Terms of Service

These Terms form a binding agreement between you and the Einzelunternehmen trading as "edvone" (Edvard Grei), Jülicher Straße 72a, 52070 Aachen, Germany ("elvix", "we", "us"). By creating or signing in to an elvix account, or by using the Console, you accept these Terms. If you accept on behalf of an organisation, you confirm you are authorised to bind it. "Consumer" and "entrepreneur" have the meanings given in §§ 13, 14 BGB.

1. The service

elvix is a sign-in (identity) service. Businesses ("Operators") integrate it so people ("end users") can sign in to their applications. We hold the sign-in factors needed to recognise a user (a hash of email one-time codes, OAuth provider links, and passkey public keys) and an audit trail of sign-in events. Account holders may also keep an optional profile (contact details, postal addresses, billing and tax entities, languages) that they can choose to share with the apps they sign in to. elvix does not use passwords and does not hold the data the Operator's application keeps about its users.

2. Two surfaces, two relationships

• Your account is for end users. elvix is the controller of the sign-in data it holds about you; the app you sign in to controls its own data about you.
• Your Console is for Operators. You are the controller of the end-user data in your apps; elvix is your processor under a Data Processing Agreement (DPA) reflecting Articles 28 and 32 GDPR.

3. Accounts and eligibility

• You must be at least 16 years old to hold an elvix account.
• Provide accurate details and keep your devices, passkeys, and recovery channels secure.
• You are responsible for activity carried out through your account or API keys.
• Notify us without undue delay at [email protected] if you suspect unauthorised access.

4. Acceptable use

You agree not to, and not to permit any third party to:

• use the service unlawfully, or to sign users in to content or services prohibited by EU or German law;
• send phishing, spam, malware, or use elvix to facilitate fraud or credential abuse;
• probe, scan, attack, overload, or attempt to circumvent the security or rate limits of the service;
• reverse engineer, decompile, or disassemble the service except to the narrow extent permitted by mandatory law (for example § 69e UrhG);
• scrape, resell, sublicense, or white-label the service except as expressly agreed;
• misrepresent your identity or impersonate others.

We may investigate suspected violations and cooperate with law-enforcement authorities where legally required.

5. Operator obligations

• Use elvix lawfully and only for applications you are entitled to operate.
• Give your own end users a compliant privacy notice and hold a lawful basis for the processing elvix performs on your behalf.
• Comply with the DPA and Articles 28 and 32 GDPR, and keep your API keys confidential.
• Remain solely responsible, as controller, for your end users and the content of your applications.

6. Fees and taxes

End-user accounts at /account are free. Console pricing for Operators, where it applies, is shown on the pricing page; any change takes effect no earlier than 30 days after notice. Prices are in EUR. Any applicable taxes are shown on the invoice or at checkout in accordance with the law in force at that time.

7. Intellectual property

elvix, its software, design, documentation, and marks are owned by the operator or its licensors and are protected by law. We grant you a limited, revocable, non-exclusive, non-transferable right to use the service as intended for the duration of your account. You keep all rights in your own data and content; you grant us only the rights needed to operate, secure, and provide the service to you. If you send us feedback or suggestions, you grant us a perpetual, royalty-free licence to use them without obligation to you.

8. Third-party services

Where you choose a third-party provider (for example "Continue with Google"), that provider's own terms and privacy policy apply to your relationship with it. We are not responsible for the availability, acts, or omissions of third-party providers.

9. Beta and changes to the service

elvix is offered during an early-access phase. Features may be added, changed, or withdrawn, and the service is provided without any service-level commitment unless you have a separate written SLA. We give reasonable notice of material changes. Mandatory statutory rights remain unaffected.

10. Warranties

To the extent permitted by law, and without prejudice to your mandatory statutory rights as a consumer and to statutory liability for defects, the free service is provided on an "as is" and "as available" basis. We do not warrant that the service will be uninterrupted, error-free, or fit for a particular purpose beyond what is described.

11. Indemnification (Operators)

If you are an Operator (an entrepreneur within § 14 BGB), you will indemnify and hold us harmless against third-party claims, including reasonable legal costs, arising from your applications, your content, your end users, or your breach of these Terms or applicable law, provided we notify you of the claim and let you participate in its defence. This section does not apply to consumers.

12. Limitation of liability

We are liable without limitation for damages caused by intent or gross negligence, for injury to life, body, or health, under the German Product Liability Act (Produkthaftungsgesetz), and under any guarantee we expressly give. For slight negligence we are liable only for breach of an essential contractual obligation (a duty whose fulfilment makes proper performance of the contract possible and on whose observance you may regularly rely), and that liability is limited to the foreseeable damage typical for this kind of contract. Any further liability is excluded. For paid Operator subscriptions, our aggregate liability for slight negligence is in any case capped at the fees paid in the twelve months before the event giving rise to the claim. Where we are liable for loss of data, that liability is limited to the typical cost of recovery that would have arisen had you kept reasonable, regular backups. The limitations above do not apply where the law forbids them.

13. Term, suspension, and termination

You may delete your account at any time from /account or your Console settings; we then revoke your sessions and delete your record in line with our privacy policy. We may suspend or terminate access for material breach (such as fraud, abuse, security risk, or unlawful use), giving notice and a chance to cure where the circumstances reasonably allow, and with immediate effect where a serious security or legal risk requires it. On termination of an Operator account we make your export available for a reasonable period before deletion.

14. Force majeure

Neither party is liable for failure or delay caused by events beyond its reasonable control, including outages of upstream infrastructure, network or energy failures, acts of authorities, or comparable events. Affected obligations are suspended for the duration of the event.

15. Changes to these Terms

We publish material changes on this page at least 14 days before they take effect and notify registered Operators by email. If you are a consumer and do not accept a change, you may object and terminate before it takes effect; for entrepreneurs, continued use after the effective date constitutes acceptance.

16. Final provisions

• These Terms are governed by the law of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods. Mandatory consumer-protection law of your country of residence is unaffected.
• If you are a merchant, a legal person under public law, or a special fund under public law, the exclusive place of jurisdiction is Aachen. Consumers keep the courts available to them by law.
• Should any provision be or become invalid, the validity of the remaining provisions is unaffected (severability).
• Failure to enforce a provision is not a waiver of it.
• We may assign this agreement to an affiliate or to a successor in connection with a reorganisation or transfer of the business; you may assign only with our prior written consent.
• These Terms, the privacy policy, and (for Operators) the DPA are the entire agreement between us on their subject matter.