Terms of Service

1. Who can use UntilPaid

UntilPaid is for businesses only. You may use it only in the course of your trade, business or profession — as a company, a sole trader or a freelancer. By accepting these terms you confirm that you are acting as a business (an entrepreneur, podnikatel, under § 420 of the Czech Civil Code) and not as a consumer. Rights that the law gives only to consumers, such as the 14-day right to withdraw from a contract made online, therefore don’t apply.

If you accept these terms on behalf of a company or other organisation, you confirm that you’re authorised to bind it, and “you” means that organisation. You must be at least 18.

You may not use the service if you are located or ordinarily resident in a country or territory subject to comprehensive EU, UN, UK or US sanctions, or if you — or anyone who owns or controls you — are named on a sanctions list kept by any of them, including the US Treasury’s Specially Designated Nationals list.

2. What the service does — and doesn’t

UntilPaid connects to your Stripe account through Stripe Connect, reads your invoices, customers and the payments made against them, watches for overdue invoices, and follows up on them automatically, on your behalf and according to the rules you set: by email, by SMS once that’s available, and — if you set it up — by sending a signal to a system you control so that you can restrict a client’s access until they pay (“Lock access,” section 5). You decide which invoices are chased, the schedule, the wording, and which steps run. Nothing is sent until you turn chasing on.

We provide software, nothing more. We are not a debt collector or collection agency, not a law firm, and not your agent, and we don’t give legal, tax or financial advice. We don’t decide whether a client owes you money, or whether you may chase them or restrict their access — and we don’t check: we don’t verify any debt, or what your contract with a client allows. We never contact anyone or send any signal on our own initiative: everything the service does, it does because your account’s settings told it to. The default rules, templates and examples we provide are starting points, not advice that they are lawful or suitable for your clients, your contracts or your country.

Stripe is the source of truth. We don’t process payments, move money, or change your invoices, and the service acts on the data Stripe gives it. If that data is wrong, late or incomplete — for example, a client paid you by bank transfer and the invoice is still open in Stripe — the service will treat the invoice as unpaid. Keeping your Stripe records accurate is your responsibility.

3. Your account & team

You’re responsible for the information you give us being accurate, for keeping your logins, your Stripe account, your API keys and your webhook signing secret secure, and for everything that happens under your account — including anything done by team members you invite or with your API keys. Tell us promptly if you think someone has gained unauthorised access.

You may not share your account, resell the service, or let anyone use it who hasn’t agreed to these terms. You’re responsible for your team members following them.

4. Connecting Stripe

When you connect Stripe, you authorise us to access the invoice, customer, payment and account information we need to run your follow-ups. Stripe grants this type of connection broad access to your account; we use it only to read that information. You confirm that you have the right to connect that account and to have us process your clients’ information for this purpose.

Because we handle your clients’ personal data on your behalf, our Data Processing Addendum applies and forms part of these terms. In plain terms: you are the controller of that data, and we are your processor.

You can delete your account at any time from your settings. Deleting it permanently deletes your account data, as described in the Privacy Policy — export anything you need first, because we can’t recover it. From then on we make no requests to your Stripe account. The connection itself stays in place so you can sign up again with the same account; you can remove UntilPaid from your Stripe Dashboard at any time, though Stripe may then not let that account connect to us again. Deleting your account doesn’t unlock anyone. Once your data is deleted we can no longer send restore signals, so any client your systems have locked stays locked until you unlock them yourself (section 5.6).

5. Lock access

5.1 What Lock access does

A Lock access step sends a signed HTTP request — a lock signal — to an endpoint URL you choose, on the day your rules say, if the invoice is still open in Stripe. When Stripe later reports that invoice paid or voided, or when someone on your account presses Restore access, we send a restore signal to the same endpoint. How the signals work is described in the app.

That is all it does. We don’t connect to, control or change your systems or your clients’ systems, and we never lock or unlock anything ourselves. Whether a signal restricts anything, what it restricts, for whom and for how long is decided entirely by the endpoint and the code that you build, configure and run.

Before a lock signal goes for an invoice, the service checks that you have turned Lock access on for that client, and that a final notice — a reminder email from your account that names the lock date — was sent to that client at least three days earlier in the same chase and didn’t bounce. It never sends a lock signal before the date that notice names. Every final notice carries a link the client can use to tell you they dispute the invoice; if they use it, we pause chasing that invoice and tell you. These checks are there to help you. They don’t verify your contract, the debt or the notice your contract requires, and they don’t change your responsibilities under this section.

5.2 Your decision, your responsibility

You decide whether to use Lock access, against which clients and invoices, and when. Every restriction of access is your act — carried out by your systems, under your agreement with your client — not ours. You alone are responsible for it and for its consequences, towards your clients, their customers and users, and anyone else affected.

5.3 What you confirm

By turning on a Lock access step, and for as long as one is active, you confirm that:

• for each client you turn Lock access on for — a confirmation you also give in the app, client by client — under your contract with that client and the law that governs it, you have the right to suspend or restrict that client’s access for non-payment: for example, a clause allowing you to suspend services or access when invoices are overdue;
• you have given, or will give, each client any warning or notice that your contract or the law requires before their access is restricted. The final notice the service sends may help, but it doesn’t replace notice you owe under your contract;
• the systems your endpoint controls are yours, or you are authorised to control them, and restricting them won’t infringe a right your client already has — for example, to work, content or data they already own or have paid for;
• before each lock takes effect, you will make sure the invoice is genuinely due — not disputed, paid some other way, covered by a payment plan, credit note or agreed extension, or frozen by insolvency or other legal proceedings — and you will pause the sequence or remove the step when it isn’t;
• when a client disputes an invoice — through the link in a final notice or in any other way — you will look into it in good faith before you resume chasing it;
• you will restrict no more than is reasonably needed to encourage payment, you won’t delete, corrupt, encrypt or withhold data, and you won’t demand anything beyond what is owed;
• your endpoint verifies our signature and timestamp, you keep your signing secret confidential, your endpoint handles repeated, late or out-of-order signals safely, and you can switch it off; and
• you can restore any client’s access yourself, at any time, without relying on us.

5.4 Where you must not use it

Don’t use Lock access:

• against consumers — individuals acting outside their trade, business or profession;
• on any system whose interruption could endanger anyone’s life, health or safety, or affect medical care, emergency services, critical infrastructure or safety equipment;
• to stop anyone reaching personal data or other data they are legally entitled to — including data you process for your client as their processor under the GDPR or similar laws;
• to restrict anyone other than the client who owes the invoice — for example, another client who shares the same system; or
• where it would breach a court order, a stay or moratorium in insolvency or bankruptcy proceedings (such as the US automatic stay), or a law that restricts disabling software or services over a payment dispute. Some US states, for example, restrict this kind of “electronic self-help.”

5.5 Signals can be wrong, late or missing

Lock access depends on Stripe’s data, the internet, your endpoint and our software, and any of them can fail. A signal may be sent late, more than once, out of order or not at all, or sent when it shouldn’t be — for example because Stripe reports a payment late or not at all, your client paid outside Stripe, your endpoint was down, slow or misconfigured, your rules changed, or our service had an outage or a bug. We work hard to deliver restore signals and to alert you when one fails, but we don’t guarantee that any lock or restore signal will be delivered, delivered on time, or delivered only once. The checks described in section 5.1 depend on the same things and can fail too.

You must keep track of which clients your systems have locked, and restore access yourself whenever it should be restored: promptly once you know a client has paid or the debt is otherwise settled, and whenever a restore signal has failed.

5.6 When you change plans or leave

We try to keep sending restore signals for locks already in place if you downgrade, your trial or subscription ends, or we suspend your account. We can’t once your account is deleted. Before you disconnect Stripe or close your account, restore access for every client your systems have locked. Any lock in place when your account is deleted stays exactly as your systems left it, and remains your responsibility.

5.7 Our liability for Lock access

To the fullest extent the law allows (see section 14.1), we are not liable for any loss or damage that arises from a lock or restore signal, from how your systems acted or failed to act on one, or from a client being locked out, staying locked out, or not being locked out — including where a signal was sent when it shouldn’t have been, wasn’t sent when it should have been, or was delayed, duplicated or forged. Claims about it are covered by your indemnity in section 15.

6. Sending messages & the law

When the service sends an email or SMS, it does so as you, on your behalf, under your name or domain. You are the sender, and you are responsible for those messages complying with the law wherever you and your recipients are. That includes data-protection law such as the GDPR; rules on electronic communications such as the Czech Act No. 480/2004 Coll. on Certain Information Society Services, the EU and UK ePrivacy rules (PECR), the US CAN-SPAM Act and the Telephone Consumer Protection Act (TCPA); and laws on collecting debts. If you chase individuals rather than businesses, consumer debt-collection laws may also apply to you — some, such as California’s Rosenthal Fair Debt Collection Practices Act, cover businesses collecting their own debts.

By using the service you confirm that:

• you have a lawful basis to contact each recipient about their overdue invoice (in most cases this is an existing business relationship, but that’s your call to make);
• you only chase amounts that are genuinely owed, and your messages are honest and not misleading. You won’t pretend to be a lawyer, court, government body or collection agency, or threaten action you don’t intend or aren’t entitled to take;
• you will honour opt-outs. We give you tools — an unsubscribe link on reminders sent from our domain, automatic handling of SMS STOP replies and hard bounces, quiet hours, and a suppression list — but the obligation to respect them is yours, including any unsubscribe mechanism the law requires on messages sent from your own domain; and
• you will not use the service to harass anyone or to contact people you have no lawful reason to contact.

We may suspend sending on your account if we reasonably believe it is being used unlawfully or in a way that threatens the deliverability or reputation of our shared sending infrastructure.

7. Acceptable use

Don’t use the service to break the law, to send spam, to infringe anyone’s rights, or to interfere with how the service works. Specifically, you agree not to:

• reverse-engineer, resell or copy the service, except where the law says we can’t stop you;
• probe, scan or try to breach our security, or access data that isn’t yours;
• send messages to purchased, scraped or otherwise unlawfully obtained contact lists;
• chase amounts you know aren’t owed, or use the service to threaten, harass or mislead anyone;
• point a Lock access endpoint at systems you don’t own or aren’t authorised to control, or use one to attack, overload or probe any system, including ours;
• get around plan or usage limits, or access the service by automated means other than our API;
• use the service in breach of sanctions or export-control laws; or
• use the service to build a competing product.

8. Plans, trials & payment

Paid plans, their prices, and what’s included are shown when you sign up or upgrade, and those details are part of this agreement. Paid plans are sold through Polar (Polar Software Inc.), acting as our merchant of record — Polar processes your payment, and your purchase is also subject to Polar’s own terms. Polar’s name may appear on your card statement. Unless stated otherwise:

• Free trial. If we offer a trial, it runs for the period shown when you sign up. We don’t take a card for it and don’t charge you when it ends — chasing pauses until you choose a paid plan. If you choose one during the trial, Polar takes your card at checkout and the first charge comes when the trial would have ended.
• Features vary by plan. Some, including Lock access, are available only on certain plans; the plan details say which.
• Subscriptions renew automatically for the same period until you cancel. You can cancel anytime from your settings; cancellation takes effect at the end of the current billing period.
• Prices exclude taxes. As merchant of record, Polar calculates, collects and remits any VAT, sales tax or similar due on your purchase at checkout.
• Usage-based charges (for example, SMS beyond a plan’s included allowance) are billed as described in your plan.
• Refunds. Fees already paid are non-refundable, except where the law requires otherwise or these terms say so (sections 16 and 18).
• Price changes. We may change prices for future billing periods with at least 30 days’ notice. If you don’t agree, you can cancel before the change takes effect.

If a payment fails, we may retry it and may suspend or downgrade your account until it’s resolved. If you dispute a charge with your bank or card issuer without contacting us first, we may suspend your account while the dispute is open.

9. Third-party services

The service relies on third parties to work: Stripe (to read your invoice data), Polar (our merchant of record, which sells and bills paid plans), Postmark (to deliver reminder emails), Twilio (to deliver reminder SMS), Railway (to host the application and its databases), Cloudflare (to deliver and protect the website and app) and PostHog (product analytics and error reporting). Your use of the service is also subject to their terms, and we’re not responsible for their acts, outages or decisions. If one of them changes, restricts or stops offering what the service depends on — Stripe’s API access included — we may need to change or stop parts of ours.

10. Ownership

We own the service — the software, design, and everything in it — and our name and logo. Nothing in these terms transfers any of that to you. We grant you a limited, non-exclusive, non-transferable right to use the service while these terms are in force. If you give us feedback, you grant us a free, worldwide, perpetual right to use it for any purpose, without owing you anything.

11. Your data

You keep ownership of your data and your clients’ data. You grant us the permission we need to host and process it in order to provide the service. How we handle personal data is set out in the Privacy Policy and the Data Processing Addendum.

The service is not a backup or archive. Keep your own records; when your account is deleted, your data is deleted permanently.

12. Availability & changes

We work hard to keep the service running, but we don’t promise it will be uninterrupted or error-free, and we don’t offer an uptime or service-level commitment unless we have agreed one with you in writing. We may suspend all or part of the service for maintenance or security, or to comply with the law. Support is by email, on a best-effort basis.

We may add, change or remove features over time. Features marked beta, preview or coming soon are provided as they are and may change or be withdrawn. If we make a change that materially reduces the core functionality you’re paying for, we’ll let you know.

13. Disclaimers

The service is provided “as is” and “as available.” To the fullest extent the law allows, we disclaim all warranties and conditions, whether express or implied, including any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, accuracy and non-infringement, and any arising from a course of dealing or usage of trade.

In particular, we don’t warrant that any invoice will be paid; that any message or signal will be delivered, delivered on time, or delivered only once; that the service will be uninterrupted, secure or error-free; that the data we receive from Stripe will be accurate or current; or that our default rules and templates, or any use of Lock access, comply with the law that applies to you.

Our website, marketing, demos and documentation describe how the service is meant to work. They are not warranties or promises unless these terms say so.

Nothing in these terms excludes any warranty or right that can’t legally be excluded.

14. Limitation of liability

14.1 What we never limit

Nothing in these terms limits or excludes liability that can’t be limited or excluded under the applicable law — including, under Czech law, liability for harm to a person’s natural rights, such as their life or health, or for harm caused intentionally or through gross negligence (§ 2898 of the Civil Code).

14.2 Limits

Subject to section 14.1:

• neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, business, savings, data or goodwill, or the cost of substitute services, even if told such losses were possible;
• we are not liable for losses arising from: your use of Lock access, or how your systems act on our signals (section 5); the content, timing or legal effect of the messages and rules you configure; the acts or omissions of your clients or of third-party services such as Stripe; inaccurate, late or missing data from Stripe; or unauthorised use of your account, API keys or signing secret that results from you not keeping them secure; and
• our total liability arising out of or relating to these terms and the service, for all claims together, is limited to the greater of the fees you paid for the service in the 12 months before the event that gave rise to the claim, and EUR 100.

14.3 How the limits apply

These limits apply however a claim arises — in contract, in tort (including negligence), for breach of statutory duty or otherwise — and even if a limited remedy fails of its essential purpose. They don’t limit your obligation to pay fees or your obligations under section 15. Our prices reflect this allocation of risk; we could not offer the service at these prices without it.

14.4 Time limit for claims

Any claim against us must be brought within one year after you became aware, or ought reasonably to have become aware, of the facts giving rise to it. After that, the claim is time-barred.

15. Indemnification

You will defend, indemnify and hold harmless us and our contractors and successors from and against all claims, demands and proceedings brought by anyone else — including your clients, their customers and users, recipients of your messages, and regulators — and all resulting losses, damages, fines, penalties, settlements, costs and expenses (including reasonable legal fees) that arise out of or relate to:

• any lock or restore signal sent from your account, and any restriction or restoration of access — or failure to restrict or restore it — by your systems or anyone acting for you;
• messages sent from your account, and your rules, templates and settings;
• your contracts and relationships with your clients, and any amount you claim from them;
• your clients’ data and your right to collect it and have us process it;
• your endpoints and systems, and the security of your credentials and signing secret; or
• your breach of these terms, or your violation of any law or anyone’s rights.

We’ll tell you promptly about any such claim (a delay reduces your obligations only to the extent it actually harms your position) and cooperate reasonably, at your cost. You may control the defence with counsel reasonably acceptable to us, but you may not settle a claim in a way that admits fault on our behalf or imposes any obligation on us without our written consent. We may take part with our own counsel at our own cost, and if you don’t promptly take up the defence, we may defend the claim ourselves at your cost.

16. Suspension & termination

These terms apply for as long as you use the service. You can stop at any time by cancelling your plan and disconnecting Stripe — after first restoring any access your systems have locked (section 5.6).

We may suspend all or part of the service — for example sending, or Lock access on its own — immediately and without prior notice if we reasonably believe that you have breached these terms; that your use is unlawful or harmful, or exposes us, our providers or anyone else to risk or liability; that a recipient or affected client has a credible complaint; or that the law, a court, a regulator or one of our providers requires it. We’ll tell you why when we can, and lift the suspension once the reason has gone.

We may end these terms and close your account immediately for a serious or repeated breach, or for any of the reasons above that can’t be put right; or for any other reason with at least 30 days’ notice, in which case we’ll refund, pro rata, any prepaid fees for time you can’t use.

When your account ends, your right to use the service stops, we stop sending messages and signals, and we delete your data as described in the Privacy Policy. Sections that by their nature should survive — including sections 5, 10, 13, 14, 15, 17 and 19 — do.

17. Governing law & disputes

These terms, and any dispute or claim arising out of or relating to them or the service (including non-contractual disputes or claims), are governed by the laws of the Czech Republic, in particular the Civil Code (Act No. 89/2012 Coll.), excluding its conflict-of-laws rules and excluding the UN Convention on Contracts for the International Sale of Goods.

Before starting proceedings, the party with a complaint will email the other with the details, and both will try in good faith to resolve it within 30 days. This doesn’t stop either party from seeking urgent injunctive or interim relief.

The courts of the Czech Republic — specifically the court with local jurisdiction over our place of business — have exclusive jurisdiction. We may, however, also bring proceedings against you in the courts of the country where you are established, for example to recover unpaid fees or under section 15.

To the extent the law allows, claims may be brought only on an individual basis, not as a plaintiff or class member in any class, collective or representative action, and each party waives any right to a trial by jury.

If, despite section 1, mandatory law treats you as a consumer, nothing in this section removes the protections that law gives you.

18. Changes to these terms

We may update these terms — for example, when the service, our providers or the law changes. If a change materially affects your rights, we’ll email you at least 30 days before it takes effect; changes needed for legal or security reasons, or that concern only new features, may take effect sooner. If you don’t agree, you can end these terms before the change takes effect by cancelling and disconnecting Stripe, and we’ll refund, pro rata, any prepaid fees for time you can’t use. If you keep using the service after a change takes effect, you accept the updated terms. We keep previous versions and will send you the one you accepted on request.

19. General

Whole agreement. These terms, plus the DPA, the Privacy Policy and the plan details shown when you sign up or upgrade, are the entire agreement between us about the service and replace anything said or written before. Neither party relies on any statement that isn’t set out in them. Terms in your own documents, such as a purchase order, don’t apply.

Order of precedence. If these documents conflict, the DPA wins on data-protection matters; otherwise these terms win over the plan details.

Assignment. You can’t transfer these terms without our written consent. We may transfer them — and you consent to this in advance — to a company we set up or control to run the service, or in connection with a merger, acquisition or sale of the business. We’ll tell you if we do.

Relationship. We are independent of each other. Nothing in these terms makes us your agent, partner, employee or fiduciary. Nobody else — including your clients — has any rights under these terms or can enforce them.

Severability & waiver. If part of these terms is unenforceable, it applies to the greatest extent the law allows and the rest stays in force. If we don’t enforce a right, that’s not a waiver of it.

Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control, including outages or failures of Stripe, our hosting, email or SMS providers, or the internet; cyberattacks; acts of government; war; natural disasters; and epidemics. This doesn’t excuse paying fees.

Notices. We’ll contact you at the email on your account or in the app, and you agree that notices, agreements and other communications we give you electronically satisfy any requirement for them to be in writing. You can reach us at the address below.

Language. These terms are written in English, and the English version governs if any translation differs.

20. Contact

Questions about these terms? Email us at legal@untilpaid.com. Operated by Jonas Vondracek, Czech Republic.