The Jubile Bug Bounty Programs Terms and Conditions ("Terms") cover your participation in the Jubile Bug Bounty Program (the "Program"). These Terms are between you and Jubile Limited ("Jubile," "us" or "we"). By submitting any vulnerabilities to Jubile or otherwise participating in the Program in any manner, you accept these Terms.
The Program enables users to submit vulnerabilities and exploitation techniques ("Vulnerabilities") to Jubile about eligible Jubile products and services ("Products") for a chance to earn rewards in an amount determined by Jubile at its sole discretion ("Bounty"). Each Product for which Bounties are available has a separate set of terms applicable to that Product (the "Product Program Terms"), which are incorporated by reference into these Terms. In the event of a conflict between these Terms and the Product Program Terms for a particular Product, the Product Program Terms control for that particular Product only. The decisions made by Jubile regarding Bounties are final and binding. Jubile may change or cancel this Program at any time, for any reason..
We may change these Terms at any time. Participating in the Program after the changes become effective means you agree to the new Terms. If you don't agree to the new Terms, you must not participate in the Program. If you wish to opt-out of the Program and not be considered for Bounties, contact us at data-privacy@jubile.tech. Opting out will not affect any licenses granted to Jubile in any Submissions provided by you.
You ARE eligible to participate in the Program if you meet all of the following criteria:
For PUBLIC sector employees: If you are a public sector employee (government and education), all Bounties must be awarded directly to your public sector organization and subject to receipt of a gift letter signed by your organization's ethics officer, attorney, or designated executive/officer responsible for your organization's gifts/ethics policy. Jubile seeks to ensure that by offering Bounties under this Program, it does not create any violation of the letter or spirit of a participant's applicable gifts and ethics rules.
You ARE NOT eligible to participate in the Program if you meet any of the following criteria:
It is your responsibility to comply with any policies that your employer may have that would affect your eligibility to participate in the Program. If you are participating in violation of your employer’s policies, you may be disqualified from participating or receiving any Bounty. All payments will be made in compliance with local laws, regulations, and ethics rules. Jubile disclaims any and all liability or responsibility for disputes arising between an employee and their employer related to this matter. There may be additional restrictions on your ability to enter depending upon your local law.
If you believe you have identified a Vulnerability that meets the applicable requirements set forth in the Product Program Terms, you may submit it to Jubile through the process described in the Product Program Terms or, if none is provided, in accordance with the following process:
Each Vulnerability submitted to Jubile shall be a "Submission." Submissions must be sent to data-privacy@jubile.tech. In the initial email, specify the name of the Bounty Program you are submitting under, the Vulnerability details, and specific product version numbers you used to validate your research. Please also include as much of the following information as possible:
Depending on the detail of your Submission, Jubile may award a Bounty of varying scale. Well-written reports and functional exploits are more likely to result in Bounties. Those Submissions that do not meet the minimum bar described above are considered incomplete and not eligible for Bounties.
Jubile is not responsible for Submissions that we do not receive for any reason. If you do not receive a confirmation email after making your Submission, notify Jubile at data-privacy@jubile.tech to ensure your Submission was received.
There are no restrictions on the number of qualified Submissions you can provide and potentially be paid a Bounty for.
If you submit a Vulnerability for a product or service that is not covered by the Program at the time you submitted it, you will not be eligible to receive Bounty payments if the product or service is later added to the Program.
Jubile is not claiming any ownership rights to your Submission. However, by providing any Submission to Jubile, you:
Protecting customers is Jubile's highest priority. We endeavor to address each Vulnerability report in a timely manner. While we are doing that we require that Bounty Submissions remain confidential and cannot be disclosed to third parties or as part of paper reviews or conference submissions. You can make available high-level descriptions of your research and non-reversible demonstrations after the Vulnerability is fixed. We require that detailed proof-of-concept exploit code and details that would make attacks easier on customers be withheld for 30 days after the Vulnerability is fixed. Jubile will notify you when the Vulnerability in your Submission is fixed. You may be paid prior to the fix being released and payment should not be taken as notification of fix completion. VIOLATIONS OF THIS SECTION COULD REQUIRE YOU TO RETURN ANY BOUNTIES PAID FOR THAT VULNERABILITY AND DISQUALIFY YOU FROM PARTICIPATING IN THE PROGRAM IN THE FUTURE.
After a Submission is sent to Jubile in accordance with this Program, Jubile engineers will review the Submission and validate its eligibility. The review time will vary depending on the complexity and completeness of your Submission, as well as on the number of Submissions we receive.
Jubile retains sole discretion in determining which Submissions are qualified, according to the rules set forth in the Product Program Terms. If we receive multiple bug reports for the same issue from different parties, the Bounty will be granted to the first eligible Submission. If a duplicate report provides new information that was previously unknown to Jubile, we may award a differential to the person submitting the duplicate report.
If you report a Vulnerability without a functioning exploit, you may be eligible for a partial Bounty. If you submit the functioning exploit within 90 days of submitting the Vulnerability, we may, in our discretion, provide an additional Bounty payment (but are not obligated to do so).
The decisions made by Jubile regarding Bounties are final and binding.
If we have determined that your Submission is eligible for a Bounty under the applicable Product Program Terms, we will notify you of the Bounty amount and provide you with the necessary paperwork to process your payment. You may waive the payment if you do not wish to receive a Bounty.
If there is a dispute as to who the qualified submitter is, we will consider the eligible submitter to be the authorized account holder of the email address used to enter the Program.
Before receiving a Bounty, you are required to complete and submit an Internal Revenue Service tax form (e.g., Form W-9, W-8BEN, 8233) within 30 calendar days of notification of validation. If you do not complete the required forms as instructed or do not return the required forms within the time period listed on the notification message, we may not provide payment. We cannot process payment until you have completed and submitted the fully executed required documentation.
If your Submission qualifies for a Bounty, please note:
Jubile may publicly recognize individuals who have been awarded Bounties. Jubile at it is discretion may recognize you on web properties or other printed materials unless you explicitly ask us not to include your name.
See the Jubile Privacy Statement disclosures relating to the collection and use of your information in connection with the Program.
By participating in the Program, you will follow these rules:
If you violate these Terms, you may be prohibited from participating in the Program in the future and any Submissions you have provided may be deemed to be ineligible for Bounty payments.
Jubile, and our affiliates, resellers, distributors, and vendors, make no warranties, express or implied, guarantees or conditions with respect to the program. you understand that your participation in the program is at your own risk. to the extent permitted under your local law, we exclude any implied warranties in connection with the program. you may have certain rights under your local law. nothing in these terms is intended to affect those rights, if they are applicable.
If you have any basis for recovering damages in connection with the Program (including breach of these Terms), you agree that your exclusive remedy is to recover, from Jubile or any affiliates, resellers, distributors, third-party providers, and vendors, direct damages up to $100.00. You can't recover any other damages or losses, including direct, consequential, lost profits, special, indirect, incidental, or punitive. These limitations and exclusions apply even if this remedy doesn't fully compensate you for any losses or fails of its essential purpose or if we knew or should have known about the possibility of the damages. To the maximum extent permitted by law, these limitations and exclusions apply to anything or any claims related to these Terms and the Program.
You and we irrevocably consent to the exclusive jurisdiction and venue of the state or federal courts of England, UK, for all disputes arising out of or relating to these Terms or the Program that are heard in court (excluding arbitration and small claims court).
These Terms, the Jubile Privacy Statement, and any applicable Product Program Terms are the entire agreement between you and Jubile for your Participation in the Program. It supersedes any prior agreements between you and Jubile regarding your participation in the Program. All parts of these Terms apply to the maximum extent permitted by relevant law. If a court or arbitrator holds that we can't enforce a part of these Terms as written, we may replace those terms with similar terms to the extent enforceable under the relevant law, but the rest of these Terms won't change.
Other than your Submission, Jubile does not consider or accept unsolicited proposals or ideas, including without limitation ideas for new products, technologies, promotions, product names, product feedback and product improvements ("Unsolicited Feedback"). If you send any Unsolicited Feedback to Jubile through the Program or otherwise, Jubile makes no assurances that your ideas will be treated as confidential or proprietary.
IF YOU DO NOT AGREE TO THESE TERMS, PLEASE DO NOT SEND US ANY SUBMISSIONS OR OTHERWISE PARTICIPATE IN THIS PROGRAM.
