Terms and Conditions

The Processor provides Scisso, an appointment coordination and SMS notification platform, to the Controller. The Processor processes personal data on behalf of the Controller for the duration of the Controller's use of the Service. Upon termination, data is handled in accordance with Section 6.10 below.

The Processor processes personal data for the following purposes, solely on the Controller's documented instructions:

• Storing and managing client records (names, contact details, appointment history)
• Sending SMS notifications (confirmations, reminders, rescheduling notices, cancellation notices) via the Controller's on-premises Android relay device or, when configured by the Controller, via third-party SMS gateway providers
• Synchronising appointments with Google Calendar when enabled by the Controller
• Matching Google Calendar events to existing client records using email addresses, calendar colour codes, or event title keywords
• Sending promotional SMS messages to clients who have provided explicit opt-in consent via the booking form or other mechanisms configured by the Controller
• Generating anonymised appointment statistics
• Processing data subject requests (access, erasure, portability) on behalf of the Controller
• Facilitating online payment collection during booking by creating payment objects (SetupIntents, Invoices) on the Controller's connected Stripe account, storing encrypted client billing details for returning-client pre-fill, and processing refunds and cancellations per the Controller's configured refund policy

• Client names (first name, last name)
• Client phone numbers (encrypted at rest using AES-256-GCM)
• Client email addresses (encrypted at rest using AES-256-GCM)
• Client date of birth (encrypted at rest using AES-256-GCM), when collected by the Controller
• Client language preference
• Client profile notes entered by staff (free-text service preferences or remarks, stored on the client record)
• Appointment dates, times, and associated services
• SMS notification metadata (type, status, timestamp). Message content and recipient phone number are deleted immediately after sending.
• Staff comments on individual appointments (encrypted at rest using AES-256-GCM). These are internal notes left by staff members on specific appointments. They may contain personal data. They are included in data exports and permanently deleted upon customer erasure.
• Client billing address (street, city, county/state, postal code, country), encrypted at rest using AES-256-GCM, when collected during online booking with payment
• Client company details (company name, tax identification number, trade register number), encrypted at rest using AES-256-GCM, when the client identifies as a company during payment booking
• Phone and email verification timestamps, recording when a client verified ownership via OTP during booking
• Stripe customer identifier on the Controller's connected Stripe account, linking the client record to Stripe for payment processing
• Payment metadata on appointments: payment status, payment amount, Stripe reference identifiers (opaque IDs, not card details), manage token for client self-service, and card-on-file consent timestamp

• Clients of the Controller's business who have appointments or are registered in the system
• Individuals whose contact details are entered by the Controller's staff for appointment management purposes

In accordance with Article 28(3) GDPR, the Processor shall:

• (a) Process only on documented instructions. The Processor shall process personal data only on the Controller's documented instructions, including with regard to transfers of personal data to a third country, unless required to do so by EU or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest. If the Processor considers that an instruction infringes GDPR or other applicable data protection law, the Processor shall promptly inform the Controller and may suspend the relevant processing until the Controller confirms or modifies the instruction.
• (b) Ensure confidentiality. The Processor shall ensure that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• (c) Implement security measures. The Processor shall implement all measures required pursuant to Article 32 GDPR (security of processing), as described in Section 6.7 below.
• (d) Respect sub-processor conditions. The Processor shall not engage another processor without the Controller's prior general written authorisation. The conditions for engaging sub-processors are set out in Section 6.6 below.
• (e) Assist with data subject rights. The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR. The Service provides built-in tools for data access, export (portability), erasure, and rectification.
• (f) Assist with compliance obligations. The Processor shall assist the Controller in ensuring compliance with Articles 32 to 36 GDPR (security of processing, notification of a personal data breach, communication to data subjects, data protection impact assessment, and prior consultation), taking into account the nature of processing and the information available to the Processor.
• (g) Delete or return data. At the choice of the Controller, the Processor shall delete or return all personal data after the end of the provision of services, and delete existing copies unless EU or Member State law requires continued storage. See Section 6.10.
• (h) Demonstrate compliance. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. See Section 6.9.

The Controller grants the Processor general written authorisation to engage sub-processors for the purposes described in this DPA. The Processor currently uses the following sub-processors:

When the Controller's Android relay device is used, SMS messages are delivered via the device's native SMS system and no third-party gateway processes the recipient's phone number or message content. When a third-party SMS gateway (SMSAdvert) is used as a fallback, the recipient's phone number and message content are transmitted to the gateway for delivery. The gateway deletes the phone number and message content after transmission in accordance with its data processing agreement. The Controller can configure which providers are active and their priority order.

The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 14 days in advance by email, giving the Controller the opportunity to object to such changes. If the Controller objects on reasonable data protection grounds, the parties shall negotiate in good faith to find a resolution. If no resolution is reached within 30 days, either party may terminate the Service.

Where the Processor engages a sub-processor, the same data protection obligations as set out in this DPA shall be imposed on the sub-processor by way of a contract, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations.

The Processor implements the following measures pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk:

• Encryption at rest. Client phone numbers, email addresses, dates of birth, and billing details (address, company name, tax ID) are encrypted using AES-256-GCM with unique random initialisation vectors per record. Staff comments on appointments are encrypted using the same method. SMS job phone numbers and message bodies are similarly encrypted. Google OAuth refresh tokens are encrypted at rest. Encryption keys are stored separately from the database.
• Encryption in transit. All data is transmitted over HTTPS/TLS between browser and server. The connection between server and Android relay device uses an encrypted WebSocket (WSS) connection.
• Access control. Role-based access control restricts data visibility. Employees can only access client records for which a direct working relationship exists. Administrative functions (employee management, settings, GDPR tools) are restricted to owners and receptionists.
• Authentication. Passwords are hashed using bcrypt (12 rounds). Sessions use httpOnly, Secure, SameSite JWT cookies with 7-day expiry. Two-factor authentication (TOTP) is available for all users. TOTP secrets and backup codes are encrypted at rest using AES-256-GCM. Changing a password or modifying MFA settings invalidates all existing sessions on other devices. Android relay devices authenticate via API keys stored as bcrypt hashes on the server.
• Data minimisation. SMS message content and recipient phone numbers are deleted immediately after the message is sent, or after all retry attempts are exhausted, and are never retained while awaiting a delivery report. When a third-party SMS gateway is used, only the recipient phone number and message body are shared with the gateway. No internal identifiers, client profile data, or organisation metadata is transmitted. Personal data is automatically redacted from application logs. Audit logs contain only event types, record identifiers, and timestamps.
• Infrastructure security. All servers are hosted within the European Union. Database access is restricted to the application server. Rate limiting is applied to all public-facing endpoints to prevent abuse.
• Resilience and recovery. Database backups are performed regularly. The SMS delivery system includes automatic retry with exponential backoff (up to 10 attempts). A daily cleanup job runs as a safeguard to remove any sensitive data that was not cleared in real time.
• Audit trail. All personal data access, mutations, erasures, and exports are recorded in an append-only audit log. The audit log itself never contains personal data.

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. "Becoming aware" means the point at which the Processor has a reasonable degree of certainty that a security incident has resulted in personal data being compromised, not mere suspicion. The notification shall include, to the extent available:

• A description of the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned
• The name and contact details of the point of contact from whom more information can be obtained
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of any data breach. The Processor shall document all personal data breaches, including the facts, effects, and remedial actions taken.

The Controller has the right to audit the Processor's compliance with this DPA. Audits may be conducted by the Controller or a qualified third-party auditor bound by confidentiality obligations, subject to the following conditions:

• Audit requests must be made in writing with at least 30 days' notice
• Audits shall be conducted during normal business hours and shall not unreasonably disrupt the Processor's operations
• The Controller shall bear the costs of any audit it initiates, unless the audit reveals a material breach of this DPA by the Processor
• No more than one audit may be conducted per 12-month period, unless a supervisory authority requires additional audits or a personal data breach has occurred
• All information obtained during an audit shall be treated as confidential

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and shall cooperate fully with audit activities.

Upon termination of the Service, the Processor shall:

• Make the Controller's data available for export in a structured, commonly used, machine-readable format (JSON) for a period of 30 days following termination
• After the 30-day export window, permanently delete all personal data from active systems. Personal data in encrypted backups will be deleted in accordance with the standard backup rotation schedule, not to exceed 90 days. During this period, backup data remains encrypted and access-restricted, and will not be restored to active systems.
• Provide written confirmation of deletion upon the Controller's request

Anonymised, aggregate statistical data (total appointment counts per service category at the organisation level, not attributable to any individual employee or client) may be retained indefinitely as it does not constitute personal data under GDPR Recital 26. Per-employee statistics are aggregated to organisation-level totals upon termination.

The Controller warrants and undertakes that:

• It has a valid lawful basis under GDPR Article 6 for all personal data provided to the Processor for processing
• It has informed its clients, by appropriate means, that their data will be processed through the Service for appointment management and SMS notification purposes
• It will comply with all applicable data protection laws in its capacity as Data Controller, including responding to data subject rights requests within the timeframes required by GDPR
• It will not instruct the Processor to process personal data in a manner that would violate GDPR or any other applicable law
• It will promptly notify the Processor if it becomes aware of any circumstance that may affect the Processor's ability to comply with its obligations under this DPA

The Processor stores and processes all personal data within the European Union. Where sub-processors located outside the EU are engaged (see Section 6.6), the Processor ensures that appropriate safeguards are in place in accordance with GDPR Chapter V, such as Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Article 46(2)(c) GDPR, or an adequacy decision by the European Commission pursuant to Article 45 GDPR.

Each party shall be liable for damages caused by processing that infringes GDPR in accordance with Article 82 GDPR. The Processor shall be liable for damage caused by processing only where it has not complied with obligations of GDPR specifically directed to processors, or where it has acted outside of or contrary to the Controller's lawful instructions.

Where either party has paid full compensation to a data subject under Article 82(4) GDPR, it is entitled to claim back from the other party that portion of the compensation corresponding to the other party's share of responsibility, in accordance with Article 82(5) GDPR. The general limitation of liability in these Terms (Section 15) does not limit either party's obligations under this Section 6.13 or under GDPR Article 82.

Scisso offers an optional feature that helps the Controller identify Google Calendar events that are likely client appointments but were left unclassified (for example, where an employee's freeform event title did not match a configured rule). To do this, the event title and the Controller's own service-catalogue labels are sent for analysis to an AI sub-processor. The following terms apply to this processing:

• (a) Data sent. Only the event title and the Controller's service-catalogue labels are transmitted. An event title may contain a client's first name written in the employee's shorthand. Client contact lists, phone numbers, email addresses, and Scisso record identifiers are never sent. The feature extracts a candidate name from the title; matching that name to a client is performed locally by Scisso, not by the sub-processor.
• (b) Purpose and lawful basis. The purpose is limited to classifying the Controller's own calendar events so that genuine appointments are not silently lost. The Controller determines the lawful basis for this processing; KodeKind considers the Controller's legitimate interest under Article 6(1)(f) GDPR (accurate operation of the Controller's own booking records) to be the applicable basis. The Processor performs this processing solely on the Controller's documented instructions and for no other purpose.
• (c) Sub-processor and location. Inference is performed by Scaleway SAS on infrastructure located in France (European Union), using the Mistral Small 3.2 model authored by Mistral AI (a French company). The model author does not receive the data: only Scaleway's European inference infrastructure processes it. No data is transferred outside the European Union for this feature.
• (d) Retention. Titles are processed transiently for inference only. Neither Scisso nor the sub-processor stores the prompt or the response content. Scisso retains only non-personal telemetry about each call (token counts, cost, status, timestamps) for cost control and reliability; this telemetry contains no titles, names, or other personal data.
• (e) No model training. Per the sub-processor's data-processing terms, the data sent is not used to train, retrain, or improve any model, and the content of inputs and outputs is not read, reused, or analysed by the sub-processor.
• (f) Controller control and opt-out. The feature is governed by a per-organisation AI setting that an owner can switch off at any time in Settings. While the feature is enabled, the Controller authorises the sub-processing described above on the basis of this disclosure; switching it off stops all such processing.
• (g) Flow-down and liability. The data protection obligations in this DPA are imposed on the sub-processor by way of its data processing agreement, including the security and confidentiality obligations in Section 6.7. The Processor remains fully liable to the Controller for the sub-processor's performance, as set out in Section 6.6.

This feature is advisory only. It surfaces suggestions for the Controller's staff to review; it never automatically modifies, reclassifies, or sends messages for an appointment. The Controller may disable it at any time without affecting any other part of the Service.

Scisso offers an optional feature that lets the Controller build its service catalogue from photographs or screenshots of an existing price list, instead of typing every entry by hand. Images uploaded by the Controller are sent for analysis to an AI sub-processor, which returns a draft catalogue for the Controller to review. The following terms apply to this processing:

• (a) Data sent. Only the images the Controller chooses to upload. These are expected to contain the Controller's own commercial information: service names, durations and prices. The Controller must not upload images containing client personal data; the feature does not need it and does not extract it. Image metadata, including any location recorded by the camera, is removed before transmission.
• (b) Purpose and lawful basis. The purpose is limited to converting the Controller's own price list into catalogue entries in the Service. The Controller determines the lawful basis for this processing; KodeKind considers the Controller's legitimate interest under Article 6(1)(f) GDPR (setting up and maintaining its own service catalogue) to be the applicable basis. The Processor performs this processing solely on the Controller's documented instructions and for no other purpose.
• (c) Sub-processor and location. Inference is performed by Scaleway SAS on infrastructure located in France (European Union), using the Mistral Small 3.2 model authored by Mistral AI (a French company). The model author does not receive the data. No data is transferred outside the European Union for this feature.
• (d) Retention. Images are processed transiently for inference only. No image is stored by Scisso or by the sub-processor, and no model response is retained beyond the draft catalogue the Controller is actively editing, which exists only until the Controller confirms or discards it. Scisso retains only non-personal telemetry about each call (token counts, cost, status, timestamps) for cost control and reliability.
• (e) No model training. Per the sub-processor's data-processing terms, the data sent is not used to train, retrain, or improve any model, and the content of inputs and outputs is not read, reused, or analysed by the sub-processor.
• (f) Controller control and opt-out. The feature is governed by the same per-organisation AI setting as Section 6.14, which an owner can switch off at any time in Settings. While the feature is enabled, the Controller authorises the sub-processing described above on the basis of this disclosure; switching it off stops all such processing.
• (g) Flow-down and liability. The data protection obligations in this DPA are imposed on the sub-processor by way of its data processing agreement, including the security and confidentiality obligations in Section 6.7. The Processor remains fully liable to the Controller for the sub-processor's performance, as set out in Section 6.6.

This feature is advisory only. It produces a draft that the Controller reviews and edits; nothing is added to the catalogue until the Controller confirms it. Existing services, categories and prices are never modified or deleted by an import. The Controller may disable the feature at any time without affecting any other part of the Service.

Scisso offers multiple subscription plans that differ in the number of included employees and SMS volume. All plans include access to every feature. Current plan details and pricing are displayed during sign-up and on the billing page within the application.

• New accounts receive a 30-day free trial with full access to all features.
• A valid payment method is required to start the trial. You will not be charged during the trial period.
• Before the trial ends, we will notify you by email that the trial is expiring. If you do not cancel before the trial ends, your subscription will automatically convert to a paid plan and your payment method will be charged at the rate displayed during sign-up.
• You may cancel at any time during the trial without being charged.
• By providing a payment method and starting the trial, you expressly consent to the automatic conversion to a paid subscription at the end of the trial period, and you acknowledge that you will be charged unless you cancel before the trial ends.

• Subscriptions are billed monthly on the same day each month (your billing anchor date, set at account creation).
• Charges are processed automatically via Stripe. Scisso does not store your card details. All payment data is handled directly by Stripe in accordance with PCI DSS standards.
• Adding employees beyond your plan's included amount will result in additional per-employee charges, prorated for the remaining billing period.

• If a payment fails, your subscription enters a 7-day grace period during which the service remains fully functional.
• Stripe will retry the payment automatically during this period.
• If payment is not resolved within 7 days, your subscription will be cancelled. SMS dispatch will be paused and the application will become read-only.
• Your data will not be deleted. You may resubscribe at any time to restore full access.

• You may cancel your subscription at any time from the billing page.
• Cancellation takes effect at the end of the current billing period. You will retain full access until then.
• No partial refunds are issued for unused time within a billing period, except as required by applicable law.
• After the billing period ends, SMS dispatch will be paused and the application will become read-only until you resubscribe.
• If you are entitled to a statutory right of withdrawal under applicable consumer protection law, you may exercise it within 14 days of your initial subscription by contacting us at the email address below. If you have used the Service during this period, you will be charged proportionally for the time used.

Subscription fees are non-refundable except where required by applicable law. If you believe you have been charged in error, contact us at [email protected] within 14 days of the charge.

We may adjust subscription pricing to reflect changes in our operating costs, infrastructure costs, regulatory requirements, or general market conditions. Prices will not increase more than once per 12-month period.

We will notify you by email at least 30 days before any price increase takes effect. The notification will state the new price and the date it takes effect. If you do not agree to the new pricing, you may cancel your subscription before the new price takes effect and will not be charged the increased amount. New pricing applies only from the next billing cycle after the notice period ends.

• Scisso may offer promotional codes that provide a percentage discount on subscription fees. Promotional codes are issued at our sole discretion and may be subject to conditions such as plan restrictions, single-use limits, expiration dates, or maximum redemption caps.
• Promotional discounts apply exclusively to recurring subscription charges: the base plan fee and additional per-employee fees. They do not apply to any pay-per-use fees, usage-based charges, or third-party service costs such as SMS delivery fees.
• Time-limited promotional discounts apply for the stated number of billing periods. Once the promotional period ends, your subscription will automatically renew at the standard rate for your plan. The applicable post-discount price is displayed during sign-up.
• Promotional codes have no cash value, are non-transferable, and cannot be combined with other offers or codes unless explicitly stated.
• We reserve the right to deactivate or revoke any promotional code at any time for any reason, including suspected abuse or fraud. If a code is revoked before its stated promotional period ends, the discount will continue to apply for the remainder of the originally stated duration.
• Promotional discounts do not survive cancellation. If you cancel your subscription and later resubscribe, the standard pricing for your chosen plan will apply unless a new promotional code is used.

To generate invoices, we collect billing details during sign-up: billing type (company or individual), company name, tax identification number, VAT number (if applicable), and billing address. This information is stored on your account and shared with Stripe for payment processing and invoice generation. You may update your billing details at any time from the billing page.

The operator is registered for VAT in Romania. All prices displayed during sign-up and within the application are exclusive of VAT. The applicable VAT is calculated automatically at checkout based on your billing country, business status, and VAT number (if provided), and is shown before you confirm any purchase. If you provide a valid EU VAT identification number, it will be verified and recorded on your account. Intra-EU B2B transactions where the customer provides a valid VAT number are subject to the reverse charge mechanism. You are responsible for any local taxes, duties, or levies applicable in your jurisdiction beyond what is collected by us.

Third-party SMS providers (such as SMSAdvert) require prepaid SMS credits. Credits are abstract service units, not stored monetary value or electronic money. They are redeemable only for SMS delivery through Scisso and cannot be transferred, cashed out, or used for any other purpose.

• Credits are purchased in fixed packs via a one-time Stripe payment. Available pack sizes and prices are displayed on the SMS settings page within the application.
• Credits are non-expiring. Purchased credits remain on your account indefinitely.
• Credits are non-transferable between organisations.
• Each SMS consumes credits based on the destination country and the number of message segments. The applicable credit cost per segment for each country is published within the application and may be updated from time to time (see Section 7.11).
• Credits are deducted at the time a message is routed to a paid provider. If a message permanently fails after all retry attempts, the credits consumed for that message are automatically refunded to your balance.
• If your credit balance is insufficient to cover a message, the paid provider is skipped. If no other provider is available (e.g., the Android relay is offline), the message will fail.

Withdrawal right and waiver. When you purchase SMS credits, you have the right to withdraw from the purchase within 14 days without giving any reason, in accordance with Directive 2011/83/EU (transposed in Romania by OUG 34/2014). However, because credits are digital content delivered immediately to your account, you will be asked to provide express consent to immediate performance and to acknowledge that you lose your right of withdrawal. This consent is collected via a separate, unticked checkbox before each purchase. A confirmation of your purchase, including your consent and acknowledgment, is provided via invoice.

Refund policy. Subject to the withdrawal waiver above, SMS credit purchases are non-refundable. This does not affect your rights under Directive 2019/770 (transposed in Romania by OUG 141/2021): if the SMS delivery service is materially impaired or discontinued and you are unable to use your credits, you are entitled to a proportionate price reduction or, where the lack of conformity is not minor, termination and a refund for unused credits. If you believe you have been charged in error, contact us at [email protected].

VAT treatment. SMS credits are treated as a prepayment for a known service. VAT (where applicable) is charged at the time of purchase and reflected on the invoice.

The number of credits consumed per SMS segment varies by destination country. We may adjust these rates to reflect changes in our upstream provider costs. Rate adjustments are not retroactive and do not affect credits already consumed.

We will notify you by email at least 30 days before any rate increase takes effect. The notification will state the affected countries, the new rates, and the effective date. If you do not agree to the new rates, you may request a refund of your remaining unused credits at the per-credit price you originally paid, provided the request is made before the new rates take effect. After the new rates take effect, remaining credits are consumed at the new rates.

You may optionally enable auto-reload, which automatically purchases a credit pack when your balance drops below a threshold. Auto-reload is disabled by default and requires explicit activation from the SMS settings page.

• The reload threshold is calculated dynamically based on your organisation's country (approximately 10 messages worth of credits).
• When auto-reload is triggered, your stored payment method is charged for the selected credit pack. A Stripe invoice is generated for each auto-reload charge.
• By enabling auto-reload, you provide express consent to immediate performance for each auto-reloaded credit pack and acknowledge that you lose your right of withdrawal for those purchases, on the same terms as Section 7.10.
• You may disable auto-reload at any time from the SMS settings page. Disabling auto-reload does not affect credits already purchased.

When you enable online payments via Stripe Connect, payments are processed directly on your connected Stripe account. Scisso does not charge any platform fee or commission on payment transactions. The only fees that apply are Stripe's own processing fees, which are charged by Stripe directly to your connected account according to Stripe's published pricing.

• Online payments support deposits and prepayments processed through the booking widget.
• On refunds, the full payment amount is returned to the client. Stripe's processing fee is not refunded (this is Stripe's standard policy and is not within our control).
• You may disconnect your Stripe account at any time from the payments settings page. All outstanding payments on upcoming appointments will be automatically refunded before the disconnect is finalised. Disconnecting disables all payment modes on your services.
• Online payments are available on all subscription plans. No additional monthly fee is charged for the payment feature.
• KodeKind reserves the right to introduce a platform fee on payment transactions in the future. Any such change will be communicated at least 30 days in advance via email and will require your continued use of the payment feature to constitute acceptance.

The Android relay uses a device physically located on your premises (the "Relay") to send SMS via your mobile carrier's SIM card. Messages are sent from your own business phone number. This method is free within Scisso, but you are solely responsible for all carrier costs (per-message charges, bundle usage, and any carrier fees). You should ensure your mobile plan is suitable for your message volume.

Relay delivery depends on factors outside our control, including: the device being powered on and connected to the internet, mobile network availability, recipient phone number being active and reachable, SMS not being filtered by the recipient's carrier, and the Android operating system not terminating the relay application due to battery optimisation or system updates.

The Relay is your equipment, on your premises, under your control. Keeping it available is your responsibility, as set out in Section 4. We do not operate the Relay and we do not guarantee any level of Relay availability or uptime. Scisso displays the Relay's connection status in your settings and sends best-effort notifications when the device has appeared offline for an extended period or reports a low battery. Those notifications depend on the device reporting its status and on push delivery reaching you, are provided as a convenience only, are not guaranteed, and do not transfer responsibility for Relay availability to us.

The Relay will be unavailable at times, for reasons including power cuts, loss of internet or mobile coverage, the device being switched off, moved, or taken off the premises, the operating system terminating or updating the relay application, device failure, and carrier issues. A paid provider can be configured as a backup in your chain (Sections 8.2 and 8.3) precisely so that messages continue to be sent while the Relay is offline, subject to your SMS credit balance. Whether to keep a funded backup provider active is your decision. If you operate the Relay as your only provider, or your credit balance is insufficient while the Relay is offline, messages will not be sent. We are not liable for any consequence of the Relay being unavailable, for any reason and however caused, including messages never sent, sent late, or sent after the appointment they refer to, missed appointments, lost revenue, client dissatisfaction, and client replies (such as STOP or HELP keywords) that the Relay does not receive while it is offline.

Your mobile plan must permit automated sending. Mobile operators across the EEA commonly limit ordinary mobile subscriptions, consumer and business alike, to personal or manual use. These limits frequently name automated or bulk SMS sending, telemarketing and customer-service messaging as prohibited, and some define improper use to include any message that is not written and sent by hand. The Relay sends messages automatically and may fall within such limits.

The contract with your mobile operator is yours, not ours. Before enabling the Relay, it is your responsibility to check your operator's terms and, where they require it, to move to a plan or product that permits automated messaging. Operators commonly sell a dedicated bulk-SMS or business-messaging product for exactly this purpose.

If your operator restricts, suspends or terminates your subscription, or charges you differently, because messages were sent automatically, that is a matter between you and your operator. We are not liable for it, nor for any message that is not sent as a result. A paid SMS provider can be configured instead of or alongside the Relay (Sections 8.2 and 8.3); those routes do not use your own SIM and are not subject to your mobile plan's terms.

When configured, Scisso can route SMS through a third-party SMS gateway (currently SMSAdvert) as a fallback or primary provider. Messages sent via the gateway are delivered from a generic short code (not your business phone number), but the message content identifies your business by name.

Gateway delivery requires prepaid SMS credits (see Section 7.10). Credits are deducted when a message is routed to the gateway. The cost per message depends on the destination country and message length (number of segments). If your credit balance is insufficient, the gateway is skipped and the next available provider in your chain is tried.

Gateway delivery depends on the third-party provider's infrastructure and the downstream carrier networks they use. We do not operate or control the gateway infrastructure.

You configure which providers are active and their priority order. When an SMS is dispatched, Scisso selects the first available provider in your chain. Once a provider is selected for a message, all retry attempts for that message use the same provider. This prevents duplicate deliveries that could occur if a message were re-routed mid-lifecycle.

If no provider in your chain is available (e.g., the relay is offline and your credit balance is insufficient for the gateway), the message will fail after all retry attempts are exhausted. We are not liable for any loss, including missed appointments, lost revenue, or client dissatisfaction, resulting from undelivered SMS messages regardless of the delivery method used.

We do not guarantee SMS delivery via any method. Undelivered messages are retried automatically (up to 10 attempts with increasing delays). Factors affecting delivery include mobile network conditions, carrier filtering, recipient phone status, and third-party provider availability. Scisso is an appointment coordination platform, not a telecommunications provider. SMS delivery is a feature of the platform, not a standalone communications service.

Clients can opt out of SMS at any time using the methods described below. Once a client opts out, Scisso will not send them further SMS from your business, even if their phone number is re-entered into the system.

By connecting a Google Calendar, you authorise Scisso to perform the following actions on the connected calendar:

• Create events when an appointment is created in Scisso (including from online booking requests), with appointment details such as client name, service, and time
• Update events when an appointment is rescheduled, confirmed, or modified in Scisso (including updating titles, times, descriptions, and status indicators)
• Delete events when an appointment is cancelled or a pending booking is rejected in Scisso
• Set extended properties (private metadata) on events created by Scisso, used to link events back to Scisso records (e.g., customer ID, service ID). These properties are not visible in the Google Calendar UI but are stored on the event.
• Read events from the connected calendar via webhook notifications, to detect appointments created or modified directly in Google Calendar and sync them into Scisso
• Match events to clients using attendee email addresses, calendar colour codes, or event title keywords. This matching is best-effort and may require manual review.

In short: creating, rescheduling, confirming, or cancelling appointments in Scisso will create, modify, or delete corresponding events in the connected Google Calendar. Changes made directly in Google Calendar will also be synced back into Scisso.

The Google Calendar API is a third-party service operated by Google LLC and subject to Google's own terms and availability. We make no representations or warranties regarding:

• The continued availability of the Google Calendar API
• The accuracy or timeliness of calendar data synchronisation
• Webhook delivery delays or failures caused by Google's infrastructure
• Changes Google makes to its API that may affect Scisso functionality

Loss of Google Calendar integration due to causes attributable to Google is not a breach of these Terms by KodeKind.

While Scisso is designed to sync calendar data accurately, software bugs, network failures, API changes, or race conditions may occasionally cause unintended outcomes, including but not limited to:

• Events being created, modified, or deleted in your Google Calendar in error
• Duplicate events, missing events, or events with incorrect details
• Extended properties being set, modified, or lost on events
• Sync delays causing stale data to be displayed or acted upon
• Recurring event series being partially or incorrectly updated

To the maximum extent permitted by applicable law, KodeKind shall not be liable for any loss or damage arising from unintended modifications to your Google Calendar data, including lost events, corrupted event data, scheduling conflicts, or any downstream consequences thereof. This limitation applies regardless of whether the issue was caused by a bug in Scisso, a change in the Google Calendar API, a network failure, or any other cause.

You are responsible for maintaining your own backups or records of critical scheduling information and for verifying that calendar data is accurate. You may disconnect your Google Calendar at any time from your profile settings.

Scisso provides a public booking page where prospective and existing clients can browse your services, select an employee, choose a date and time slot, and submit a booking request. Online booking is subject to the following:

• Booking requests are submitted as pending and require explicit confirmation or rejection by the business within the configured expiry period (default: 8 business hours). Scisso does not automatically confirm bookings on your behalf.
• Pending bookings that are neither confirmed nor rejected within the expiry period are automatically cancelled. Scisso is not liable for bookings that expire due to inaction.
• A booking request does not create a binding appointment or any contractual obligation between Scisso and the client. The booking is a request only. The business decides whether to accept or reject it. When a payment-enabled service requires a deposit or prepayment at booking, the payment is a transaction between the client and the business (see Section 2). The business's configured refund policy applies if the booking is rejected or cancelled.
• When a booking is submitted, a corresponding event is created in the assigned employee's Google Calendar (if connected) with a visual pending indicator. The indicator is removed upon confirmation and the event is deleted upon rejection.
• The online booking form is protected by Cloudflare Turnstile (an invisible bot verification service) to prevent automated abuse. No personal data is shared with Cloudflare beyond the verification token.
• The booking page displays your business name, logo, address, phone number, employee names, employee titles and biographies, service names with descriptions and pricing, and available time slots. You are responsible for ensuring this information is accurate and up to date. Scisso is not liable for any inaccuracies in the information you provide.
• Available time slots are calculated based on your configured shop hours, existing appointments, and blocked time. Slot resolution (15, 30, or 60 minutes) is configurable. For services with online payment enabled, a temporary slot reservation is created when the client reaches the payment step, preventing double-booking during the payment window. For services without payment, Scisso does not guarantee that displayed time slots are still available at the time of submission, and simultaneous bookings for the same slot may result in double bookings that you must resolve manually.
• The booking form collects optional consent for SMS appointment notifications and promotional messages. You are responsible for honouring these consent choices and for ensuring that any promotional messages comply with applicable electronic communications regulations (including the ePrivacy Directive).
• Clients may include a free-text note with their booking request. This note is visible to your staff. You are responsible for ensuring that notes are handled appropriately and not used to collect sensitive personal data beyond what is necessary.
• You may enable or disable online booking at any time from the settings page. When disabled, the booking page displays a message directing visitors to contact the business directly.
• When a service has a payment mode configured (deposit, prepayment, or card-on-file) and your Stripe account is connected, the booking form includes additional steps: billing details (address, optional company information), a Stripe payment form, and your cancellation/refund policy. Email becomes required for payment-enabled services. Billing details are encrypted and stored on the client record for future bookings (pre-filled only after phone OTP verification). Card details are collected directly by Stripe and never pass through Scisso servers.
• After a successful online booking, the client receives a secure manage link (via SMS and/or email) that allows them to view appointment details and, after phone verification, cancel the appointment subject to your configured refund policy. Cancellations via the manage link follow the same refund rules as cancellations initiated by the business. You are notified of every client-initiated cancellation via push notification and email.

Each employee may have a personalised booking URL (a "booking slug") that links directly to their availability on the booking page. Booking slugs are auto-generated from the employee's name and can be customised. These URLs are publicly accessible when online booking is enabled.

When a client submits a booking, Scisso may send the following SMS notifications on behalf of the business:

• Booking received - sent to the client confirming that their booking request has been received and is pending review by the business
• Booking rejected - sent to the client if the business rejects their booking request

If the booking is confirmed, the standard appointment confirmation SMS is sent (see Section 8). Each SMS type can be individually enabled or disabled by the business.

Scisso generates QR codes that encode URLs for the booking page, client registration forms, and client record update forms. QR codes are generated entirely within the browser and are not transmitted to or stored on Scisso servers. You may download and print QR codes for display in your business premises. The business is solely responsible for the placement, display, and removal of printed QR codes.

When the business is outside of its configured shop hours, the booking page may offer visitors the option to save the business contact details as a vCard file (.vcf). The vCard contains only the business name and phone number. vCard files are generated in the browser and are not stored on Scisso servers.