Terms of Service

GeBeCert is a hosted product authentication and consumer-data capture service. It issues unique identities for physical products — codes and secure chip tags — resolves them to branded verification pages, records the resulting verification events, and presents those records to you as analytics.

The Free tier includes up to 500 verified scans per month. Pro and Enterprise tiers add higher limits, white-label verification pages, batch operations, and bulk export.

These Terms are an agreement between you (or the entity you represent) and GeBeCert. By creating an account or using the service you accept them. If you are accepting on behalf of a company, you confirm you are authorised to bind that company.

• You must provide accurate registration information and keep it current.
• You are responsible for all activity under your account and for maintaining the confidentiality of your credentials. Enable multi-factor authentication where offered.
• You must be at least 18 years old and authorised to bind the entity you represent.
• Accounts are for named organisations. You may add team members under the roles we provide, and you are responsible for their activity.

You agree not to:

• Use GeBeCert to authenticate products you do not own or have no right to authenticate.
• Scrape, resell, or attempt to reverse-engineer our verification endpoints or chip protocols.
• Probe for vulnerabilities outside our published disclosure process, or access any account or data not properly authorised to you.
• Use the service to harass, defraud, or misrepresent your relationship with any brand or consumer.
• Circumvent plan limits, rate limits, or access controls.

We may suspend activity that threatens the security or integrity of the service or of other customers, and we will use reasonable efforts to notify you first where the circumstances permit.

GeBeCert runs on third-party infrastructure — a cloud hosting provider, a transactional email provider, and IP geolocation and map-tile services. That architecture is what allows us to deliver the service at scale and at the price we charge. It also means that a failure or degradation originating outside our own systems can affect what you experience.

Service levels

We target monthly availability of 99.9% for the application, excluding scheduled maintenance, which we notify in advance wherever practicable. We measure availability against the production verification endpoint and the dashboard, and we publish the result to you on request at the end of each calendar month.

Availability is measured as the proportion of the calendar month during which the public verification endpoint and the dashboard respond successfully to an unauthenticated request, sampled at intervals of no more than sixty seconds from at least three geographically distinct regions.

The following are excluded from the availability calculation: scheduled maintenance announced at least 48 hours in advance; reasonable emergency maintenance; general internet or carrier failures outside our reasonable control; third-party network failures; beta and preview endpoints; and any period during which you are in material breach of these Terms, including non-payment.

Where a verified failure of the availability target occurs in a calendar month, Enterprise customers may request a service credit within 30 days of the end of that month. Credits are applied to the next invoice on this scale:

Service credits constitute liquidated damages, not a penalty. They are your sole and exclusive remedy for a failure to meet the availability target, without prejudice to your right to terminate for material breach.

Maintenance and planned work

Maintenance windows are announced in advance by email and in the dashboard where the work is expected to be material. We schedule maintenance outside peak business hours in the regions our customers operate in, and we keep the public verification path available on a best-effort basis during non-critical work.

Downtime caused by third-party providers

Where availability is degraded or an outage is caused by a failure originating in a third-party provider’s infrastructure, our position is as follows:

• We remain responsible for our part of the chain. We remain accountable for the engineering, monitoring, redundancy, and incident response we control. A provider failure does not transfer our obligations to them, and we do not treat a third-party outage as a reason to reduce our own standard of care.
• Service credits. Where a third-party outage causes us to miss the monthly availability target, service credits are available to Enterprise customers on request, in line with the credit schedule in their order. We do not require customers to pursue the third-party provider directly to obtain a credit that is properly owed under our agreement.
• Mitigation. We maintain redundancy across infrastructure boundaries, automated failover, and tested recovery procedures so that a single provider failure does not become a total loss of service. Recovery priorities are ordered so that the consumer verification path — the path your customers use to authenticate a product — is restored before analytics, reporting, or administrative functions.
• Communication. We will confirm an outage we attribute to a third-party provider, state what we know about its cause and expected duration, and give updates as the situation develops. We do not ask customers to monitor provider status pages to understand the state of our service.
• No compensation for provider failure alone. Save as expressly provided in these Terms or your order, we are not liable for loss that arises from a third-party provider’s failure to perform, where we have complied with our own obligations in Section 04. This limitation does not apply where our own negligence or failure contributed to the outage.

Force majeure

Neither party is liable for failure to perform caused by events beyond its reasonable control, including natural disaster, war, civil unrest, epidemic, governmental action, denial-of-service attack, or failure of third-party infrastructure or utilities. We will use reasonable efforts to restore service, and the suspension does not entitle you to terminate for the affected period alone.

A force majeure event does not excuse your payment obligations. Fees already accrued remain payable, and fees for a suspended period remain payable for the duration of the suspension.

Your continuity planning

We do not ask you to treat GeBeCert as your only record of consumer activity. Export your verification data regularly — batch and bulk export are included from the Pro tier upward — so that your operational reporting and your customer records remain independent of our availability. Where your business requires continuous verification during an outage, discuss failover arrangements with us before you need them.

We may modify the service, and we may update these Terms. Material changes are notified by email to account administrators at least 30 days before they take effect, and the effective date is recorded at the top of this page. If you do not accept a material change, you may terminate your subscription before it takes effect and we will refund any prepaid, unused fees.

We may introduce new features or change plan entitlements. Where a change materially reduces a paid feature you actively use, we will offer a comparable alternative or allow you to cancel with a prorated refund.

GeBeCert retains all right, title, and interest in the service, the ChipTech architecture, the verification protocols, the software, and the underlying intellectual property, including the technology we developed for embedding chip identity inside physical products.

You retain all right, title, and interest in your own content — your brand assets, product data, marketing material, and the consumer records you collect. You grant us a limited, non-exclusive licence to host, process, and display that content solely to operate the service for you. This licence ends when you delete the content or your subscription ends, save for archival copies held in backup cycles.

Verification event data collected through your branded pages is yours. We do not use it to build a cross-customer dataset, to train models, or to benchmark other customers.

We back your data up nightly to encrypted, geographically separate storage, on a rolling 30-day window. Backups exist to recover from our own failure — they are not a live replica and are not available for ad-hoc restore on demand.

You can export your data at any time through the dashboard, and bulk export is included from the Pro tier upward. Exports are provided in structured, machine-readable formats. We do not restrict your ability to take your data elsewhere, and we do not impose an export fee.

Our handling of personal data, including the safeguards we apply to third-party infrastructure, is described in full in our Privacy Policy.

Subscriptions are billed in advance on the cycle you select. Payment is taken automatically by our payment processor. Fees exclude taxes, which are added where applicable.

We suspend accounts 14 days past the due date, after two reminder emails. Data is retained for 30 days following suspension, and is restored on receipt of payment. After 30 days the account is closed and its data is deleted in line with the retention schedule in our Privacy Policy.

Plan limits are measured per calendar month. Where a limit is reached we notify you before the fact, and where we can, we offer a mid-cycle upgrade rather than a hard stop.

Warranties

We warrant that we will perform the service with reasonable skill and care, that it will materially conform to its documentation, and that we will not knowingly introduce malicious code into it. Except as stated, the service is provided on an as-is basis and we disclaim implied warranties to the fullest extent permitted by law.

Our aggregate liability

Subject to the exclusions below, our total aggregate liability arising out of or in connection with the service is limited to the greater of the fees you paid us in the 12 months preceding the event giving rise to the claim, or USD 1,000.

The cap in this section does not apply to a personal data breach caused by our failure to meet our security obligations, nor to our liability for infringement of your intellectual property rights. For those, our aggregate liability is limited to the greater of the fees you paid us in the 12 months preceding the event, or USD 100,000.

Exclusions

Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded.

We are not liable for indirect or consequential loss, or for loss of profit, revenue, goodwill, or anticipated savings. We are not liable for loss of data where you have not maintained the exports described in Section 07.

Third-party infrastructure

We are liable for the security and integrity of the personal data in our custody, including data processed by subprocessors on our instructions, and our obligations in respect of it are set out in Section 04 and in our Privacy Policy. Where loss arises from a third-party provider’s failure to perform, the aggregate limit in this Section applies to that loss as well, subject to the exclusions above. We do not reduce our liability simply because the failure originated outside our own systems, and we do not require you to pursue the provider yourself.

We remain fully liable to you for the performance of a subprocessor’s data-protection obligations where that subprocessor fails to meet them. Where you have suffered loss arising from a processor breach, our liability to you is governed by Section 09 of these Terms.

Nothing in these Terms excludes our responsibility for our own security obligations, nor limits your right to make a claim against us directly for a breach of them.

Indemnity

You agree to indemnify us against claims arising from your use of the service in breach of these Terms, including your infringement of a third party’s rights and your use of content you upload.

We indemnify you against any third-party claim that the service, as we supply it, infringes that third party’s intellectual property rights. If such a claim is made, we will procure for you the right to continue using the affected part of the service, or replace or modify it so it is no longer infringing, or failing both refund the fees you paid for the affected part in the 12 months before the claim and allow you to terminate the affected service.

Either party may terminate for material breach that remains uncured 30 days after written notice. You may terminate at any time by cancelling your subscription, and we may suspend or terminate immediately where continued operation would breach law, threaten the security of the platform or other customers, or where required by a competent authority.

On termination we export your data for 30 days, after which it is deleted in line with the retention schedule in our Privacy Policy. We refund prepaid, unused fees on termination for convenience.

These Terms are governed by the laws of the Hong Kong Special Administrative Region, without prejudice to any mandatory consumer protections available to you. The courts of the Hong Kong Special Administrative Region have exclusive jurisdiction, except that we may seek injunctive relief in any competent jurisdiction.

If a provision is held unenforceable, the remainder continues in full effect. Our failure to enforce a right is not a waiver of it. These Terms are the entire agreement between us on their subject and supersede prior statements.

Where we process personal data on your instructions as a processor, the terms are in our Data Processing Agreement, which forms part of this agreement.

Questions about these terms: [email protected]. General enquiries: the contact page.