Skip to content

Dwg. BX-03 Rev. August 2026

Terms of Service

The agreement between you and Kypos Ltd for the Boxana platform — the shop we build, the admin you run it from, and the services underneath.

The short version

Boxana designs, builds, hosts and maintains an online shop for your business, and gives you an admin to run it. You own your brand, your content and your records; we own the platform they run on. You are the merchant of record for what you sell, and you keep your own customer-facing terms.

These terms apply to every shop on the platform. Anything specific to your business — price, scope, launch date, whether we handle fulfilment — is agreed separately in writing.

1. Who you are contracting with

boxana.io and the Boxana platform are operated by Kypos Ltd, a company registered in Cyprus, trading as Boxana.

  • Registered name: Kypos Ltd
  • Registration number: HE 488430
  • VAT number: CY60336259M
  • Registered address: Voreiou Ipeirou 2, Oasis Park, Flat/Office Q2, 8035 Paphos, Cyprus
  • Email: boxana+contact@kypos.cy

When these terms say “we” or “us”, they mean Kypos Ltd. “You” means the business that holds the account, and everyone it lets into the admin.

2. Who these terms are for

These terms apply to:

  • merchants — the businesses whose shops we build, host and maintain;
  • staff users — anyone a merchant gives an admin login to;
  • visitors to boxana.io, for sections 11 and 12.

They are not the terms a shopper buys under.If you bought something from a shop that runs on Boxana, your contract is with that shop, not with us, and that shop's own terms of sale govern the purchase, the delivery and the return. We supply the software and the hosting behind it.

These are business-to-business terms. They are not consumer terms, and nothing in them restricts the statutory rights a shopper has against a shop.

3. What we provide

Unless we agree otherwise in writing, the service is:

  1. A shop designed and built for you — the storefront, product pages, search, cart and checkout, on your own domain.
  2. The admin you run it from — products, prices, stock, photos, orders, refunds, staff logins and reports, at https://shop-admin.boxana.io.
  3. The platform underneath — payments, accounts, delivery rules, transactional email, file storage and languages, kept as one maintained set of parts shared across every shop.
  4. Hosting and upkeep after launch — we host the shop, apply updates and security patches, and fix faults.
  5. Storage and fulfilment, if and only if that is separately agreed. It is optional and priced separately.

The platform is shared. We improve it continuously, and changes reach every shop. We will not remove a feature you depend on without reasonable notice and a workable replacement.

4. Your account and your staff

Keep credentials to yourself. You are responsible for what is done under the logins you issue, so remove staff who leave, and tell us at boxana+contact@kypos.cy the moment you think an account has been compromised.

Accounts are for named people. Do not share one login between several people — the audit trail is what protects you in a dispute.

We may suspend an account, or a whole shop, if it is being used fraudulently, if it breaks section 6 or 10, or if leaving it live would put the platform or other shops at risk. Where we can, we tell you first and give you a chance to fix it; where the risk is immediate, we act first and explain straight after.

5. Fees

Build fees, the monthly platform fee and any fulfilment charges are set out in the quote or order form we agree with you. Prices exclude VAT unless stated otherwise.

Invoices are payable within the period stated on them. If an invoice goes unpaid, we will chase it before we do anything else — we will not take a live shop offline without written notice and a reasonable opportunity to pay.

Third-party costs are yours: payment-processing fees charged by Stripe, courier charges, domain registration and any service you connect yourself.

6. What you are responsible for

You run the business. That means you are responsible for:

  • What you sell — that it is lawful, accurately described, safe, and yours to sell.
  • Your customer-facing legal pages — your own terms of sale, privacy policy, cookie policy, shipping and returns terms. We provide a place to publish them and a sensible starting point; the content is yours and must match how you actually operate.
  • Consumer law compliance — the right of withdrawal, the legal guarantee, delivery deadlines, price display and VAT in every market you sell to.
  • Your own payment account — you hold the Stripe account, you are the merchant of record, and refunds and chargebacks are settled from it.
  • The content you upload — images, copy, trade marks and product data, and the right to use them.
  • Your data protection duties— you are the controller for your shoppers' data, and section 7 sets out what we do with it as your processor.

7. Data protection

For personal data your shop collects about its shoppers, you are the controller and we are the processor. This section is the written contract required by Article 28 of the GDPR, and it applies for as long as we hold that data.

We will:

  • process shopper personal data only on your documented instructions, and to run the service;
  • keep it confidential, and bind the people who can reach it to confidentiality;
  • apply appropriate technical and organisational measures — encryption in transit, hashed credentials, least-privilege access, per-shop isolation and encrypted backups;
  • use only the sub-processors listed in our Privacy Policy, give you notice before adding one, and stay responsible for what they do;
  • help you answer shopper rights requests, meet your breach-notification duty, and complete a data protection impact assessment where one is needed;
  • tell you without undue delay if we become aware of a personal data breach affecting your shop;
  • make available the information you need to demonstrate compliance, and allow an audit on reasonable notice;
  • transfer data outside the EEA only under the safeguards described in the Privacy Policy.

We do not use shopper data for our own purposes, do not sell it, and do not use it to train machine-learning models.

When this agreement ends, you may export your data (see section 13). After the export window we delete it, except where the law requires us to keep it.

8. Who owns what

You own your side. Your brand, your name, your logo, your product photography, your copy, your customer records and your order history stay yours. The visual design we draw for your shop is yours to use for your business, for as long as this agreement lasts and afterwards.

We own the platform. The Boxana software, the shared components, the admin, and everything we build to serve more than one shop stays ours, including anything we build while working for you that is not specific to your brand. You get a non-exclusive, non-transferable licence to use it for your own business while this agreement is in force.

You give us permission to host, copy, adapt and display your content only so far as we need to in order to run your shop, back it up and support it.

We may name you and show your shop as an example of our work. Tell us at boxana+contact@kypos.cy if you would rather we did not, and we will stop.

9. Availability and support

We aim to keep every shop available and fast, and we monitor for failures. We do not promise uninterrupted service: planned maintenance, a supplier outage, or something outside our reasonable control can interrupt it. Where maintenance is planned and disruptive, we give notice and schedule it outside peak trading hours where we can.

Faults are reported to boxana+contact@kypos.cy. We triage by impact — a shop that cannot take orders comes first. Where we have agreed specific response or uptime targets with you in writing, those apply.

10. Acceptable use

Do not use the platform to:

  • sell anything unlawful, counterfeit, or restricted where you sell it;
  • break someone else's intellectual property, privacy or publicity rights;
  • send unsolicited bulk email, or mislead shoppers about price, stock or delivery;
  • probe, scrape, overload or interfere with the platform, another shop, or anyone's use of it;
  • reverse-engineer, resell or sublicense the platform itself, or copy it to build a competing service.

11. Third-party services

The platform relies on suppliers — Stripe for payments, Google and Vercel for hosting, email and courier providers. Their own terms apply to their own services, and an outage on their side can affect yours. We choose them carefully and hold contracts with them, but we do not control them.

12. Our responsibility to you

If we fail to meet these terms, we are responsible for loss that is a foreseeable result of our breach. Loss is foreseeable if it is obvious that it will happen, or if we both knew it might when we agreed.

We do not limit our responsibility in any way where the law does not allow us to. That includes death or personal injury caused by our negligence, and fraud.

Otherwise, our total liability to you in any twelve-month period is limited to the fees you paid us in that period, and we are not responsible for lost profit, lost revenue, lost data where you could have exported it, or loss of goodwill.

You are responsible to us for claims that arise from what you sell, what you upload, or how you handle your own customers — because those are decisions we do not make.

13. Ending the agreement

Either of us can end this agreement by giving the notice period agreed in your order form, or one month if none was agreed. Either of us can end it immediately if the other commits a serious breach and does not fix it within 30 days of being asked in writing.

For 30 days after the end, you can export your products, orders, customers and invoices in a machine-readable format, and we will help you move a domain you own. After that window we delete your data, except what the law requires us to keep.

Fees already invoiced remain payable. We do not hold your data hostage over a payment dispute.

14. Changes to these terms

We may change these terms — for example to reflect a change in the law, in our suppliers, or in how the platform works. For anything material we give you at least 30 days' notice by email. If you do not accept a material change, you may end the agreement before it takes effect and section 13 applies.

Changes are never applied backwards.

15. General

Neither of us is liable for a failure caused by something outside our reasonable control, for as long as it lasts. If any part of these terms turns out to be unenforceable, the rest stays in force. Not enforcing a right straight away does not waive it. You may not transfer this agreement without our written consent; we may transfer it to a company that takes over our business, on notice to you. Nobody other than you and us can enforce these terms.

16. Which law applies

These terms are governed by the law of Cyprus, and disputes can be brought before the Cyprus courts.

This is a business agreement. Where a shopper has a complaint about a shop on our platform, it goes to that shop, and — in Cyprus — to the Consumer Protection Service of the Ministry of Energy, Commerce and Industry at www.consumer.gov.cy.

17. Contact

  • Service and support: boxana+contact@kypos.cy
  • Legal notices: boxana+legal@kypos.cy
  • Privacy: boxana+privacy@kypos.cy, and our Privacy Policy
  • Post: Kypos Ltd, Voreiou Ipeirou 2, Oasis Park, Flat/Office Q2, 8035 Paphos, Cyprus