MyAccount Payments, Billing and Tax Terms

Policy ID: BSG-MA-PAYMENTS
Version: 1.0
Status: Approved for publication
Effective: 14 September 2026

1. Price disclosure

Before payment, MyAccount shows:

• legal merchant name;
• service/order reference;
• scope summary;
• base amount;
• GST/other tax and total;
• milestone amount and remaining balance;
• currency;
• known pass-through/field/third-party charges;
• cancellation/refund link; and
• whether payment activates work or only reserves compliance review.

No hidden mandatory charge may appear after acceptance without a change order.

2. Quotation validity

Quotes expire on the stated date. A quote may be revised before acceptance if scope, location, tax, source cost or risk changes. After acceptance, material changes require a new scope/price acceptance unless already governed by an objective disclosed variable.

3. Payment milestones

The signed service scope controls. A common investigation model is:

• initial milestone: 80% before operational work begins; and
• final milestone: 20% after completion notice and before final report access.

Other services may use full advance, subscription, usage-based or enterprise invoicing only when clearly displayed. The platform must not hard-code 80:20 as a universal legal rule.

4. Authorisation and settlement

A payment “authorised” or “pending” at the gateway is not received until confirmed/settled in Company records. The order state must distinguish initiated, authorised, captured, failed, pending, settled, reversed, refunded, disputed and charged back.

Idempotency prevents duplicate capture. Payment webhooks are signature-verified and reconciled server-to-server.

5. Payment credentials

The Company does not request or store:

• full card number;
• CVV;
• card/ATM PIN;
• UPI PIN;
• banking password;
• OTP/authentication code; or
• full payment instrument credentials.

Users must enter credentials only into the approved payment provider/bank interface. Support will never ask for them.

6. Invoices and tax

Invoices use the verified legal entity name, GSTIN, invoice number/date, supply details, taxable value, tax breakdown and recipient data required by law. Business customers must provide accurate GST/billing data before invoice finalisation. Corrections follow finance/tax controls and do not rewrite audit history.

7. Work-start dependency

Payment alone does not override KYC, authority, consent or lawful-purpose review. The service scope states whether payment is collected before final compliance approval. If the Company rejects a case before substantive work for reasons not caused by customer breach, unearned fees are handled under the Refund Policy.

8. Failed, duplicate and reversed payment

• failed: no service activation; user may retry without duplicate order;
• pending: wait for gateway confirmation; do not ask user to pay repeatedly;
• duplicate: confirmed excess refunded to original method;
• reversal: reflect bank/gateway result and notify user;
• under/overpayment: finance reconciliation and documented adjustment.

9. Final milestone and report access

Where scope uses a final milestone, completion notice explains the amount and report-access window. We may withhold final report access until due payment, but must not withhold mandatory invoices, privacy rights, complaint routes or data-breach notices.

10. Chargebacks and payment disputes

The customer should first raise a billing ticket. A chargeback does not authorise deletion of evidence or retaliatory disclosure. Finance preserves the quote, acceptance, work-start/completion records, delivery/access logs, communication and refund calculation, and responds through the gateway lawfully.

Fraudulent chargeback indicators receive human review. Account restriction must be proportionate and must not block access to statutory grievance/privacy rights.

11. Credits and promotions

Credits are non-cash unless law or offer terms require otherwise. Expiry, transferability and refund treatment must be shown before issue. Promotions must not pressure users into sensitive investigations, create fake scarcity or misrepresent ordinary pricing.

12. Records

Store only minimum transaction, invoice, tax, reconciliation, refund and dispute data for the approved period. Payment data is isolated from investigation content; finance personnel do not automatically access case details.

Bharat Suraksha Grid MyAccount Privacy Notice

Policy ID: BSG-MA-PRIVACY
Version: 1.0
Status: Approved for publication
Effective: 14 September 2026

1. Who controls the data

Gods Eye Security Force Private Limited determines the purposes and means of processing described in this notice. TruBond and Bharat Suraksha Grid are services/brands, not separate data controllers unless a future notice states otherwise.

The authorised support and privacy contact is contact@godseyesecurity.in. Formal grievance requests may be submitted through the authenticated Privacy Centre or this published contact route.

2. Scope

This notice applies to MyAccount registration, service discovery, requests, case intake, documents, consent/KYC, payments, messages, status, reports, support, privacy rights and account security.

It does not govern the public TruBond landing page or employee/internal GESphere processing, each of which has its own notice/policy.

3. Privacy design

• browse before full profile;
• one email or mobile for initial account;
• progressive data collection by service and stage;
• field-level purpose labels;
• no universal Aadhaar/PAN gate;
• no direct MyAccount-to-internal database access;
• customer-safe status only;
• case-level access internally;
• no customer data in advertising analytics; and
• no AI training on customer/case data by default.

4. Information categories

4.1 Account and authentication

• verified email or mobile number;
• account ID and status;
• authentication method, MFA/step-up state;
• login/session history, IP, time, device/browser data;
• security alerts and recovery events; and
• versioned terms/privacy acknowledgments.

4.2 Profile and communication

• display/legal name when needed;
• preferred contact method/language;
• city/state where relevant;
• organisation and representative role for business users; and
• support and notification preferences.

4.3 Service request and case intake

• selected service and stated purpose;
• situation category, urgency and location;
• information about the customer, subject and relevant persons where lawfully supplied;
• scope, exclusions, quotation and status;
• lawful-purpose declarations, consent and authority evidence;
• documents, photographs, recordings or other material accepted for the scope;
• client instructions, corrections and communications; and
• customer-safe outcome/report data.

MyAccount must collect only fields approved in the signed Service Registry. Sensitive free text is deferred until eligibility and notice.

4.4 CDD/KYC and authority

Depending on risk:

• legal name, age/adult status and contact verification;
• government-ID type and limited verification result;
• address verification where necessary;
• liveness or assisted verification only if approved and disclosed;
• corporate CIN/GSTIN/registered office/authorisation records;
• representative and beneficial-owner/control information where justified;
• purpose, source-of-funds/payment mismatch indicators; and
• sanctions/adverse-risk check result if a lawful approved service requires it.

Store verification result and minimum attributes rather than full documents where possible. Aadhaar is voluntary unless a specific law requires it; alternatives must be available.

4.5 Payments and billing

• quotation/order/case reference;
• amount, tax, currency and milestone;
• invoice name, address and GST details where needed;
• gateway transaction/reference, status, time and limited method metadata;
• refund, dispute and chargeback records.

We do not collect/store CVV, PIN, UPI PIN, bank password or OTP. Full card data should not reach Company systems.

4.6 Communications

• in-app messages and attachments;
• support tickets, calls where recorded after notice, and email;
• delivery/read status for operational notices; and
• grievance, refund and rights correspondence.

4.7 Derived and internal risk data

• fraud/security signals;
• KYC consistency flags;
• unlawful-use indicators;
• upload scan result;
• risk tier and review status; and
• access/anomaly alerts.

These are used for safety, security, compliance and service eligibility. High-impact decisions receive human review. Detection rules, third-party identities or details that enable evasion may be withheld where law permits.

5. Sources

Data comes from:

• you or your authorised representative;
• the investigation/verification subject where they participate/consent;
• documents and contacts you lawfully provide;
• public records/sources and authorised verification providers within approved scope;
• payment/communications/security providers;
• assigned field/verification partners; and
• Company systems generating service, security and audit records.

We do not claim access to private bank, telecom, government or communications systems without lawful authority.

6. Purposes and necessity

Purpose	Typical data	Necessity
Account access	contact, authentication, session	required for secure account
Service discovery	account preferences, optional history	minimal; profile not required
Eligibility/lawful-use review	purpose, relationship, location, risk answers	required before sensitive intake
CDD/KYC/authority	identity and authority result	conditional by risk/service
Service delivery	case-specific inputs, documents, communications	only accepted scope
Payment/invoice/refund	transaction and billing data	contract/accounting
Report delivery	recipient identity, authentication, access logs	confidentiality/security
Fraud/security	IP, device/session, events, scan/risk data	platform/data protection
Support/grievance/rights	contact, ticket and relevant record	resolve request
Legal claims/obligations	minimum necessary records	applicable law/legal hold
Product improvement	aggregate/de-identified measures	no case-content analytics by default

7. Grounds and consent

Processing must be mapped to the then-applicable Indian legal ground. Where consent is used, it is specific to listed data and purpose, affirmative and withdrawable. Platform Terms acceptance is not consent for every data use. A privacy notice acknowledgment proves presentation, not agreement to hidden purposes.

Some processing is necessary to provide a requested service, secure the platform, maintain accounts/invoices, respond to a voluntarily initiated request, establish/defend legal claims or comply with law. Legal must approve the ground map and update it when DPDP provisions commence.

8. Case-subject data

Investigation subjects may not be MyAccount users. Their data receives enhanced controls:

• documented lawful purpose and method;
• necessity/proportionality review;
• consent/authority verification where required;
• no collection merely because it is interesting;
• restricted case-level access;
• source/reliability notation;
• no customer-visible raw evidence by default;
• retention/deletion by category; and
• lawful rights/safety response assessed without compromising another person or active lawful investigation.

Client consent does not replace subject consent where the law/method requires it.

9. Sharing and recipients

We may share minimum necessary data with:

• assigned internal case personnel under case-level access;
• approved field/verification partners for a defined task and time;
• hosting, storage, communications, KYC, document-security and support processors;
• payment gateway/bank/tax/accounting providers;
• professional advisers under confidentiality; and
• courts, police, regulators or statutory authorities following validated legal process.

We do not sell personal data. We do not disclose to a spouse, employer, family member or requester merely because they ask. Each disclosure is purpose-limited and logged.

10. GESphere transfer boundary

MyAccount sends an approved intake package through the controlled gateway after eligibility. Files enter quarantine and scanning before evidence storage. Internal case identifiers, notes, source identities and methods are not returned. GESphere publishes only allowlisted customer-safe statuses/reports.

11. AI and automation

AI may support classification, document triage, redaction, summarisation or risk suggestions only through an approved gateway. Controls:

• no direct browser-to-model connection;
• no model-provider training on case data;
• no case data to unapproved public AI;
• minimisation/redaction before model use;
• prompt/output/tool logs in a restricted audit zone;
• human verification before investigative finding or adverse action;
• source-grounding and uncertainty labels; and
• kill switch and incident review.

AI does not autonomously accept/reject a high-risk case, terminate an account, deny a refund, disclose data, identify guilt or publish a report.

12. Cookies and device data

Essential cookies secure authentication and workflow. Optional analytics/preferences require choice as described in the Cookie Notice. Sensitive case pages use no advertising pixels, session replay or third-party social trackers. Authentication tokens are not stored in localStorage.

13. Security

Controls include secure HttpOnly cookies, MFA/step-up, encryption, case-level RBAC+ABAC, private object storage, file quarantine/scanning/CDR, short-lived signed delivery, immutable audit, key rotation, backups, monitoring, vendor controls and incident response. Security measures are reviewed and cannot guarantee absolute prevention of incidents.

14. Retention

Retention is category-specific:

Category	Standard target	Notes
Unsubmitted draft request	30 days	Warn then delete
Rejected enquiry without incident	90 days	Minimal decision/appeal evidence only
KYC raw document	Delete after verification, normally within 30 days	Keep result/limited attributes unless legal hold
Accepted case working data	Case duration + 6 months	Longer category only if justified
Final report	12 months from closure	Access may expire sooner; legal hold overrides
Consent/contract/scope receipts	Contract life + 8 years target	Counsel/tax/limitation review required
Invoice/tax/payment records	8 financial years target	Finance/counsel confirmation
Security/ICT logs	At least 180 days in India; one-year readiness for DPDP target controls	Minimise content; legal hold for incident
Support/grievance/refund	3 years after closure	Longer for active dispute

The final approved enterprise schedule controls. Expired data is deleted or irreversibly anonymised; legal holds are narrow and reviewed.

15. Rights and choices

Subject to applicable law and identity verification, a person may request:

• information/access about their processing;
• correction, completion or updating;
• erasure where no purpose/law requires retention;
• consent withdrawal;
• grievance redressal;
• nomination where legally available; and
• review of significant account/KYC/enforcement decisions.

The Company will not demand more identity data than reasonably needed to verify the requester. Complex subject-data requests may be limited to protect another person, confidential source, legal privilege, safety, investigation integrity or statutory exemption; reasons are documented and communicated where permitted.

16. Children

MyAccount is adult-only. A child may not create an account. Child-related case data requires verified parent/guardian or legal authority, enhanced legal/safety review, no harmful tracking/behavioural monitoring and minimum necessary processing. Suspected child sexual abuse material triggers isolation and lawful handling; staff must not redistribute it.

17. Breach notification

The Company maintains incident and personal-data-breach procedures. Where required, affected individuals and authorities receive clear, timely information about the event, likely consequences, mitigation, safety steps and contact. CERT-In reportable incidents follow the applicable six-hour direction. Target DPDP controls include notice without delay and detailed Board reporting within the prescribed time after awareness when those provisions apply.

18. International processing

The production processor/location register must be verified. No case data is transferred outside approved locations without legal, security and contractual review. Security logs subject to CERT-In location requirements remain in India.

19. Changes

The policy version and effective date are preserved. A new purpose, sensitive category, recipient class, AI use or cross-border location requires prior assessment, updated notice and consent where required. No retroactive expansion occurs through “continued use.”

20. Contact and grievance

Privacy and grievance requests may be submitted through the authenticated Privacy Centre or to contact@godseyesecurity.in. Do not send full identity documents over ordinary email unless a secure route is specifically provided.

MyAccount Refund, Cancellation and Service Credit Policy

Policy ID: BSG-MA-REFUND
Version: 1.0
Status: Approved for publication
Effective: 14 September 2026

1. Scope

This policy applies unless a signed enterprise agreement or service-specific scope gives the customer more favourable rights. Mandatory consumer rights always apply.

2. Key definitions

• Work start: the recorded time the Company activates substantive approved work, not merely account creation, payment, automated intake or preliminary fraud screening.
• Earned fee: reasonable value allocated to completed accepted work.
• Non-recoverable cost: a disclosed third-party, field, travel, gateway or other cost actually incurred and not recoverable by the Company.
• Unearned balance: payment received minus earned fee, permitted non-recoverable cost and already-refunded amount.

3. Request method

Customer submits an authenticated cancellation/refund request with order/case reference, reason and relevant evidence. If account access is unavailable, the published finance route may be used after identity verification. No full payment credential is required.

4. Before work starts

If cancellation is received before work starts, refund the unearned amount less any clearly disclosed, reasonable and actually incurred non-recoverable cost permitted by law. Routine internal overhead should not be invented after the request.

If the Company rejects the case before substantive work and the customer did not materially misrepresent or cause a non-recoverable cost, ordinarily refund the unearned service fee.

5. After work starts

Finance calculates:

refundable amount = amount settled
                  - value of completed accepted work
                  - disclosed actual non-recoverable cost
                  - prior refunds/valid adjustments

The decision shows work stage categories without revealing internal sources or sensitive methods. The Company may offer a partial refund, revised scope or service credit; a credit cannot be forced instead of a legally required monetary refund.

6. Completed services and outcome

No refund is due solely because:

• the finding is inconclusive;
• no adverse information is found;
• the finding differs from the customer’s belief;
• the relationship/business decision changes; or
• a third party refuses cooperation,

provided the Company performed the agreed work with reasonable skill and care. Non-performance, material scope deviation, billing error or deficiency remains reviewable.

7. Customer delay or abandonment

If required documents/consent/payment remain missing, the Company sends reminders and may pause. After the stated inactivity period, the request may close. Earned work and actual costs may be retained; the unearned balance follows this policy. Closure does not permit indefinite retention of unnecessary case data.

8. Unlawful use, false authority or forged material

The Company may immediately stop processing and restrict the account. Refund is still calculated separately and fairly. The Company may retain earned fees/actual costs and pursue direct provable loss or legal remedies. It will not use blanket forfeiture as a punitive substitute for evidence.

9. Company cancellation

If the Company cancels for operational reasons not caused by the customer, refund unearned fees and assess reasonable remedy for a material service failure. If cancellation is required by law, safety or an authority, refund treatment depends on completed work, costs, legal restriction and mandatory rights.

10. Duplicate, failed and unauthorised transactions

• confirmed duplicate: excess refunded to original method;
• failed/not received: no Company refund because funds were not received; assist with reference;
• unauthorised claim: secure account, investigate and coordinate with provider/bank;
• cash/manual payment: refund only through approved verified finance process.

11. Refund destination and time

Approved refunds return to the original method unless law/provider constraints require a verified alternative. Company processing target: initiate within 7–10 working days after approval. Bank/gateway credit time is outside Company control and is communicated as an estimate, not a guarantee.

12. Human review and appeal

Refund denial and material partial-refund decisions require a reviewer independent of the original calculation where practical. Decision record includes policy version, scope, work-start time, completed stages, actual costs, calculation, evidence and approver. Customer receives a reason category and one internal escalation route.

13. Service credits

Credits may remedy delay or minor service issues only when approved. Record amount, reason, expiry, eligible services and tax treatment. Credits cannot be used to avoid a cash refund required by law.

14. Chargeback coordination

Once notified of a chargeback, do not issue a duplicate refund without reconciliation. Preserve relevant contract/service/payment evidence, restrict it to finance/legal reviewers and never include sensitive investigation detail beyond what is necessary for the dispute.

Bharat Suraksha Grid MyAccount Platform Terms and Conditions

Policy ID: BSG-MA-TERMS
Version: 1.0
Status: Approved for publication
Effective: 14 September 2026

1. Contracting entity and platform

These Terms are between the customer/authorised representative (“you”) and Gods Eye Security Force Private Limited (“Company”, “we”, “us”). MyAccount is the customer-facing service marketplace and request centre at myaccount.bharatsurakshagrid.com.

MyAccount may present TruBond, personal investigation, corporate verification, citizen safety, Suraksha QR, vehicle/asset protection, cybersecurity and future approved services. Each service has a separate scope. Seeing a service tile does not mean every user or situation is eligible.

2. Documents forming the agreement

The agreement for a service consists of:

1. these Platform Terms;
2. the Privacy Notice and applicable policies incorporated by reference;
3. the accepted service scope/quotation;
4. case-specific declarations, consents and authority evidence;
5. any accepted NDA/confidentiality conditions; and
6. an enterprise statement of work where applicable.

If they conflict, applicable law controls, followed by the signed enterprise agreement/scope, then these Terms. An illegal request is void and will not be performed even if paid.

3. Eligibility and authority

You must:

• be at least 18 and competent to contract under Indian law;
• use your real identity;
• act for yourself or have verifiable authority to represent an organisation/person;
• provide accurate, complete and current information;
• correct material inaccuracies promptly; and
• satisfy risk-based client due diligence where required.

An organisation account representative warrants that they are authorised to bind the organisation for the accepted service. We may request an authorisation letter, corporate records or confirmation by another authorised person.

4. Account creation

Initial registration collects one verified contact channel and acceptance records. Browsing services does not require full KYC. We may require step-up authentication or additional identity/authority verification before high-risk actions, restricted services, payment changes, report access or export.

You must protect your credentials, OTPs and devices, use only your own authentication factor and promptly report suspected compromise. Do not share an individual account. Approved organisation roles must use named accounts.

5. Platform separation

MyAccount contains customer accounts only. Company employees and internal administrators use separate GESphere identities. A customer cannot access internal tools, internal case IDs, evidence repositories, sources, methods, investigator identities, internal notes or risk signals.

MyAccount does not connect directly to internal databases. Requests cross a controlled intake gateway. Customer-safe status updates return through a separate publisher.

6. Service discovery and requests

You may browse available services without completing a universal profile. When you select a service, MyAccount asks only the fields approved for that service and stage.

Submitting an enquiry creates a request for assessment, not an accepted investigation. We may ask questions, narrow scope, request consent/authority, require KYC/CDD, quote a price, reject the request or refer an urgent safety matter to an appropriate channel.

7. Service scope

Before payment, the scope will state:

• service and purpose;
• included checks/work;
• exclusions and prohibited methods;
• information/consent required;
• price, taxes and milestones;
• estimated timeline and dependencies;
• delivery/report format;
• cancellation/refund basis;
• expiry/re-access rules; and
• special confidentiality or legal conditions.

Only the accepted scope is owed. Additional work requires a change order or new scope acceptance.

8. Lawful purpose and client responsibility

For every investigation/verification request, you must provide the true purpose, intended use, relationship to the matter and evidence of authority/consent where required. You are responsible for lawfully obtaining information you upload and must not instruct us to use illegal sources or methods.

We independently screen the request. Your declaration does not require us to proceed and does not transfer all legal responsibility to you. We may refuse a method or entire request to protect a person, the Company or the public.

9. Prohibited conduct

You must not use MyAccount or any service for:

• stalking, voyeurism, harassment, revenge, intimidation, coercion, blackmail or extortion;
• hacking, interception, spyware, credential/OTP theft, device/account takeover or unlawful tracking;
• impersonation, forged consent/authority, fake documents or misleading identity;
• obtaining restricted bank, telecom, government, health or private-communication data unlawfully;
• discriminatory screening unrelated to a lawful purpose;
• publishing, altering or weaponising reports for defamation, doxxing or public shaming;
• violence, self-harm facilitation or other crime;
• evading sanctions, suspension, KYC or access controls; or
• probing, scraping, disrupting or compromising the platform.

Detailed rules appear in the Acceptable and Lawful Use Policy.

10. Uploaded material

You retain lawful rights in your material. You grant the Company a limited permission to process it only for the accepted service, security, support, compliance, dispute and legal purposes described in the notice.

You represent that the material is genuine to your knowledge, relevant, lawfully held and safe to submit. Do not upload malware, illegal sexual material, child sexual abuse material, stolen credentials or material you are prohibited from sharing.

Uploads enter quarantine, file validation, malware scanning and content-disarm controls. Unsupported or unsafe content may be blocked and preserved only where required for security/legal handling.

11. Payments and taxes

You pay the amount and milestones in the accepted scope. Taxes are added or included as displayed. Payment is processed by an authorised provider; we do not ask for or store CVV, PIN, UPI PIN, OTP or banking password.

Payment does not guarantee case acceptance if a pending compliance condition fails. The Payments Policy explains authorisation, settlement, failed/duplicate payments, invoices and chargebacks.

12. Work start and timelines

The system records when work starts. Timelines are estimates unless expressly guaranteed in the scope. We may pause for missing information, consent, authority, safety, payment, legal restriction or force majeure. We will provide reasonable status information without exposing internal methods or sources.

13. Reports and findings

Reports are confidential decision-support material for the authorised recipient. They are based on the agreed lawful scope and information available. They are not a finding by a court/police/government authority and do not guarantee completeness or outcome.

You must preserve context and limitations. You must not edit a report to mislead, publish it, sell it, use it for threats/harassment/discrimination or present it as an official government certificate. Permitted disclosure to an advocate, court or authority remains subject to law and report classification.

14. Corrections

You may identify a specific factual inaccuracy. We may verify, correct, annotate or issue a supplement. Disagreement with an opinion, inconclusive result or lawful limitation is not automatically an error. Correction does not require deletion of a record needed to preserve evidentiary history; superseded versions are restricted and linked.

15. Cancellation and refunds

Refunds follow the policy shown before payment. Generally, pre-start cancellation returns unearned fees less disclosed, reasonable and actually incurred non-recoverable cost. After work starts, completed work and actual costs may be retained; the unearned balance is reviewed. Result dissatisfaction alone is not a refund basis if agreed work was performed.

Account enforcement and refund calculations are separate. No term removes mandatory consumer rights.

16. Monitoring and platform integrity

We monitor account, transaction, upload and access events proportionately for security, fraud, unlawful-use prevention, consent proof, service quality and legal compliance. Monitoring is described in the Privacy Notice. We do not claim permission to read unrelated device content, activate microphone/camera or conduct hidden surveillance of users.

Automated systems may detect risk and temporarily restrict a transaction. A trained human reviews case rejection, material suspension, refund denial, KYC failure, disclosure and other high-impact decisions, except immediate technical containment.

17. Suspension and termination

We may warn, require re-verification, restrict an action, pause a request, suspend or terminate access where reasonably necessary for security, fraud, illegality, safety, repeated breach, non-payment or legal compliance.

Where safe and lawful, we provide the category of reason, duration/conditions and an appeal route. We may withhold detailed detection logic, source identity or information that would enable evasion or harm another person. Immediate containment is reviewed promptly.

Termination does not erase payment duties, report-use restrictions, confidentiality, evidence/legal holds or provisions intended to survive.

18. Privacy and security

The Privacy Notice explains categories, purposes, recipients, retention, rights and choices. Security includes separate identity zones, secure cookies, encryption, file quarantine, case-level authorisation, audit logs and incident response. No system is completely risk-free; users must follow security notices.

19. Third parties

We may use approved payment, hosting, communications, verification, field and support providers under purpose, confidentiality and security restrictions. A service may depend on third-party response or public/authorised data. We remain responsible as required by applicable law and contract.

20. Intellectual property

The platform, service registry, workflow, reports, templates, brands and original materials are owned by or licensed to the Company. Your paid service grants only the report-use right stated in the scope. No source code, internal method, training data or tool licence is transferred.

21. Confidentiality

Both parties must protect confidential information received for the service. The Company may use minimum necessary information for approved staff/partners and lawful purposes. Confidentiality does not prevent disclosure required by valid law, court/statutory process, incident response or documented immediate safety need.

22. Disclaimers and limitation

Services use reasonable skill and care within the accepted scope. We do not guarantee a particular discovery, relationship decision, recovery, prosecution, court outcome or third-party action.

To the maximum extent law permits, neither party is liable for indirect, special or consequential loss not reasonably foreseeable from the specific breach. Any contractual cap must be stated in the accepted scope and approved by counsel. No cap or exclusion applies where law does not permit it, including fraud, wilful misconduct and other non-excludable liability. Mandatory consumer rights remain unaffected.

23. Indemnity

To the extent permitted by law, you are responsible for direct losses and third-party claims caused by your intentional unlawful use, forged authority, knowing material misrepresentation, malicious upload or prohibited publication/misuse of a report. This is not a blanket transfer of responsibility for the Company’s own breach, negligence or unlawful conduct.

24. Force majeure

Neither party is responsible for delay caused by an event outside reasonable control, provided the affected party takes reasonable mitigation steps and communicates material impact. Payment/refund and statutory rights are assessed for work actually performed.

25. Changes

Editorial/minor changes are logged. Material changes receive advance notice and fresh acceptance before prospective use where required. New privacy purposes require a new notice/choice. Changes do not retroactively authorise data use or alter completed scopes without agreement.

26. Grievance and disputes

Use the MyAccount grievance route first where practical. We will acknowledge and review. This does not restrict police, courts, regulators, consumer commissions or urgent remedies.

Indian law governs. Subject to mandatory statutory forum rights and a signed enterprise agreement, courts at Bengaluru, Karnataka have jurisdiction.

27. Notices and contact

Operational notices may be delivered in-app or to the verified contact channel. Legal notices must use the route published on the Contact and Grievance page. Never send payment credentials or sensitive evidence to a social-media account.

28. Severability and waiver

If a provision is unlawful or unenforceable, it is limited to the minimum extent necessary and the remaining provisions continue. Failure to enforce once is not a continuing waiver. No term waives a non-waivable right.