privacy and data security practices. If those lawsuits are successful, it could increase the risk that we may be exposed to liability for similar practices. Furthermore, if customer concerns regarding data security increase, customers may be hesitant to provide us with the data necessary to provide our service effectively. This could generally limit the adoption of our product and the growth of our company. Payment transactions processed on our platform may subject us to regulatory requirements and the rules of payment card networks, and other risks that could be costly and difficult to comply with or that could harm our business. The payment card networks require us to comply with payment card network operating rules, including special operating rules that apply to us as a “payment service provider” that provides payment processing-related services to merchants and payment processors. The payment card networks set these network rules and have discretion to interpret them and change them. We are also required by our payment processors to comply with payment card network operating rules and we have agreed to reimburse our payment processors for any fines they are assessed by payment card networks as a result of any rule violations by us or our customers. Any changes to or interpretations of the network rules that are inconsistent with the way we and the payment processors and merchants currently operate may require us to make changes to our business that could be costly or difficult to implement. If we fail to make such changes or otherwise resolve the issue with the payment card networks, the networks could fine us, cancel or suspend our registration as a payment service provider, or prohibit us from processing payment cards, which would have an adverse effect on our business, financial condition, and operating results. In addition, violations of the network rules or any failure to maintain good standing with the payment card networks as a payment service provider could impact our ability to facilitate payment card transactions on our platform, increase our costs, or could otherwise harm our business. If we were unable to facilitate payment card transactions on our platform, or were limited in our ability to do so, our business would be materially and adversely affected. If we fail to comply with the rules and regulations adopted by the payment card networks, we would be in breach of our contractual obligations to our payment processors, financial institutions, or partners. Such failure to comply may subject us to fines, penalties, damages, higher transaction fees and civil liability, and could eventually prevent us from processing or accepting payment cards or could lead to a loss of payment processor partners, even if there is no compromise of customer or consumer information. In the event that we are found to be in violation of any of these legal or regulatory requirements, our business, financial condition, and results of operations could be harmed. We believe the licensing requirements of the Financial Crimes Enforcement Network and state agencies that regulate banks, money service businesses, money transmitters, and other providers of electronic commerce services do not apply to us. One or more governmental agencies may conclude that, under its statutes or regulations, we are engaged in activity requiring licensing or registration. In that event, we may be subject to monetary penalties, adverse publicity, and may be required to cease doing business with residents of those states until we obtain the requisite license or registration. We currently generate significant revenue from our largest restaurant customers, and the loss or decline in revenue from any of these customers could harm our business, results of operations, and financial condition. For the year ended December 31, 2020, our 10 largest restaurant customers generated an aggregate of approximately 21% of our revenue. Although these customers enter into long-term contracts with us, they may reduce or terminate their usage of our platform or decide not to renew their agreements with us. We have in the past, and we may in the future, lose one or more of our largest restaurant customers. While no such losses have been material to date, in the event that any of our largest restaurant customers do not continue to use our platform, use fewer of our modules, use our modules in a more limited capacity, or not at all, or if the volume of transactions processed on our platform declines, our business, results of operations, and financial condition could be adversely affected in the future. Our business is highly competitive. We may not be able to compete successfully against current and future competitors. We face competition in various aspects of our business and we expect such competition to intensify in the future, as existing and new competitors, including some of our current ecosystem partners, introduce new solutions or enhance existing solutions that are directly competitive with our modules. Our platform combines functionality from numerous product categories, and we may compete against providers in each of these categories including white-label digital ordering solution providers, restaurant-focused POS platforms, aggregators that provide direct digital ordering solutions, and custom software providers. Our potential new or existing competitors may be able to develop solutions that are better received by customers or may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, regulations, or customer requirements. Some ordering aggregators sell solutions that are competitive with our core platform and they may become more aggressive in their sales tactics, including by bundling competitive solutions with their delivery or aggregator 59

Q3 2021 10Q - Page 65 Q3 2021 10Q Page 64 Page 66