Log in
Privacy Policy

Terms and Conditions of Service

Last updated: 20 August 2026 · Version 2.0

Welcome to IDBuddy. These Terms and Conditions (the “Terms”) govern your access to and use of our web-based membership management platform, unified CRM dashboard, digital wallet tools, and related services (collectively, the “Service”). The Service is owned and operated by Byte Buddies AB, a Swedish limited liability company, corporate registration number 559491-4979, with its registered office in Malmö, Sweden (“IDBuddy”, “we”, “us” or “our”). You can reach us at info (at) idbuddy.io.

By creating an account, completing our onboarding workflow, or otherwise using the Service, you agree to these Terms. If you accept these Terms on behalf of a company, non-profit association, or other organization, you confirm that you are authorized to bind that organization, and “Customer”, “you” or “your” refers to that organization. If you do not agree to these Terms, please do not use the Service.

Business use only. The Service is offered exclusively to businesses, merchants, non-profit associations and other organizations, for purposes within their trade, business or organizational activity. By accepting these Terms you confirm that you are not acting as a consumer. Private individuals do not purchase the Service and are not Customers under these Terms; their position as members and end users of a Customer’s workspace is described in Section 3.4.

You must be at least 18 years old to create an account or administer a workspace.

1. Definitions

In short: Key words used throughout these Terms, defined once so the rest of the document stays readable.
  • "Customer Data" means all data, including personal data of your members and contacts, that you or your end users upload to, store in, or generate through the Service.
  • "DPA" means the Data Processing Agreement between you and us pursuant to Article 28 GDPR, which forms an integral part of these Terms. A copy is available on request from info (at) idbuddy.io and in your dashboard.
  • "GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation), together with applicable supplementary national legislation, including the Swedish Data Protection Act (2018:218).
  • "Member" means a private individual whose record exists in a Customer’s member database and/or who holds a digital wallet pass issued through the Service on that Customer’s behalf. Members use these features free of charge and are not parties to these Terms.
  • "Member Volume" means the number of Member records stored in your workspace. It is the figure your plan is sized against.
  • "Order" means the written subscription confirmation agreed between us when you subscribe or change plan, stating your plan, your billing period, your price and any add-ons.
  • "Workspace" means the organizational account through which you use the Service, including its members, settings and Customer Data.

2. The Service

In short: IDBuddy is an app-free, web-based platform for membership management, digital wallet passes, and member communications. We keep it running, improve it over time, and tell you before we make changes that materially reduce what you paid for.

2.1 IDBuddy provides an app-free, web-based platform designed to simplify membership management, enable verification and collaboration between organizations, and support direct member communications. Core components include:

  • Member management: dashboards for member lists, roles, filtering and profile statuses.
  • Digital Wallet Interface: standardized QR passes delivered to members’ mobile digital wallets for identification and digital stamp card updates, without an app store download.
  • Stamp cards, offers and events: loyalty stamp cards, member offers with claim tracking, and event listings with venue and map details.
  • Communication modules: tools for newsletters and targeted member communications, including the unsubscribe and preference handling described in Section 10.3.
  • Membership renewal and retention tools: configurable renewal schedules and retention periods, described in Section 9.

2.2 Updates and changes. We may deploy updates, security patches, feature adjustments and technical modifications to maintain and improve the Service. We will not materially degrade the core functionality of your paid plan during a paid period without giving you at least thirty (30) days’ prior notice; if a change materially reduces the core functionality you pay for, you may terminate the affected subscription and receive a pro-rated refund for the unused remainder of any prepaid period.

2.3 Availability. We aim to keep the Service available at all times but do not guarantee uninterrupted operation, and we do not currently offer a contractual service level or uptime commitment. Planned maintenance will, where reasonably possible, be scheduled outside normal Swedish business hours and announced in advance.

2.4 Beta features. Features marked as beta, preview or early access are provided for evaluation, may change or be withdrawn at any time, and are excluded from any availability commitments.

2.5 Free plan. The Community Free plan is provided free of charge and may be modified, limited or discontinued on reasonable notice. Sections 2.2 and 2.3 do not apply to the free plan.

3. Accounts, Security and Verification

In short: Keep your login credentials safe, give us accurate information, and tell us immediately if your account is compromised. You are responsible for what happens through your authenticated account, unless the problem is on our side.

3.1 Onboarding. To protect the platform against unauthorized actors, organizational accounts are set up by us following your request, which may include manual verification before full activation. You agree to provide accurate, complete and current registration information and to keep it up to date.

3.2 Credentials. You must keep your access keys, master account, linked authentication profiles (e.g., Google sign-in) and magic-link pathways secure and confidential. You are responsible for all activities carried out through your authenticated dashboard, except to the extent an activity results from our breach of these Terms or a security failure attributable to us.

3.3 Compromise. You must promptly notify us at info (at) idbuddy.io if you discover any breach of security or unauthorized use of your account. We may suspend an account we reasonably believe to be compromised while we investigate, and will inform you without undue delay when we do.

3.4 Members and end users. Members access wallet passes, check-ins, stamp cards and similar features free of charge, as a facility we provide on your behalf and on your instructions. Members are not parties to these Terms, have no contractual relationship with IDBuddy under them, and owe us no fees. The relationship between you and your Members, including membership terms, benefits, communications and privacy information, is yours alone to define and manage, and you are responsible for providing Members with any terms and privacy notices required by law. We process Members’ personal data solely as your processor under Section 8 and the DPA. Nothing in this Section prevents a Member from exercising their data protection rights, which you are responsible for honoring as controller.

3.5 Automated abuse checks. Sign-in and account creation are subject to an automated check for automated clients, described in Section 18 of our Privacy Policy. Where a legitimate request is refused, contact info (at) idbuddy.io and a person will review it.

4. Plans and Pricing

In short: Your plan is sized by how many members you store, agreed with us in writing when you subscribe. Your plan does not change by itself, and it never changes without us agreeing it with you first.

4.1 Plans. The Service is offered in volume-based plans (currently Community Free, Starter, Momentum, Growth, Pro and Ultimate). Each plan covers a Member Volume ceiling. Current plans, ceilings and prices are published on our website and confirmed in your Order.

4.2 Storage of inactive members. Members who are no longer active still count toward your Member Volume for as long as their records are stored in your workspace. Section 9 describes the retention tools you can use to remove records you no longer need.

4.3 No automatic plan changes. Your plan does not scale up or down by itself, and we do not bill usage-based overages. If your Member Volume passes your plan ceiling, we will contact you, and any change of plan takes effect only once we have agreed it with you in writing. Nothing is charged to you that is not stated in an Order.

4.4 Seasonal and one-off peaks. If you expect a temporary peak, whether a festival, a recruitment drive or a membership campaign, tell us in advance and we will agree a temporary arrangement for that period rather than moving you to a higher plan permanently.

4.5 Transparency. Your dashboard shows your current stored member count so you can see where you stand against your plan ceiling.

5. Fees, Payment, Taxes and Price Changes

In short: We invoice you in advance in Swedish kronor. Prices exclude VAT unless stated. If we raise prices, we give at least 30 days’ notice and you can cancel before the increase takes effect.

5.1 Payment. Subscription fees are invoiced in advance for each billing period, in Swedish kronor (SEK), payable within thirty (30) days of the invoice date unless your Order states otherwise. We do not operate a self-service checkout and we do not store a payment card or direct debit mandate for your account.

5.2 Taxes. Unless stated otherwise, prices exclude VAT and other applicable taxes, which are added at the statutory rate. You are responsible for providing a valid VAT number where applicable to intra-EU supplies.

5.3 Late payment. If an undisputed invoice remains unpaid after its due date, we may charge default interest in accordance with the Swedish Interest Act (räntelagen, 1975:635) and statutory reminder and collection fees. We may suspend the Service for continued non-payment after giving you at least ten (10) days’ written notice; suspension does not relieve you of your payment obligation.

5.4 Price changes. We may change our prices and plan ceilings. Changes take effect for monthly plans no earlier than thirty (30) days after notice, and for annual plans at the start of your next annual term. If you do not accept a price increase, you may cancel effective from the date the increase would apply.

5.5 Good-faith billing disputes. If you dispute a charge in good faith, notify us within thirty (30) days of the invoice date with reasonable detail. We will not suspend the Service over the disputed amount while we investigate, provided undisputed amounts are paid on time.

6. Refunds

In short: Fees for a period you have already started are not refundable, except where these Terms promise otherwise: our material breach, a material degradation of the Service, or prolonged force majeure.

6.1 No-refund rule. Except as expressly stated in these Terms (including Sections 2.2, 7.4 and 16) or required by mandatory law, subscription fees, renewals and add-on purchases are non-refundable, and we do not provide pro-rated returns for partial subscription periods, downgrades or voluntary account closure. This reflects standard practice for subscription software and allows us to provision capacity predictably.

6.2 Downgrades. If you move to a lower plan, the change takes effect at the start of your next billing period. We do not issue a credit or refund for the remainder of the current period.

7. Term, Cancellation and Termination

In short: Cancel by writing to us; monthly plans end at the close of the current month, annual plans at the end of the annual term. After termination you get 30 days to export your data, after which we delete it.

7.1 Term. Monthly subscriptions renew automatically each calendar month; annual subscriptions renew automatically for successive twelve-month terms unless cancelled before the renewal date. We will send a reminder before any annual renewal.

7.2 Cancellation by you. You may cancel at any time by written notice to info (at) idbuddy.io. Cancellation takes effect at the end of the current billing period (monthly plans) or the current annual term (annual plans). Section 6 governs refunds.

7.3 Termination by us for cause. We may suspend or terminate the Service, in whole or in part, with immediate effect if: (a) you materially breach these Terms (including the Acceptable Use rules in Section 10) and, where the breach is curable, fail to cure it within fourteen (14) days of written notice; (b) you become insolvent or subject to bankruptcy or company reorganization proceedings; or (c) we are required to do so by law or by order of a competent authority. Where lawful and practicable, we will give notice and an opportunity to remedy before suspending or terminating. Suspension may be partial: we are able to withdraw individual capabilities from a workspace, including its ability to send messages, without terminating it.

7.4 Termination by you for cause. You may terminate with immediate effect if we materially breach these Terms and fail to cure within fourteen (14) days of written notice. In that case we will refund the pro-rated portion of prepaid fees covering the period after termination.

7.5 Effect of termination; data export. Upon expiry or termination: (a) your right to use the Service ceases; (b) for thirty (30) days you may export Customer Data in a structured, commonly used, machine-readable format from the dashboard or on request; and (c) after that period we will delete or irreversibly anonymize Customer Data in accordance with the DPA, except where retention is required by law. We will confirm to you in writing when deletion is complete.

8. Your Data and the GDPR: Roles and Responsibilities

In short: You are the data controller for your member data; we are your data processor and only act on your instructions under a Data Processing Agreement. Your member data is held in the EU. We handle the technical safeguards; you remain responsible for having a lawful basis and being transparent with your members.

8.1 Roles

For all Customer Data, you act as the data controller and IDBuddy acts as your data processor within the meaning of Articles 4(7)–(8) GDPR. We process Customer Data only on your documented instructions, as set out in these Terms, the DPA and your configuration of the Service, unless EU or Swedish law requires otherwise. Our own staff access Customer Data only to operate, support and secure the Service, and that access is logged.

For our own account, billing and platform-security data, we act as an independent controller as described in our Privacy Policy, a separate document available at idbuddy.io/privacy in all supported languages.

8.2 Data Processing Agreement

The DPA is incorporated into these Terms by reference and governs the subject matter, duration, nature and purpose of processing, the categories of data subjects and personal data, sub-processors, technical and organizational measures, assistance with data subject rights, audits, and deletion or return of data. In case of conflict between the DPA and these Terms regarding the processing of personal data, the DPA prevails.

8.3 Your responsibilities as controller

Using IDBuddy’s tools does not, by itself, make you GDPR-compliant, and we are not a compliance guarantor. You remain responsible for: (a) having a lawful basis for collecting and processing your members’ personal data; (b) providing transparency information to your members; (c) honoring data subject rights and communication preferences, including marketing consent and opt-outs; (d) carrying out any required impact assessments; (e) where your Members include children, complying with Article 8 GDPR and the applicable national age threshold for consent-based processing (13 years in Sweden under Chapter 2, Section 4 of the Swedish Data Protection Act; between 13 and 16 years elsewhere in the EU/EEA), including obtaining parental consent where required, noting that the Service does not collect a date of birth and cannot assess a Member’s age on your behalf; (f) maintaining your own Records of Processing Activities where required by Article 30 GDPR; and (g) where your membership itself reveals a special category of personal data under Article 9 GDPR, identifying your condition under Article 9(2) and handling your list accordingly.

8.4 Our commitments as processor

  • EU storage: Customer Data, meaning member records, memberships, interaction history and uploaded files, is stored in an EU region. Some of the vendors that operate parts of the Service are established outside the EU/EEA, and email delivery in particular involves a transfer to the United States. Sections 11 and 12 of our Privacy Policy name every such vendor and state the Chapter V transfer mechanism relied on for each. We will not add a transfer without a valid mechanism under Chapter V GDPR and updating the DPA accordingly.
  • Security: we implement appropriate technical and organizational measures under Article 32 GDPR, including encryption in transit and at rest, database-enforced tenant isolation, server-side authorization on every write, access controls and logging, as further described in the DPA.
  • Breach notification: we will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and provide the information reasonably needed for your obligations under Articles 33–34 GDPR.
  • Sub-processors: the current list of sub-processors, with each one’s jurisdiction and role, is published in Section 11 of our Privacy Policy and maintained in the DPA. We will notify you of intended additions or replacements in good time and give you the opportunity to object as set out in the DPA.
  • Assistance: taking into account the nature of processing, we will assist you with data subject requests, impact assessments and consultations with supervisory authorities, as set out in the DPA. The Service provides export tooling for this purpose.
  • Confidentiality: persons authorized to process Customer Data are bound by confidentiality obligations.

9. Membership Renewal and Data Retention Tools

In short: You can set a renewal schedule and a retention period so that records you no longer need are removed automatically. You configure it, we warn you before anything is permanently deleted.

9.1 Purpose. The Service includes configurable workflows that help you apply the GDPR storage-limitation principle. You can set a renewal schedule under which members are asked to confirm their membership, and a retention period after which records that remain inactive are removed from your workspace.

9.2 Your configuration, our execution. These workflows run only according to parameters that you review, set and expressly accept; your configuration constitutes your documented instruction to us as processor. You are responsible for ensuring the configured periods match the legal, tax and industry retention requirements that apply to your organization, including the accounting retention period for any membership fees you have recorded, which for a Swedish organization is seven years under Chapter 7, Section 2 of the Bookkeeping Act (1999:1078).

9.3 Safeguards. Before any automated permanent deletion, the Service will: (a) notify workspace administrators in advance with a summary of the records scheduled for deletion; (b) provide a reasonable window to pause the run, adjust parameters or export the affected records; and (c) log completed runs for your accountability records.

9.4 Defaults. We do not switch these workflows on for you. A workspace has no automatic deletion schedule until an administrator configures one.

9.5 Liability. Provided the safeguards in Section 9.3 have operated as described, we are not liable for the deletion of data carried out in accordance with your configured parameters. This does not limit our liability for deletion that deviates from your configuration or from Section 9.3, or any liability that cannot be excluded under mandatory law.

10. Acceptable Use

In short: Use the platform lawfully. In particular, only send marketing to people who have validly consented or whom you may lawfully contact, honor opt-outs, and never upload data you have no right to process.

10.1 You agree not to use the Service to:

  • send unsolicited electronic marketing in violation of the GDPR, the ePrivacy rules implemented in the Swedish Electronic Communications Act (2022:482), or the Swedish Marketing Practices Act (marknadsföringslagen, 2008:486), including messaging contacts without a valid legal basis or ignoring opt-outs;
  • upload or process personal data you are not lawfully entitled to process, including special categories of data under Article 9 GDPR unless a valid exception applies;
  • upload malicious code, attempt to gain unauthorized access to the Service or other customers’ data, or probe, scan or test the vulnerability of the platform without our written permission;
  • resell, sublicense or provide the Service to third parties as a service bureau, except as expressly permitted by your plan;
  • use the Service for any unlawful, fraudulent, discriminatory or harassing purpose, or in a way that infringes third-party rights.

10.2 Enforcement. We may suspend dispatch functionality or accounts that we reasonably believe violate this Section, following the notice-and-cure process in Section 7.3 where practicable. We do not monitor the content you write into your own fields or messages, so our enforcement is triggered by what we are told and what we observe, not by content inspection.

10.3 Communications and opt-outs

Messages you send through the Service carry an unsubscribe link and the standard unsubscribe headers, and the Service records and applies the resulting opt-outs. You must not remove, obscure or defeat that mechanism, and you must not re-add a contact who has opted out. Where a Member opts out of your mailings, the Service will exclude them from your future sends; that exclusion is applied on your behalf and does not relieve you of your own obligations as controller under Article 21(3) GDPR.

You are responsible for the recipients you select. The Service sends to the member records in your workspace, and you must not use it to reach addresses you have no lawful basis to contact.

11. Intellectual Property

In short: We own the platform; you own your data. You give us just enough license to your data to run the Service for you, nothing more.

11.1 Our IP. The Service, including its software, design, dashboards, QR pass architecture, documentation and trademarks, is and remains the exclusive property of Byte Buddies AB and its licensors. We grant you a non-exclusive, non-transferable, non-sublicensable right to use the Service during your subscription, for your internal business or organizational purposes, in accordance with these Terms.

11.2 Your data. As between the parties, you own all Customer Data. You grant us a limited license to host, process, transmit and display Customer Data solely to provide and secure the Service, comply with law, and as otherwise instructed by you. We do not sell Customer Data and do not use it to train machine-learning models.

11.3 Aggregated statistics. We may generate aggregated, anonymized usage statistics that do not identify you or any individual, and use them to operate and improve the Service.

11.4 Feedback. If you provide suggestions or feedback, we may use them without restriction or obligation, provided we do not identify you without consent.

12. Confidentiality

In short: Each side keeps the other’s non-public information secret and uses it only for purposes of the relationship.

Each party will keep confidential all non-public information received from the other in connection with the Service, use it only to perform under these Terms, and protect it with at least reasonable care. This obligation does not apply to information that is or becomes public without breach, was lawfully known before disclosure, is independently developed, or must be disclosed by law or competent authority, in which case the disclosing party will, where lawful, notify the other party in advance. This Section survives termination for three (3) years; obligations regarding personal data survive as long as the data is retained.

13. Warranties and Disclaimers

In short: Beyond the commitments we expressly make in these Terms and the DPA, the Service is provided “as is”.

13.1 The Service is provided “as is” and “as available”. Except as expressly set out in these Terms or the DPA, we disclaim all implied warranties to the maximum extent permitted by law, including fitness for a particular purpose and non-infringement. We do not warrant that the Service will be error-free or uninterrupted, or that it will satisfy your regulatory obligations.

13.2 No legal advice. Information, templates and automated workflows in the Service are provided for convenience and do not constitute legal advice.

14. Indemnification (Business Customers Only)

In short: If your unlawful use of the platform, for example spamming people or uploading data you had no right to, gets us fined or sued, you cover those costs.

You will defend and indemnify Byte Buddies AB against third-party claims, regulatory penalties and reasonable costs (including reasonable legal fees) to the extent arising from: (a) Customer Data you had no right to process; (b) your electronic marketing or member communications conducted in breach of applicable law; or (c) your use of the Service in violation of these Terms. In each case this excludes a claim to the extent it results from our breach of these Terms or the DPA. We will notify you promptly of any such claim and allow you to control the defense, provided you do not settle in a way that imposes obligations on us without our consent.

15. Limitation of Liability

In short: Our liability is capped at what you paid us in the 12 months before the event, and neither side is liable for indirect losses. The cap never applies to intent, gross negligence, personal injury, or anything the law says cannot be limited.

15.1 Exclusion of indirect loss. To the maximum extent permitted by law, neither party is liable to the other for indirect, incidental, special, consequential, punitive or exemplary damages, including loss of profits, goodwill or anticipated savings.

15.2 Cap. Our total aggregate liability arising out of or in connection with these Terms, under any legal theory, shall not exceed the total fees paid by you for the Service during the twelve (12) months immediately preceding the event giving rise to liability, or SEK 5,000 if that amount is higher.

15.3 Carve-outs. Nothing in these Terms excludes or limits either party’s liability for: (a) death or personal injury; (b) willful misconduct or gross negligence; (c) fraud; (d) a party’s indemnification obligations under Section 14; or (e) any liability that cannot be excluded or limited under mandatory law, including each party’s liability to data subjects under Article 82 GDPR (the allocation of data-protection liability between the parties is addressed in the DPA).

15.4 Your responsibility. For clarity, we are not liable for losses arising from your independent mismanagement of your member databases, or from regulatory penalties imposed on you due to your own failure to comply with your controller obligations under Section 8.3, except to the extent we contributed to the failure through a breach of these Terms or the DPA.

16. Force Majeure

In short: Neither side is on the hook for failures caused by events genuinely outside its control, though payment for services already delivered is still owed.

Neither party is liable for failure or delay in performance (other than payment obligations already due) caused by circumstances beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, power or internet infrastructure failures, acts of public authorities, or widespread failures of third-party hosting providers, provided the affected party notifies the other without undue delay and uses reasonable efforts to mitigate. If a force majeure event persists for more than thirty (30) days, either party may terminate the affected subscription, and prepaid fees for the undelivered period will be refunded.

17. Changes to These Terms

In short: If we change these Terms in a way that affects you negatively, you get at least 30 days’ notice and the right to walk away before the change applies.

We may update these Terms from time to time. Material changes that are adverse to you take effect no earlier than thirty (30) days after we notify you by email and by notice in your dashboard; non-material changes (such as clarifications, typographical fixes or changes required by law) may take effect immediately. If you do not accept a material adverse change, you may terminate the affected subscription effective from the date the change takes effect, and any prepaid fees for the period after termination will be refunded pro rata. Continued use after the effective date constitutes acceptance.

18. General Provisions

In short: The usual legal housekeeping: transfers, notices, severability and the fact that this document is the whole agreement.

18.1 Assignment. You may not assign these Terms without our prior written consent, not to be unreasonably withheld. We may assign these Terms to an affiliate or in connection with a merger, acquisition or sale of assets, provided the assignee assumes our obligations and, for Customer Data, the protections of Section 8 and the DPA continue to apply.

18.2 Notices. Legal notices to us must be sent to info (at) idbuddy.io or our registered address. Notices to you are given via your registered email address or the dashboard and are deemed received on the next business day.

18.3 Severability. If any provision of these Terms is held unlawful, void or unenforceable by a competent court, that provision is severed (or, where possible, adjusted to the minimum extent necessary to make it enforceable) and the remaining provisions remain in full force.

18.4 No waiver. A party’s failure to enforce any provision is not a waiver of its right to enforce it later.

18.5 Entire agreement. These Terms, together with the DPA and your Order, constitute the entire agreement between the parties regarding the Service and supersede all prior proposals, drafts and discussions. In case of conflict, the order of precedence is: (1) the DPA (for personal data matters), (2) the Order, (3) these Terms. The Privacy Policy (available at idbuddy.io/privacy) is an information notice under Articles 13–14 GDPR describing how we process personal data; it is a separate document and does not amend the contractual allocation of responsibilities in these Terms or the DPA.

18.6 Marketing and product information. Descriptions of the Service on our website, in our FAQ pages and in sales material are provided for orientation. Where such a description conflicts with these Terms, your Order or the DPA, those documents govern.

18.7 Survival. Sections 6–8, 9.5 and 11–19 survive termination to the extent relevant.

18.8 Language. These Terms, the Privacy Policy and the DPA are each published in English, Swedish, Danish and French. All versions have the same content; in case of discrepancies between language versions, the English version prevails to the extent permitted by applicable law.

19. Governing Law and Disputes

In short: Swedish law applies and disputes go to the District Court of Malmö. But contact us first: most issues are resolved quickly and informally.

19.1 Governing law. These Terms are governed by the substantive laws of Sweden, excluding its conflict-of-law rules.

19.2 Venue. Any dispute arising out of or in connection with these Terms shall be finally settled by the general courts of Sweden, with the District Court of Malmö (Malmö tingsrätt) as the court of first instance.

19.3 We encourage you to contact us first at info (at) idbuddy.io. Most issues can be resolved quickly and informally.

20. Contact

Byte Buddies AB (reg. no. 559491-4979)

Registered office: Malmö, Sweden

Email: info (at) idbuddy.io