Shatale SASU — SIREN 105 278 964 · RCS Montpellier 105 278 964 · TVA FR54105278964 · 623 Rue du Devois, 34160 Saint-Drézery, France ("Shatale")
Between Shatale and the entity identified in the Order Form ("Publisher"). Governing law: France — Tribunal de Commerce de Paris. Effective date: as specified in the Order Form.
What Shatale is. Shatale buys from merchants in its own name for the End User’s account when a Publisher’s AI agent makes a purchase, and sells plans for the Publisher’s AI agent as the Publisher’s distributor. Shatale operates no wallet, no stored balance and no payment account. Shatale is not a bank, electronic money institution, payment institution or acquirer, and does not hold End Users’ funds on their behalf. Cards are issued under the card programme of a regulated EU card-issuing partner. Shatale is PCI DSS 4.0.1 (Level 1) certified.
1.1. Capitalised terms have the meanings below. Terms not defined here have the meaning given in the Order Form or the Card Scheme Rules.
| Agent | An AI agent supplied by the Publisher and integrated with the Platform that an End User has authorised, with Shatale, to request purchases on the End User’s behalf. |
| Agent Purchase | A purchase of goods or services from a merchant requested by an Agent for an End User, made by Shatale under clause 4.1. |
| Agent Plan | A paid plan for the use of a Publisher’s Agent, sold to an End User by Shatale as the Publisher’s distributor under clause 4.2. |
| Card Credential | The details of a Shatale card provided to an Agent for one Agent Purchase, limited for that purchase to its amount, its currency and a short period, and locked outside it. |
| Card Scheme Rules | The rules and standards of the card networks (including Visa and Mastercard) applicable to the card programme. |
| Cardholder Data | Has the meaning given in PCI DSS, and includes Card Credentials. |
| End User | A natural person or legal entity holding an account with Shatale who has authorised one or more Agents. |
| End-User Terms | Shatale’s documents accepted by End Users in Shatale’s own flows, including the End-User Terms, the Purchasing Mandate, the Card-on-File Consent, the Refund, Return & Non-Delivery Policy and the Shatale Privacy Notice, as published by Shatale from time to time. |
| Limits | The approval threshold, ceiling, period budgets and allowed categories an End User sets for each Agent. |
| Order Form | The order form signed by the parties, which sets out Fees, commission, chargeback fees and other commercial terms and forms part of this Agreement. |
| Platform | Shatale’s REST API, MCP server, policy engine, approval flow and records, through which Agents request Agent Purchases and End Users subscribe to Agent Plans. |
| Publisher Policy | Rules the Publisher configures on the Platform for its Agents, which may only narrow an End User’s Limits. |
| Regulated Partner | The regulated EU card-issuing partner under whose card programme Shatale’s cards are issued, and any regulated partner Shatale engages in its place. |
| Statement | Shatale’s monthly statement to the Publisher under clause 8.9. |
2.1. The Platform lets an Agent request an Agent Purchase for an End User who has authorised it. Shatale evaluates the End User’s Limits and the Publisher Policy when the request is made and again when the card authorisation reaches the network, obtains the End User’s approval in the Shatale app where the Limits require it, and records each request, approval and decision.
2.2. No wallet or stored balance. Shatale operates no wallet, stored balance or payment account for End Users or Publishers. An End User reimburses Shatale for an Agent Purchase by a pre-authorisation on the End User’s own card, captured after the merchant has been paid and never above the amount authorised.
2.3. Regulatory status. Shatale is not a bank, electronic money institution, payment institution or acquirer, and does not hold End Users’ funds on their behalf. Shatale’s cards are issued under the card programme of the Regulated Partner. Shatale is PCI DSS 4.0.1 (Level 1) certified.
2.4. Shatale may change the Regulated Partner. Shatale will give the Publisher at least thirty (30) days’ written notice of a change that affects the Publisher’s integration, except where the change is required by law, by the Card Scheme Rules or by a competent authority.
3.1. The Publisher supplies its Agents and the content of any Agent Plan. The Publisher is not the seller in an Agent Purchase, not the End User’s payment provider and not a party to an Agent Purchase. The End User’s contract for Agent Purchases and Agent Plans is with Shatale under the End-User Terms.
3.2. The Publisher warrants that it holds, and will maintain throughout the Term, all licences, permits and registrations required for its own business and services in every jurisdiction where it offers them.
3.3. The Publisher’s own terms for its Agent service must not contradict the End-User Terms, must describe the Agent and what it may do, and must direct End Users to Shatale for any matter concerning an Agent Purchase, an Agent Plan payment, a refund or a dispute.
3.4. The Publisher shall comply with all laws, regulations and Card Scheme Rules applicable to it, including anti-money-laundering and counter-terrorist-financing rules, sanctions (EU, UK, US OFAC, UN), data protection (including the GDPR and the ePrivacy Directive), consumer protection and advertising rules.
3.5. Responsibility for Agents. As between the parties, the Publisher is responsible for the design, configuration, instructions, outputs and consequences of its Agents, including errors, hallucinations and unintended purchases. Shatale remains answerable to End Users under the End-User Terms and recovers from the Publisher under Section 10.
4.1. Purchases made by an AI agent. When an AI agent integrated with the Platform buys goods or services for an End User, Shatale purchases them from the merchant in its own name and for the End User’s account, as commissionnaire à l’achat (Article L132-1 of the French Commercial Code). The merchant remains the seller of those goods or services. The Publisher is not a seller to the End User, not the End User’s payment provider and not a party to the purchase.
4.2. Plans for the Publisher’s AI agent. Where an End User subscribes through Shatale to a paid plan for the Publisher’s AI agent, Shatale acquires from the Publisher the right to supply that plan and sells it to the End User in its own name, as the Publisher’s distributor: the End User buys the plan from Shatale, pays Shatale and receives Shatale’s receipts. Shatale pays the Publisher the supply price for each plan sold, as set out in Section 8, against the Publisher’s invoice for the amount stated in Shatale’s Statement. The Publisher remains responsible for the agent and for what the plan includes.
4.3. The Publisher shall NOT represent, market, advertise, or describe Shatale as a bank, card issuer, acquirer, payment service provider, electronic money institution or any other form of regulated financial institution. Any such misrepresentation shall constitute a material breach of this Agreement.
4.4. Billing Descriptor: transactions under this Agreement appear on End User payment card statements under the descriptor set by Shatale and the applicable Regulated Partner — currently the prefix “SHAT” and an asterisk, followed by the name of the seller — in compliance with Card Scheme Rules. The Publisher shall not alter, or ask an End User to expect, any other descriptor.
4.5. Any breach of clause 4.3 or 4.4 shall entitle Shatale to suspend API access immediately without liability and may result in Card Scheme fines being passed through to the Publisher pursuant to Section 10.
5.1. End Users accept the End-User Terms, authorise Agents, set their Limits and give their card-on-file and purchasing-mandate consents in Shatale’s own flows (the Shatale app and user console). Shatale records each acceptance with its version.
5.2. The Publisher shall send End Users to those flows through the links and interfaces Shatale provides. It shall not reproduce, alter, pre-fill or collect any of those consents on Shatale’s behalf, and shall not collect an End User’s own card details.
5.3. The Publisher shall keep records of its Agents’ requests to the Platform and of the instructions behind them for at least six (6) years and provide them to Shatale within five (5) business days of a written request.
5.4. A breach of this Section may result in immediate suspension of API access and constitutes a material breach of this Agreement.
6.1. Approvals required by an End User’s Limits are given by the End User in the Shatale app, outside the Agent’s channel. Strong Customer Authentication is performed by the End User with Shatale, the Regulated Partner or the End User’s card issuer, as applicable.
6.2. The Publisher and its Agents shall not intercept, simulate, automate or ask an End User to share an approval, a one-time code or any authentication step, and shall not render, overlay or modify any approval or authentication screen unless Shatale supplies it for that purpose. A breach entitles Shatale to suspend API access immediately and may be reported to the Regulated Partner and the card networks.
7.1. Each End User sets the Limits for each Agent. A Publisher Policy may only narrow an End User’s Limits; neither the Publisher nor an Agent may raise a Limit an End User has set.
7.2. The Publisher may configure a Publisher Policy on the Platform, including per-purchase and period limits and prohibited categories. Categories prohibited by Shatale’s platform policies apply in every case.
7.3. End Users view, change and revoke an Agent’s authorisation and Limits in the Shatale app and user console. The Publisher shall not obstruct or discourage this.
7.4. An Agent may use a Card Credential only to complete the Agent Purchase for which it was provided. It shall not store, log, reuse or transmit a Card Credential to anyone other than the merchant’s checkout for that purchase. Schedule A applies.
7.5. Shatale may impose additional controls on an Agent, including velocity limits and suspension of the Agent’s access, where it reasonably considers that the Agent’s behaviour presents a material risk of fraud, regulatory breach or breach of the Card Scheme Rules. Shatale will use reasonable endeavours to give prior notice, but may act without notice where immediate action is required.
8A Fees payable by the Publisher
8.1. The Publisher shall pay the fees set out in the Order Form (“Fees”), denominated in EUR unless the Order Form states otherwise.
8.2. Fees are stated exclusive of VAT and other applicable taxes, which the Publisher shall pay in addition.
8.3. Shatale invoices Fees as set out in the Order Form. The Publisher shall pay each invoice within thirty (30) days of its date unless the Order Form states otherwise.
8.4. Overdue amounts bear interest at the rate prescribed by Article L441-10 of the French Commercial Code from the day after the due date, plus the fixed recovery indemnity of EUR 40 per invoice under Article D441-5.
8.5. Shatale may suspend API access on fourteen (14) days’ written notice if an amount remains unpaid after its due date. Suspension does not relieve the Publisher of its payment obligations and is not termination.
8.6. Shatale may change the Fees on at least sixty (60) days’ written notice. If the Publisher does not accept the change, it may terminate this Agreement on thirty (30) days’ written notice given within that period.
8B Agent Plan revenue and payouts
8.7. Shatale sells Agent Plans in its own name under clause 4.2. The price an End User pays for an Agent Plan is Shatale’s revenue; the Publisher is paid the supply price under clause 8.8.
8.8. Supply price. For each Agent Plan payment, the supply price payable to the Publisher is the full price paid by the End User, including VAT, less Shatale’s margin set out in the Order Form (the “Commission”: seven per cent (7%) of that full price, unless the Order Form states otherwise). VAT is extracted from the price at the End User’s applicable rate.
8.9. Statement. For each calendar month (UTC) Shatale issues a Statement showing the Agent Plan payments received, refunds and chargebacks, the Commission, the supply price, chargeback fees, any set-off under clause 8.11 and the amount due to the Publisher.
8.10. Payout. The Publisher invoices Shatale for the amount stated in the Statement. Shatale pays that amount within thirty (30) days of receiving a valid invoice; without an invoice, no amount is payable. No minimum payout threshold applies unless the Order Form states otherwise.
8.11. Set-off. Shatale may set off against any amount due to the Publisher: (a) chargeback fees under clause 9.5; (b) amounts recoverable under Section 10, including amounts Shatale has refunded to End Users for losses caused by an Agent; and (c) unpaid Fees. Any balance remaining in Shatale’s favour is invoiced to the Publisher and payable under clause 8.3.
9.1. Shatale is the End User’s single point of contact for any matter concerning an Agent Purchase or an Agent Plan payment, including refunds, returns, non-delivery and chargebacks. The Publisher shall direct End Users who contact it about such a matter to Shatale.
9.2. The Publisher shall give Shatale the information and cooperation it reasonably requests about an Agent’s actions, within the time Shatale specifies to meet Card Scheme deadlines (typically twenty (20) to forty-five (45) days from a chargeback notification).
9.3. Agent Purchases. Shatale pursues the merchant for cancellations, returns, refunds and card-scheme disputes. Where a loss was caused by an Agent (for example a wrong merchant or product, an unintended or hallucinated purchase, or a purchase of prohibited goods), Shatale makes the End User whole under the End-User Terms and recovers the loss from the Publisher under Section 10.
9.4. Agent Plans. Refunds to End Users for Agent Plans are made by Shatale and deducted in the next Statement.
9.5. Chargebacks on Agent Plans. For each chargeback on an Agent Plan payment the Publisher pays the chargeback fee set out in the Order Form (at the date of this version: EUR 20 for each dispute received and EUR 20 if it is contested, the contest fee being refunded if the dispute is won). Shatale’s commission on the payment is retained.
9.6. The Publisher shall keep the chargeback ratio of its Agents and Agent Plans below the thresholds set by the Card Scheme Rules or the Regulated Partner. Persistent breach may result in suspension or termination.
10.1. The Publisher shall indemnify Shatale SASU and its officers, employees and agents against all claims, losses, liabilities, damages, costs, fines, penalties and expenses, including reasonable legal fees (“Losses”), arising from:
(a) an Agent’s acts, outputs or omissions, including wrong merchants or products, unintended or hallucinated purchases and purchases of prohibited goods, and any amount Shatale refunds or pays to an End User because of them;
(b) claims about the Publisher’s services or the content of an Agent Plan;
(c) chargebacks, Card Scheme fees and fines attributable to the Publisher or its Agents;
(d) a security incident in the Publisher’s environment, including any exposure of a Card Credential, and the resulting fines, forensic and notification costs;
(e) the Publisher’s processing of personal data in breach of data protection law;
(f) a breach of sanctions or anti-money-laundering obligations by the Publisher;
(g) a misrepresentation by the Publisher of Shatale’s role, regulatory status or relationship with End Users.
10.2. The Publisher’s obligations under this Section are not subject to the limitation in clause 11.1 and are uncapped.
10.3. Shatale shall give the Publisher prompt written notice of a claim and reasonable cooperation in its defence. The Publisher shall not settle a claim in a way that imposes an obligation on, or adversely affects, Shatale without Shatale’s prior written consent, not to be unreasonably withheld or delayed.
11.1. Subject to clause 11.3, Shatale’s aggregate liability to the Publisher under or in connection with this Agreement shall not exceed the greater of (a) the Fees paid by the Publisher in the twelve (12) months before the event giving rise to the claim and (b) EUR 10,000. This limit does not apply to amounts due to the Publisher under a Statement.
11.2. To the fullest extent permitted by law, Shatale is not liable for indirect, consequential, special or punitive loss, loss of profit, revenue, business, contracts, anticipated savings, goodwill or data.
11.3. Nothing in this Agreement limits or excludes liability for fraud (dol), wilful misconduct, gross negligence (faute lourde), death or personal injury caused by negligence, or any liability that cannot be limited under French law.
11.4. The limitation in clause 11.1 applies only to Shatale’s liability to the Publisher. It does not limit the Publisher’s obligations under Section 10, nor Shatale’s obligations to End Users under the End-User Terms.
12.1. Shatale holds no account, balance or deposit for the Publisher. An amount stated as due in a Statement is a debt payable under clause 8.10.
12.2. No reserve applies at the date of this version. Any reserve or holdback required by the Regulated Partner or agreed by the parties shall be set out in the Order Form.
13.1. Shatale may audit, or have audited, the Publisher’s compliance with this Agreement — including its Agents’ configuration, the records under clause 5.3 and its handling of Card Credentials — on at least ten (10) business days’ written notice, during business hours and without unreasonable disruption.
13.2. In the event of a suspected security incident, fraud or card-scheme investigation, Shatale may require an immediate audit, with which the Publisher shall cooperate fully.
13.3. Within five (5) business days of a written request the Publisher shall provide its PCI DSS evidence where Schedule A requires it, the records under clause 5.3, and documentation relevant to a dispute or chargeback.
13.4. Shatale may monitor API and MCP usage in real time and apply automated controls, including rate limits, transaction blocking and temporary suspension, where it detects patterns consistent with fraud, money laundering or breach of the Card Scheme Rules.
14.1 Immediate Suspension by Shatale
Shatale may suspend the Publisher’s access with immediate effect upon:
(a) material breach of this Agreement, including of Sections 4, 5, 6 or 7;
(b) suspected fraud, money laundering, sanctions breach or other criminal activity connected with the Publisher, its Agents or End Users;
(c) a breach of the Card Scheme Rules that creates a risk of fines or of termination of the card programme;
(d) an instruction from the Regulated Partner, a competent authority or law enforcement; or
(e) a security incident or suspected breach affecting Cardholder Data.
14.2. Shatale will notify the Publisher of a suspension as soon as practicable and give written reasons within five (5) business days.
14.3. Either party may terminate this Agreement on thirty (30) days’ written notice. Shatale may terminate immediately if required to do so by the Regulated Partner, the card networks or a competent authority.
14.4. Either party may terminate this Agreement for the other’s material breach that is not remedied within ten (10) business days of written notice specifying it.
14.5. On termination: (a) the Publisher’s access is revoked; (b) Shatale provides a data export facility for thirty (30) days, subject to legal retention obligations; (c) Shatale issues a final Statement and pays the amount due under it, net of set-off under clause 8.11, and all Fees become due; and (d) Sections 8, 9, 10, 11, 15 and 17 survive. Existing Agent Plans of End Users are handled as Shatale notifies End Users under the End-User Terms.
15.1. Each party shall keep confidential all non-public information disclosed by the other in connection with this Agreement that is identified as confidential or that a reasonable party would understand to be confidential, and shall not disclose it without the other’s prior written consent.
15.2. Each party may disclose such information to its employees, officers, professional advisers and contractors who need to know it and are bound by equivalent obligations.
15.3. These obligations do not apply to information that is or becomes public without breach, was rightfully known before disclosure, is received from a third party without restriction, or must be disclosed by law, regulation or court order (with prompt notice where permitted).
15.4. This Section survives for five (5) years after termination.
16.1. Shatale retains all rights in the Platform, the API, the MCP server, their documentation and its trade marks. The Publisher retains all rights in its Agents, services and content.
16.2. Subject to this Agreement and payment of the Fees, Shatale grants the Publisher a limited, non-exclusive, non-transferable, revocable licence to use the API and the MCP server so that its Agents can request Agent Purchases and End Users can subscribe to its Agent Plans through Shatale. The licence does not permit sub-licensing, white-labelling or resale of the Platform.
16.3. The Publisher shall not reverse-engineer, decompile or disassemble the Platform, create derivative works from it, or use it for the benefit of anyone other than End Users as contemplated by this Agreement.
17.1. Each party shall comply with applicable data protection law, including the GDPR.
17.2. Shatale is the controller of the personal data of End Users that it processes to provide its services to them, as described in the Shatale Privacy Notice. The Publisher is an independent controller of the personal data it processes for its own Agent service.
17.3. Where Shatale processes personal data on the Publisher’s documented instructions, it does so as processor and Schedule C applies.
17.4. The Publisher’s privacy notice must accurately describe the personal data it sends to Shatale and why.
17.5. Neither party shall transfer personal data outside the European Economic Area except in accordance with Chapter V of the GDPR.
18.1. Neither party is liable for a failure or delay caused by an event beyond its reasonable control within the meaning of Article 1218 of the French Civil Code, including natural disasters, epidemics, war, terrorism, government action, an outage of the Regulated Partner or a card network beyond Shatale’s control, a major cyber incident, or a sanctions or regulatory measure preventing performance.
18.2. The affected party shall notify the other promptly, mitigate the effects and keep the other informed. If the event continues for more than sixty (60) consecutive days, either party may terminate this Agreement on written notice without liability, other than for amounts already due.
19.1. This Agreement and any non-contractual obligations arising from it are governed by French law.
19.2. The Tribunal de Commerce de Paris has exclusive jurisdiction over any dispute arising from this Agreement.
20.1. Entire agreement: this Agreement, the Order Form and the Schedules are the entire agreement between the parties on their subject matter and supersede all prior discussions and agreements.
20.2. Severability: an invalid or unenforceable provision is modified to the minimum extent needed to make it enforceable; the rest remains in force.
20.3. Waiver: a failure or delay in exercising a right is not a waiver of it.
20.4. Assignment: the Publisher may not assign or transfer this Agreement without Shatale’s prior written consent. Shatale may assign it in connection with a merger, acquisition, restructuring or sale of its business, with written notice within thirty (30) days.
20.5. Notices: by email with read receipt to the addresses in the Order Form, or by recorded post to the registered office; deemed received on the next business day (email, receipt confirmed) or three (3) business days after posting.
20.6. Amendments: only in writing signed by both parties, or agreed electronically with an audit trail.
20.7. Language: English prevails over any translation.
20.8. Relationship: Shatale acts towards End Users as set out in Section 4. Nothing in this Agreement creates a partnership or joint venture, and neither party may bind the other except as this Agreement expressly provides.
20.9. Third parties: End Users are not third-party beneficiaries of this Agreement; their rights are set out in the End-User Terms.
PCI DSS and Card Credentials
A.1. Shatale is PCI DSS 4.0.1 (Level 1) certified. End Users’ own card details are held only in Shatale’s certified environment and are never provided to the Publisher or its Agents.
A.2. A Card Credential is Cardholder Data. The Publisher and its Agents may handle a Card Credential only to complete the Agent Purchase for which it was provided, and shall not store, log or persist it.
A.3. Where the Publisher’s environment handles Card Credentials, the Publisher shall comply with PCI DSS at the level applicable to it, provide Shatale annually and on request with its Attestation of Compliance or Self-Assessment Questionnaire, notify Shatale within twenty-four (24) hours of an actual or suspected compromise, cooperate with any forensic investigation and bear the related costs.
A.4. Where Shatale provides interfaces that keep Card Credentials out of the Publisher’s environment, the Publisher shall use them as documented.
Card Scheme Compliance
B.1. The Publisher shall comply with the Card Scheme Rules applicable to its Agents’ use of Card Credentials, including on prohibited transaction types and transaction data. The billing descriptor is set under clause 4.4.
B.2. Any fine, penalty or assessment levied by a card network as a result of the Publisher’s or its Agents’ acts or omissions is passed through to the Publisher in full. Shatale provides documentation and the Publisher pays within thirty (30) days, or Shatale sets it off under clause 8.11.
Data Processing Addendum
C.1. This Schedule applies only where Shatale processes personal data on the Publisher’s documented instructions (clause 17.3). Shatale then processes it only on those instructions and for the purposes agreed in writing, and informs the Publisher if it considers an instruction unlawful.
C.2. Shatale implements appropriate technical and organisational security measures, engages sub-processors only with prior notice and equivalent obligations and remains liable for them, assists the Publisher with data subject requests, notifies the Publisher of a personal data breach affecting that data without undue delay and within forty-eight (48) hours, and keeps records of processing.
C.3. The processing details and security measures are set out in an annex to be agreed by the parties.
Acceptable Use
The Publisher shall not use, or let its Agents use, the Platform for:
(a) any unlawful purpose, including money laundering, terrorist financing, sanctions evasion or fraud;
(b) gambling, adult content, cryptocurrency exchange, firearms, tobacco or other categories prohibited by law, by the Card Scheme Rules or by Shatale’s platform policies;
(c) payments to sanctioned countries, entities or individuals;
(d) splitting purchases to avoid an End User’s Limits or authorisation thresholds;
(e) any purpose that would put Shatale or the Regulated Partner in breach of law, the Card Scheme Rules or regulatory requirements.
End Users choose the categories they allow; Shatale’s platform policies and the Publisher Policy may prohibit further categories. Restricted categories require Shatale’s prior approval.
Dispute Handling
| End User raises an issue | The End User contacts Shatale (clause 9.1). If the End User contacts the Publisher, the Publisher directs them to Shatale. |
| Agent Purchase problem | Shatale pursues the merchant (cancellation, return, refund, card-scheme dispute) and makes the End User whole under the End-User Terms. |
| Loss caused by an Agent | Shatale recovers the loss from the Publisher under Section 10, by set-off under clause 8.11 or by invoice. |
| Chargeback | Shatale handles the chargeback with the Regulated Partner; the Publisher provides evidence within the time Shatale specifies (clause 9.2). |
| Chargeback on an Agent Plan | The Publisher pays the chargeback fee under clause 9.5; Shatale retains its commission. |
| Card Scheme fine | Passed through to the Publisher where caused by the Publisher or its Agents (Schedule B). |