In short
These Terms govern your use of Everabyte's website and cloud storage service.
You accept them by clicking “I agree”, by signing an order form that refers to them, or by using the service.
They work together with the Privacy Policy and, for business customers, the Data Processing Agreement (DPA). Where we act as your processor, the DPA prevails. On any other data protection question, the Privacy Policy prevails over these Terms.
If you are a consumer, nothing here reduces your statutory rights under the Consumer Rights Act 2015 or the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.
1. Definitions
- “Everabyte”, “we”, “us” — Everabyte Limited, company no. 16338558, Suite 3173, 275 New North Road, London N1 7AA, United Kingdom.
- “Services” — the Everabyte website, platform, APIs and zero-knowledge encrypted cloud storage, together with related documentation and support.
- “User”, “you” — any individual or organisation using the Services.
- “Consumer” — a User acting wholly or mainly outside their trade, business, craft or profession.
- “Business User” — a User acting in a commercial or professional capacity.
- “Account” — a registered account on the platform.
- “Subscription” — recurring access to the Services, billed monthly or annually.
- “Content” — any file or data you upload, store or transmit through the Services.
- “Personal Data” — as defined in the UK GDPR.
- “DPA” — the Everabyte Data Processing Agreement for business customers.
2. Acceptance and changes
2.1 Acceptance
You accept these Terms when you click “I agree” or a similar button at sign-up, sign an order form referring to them, or use the Services.
If you accept on behalf of an organisation, you confirm you have authority to bind it, and “you” means that organisation.
2.2 Changes
Minor changes — clarifications, corrections, updated contact details — are published here with a new “Last updated” date.
Material changes — fees, auto-renewal, liability, acceptable use, data protection or termination rights — are notified to you by email and in-product notice at least 30 days before they take effect.
If you do not want to accept a material change, you may terminate the affected Service before it takes effect, at no penalty. Continuing to use the Services is not treated as consent to a change that requires your consent by law. Ask us at [email protected] for a previous version of these Terms.
3. Eligibility, accounts and suspension
3.1 Eligibility
You must be at least 18 years old to open an Account and enter into a contract with us. The Services are not offered to under-18s, with or without parental consent. This matches Section 11 of the Privacy Policy.
3.2 Your Account
You agree to give accurate registration information and keep it current, keep your credentials and recovery codes secure, tell us at [email protected] promptly about any unauthorised access, and take responsibility for activity under your Account, subject to applicable law.
Because of how the encryption works, we cannot recover your data if you lose your key or recovery codes. There is no reset, no master key and no back door. Keep your recovery codes somewhere safe and separate from your device.
3.3 Account security
We are not liable for losses from unauthorised access where you have not taken reasonable steps to protect your credentials — a strong unique password, multi-factor authentication, not sharing credentials. Where you have taken reasonable steps and the access is attributable to our failure to provide adequate security, Section 11 applies.
3.4 Suspension
We may suspend or restrict your Account where we reasonably believe that you have breached these Terms (in particular Section 6), your Account is subject to a security incident, your Account is creating legal, security or operational risk, or a competent authority has ordered it.
Where lawful and reasonably practicable we will give you advance notice and an opportunity to fix the problem before suspension, unless immediate action is needed to prevent fraud, abuse or harm. We will tell you the reason and how to respond.
4. The Services
4.1 What we provide
- Encrypted cloud storage — zero-knowledge, end-to-end encrypted file storage. Your files are encrypted on your device with keys we do not hold.
- Dedicated servers — dedicated hosted infrastructure, where taken.
- White-label deployment and custom modules — our software, developed in-house, made available under your own branding. You can ask us to build additional modules specific to your needs.
- Security operations — the monitoring, hardening and protective measures we run to keep the platform and your data secure, described in Section 11 and in Section 7 of the Privacy Policy.
The exact plan, capacity, modules and features you receive are set out on the website or in your order form.
4.1.1 What “zero-knowledge” covers
The statements in these Terms that we cannot read your Content — Sections 3.3, 7.1, 9.5, 10 and 12.4 — apply to our storage platform, including white-label deployments, which run the same software and handle keys the same way. Rebranding changes nothing about the encryption.
Two situations can differ:
- a dedicated server, where what we can access depends on how the environment is configured and what administrative access you ask us to retain;
- a custom module that, by design, needs to process your data in readable form.
Where either applies, your order form or DPA states exactly what we can and cannot access, and we will tell you before building anything that would change the zero-knowledge position.
4.2 Service levels
For paid Services marked “with SLA”:
- Target uptime: 99.9% per calendar month, measured at the platform edge.
- Service credits: 5% of the monthly fee for each full hour of downtime beyond the target, capped at 50% of the monthly fee for the affected Service. Credits are non-cash, applied against future invoices, and are your only remedy for an SLA shortfall — except where the law gives you additional remedies, which for Consumers it does.
- Maintenance: scheduled maintenance runs in low-traffic windows, announced at least 48 hours ahead where practicable, and does not count against the target.
- Excluded: force majeure and emergency security patching.
Current and historical uptime is published on our website.
5. Pricing, payment and cancellation
5.1 Prices
Prices are shown on the website or in your order form, and vary by plan, storage volume and support level. Prices exclude VAT and other transaction taxes, which are added at checkout where required.
5.2 Auto-renewal (Consumers)
For Consumers on a Subscription:
- before checkout we give you clear information about the term, the recurring price, the renewal date and how to cancel;
- your Subscription does not auto-renew unless you have actively opted in. A pre-ticked box, a default setting or silence is not consent;
- we send you a reminder at least 7 days before each renewal, with the date, the amount and how to cancel;
- you can cancel at any time, effective at the end of the current paid period;
- cancelling is at least as easy as signing up — from your Account settings, or by emailing [email protected].
Some of these commitments go beyond what the law currently requires. The Digital Markets, Competition and Consumers Act 2024 introduces a statutory subscription regime — reminder notices, a second cooling-off period on renewal, and a guaranteed easy exit — expected to commence in Spring 2027. Until then, the Consumer Contracts Regulations 2013 apply, and we operate the commitments above voluntarily.
For Business Users, the terms of your order form prevail; otherwise the above applies as a default.
5.3 Payment
Fees are payable in advance of the service period unless agreed otherwise in writing. You authorise us and our payment providers to charge your payment method for recurring fees, taxes and other charges you incur. Keep your payment method current — if it fails, Section 5.5 applies.
5.4 Payment providers
Card and bank payments are processed by Stripe; cryptocurrency payments by NowPayments. In both cases the provider handles the transaction and we receive only its status and reference — we never hold your card number, wallet credentials or private keys. Each provider is subject to its own terms and privacy policy.
Cryptocurrency payments carry additional risks — price volatility, irreversibility, regulatory uncertainty — which you accept if you choose that method. We do not give financial, tax or investment advice.
5.5 Price changes and failed payments
Price changes. Non-material adjustments are notified at least 30 days ahead and take effect at your next renewal. Material increases are notified at least 60 days ahead, and you may terminate the affected Service without penalty before they take effect — we will remind you of that right in the notice. Statutory changes such as a VAT rate change take effect when the law does.
Failed payments. We may retry the charge at reasonable intervals, suspend or restrict the affected Service, downgrade it to a lower tier, or terminate it after at least 14 days' notice if the failure is not cured. We may charge reasonable administrative costs for recovering failed payments where the law permits and we disclosed them in advance. We do not charge Consumers interest on late amounts except where required by law.
5.6 Trials
We may offer a free 7-day trial. Eligibility, duration and features vary by offer and may change, to the extent the law permits.
If a payment method is required at sign-up, the paid Subscription does not start automatically when the trial ends. We obtain your explicit consent before charging you, and send a reminder at least 3 days before the trial ends explaining how to cancel. If no payment method is required, nothing is charged unless you actively choose a paid plan.
5.7 Right to cancel (Consumers)
As a Consumer buying at a distance, you have a statutory 14-day right to cancel under the Consumer Contracts Regulations 2013.
If you ask us to start providing the Services during those 14 days and acknowledge that you will lose the right to cancel once they are fully performed, you lose that right on full performance. We ask for that acknowledgement separately at checkout — it is never bundled into acceptance of these Terms.
If you do not give it, you may cancel within 14 days and we refund you under Section 5.8.
5.8 Refunds
- Cancelling under Section 5.7: we refund all payments received, by the same method you paid, within 14 days of being told of your decision.
- After full performance at your express request: no refund is due.
- Unused time: we do not give partial or pro-rated refunds for unused time, storage, downgrades or partly used billing periods, except where the law requires it.
- SLA credits: non-cash, non-transferable, usable only against future Services.
- Goodwill: we may issue a discretionary refund or credit, for example where there has been a documented service quality problem.
5.9 Cancelling
Cancel from your Account settings or by emailing [email protected]. Cancellation takes effect at the end of the current paid period and you keep access until then. It does not cancel fees already due. Enterprise and negotiated contracts may have their own notice periods, which prevail.
6. Acceptable use
You must not use the Services to:
- store, distribute or facilitate illegal content, including content infringing criminal, intellectual property or data protection law;
- distribute malware, ransomware, spyware or other malicious code;
- carry out phishing, fraud, identity theft or other deceptive practices;
- infringe intellectual property rights or host pirated or stolen material;
- send spam or abusive bulk messaging;
- bypass authentication, security controls, rate limits or access restrictions;
- interfere with the platform's or any third party's integrity, availability or performance, including denial-of-service attacks, port scans or unauthorised vulnerability testing;
- carry out unlawful hacking or credential theft;
- overload the infrastructure in a way that degrades the service or harms others;
- breach export control, sanctions or anti-money-laundering law;
- store or process special category personal data (health, biometric, criminal offence data and the like) unless you have a DPA with us covering it. This matches Section 2 of the Privacy Policy: we do not process such data as a controller.
6.1 How we enforce this — and what we cannot see
We cannot read your files. We have no technical means of inspecting Content, so we do not and cannot proactively scan it. Our enforcement works from metadata, platform behaviour, abuse reports and lawful requests — never from file content.
We may monitor use of the Services to detect breaches of this Section, security incidents and abuse. Monitoring is limited to what is necessary and proportionate, and is described in the Privacy Policy.
Some enforcement is automated — rate limiting and temporary blocking of suspicious logins, and fraud scoring on payments. If an automated measure restricts your access, you can ask a person to review it, make representations and contest the outcome, by emailing [email protected]. We do not make significant decisions about you by automated means alone. See Section 10 of the Privacy Policy.
Where we reasonably believe you have breached this Section, we may suspend or terminate the affected Account or Service, disable access to specific Content where lawful and proportionate, report suspected offences to the authorities and co-operate with them, and pursue civil remedies.
Where lawful and practicable we will tell you what we have done and why, and give you a chance to respond — unless that would prejudice an investigation or cause further harm.
7. Data protection
7.1 Privacy Policy
The Privacy Policy explains how we handle Personal Data as a controller — your account, billing, support and technical log data. It forms part of these Terms, and prevails over these Terms on any data protection question, except where the DPA applies.
7.2 If you are a business customer
Where you use the Services to store Personal Data about your own customers, staff or end users, you are the controller and we are your processor under Article 28 UK GDPR. We process that data only on your documented instructions, under the DPA, which contains the terms required by Article 28(3). The DPA prevails over these Terms for that processing.
7.3 If you are an individual
Where you store your own personal files for your own private purposes, that is your own domestic activity and falls outside the scope of the UK GDPR (Article 2(2)(a)). You are not a controller of your own data and we are not your processor.
We are the controller of the data we hold about you as a customer — your account, billing, support history and technical logs — and of the metadata your use of the Service generates. The Privacy Policy covers all of it.
This replaces the position in version 2.1 of these Terms, which described individual users as controllers and Everabyte as their processor. A person cannot be the controller of their own personal data, purely domestic processing is out of scope, and an Article 28 agreement cannot be concluded with a consumer.
7.4 Where your data is stored, and providers
You choose the data centre region for your storage. Individual accounts default to London. Available regions: London; Amsterdam, Frankfurt, Paris, Milan; Toronto, Tokyo; Sydney, Singapore; Oregon, San José, Virginia.
Your account, billing and support data stays in the UK regardless of the region you choose. Limited cross-region processing happens for authentication, billing and DDoS mitigation, and encrypted backups may sit in a secondary region.
Our providers are IONOS UK (data centre hosting and storage), Stripe (payments), and Google Analytics (website and product analytics, only with your consent). We give business customers 30 days' notice by email before adding a new provider that processes their data, and you may object on reasonable data protection grounds — we will then work with you in good faith, which may include letting you terminate the affected Service.
Transfers out of the UK rely on UK adequacy regulations, the UK-US Data Bridge, or the UK International Data Transfer Agreement. Where we rely on the IDTA we assess and document whether protection in the destination is not materially lower than under the UK GDPR, as the Data (Use and Access) Act 2025 requires. Section 5 of the Privacy Policy sets out which mechanism applies to which region. Copies on request: [email protected].
7.5 Zero-knowledge architecture, and what it means for you
Encryption keys are derived and held on your device. We do not hold them and cannot decrypt your Content.
The practical consequences, so there is no surprise later:
- We cannot recover your files if you lose your key or recovery codes.
- We cannot produce the plaintext of your files in response to a subject access request, a court order, or any other request. We can confirm what encrypted objects exist and their metadata.
- We cannot help you find or extract specific records from inside your files.
- Export is yours to run — use the platform's export function at any time.
7.6 Your rights, and complaints
Nothing in these Terms reduces your rights under the UK GDPR or the Data Protection Act 2018. Section 8 of the Privacy Policy explains them and how to use them.
You also have a statutory right to complain directly to us about how we handle your data (section 164A, Data Protection Act 2018). Email [email protected] — we acknowledge within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint without coming to us first.
8. Content and intellectual property
8.1 Your Content
You keep all intellectual property rights in your Content. You grant us a limited, non-exclusive, royalty-free licence to host, copy, transmit, encrypt, back up and retrieve your Content solely as necessary to provide the Services to you.
Because your Content reaches us as ciphertext we cannot decrypt, this licence covers operations on encrypted data only. It does not permit us to read, analyse, share or use the substance of your files, and it ends when these Terms end.
8.2 Our intellectual property
All intellectual property in the website, platform, branding, software and documentation belongs to us or our licensors. Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence to use the Services for their intended lawful purpose. It terminates automatically when these Terms do.
8.3 Feedback
If you send us feedback or suggestions about the Services, you grant us a non-exclusive, royalty-free licence to use them to improve the Services, with no obligation to you. This covers the idea, not any personal data or confidential information in your message — we will not publish or attribute your feedback without asking you first.
9. Suspension and termination
9.1 By us, for cause
We may suspend or terminate your Account or a Service where you materially breach these Terms, including acceptable use (Section 6) or payment (Section 5); you create legal, security or operational risk to us or other users; you use the Services fraudulently, abusively or unlawfully; a competent authority orders it; or you become insolvent or unable to pay your debts.
Where lawful and reasonably practicable we give prior notice and an opportunity to fix the problem, unless immediate action is needed to prevent harm, fraud or legal exposure.
9.2 By you
You may stop using the Services at any time — Section 5.9 applies to paid Subscriptions.
You may terminate the affected Service immediately if we materially breach these Terms and fail to fix it within 30 days of your written notice, or if we become insolvent. In that case you are entitled to a pro-rated refund for the unused part of the affected Service.
9.3 What happens to your Content
When a Subscription ends, you have 30 days to export your Content before it is purged. Deleted files sit in trash for 30 days and are then purged.
If you delete your Account, a shorter 14-day grace period applies: after it ends the Account is permanently closed and cannot be recovered, reactivated or accessed by anyone, including us. If you want the longer export window, export your Content before deleting the Account.
Full retention periods are in Section 6 of the Privacy Policy. Some records are kept longer where the law requires it — billing and tax records for 7 years, for example.
9.4 Other effects of termination
Your licence to use the Services ends and you must stop using them. Clauses that by their nature should survive — Sections 6, 7, 8, 10, 11, 12 and 13 — survive termination.
10. Warranties
Each party confirms it has the authority to enter into these Terms and that doing so breaches no other agreement.
We warrant that we will perform the Services with reasonable skill and care, that they will work in accordance with the documentation in all material respects, and that we will comply with applicable law in providing them.
Except as stated in these Terms, and to the maximum extent the law permits, all other warranties and conditions, express or implied, are excluded. We do not warrant that the Services will be uninterrupted, error-free or free from security incidents.
Consumers: nothing here removes your statutory rights under the Consumer Rights Act 2015, including the rights to services performed with reasonable care and skill, and to digital content of satisfactory quality and fit for purpose.
11. Liability
11.1 Cap
Business Users: our aggregate liability arising out of the Services in any 12-month period will not exceed the total fees you paid us for the affected Service in that period. If the Service has run for less than 12 months, the cap is the fees paid in the preceding 3 months, pro-rated to a 12-month equivalent.
Consumers: nothing in this Section limits or excludes any liability that cannot be limited or excluded under the law that applies to you. Your statutory rights under the Consumer Rights Act 2015 are preserved in full.
11.2 Excluded losses
To the maximum extent the law permits, neither party is liable for indirect, incidental, special or consequential loss, or for loss of profits, revenue, business opportunity or goodwill.
Loss of data. Between us and a Business User, liability for loss or corruption of data is excluded, and it is your responsibility to keep independent backups of Content you cannot afford to lose. This exclusion does not apply to Consumers, whose statutory rights are unaffected.
Nothing in this Section excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, breach of confidentiality, infringement of the other party's intellectual property, your payment obligations, or anything else that cannot be excluded by law.
11.3 Force majeure
Neither party is liable for failure or delay caused by events beyond its reasonable control — natural disasters, pandemics, war, terrorism, civil unrest, government action, sanctions, internet, telecommunications or power failures, cyberattacks, supply chain disruption or labour disputes. The affected party will mitigate and keep the other informed. If the event lasts more than 60 days, either party may terminate the affected Service by written notice, without penalty.
12. Indemnity (Business Users only)
If you are a Business User, you will indemnify us against third-party claims arising from your breach of these Terms, your Content — including any claim that it infringes a third party's rights — or your breach of any law applicable to your use of the Services.
We will notify you promptly of the claim, give you control of the defence and settlement (provided you do not settle in a way that admits fault on our part or imposes obligations on us without our consent), and co-operate reasonably at your expense.
This Section does not apply to Consumers.
13. Law, disputes and general
13.1 Governing law and jurisdiction
These Terms are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
If you are a Consumer, you keep the mandatory protections of the law where you live, and you may bring proceedings in the courts of your own part of the United Kingdom.
Where a separate written agreement specifies different governing law or dispute resolution, that agreement prevails.
13.2 Resolving disputes
We will both try in good faith to resolve any dispute informally within 30 days of written notice.
If that does not work, Consumers may also use an alternative dispute resolution body approved by the Chartered Trading Standards Institute, or contact the Citizens Advice consumer service. Using ADR does not affect your right to go to court.
13.3 General
Entire agreement. These Terms, with the Privacy Policy, the DPA where applicable, and any order form, are the whole agreement between us about the Services, and replace earlier agreements and representations. Nothing in this clause limits liability for fraudulent misrepresentation.
Third parties. These Terms create no rights enforceable by anyone who is not a party.
Assignment. You may not assign your rights or obligations without our written consent. We may assign these Terms to a successor in a merger, acquisition or restructuring, on notice to you. Your data protection rights are unaffected — see Section 4 of the Privacy Policy.
Notices. To you: by email to your Account address, by in-product notice, or by post to the address you gave us. To us: [email protected], or by post to Everabyte Limited, Suite 3173, 275 New North Road, London N1 7AA. Notices are deemed received 24 hours after email unless it bounces, immediately on display for in-product notice, and 3 business days after posting.
Severability. If any provision is held invalid or unenforceable, it is severed and the rest stands.
No waiver. A failure or delay in exercising a right is not a waiver of it.
Language. These Terms are in English. Where a translation is provided, the English version prevails.
14. Contact
- General: [email protected]
- Legal: [email protected]
- Security incidents: [email protected]
- Data protection: [email protected]
- Post: Everabyte Limited, Suite 3173, 275 New North Road, London N1 7AA, United Kingdom
To stop marketing emails, use the unsubscribe link in any marketing message or email [email protected]. Opting out does not stop service communications — security alerts, operational notices and policy updates — which are necessary to provide the Services.
Read alongside: Privacy Policy v5.7 · Data Processing Agreement (business customers) · Zero-Knowledge Whitepaper