Legal

Terms of Service

Effective date: [EFFECTIVE DATE]

These Terms of Service (the "Terms") form a binding agreement between MKYCAPITAL LTD, a company registered in England and Wales under number 17156320, with its registered office at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom ("Keyrail", "we", "us"), and the business or organisation that creates an account or uses the Service (the "Customer", "you").

By creating an account, clicking to accept these Terms, or using the Service, you confirm that you have read and accept them. If you accept on behalf of an organisation, you confirm that you have authority to bind it.

1. Business use only#

The Service is offered exclusively to businesses, sole traders and other professionals acting for purposes relating to their trade, business, craft or profession. It is not offered to consumers. By accepting these Terms you confirm that you are not acting as a consumer.

2. Definitions#

3. Your account#

3.1. You must provide accurate information when creating an account and keep it up to date.

3.2. Access to the dashboard is by single-use sign-in links sent to the email address of each user. You are responsible for securing the email accounts of your users, for your secret API keys, and for all activity under your account. Notify us without undue delay at security@keyrail.tech if you suspect unauthorised access.

3.3. Secret API keys are shown once at creation. We store only a hash of them and cannot recover them. You must rotate any key you believe has been exposed.

4. The Service#

4.1. What the Service does. The Service lets you issue licence keys, limit activations per machine, manage licence status from events sent by your Payment Provider, issue signed certificates that your Customer Application can verify offline, and give your End Customers a self-service portal.

4.2. Offline verification. Certificates issued by the Service are signed with keys specific to each of your products and remain verifiable offline until their expiry date, as described in the technical documentation. A temporary unavailability of the Service does not prevent a Customer Application from verifying a certificate already obtained.

4.3. Your responsibility for enforcement decisions. The Service reports licence status. You decide how your Customer Application behaves (for example, which features to enable, whether to show a warning, or whether to stop working). You are solely responsible for those decisions and for your relationship with your End Customers, including refunds, support and compliance with consumer law where your End Customers are consumers.

4.4. Changes. We may improve or modify the Service. We will not materially reduce the core functionality of a paid Plan during a paid period. We will give at least 90 days' notice before removing a public API version, except where required for security or by law.

4.5. Beta features. Features marked "beta", "preview" or similar are provided as-is, may change or be withdrawn, and are excluded from any service level commitment.

5. Plans, limits and fees#

5.1. Plans. Plan limits (such as the number of active licences and products) and prices are published on the pricing page. Limits are soft: if your account exceeds the limit of its Plan, the Service will continue to serve your existing End Customers' licences, will warn you, and may refuse the creation of new products. We may ask you to move to an appropriate Plan if you stay over the limit for more than [30] days.

5.2. Free Plan. The Free Plan is provided without charge and without any service level commitment. We may change or discontinue the Free Plan with at least 60 days' notice.

5.3. Paddle is the reseller of paid Plans. The Indie and Pro Plans (and any other Plan offered for self-service purchase) are sold through Paddle, which acts as reseller and merchant of record. Depending on where you buy, Paddle is Paddle.com Market Limited (company number 8172165, 30 Old Bailey, London EC4M 7AU, United Kingdom), Paddle.com Inc. (United States) or Paddle.com (Canada) Ltd. (Canada), as set out in the Paddle Buyer Terms [TO VERIFY ON PUBLICATION DATE]. When you buy a Plan:

• you buy it from Paddle, under the Paddle Buyer Terms, which you accept at checkout;
• Paddle runs the checkout, collects the payment, issues the invoices, calculates, collects and remits sales taxes such as VAT, and handles refunds and chargebacks;
• your payment details are given to Paddle and are never received or stored by us;
• these Terms govern your access to and use of the Service under that Plan.

In case of conflict, the Paddle Buyer Terms prevail for payment, invoicing, taxes, refunds and chargebacks, and these Terms prevail for everything else [TO CONFIRM WITH COUNSEL]. Business Plans and any custom arrangement are agreed directly with us in an order form, which states how they are invoiced.

5.4. Buying and changing a Plan. The owner of your account buys, changes and cancels the Plan from the "Account & usage" page of the dashboard. A paid Plan starts when Paddle confirms the payment to us, usually within seconds. You can change to another paid Plan, or between monthly and yearly billing, at any time: the change is prorated by Paddle for the rest of the current billing period (an increase is charged immediately, a decrease is credited or otherwise settled as Paddle determines under the Paddle Buyer Terms), and the new Plan applies once Paddle confirms the change to us. Billing actions cannot be performed with a secret API key.

5.5. Billing period and automatic renewal. Paid Plans are billed in advance, monthly or yearly. They renew automatically at the end of each billing period, for a period of the same length and at the price then in force for your Plan, and Paddle charges the payment method on file, until you cancel. Where applicable law requires a reminder before a renewal, it will be sent by [Paddle / us] [TO CONFIRM WITH COUNSEL].

5.6. Taxes and invoices. Prices are exclusive of taxes unless stated otherwise. Paddle adds any applicable VAT or sales tax at checkout based on your billing location and may apply a reverse charge where you provide a valid tax identification number. Invoices are issued by Paddle and are available from the billing portal opened by "Manage billing" in the dashboard.

5.7. Cancellation. You can cancel a paid Plan at any time from "Manage billing" in the dashboard (which opens Paddle's customer portal) or as described in the Paddle Buyer Terms. Cancellation takes effect at the end of the current billing period: your Plan stays in force until then, and your account then returns automatically to the Free Plan. The same applies if your subscription is paused. Cancelling a Plan does not close your account (see section 14.2) and does not affect your End Customers: their licences keep working, certificates already issued remain valid, and if your account exceeds the Free Plan limits, section 5.1 applies (soft limits).

5.8. Refunds. Except where these Terms expressly provide for a pro-rata refund (sections 11.2 and the DPA, section 7.2), fees are non-refundable, without prejudice to any refund you are entitled to under the Paddle Refund Policy or applicable law. Refunds are decided and paid by Paddle. Where these Terms provide for a refund, we will ask Paddle to issue it to the original payment method [TO CONFIRM WITH COUNSEL: mechanism and who bears the refund].

5.9. Price changes. We may change prices for future billing periods with at least 30 days' notice by email to the account owner. A new price applies to your subscription from the first renewal after the notice period. If you do not accept the change, you can cancel before it takes effect.

5.10. Failed payments. If a renewal payment fails, Paddle retries it and contacts you according to its payment recovery process. Your Plan stays in force while the payment is being recovered. If Paddle cancels the subscription because the payment could not be recovered, your account returns to the Free Plan as in section 5.7. A downgrade never revokes your End Customers' licences; it only applies the Free Plan limits to your account.

6. Acceptable use#

You must not, and must not allow anyone to:

• use the Service in breach of any applicable law, including sanctions and export control laws;
• use the Service to license, distribute or monetise malware, software that infringes third-party rights, or software whose purpose is unlawful;
• attempt to access data of another Keyrail customer, probe or bypass security controls, or test the Service's vulnerabilities without our written permission (responsible disclosure: see https://keyrail.tech/security/);
• overload the Service, circumvent rate limits, or use the Service in a way that degrades it for other customers;
• resell the Service as a stand-alone licensing service without our written agreement;
• submit special categories of personal data (such as health data) or payment card data to the Service.

We may suspend access to the extent reasonably necessary to stop a breach of this section or to protect the Service, and will notify you promptly with the reason. Where possible we will limit suspension to the vendor API and dashboard so that certificates already issued to your End Customers keep working.

7. Customer Data and data protection#

7.1. Ownership. You keep all rights in Customer Data. You grant us a limited licence to host, process and transmit Customer Data only to provide, secure and support the Service and as otherwise instructed by you.

7.2. Data protection. Where we process personal data on your behalf, we act as your processor and the DPA applies. Where we process personal data for our own purposes (for example the account details of your users, billing, security and fraud prevention), we act as an independent controller as described in our Privacy Policy.

7.3. Your responsibilities. You are responsible for having a lawful basis and giving any required information to your End Customers for the processing of their personal data through the Service, including the sending of licence emails on your behalf.

7.4. No telemetry. The Service does not collect usage telemetry from Customer Applications. The SDKs send only the data needed for activation and validation, as described in the technical documentation.

7.5. Export and deletion. You can export your licences, customers and activations through the vendor API at any time, and the account owner can download a complete export (licence keys included) and the private signing keys of each product from the dashboard (section 15). After termination, we will delete Customer Data in accordance with section 14.5 and the DPA.

8. Intellectual property#

8.1. We own the Service, including its software, design and documentation, except the SDKs, which are licensed under their open-source licence, and Customer Data.

8.2. Feedback you choose to give us may be used by us without restriction or compensation.

8.3. You may describe Keyrail as your licensing provider. We may list your company name and logo as a customer only with your prior written consent.

9. Availability and support#

9.1. We aim for high availability but do not guarantee that the Service will be uninterrupted or error-free. The Service relies on third-party infrastructure listed on the sub-processors page.

9.2. Support is provided by email at support@keyrail.tech on business days. [Business Plan: response times and any service level commitment are set out in a separate order form.]

9.3. We will publish incidents and planned maintenance at [STATUS PAGE URL].

10. Confidentiality#

Each party will keep confidential the non-public information disclosed by the other party that is marked as confidential or that should reasonably be understood as confidential, will use it only for the purposes of these Terms, and will protect it with at least reasonable care. This obligation does not apply to information that is or becomes public without breach, was already known, is independently developed, or must be disclosed by law (in which case the disclosing party will be notified where legally allowed).

11. Warranties and disclaimers#

11.1. Each party warrants that it has the authority to enter into these Terms.

11.2. We warrant that we will provide the Service with reasonable skill and care. Your exclusive remedy for a breach of this warranty is that we use reasonable efforts to correct the failure and, if we cannot, that you may terminate and receive a pro-rata refund of prepaid fees for the remaining period (paid through Paddle, see section 5.8).

11.3. Licensing reduces, but cannot eliminate, unauthorised use of software. We do not warrant that the Service or the SDKs will prevent piracy, reverse engineering or tampering with a Customer Application.

11.4. Except as expressly stated in these Terms, and to the maximum extent permitted by law, the Service is provided "as is" and we disclaim all other warranties, express or implied, including fitness for a particular purpose and non-infringement.

12. Limitation of liability#

12.1. Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law.

12.2. Subject to 12.1, neither party is liable for any loss of profits, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss, even if foreseeable.

12.3. Subject to 12.1, each party's total aggregate liability arising out of or in connection with these Terms in any 12-month period is limited to the greater of (a) the fees paid or payable by you for your Plan, excluding taxes, in the 12 months before the event giving rise to the claim, whether paid to us or to Paddle as reseller, and (b) [USD 100].

12.4. The limitations in this section do not apply to your obligation to pay fees (including fees due to Paddle for your Plan), or to either party's liability for breach of section 6 (acceptable use) or [section 10 (confidentiality)] [TO CONFIRM WITH COUNSEL].

13. Indemnity#

You will defend and indemnify us against third-party claims arising from your Customer Application, your relationship with your End Customers, or your breach of section 6, and against related reasonable costs, provided we notify you promptly, give you control of the defence and reasonably cooperate.

14. Term and termination#

14.1. These Terms apply from the date you accept them until your account is closed.

14.2. You may close your account at any time from the dashboard (as the account owner) or by email to support@keyrail.tech. Closing your account automatically cancels your paid Plan with Paddle at the end of the current billing period: the Plan is not renewed and nothing more is charged (section 5.7).

14.3. Either party may terminate for material breach if the breach is not remedied within 30 days of written notice. We may terminate immediately if you are subject to insolvency proceedings or if continued provision of the Service would breach applicable law.

14.4. We may terminate the Free Plan of an account that has been inactive for more than [12] months, after at least 30 days' notice by email.

14.5. Transition. When your account is closed, the following applies for 30 days so that you can migrate your End Customers:

(a) the dashboard and the vendor API are no longer accessible: export your Customer Data from the dashboard before closing the account, or reopen it to export;

(b) licences already activated by your End Customers keep validating, and certificates already issued remain verifiable offline until their expiry date;

(c) payments of your End Customers notified by your payment provider keep being processed (for example, a renewal extends the licence), but no licence key is emailed;

(d) activations of new devices are refused.

During these 30 days you can reopen the account with the single-use link emailed to the account owner at closure; reopening resumes your cancelled Plan where Paddle allows it, otherwise the Plan ends as scheduled and you can subscribe again. After 30 days, the account and all Customer Data are deleted (section 7.5 and the DPA). If we terminate under section 14.3 for a reason other than your breach, or under section 14.4, we will notify you at least [14] days in advance so that you can export Customer Data, and the account then follows the same transition.

14.6. Sections 7.5, 8, 10, 11.4, 12, 13, 15.3, 16 and any other provision which by its nature should survive, survive termination.

15. Service continuity#

15.1. Why this section exists. The Service is operated by a small company. You rely on it for the licensing of your own products, so this section states what you can do without us, and what we commit to if the Service is discontinued. The technical means described in 15.2 are part of the Service and are available at any time, not only on termination.

15.2. Exit path built into the Service.

(a) Certificates already issued to your End Customers are verified offline by the Customer Application with the public key it embeds, and remain verifiable until their expiry date, without any call to the Service (section 4.2).

(b) The account owner can download, at any time, a complete export of Customer Data (section 7.5) and the private signing keys of each product, pending, active and retired. With the signing keys you can issue certificates in the documented format yourself, and Customer Applications already distributed accept them without modification. The export of signing keys is restricted to the account owner, is recorded in your audit log and is rate-limited; you are responsible for keeping the exported keys secure, and section 11.3 applies to their use.

(c) The certificate format, its verification rules and public test vectors are published in the technical documentation, and the SDKs are licensed under an open-source licence and accept any server address.

15.3. Discontinuation of the Service. If we decide to discontinue the Service, or a material part of it on which Customer Applications depend (such as the public client API or the issuance of certificates), we will give you at least 90 days' notice by email to the account owner. During the notice period the Service, the exports of 15.2(b) and the vendor API remain available, and we will provide reasonable assistance by email to help you migrate. The transition of section 14.5 then applies from the end of the notice period. Shorter notice may apply only where required by law or by an event of force majeure, in which case we will give as much notice as is reasonably possible and keep the exports available for as long as we can.

15.4. Successor. An assignment of these Terms to a successor under section 16.2 that continues to provide the Service on these Terms is not a discontinuation.

15.5. What is not covered. The Service itself (dashboard, APIs, customer portal, webhook processing) is proprietary software that we do not provide for self-hosting. After the Service is discontinued, Customer Applications can no longer refresh their certificates from the Service: they keep their current certificate until it expires, and then depend on the certificates you issue yourself or on an update of the Customer Application. It is your responsibility to use the notice period and the exports of 15.2 for that purpose. [TO CONFIRM WITH COUNSEL: enforceability of this commitment in insolvency proceedings, and whether an escrow or a standing instruction to hand over the keys should be set up.]

16. General#

16.1. Changes to these Terms. We may update these Terms. For material changes we will give at least 30 days' notice by email or in the dashboard. Continued use after the effective date constitutes acceptance; if you do not accept, you may close your account before that date.

16.2. Assignment. You may not assign these Terms without our consent, which will not be unreasonably withheld. We may assign them to an affiliate or to a successor in a merger, acquisition or sale of assets, with notice to you.

16.3. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control.

16.4. Notices. Notices to you are sent to the email address of the account owner. Notices to us must be sent to legal@keyrail.tech.

16.5. Entire agreement. These Terms, the DPA and any order form constitute the entire agreement between the parties on their subject matter. In case of conflict, the order form prevails, then the DPA (for data protection matters), then these Terms.

16.6. Severability and waiver. If a provision is held invalid, the rest remains in force. Failure to enforce a provision is not a waiver.

16.7. Third parties. No third party, including End Customers, has any right to enforce these Terms [, including under the Contracts (Rights of Third Parties) Act 1999].

16.8. Governing law and jurisdiction. These Terms are governed by the laws of [GOVERNING LAW]. The courts of [JURISDICTION] have exclusive jurisdiction over any dispute arising out of or in connection with them.

16.9. Language. These Terms are written in English. Any translation is for convenience only.

Contact#

MKYCAPITAL LTD, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. Email: legal@keyrail.tech.