Legal Notice

Mandatory disclosure pursuant to applicable transparency and intermediary service obligations

Version 2026.3 — Effective March 2026

Legal Notice Terms of Service Privacy Policy Acceptable Use Terms of Sale Law Enforcement Transparency DPA

1. Publisher and Operator

The Ten-Seconds software platform (hereinafter "the Software") is published, operated, and made available worldwide by:

Sterling and Pierce Holding L.L.C-FZ
Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
License No: 2420814.01 — Meydan Free Zone (issued 18/07/2024, valid 17/07/2026)
Licensed activities: Software publishing, software distribution, holding company
Contact: contact@sterlingandpierce.com

The Software is published and made available under the software publishing and distribution activities licensed to the above entity by the Meydan Free Zone Authority. The entity acts as the operator and publisher of the Software in all jurisdictions where it is accessible, unless a separate B2B or enterprise licensing agreement provides otherwise.

2. Nature of the Software and Service

Ten-Seconds is an encrypted ephemeral communications software made available by the Publisher as a hosted software service. It provides end-to-end encrypted messaging using TweetNaCl (Curve25519/XSalsa20/Poly1305) cryptographic primitives. It is designed primarily as a professional secure communications platform intended for confidentiality-sensitive professional use.

The Software operates as an intermediary relay service: it transmits encrypted data between authenticated users without the Publisher having technical access to the plaintext content of communications. This architecture is described in full in the Terms of Service and Privacy Policy.

The Publisher may additionally offer the Software under a B2B enterprise licensing model to organisations seeking to deploy the platform for internal or client-facing use. Such arrangements are governed by separate commercial licensing agreements.

Ref: Regulation (EU) 2022/2065 (DSA), Art. 12 — Transparency requirements for intermediary service providers

3. Cryptographic Architecture

The Software incorporates TweetNaCl open-source cryptographic software implementing Curve25519 key exchange, XSalsa20 stream cipher, and Poly1305 message authentication. The private cryptographic key is generated exclusively on the user's device, encrypted locally with the user's password, and never transmitted in plaintext to the Publisher's servers.

Technical limitation: The Publisher cannot decrypt message content. The Publisher does not hold the cryptographic keys required to read user communications. This is an inherent technical constraint of the architecture, not a contractual guarantee of absolute immunity from all forms of interception.

Use of cryptographic technology in this Software is governed by applicable export control and cryptography regulation as set out in Section 7 below.

4. Intermediary Service — DSA Compliance

In its capacity as an intermediary service provider, the Publisher complies with applicable provisions of Regulation (EU) 2022/2065 (Digital Services Act) to the extent applicable to its user base and activity level:

Single point of contact for authorities and users: contact@sterlingandpierce.com
This Legal Notice constitutes the Publisher's transparency disclosure pursuant to DSA Art. 12.
The Publisher will notify competent authorities of information suggesting criminal offences involving threats to life or safety (DSA Art. 18).
Due to the end-to-end encryption architecture, the Publisher's capacity to assist with content-related requests is technically limited to the account-level metadata described in the Law Enforcement Guidelines.

Ref: Regulation (EU) 2022/2065, Art. 12, 18 | UAE Federal Decree-Law No. 46/2021 on Electronic Transactions

5. Data Retention — Telecommunications and Privacy Obligations

In accordance with applicable data retention obligations, the Publisher retains the following categories of data:

Data category	Retention period	Legal basis
Account credentials (pseudonymous)	Duration of subscription + 5 years	Civil and commercial obligations
Payment records	10 years	Accounting and tax obligations
Legal consent records	5 years from acceptance	Proof of contract / GDPR Art. 6(1)(c)
Technical access logs (IP, timestamps)	Up to 1 year	Security / telecommunications obligations
Message content	Not retained — purged from server memory within session lifetime (max 30 min)	Privacy-by-design architecture

Ref: GDPR Art. 5(1)(e) — Storage limitation | UAE Federal Law No. 45/2021 on Personal Data Protection | UAE TDRA data retention framework

6. Disclaimer — Accuracy of Technical Claims

The Publisher provides accurate descriptions of the Software's technical architecture to the best of its knowledge. The following statements reflect factual technical design constraints and are not absolute guarantees:

The statement that "the server cannot read message content" reflects the end-to-end encryption design. It does not guarantee immunity from device-level interception, legal order compelling device access, or any future architectural changes.
The statement that messages are "deleted after display" refers to server-side session memory purge. It does not guarantee deletion from recipient device memory, screenshots, or network capture prior to encryption.
The platform does not claim to provide legally-admissible anonymity. User connection metadata (IP addresses, timestamps) may be retained for up to one year as described above.

7. Export Control and Cryptography

The Software incorporates cryptographic software. The Publisher has assessed the following applicable frameworks:

EU Dual-Use Regulation (EU) 2021/821: Mass-market cryptographic software with key lengths ≤256-bit is generally eligible for general EU export authorisation (EU001). The Publisher believes the Software falls within this category. External counsel confirmation is recommended for large-scale commercial EU operations.
US EAR: The Software does not directly export US-origin cryptographic binary code. Users access the service via web browser. The Publisher has no US nexus that would independently trigger US EAR obligations, but notes that TweetNaCl's provenance should be confirmed if the Publisher operates US-based infrastructure in future.
UAE (Federal Law No. 5/2012 as amended): Use of encryption for personal and commercial communications is lawful under UAE law. The Publisher operates within the Meydan Free Zone under its software publishing licence.
France-specific note (for EU operations): If the Software generates significant commercial volume in France, a declaration under Art. 30–31 of Loi n°2004-575 (LCEN) regarding cryptographic service provision may be advisable. The Publisher recommends confirming this with French ANSSI counsel before large-scale French commercial operations. This obligation, if applicable, rests on the Publisher as a software service provider, not on individual users.

Note: The above is an internal compliance assessment, not legal advice. The Publisher recommends obtaining specialist export control counsel before expanding commercial operations to jurisdictions with heightened cryptography controls.

8. Intellectual Property

All elements of the Software — including source code, user interface, design, documentation, and trademarks — are the exclusive intellectual property of Sterling and Pierce Holding L.L.C-FZ, protected under UAE Federal Law No. 38 of 2021 on Intellectual Property Rights, and applicable international IP conventions.

TweetNaCl is used under its public domain licence. No proprietary claims are made over TweetNaCl or its underlying algorithms.

9. Limitation of Liability

To the maximum extent permitted by applicable law, the Publisher excludes liability for: (a) loss of data resulting from the designed ephemeral architecture; (b) unauthorised access resulting from compromise of user devices or passwords; (c) service interruptions; (d) any indirect or consequential loss. Statutory consumer rights in applicable jurisdictions are not affected.

10. Governing Law and Dispute Resolution

This Legal Notice and all related documentation are governed by the laws of the United Arab Emirates, specifically applicable Meydan Free Zone regulations. Disputes shall be submitted to the exclusive jurisdiction of the Dubai Courts, except where mandatory consumer protection law in the user's jurisdiction provides otherwise. EU users retain all statutory rights under applicable EU consumer and privacy legislation.

11. Modifications

This Legal Notice may be updated at any time. Users will be notified of material changes through the platform interface. The version number and effective date are displayed at the top of each document. Continued use following notification constitutes acceptance of the revised terms.