Terms of Service

1. Who we are and this agreement

allpass is a product name of CHGROUP – FZCO, a free zone company registered in the United Arab Emirates, at Dubai Silicon Oasis, IFZA Business Park, Building A2, Nadd Hessa, PO Box 342001, Dubai, United Arab Emirates. In these terms, “we” and “us” mean CHGROUP – FZCO. These terms form an agreement between that entity and you, or the organization you represent. Contact us at support@bychgroup.com.

By creating an account or using allpass, you accept these terms. If you act for an organization, you confirm that you can bind it. Our Privacy Policy explains personal data handling. A signed order or data processing agreement may add specific terms.

2. Eligibility, organizations and members

You must be at least 18 and able to enter a binding contract. Do not use allpass where law, sanctions or provider restrictions prohibit it. Give accurate account details and keep a working contact email.

An organization has members, projects and a shared prepaid wallet. Member roles include owner, admin, developer and billing. Permissions depend on the action. Owners and admins manage organization access; developers can manage project keys; billing access includes payments. Only invite people you authorize.

You are responsible for your members and for reviewing their access. We may require email verification, review an account, limit access or refuse activation for fraud, abuse or compliance reasons. Payment alone does not guarantee approval or a particular provider.

3. API keys and your agents

A project key can send messages, create resources and spend the organization wallet within its scopes and spending limit. The full key is shown once. Keep keys and resource credentials in a secret store or private environment file. Do not publish them, put them in browser code or share them in chat.

Use separate keys with the smallest scopes and spending limits each app needs. Revoke a leaked key promptly and tell us at support@bychgroup.com. Revocation can take about 30 seconds to reach a cached gateway check. It does not undo accepted requests or charges.

You choose and supervise the apps, coding agents and other tools that use your keys. You are responsible for their authorized actions, recipients, resource creation, deletion and spending. Our agent instructions require your approval before paid actions and require agents to protect secrets. Those instructions do not guarantee that every agent follows them. An agent error does not automatically cancel provider charges.

Do not sell or rent allpass keys, provider credentials or access to our provider accounts. You may use provisioned services in your own applications for your end users, within the applicable provider rules.

4. The service and provider access

allpass gives you one API and prepaid wallet for services supplied through provider accounts held by allpass. We arrange and meter the provider services. You do not receive ownership of our provider accounts or our master keys.

Email and SMS sends pass through our gateway. For direct services such as databases and storage, your app connects to the provider using credentials for its resource. Hosting traffic reaches the hosting provider directly. Setup and control actions use allpass.

The services available today are Amazon SES, Resend, Neon and Vercel. Availability can change. Access depends on provider approval, verification, quotas and our enablement checks. Other integrations, including SMS, are not available unless we say so. A provider appearing in a catalog or agent guide does not mean it is enabled. Check the provider availability response before use.

If checkout describes your payment as a reservation, it reserves future access and becomes usable credit at activation. It does not provision resources or promise an activation date. Reservation credit is refundable on request before use. Any announced activation date is an estimate unless a separate written agreement says otherwise.

Provider availability, regions, prices and limits can change. We may add, restrict or withdraw an integration. We will give reasonable notice where practical and offer a refund of unused purchased credit if we discontinue all service.

5. Provider terms that apply to your use

You must follow the provider terms, service restrictions and acceptable-use policies that apply to each service you use. These include AWS Service Terms and the AWS Acceptable Use Policy for SES, Resend terms, Resend acceptable use, Neon terms, Vercel terms and Vercel acceptable use.

If SMS becomes available, Telnyx terms, its acceptable-use policy, or Plivo terms and acceptable-use policy apply, along with carrier rules. The provider table links the other integrations.

These obligations cover your application, content and end users. They do not give you a license to resell a provider's standalone service. Our agreement with you governs the allpass wallet and our obligations. A provider's restrictions still limit how its service may be used. If requirements conflict, stop the affected use and contact us. We may suspend it while we resolve the conflict. Listing a provider does not replace any partner permission we need.

6. Acceptable use and security testing

Use allpass only for lawful activity and content you have the right to process. Do not use it for fraud, phishing, malware, unlawful harassment, child sexual abuse material, infringement or unauthorized access. Do not evade account controls, provider limits, sender checks, sanctions or a suspension.

Do not interfere with other customers, probe their resources, steal credentials or overwhelm our systems. Security testing is limited to your own application and resources, within provider rules. Get our written permission before testing allpass infrastructure, running load tests against shared systems or attempting denial-of-service tests. Report vulnerabilities privately at support@bychgroup.com.

You must have a lawful basis for personal data you submit and give required notices to your end users. Do not submit regulated or highly sensitive data unless you have confirmed that the service and our written agreements support your requirements.

7. Email and SMS rules

Send only to recipients you are lawfully allowed to contact. Keep proof of consent where required. Do not use bought or scraped lists for unsolicited messages, spoof senders or hide who sent a message. Include required identification and unsubscribe or opt-out instructions. Honor opt-outs and suppression requests before sending again.

Email requires a domain you control and verification through our ownership challenge and the provider's DNS records. Keep your lists current and remove invalid addresses. Our current Resend risk limits are 4% bounces and 0.08% complaints. We may pause a project before it reaches either level because all customers share one Resend team reputation. SES has its own reputation and account controls. Lower provider limits or other signs of abuse may also require a pause.

Where SMS is enabled, it covers US and Canadian destinations and uses your project's assigned numbers. Before sending, complete any required business, sender and campaign checks. US local-number messaging may require A2P 10DLC brand and campaign registration. Toll-free messaging requires verification where applicable. Follow carrier content, consent, quiet-hour and STOP/HELP rules. Do not bypass registration or send from someone else's number. allpass does not provide an emergency messaging service.

We may block a sender, domain, number, project or account to protect recipients and shared provider access. Message acceptance is not a guarantee of delivery. Providers and carriers can filter or reject messages. Accepted work can incur provider charges even if a recipient never receives it.

8. Prepaid credit, prices and taxes

Credit is denominated in US dollars. The minimum top-up is 10 USD. Current checkout accepts up to 1,000 USD per payment. Credit is usable only for allpass services. It is not a bank deposit, earns no interest and cannot be traded or transferred to another customer's account. Refund rights below still apply.

Our current markup on provider usage is 0%. We charge the applicable provider usage price and absorb Stripe processing fees, so a 10 USD top-up adds 10 USD of purchased credit. Provider account free tiers, negotiated credits and plan overhead do not necessarily change the published per-unit price you pay. SMS usage can include carrier fees and multiple message segments.

We place holds before paid work and reserve funds for delayed usage and retaining paused resources. A direct resource can have a monthly allowance held from the wallet. Holds and reserves reduce what you can spend elsewhere; they are not an extra markup. We settle actual usage and release unused holds, including after late provider reports.

If a send's final cost is unavailable, we may charge the maximum estimate provisionally. Later usage results or reconciliation adjust the charge and return any overcharge as wallet credit. Contact us with the request ID if a charge looks wrong.

Automatic card top-ups are not part of current checkout. If offered later, the billing flow must show the amount and trigger and obtain your authorization. Do not rely on an automatic payment to prevent a service stop.

Active credit does not expire. Money left after a project closes is kept as account credit for 12 months. Any expiry is subject to mandatory refund and unclaimed-property law. Promotional credit is separate from purchased credit and has only the conditions disclosed with the offer.

You are responsible for applicable sales tax, VAT or similar tax, excluding tax on our income. Any tax we must collect must be disclosed before payment. The 0% usage markup does not mean a statutory tax exemption.

9. Low balance, pause, retention and deletion

The wallet uses active, low, paused, closing and closed states. Your spendable balance is the available amount after the reserve. It can reach zero while your total balance is positive. New resources can be refused at low balance. At zero spendable credit, the gateway refuses new paid calls.

A direct resource with a funded allowance can keep working while that allowance covers it, even if the wallet is paused. When its allowance is exhausted or renewal fails, its overflow and provider controls apply. A database can be suspended, hosting blocked or storage made read-only. Some provider charges, including storage retention, continue while access is restricted.

The wallet's reserve calculation uses 14 days of estimated retention cost plus a buffer for delayed usage. This is not a guaranteed 14-day grace period. Actual usage and retention costs can use up the reserve sooner. Top up promptly if you want to retain resources.

The wallet enters closing when all direct resources are uncovered and available funds cannot pay one day of retention. We send low-balance and pause notices, then a final closing notice. Deletion for lack of funds starts no earlier than 72 hours after that final notice.

A top-up can restore a paused or closing wallet if sufficient funds arrive before deletion and any dispute is cleared. Restoration also depends on the provider. After deletion, resources and their data may be unrecoverable. A closed wallet does not reopen automatically.

10. Refunds, payment disputes and chargebacks

You may request a refund of unused purchased credit, including an unused reservation, at support@bychgroup.com. Send the account email and payment reference. Do not send card numbers or secret keys. A refused activation receives a full refund of its unused reservation.

We must settle open holds, used services and delayed provider charges before calculating the refundable amount. Promotional credit has no cash refund value. Refunds go to the original payment method through Stripe where possible. We review refund requests within 10 business days; card posting time depends on Stripe and your bank. Statutory cancellation or refund rights take priority.

A disputed or reversed payment may cause us to pause the wallet and remove the disputed amount from available credit while we investigate. We may ask for evidence and work with Stripe and your bank. We do not charge the same usage twice. If you believe a payment was unauthorized, contact us promptly; this does not limit your right to dispute it with your bank.

11. Your content, resources and backups

You keep ownership of your content, code and data. You give us and the providers the permission needed to host, transmit, deliver, secure and delete them to supply the service. You must have the rights needed to grant that permission.

You choose what to upload or send. Keep separate backups and export data before closing or deleting a resource. We do not guarantee backups, recovery or transfer to your own provider account. A provider's backup feature is subject to its own settings, limits and retention rules.

Your deletion request can permanently remove content and credentials without the low-balance notice period. On closure, we arrange deletion of customer resources, subject to provider processing and legal holds. Removing an organization from the dashboard alone does not erase ledger or catalog history. Financial, security and legal records have separate retention periods in the Privacy Policy.

For personal data you process for your end users, we generally act as your processor. See the data processing agreement notice. These terms and the Privacy Policy do not replace a required DPA.

12. Suspension and termination

You may stop using allpass and request closure at support@bychgroup.com. Stop your apps, revoke keys and delete or export resources you no longer need. Running resources can keep incurring costs until they are stopped or deleted. An organization with available or held funds cannot currently be deleted through the organization flow; contact us to settle its balance first.

We may restrict or suspend access for insufficient funds, payment disputes, compromised credentials, abuse, provider requirements or legal obligations. We may act immediately when necessary to prevent harm. Otherwise, we will try to explain the issue and give you a reasonable chance to fix it.

We may terminate an account for serious or repeated breaches or discontinue the service with reasonable notice where practical. Unused purchased credit remains subject to the refund policy and law. Termination does not erase accrued charges, lawful record retention or clauses that must continue, including liability and dispute terms.

13. Beta availability and warranties

allpass is a beta service. Features can change or fail. We provide no contractual uptime commitment or service level agreement (SLA). Internal engineering goals are not a customer SLA. Provider outages, quotas, suspensions and changes can interrupt your apps.

To the extent law permits, the service is provided as available and as is. We disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement. We do not warrant uninterrupted, error-free or fully secure operation, message delivery, data recovery or that a provider will remain available. Mandatory legal warranties and consumer rights remain in force.

14. Limits on liability

To the extent the law permits, neither party is liable for indirect or consequential loss, lost profits, lost revenue or lost business opportunity arising from this agreement.

Our total liability for claims arising from the service is limited to the greater of 100 USD and the amount of purchased credit consumed by your account in the 12 months before the event giving rise to the claim. A refund or return of unused purchased credit is not reduced by this cap.

These limits do not exclude liability for fraud, willful misconduct, death or personal injury caused by negligence, or any liability law does not allow us to limit. They do not restrict mandatory consumer remedies or a data subject's statutory rights. A signed DPA may set additional liability terms.

15. Responsibility for third-party claims

If you use allpass for a business, you will defend us against third-party claims caused by your unlawful content, infringement, unlawful messaging or material breach of the acceptable-use rules. You will pay reasonable damages and costs finally awarded or agreed in a settlement you approve. This obligation does not cover harm caused by our breach, negligence or misconduct.

We must notify you promptly, allow you reasonable control of the defense and give reasonable cooperation at your expense. You cannot settle a claim in a way that admits our fault or binds us to a non-monetary obligation without our written consent. Mandatory law may limit this clause.

16. Changes to these terms

We will post revisions here and update the date. We give at least 30 days' notice by email or an account notice for material changes. Urgent legal or security changes may take effect sooner with an explanation where permitted. Changes do not retroactively change settled usage charges.

Where law permits, continued use after a change takes effect means you accept it. If you disagree, stop using the service and request closure and a refund of unused purchased credit. We will obtain separate consent where law requires it.

17. Governing law and disputes

These terms are governed by the laws of the Dubai International Financial Centre (DIFC), United Arab Emirates. Disputes go to the DIFC Courts in Dubai, unless the consumer protection law of the country where you live gives you the right to bring a claim there. There is no arbitration requirement and no class-action waiver.

Contact support@bychgroup.com with the facts and the outcome you seek so we can try to resolve a dispute. This does not delay an urgent remedy or remove a statutory deadline. Mandatory consumer law and any right to bring a claim in your local courts still apply.

18. Other terms and contact

These terms and any agreed order or DPA form the agreement for allpass. A signed agreement controls its specific subject; a DPA controls personal data processing if terms conflict. Provider restrictions continue to apply to the provider service.

If a clause cannot be enforced, the rest remains effective. A delay in enforcing a right is not a waiver. Neither party becomes the other's partner, employee or agent. Neither party may transfer this agreement without the other's consent, except to a successor in a merger or sale that assumes its obligations, subject to law and notice.

Neither party is responsible for delay caused by events beyond its reasonable control, but this does not cancel accrued payment or refund obligations. No one else gains contractual enforcement rights except where law requires them.

We send service and legal notices to your account email or through the account interface. Keep your email current. Send legal notices and questions to support@bychgroup.com, or by post to CHGROUP – FZCO, Dubai Silicon Oasis, IFZA Business Park, Building A2, Nadd Hessa, PO Box 342001, Dubai, United Arab Emirates.