Jurisdiction-aware governance is integrated into amaRQ release operations.

Terms Of Service

amaRQ is provided by LuxLeaf AI, and platform usage is subject to documented terms, privacy controls, and jurisdiction-specific legal constraints that are required to remain enforceable before client-facing or investor-facing deployment. Free waitlist enrollment is available without payment and is not conditioned on support contributions, while any optional founder support flow remains legally separate from access status and product capabilities.

Any optional support payment is processed by Sentience Labs acting as LuxLeaf AI's partner and authorized payment collection agent, funds are collected for the benefit of LuxLeaf AI, and all product obligations, service commitments, and legal duties related to amaRQ remain with LuxLeaf AI.

Assent And Contract Controls

amaRQ applies explicit assent controls for enforceability-sensitive workflows. Browsing and continued use after conspicuous notice may establish baseline terms acceptance where permitted, and account login, checkout, and waitlist submission paths require affirmative click-through consent tied to timestamped records and policy-version hashes. Users who do not agree to these terms must discontinue use of the site and services.

No contract language in this platform is intended to waive rights that cannot legally be waived, and any clause that is unenforceable in a given jurisdiction is interpreted narrowly to preserve the maximum lawful scope of the remaining provisions.

Payment Processing And Agency Disclosure

Founder support is an optional contribution to ongoing development and does not grant purchase rights, equity, priority access, preferential waitlist treatment, product functionality, or commercial perks. If a user elects to provide optional founder support, the payment is processed by Sentience Labs, acting as LuxLeaf AI's partner and authorized payment collection agent, and funds are collected for the benefit of LuxLeaf AI.

This agency disclosure must be displayed directly adjacent to payment actions in checkout flows and maintained in these Terms so users can review processing roles before payment is submitted, and product obligations, customer commitments, and platform accountability remain with LuxLeaf AI. Founder support payments are non-refundable once processed except where mandatory law provides a non-waivable refund, chargeback, or cancellation right.

Baseline Regulatory Posture

amaRQ operations require documented legal scoping for United States, European Union, Republic of Korea, People’s Republic of China, and Mexico deployment contexts, and every production workflow must preserve auditable evidence that data usage, product behavior, and release decisions remain inside approved legal boundaries.

Regulatory Framework Coverage

amaRQ maintains an implemented engineering baseline for GDPR and monitoring baselines for FTA-scoped financial transaction requirements, FATF AML/CFT and Travel Rule readiness, OFAC sanctions obligations, FinCEN BSA/AML readiness, MiCA governance obligations, CCPA/CPRA privacy rights expectations, and UK MLR/FCA crypto-asset operational controls, with each framework mapped to machine-readable control metadata and verification evidence.

Where legal obligations depend on deployment geography, customer type, or product classification, production release requires explicit counsel review and signed jurisdiction-specific interpretation before activation.

Jurisdictional Readiness

United States readiness requires feature-specific analysis against SEC, CFTC, FinCEN, OFAC, and state-level obligations, including sanctions and AML recordkeeping controls for relevant product behavior. European Union readiness requires MiCA and DORA applicability assessment aligned with GDPR rights handling, retention governance, and cross-border transfer controls.

Republic of Korea readiness requires conformity checks against current virtual-asset user protection and supervisory guidance. People’s Republic of China readiness requires strict legal scoping under virtual-asset restrictions and data-governance obligations, including PIPL and Data Security Law. Mexico readiness requires mapping to applicable Banxico and CNBV guidance and related AML reporting obligations before production analytics distribution.

Institutional Alignment

Control design and governance documentation are aligned to leading institutional references, including Financial Stability Board stablecoin recommendations, CPMI-IOSCO financial market infrastructure principles, FATF virtual-asset risk-based guidance, EDPB and ICO privacy baselines, NIST CSF 2.0, OFAC compliance framework principles, and FinCEN BSA control expectations, while final legal interpretation remains the responsibility of qualified counsel in each jurisdiction.

Sentience Labs Legal-Intelligence Agent Layer

amaRQ legal operations now integrate the Sentience Labs legal-intelligence agent architecture from lux-securities-agent-sentience-labs to maintain continuous, jurisdiction-aware policy monitoring for securities, stablecoin, and digital-asset governance workflows. The integrated model maintains provenance-first legal records with source URL, institution, jurisdiction, and cryptographic content hash so downstream legal interpretation and investor-facing claims can be traced back to collected primary materials.

The current integrated source framework covers regulatory, institutional, and legal-literature channels across the United States, European Union, Republic of Korea, People’s Republic of China, and Mexico, with robots-aware collection and host-level pacing controls designed to preserve lawful collection behavior. This section represents an operational legal-support layer and does not replace qualified legal counsel or jurisdiction-specific licensing review.

Cybersecurity Control Baseline

amaRQ production operation requires a defense-in-depth cybersecurity baseline covering secure session handling, encrypted secret storage, strict transport protection, request-origin controls for authenticated state changes, host-header allowlisting, and auditable key lifecycle controls. Security posture is mapped to NIST CSF 2.0 and ISO 27001-style control domains, with release gates requiring evidence that preventative, detective, and corrective controls are active in the exact deployed build.

Security controls must be continuously monitored for drift, and any material control degradation immediately triggers release rollback or feature-gating until the control state is remediated and revalidated.

Secure Engineering Standard

Engineering workflows require secure-by-default implementation choices, including explicit input validation, contextual output encoding, rate limiting on abuse-prone endpoints, and least-privilege access boundaries for operator features and payment administration paths. High-risk surfaces, including authentication, billing webhooks, key management, and recommendation endpoints, require deterministic test coverage and manual release review before public promotion.

Security-critical changes are required to preserve traceable commit lineage, verification evidence, and rollback capability so incident containment can be executed without ambiguity.

Incident Response And Breach Readiness

amaRQ operations require documented incident-severity definitions, escalation routing, forensic log retention, and jurisdiction-aware notification workflows. Suspected compromise of credentials, customer data, payment metadata, or recommendation-control pathways must be treated as a high-priority event with immediate containment, root-cause analysis, and corrective release evidence before restoration of normal operations.

Where legally required, affected users and regulators must be notified within applicable statutory windows, and post-incident remediation records must remain auditable for compliance review.

DeFi And Crypto Data Controls

amaRQ prohibits key bypassing, authentication circumvention, paywall evasion, and rate-limit circumvention across all data connectors, and these controls are enforced as hard engineering and policy boundaries in collection and integration workflows. Data acquisition is restricted to licensed or public endpoints used within provider terms, and any uncertainty on licensing scope, redistribution rights, or educational sharing permissions requires legal escalation before execution.

Travel Rule, AML/CFT, and sanctions-readiness controls are treated as pre-production gates for regulated flow classes, and release operations require evidence that screening, escalation, and audit logging paths remain operational throughout deployment cycles.

API Tier And Key Controls

amaRQ app access is controlled through encrypted API-key issuance, tier-scoped throughput policies, and revocation workflows, with educational and paid tiers mapped to differentiated data depth, operational support, and allowable recommendation modes. Plaintext keys are only disclosed at issuance time and encrypted vault storage is used for at-rest persistence of key metadata and validation artifacts.

API users are responsible for secure key handling, principle-of-least-privilege scope assignment, and immediate revocation or rotation after suspected compromise, and production usage must preserve audit evidence linking each high-impact recommendation request to an authenticated and policy-valid access channel.

Privacy And Data Rights

All personal and operationally sensitive data handling must follow lawful-basis processing rules, minimization, retention governance, and rights-response controls, with encryption and access-control safeguards enforced for transport and storage paths used by platform integrations and release artifacts.

Where applicable privacy law grants the right to opt out of sale or sharing of personal data, amaRQ must provide a clear in-product path to disable sale/share consent and preserve a defensible record of user preference state for audit and rights-response handling. Agreement to site terms does not eliminate statutory privacy rights that cannot be waived under applicable law.

Data Collection And Sale Choices

amaRQ distinguishes essential security and platform-operation data from optional analytics, marketing, and sale/share permissions. Essential processing remains limited to security, fraud prevention, session integrity, and required platform functionality, while optional categories require explicit affirmative consent before activation.

The runtime consent surface must include a visible do-not-sell/share control that allows users to revoke sale/share permission at any time without disabling essential platform operation. Preference changes are written to an encrypted consent ledger with timestamped receipts and policy-version metadata for audit and rights-response workflows.

Cookie And Accessibility Controls

The web client maintains category-based cookie controls where essential security and preference storage can operate without enabling optional analytics, marketing, or data-sale/share categories, and optional categories remain disabled until explicit user consent is captured. Accessibility controls include keyboard-first navigation, visible focus states, scalable typography, reduced-motion compatibility, and colorblind palette toggles so platform functions remain operational under inclusive access expectations.

Users can open the runtime Cookie + Accessibility Settings control from the floating settings action or the footer on any supported route, and all changes are persisted both in local preference storage and in encrypted backend consent records with do-not-sell/share and Global Privacy Control enforcement.

AML, Sanctions, And Conduct Controls

Market-integrated workflows must be operated with sanctions-screening awareness, suspicious-activity escalation capability, and conduct-risk monitoring procedures where applicable obligations exist, and material integration changes require renewed legal and compliance review before production promotion.

Data License Entitlement

amaRQ enforces a strict lawful-access policy in which external data feeds are consumed only under valid contractual or public-license terms, and credential bypass, key circumvention, or unauthorized access patterns are explicitly prohibited across all ingestion and proxy pathways.

Release Gate Standard

No production release is considered complete unless confidential control outputs are generated, verification checks pass from the same immutable code state, and deployment package artifacts are produced and retained with matching verification metadata.

SmartSwap+ Portfolio And Market-Product Notices

SmartSwap+ optimizer outputs for spot assets, ETFs, futures, equities, and options are decision-support analytics and do not constitute brokerage execution, investment-adviser recommendations, solicitation, or a guarantee of suitability for any account. Where regulated products or customer-facing allocation decisions are involved, operation must be performed through appropriately licensed entities with jurisdiction-specific disclosures, best-execution controls, market-abuse controls, and derivatives appropriateness checks.

Portfolio analytics that include leverage, derivatives exposure, or cross-asset hedging assumptions require formal model-risk governance, scenario-stress review, and counsel-approved distribution language before production deployment to clients or investors.

Production Legal Documentation Pack And Release Gates

Productionalization requires a complete documentation pack that remains versioned, internally consistent, and cross-referenced to current framework metadata, including the legal baseline, privacy and data-rights notice, AML and sanctions playbook, retention and deletion schedule, source-license register, and security architecture records. Release remains blocked when required artifacts are missing, materially stale, or disconnected from validation evidence.

Operational release gates require evidence of compliance checks, documentation integrity checks, and open-risk review from the same immutable code state used for packaging and deployment, so that legal posture is auditable and technically enforceable.

Client Readiness Checklist

Use this checklist to confirm baseline legal readiness before client-facing activation or investor distribution.

Checklist status: 0/5 controls acknowledged

Dispute Resolution And Waiver

To the maximum extent permitted by applicable law, users agree that disputes arising from use of amaRQ, StableX, SmartSwap+, or related services will be resolved through binding individual arbitration, with waiver of jury trial and waiver of class, collective, or representative proceedings. This provision is intended to apply across contract, tort, statutory, and equitable claims connected to platform access, outputs, payments, or operations.

Any rights or remedies that are non-waivable under applicable law remain preserved, including statutory rights that cannot be contracted away in specific jurisdictions, and any unenforceable part of this section is severed while the remaining lawful portions stay in force.

User Data Rights Assignment

Users retain ownership of source data they submit, and grant amaRQ a non-exclusive, worldwide license to host, process, transform, and analyze that data as necessary to provide, secure, monitor, and improve contracted services, including compliance, fraud-prevention, and reliability operations. Any use of customer-provided data for generalized model training or external commercialization must follow the governing customer agreement and applicable law, including required consent and data-rights controls.

Where legal restrictions apply, amaRQ applies the narrowest legally valid processing scope needed for service delivery and compliance obligations, and honors mandatory data-rights limitations that cannot be waived by contract.

Copyright And Intellectual Property

amaRQ is a LuxLeaf AI product, and amaRQ, StableX, SmartSwap+, associated source code, data models, visual interfaces, written documentation, and media assets are owned by LuxLeaf AI and protected by copyright and other applicable intellectual property laws. © 2026 LuxLeaf AI. All rights reserved. No part of these materials may be copied, redistributed, reverse engineered, or used for derivative commercial exploitation without prior written authorization, except where mandatory law provides a non-waivable right.

Legal Notice

This page reflects engineering and compliance implementation posture and is not legal advice. No software release can guarantee one-hundred-percent legal certainty across all jurisdictions or fact patterns, so final jurisdiction-specific interpretation, licensing scope confirmation, and production sign-off must be completed by qualified counsel before launch.