Terms and conditions

1. Who we are

Zyton is provided by PairOx Pty Ltd, a company registered in New South Wales, Australia. In these terms, "Zyton", "we" and "us" mean PairOx Pty Ltd, and "you" means the person or organisation that uses the Services.

• ACN (Australian Company Number): 154 477 728
• ABN (Australian Business Number): 82 154 477 728
• Registered office: 4 Lorikeet Street, Glenwood NSW 2768, Australia

Our company details and contacts are also in our Imprint.

2. The Services

The Services give your applications identity, consent, verification and audit features through an API. Some features rely on third parties, such as Stripe for payments, and their own terms apply to your use of them.

We keep improving the Services and may add, change or remove features. If we remove or materially reduce a feature that your paid plan relies on, we'll give you reasonable notice first. There is no service-level agreement (SLA) unless we sign one with you.

3. Your account

• You must be at least 16 years old, or the minimum age required in your country, and able to enter into a binding contract.
• If you sign up for an organisation, you confirm that you're authorised to accept these terms on its behalf, and "you" includes that organisation.
• You can't use the Services if you're located in a country subject to comprehensive sanctions, or if you appear on a government list of restricted parties.
• Signing up creates a workspace for your organisation on the Free plan, with you as its administrator.
• Keep your account details accurate, and keep your password and API keys secret. You're responsible for everything done with your account and keys, so tell us straight away at [email protected] if you think someone else has access.

4. Your end users' consent

Through the Services, a consent grant for one of your end users comes about in one of two ways: a developer-attested grant, which you record on your word, or a Zyton-hosted approval, where the end user decides on a Zyton screen. Either way, you check the grant before you use the data it covers.

Developer-attested grants

With your API key, your backend can record a consent grant for one of your end users inside your own workspace: a "developer-attested grant". Zyton doesn't show your end users a consent screen for it or check it with them. We record the grant on your word, so you are responsible for capturing your end users' consent in your own app or website.

Before you record a grant, you must:

• ask the end user for consent in your own user interface, in clear and plain language, before you use their data for the purpose the grant covers;
• tell them who is asking, which data is involved, the purpose, who will receive it, how long the consent lasts and how they can withdraw it;
• get a clear, affirmative action from them, such as ticking an unticked box or tapping "Agree" (never silence, a pre-ticked box or wording buried in other terms);
• record a grant that matches exactly what they agreed to, and nothing more; and
• where the person is below the age at which they can consent for themselves, get consent from their parent or guardian as the law requires.

You must also:

• keep a record of how and when each consent was given, so you can show it to the person, to a regulator or to us when asked;
• let people withdraw consent as easily as they gave it, and record the withdrawal through the Services without undue delay; and
• never record a grant for someone who hasn't agreed, or present a grant as broader or more certain than it is.

Zyton-hosted approvals

Where the Services offer it, your backend can instead send an approval request with your API key, naming one of your end users by your own reference and their email address. We show the request to the end user on a Zyton-hosted screen, under your organisation's registered name with a "via Zyton" label, and record their decision. With a live key, we email them a link to the request on your behalf; to see it, they sign in to their own Zyton account, or create one, with that email address. If they approve, the approval becomes a grant you can check, and they can revoke it in their Zyton account at any time.

When you send approval requests, you must:

• send them only to people who use your app or service, at an email address they gave you, and only when you need their consent for something you are about to do;
• describe each request accurately and in plain language in its purpose, and ask only for the data and operations that purpose needs;
• never use approval requests to send marketing, or to mislead or pressure anyone into agreeing;
• use a grant only while it is active, and stop when a request is denied or expires or the end user revokes the grant; and
• explain in your own privacy notice that you use Zyton to ask your end users for their consent.

We limit how many approval requests and emails each organisation can send, and we may suspend approval requests for an organisation whose requests draw complaints or look abusive.

A grant recorded with your API key is your statement that the consent is genuine. For a Zyton-hosted approval, the end user's decision on our screen is their consent, but you remain responsible for the requests you send. Either way, you're responsible for having a lawful basis for your own processing of the data. You agree to cover (indemnify) us against third-party claims, and the resulting losses and reasonable costs, that arise because a grant you recorded wasn't validly obtained, a withdrawal wasn't recorded, or an approval request you sent broke these terms.

5. Plans, payment and automatic renewal

The Free plan costs nothing. Paid plans (Team and Enterprise) are monthly subscriptions at the prices on our pricing page, in US dollars. We show you the price, and any tax, at checkout before you pay.

Payments are processed by Stripe, our payment provider. When you subscribe, you authorise us to charge your payment method through Stripe at the start of each monthly billing period.

Automatic renewal: your subscription renews automatically each month, for another month, until you cancel. You'll get a receipt by email for every payment.

How to cancel: an admin of your workspace can cancel at any time on the Billing page of this developer portal (choose "Manage billing", which opens the Stripe Customer Portal) or by emailing [email protected]. Cancellation takes effect at the end of your current billing period: your paid features keep working until then, we don't charge you again, and your workspace then moves to the Free plan.

If a payment fails, Stripe tries again over the following days and your plan stays active meanwhile. If the payment still can't be collected, we may end your subscription and move your workspace to the Free plan.

Paid plans have a fixed monthly price and we don't charge for usage. If we ever introduce usage-based charges, we'll tell you at least 30 days before they apply to you.

6. Price changes

We may change our prices. We'll email you at least 30 days before a price increase applies to you, and the new price starts with your first billing period after that notice. If you don't want to pay the new price, you can cancel before it takes effect.

7. Taxes

Prices don't include tax. Where we have to collect tax, such as GST, VAT or sales tax, Stripe Tax calculates it at checkout from your billing address (and your tax ID, if you give one). The tax is shown before you pay and on your invoice. You're responsible for any other taxes that apply to your purchase.

8. Refunds

Our Refund policy explains when we give refunds. In short: we refund your first payment on a paid plan if you ask within 14 days, we refund billing mistakes, and otherwise we don't give pro-rata refunds when you cancel part-way through a month, except where the law requires it. Nothing in the policy limits your rights under consumer law.

9. Acceptable use

You must use the Services lawfully and responsibly. In particular, you must not:

• use them for fraud, phishing, identity theft or other deceptive practices;
• use them to track, monitor or profile people without their informed consent and a lawful basis, including covert employee monitoring, social scoring, or targeting people for their political views, beliefs or other protected characteristics;
• use them to discriminate unlawfully, to exploit children, or to develop weapons designed to harm people;
• send malware or spam through them, overload them, scrape them beyond the documented rate limits, or try to bypass authentication, rate limits or other security controls;
• access another customer's data, test the security of the Services without our written permission, or reverse-engineer them except where the law allows it;
• resell or share access to the Services or your API keys outside your organisation without our written agreement; or
• infringe anyone's intellectual property rights or break a duty of confidentiality.

If you break these rules, we may suspend or end your access, as section 13 explains.

10. Your data and our software

Your data stays yours. You keep all rights in the data you send to the Services, and you allow us to store and process it only as needed to provide, secure and support the Services and to meet our legal obligations.

Our software stays ours. We and our licensors own the Services, including the API, SDKs and documentation. While you follow these terms, we give you a limited, non-exclusive, non-transferable right to use the Services for your organisation's applications. Some components, such as our SDKs, are open source, and the licence that comes with them applies to that code.

If you send us feedback or suggestions, we may use them freely, without any obligation to you.

11. Data protection

Our Privacy policy explains how we handle your personal data as a customer, such as your name, your email address and how you use this portal.

When you send us personal data about your end users, such as your reference for them and the grants you record, we process it on your behalf and on your instructions, only to provide the Services. You're responsible for having a lawful basis for that data and for telling your end users about it in your own privacy notice.

Zyton-hosted approvals are the exception. For them, PairOx Pty Ltd is an independent controller, not your processor, of the end user's Zyton account, of the approval requests we show them (including the email address you send, which we store encrypted) and of the consent records we keep for them, as the Zyton Approvals Privacy Policy that the end user accepts describes. You remain a separate controller of the personal data you collect about your end users. We tell you whether an end user approved or denied a request, or that it expired, but never their Zyton account ID or the email address on their account.

The providers that help us run the Services are listed on our Subprocessors page. If you need a data processing agreement, email [email protected].

12. Warranties and liability

We provide the Services "as is" and "as available". We work hard to keep them secure and running, but we don't promise that they'll be uninterrupted or error-free, or that they'll meet every need you have.

To the extent the law allows, we're not liable for indirect or consequential losses, or for loss of profits, revenue, data or goodwill.

To the extent the law allows, our total liability for all claims relating to the Services or these terms is limited to the amount you paid us in the 12 months before the event that gave rise to the claim, or US$100 if you haven't paid us anything.

These limits don't apply to liability that the law doesn't allow us to limit, such as liability for fraud, or for death or personal injury caused by negligence.

Nothing in these terms excludes, restricts or changes rights you have under the Australian Consumer Law or other consumer protection laws that can't be excluded. Where the law allows us to limit our liability for failing to meet a consumer guarantee, our liability is limited to supplying the Services again or paying the cost of having them supplied again.

13. Suspension and termination

You can stop using the Services at any time. To end a paid plan, cancel it as section 5 describes. To close your account and delete its data, email [email protected], as our Privacy policy explains.

We may suspend or end your access if you seriously or repeatedly break these terms, if you don't pay, if your use creates a security or legal risk for us or others, or if the law requires us to. Where it's reasonable, we'll tell you why first and give you a chance to fix the problem.

We may also stop offering the Services, or end these terms with you for any other reason, by giving you at least 30 days' notice. If we do, we'll refund any fees you've paid for the time after your access ends.

When your access ends, your API keys stop working and we handle your data as our Privacy policy describes. Terms that by their nature should continue, such as amounts you owe, your responsibilities for end-user consent, liability and governing law, continue to apply.

14. Changes to these terms

We may update these terms. We'll post the new version on this page with a new "Last updated" date. If a change materially affects your rights, for example your fees, our liability or how disputes are resolved, we'll tell you by email or in the portal at least 30 days before it takes effect. If you keep using the Services after that, the new terms apply; if you don't agree, you can cancel before they take effect.

15. Governing law and disputes

These terms are governed by the laws of New South Wales, Australia.

If you have a dispute with us, please contact us first. We'll try in good faith to resolve it within 30 days. If we can't, the courts of New South Wales, Australia, can decide it.

If you're a consumer, you can also bring proceedings in the courts where you live, and you keep the protection of the mandatory consumer laws of your country.

16. General

• We're not responsible for delays or failures caused by events beyond our reasonable control, such as natural disasters, war, or outages of the internet or of our providers.
• If a court finds part of these terms unenforceable, the rest of the terms still apply.
• You may not transfer these terms to anyone else without our written consent. We may transfer them to a company that takes over our business, and we'll tell you if we do.
• These terms, together with our Privacy policy, Refund policy, Cookie policy and any order form we sign with you, are the whole agreement between us about the Services.
• If we don't enforce a right straight away, we haven't given it up.

17. Contact

Questions about these terms or your bill: [email protected]
Privacy questions: [email protected]
Postal address and company details: see our Imprint.