Terms of Service
The rules for using SkedEz, subscriptions, customer data, processing terms, security measures, and legal remedies.
- Version
- terms-2026-09-16
- Effective date
- September 16, 2026
- Last updated
- September 16, 2026
Legal contact
Agreement, eligibility, and authority
These Terms form an agreement for use of SkedEz. A person must be an adult and have authority to accept these Terms for a business or must use the service only as an authorized individual user.
- The person accepting for a business confirms authority to bind a business and must provide accurate information.
Accounts and security
Customers must protect credentials, keep account information current, limit access to authorized people, and promptly report suspected compromise. Customers are responsible for activity performed through their accounts except to the extent applicable law provides otherwise.
- StationByte may apply safeguards, verification, rate limits, or temporary protective measures to protect accounts and the service.
Acceptable use
Customers may not use SkedEz unlawfully, infringe rights, send harmful or deceptive material, bypass controls, probe or disrupt systems, introduce malicious code, abuse integrations, or use the service to create an unreasonable security or privacy risk.
- Prohibited conduct includes unauthorized access, misuse of personal data, interference with another user's service, and attempts to reverse engineer protected components except where law permits.
Plans, billing, trials, renewal, and refunds
SkedEz offers free and paid plans with feature limits, trials when offered, and plan-specific terms. Paid subscriptions are billed in advance and renew until canceled; canceling takes effect at the end of the paid period.
- Customers are responsible for applicable fees and taxes. Fees are non-refundable except where applicable law or an express written offer requires otherwise; payment processors and app stores may impose their own terms.
Service changes and integrations
StationByte may change, maintain, suspend, or discontinue features, plans, availability, or integrations, with notice or other protections required by applicable law. Third-party integrations remain subject to their own permissions and terms.
- Maintenance, networks, and third-party services can affect availability, and StationByte does not promise uninterrupted or error-free operation.
Intellectual property and license
StationByte and its licensors retain rights in SkedEz and its materials. Customers retain rights in their own content and grant only the limited rights needed to operate, secure, support, and improve the service as described in these Terms and the Privacy Policy.
- Subject to these Terms, StationByte grants a limited, non-exclusive, non-transferable right to access and use SkedEz for the customer's authorized internal business purposes during the applicable subscription or free use.
Confidentiality and security responsibilities
Each party must protect the other's confidential information with reasonable care, use it only for the relationship, and disclose it only to people or providers who need it and are bound by confidentiality duties, subject to lawful requests.
- The parties will maintain appropriate security measures for their respective systems and promptly cooperate on a suspected security incident affecting the service or customer data.
Customer data and roles
The customer is generally controller for appointment data concerning its clients, and StationByte processes that data as processor to provide SkedEz. The customer is responsible for lawful collection, notices, instructions, data quality, permissions, and responses to its clients.
- The customer must not instruct processing that violates applicable law and must use the service's controls to honor appropriate access, correction, deletion, and consent requests.
Processor terms
Documented instructions: StationByte processes customer appointment data only on the customer's documented instructions in these Terms, the customer's configuration, and lawful written directions, unless applicable law requires otherwise. Where the GDPR applies, StationByte will immediately inform the customer if, in its opinion, an instruction infringes Union or Member State data-protection law.
Confidentiality: people authorized to process customer appointment data are bound by confidentiality duties and receive access only for their assigned responsibilities.
Rights assistance: taking account of the processing, StationByte provides reasonable assistance with requests to access, correct, delete, restrict, object to, or export appointment data.
Breach and DPIA assistance: StationByte provides reasonable information and cooperation for security incident notification and data-protection impact assessments. Where the GDPR applies, StationByte notifies the customer without undue delay after becoming aware of a personal-data breach and provides the assistance required by Articles 32 to 36, taking into account the nature of processing and the information available to StationByte.
Deletion or return: at the customer's choice after the service ends, StationByte deletes or returns all personal data processed on the customer's behalf under these Terms and deletes existing copies, except where applicable law requires storage. Where the GDPR applies, this exception is limited to storage required by Union or Member State law.
International transfer instructions: StationByte follows the verified transfer safeguards and documented instructions published for the enabled provider path and does not transfer customer appointment data contrary to applicable requirements.
- Article 28 scope: the processing subject matter is appointment and business-service data; its duration is the service relationship; its nature and purpose are hosting, scheduling, support, security, and requested integrations; the personal-data categories and data-subject categories are those configured by the customer for its users, clients, and staff.
Technical and organizational measures schedule
The versioned technical-and-organizational-measures schedule is toms-2026-08-20. It describes the control areas applied to the service and is reviewed periodically for effectiveness.
- Access control — permissions are granted, reviewed, and removed through controlled access processes.
- Authentication — accounts and service access use authentication controls appropriate to the risk.
- Least privilege — people and systems receive only the access needed for assigned work.
- Encryption in transit — network transfers use protected channels where applicable.
- Encryption at rest where applicable — stored data is protected with available encryption controls appropriate to the service.
- Tenant and data segregation — customer data and authorization boundaries are designed to reduce cross-tenant access risk.
- Backup and recovery — backup, restoration, and recovery procedures support continuity and data resilience.
- Logging and monitoring — relevant security and operational activity is logged and monitored with appropriate safeguards.
- Vulnerability and patch management — vulnerabilities are assessed and fixes are prioritized and deployed according to risk.
- Incident response — documented response, escalation, containment, investigation, and notification processes address security incidents.
- Availability and resilience — service operations include continuity planning, capacity awareness, and recovery objectives appropriate to the service.
- Vendor management — relevant providers are selected, reviewed, and governed through contractual and operational controls.
- Personnel confidentiality — personnel receive confidentiality duties and role-appropriate security guidance.
- Data minimization — collection, access, and disclosure are limited to what the documented service purpose requires.
- Retention and deletion — data is retained and deleted under documented schedules, legal holds, and auditable processes.
- Periodic effectiveness review — safeguards are reviewed and improved periodically as risks, systems, and evidence change.
Subprocessors
The customer gives general written authorization for the versioned subprocessor registry. StationByte gives at least 30 days' advance notice of a new or replacement subprocessor through the registry or another durable notice.
The customer may object on reasonable data-protection grounds within the notice period and must explain the grounds sufficiently for StationByte to assess them.
StationByte documents a resolution path, including reasonable mitigation or an alternative where available; if no reasonable alternative exists, the affected service may be ended in accordance with these Terms and applicable law.
Where the GDPR applies, each subprocessor is bound by the same data-protection obligations applicable to StationByte under these Terms, and StationByte remains fully liable to the customer for the performance of the subprocessor's obligations.
- Only the verified provider and subprocessor details applicable to the deployed service are presented as enabled facts.
Audit and inspection
Where the GDPR applies, StationByte makes available all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the customer or an auditor mandated by the customer. StationByte may first provide available independent assurance reports and relevant security documentation, followed by reasonable written responses to focused questions; this process does not limit those audit and inspection rights.
The inspection process may include the customer, its independent auditor, or a competent authority and does not restrict mandatory regulator powers. Inspections are coordinated to protect other customers and are charged only where legally permitted; StationByte bears reasonable cost when material non-compliance is found.
- Audit information is handled confidentially and may not expose another customer's data, security details, or confidential material.
Disclaimers and availability
To the maximum extent permitted by law, SkedEz is provided on an as-available basis and StationByte disclaims implied warranties not required by law, including uninterrupted availability, fitness for a particular purpose, and non-infringement.
- The customer remains responsible for its business decisions, content, notices, permissions, and use of appointment data.
Limitation of liability
To the maximum extent permitted by law, aggregate liability arising from the service or these Terms is limited to the fees paid for SkedEz during the preceding 12 months, or USD 100 for a free account. This limit does not apply to liability that applicable law does not allow the Terms to exclude or limit.
- To the extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or lost-profit damages, subject to non-waivable rights.
Indemnity
Each party will provide the indemnity and cooperation required by applicable law for claims arising from its unlawful conduct, infringement, or breach of its responsibilities, subject to fair notice, control of defense, and reasonable mitigation.
- Any indemnity applies only to the extent lawful and does not require a party to waive a mandatory right or assume liability that cannot lawfully be transferred.
Suspension and termination
StationByte may suspend or terminate access for non-payment, material breach, unlawful or dangerous use, security risk, or service discontinuation, with notice and an opportunity to cure where appropriate and lawful. The customer may cancel under its plan terms.
- On termination, access ends, accrued payment duties remain due, and the deletion or return rules for customer data apply. Provisions intended to survive termination continue.
Changes and notices
A material change to these Terms creates a new version and is notified through the service, email, or another durable method before it takes effect when required. Legal notices may be sent to contact@stationbyte.com.
- Continued use after an effective change does not waive a right that applicable law makes non-waivable.
Applicable law and mandatory rights
These Terms are interpreted under applicable law while preserving mandatory consumer rights and other protections that apply to the customer or user.
No blanket waiver in these Terms overrides a non-waivable consumer protection, privacy right, remedy, or power of a competent authority.
These Terms do not select state-specific law, court, or forum. The parties may use any forum made available by applicable mandatory law.
- Questions and legal notices concerning these Terms may be sent to contact@stationbyte.com.
Provider registry
| Provider registry | Version |
|---|---|
| Provider registry | provider-registry-2026-09-16 |
Provider registry
- Version
- provider-registry-2026-09-16
Provider verification required
This versioned registry is not release-complete while an enabled provider lacks verified account and legal evidence. Incomplete provider details are not presented as facts.
Professional advisers and public authorities, where lawfully required
- professional-advisers-public-authorities
- professional-advisers-and-public-authorities
- Only information lawfully required for advice, proceedings, or an authority request
- Obtain professional advice or respond to a lawful authority request
- Legal obligation and legitimate interests, as applicable
Technical and organizational measures
| Technical and organizational measures | Version |
|---|---|
| Technical and organizational measures | toms-2026-08-20 |
Technical and organizational measures
- Version
- toms-2026-08-20
- Access control — permissions are granted, reviewed, and removed through controlled processes.
- Authentication — accounts and service access use controls appropriate to risk.
- Least privilege — people and systems receive only access needed for assigned work.
- Encryption in transit — network transfers use protected channels where applicable.
- Encryption at rest where applicable — stored data is protected by suitable available controls.
- Tenant and data segregation — authorization boundaries reduce cross-tenant access risk.
- Backup and recovery — backup, restore, and recovery procedures support continuity.
- Logging and monitoring — relevant security and operational activity is logged and monitored with safeguards.
- Vulnerability and patch management — vulnerabilities are assessed and fixes are prioritized by risk.
- Incident response — documented escalation, containment, investigation, and notification processes address incidents.
- Availability and resilience — continuity, capacity, and recovery objectives support service resilience.
- Vendor management — relevant providers are assessed and governed by contractual and operational controls.
- Personnel confidentiality — personnel have confidentiality duties and role-appropriate security guidance.
- Data minimization — collection, access, and disclosure are limited to the documented purpose.
- Retention and deletion — data follows documented schedules, legal holds, and auditable processes.
- Periodic effectiveness review — safeguards are reviewed and improved as risks and systems change.