Customer Agreement

This is a translation for reference. If it differs from the Mongolian text, the Mongolian text prevails.

Version 1.0. Effective 1 November 2026. Accepted electronically in the Developer Console.

This agreement governs the relationship between Hi Commerce LLC (register no. 7180697, the "Provider") and any individual or legal entity registered for the 2fa.mn service (the "Customer"). By clicking "I agree" at sign-up, the Customer accepts this agreement and its annexes: the Acceptable Use Policy, the Data Processing Annex and the Tariff Annex. The agreement follows the Civil Code, the Law on Communications, the Law on Personal Data Protection, the Law on Consumer Rights Protection and the relevant rules of the Communications Regulatory Commission.

2.1. Definitions

1. End user: a person using the Customer's app or website who verifies their phone number.
2. MO SMS: a message sent by an End user to 150073.
3. MT SMS: a message sent by the Provider to an End user.
4. SESSION: verification with a one-time code valid for 5 minutes.
5. RULE: a message with a fixed prefix that triggers an action in the Customer's system.
6. Successful verification: an MO SMS that matches an active SESSION or RULE and whose charge the operator has confirmed.
7. Operator: Mobicom, Unitel, Skytel, G-Mobile, Lime, ONDO, Toki, Kaos and any other mobile operator that carries number 150073.
8. API key: the secret key that identifies the Customer to the system.

2.2. The service

1. The Provider receives End users' MO SMS and sends the result to the Customer's system by API and by HMAC-signed webhook.
2. The Customer uses the service to verify phone numbers, for sign-up, login, transaction confirmation, service activation and account linking.
3. MT SMS is used only to reply to an End user's MO SMS or to send a notice about that user's verification. No bulk or marketing MT SMS is sent.

2.3. Registration, checks and API keys

1. The Customer signs up in the Developer Console by verifying their own phone number by MO SMS, and gives true and complete details.
2. For high volume, suspicious activity, or where an Operator or the law requires it, the Provider may ask for a ДАН (DAN) identity check, a company registration certificate or other information. If it is not provided, the account is limited.
3. API keys must not be passed to third parties or published in source code or in public. If a key may be compromised, the Customer rotates it in the console at once. The Customer bears any loss from a compromised key.
4. The test environment is free.

2.4. Price, revenue share and settlement

1. The Customer pays no connection, monthly or other base fee.
2. The End user pays 150₮ (VAT included) per MO SMS, charged by the Operator.
3. For each Successful verification, the amount in the Tariff Annex is credited to the Customer's console balance.
4. Amounts are calculated only on messages the Operators have reconciled with and paid to the Provider. No amount is due for messages the Operator refunded to the user, failed to collect or removed at reconciliation; if already paid, it is deducted from the next payout.
5. The Provider settles each month by the end of the following month and transfers the amount to the Customer's registered bank account. Balances under 10,000₮ roll over to the next month.
6. For individual Customers, the Provider withholds the tax required by law. Legal entities are responsible for their own taxes.
7. The Provider is not liable for delays caused by wrong bank details entered by the Customer.
8. Amounts for traffic suspected of fraud or inflation are held until the review ends, for no more than 90 days. If fraud is confirmed, they are not paid.
9. Changes to the tariff or revenue share are notified 30 days ahead by console and email. If the change comes from an Operator's tariff change, the Operator's notice period applies.

2.5. Provider obligations

1. Aim for at least 99.9% monthly availability. Operator network outages are excluded.
2. Announce planned maintenance 3 days ahead, and critical incidents within 1 hour of detection, by status page and email.
3. Respond 24/7 to critical incidents, and within 4 business hours to other technical issues.
4. Retry failed webhooks up to 5 times and show their status in the console.
5. Show the Customer's traffic, earnings and settlement in the console in real time.

2.6. Customer obligations

1. Before the SMS button or link, clearly show "Send a message to 150073, price 150₮". Hide the button once verified. The Customer bears full responsibility for any claim or dispute caused by failing to show the price.
2. Do not make End users send unnecessary repeat messages for one verification.
3. Use the service in line with the Acceptable Use Policy.
4. State in its own privacy policy that phone numbers are verified through 2fa.mn.
5. Accept End user complaints and pass any that concern the Provider within 1 business day.
6. Update changed contact details in the console within 5 business days.

2.7. Operator requirements

1. Number 150073 operates under the Provider's contracts with the Operators. Requirements of the Operators and the Communications Regulatory Commission prevail over this agreement.
2. If an Operator blocks the number or traffic because of spam, fraud or user complaints, the Provider suspends the Customer concerned. This is not a breach of this agreement.
3. The Customer reimburses any penalty, refund or loss paid to an Operator or regulator because of the Customer's fault.
4. On request from an Operator or regulator, the Provider may provide the Customer's details and traffic reports within the limits of the law.

2.8. Suspension and termination

1. The Customer may close its account in the console at any time. The balance is paid in the next settlement period.
2. The Provider may terminate with 30 days' notice.
3. If the Customer breaches clauses 2.6, 2.7 or the Acceptable Use Policy, or fraud or illegal activity is found, the Provider may suspend or terminate without notice, and balances earned by fraud are not paid.

2.9. Liability

1. Each party is liable for direct loss caused by its breach of this agreement.
2. The Provider's total liability is capped at the amounts paid to the Customer in the previous 3 months. The Provider is not liable for lost profits or indirect loss.
3. The Provider is not liable for loss caused by Operator network outages or force majeure.
4. The Customer is fully responsible for its goods, services and relationship with End users.

2.10. Confidentiality and intellectual property

1. Neither party discloses confidential information learned under this agreement to third parties. This duty lasts 2 years after the agreement ends.
2. The 2fa.mn name, logo, software and API documentation belong to the Provider. The Customer uses the SDKs and documentation only to integrate the service.
3. The Customer may display "Verified by 2fa.mn".

2.11. Other terms

1. The Provider notifies changes to this agreement 30 days ahead. Changes required by law take effect on notice.
2. Disputes are settled by negotiation, and failing that by the Communications Regulatory Commission or the courts of Mongolia.
3. A company that wants a paper contract may sign one based on this agreement.

4. Acceptable Use Policy

Version 1.0. Part of the Customer Agreement. Number 150073 runs under the Operators' value-added messaging rules, so a breach of these rules can lead an Operator to block the number for every Customer.

4.1. Prohibited uses

1. Fraud, phishing, illegal use of another person's number or account, money laundering, terrorist financing, human trafficking.
2. Gambling, lotteries, betting, games of chance, prize contests.
3. Advertising, marketing or bulk messages.
4. Charging End users without consent, signing them up to subscriptions, or forcing them to send messages.
5. Hiding or misstating the price or purpose, or falsely calling it "free".
6. Creating fake traffic with SIM farms, bots or stolen SIMs, or making users send repeat messages to earn payouts.
7. Attacking the system, reverse engineering it, or technically bypassing rate or volume limits.
8. Infringing third parties' copyright, trademarks or personal data.
9. Adult content, content inciting violence or hatred, illegal goods or services.
10. Any use that breaks the law, the Operator contracts or the Communications Regulatory Commission's rules.

4.2. Mandatory rules

1. Clearly show the price (150₮), the number (150073) and the purpose before the SMS button.
2. Require one message per action. Do not ask for another after a successful verification.
3. MT SMS text must be 160 characters or less and contain no links or advertising.
4. Pass End user complaints to the Provider within 1 business day.

4.3. Monitoring and enforcement

1. The Provider monitors traffic automatically: unique senders, repeats per number, unusual hours, sudden spikes from one Operator.
2. If suspicious traffic is found, the Customer's access is suspended automatically, payouts are held and a person reviews the case.
3. If a breach is confirmed, access is terminated, the numbers and the Customer are blacklisted and the Operators are informed.
4. Report abuse to ceo@hihi.mn or 80085517.

5. Annexes

5.1. Data Processing Annex

Part of the Customer Agreement.

1. Roles: for verifying End users' phone numbers, the Customer is the data controller and the Provider processes data on its instructions. For billing reconciliation with Operators and fraud prevention, the Provider is an independent controller.
2. Data processed: phone number, operator, message text, code, date and time, verification result.
3. Limits: the Provider processes the data only for verification, billing and security, and never uses or sells it for other purposes.
4. Customer duty: tell End users in its own privacy policy that numbers are verified through 2fa.mn, and obtain any consent the law requires.
5. Staff: staff with access to the data are bound by confidentiality.
6. Sub-processors: the domestic cloud provider and the Operators. New ones are announced in the console 30 days ahead.
7. Location: data is stored in Mongolia.
8. Security: the measures in Privacy Policy clause 3.4.
9. Breach notice: the Provider notifies the Customer within 24 hours of detecting a data breach.
10. Rights requests: the Provider helps the Customer answer End user requests within 10 business days.
11. Deletion: message text is deleted after 90 days. Billing records are kept for the period required by law.
12. Audit: once a year, with 30 days' notice, the Customer may request written information on the security measures.

5.2. Tariff Annex

Effective 1 November 2026. All amounts in Mongolian tögrög.

Changes are notified 30 days in advance.