Terms of Service

1. About Ninebloom

Ninebloom is a Regulatory Technology (RegTech) company that provides Digital Personal Data Protection (DPDP) compliance, data governance, privacy management, and related tools and services to industries, educational institutes, and startups. Our services include:

• Ninebloom Compliance Platform — a cloud-based suite for data protection governance, consent management, data subject request handling, privacy impact assessments, breach response workflows, and audit readiness;
• Ninebloom Consul — advisory and implementation services for DPDP Act and GDPR compliance, including policy drafting, gap assessments, and remediation support;
• Ninebloom Eduguard — privacy tools specifically designed for educational institutes to manage student and parent data, verifiable parental consent, and institutional data governance;
• Ninebloom Startshield — a lightweight privacy and compliance toolkit for early-stage startups to get DPDP-ready quickly.

2. Definitions

3. Eligibility

You must be at least 18 years of age to create an account and use the Services. By registering, you confirm that you are 18 or older and legally capable of entering into a binding agreement under applicable law.

If you are accessing the Services on behalf of an educational institute, company, or other organisation, you confirm that you are authorised to act on its behalf and to bind it to these Terms.

4. Your Account

4.1 Account creation

To access most Services, you must create an Account. You agree to provide accurate, current, and complete information during registration and to keep your Account information updated.

4.2 Account security

You are responsible for:

• maintaining the confidentiality of your Account credentials (password, API keys, access tokens);
• all activity that occurs under your Account;
• promptly notifying us at privacy@ninebloom.co of any unauthorised use, access, or suspected security breach;
• ensuring that your organisation members and nominees use the Services in compliance with these Terms.

4.3 Organisation members and nominees

You may add one or more organisation members or nominees to your Account so that multiple authorised individuals can manage your data and compliance settings. Account administrators are responsible for managing access levels and permissions for all members and may revoke access at any time. You are responsible for all actions taken by your authorised users.

5. Your Use of the Services

5.1 Permitted use

You may use the Services only for lawful purposes and in accordance with these Terms. You agree to use the Services to support your own data protection and compliance obligations under applicable law, including the DPDP Act and GDPR where relevant.

5.2 Acceptable use

You must not, and must not permit any User to:

• Use the Services in any manner that violates any applicable law, regulation, or third-party right;
• Upload, store, or process any data that is unlawful, infringing, or that you do not have the right to process;
• Attempt to gain unauthorised access to any part of the Services, other clients' data, or Ninebloom's systems;
• Introduce malware, viruses, or any malicious code into the platform;
• Interfere with or disrupt the integrity or performance of the Services, including attempting to overload, crash, or reverse-engineer the platform;
• Use the Services to process personal data without a lawful basis under the DPDP Act, GDPR, or other applicable law;
• Resell, sublicense, or redistribute access to the Services without our written permission;
• Use the Services to develop a competing product or service;
• Remove, alter, or obscure any proprietary notices on the Services;
• Use the Services in any manner that could damage Ninebloom's reputation or goodwill.

5.3 Your responsibilities as a Data Fiduciary / Controller

Where you process personal data of your end-users through the Services, you remain the Data Fiduciary under the DPDP Act and/or the Controller under GDPR. You are responsible for:

• obtaining lawful consent and providing privacy notices to your end-users;
• the accuracy, quality, and legality of the Client Data you process;
• configuring the platform's retention, access control, and consent settings in a manner consistent with your legal obligations;
• responding to your end-users' data subject requests (Ninebloom will assist you as described in the DPA).

6. Subscriptions and Payment

6.1 Subscription plans

The Services are offered through subscription plans described on our website. The plan you select, its fees, billing cycle, and included features are set out in your order confirmation or the plan page on ninebloom.co.

6.2 Fees

You agree to pay all fees associated with your Subscription. Fees are billed in advance and are payable in Indian Rupees (₹) unless otherwise stated. Payment is processed through Zoho Payments and Zoho Billing.

6.3 Renewal

Subscriptions automatically renew at the end of each billing cycle (monthly or annually, depending on your plan) unless you cancel before the renewal date. You can cancel at any time through your Account settings or by contacting ceo@ninebloom.co (for billing) or terms@ninebloom.co (for contract matters). Cancellation takes effect at the end of the current billing cycle — you retain access to the Services until then.

6.4 Price changes

We may change our fees upon at least 30 days' notice. Any fee change takes effect at the start of your next billing cycle following the notice. If you do not agree to the new fees, you may cancel your Subscription before the renewal date.

6.5 Refunds

Unless required by law, subscription fees are non-refundable. If you cancel mid-cycle, you retain access until the end of the billing cycle but no prorated refund is issued. If Ninebloom terminates your access for its own breach of these Terms, you will receive a prorated refund of prepaid fees for the remaining period.

6.6 Taxes

All fees are exclusive of applicable taxes, including GST. You are responsible for paying all taxes associated with your use of the Services.

7. Trial and Free Tier

If we offer a free trial or a free tier of the Services, the following apply:

• Free trials are limited to the duration and features specified at sign-up and are intended for evaluation purposes only;
• You may convert to a paid Subscription at any time during or after the trial;
• Ninebloom may terminate, modify, or limit free tier features at any time without prior notice;
• Data you enter during a free trial may be deleted if you do not convert to a paid Subscription within 14 days after the trial ends. You will receive a reminder email before deletion.

8. Client Data

8.1 Your data

You retain all rights, title, and interest in your Client Data. Ninebloom does not acquire any ownership of your Client Data. We process Client Data only as your Data Processor under the DPA.

8.2 Data processing

The processing of Client Data is governed by our Privacy Policy and the DPA. By using the Services, you agree to the terms of the DPA, which is incorporated by reference into these Terms.

8.3 Data security and tenant isolation

We protect Client Data using the security measures described in our Privacy Policy and DPA, including tenant isolation or dedicated per-client databases, encryption in transit and at rest, role-based access control, and multi-factor authentication. Client Data is never commingled across tenants.

8.4 Data retention and exit

You may export your Client Data at any time in JSON or CSV format. When your Subscription ends, the data-exit process described in our Privacy Policy and DPA applies:

• Export window: for 30 days after termination, you can export all your data;
• Server shutdown: at the close of the export window, we shut down your tenant environment and decommission any dedicated servers or databases;
• Deletion: we delete all Client Data from active systems within 30 days of the export window closing, and purge it from backups within 90 days, subject to legal hold. We issue a written deletion confirmation once complete.

8.5 Your responsibility for Client Data

You are responsible for backing up Client Data that you process through the Services and for any data loss resulting from your failure to maintain adequate backups. While we maintain our own backups for disaster recovery, our backup systems are not a substitute for your own data backup practices.

9. Intellectual Property

9.1 Ninebloom's intellectual property

The Services, including all software, designs, features, logos, brand names, content, and documentation, are the intellectual property of Ninebloom. These Terms do not grant you any right, title, or interest in the Services except for the limited right to use them in accordance with these Terms.

9.2 Your intellectual property

You retain all rights to your Client Data. You grant Ninebloom a limited, non-exclusive licence to access and process your Client Data solely as necessary to provide the Services to you under the DPA.

9.3 Feedback

If you provide feedback, suggestions, or ideas about the Services (“Feedback”), you grant Ninebloom a perpetual, irrevocable, royalty-free licence to use and incorporate that Feedback into our Services without any obligation or compensation to you.

10. Confidentiality

Each party agrees to keep confidential any non-public information it receives from the other party, including business information, pricing, Client Data, and technical details. Confidentiality obligations survive termination of the Subscription and continue for 3 years thereafter, except for Client Data, which is handled as described in the DPA.

11. Service Availability

11.1 Best-effort availability

We strive to maintain the Services available 24/7, but we do not guarantee uninterrupted access. The Services may be temporarily unavailable due to:

• scheduled maintenance (we will notify you at least 48 hours in advance where possible);
• system failures, network issues, or third-party outages (including AWS or Zoho services);
• events beyond our reasonable control (force majeure).

11.2 No SLA

Unless your Subscription plan or MSA explicitly includes a service-level agreement (“SLA”), the Services are provided on a best-effort basis without any guaranteed uptime.

11.3 Support

Support is available through Zoho Desk during business hours for all paid plans. Response times depend on your Subscription tier and are described on our website or in your order confirmation.

12. Suspension and Termination

12.1 Suspension

We may suspend your access to the Services immediately, without prior notice, if:

• you breach these Terms, the Privacy Policy, or the DPA;
• you fail to pay fees when due;
• your Account or activity poses a security risk or exposes us or other clients to legal liability;
• we receive a lawful order from a court or regulator requiring suspension;
• we suspect fraudulent or abusive use of the Services.

We will notify you of the suspension and the reason as soon as reasonably practicable. If the issue is resolved within 30 days, we will restore access. If not, we may terminate the Account.

12.2 Termination by you

You may terminate your Subscription at any time through your Account settings or by contacting ceo@ninebloom.co. Termination takes effect at the end of the current billing cycle.

12.3 Termination by us

We may terminate your Subscription or these Terms for cause (your material breach that remains uncured for 30 days after written notice), or for convenience upon 30 days' written notice.

12.4 Effect of termination

Upon termination:

• your access to the Services ceases;
• the data-exit process in Section 8.4 applies;
• any accrued rights and obligations survive termination;
• all fees owed up to the termination date become immediately due and payable.

13. Disclaimers

13.1 As-is basis

The Services are provided on an “as is” and “as available” basis. Except as expressly stated in these Terms, Ninebloom disclaims all warranties, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

13.2 Not legal advice

The Services, including compliance assessments, policy templates, risk scores, and advisory outputs, are provided for informational and operational purposes only. They do not constitute legal advice. Ninebloom is a RegTech provider, not a law firm. You should consult a qualified legal professional for legal advice specific to your circumstances.

13.3 Advisory outputs

Compliance dashboards, risk assessments, and alerts generated by the platform are advisory tools to assist you in your compliance efforts. They do not guarantee compliance with any law or regulation. You remain responsible for your compliance decisions and for verifying the accuracy of all outputs.

13.4 Third-party services

The Services may integrate with or rely on third-party services (listed in our Privacy Policy). We are not responsible for the availability, accuracy, or performance of any third-party service.

14. Limitation of Liability

14.1 Cap on liability

To the maximum extent permitted by law, Ninebloom's total aggregate liability arising out of or relating to these Terms or the Services shall not exceed the amount you paid to Ninebloom in the 12 months preceding the event giving rise to the liability.

14.2 Excluded damages

In no event shall Ninebloom be liable for:

• indirect, incidental, special, consequential, or punitive damages;
• loss of profits, revenue, business, or anticipated savings;
• loss of data (other than as covered by the DPA's breach notification provisions);
• business interruption;
• loss of goodwill or reputation.

14.3 Exceptions

Nothing in these Terms limits or excludes any liability that cannot be limited or excluded under applicable law, including liability for death or personal injury caused by negligence, fraud, or wilful misconduct.

15. Indemnity

You agree to indemnify and hold Ninebloom harmless from any claims, damages, losses, or expenses (including reasonable legal fees) arising out of:

• your Client Data, including its accuracy, legality, and your right to process it;
• your breach of these Terms, the Privacy Policy, or the DPA;
• your violation of any applicable law, including the DPDP Act or GDPR, in your capacity as Data Fiduciary / Controller;
• any third-party claim that your Client Data infringes their rights;
• your misuse of the Services.

Ninebloom will notify you of any such claim promptly and give you reasonable cooperation in defending it. You will not settle any claim without our prior written consent where the settlement would impose an obligation on Ninebloom.

16. Governing Law and Dispute Resolution

16.1 Governing law

These Terms are governed by the laws of India. The courts having jurisdiction over the proprietor's place of business shall have exclusive jurisdiction over any disputes arising out of or in connection with these Terms.

16.2 Informal resolution

Before initiating formal legal proceedings, each party agrees to first attempt to resolve the dispute through good-faith negotiations. Either party may initiate this process by sending a written notice to the other party. If the dispute is not resolved within 30 days of the notice, either party may initiate formal proceedings.

16.3 Data Principal rights preserved

Nothing in these Terms affects any right a Data Principal or Data Subject may have under the DPDP Act, GDPR, or other applicable law to seek redressal directly against the party responsible for their data.

17. Changes to These Terms

We may update these Terms from time to time. If we make material changes — changes that significantly affect your rights, obligations, or the cost of the Services — we will notify you by email and post a prominent notice on our website at least 15 days before the changes take effect. The “Effective” date at the top of these Terms always reflects the current version.

Continued use of the Services after the effective date of any change constitutes your acceptance of the updated Terms. If you do not agree to the changes, you may cancel your Subscription before the effective date.

18. Assignment

You may not assign or transfer these Terms or your Subscription to a third party without our prior written consent. We may assign these Terms to a successor in connection with a merger, acquisition, or sale of assets, and will notify you before doing so.

19. Severability

If any provision of these Terms is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.

20. Entire Agreement

These Terms, together with the Privacy Policy, the DPA, and any other documents they incorporate by reference, constitute the entire agreement between you and Ninebloom regarding the Services and supersede all prior agreements and understandings, whether written or oral.