Open Source Software Attribution Notice

This Open Source Software Attribution Notice ("Notice") is issued by Tanqory Inc. (Delaware, USA) ("Tanqory", "we", "us"), together with its affiliate Tanqory OÜ (Estonia), to acknowledge and provide notice of the third-party open source software ("OSS") components incorporated into the Tanqory platform. This Notice supplements, but does not modify, the licenses applicable to each OSS component; in the event of any conflict between this Notice and the underlying OSS license, the underlying OSS license controls with respect to that component.

1) Purpose

1.1 The purpose of this Notice is to (i) acknowledge that the Tanqory platform incorporates, depends upon, or links against software distributed under open source licenses, (ii) describe where complete, machine-readable attribution lists and license texts are made available, (iii) summarize the principal license families used at Tanqory and the obligations Tanqory observes with respect to each, (iv) describe the process by which Tanqory reviews and approves new OSS dependencies, and (v) provide a channel for license inquiries and notices.

1.2 This Notice is intended to assist users, regulators, customers, partners, auditors, and OSS authors in understanding Tanqory's OSS posture. It is not a license grant from Tanqory in respect of any OSS component; each OSS component remains subject to its own license.

2) Scope

2.1 This Notice applies to the entire Tanqory platform, including without limitation: (a) Tanqory-branded web applications and merchant-facing dashboards; (b) Tanqory consumer storefront experiences and rendering layers; (c) Tanqory mobile and desktop applications; (d) Tanqory software development kits ("SDKs"), command-line tools, and developer integrations; (e) Tanqory websites operated under tanqory.com and affiliated domains; and (f) backend services, APIs, and worker components that form part of the Tanqory production environment.

2.2 This Notice does not extend to: (i) merchant-supplied code, themes, plugins, or third-party applications installed by merchants from any Tanqory marketplace; (ii) software embedded within third-party services that Tanqory consumes as software-as-a-service; or (iii) software distributed independently by Tanqory affiliates outside the Tanqory platform.

3) Acknowledgment of incorporation

3.1 The Tanqory platform incorporates a number of open source software components. The specific set of components, their versions, and their applicable license terms are determined by the actual dependency manifests resolved at build time for each Tanqory product (for example, package manifests such as package.json, pnpm-lock.yaml, requirements.txt, go.sum, Cargo.lock, container base images, and equivalent build artifacts).

3.2 Because the dependency set evolves with each release, Tanqory does not maintain a hand-curated list of incorporated OSS components in this Notice. Instead, complete attribution data — including package names, versions, copyright notices, SPDX license identifiers, and full license texts — is generated programmatically from the build artifacts of each release. This approach is intended to ensure that the attribution data accurately reflects what is actually shipped, rather than a manually maintained list that may drift out of date.

3.3 The auto-generated attribution data is published in a Software Bill of Materials ("SBOM") or equivalent third-party attribution file for each Tanqory product, made available at the location described in Section 4 below.

4) Per-product attribution location

4.1 The auto-generated attribution file and SBOM for each Tanqory product are intended to be published at a stable, public URL associated with that product. The open-source attribution notices are published at legal.tanqory.com and within the applicable Tanqory applications.

4.2 Users who wish to obtain the attribution file or SBOM for a specific Tanqory product release may request it by emailing ip@tanqory.com with the product name and, where known, the release version. Tanqory will respond within a reasonable period and may provide the file directly, by URL, or via a secure download.

4.3 For OSS components distributed in source or binary form together with Tanqory client-side code (for example, JavaScript bundles served from Tanqory domains), the applicable license texts and copyright notices are preserved either in the distributed source maps, in dedicated attribution endpoints, or in the attribution file referenced in Section 4.1.

5) Notable license families used at Tanqory

5.1 The following open source license families are commonly represented in the Tanqory dependency graph. This list is illustrative and is not exhaustive; the controlling list for any given release is the auto-generated attribution file described in Section 4.

5.1.1 MIT License — A permissive license requiring preservation of the copyright notice and license text. Tanqory preserves these notices in its attribution file and, where applicable, in distributed source.

5.1.2 Apache License, Version 2.0 — A permissive license with an explicit patent grant and a notice-preservation requirement. Where a NOTICE file is provided by an upstream project, Tanqory reproduces the contents of that NOTICE file in its attribution file. Tanqory documents material modifications to Apache-2.0 components in accordance with Section 4(b) of the license.

5.1.3 BSD 2-Clause and BSD 3-Clause Licenses — Permissive licenses requiring preservation of the copyright notice, the list of conditions, and (for 3-Clause) the no-endorsement clause. Tanqory preserves all required notices.

5.1.4 ISC License — A permissive license functionally equivalent to a simplified BSD/MIT. Tanqory preserves the copyright notice and license text.

5.1.5 Mozilla Public License, Version 2.0 (MPL-2.0) — A weak copyleft license operating at the file level. Where Tanqory modifies an MPL-2.0 file, Tanqory makes the modified file available in source form in accordance with the license. Tanqory does not interpret MPL-2.0 to require disclosure of files that are not themselves MPL-2.0 covered files.

5.1.6 GNU Lesser General Public License (LGPL) v2.1 and v3 — A weak copyleft license. Tanqory uses LGPL-licensed components only via dynamic linking (or equivalent mechanisms that preserve the user's ability to replace the LGPL component with a modified version), in accordance with the license's "Combined Works" provisions. Static linking against LGPL components is prohibited under Tanqory's internal OSS policy except where a written exemption has been granted.

5.1.7 GNU General Public License (GPL) v2 and v3 — A strong copyleft license. Tanqory's general policy is to avoid incorporation of GPL-licensed components into proprietary Tanqory code paths where such incorporation would create copyleft obligations on the combined work. Use of GPL components is restricted to standalone executables, build tooling, or development utilities that do not propagate the GPL to Tanqory's proprietary code. The Company's policy is to avoid copyleft (GPL/AGPL) licenses for proprietary components and to use permissively licensed components (MIT, Apache-2.0, BSD, ISC, MPL-2.0) where practicable.

5.1.8 Other licenses — Tanqory's dependency graph may include components under additional licenses (for example, BSL, EPL, CDDL, Unlicense, CC0, or various permissive variants). Each such component is reviewed on a case-by-case basis as described in Section 7, and is reflected in the attribution file.

6) Compliance obligations Tanqory observes

6.1 In respect of each OSS component incorporated into the Tanqory platform, Tanqory undertakes to observe the obligations imposed by the applicable license, including in particular:

6.1.1 Preservation of copyright notices. Copyright notices, attribution statements, and required NOTICE files from upstream projects are preserved in the attribution file referenced in Section 4 or, where the license so requires, in the distributed artifact itself.

6.1.2 Inclusion of license texts. The full text of the applicable license is included in or referenced from the attribution file for each release.

6.1.3 Modification disclosure for copyleft components. Where Tanqory modifies a component distributed under a copyleft license (for example, MPL-2.0 or LGPL), Tanqory makes the modifications available in accordance with the applicable license terms, including by providing source code on request from any recipient of the modified component.

6.1.4 No assertion of proprietary rights over upstream code. Tanqory does not assert proprietary rights over upstream OSS components and respects the rights of the original copyright holders. Tanqory's proprietary rights extend only to its own modifications, original code, configuration, integration work, and the Tanqory platform as a whole, not to the underlying OSS components.

6.1.5 No removal of license headers. Tanqory does not remove or alter license headers or in-source notices in upstream OSS components, except where modification is permitted and is itself documented in accordance with the applicable license.

7) Process for license review of new dependencies

7.1 Tanqory operates an internal review process for the introduction of new OSS dependencies into the Tanqory platform. The objective of this process is to (i) confirm that the license of each dependency is identified and recorded against an SPDX identifier, (ii) confirm that the license is compatible with Tanqory's intended use, (iii) identify any reciprocal or copyleft obligations, and (iv) record any modifications and the conditions under which they were made.

7.2 The tooling used to support the review process — including license scanners, SBOM generators, and license-compatibility decision support — is selected and configured by Tanqory's engineering and security teams. The Company reviews the license of each new dependency using automated software-composition-analysis tooling as part of its build process.

7.3 Where a proposed dependency is licensed under terms that are incompatible with Tanqory's intended use, the dependency is either rejected, replaced with a license-compatible alternative, or escalated to Tanqory's legal team for written exemption.

7.4 The review process is integrated, where technically feasible, into Tanqory's continuous integration pipelines so that license changes in transitive dependencies are surfaced for review at the time of introduction rather than at audit time.

8) Submission of license inquiries and notices

8.1 Inquiries regarding Tanqory's use of a specific OSS component, requests for the source code of modifications to copyleft components, and notices of alleged non-compliance with an OSS license should be sent to ip@tanqory.com, with a copy to legal@tanqory.com.

8.2 To assist Tanqory in routing and responding to inquiries efficiently, please include, where known: (a) the OSS component name and version, (b) the Tanqory product and release in which the component is alleged to be incorporated, (c) the specific license obligation believed to be implicated, (d) the relief or response requested, and (e) contact details of the inquirer.

8.3 Tanqory will acknowledge receipt of OSS-license inquiries within a reasonable period and will investigate in good faith. Where Tanqory determines that an obligation has not been fully observed, Tanqory will work to remediate, including by updating the attribution file, making source code available, or correcting the configuration of the affected component.

9) Trademark notice and no implied rights

9.1 The acknowledgment of an OSS component in this Notice or in any Tanqory attribution file does not imply any endorsement of Tanqory by the OSS author, sponsor a relationship between Tanqory and the OSS author, or grant Tanqory any right to use the trademarks, service marks, trade names, or logos of the OSS author or project, except to the extent strictly necessary to provide truthful attribution as required by the applicable license.

9.2 The names "Tanqory", the Tanqory logo, and the Tanqory marks registered or used by Tanqory Inc. are trademarks of Tanqory Inc. and are not licensed under any open source license. Use of Tanqory trademarks is governed by the Trademark Policy referenced in Section 10.

10) Cross-references

10.1 This Notice should be read together with the following Tanqory documents:

10.1.1 Trademark Policy (apps/legal/tanqory_legal/en/ip-and-brand/trademark-policy.md) — governs the permitted and prohibited uses of Tanqory trademarks, including in the context of OSS contributions.

10.1.2 Patent Disclosure Policy (apps/legal/tanqory_legal/en/ip-and-brand/patent-disclosure-policy.md) — addresses patent matters that may arise in connection with OSS components carrying express patent grants (for example, Apache-2.0 Section 3).

10.1.3 Content Licensing Policy (apps/legal/tanqory_legal/en/ip-and-brand/content-licensing-policy.md) — addresses the licensing of content distributed by Tanqory.

10.1.4 Subprocessor List (apps/legal/tanqory_legal/en/data-protection/subprocessor-list.md) — identifies third-party processors that are distinct from OSS components but may incorporate OSS internally.

11) Updates to this Notice

11.1 This Notice is reviewed at least annually and may be updated to reflect changes in Tanqory's OSS posture, the introduction of new license families into the dependency graph, or changes in the location at which attribution files are published.

11.2 The controlling version of this Notice is published at https://legal.tanqory.com/. The auto-generated attribution data referenced in Section 4 is updated on each release of the relevant Tanqory product.