About this document

These terms are between Orrerie LLC, a Wyoming limited liability company ("Orrerie", "we"), and the business that signs up for Orrerie Merchant ("you"). They cover the merchant dashboard at merchant.orrerie.com, the checkout and payer pages at pay.orrerie.com, the developer API at api.orrerie.com, webhooks and the plug-ins.

What Orrerie is, and what it is not

Orrerie Merchant is software, and Orrerie runs one co-signer for your wallets. Orrerie is not a holder of your funds, and not a bank, an exchange, a payment institution or an escrow. Payments are delivered into wallets you control, straight from your buyers or through Relay (section 3). Before a payment arrives, Orrerie's servers decide where it is sent: the address a buyer is shown, and the wallet Relay is told to deliver to, are chosen on Orrerie's side with none of your keys involved. Your keys protect money once it is in your wallet. Orrerie cannot reverse, refund or freeze a payment, and it cannot move your money.

Your keys

Each of your wallets is controlled by three keys: the first, the browser key, unlocked in your browser with your passkey (or your wallet password); the second, Orrerie's co-signer key, held by the server, which can never spend alone; and the third, your recovery key, made by the Orrerie app on your phone from a one-time code and kept in that app's own backup words (only its public part leaves the phone). Any two of the three can move your money. If you lose two of them, your money is lost: Orrerie cannot recover your keys and cannot move your money for you. The browser key backup must be saved, and the Orrerie app must confirm the recovery key it made, before your first real payment; until the app confirms it, Orrerie's co-signer signs nothing for your business. When the app confirms it, every Owner is emailed which Orrerie app account confirmed it. If your own Orrerie app did not show Recovery key confirmed, freeze sending and take no payments into those wallets: the code that confirmed it may hold two of your three keys.

What your app's backup words can do. The recovery key is made from the Orrerie app's 12 backup words, which also restore your own Orrerie wallet. Anyone who has those words and your browser key backup with its password can move your business's money without Orrerie. Keep the backup file off your phone and apart from the words. If the words may have been seen, replace the recovery key from the dashboard with an Orrerie account that has new backup words: a key made again from the same words is the same key to whoever saw them.

What this protection cannot stop. In the dashboard your browser key is opened by code that Orrerie's web server sends on every visit, and the passkey prompt shows only the site's name, not what you are approving. So a break-in that replaces the dashboard's code and also controls Orrerie's co-signer can take the funds of a business that approves anything while it lasts. A break-in at only one of the two is held by the co-signer's rules (section 4): saved addresses only, a 24-hour wait on a new one, your daily limits, and the waits on a change of your wallets' owners. An outside monitor compares the pages served with the signed release every 5 minutes and stops co-signing for every business when they differ; it finds a break-in, but cannot prevent one in the minutes before. To move a large amount without any page served by Orrerie, use the downloadable Recovery tool with two of your own keys. A Solana or TRON wallet that is not yet activated shows "Not activated", has no address in the dashboard and is used for nothing, because until it is activated your browser key alone would guard it.

Incoming payments are directed by Orrerie's servers. When a buyer pays through Relay or from the Orrerie app, the address the payment goes to, and the refund address Relay is given, are chosen on Orrerie's side with no key of yours involved. Two separate parts of Orrerie must agree (your business's own co-signer signs the address, and a second part checks that signature before Relay is asked), and an outside monitor compares them with the wallets your browser key registered; but a break-in at both, or of the checkout page itself, can send a payment elsewhere before it reaches your wallet. Your keys protect money once it has arrived.

Relay, the routing company

When a buyer pays in an asset or on a network other than the one you settle in, the payment is routed by Relay, a separate company. Relay holds the payment while it routes it, and takes its own fee, which the checkout shows before the buyer pays. A buyer who sends the wrong asset, the wrong network or to an expired address may lose the money, and Relay may stop a payment its own checks flag without returning it automatically. Orrerie does not control Relay and is not responsible for Relay. A payment counts as paid only when your own wallet's chain shows it arrived.

A buyer can always send coins to an address they were shown. What stops during an outage, of Orrerie or of a network or provider it reads, is Orrerie noticing the payment and telling you, not the money arriving: a payment sent to your own wallet's address arrives there whether or not Orrerie sees it at that moment, and is shown once Orrerie reads it.

What the co-signer will refuse

The co-signer adds Orrerie's signature only when the rules of your account allow it. It refuses: a payment to an address that is not one of your saved addresses (except a refund to the buyer's own claimed address or Orrerie wallet, within its limits); a saved address in its first 24 hours; a destination on a sanctions list, or one that could not be checked in the last hour; anything above your tier's limits or your own safety limit; a change to a wallet's owners outside the waiting periods; and every send while you or Orrerie have frozen sending.

A refusal is not a freeze of your money. Your money stays in your wallets. With your browser key backup and your Orrerie app's backup words you can move it in the downloadable Recovery tool without Orrerie at all.

When Orrerie stops co-signing, and how you are told. Beyond the rules above, Orrerie stops adding its signature only in these cases:

1. For every business at once, when Orrerie's outside monitor finds that the pages served at merchant.orrerie.com differ from the signed release, or cannot reach them from any of its networks: until Orrerie has looked and cleared it. A send approved meanwhile is refused with "Co-signing is stopped for every business while Orrerie checks the pages it serves. Nothing was signed."

2. For your business, while a change to its keys waits: a passkey made through email recovery holds all money out for 72 hours; a new browser key waits 72 hours, during which payouts to others wait and withdrawals to your own saved addresses go on; a new recovery key made without the old one waits 7 days with no money out, and a new recovery key is not used until the Orrerie app confirms it. Every Owner is emailed when the wait starts and again during it, with a link to cancel, and a wait starts only once that email has been accepted for delivery.

3. For your business, when it is restricted (Acceptable Use, section 5): new orders and payouts to others stop, and withdrawals to your own saved addresses go on. Every Owner is emailed the reason and how to reply.

4. For your business alone, only when it is itself found on a sanctions list and a lawyer instructs us (section 9): all co-signing stops, and the dashboard says "Orrerie has stopped co-signing for this business. Your funds can still be moved with two of your own keys in the Recovery tool."

In none of these cases does Orrerie hold or move your money; you can always move it with two of your own keys in the Recovery tool.

Tiers, limits and business verification

Every business starts Unverified. Verifying your business through Didit, a separate identity company, makes it a Verified business with higher limits. Verification is optional; without it your account keeps the Unverified limits.

One order, at most. Unverified: US$1,000. Verified business: US$50,000.

Paid orders, rolling 30 days. Unverified: US$5,000. Verified business: US$250,000.

Paid orders, lifetime. Unverified: US$20,000, then verification is needed to create new orders. Verified business: no limit.

Open orders at once. Unverified: 50. Verified business: 2,000.

First 3 paid orders. Unverified: US$250 each. Verified business: no such cap.

Payouts to others, rolling 24 hours. Unverified: US$1,000, one at a time. Verified business: US$100,000, batches up to 200 rows (50 when sent from an EVM network).

Refunds to the buyer without a wait, rolling 24 hours. Unverified: US$1,000. Verified business: US$100,000.

Withdrawals to your own saved addresses. Unverified: no tier limit. Verified business: no tier limit.

Team members. Unverified: 2. Verified business: 25.

A tier never stops you withdrawing your own money to your saved addresses. Your own safety limit on those withdrawals starts at US$10,000 a day (US$100,000 Verified); you can lower it at once, and raise it after 24 hours.

A Verified business confirms its details again 24 months after approval; if it does not, 30 days after that date its account returns to the Unverified limits. A change of legal name, country or registration number, or the verified representative leaving, also asks for a new check. We may change the limits; a lowering for safety applies at once, and any other change is announced 30 days ahead.

Acceptable use

Acceptable Use is part of these terms, in full: what you may not sell (its section 1), what you may sell only as a Verified business after our written yes (2), the countries not served (3), the rules for every business (4), and restriction, notice and appeal (5).

Fees

Orrerie Merchant's fee is 0% today. If we charge a fee later we will tell you at least 30 days before it applies, in the dashboard and by email, and say how it is taken: on routed payments as Relay's app fee, taken from the buyer's side before delivery; on direct payments as a monthly fee order to Orrerie that you pay like any other order. Network fees and Relay's fee are not Orrerie's and are shown where they apply.

You are the seller

You are the seller of what you sell. You handle taxes, licences, consumer rights, refunds, disputes with buyers and the claims you make about your products. Orrerie is not a party to your sale.

Sanctions

You promise that you, your owners and your business are not on a sanctions list and are not located in a country or region we do not serve. Payments to your checkout are checked against sanctions lists. A payer's address is screened once the money has arrived, because only then is the sender known, so screening can flag a payment but cannot prevent one. When a payment comes from a listed address, Orrerie holds the order (it is not marked paid to your systems), tells you, and will not co-sign a send to that address; only Orrerie can clear a hold found to be a mistake. Orrerie gives no legal advice about funds you hold from such a payment; speak to a lawyer. If your own business is found on a sanctions list, Orrerie may stop co-signing for your account altogether; you can still move your money with two of your own keys in the Recovery tool.

Your customers' data: the data-processing agreement

For the personal data of your customers that you keep in Orrerie Merchant (names, emails, postal addresses, notes, receipts):

1. Roles. You decide what is collected and why (the controller); Orrerie stores and processes it only for you (the processor).

2. Instructions. Orrerie processes it only to run your account as these terms describe, and on your documented instructions given through the dashboard and the API.

3. Security. Orrerie protects it by the measures of its security design: encryption at rest, encrypted fields for names, emails, postal addresses and notes, access by role, an append-only activity log, and staff access only for support or review, each look logged with its reason.

4. Sub-processors. The providers that may handle it are those listed in the Providers document; we tell you before adding one.

5. Deletion. You can delete a customer's personal details at any time. When your account closes, customer records are deleted 90 days later.

6. Requests. We help you answer your customers' requests to see, correct or delete their data.

7. Breaches. We tell you without undue delay, and within 72 hours of becoming aware, of a breach that affects your customers' data.

API and webhooks

The API and webhooks are for running your own business with Orrerie Merchant, under the acceptable-use rules. They have rate limits (60 requests a minute Unverified, 600 Verified); exceeding them is refused, not queued. They come with no warranty of uptime. Keeping your API secrets and webhook secrets secret is your duty; verify every webhook's signature and read the order back before you ship.

Suspension, restriction, closure and appeal

We may restrict your account for the reasons and in the way of Acceptable Use, section 5, and you may answer within 5 working days. You can close your account at any time from the dashboard; closing takes 30 days, during which you can still sign in, withdraw to your saved addresses, export and cancel the closure. What survives closure: your wallets and the money in them (they exist as long as your keys do), what is recorded on public blockchains, records we must keep, the closed account's identifier and public address (never given to anyone else), and sections 1, 2, 8, 9, 10 and 13 of these terms.

Warranty, liability and law

We provide Orrerie Merchant with reasonable care and skill, and no other warranty. To the extent the law allows, our liability to you for any claim is limited to the fees you paid Orrerie in the 12 months before it (and so is nothing while the fee is 0%), and we are not liable for losses we could not reasonably foresee, for anything Relay or a blockchain does, or for lost keys. These terms are governed by the law of Wyoming. Mandatory protections of the law where you are still apply. There is no arbitration clause and no class-action waiver. You use Orrerie Merchant as a business, not as a consumer.

Apps and stores

If you sell anything that unlocks content or features inside an iPhone or Android app, you must follow that store's payment rules; you are responsible for your own app, and we will act on a store's complaint (Acceptable Use, section 1, item 15).