer system, credential, or integration that holds Platform Data.
2.4 Company: All About Pawz, LLC, a Tennessee limited liability company.
2.5 Confirmed: verified by the Developer: records show the compromise, a credential is found exposed, or a third party demonstrates access. Confirmed is more than suspicion.
2.6 Credible Suspicion: indicators that would make a competent engineer believe compromise is likely, including anomalous access patterns against the Developer's credentials, a leaked secret in a public repository, or a subprocessor's breach notice naming the Developer's environment.
2.7 Developer: a person or business the Company has accepted to build on the Platform's application programming interface or to participate in a partner program.
2.8 Platform: the websites, applications, and services the Company operates under the name All About Pawz, including aapawz.com.
2.9 Platform Data: buyer personal data, seller business data, order and transaction data, and anything derived from responses obtained through the Platform, as further stated in the Data Use, Retention and Deletion.
Article 3: The Notification Duty
3.1 The Developer shall notify the Company within twenty-four (24) hours of confirming a Breach, by notice to legal@aapawz.com. The notice is given even where the Developer believes the exposure was contained before any data left the Developer's systems; the Company decides what containment means for Platform Data.
3.2 A Credible Suspicion that has not yet been Confirmed shall be reported within seventy-two (72) hours. The twenty-four (24) hour clock in Article 3.1 starts when the Developer confirms. A Developer that holds a Credible Suspicion without investigating, and later confirms, is treated as having confirmed when a competent investigation would have confirmed; the clock is not extended by slow forensics.
3.3 The initial notice shall contain, to the best of the Developer's knowledge at that hour: (a) what happened, in plain language; (b) the exposure window: when the compromise began and whether it is ongoing; (c) the classes of data affected (including buyer names, addresses, payment references, seller records, and order histories, as applicable) and approximate record counts, for which ranges are acceptable in the first notice; (d) which Applications, keys, or integrations are implicated; (e) what containment is already in place; and (f) a named contact at the Developer with authority to act, reachable around the clock until the incident closes.
3.4 The Developer shall give updates at least every seventy-two (72) hours until the incident closes, and shall deliver a final written post-incident report within thirty (30) days of closure stating the root cause, the remediation applied, and the evidence that the means of compromise is closed: what changed, what was tested, and what would detect a recurrence. Silence between updates is itself a violation of this Article.
3.5 Where law requires the Developer to notify individuals or regulators faster than the coordination procedure in Article 5 allows, the Developer shall notify the Company simultaneously, not after, and shall share the exact notice text given.
Article 4: Containment Duties
4.1 On confirmation of a Breach, the Developer shall act in the following order: (a) revoke compromised credentials immediately: a compromised key shall be revoked within one (1) hour of discovery, as the API Key Management and Rotation provides; (b) isolate affected systems, by taking the compromised integration offline or cutting its Platform access, rather than leaving a known-compromised connection open during investigation; (c) preserve forensic evidence: records, images, and access records are frozen before remediation destroys them; (d) assess scope: which keys, which data classes, which time window; and (e) notify under Article 3.
4.2 Containment is not a reason to delay notification. Revocation of a key takes minutes; the notice follows within the window in Article 3.1. A notice that states containment is in place and scope assessment is in progress satisfies Article 3; completeness is achieved through the updates in Article 3.4.
4.3 A Breach caused by the absence of a baseline control required by the Partner Security Requirements: including encryption in transit and encryption at rest: is an aggravating fact in enforcement, not a neutral one.
4.4 Where the Breach involves an artificial intelligence surface: an agent or model connection that disclosed Platform Data, or compromise of records of artificial intelligence disclosures: the Developer shall additionally: disable the implicated agent or connection immediately; preserve the invocation records for the window around the incident; and include the invocation identifiers in the notice under Article 3.3. A manipulation of an agent that is caught before any disclosure of Platform Data is reported under the Vulnerability Disclosure Policy, not this document; the line is disclosure. If Platform Data left the authorized boundary, the event is a Breach.
Article 5: Notice to Individuals and Regulators
5.1 The Company decides notification to individuals and regulators for Platform Data, under the Privacy Policy and applicable breach-notification law. The Developer shall not notify affected individuals or regulators about Platform Data without coordinating with the Company first. Fragmented notices create confusion and contradict the Company's filings.
5.2 The exception is Article 3.5: where law compels faster notice than coordination allows, the Developer complies with the law, notifies the Company simultaneously, and shares the exact notice text, so that the Company aligns its own notifications rather than contradicting them.
5.3 The Developer bears the costs of notification and remediation attributable to the Developer's Breach, including the Company's reasonable costs of forensics, legal review of notifications, support surge, and credit monitoring where the data classes warrant it. This cost allocation is without prejudice to the Company's other remedies.
Article 6: Cooperation and Company-Led Incidents
6.1 The Developer shall cooperate fully with the Company's investigation: timely access to relevant records, configurations, and timelines; identification of the personnel involved; and preservation of evidence once the Company's team is engaged. Access is provided under a nondisclosure agreement where the Developer's materials contain the Developer's own confidential information; confidentiality of the Developer's internal materials is not a reason to withhold them.
6.2 The Developer shall not mislead the investigation. Understating record counts, narrowing the exposure window without evidence, or attributing the Breach to the Company's systems without basis is concealment under Article 7.
6.3 The Company may suspend the Developer's keys, webhooks, or Applications during the investigation where continued access risks further exposure. Suspension under this Article is a protective action under the Partner Suspension, Termination and Appeals, not a finding of fault; obstruction of the investigation converts the suspension into a fault-based measure.
6.4 Where the Breach touches the Company's own systems, the Company's incident response leads, and the Developer shall cooperate under this Article. The Developer shall not run a parallel public response about the Company's systems.
6.5 The Company's reciprocal duty. Where a Breach originates in the Company's systems and affects Platform Data held or processed through a Developer's integration, the Company shall notify each affected Developer without unreasonable delay, stating what happened, the classes of data affected as then known, the containment in place, and a named Company contact. The Company shall give updates as the scope is established and shall lead notification to individuals and regulators under Article 5.1. The Developer shall cooperate with the Company's investigation under Article 6.1 where the Developer's records bear on the scope.
Article 7: Concealment
7.1 Each of the following is concealment, and each is a material breach of this document subject to immediate suspension and termination without a cure period under the Partner Suspension, Termination and Appeals: (a) knowing of a Confirmed Breach and failing to notify within the window in Article 3.1; (b) filing a notice the Developer knows to be materially incomplete or misleading, including an understated record count, a narrowed exposure window, or an omitted data class; (c) destroying, altering, or withholding forensic evidence relevant to the Breach after the duty to preserve arose; (d) instructing employees, contractors, or subprocessors not to report, or to delay reporting; and (e) attributing the Breach to the Company or a third party without evidence, to deflect investigation.
7.2 The following are not concealment: a good-faith underestimate corrected in a later update under Article 3.4; a delayed notice caused by the Company's published contact being unreachable, where the Developer documents the attempts; and a Developer that genuinely could not confirm within the window and filed the Credible Suspicion notice under Article 3.2 on time instead. The difference between concealment and an imperfect response is candor, documented in writing as facts develop.
7.3 Particular cases are resolved as follows. (a) Subprocessor breach: where the Developer's vendor is compromised and Platform Data was in the vendor's systems, the Developer notifies as if the Developer's own systems were breached; the vendor's fault is not a defense to the notice duty, though the fact may mitigate enforcement. (b) Systems holding no Platform Data: a breach of the Developer's systems that did not touch Platform Data creates no duty under this document, but the Developer shall state so in writing if the Company inquires; silence in response to an inquiry is treated under Article 7.1. (c) Ransomware: encrypted systems holding Platform Data are a Breach for notice purposes unless the Developer demonstrates, with evidence, that the data could not have been accessed; encryption of the data by the attacker counts as acquisition. (d) Developers that are also Sellers: seller-side notice duties apply in parallel; satisfying one duty does not satisfy the other where both are implicated.
Article 8: Liability
8.1 Exclusion of certain damages. To the fullest extent permitted by law, neither party is liable to the other for indirect, incidental, special, punitive, or consequential damages, or for lost profits, lost revenue, or loss of goodwill, arising out of or relating to this document, even if the party has been advised of the possibility of those damages.
8.2 Cap. To the fullest extent permitted by law, the Company's total liability arising out of or relating to this document shall not exceed the greater of (a) the amounts the Developer paid to the Company under this document in the twelve months before the event giving rise to the claim, or (b) one hundred dollars ($100).
8.3 Carve-outs. This Article does not limit (a) a party's indemnification obligations under this document; (b) liability for fraud or willful misconduct; (c) amounts owed for Orders, fees, chargebacks, or refunds under the Company's documents, and costs allocated under Article 5.3; or (d) liability that cannot be limited under applicable law.
8.4 Essential purpose. The parties agree that this Article allocates risk between them, that it is an essential part of the basis of their bargain, and that it applies even if a limited remedy fails of its essential purpose.
Article 9: Indemnification
9.1 Duty. The Developer shall indemnify, defend, and hold harmless the Company and its members, managers, employees, and agents from and against every claim, demand, action, loss, liability, judgment, settlement, cost, and expense (including reasonable attorneys' fees) arising out of or relating to: (a) the Developer's breach of this document, including a failure to notify, a failure to contain, and concealment under Article 7; (b) the Developer's Applications, services, listings, or content; (c) the Developer's violation of any law or of the rights of any person; and (d) taxes for which the Developer is responsible under the Company's documents.
9.2 Procedure. The Company shall give prompt written notice of a claim under this Article. The Developer shall control the defense with counsel reasonably acceptable to the Company. The Company may participate in the defense at its own expense. The Developer shall not settle a claim in a manner that imposes any obligation or restriction on the Company, or that does not release the Company fully, without the Company's prior written consent.
9.3 Survival. This Article survives the termination of this document.
Article 10: Enforcement and Appeals
10.1 Investigation. The Company may investigate any suspected violation of this document, including the timeliness and completeness of a notice under Article 3. The Developer shall cooperate with an investigation and shall produce the records this document requires the Developer to keep.
10.2 Notice. If the Company determines that the Developer has violated this document, the Company shall give written notice stating the provision violated and the facts relied on, except where notice would compromise an investigation of fraud, a safety risk, or a legal obligation.
10.3 Opportunity to cure. Where a violation is capable of cure, the Developer has ten (10) business days from notice to cure it and to confirm the cure in writing. No cure period applies to fraud, concealment under Article 7, a safety risk, unlawful conduct, or a violation that by its nature cannot be cured. Failure to notify within the windows in Article 3 is a material breach of this document.
10.4 Measures. If a violation is established and is not cured within the period allowed, the Company may, proportionate to the violation: (a) issue a written warning; (b) suspend the Developer's keys, webhooks, Applications, or program participation, in whole or in part, including immediate suspension under Article 6.3 during an investigation; (c) terminate this document and the Account; and (d) exercise any other right or remedy available under this document or at law. Procedure for suspension, termination, and credential measures is governed by the Partner Suspension, Termination and Appeals.
10.5 Appeal. The Developer may appeal a measure under this Article by written notice to legal@aapawz.com within thirty (30) days of the measure, stating the grounds and attaching the records relied on. The appeal is decided by a person who did not make the original decision. The Company's decision on appeal is final. A measure remains in effect during an appeal unless the Company directs otherwise in writing.
10.6 No waiver by delay. The Company's delay in acting on a violation is not a waiver of the violation or of any later violation of the same kind.
Article 11: Term and Termination
11.1 Term. This document takes effect when the Developer first holds Platform Data and continues until terminated under this Article. The duties in this document apply to a Breach discovered after termination if the compromise occurred while the Developer held Platform Data.
11.2 Termination by the Company. The Company may terminate this document and the Account on thirty (30) days' written notice for any reason, and immediately on written notice if the Developer materially breaches this document, engages in fraud or concealment, or becomes ineligible to participate.
11.3 Termination by the Developer. The Developer may terminate this document on thirty (30) days' written notice to support@aapawz.com, provided the Developer holds no Platform Data and has no incident or investigation outstanding.
11.4 Effect of termination. On termination: (a) the rights granted under this document end; (b) obligations that arose before termination: including notification, cooperation, cost, record-keeping, and indemnification obligations: survive until satisfied; and (c) the Company shall disburse amounts owed, less amounts the Company may set off under the Company's documents, within thirty (30) days, except amounts held in connection with an open investigation or dispute.
11.5 Survival. The Definitions, Liability, Indemnification, Enforcement and Appeals (for measures taken before termination), Dispute Resolution, and General Provisions Articles survive termination.
Article 12: Dispute Resolution
12.1 Any dispute arising out of or relating to this document, or to the relationship it governs, is governed by the Dispute Resolution Policy, which is incorporated into this document by reference.
Article 13: General Provisions
13.1 Amendments. The Company may amend this document by posting the amended document in the Document Center and giving notice to the Developer at the email address in the Account. An amendment that materially increases the Developer's obligations takes effect thirty (30) days after notice; other amendments take effect on posting. Continued use of the Platform after the effective date of an amendment is acceptance of it. If the Developer does not accept an amendment, the Developer's remedy is to terminate under Article 11 before the amendment takes effect.
13.2 Notices. Breach notices under Article 3 and legal notices under this document shall be sent to legal@aapawz.com. Operational notices and all other communications shall be sent to support@aapawz.com. A notice to the Company is effective when the Company acknowledges receipt or, for email, one business day after sending, whichever is earlier; the twenty-four (24) hour period in Article 3.1 runs from confirmation of the Breach, not from the effectiveness of the notice. Notices to the Developer are effective when sent to the email address in the Account or posted to the Account's notice facility in the portal, whichever occurs first. The Developer shall keep the email address in the Account current.
13.3 Governing law. This document is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules. Subject to the Dispute Resolution Policy, any proceeding arising out of this document shall be brought in the state or federal courts located in Shelby County, Tennessee, and the parties consent to personal jurisdiction there.
13.4 Severability. If any provision of this document is held unenforceable, the provision shall be enforced to the fullest extent permitted, and the remaining provisions continue in full effect.
13.5 Entire agreement. This document, together with the documents it incorporates by reference, is the entire agreement between the Company and the Developer for the subject it governs and supersedes every prior or contemporaneous statement, communication, or agreement on that subject, whether written or oral.
13.6 Assignment. The Developer shall not assign this document or any right or obligation under it without the Company's prior written consent, and an assignment without consent is void. The Company may assign this document to an affiliate or in connection with a sale of all or part of its business, on notice to the Developer.
13.7 Waiver. A waiver of any provision of this document is effective only in writing and only for the instance stated. No waiver is a waiver of any other provision or instance.
13.8 Interpretation. Headings are for convenience only. "Including" means "including without limitation." This document shall not be construed against a party as its drafter. The English-language text controls over any translation.