TERMS OF SERVICE

(A) Prudentbit has developed and owns ImmuneFiles, a platform for the secure storage, encryption, sharing and tracking of files and documents by organisations.

(B) The Customer wishes to use the ImmuneFiles platform for its internal business purposes, and the Company has agreed to make it available on the terms and subject to the conditions set out in these Terms.

(C) These Terms set out the rights and obligations of the Parties in relation to the Services, and are binding on the Customer from the time it accepts them in accordance with Clause 2.

1.1 Definitions. In these Terms, unless the context otherwise requires, the following capitalised words and expressions shall have the meanings set out below:

• “Administrator” means an Authorised User designated by the Customer to manage its Tenant;
• “AI Features” means any feature of the Services that uses machine learning or artificial intelligence, including the detection and masking of personal and health information in files;
• “Applicable Law” means all laws, statutes, ordinances, regulations, rules, notifications, directions, guidelines, judgments and orders of any court, tribunal or Governmental Authority, in each case as amended from time to time, that apply to a Party or to the subject matter of these Terms;
• “Applications” means the Desktop App, the ImmuneFiles mobile applications for iOS and Android, and the ImmuneFiles browser extensions and add-ins (including those for Gmail, Outlook and Microsoft Teams), together with all updates thereto;
• “Authorised User” means an employee, consultant, contractor or agent of the Customer, being not less than 18 (eighteen) years of age, whom the Customer permits to access and use the Services through its Tenant;
• “Business Day” means a day, other than a Saturday, Sunday or public holiday, on which banks are open for general business in Noida;
• “Company” means Prudentbit with its registered office at Ground Floor, B-1/28, Sector 18, Noida, Uttar Pradesh 201301, which expression shall, unless repugnant to the context or meaning thereof, be deemed to include its successors and permitted assigns;
• “Customer” means the organisation that accepts these Terms in accordance with Clause 2, which expression shall, unless repugnant to the context or meaning thereof, be deemed to include its successors and permitted assigns;
• “Customer Data” means all files, documents, messages and other content, and the contents thereof, that the Customer or its Authorised Users upload to, create in, sync with or process through the Services, including content obtained from Third-Party Platforms or Customer Storage at the Customer’s direction, but excluding Service Data;
• “Customer-Hosted Software” means any ImmuneFiles server software that the Company licenses the Customer to install and operate in the Customer’s own data centre or private cloud;
• “Customer Storage” means storage controlled by the Customer that it connects to the Services for the purpose of holding Customer Data, including Amazon S3, Azure Blob Storage, network-attached storage (NAS) devices and other compatible storage;
• “Data Protection Laws” means all Applicable Laws relating to the protection of personal data, including the IT Act and the rules framed thereunder, the DPDP Act and the rules framed thereunder, the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK General Data Protection Regulation, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and the Saudi Personal Data Protection Law, in each case to the extent applicable;
• “Desktop App” means the ImmuneFiles software application for the Microsoft Windows operating system;
• “Documentation” means the user guides, help materials and security documentation made available by the Company in respect of the Services, as updated from time to time;
• “DPA” means the Data Processing Addendum set out in Schedule 1;
• “DPDP Act” means the Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules, 2025;
• “Encryption Credentials” means passwords, passphrases, encryption keys, recovery codes and other secrets used to encrypt, decrypt or access Customer Data or shared links;
• “Fees” means the fees payable by the Customer for the Services, as set out in the Order Form;
• “Force Majeure Event” has the meaning given to it in Clause 22.1;
• “Governmental Authority” means any government, statutory, regulatory, judicial or quasi-judicial authority, agency, court or tribunal, including the Indian Computer Emergency Response Team (“CERT-In”) and the Data Protection Board of India;
• “Intellectual Property Rights” means patents, copyrights, trademarks, service marks, trade names, designs, database rights, rights in software, know-how, trade secrets and all other intellectual property rights, whether registered or unregistered, anywhere in the world;
• “IT Act” means the Information Technology Act, 2000;
• “IT Rules” means the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• “Losses” means all losses, liabilities, damages, fines, penalties, costs and expenses, including reasonable legal fees;
• “Master Agreement” means a master services or subscription agreement executed by both Parties in respect of the Services;
• “Order Form” means an ordering document or quotation executed or accepted by the Customer (or issued by a Partner and accepted by the Company) that specifies the plan, add-ons, Fees, Subscription Term, hosting region, deployment option and usage limits;
• “Partner” means a reseller or other channel partner authorised by the Company to sell the Services;
• “Party” means the Company or the Customer, and “Parties” means both of them;
• “Privacy Policy” means the Company’s privacy policy published at www.immunefiles.com/privacy , as amended from time to time;
• “Recipient” means any person, other than an Authorised User, with whom Customer Data is shared through the Services, or who uploads files to the Customer through a file-request link;
• “Service Data” means technical and operational data generated by the operation of the Services, including account and configuration settings, file names, sizes and other metadata, access and audit logs, device and usage information, telemetry, crash reports and performance data, but excluding the contents of files;
• “Services” means the ImmuneFiles platform, including the website at www.immunefiles.com, the web application, the Applications, integrations, application programming interfaces, Customer-Hosted Software and related support, as described in the Documentation;
• “Subscription Term” means the monthly or annual subscription period set out in the Order Form, together with each renewal thereof;
• “Tenant” means the separate, logically isolated organisational account through which the Customer and its Authorised Users access the Services; and
• “Third-Party Platform” means any service not provided by the Company that the Customer connects to the Services, including Gmail, Google Drive, Microsoft Outlook, Microsoft Teams, WhatsApp and Zoho WorkDrive.

1.2 Interpretation. In these Terms, unless the context otherwise requires:

2.1 Acceptance. These Terms shall become binding on the Customer on the earliest of the Customer: (a) executing an Order Form that refers to these Terms; (b) clicking “I agree” or a similar button; (c) creating a Tenant; (d) installing or using any Application; or (e) otherwise accessing or using the Services. If the Customer does not agree to these Terms, it shall not access or use the Services.

2.2 Authority. The individual who accepts these Terms on behalf of the Customer represents and warrants that he or she is duly authorised to bind the Customer.

2.3 Electronic record. These Terms constitute an electronic record within the meaning of the IT Act and the rules framed thereunder, and do not require any physical or digital signature. These Terms are published in accordance with Rule 3(1) of the IT Rules.

2.4 Documents comprising these Terms. These Terms comprise the clauses set out herein, the Schedules, each Order Form and, to the extent expressly referred to herein, the Documentation.

2.5 Order of precedence. In the event of any conflict or inconsistency, the following order of precedence shall apply: (a) a Master Agreement; (b) the Order Form; (c) the DPA, in so far as it relates to personal data; (d) the clauses of these Terms; and (e) the Documentation.

2.6 Privacy Policy. The Privacy Policy is a notice to individuals describing how the Company handles personal data. It does not form part of these Terms and does not create any contractual obligation between the Parties.

2.7 Documentation. The Documentation describes the functioning of the Services. It does not create any warranty, representation or commitment beyond those expressly set out in these Terms.

2.8 Exclusion of other terms. No terms contained in any purchase order, vendor registration, procurement portal or similar document of the Customer shall apply, even if accepted or clicked through by the Company, unless executed by an authorised signatory of the Company and expressly stated to amend these Terms.

3.1 Business use only. The Services are offered solely to companies, firms, government bodies and other organisations, for business purposes, and are not offered to consumers. Individuals may use the Services only as Authorised Users or Recipients of a Customer. The Customer confirms that it acquires the Services for business purposes.

3.2 Age. Every Authorised User and Recipient shall be not less than 18 (eighteen) years of age. The Customer shall not create accounts for, share Customer Data with, or enable any monitoring feature in respect of, any person below that age.

3.3 Tenants. Each Customer shall be provided with its own Tenant. Customer Data and Service Data of each Tenant shall be logically separated from those of other Tenants.

3.4 Administrators. The Customer’s Administrators shall control its Tenant and may, among other things, add and remove Authorised Users, set security and sharing policies, connect Customer Storage and Third-Party Platforms, and access, transfer, export, retain or delete Customer Data of any Authorised User within the Tenant. The Company shall be entitled to act on the instructions of any Administrator and shall not be responsible for the decisions of any Administrator. The Customer shall inform its Authorised Users of these powers.

3.5 Sign-in. Authorised Users shall sign in using an email address and password. Multi-factor authentication is available and shall be enabled for all Administrators. Passwords are stored only in hashed form. The Company may introduce additional sign-in methods, which may be subject to further terms.

3.6 Accurate information. The Customer shall provide accurate, current and complete registration information and shall keep the same updated.

3.7 Credentials. The Customer shall be responsible for all activity under its Tenant and for maintaining the confidentiality of all credentials. Authorised Users shall not share accounts.

3.8 Notification of compromise. The Customer shall notify the Company promptly at securityoperations@prudentbit.com of any actual or suspected unauthorised access to its Tenant, or the loss of any device on which an Application is installed.

3.9 Verification. The Company may decline to create a Tenant, or may require verification of identity or business details, where reasonably necessary to prevent fraud or misuse or to comply with Applicable Law.

4.1 Right to use. Subject to these Terms and payment of the Fees, the Company grants to the Customer a non-exclusive, non-transferable and non-sublicensable right, during the Subscription Term, to access and use the Services for its internal business purposes, within the limits set out in the Order Form.

4.2 Features. The Services may include file encryption, secure storage, access-level sharing, password protection, link expiry, limits on the number of times a file may be viewed, forward and download prevention, dynamic watermarking, screenshot deterrence in the web viewer, proctored viewing, geo-fencing, acceptance of non-disclosure agreements before viewing, file-request links, real-time audit logs, and AI-assisted detection and masking of personal and health information. Features vary by plan and deployment option.

4.3 Integrations. The Services can send secure links through Gmail, Outlook, Microsoft Teams and WhatsApp, and can pull files selected by the Customer from Google Drive, Outlook and Zoho WorkDrive into the Services. When sending links through Gmail, Outlook, Microsoft Teams or WhatsApp, the Company transmits the protected link only and does not read the Customer’s messages, mailbox or contacts. Clause 7.9 shall apply to all integrations.

4.4 Nature of security controls. The Customer acknowledges that the security controls forming part of the Services are designed to reduce, and cannot eliminate, the risk of unauthorised access, copying and distribution. Without limiting the foregoing:

The Customer shall be solely responsible for selecting controls appropriate to the sensitivity of its data and for its own compliance decisions.

4.5 Not a backup service. The Services are not designed to serve as the Customer’s sole backup or archive. The Customer shall maintain independent backup copies of all Customer Data that it cannot afford to lose.

4.6 AI Features. AI Features run on artificial intelligence models operated by the Company on its servers in the Customer’s hosting region. Where the Customer uses Customer Storage or Customer-Hosted Software and enables AI Features, the relevant files shall be transmitted to the Company’s servers for processing and shall not be retained after processing. The Company does not transmit Customer Data to any third-party artificial intelligence provider and does not use Customer Data to train its models. Outputs of AI Features may be inaccurate or incomplete, do not constitute legal, medical, financial or other professional advice, and shall be reviewed by the Customer before any reliance is placed on them.

4.7 Non-disclosure agreements and click-through acceptance. Non-disclosure agreement templates and acceptance flows are provided as a convenience only. The Company is not a party to any agreement between the Customer and any Recipient and makes no representation that any template is suitable, sufficient or enforceable for any purpose or in any jurisdiction. Records of acceptance are electronic records of a Recipient’s action and may not constitute an electronic signature under Section 3A of the IT Act or any equivalent law. The Customer shall obtain its own legal advice in this regard.

4.8 Availability. The Company targets availability of the cloud-hosted Services of 99.5% (ninety-nine point five per cent) in each calendar month, excluding: (a) scheduled maintenance, updates and deployments; (b) emergency maintenance; (c) unavailability of Customer Storage, Third-Party Platforms or the Customer’s own systems; and (d) Force Majeure Events. Such availability is a target only, and failure to meet it shall not entitle the Customer to any service credit, refund or other remedy unless expressly provided in a Master Agreement or Order Form.

4.9 Support. The Company shall provide support through email and phone support from Monday to Friday, 10:00 to 18:00 IST.

4.10 Modifications. The Company may improve or modify the Services from time to time, if it shall not materially reduce the core security functionality of a paid subscription during the then-current Subscription Term, and shall give not less than 30 (thirty) days’ notice before discontinuing any material feature.

4.11 Beta features. Features designated as beta, preview or early access are provided on an “as is” basis, may be withdrawn at any time, and are excluded from all warranties, indemnities and availability targets.

4.12 Free pilots. The Company may, at its discretion, provide a free pilot or proof of concept for an agreed period. A pilot is provided on an “as is” basis, may be terminated by either Party at any time, and is excluded from all warranties, indemnities and availability targets. Customer Data in a pilot Tenant shall be deleted 30 (thirty) days after the pilot ends, unless the Customer purchases a subscription.

5.1 Deployment options. As set out in the Order Form, the Services may be deployed as:

5.2 Hosting region. For ImmuneFiles Cloud and all Services hosted by the Company, the Customer’s Tenant shall be hosted in the region specified in the Order Form. For Customers in India, the Company uses data centres located in India and operated by its hosting providers, presently Amazon Web Services and NeevCloud. For Customers in the United Arab Emirates and other regions, the Company shall host the Tenant in, and store Customer Data only in, that region. The Company’s personnel, who are located in India and the United Arab Emirates, may access a Tenant remotely from outside its region only where required to provide support, maintain security or comply with Applicable Law, in accordance with the DPA.

5.3 Data held where Customer Storage is used. Where the Customer uses Customer Storage, file contents shall be stored in the Customer Storage and not on the Company’s servers, and Authorised Users and Recipients shall receive files directly from the Customer Storage. The Company shall hold only Service Data (including file names, folder structure, permissions, sharing settings and audit logs) and the information required to connect to the Customer Storage. The sole exceptions are where the Customer uses AI Features, or pulls files from a Third-Party Platform into its Customer Storage, in which case the relevant files shall pass through the Company’s servers for processing and shall not be stored thereon.

5.4 Customer Storage responsibilities. Where the Customer uses Customer Storage, the Customer shall be solely responsible for:

If the Customer revokes or alters the Company’s access, the affected features shall cease to function. The Company shall not be liable for any outage, loss, corruption, deletion of or unauthorised access to Customer Storage, save to the extent directly caused by the Company’s breach of these Terms.

5.5 Licence of Customer-Hosted Software. Where the Order Form includes Customer-Hosted Software, the Company grants to the Customer a non-exclusive, non-transferable and non-sublicensable licence, during the Subscription Term, to install and operate the Customer-Hosted Software in object code form on infrastructure controlled by the Customer, up to the number of instances, users and environments set out in the Order Form, solely for the Customer’s internal business purposes. The Customer may make a reasonable number of copies for backup and disaster recovery. The Customer-Hosted Software is licensed and not sold.

5.6 Customer-hosted environment. In respect of Customer-Hosted Software, the Customer shall be solely responsible for the security, availability, capacity, patching, monitoring and backup of the environment in which it operates, and shall install each security update released by the Company within 05 (five) days of its release. The Company shall have no access to such environment except through remote support sessions permitted by the Customer.

5.7 Licence verification. Upon the Company’s written request, not more than once in any calendar year, the Customer shall certify in writing its use of the Customer-Hosted Software and the Desktop App against its entitlement under the Order Form. If such certification is not provided, or the Company has reasonable grounds to doubt it, the Company may verify such use upon 30 (thirty) days’ written notice, during business hours, without unreasonable disruption to the Customer and subject to the Customer’s reasonable security policies. The Customer shall promptly pay for any use in excess of its entitlement at the Company’s then-current rates.

5.8 Expiry of licence. Upon expiry or termination of the licence of the Customer-Hosted Software, the Customer shall cease all use thereof, uninstall and destroy all copies, and, upon request, certify the same in writing. Customer Data held within the Customer’s environment shall remain with the Customer.

6.1 Desktop App. The Desktop App is available for Microsoft Windows 10 and 11 and is included in prime plane. If the Customer moves to a plan that does not include the Desktop App, its right to use the Desktop App shall cease on the effective date of such change.

6.2 Licence. Subject to these Terms, the Company grants to the Customer a non-exclusive, non-transferable, non-sublicensable and revocable licence, during the Subscription Term, to install and use the Applications on devices owned or controlled by the Customer or its Authorised Users, up to the number of users or devices set out in the Order Form, solely for the purpose of accessing the Services. The Applications are licensed and not sold.

6.3 Updates. Applications may download and install updates automatically, including security updates, and certain updates may be required for continued use. The Company may discontinue support for older versions of any Application, or for older operating system versions, upon reasonable notice. The Customer shall install required updates promptly.

6.4 Device permissions. Applications may request such permissions as are required for their features. The Desktop App accesses only the folders and files selected by the user. The mobile applications may request access to the camera (for proctored viewing), location (for geo-fencing), files and photos (for selecting files to upload) and notifications. Declining a permission may limit the availability of features. The Customer shall ensure that installation complies with its own information technology policies.

6.5 Local data and device security. Applications may store copies of Customer Data, cached files, metadata and logs on the device for offline access and performance. The Desktop App encrypts the files that it stores locally and removes its local cache upon being uninstalled. The Customer shall be responsible for the physical and logical security of its devices, including operating system updates, disk encryption, anti-malware protection and user access controls. The Company shall not be liable for any loss, theft, compromise of or unauthorised access to Customer Data stored on a device, or for data lost by reason of a device failing or being wiped, reformatted or infected with malware, save to the extent directly caused by the Company’s breach of these Terms.

6.6 Remote revocation. Administrators, and the Company where required for security or upon termination, may revoke a device’s access and instruct an Application to remove locally cached Customer Data when the device next connects. Remote removal depends on the device connecting to the internet and may not be effective on a device that remains offline, has been tampered with or has been reset.

6.7 Restrictions. The Customer shall not, and shall ensure that its Authorised Users do not: (a) copy, modify, distribute, rent or lend any Application; (b) disable, bypass or tamper with any security, licensing, update or content-protection mechanism therein; or (c) use any Application after its licence has ended.

6.8 Third-party components. The Applications and the Customer-Hosted Software may include open-source or third-party components, which are licensed under their respective term. Nothing in these Terms shall limit any right granted under such licences.

6.9 Application stores. Where an Application is obtained through the Apple App Store, Google Play or any other application store, the terms of such store shall also apply. The store operator is not a party to these Terms and has no obligation to provide maintenance, support or warranty in respect of the Application.

6.10 Apple. In respect of any Application downloaded from the Apple App Store:

6.11 Interaction with other software. Applications operate alongside operating systems, security products and other software that the Company does not control. The Company shall not be responsible for conflicts with such software or for operating system changes that affect any feature. The Customer shall test the Applications in its environment before deploying them at scale.

6.12 Upon termination. Upon expiry or termination of the Customer’s subscription or entitlement, the Applications shall cease to sync and the Customer shall uninstall them from all devices. Encrypted data stored locally may become inaccessible.

7.1 Ownership. As between the Parties, the Customer retains all right, title and interest in and to the Customer Data, and the Company acquires no ownership rights therein.

7.2 Licence to the Company. The Customer grants to the Company a limited, non-exclusive, worldwide and royalty-free licence to host, store, transmit, process, analyse, display and reproduce Customer Data solely for the purposes of: (a) providing, securing and supporting the Services for the Customer, including applying the watermarks, masking, non-disclosure agreements and other controls configured by the Customer; (b) preventing or addressing technical, security or fraud issues; and (c) complying with Applicable Law. This licence shall terminate upon deletion of the Customer Data in accordance with Clause 19.4.

7.3 No other use. The Company shall not sell Customer Data, use it for advertising or use it to train artificial intelligence models. AI Features process Customer Data solely to deliver results to the Customer.

7.4 Personal data. To the extent that Customer Data contains personal data, the Customer shall be the data fiduciary (or controller) and the Company shall act as its data processor (or processor), and the DPA shall apply.

7.5 Customer responsibilities. The Customer shall be solely responsible for the accuracy, quality, content and legality of the Customer Data and for the manner in which it is shared. The Customer represents and warrants that it has obtained all rights, licences, consents and notices required to upload Customer Data and to share it with Recipients, and that it complies with all sector-specific regulations applicable to it.

7.6 Regulated data. Unless a separate written agreement executed by the Company expressly permits it, the Customer shall not upload or process through the Services: (a) protected health information regulated under the United States Health Insurance Portability and Accountability Act, 1996; (b) full payment card numbers regulated under the Payment Card Industry Data Security Standard; or (c) information classified by any government as secret or above.

7.7 No obligation to monitor; access by personnel. The Company does not pre-screen Customer Data and shall have no obligation to monitor it. Where Customer Data is held in Customer Storage or a Customer-hosted environment, the Company does not store file contents and its personnel have no access to them. Where Customer Data is held in ImmuneFiles Cloud, the Company manages the encryption keys and its authorised personnel are therefore technically able to access file contents; however, such personnel shall access file contents only where required by Applicable Law or by an order of a court or Governmental Authority, or where expressly requested in writing by the Customer, and all such personnel are bound by written confidentiality obligations. The Company shall not be responsible for the content of Customer Data or for its use by the Customer, its Authorised Users or Recipients.

7.8 Service Data and aggregated data. The Company may collect and use Service Data to provide, secure, support, invoice for and improve the Services, and to comply with Applicable Law. The Company may also create aggregated or de-identified data that does not identify the Customer, any individual or the contents of Customer Data, and may use such data for any lawful purpose. The Company shall own all Service Data and aggregated data, subject to the Customer’s rights in any Customer Data contained therein. To the extent that Service Data contains personal data, the Company shall handle it in accordance with the Privacy Policy and, where it processes such data on behalf of the Customer, the DPA.

7.9 Third-Party Platforms. By connecting a Third-Party Platform, the Customer authorises the Company to access and exchange data with such platform to the extent required to provide the connected features. The Customer’s use of any Third-Party Platform shall be governed by the terms of its provider. The Company shall not be responsible for any Third-Party Platform, including its availability, security or any change to its interfaces, and connected features may cease to function if a Third-Party Platform changes.

8.1 Safeguarding. The Customer shall safeguard its Encryption Credentials, account passwords and the passwords it sets on shared links, and shall share them only through secure channels.

8.2 Encryption and keys. In respect of ImmuneFiles Cloud, files are encrypted at rest using AES-256 and in transit using Transport Layer Security, with keys managed by the Company. Where the Customer uses Customer Storage or Customer-Hosted Software, the Customer shall control the encryption of such storage or environment and any keys held by it. The Company cannot recover, decrypt or restore Customer Data if the Customer loses any key or Encryption Credential under its control, and shall have no liability for any resulting loss of access.

8.3 Fraudulent requests. The Company shall never request any password or Encryption Credential by email, telephone or chat. Any such request shall be treated as fraudulent and reported to securityoperations@prudentbit.com.

9.1 Data collected. Certain features collect data relating to Recipients, including the name and email address entered by them, IP address, approximate or precise location, device information and viewing activity. Proctored viewing analyses the Recipient’s webcam feed in real time for signals such as the presence of a face. Webcam images and video are never stored, and only the resulting alerts are recorded in the access logs.

9.2 Customer obligations. Where the Customer enables any such feature, the Customer shall: (a) have a valid legal basis for monitoring each Recipient; (b) ensure that Recipients receive all notices required under Applicable Law before access, in addition to the notice displayed by the Services under Clause 12.1, which the Customer shall not remove or obscure; (c) obtain consent where required; and (d) not use such features for covert surveillance, for employment decisions based solely on automated signals, or for any unlawful purpose.

9.3 No biometric identification. The Services do not perform biometric identification, facial recognition or face matching, and do not create facial templates. The Customer shall not use the Services, or any image or output generated by them, for any such purpose.

9.4 Customer responsibility. The decision whether to enable any monitoring feature, and in respect of whom, rests solely with the Customer, which shall be solely responsible for any claim by a Recipient, employee or other person arising from monitoring enabled by it.

10.1 Prohibited conduct. The Customer shall not, and shall ensure that its Authorised Users and Recipients do not:

10.2 Suspension. The Company may suspend access to any content, link, device, Authorised User or the Tenant where reasonably necessary to prevent a breach of Clause 10.1, to address a security threat, to comply with Applicable Law or a lawful order, or to avoid legal liability. Where practicable, the Company shall notify the Customer in advance and shall limit such suspension to the extent necessary, and shall restore access promptly once the relevant issue has been resolved.

10.3 Reporting. The Company may report unlawful content or activity to the relevant Governmental Authority, and may preserve related information, where required by Applicable Law or where it reasonably believes such action necessary to protect any person from harm.

11.1 Intermediary. In respect of Customer Data and other content shared through the Services, the Company acts as an intermediary within the meaning of Section 2(1)(w) of the IT Act. Users determine what to upload and share, initiate each transmission and select its recipients. Watermarking, masking, non-disclosure and similar functions are automated tools that operate only as configured by the Customer, and the Company does not select or modify the information shared by users.

11.2 Complaints. Any person who believes that any content on the Services is unlawful or infringes his or her rights may submit a complaint to the Company’s Grievance Officer, Mr. Vareesh Ahmed whose particulars are also published in the Privacy Policy, at , setting out: (a) the link to, or other identification of, the content; (b) the grounds of the complaint, together with proof of ownership in the case of a claim relating to Intellectual Property Rights; (c) the name and contact details of the complainant; and (d) a declaration that the complaint is made in good faith and is accurate.

11.3 Timelines. The Company shall acknowledge each complaint within 24 (twenty-four) hours and shall act thereon within the timelines prescribed under the IT Rules, which at present are:

In the event of any amendment to the IT Rules, the timelines prescribed thereunder from time to time shall apply.

11.4 Appeal. Any person aggrieved by a decision of the Grievance Officer may prefer an appeal to the Grievance Appellate Committee constituted under the IT Rules within 30 (thirty) days of receipt of such decision.

11.5 Periodic notice. The Company shall inform users of these rules, and of the consequences of non-compliance, at least once in every 3 (three) months, or at such other frequency as may be prescribed under the IT Rules.

11.6 Repeat infringers. The Company may suspend or terminate the access of any user who repeatedly infringes the rights of others or breaches Clause 10.1.

12.1 Terms applicable to Recipients. Any person who accesses, views, downloads or uploads files through a link shared by a Customer is a Recipient. A Recipient is not required to create an account, but may be asked to enter basic details, such as name and email address, which shall be recorded in the Customer’s access logs. Before a shared file is opened, the Services display to the Recipient a notice stating that access is logged and may be monitored as configured by the Customer, with links to these Terms and the Privacy Policy, together with a request for permission to use the webcam where proctored viewing is enabled. By continuing past such notice, the Recipient confirms that he or she is not less than 18 (eighteen) years of age and agrees to be bound by Clause 10.1, by the access conditions set by the Customer (including any non-disclosure agreement, password, view limit, watermark, expiry or geo-fencing restriction) and by the monitoring notice displayed.

12.2 Relationship. The Customer, and not the Company, determines what is shared with a Recipient and which controls apply. The Recipient’s relationship in respect of such content is with the Customer, and the Company shall not be responsible therefor.

12.3 Circumvention. A Recipient shall not attempt to circumvent any restriction, or to capture, record, photograph or redistribute protected content contrary to the Customer’s settings. The Company may block the access of any Recipient who does so and may make records of such attempts available to the Customer.

12.4 Liability to Recipients. The Services are provided to Recipients free of charge and on an “as is” basis. To the maximum extent permitted by Applicable Law, the aggregate liability of the Company to any Recipient shall not exceed INR 1,000 (Indian Rupees One Thousand only).

13.1 Fees. The Customer shall pay the Fees set out in the Order Form for a monthly or annual subscription. Unless otherwise specified, the Fees are denominated in Indian Rupees (or, for Customers outside India, in the currency specified in the Order Form), are payable in advance, and are exclusive of goods and services tax, value added tax and all other applicable taxes, which shall be borne by the Customer.

13.2 Invoices. Invoices shall be payable within 30 (thirty) days of the date of invoice, unless otherwise specified in the Order Form.

13.3 Late payment. Overdue amounts shall bear interest at the rate of 18% (eighteen per cent) per annum, or the maximum rate permitted by Applicable Law, whichever is lower, from the due date until the date of actual payment. The Customer shall also reimburse the Company’s reasonable costs of recovering overdue amounts.

13.4 Renewal. Each subscription shall renew automatically for a period equal to the expiring Subscription Term unless either Party gives written notice of non-renewal: (a) in the case of an annual subscription, not less than 30 (thirty) days before the end of the then-current Subscription Term; and (b) in the case of a monthly subscription, before the next billing date.

13.5 Revision of Fees. The Company may revise the Fees for any renewal by giving written notice not less than 60 (sixty) days before the end of an annual Subscription Term, or not less than 30 (thirty) days before the next billing date of a monthly subscription.

13.6 Suspension for non-payment. If any undisputed amount remains unpaid 15 (fifteen) days after written notice of non-payment, the Company may suspend the Services until payment is received. The Company shall not delete Customer Data during such suspension. If such amount remains unpaid 30 (thirty) days after the suspension commences, the Company may terminate under Clause 19.2, whereupon Clause 19.4 shall apply.

13.7 Upgrades and downgrades. Upon an upgrade of plan or the addition of the Desktop App or any other add-on, the revised Fees shall apply from the date of such upgrade, pro-rated as specified in the Order Form. A downgrade shall take effect at the next renewal and may reduce features, storage or user limits. The Customer shall be responsible for exporting any Customer Data exceeding the limits of the downgraded plan before the downgrade takes effect.

13.8 Withholding tax. If the Customer is required by Applicable Law to deduct tax at source from any payment, it shall furnish valid certificates of such deduction promptly, failing which it shall pay the amount so deducted to the Company.

13.9 Purchases through Partners. Where the Customer purchases the Services through a Partner, the Fees, invoicing and payment terms shall be as agreed between the Customer and the Partner, and any refund due under these Terms shall be paid through the Partner. These Terms shall nonetheless govern the Customer’s use of the Services. A Partner is not an agent of the Company and has no authority to make any commitment, or to vary these Terms, on behalf of the Company. If the Company does not receive payment for the Customer’s subscription from the Partner, the Company may suspend the Services upon 15 (fifteen) days’ notice to the Customer.

13.10 Refunds. Save as expressly provided in Clauses 16.3, 17.1, 19.3 and 20.2 and paragraph 4.3 of Schedule 1, or as required by Applicable Law, all Fees are non-refundable.

13.11 Set-off. The Company may set off any amount owed by the Customer to the Company against any amount payable by the Company to the Customer under these Terms.

14.1 Definition. “Confidential Information” means all non-public information disclosed by a Party (the “Disclosing Party”) to the other Party (the “Receiving Party”) that is designated as confidential or that ought reasonably to be understood to be confidential. Customer Data is the Confidential Information of the Customer. The Services, the Applications, the Customer-Hosted Software, the Documentation, pricing and the non-public terms of any Order Form are the Confidential Information of the Company.

14.2 Obligations. The Receiving Party shall: (a) use the Confidential Information only to perform its obligations or exercise its rights under these Terms; (b) protect it with at least the degree of care it applies to its own information of a similar nature, and in any event no less than reasonable care; and (c) disclose it only to its employees, contractors and advisers who need to know it and who are bound by obligations of confidentiality no less protective than those set out herein.

14.3 Exceptions. The obligations in Clause 14.2 shall not apply to information that: (a) is or becomes publicly available otherwise than through a breach of these Terms; (b) was lawfully known to the Receiving Party before disclosure; (c) is independently developed by the Receiving Party; or (d) is lawfully received from a third party without restriction.

14.4 Compelled disclosure. The Receiving Party may disclose Confidential Information to the extent required by Applicable Law or by an order of a court or Governmental Authority, provided that, where legally permitted, it gives the Disclosing Party prompt notice and reasonable assistance to seek protective treatment, and discloses only such information as is required.

14.5 Equitable relief. Each Party acknowledges that damages alone may not be an adequate remedy for a breach of this Clause 14 or of the other Party’s Intellectual Property Rights, and that the other Party shall be entitled to seek injunctive or other equitable relief without proof of special damage.

15.1 Ownership. The Company and its licensors own all right, title and interest, including all Intellectual Property Rights, in and to the Services, the Applications, the Customer-Hosted Software, the Documentation, the artificial intelligence models, trademarks and underlying technology, including all improvements thereto. No right is granted to the Customer save as expressly set out in these Terms.

15.2 Feedback. The Company may freely use any suggestion or feedback provided by the Customer, without obligation, provided that it does not identify the Customer or disclose its Confidential Information.

15.3 Customer references. The Company may identify the Customer by name and logo as a customer only with the Customer’s prior written consent, which may be withdrawn at any time.

15.4 Trademarks. The Customer shall not use the names, logos or trademarks “ImmuneFiles” or “Prudentbit” without the Company’s prior written consent.

16.1 Mutual. Each Party represents and warrants that it is duly organised and validly existing, that it has full power and authority to enter into and perform these Terms, and that it shall comply with all Applicable Laws in the performance of its obligations hereunder.

16.2 By the Company. The Company warrants that: (a) the Services shall perform materially in accordance with the Documentation; and (b) it shall maintain an information security management system certified to ISO/IEC 27001 or an equivalent standard, together with the reasonable security practices and procedures required under Applicable Law.

16.3 Remedy. If the Services fail to conform to the warranty in Clause 16.2(a) and the Customer notifies the Company within 30 (thirty) days of such failure, the Company shall use reasonable efforts to correct the non-conformity. If the Company is unable to do so within a reasonable time, either Party may terminate the affected subscription, and the Company shall refund the prepaid Fees for the unexpired portion of the Subscription Term. This Clause 16.3 sets out the Customer’s sole and exclusive remedy for breach of the warranty in Clause 16.2(a).

16.4 Exclusions. The warranty in Clause 16.2(a) shall not apply to any failure caused by Customer Storage, a Customer-hosted environment, a Third-Party Platform, an unsupported device, browser or operating system, any modification not made by the Company, any misuse, or any beta or pilot feature.

16.5 By the Customer. The Customer represents and warrants that it has, and shall maintain, all rights, consents and notices required for the Customer Data and for its use of the Services, and that its use of the Services shall not breach any Applicable Law or the rights of any person.

16.6 Disclaimer. SAVE AS EXPRESSLY SET OUT IN THESE TERMS AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES, THE APPLICATIONS AND THE CUSTOMER-HOSTED SOFTWARE ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, AND THE COMPANY DISCLAIMS ALL OTHER WARRANTIES, CONDITIONS AND REPRESENTATIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, THE COMPANY DOES NOT WARRANT THAT THE SERVICES SHALL BE UNINTERRUPTED OR ERROR-FREE; THAT THEY SHALL PREVENT ALL UNAUTHORISED ACCESS, DISCLOSURE, SCREEN CAPTURE, MALWARE OR RANSOMWARE; THAT ALL DATA SHALL BE RECOVERABLE AFTER AN INCIDENT; THAT ANY OUTPUT OF THE AI FEATURES SHALL BE ACCURATE OR COMPLETE; THAT ANY NON-DISCLOSURE AGREEMENT TEMPLATE SHALL BE ENFORCEABLE; THAT ANY APPLICATION SHALL BE COMPATIBLE WITH EVERY DEVICE OR SOFTWARE; OR THAT USE OF THE SERVICES SHALL, BY ITSELF, ENSURE COMPLIANCE WITH ANY APPLICABLE LAW.

16.7 Non-reliance. The Customer acknowledges that, in accepting these Terms, it has not relied on any statement, representation, demonstration or marketing material that is not expressly set out in these Terms, an Order Form or a Master Agreement.

17.1 By the Company. The Company shall defend the Customer against any claim by a third party alleging that the Services, as provided by the Company, infringe the Intellectual Property Rights of such third party, and shall pay the damages and costs finally awarded against the Customer or agreed in settlement by the Company, subject to Clause 18.4. This Clause 17.1 shall not apply to any claim arising from Customer Data, a Third-Party Platform, any beta or pilot feature, or any combination or modification not made by the Company. If the Services are, or in the Company’s opinion are likely to be, held to infringe, the Company may, at its option, procure the right for the Customer to continue using them, modify them so that they become non-infringing, or terminate the affected subscription and refund the prepaid Fees for the unexpired portion of the Subscription Term. This Clause 17.1 states the entire liability of the Company in respect of any infringement of Intellectual Property Rights.

17.2 By the Customer. The Customer shall defend, indemnify and hold harmless the Company, its affiliates and their respective directors, officers and employees from and against all Losses arising out of any claim by a third party, or any investigation or proceeding by a Governmental Authority, to the extent arising from:

17.3 Procedure. The indemnified Party shall notify the indemnifying Party promptly of any claim and shall provide reasonable cooperation at the indemnifying Party’s cost. The indemnifying Party shall have conduct of the defence and settlement of any third-party claim, provided that no settlement shall impose any liability on, or require any admission from, the indemnified Party without its prior written consent. The indemnified Party may participate in the defence through counsel of its own choice at its own cost.

17.4 Regulatory proceedings and failure to defend. Notwithstanding Clause 17.3, the Company shall at all times retain conduct of its own response to any Governmental Authority, and the Customer shall bear the reasonable costs of such response to the extent Clause 17.2 applies. If the Customer fails to assume the defence of any claim promptly, the Company may defend such claim itself, and the Customer shall reimburse the reasonable costs thereof.

18.1 Exclusion of indirect loss. In no event shall either Party be liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profit, revenue, business, goodwill or anticipated savings, business interruption, cost of substitute services, or loss or corruption of data, even if advised of the possibility thereof.

18.2 Aggregate cap. Subject to Clause 18.3, the total aggregate liability of each Party arising out of or in connection with these Terms shall not exceed the Fees paid and payable by the Customer for the Services in the 3 (three) months immediately preceding the event giving rise to the claim. In respect of a free pilot, such liability shall not exceed INR 10,000 (Indian Rupees Ten Thousand only).

18.3 Exceptions. Nothing in Clauses 18.1 or 18.2 shall limit:

18.4 Security incidents and infringement claims. For the avoidance of doubt, all claims arising from any security incident or personal data breach, and all obligations of the Company under Clause 17.1, shall be subject to Clauses 18.1 and 18.2.

18.5 Single cap. The existence of more than one claim shall not enlarge the limits set out in this Clause 18.

18.6 Contributory acts. The liability of the Company shall be reduced to the extent that any loss is caused or contributed to by the Customer, its Authorised Users or Recipients, including by any failure to follow the Documentation, enable multi-factor authentication, secure Customer Storage or devices, or protect Encryption Credentials.

18.7 Allocation of risk. The Customer acknowledges that the Fees reflect the allocation of risk set out in this Clause 18, and that the Company would not provide the Services without these limitations.

19.1 Term. These Terms shall commence on the date of their acceptance by the Customer and shall continue until the expiry or termination of all subscriptions hereunder.

19.2 Termination for cause. Either Party may terminate these Terms or any subscription by written notice to the other Party if the other Party: (a) commits a material breach of these Terms and fails to cure such breach within 30 (thirty) days of receipt of written notice thereof; or (b) becomes insolvent, makes an arrangement with its creditors, or has a liquidator, administrator or resolution professional appointed in respect of it. The Company may terminate with immediate effect upon written notice in the event of a serious breach of Clause 10.1, or where required by Applicable Law or a lawful order.

19.3 Refund upon termination by the Customer. If the Customer terminates under Clause 19.2 for the Company’s uncured material breach, the Company shall refund the prepaid Fees for the unexpired portion of the Subscription Term.

19.4 Consequences of termination. Upon expiry or termination, the Customer’s right to use the Services, the Applications and the Customer-Hosted Software shall cease. During the export period specified in the Order Form or, where none is specified, 30 (thirty) days, the Customer may export the Customer Data held by the Company using the standard export tools of the Services, and it shall be the Customer’s responsibility to do so. Thereafter, the Company shall delete such Customer Data from its active systems, and from backups as they expire under its backup schedule within a further 90 (ninety) days, save as required by Applicable Law. Upon request, the Company shall certify such deletion in writing. Upon expiry of the export period, the Company shall have no obligation to retain or provide any Customer Data. Customer Data held in Customer Storage or in a Customer-hosted environment shall remain under the Customer’s control, and the Customer shall revoke the Company’s access thereto.

19.5 Survival. Clauses 1, 4.4, 6.5, 6.6, 6.12, 7.1, 7.5 to 7.8, 8, 13 (in respect of unpaid amounts), 14, 15, 16.4 to 16.7, 17, 18, 19.4, 19.5, 21 and 22, and those provisions of the DPA which by their nature are intended to survive, shall survive the expiry or termination of these Terms.

20.1 Right to amend. The Company may amend these Terms to reflect changes in the Services, Applicable Law or its business. The Company shall notify the Customer of any material amendment by email or in-product notice not less than 30 (thirty) days before it takes effect, save where an earlier effective date is required by Applicable Law or to address a security risk.

20.2 Objection. No amendment shall apply retrospectively. If the Customer objects to a material amendment that is not required by Applicable Law, it may terminate the affected subscription before the amendment takes effect and shall be entitled to a refund of the prepaid Fees for the unexpired portion of the Subscription Term. Continued use of the Services after the effective date of an amendment shall constitute acceptance thereof.

21.1 Governing law. These Terms, and any dispute or claim arising out of or in connection with them, shall be governed by and construed in accordance with the laws of India.

21.2 Amicable resolution. The Parties shall first endeavour to resolve any dispute arising out of or in connection with these Terms, including any question regarding their existence, validity or termination (a “Dispute”), through good-faith negotiations between their senior representatives for a period of 30 (thirty) days from the date on which either Party notifies the other of the Dispute in writing.

21.3 Arbitration. Any Dispute not so resolved shall be referred to and finally resolved by arbitration in accordance with the Arbitration and Conciliation Act, 1996. The arbitral tribunal shall consist of a sole arbitrator appointed by mutual agreement of the Parties or, failing such agreement within 30 (thirty) days, in accordance with that Act. The seat and venue of arbitration shall be Noida, Uttar Pradesh. The arbitration shall be conducted in the English language, shall be kept confidential, and the award shall be final and binding on the Parties.

21.4 Jurisdiction. Subject to Clause 21.3, the courts at Noida, Uttar Pradesh shall have exclusive jurisdiction in respect of all matters arising out of these Terms. Nothing herein shall prevent either Party from seeking urgent interim relief, including under Section 9 of the Arbitration and Conciliation Act, 1996, from any court of competent jurisdiction.

21.5 Individual claims. To the extent permitted by Applicable Law, claims may be brought only in an individual capacity, and not as a plaintiff or member in any class or representative proceeding.

21.6 Continued performance. Save where these Terms have been terminated, the Parties shall continue to perform their respective obligations during the pendency of any Dispute.

22.1 Force majeure. Neither Party shall be liable for any delay or failure in the performance of its obligations (other than payment obligations) to the extent caused by any event beyond its reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, acts of any Governmental Authority, epidemics, failure of public networks, power or hosting providers, and large-scale cyber attacks on third-party infrastructure (such as distributed denial-of-service attacks) occurring notwithstanding the Company’s reasonable security measures (each, a “Force Majeure Event”).

22.2 Assignment. Neither Party may assign or transfer its rights or obligations under these Terms without the prior written consent of the other Party, save that either Party may assign these Terms to a successor in connection with a merger, amalgamation, acquisition or sale of all or substantially all of its relevant assets, upon written notice to the other Party.

22.3 Subcontracting. The Company may engage subcontractors and sub-processors to provide the Services, and shall remain responsible for their performance under these Terms.

22.4 Notices. All legal notices to the Company shall be sent to animesh.singh@prudentbit.com, with a copy to its registered office. Notices to the Customer shall be sent to the email address of its Administrator or of the billing contact specified in the Order Form, and shall be deemed received when sent.

22.5 Anti-bribery. Each Party shall comply with all applicable anti-bribery and anti-corruption laws, including the Prevention of Corruption Act, 1988, in connection with these Terms.

22.6 Export and sanctions. Each Party shall comply with applicable export control and sanctions laws. The Customer represents that it is not located in, or owned or controlled by persons located in, any country or on any list subject to sanctions that would prohibit the Company from dealing with it.

22.7 Severability. If any provision of these Terms is held to be invalid or unenforceable, such provision shall be enforced to the maximum extent permissible, and the remaining provisions shall continue in full force and effect.

22.8 Waiver. No failure or delay by either Party in exercising any right or remedy shall operate as a waiver thereof, nor shall any single or partial exercise of any right or remedy preclude any further exercise thereof.

22.9 Relationship. The Parties are independent contractors. Nothing in these Terms shall create any partnership, joint venture, agency or employment relationship between them.

22.10 Third-party rights. Save for the persons referred to in Clause 17.2 and Apple under Clause 6.10, no person other than the Parties shall have any right to enforce any provision of these Terms.

22.11 Language. These Terms are executed in the English language. Any translation is provided for convenience only, and the English version shall prevail.

22.12 Stamp duty. Any stamp duty payable on these Terms or on any Order Form shall be borne by the Customer.

22.13 Cumulative remedies. Save as expressly provided in these Terms, the rights and remedies provided herein are cumulative and are in addition to any rights or remedies provided by Applicable Law.

22.14 Entire agreement. These Terms, together with the documents referred to in Clause 2.4 and any Master Agreement, constitute the entire agreement between the Parties in relation to their subject matter, and supersede all prior agreements, understandings and representations in relation thereto.

22.15 Contact. Any query in relation to these Terms may be addressed to animesh.singh@prudentbit.com or +91-9650111303.