Terms and conditions

About these terms

These terms are an agreement between Pheme Media Ltd (“we” or “us”) and the business or other organisation that uses Patchd (“you”). The person who starts a trial or a subscription for an organisation agrees to them on its behalf, and confirms they’re allowed to. Everyone invited into the organisation’s account must follow them too.

Patchd is for businesses and other organisations. It isn’t for personal use.

Who we are

Pheme Media Ltd is a company registered in England and Wales, company number 15380848, with its registered office at The Old Church School, Butts Hill, Frome, United Kingdom, BA11 1HR. You can reach us through our contact page.

The service

Patchd reads the files that list dependencies in the repositories you connect, such as lockfiles and Dockerfiles, and checks every package against public sources of advisories and release data. It shows your team what it finds, and can alert them. We keep improving Patchd, so its features change over time. If we take away something significant that you pay for, we’ll tell you before we do.

Accounts

• Patchd is invite-only. Your organisation’s admins decide who joins its account and what each person can do, and are responsible for keeping that up to date.
• Everyone needs their own account, with a passkey or an authenticator app, and must keep their ways of signing in secure. Don’t share accounts.
• Tell us straight away if you think someone has got into your account without permission.

The free trial

• A new organisation can try Patchd free for 7 days. We don’t ask for card details to start a trial, so nothing is charged when it ends.
• To keep using Patchd after the trial, choose a subscription and pay for it. If you don’t, the account stops scanning and nobody can sign in to it, and we delete its data 30 days after the trial ends.
• There’s one free trial for each organisation, and we may turn down or end a trial that’s being misused.

Prices

• Our prices are on our pricing page, and shown in Patchd before you subscribe, unless we’ve agreed others with you in writing. What you pay each month depends on how many repositories Patchd monitors for you.
• Prices are in pounds sterling (GBP) and don’t include VAT, which we add where it applies.
• We’ll tell you at least 30 days before a price changes. The new price applies from your first renewal after that, and you can cancel before then if you don’t want to pay it.

Payments

Subscriptions are paid by card, and the payments are handled by Stripe, our payment provider.

• You enter your card details in Stripe’s secure payment form, which sends them straight to Stripe over an encrypted connection. Stripe is certified to PCI DSS Level 1, the highest level of the card industry’s security standard. We never see or store your full card number.
• Stripe uses your payment details as its privacy policy describes.
• Subscriptions are paid monthly, in advance.
• Your subscription renews automatically. At the end of each month, we charge your card for the next one, at the price that applies then, until you cancel. By subscribing, you authorise us to take these payments through Stripe.
• We email a receipt for every payment.
• If a payment fails, we’ll tell you and try again. If it still hasn’t been paid 14 days after it was due, we may suspend your account until it is.

Cancelling

• You can cancel at any time from your account’s billing settings, or by sending us a message from our contact page.
• Cancelling stops your subscription renewing. You keep using Patchd until the end of the period you’ve paid for, and we don’t charge you again.
• When your access ends, we delete your organisation’s data within 30 days, except anything the law requires us to keep, such as billing records. Ask us before then if you’d like a copy.

Refunds

• Payments aren’t refundable, including for the rest of a month when you cancel, except in the cases below.
• If we charge you by mistake, or more than we should have, we refund the difference.
• If we end your subscription for any reason other than your breaking these terms, we refund the part of the period you’ve paid for that you won’t get.
• Refunds go back to the card you paid with, through Stripe, and usually arrive within 5 to 10 working days.

Questions about a payment

If a charge looks wrong, send us a message from our contact page within 60 days of it, and we’ll look into it. Asking us first is usually quicker than disputing the charge with your bank. While a payment is disputed with a bank, we may suspend your account.

Your data

• Your organisation’s data stays yours. You let us use it only to run Patchd for you.
• Our privacy policy explains how we handle personal data. Where we handle it for your organisation, such as the details of the people you invite, we follow only your organisation’s instructions. If you need a data processing agreement, ask us.
• Our cookie policy explains the cookies Patchd uses.

Connections

• Only connect repositories, and give us tokens for accounts, that you’re allowed to.
• Patchd uses your tokens only to read the files its scans need. Give it tokens that can only read.
• You can remove a connection at any time.

Using Patchd fairly

You mustn’t:

• break the law, or anyone else’s rights, with Patchd
• try to get into accounts, data or systems you aren’t meant to, or test Patchd’s security without our agreement
• overload or disrupt Patchd, or get round its limits
• copy or resell Patchd, or let anyone outside your organisation use it
• use Patchd to build a product that competes with it
• use Patchd anywhere UK sanctions or export laws don’t allow

What findings can and can’t tell you

Patchd’s findings come from public sources, such as advisory databases, package registries and end-of-life dates, which can be incomplete, late or wrong. Patchd helps you find problems sooner, but it can’t promise to find every one, or that your software is secure. You’re responsible for your software, and for what you decide to do about each finding.

Keeping Patchd running

We work to keep Patchd available and scanning, but we can’t promise it will always be available or free of errors. Sometimes we pause it for maintenance, and we try to do that when it causes the least disruption.

Suspending or ending your account

• We may suspend or end your account if you seriously or repeatedly break these terms or don’t pay, or if we have to in order to protect Patchd or our other customers, or to comply with the law. Where we can, we’ll warn you first and give you the chance to put things right.
• If we stop offering Patchd altogether, we’ll give you at least 30 days’ notice and refund the part of your subscription you won’t get.

Our responsibility to you

• Nothing in these terms limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else the law doesn’t allow us to limit.
• Otherwise, we aren’t liable for indirect losses, or for lost profits, revenue, business or goodwill.
• Our total liability to you in any 12 months is limited to what you paid us for Patchd in those 12 months.

Intellectual property

Patchd, its software and its content belong to us or to the people we license them from. While your subscription lasts, you can use Patchd as these terms allow. If you send us ideas or feedback, we may use them freely.

Changes to these terms

We may update these terms. If a change matters, we’ll tell your organisation’s admins at least 30 days before it takes effect, and you can cancel before then. If you carry on using Patchd after that, you accept the new terms.

The law that applies

These terms are governed by the law of England and Wales, and its courts can settle any dispute about them.

Contact us

Send us a message from our contact page, or write to Pheme Media Ltd at The Old Church School, Butts Hill, Frome, United Kingdom, BA11 1HR.