Terms of service

DRAFT — NOT LEGAL ADVICE — for review by a qualified Indian lawyer before use

Two sets of terms: Part 1, the SaaS terms between Upkiva and a Business (tenant), including a data processing schedule; and Part 2, end-customer service terms that a Business (e.g. TV Palace) adopts for its own customers. Items marked [CONFIRM] need counsel's input or a business decision. Reviewed in October 2026 (REVIEW-2026-10.md); open questions are in README.md.

Part 1: Upkiva Terms of Service for Businesses

Effective date: [●] · Version: 0.2 (draft, October 2026)

These terms ("Terms") are an agreement between [Upkiva legal entity, CIN, address] ("Upkiva") and the business that registers for or is onboarded to Upkiva ("Business", "you"). They apply with any order form or commercial proposal ("Order"). If the two conflict, the Order prevails.

1. The service

1.1 Upkiva provides, as software-as-a-service: a back-office web application (app.upkiva.com), a technician Android app (Upkiva Tech), a customer portal (my.upkiva.com), customer messaging, and related APIs (the "Service").

1.2 Onboarding. An account is created by Upkiva (invite with a time-limited link or temporary password) or by a sign-up request that Upkiva may approve or reject at its discretion. You must give accurate business details (legal name, GSTIN, owner contact).

1.3 Support access. Upkiva staff access your workspace only through logged, time-limited support sessions, for support, security or legal reasons.

1.4 Changes. We may improve or change the Service. We will not materially reduce core functionality during a paid term without [30] days' notice [CONFIRM].

2. Your responsibilities

2.1 Users. You create and manage your staff's logins and roles. You are responsible for their actions and for keeping credentials confidential. Promptly deactivate users who leave.

2.2 Your data fiduciary duties. For personal data of your customers, technicians and staff, you are the data fiduciary under the DPDP Act and remain responsible for compliance (s.8(1)), even though Upkiva processes the data for you. You must: give notices and obtain consents where needed (templates are provided: customer notice, technician location notice) in English and, on request, in another Eighth Schedule language; publish your privacy notice and the name and contact of your Grievance Officer; answer data-principal requests within your published period and at most 90 days (DPDP Rules, Rule 14(3); Upkiva assists, see Schedule A); review the retention settings in Settings → Data & privacy and switch on the automatic purges you rely on; inform the Data Protection Board and affected people of a personal data breach (Upkiva helps); and not instruct Upkiva to process data unlawfully.

2.3 Employees and technicians. You confirm that technician location tracking, selfies, device checks and call recording are used for legitimate employment purposes, that you have informed the technicians (and obtained consent where needed), and that tracking is limited to working hours (between check-in and check-out, as the Service is designed to do). You will use location and selfie data only for the purposes in the technician notice (attendance, dispatch, customer ETA, travel claims, safety and proof of work), not to monitor technicians off duty, and you will let a technician see the data held about them (the app shows each day's route under My Day; anything else on request). For employees you may rely on the employment legitimate use (DPDP s.7(i)); for freelance or agency technicians obtain consent [CONFIRM].

2.4 Acceptable use. No unlawful, fraudulent or abusive use; no spam. WhatsApp and SMS messages must follow Meta's policies, the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 (as amended in 2025) and opt-out requests. You are the sender: your business, SMS headers and message templates must be registered on a DLT platform in your name [CONFIRM: or under Upkiva's entity for platform messages only]; service and transactional messages go on service / transactional templates, and promotional messages (offers) only to customers who agreed to receive them. No reverse engineering, load testing or security testing without written permission; no uploading of malware; no use to track people outside working purposes.

2.5 Third-party services. WhatsApp, SMS, payment gateway, masked calling and maps are provided by third parties under their own terms. Some require your own account and KYC (e.g. the payment gateway settles to your bank account). Upkiva is not responsible for their outages or decisions (e.g. Meta rejecting a template).

2.6 Tax and invoices. You are responsible for the correctness of your GST registration, rates, HSN / SAC codes, invoice series and filings. The Service computes GST from your settings; it does not file returns. E-invoicing (IRN) is not provided. E-invoicing is mandatory for a GST-registered person whose aggregate turnover in any financial year from 2017-18 exceeded ₹5 crore (CGST Rules, rule 48(4); Notification 10/2023-Central Tax). If that applies to you, you must generate the IRN outside the Service [CONFIRM before onboarding any Business above the threshold]. You must keep your books and invoices for the period the law requires (CGST Act s.36: 72 months from the due date of the annual return, longer while an appeal or proceeding is pending; Companies Act s.128(5): 8 financial years for companies), using exports if you leave the Service.

3. Fees and payment

3.1 Fees, billing period and limits (e.g. number of technicians) are as in the Order. Fees exclude GST. 3.2 Invoices are payable within [15] days. Upkiva may suspend the Service after [15] days' written notice of non-payment. 3.3 Pilot. Any free or discounted pilot is "as is", for the stated period, after which the Order terms apply unless you cancel [CONFIRM pilot commercial terms with TV Palace].

4. Data, ownership and export

4.1 Your data (customer, unit, job, stock, financial and staff data you or your users put in, and the photos / records your technicians capture) belongs to you. You grant Upkiva a licence to process it only to provide, secure and support the Service, and as Schedule A describes.

4.2 Export. You can export reports (Excel / CSV / PDF / Tally XML) at any time. On termination we will, on request made within [30] days, provide a full export in a machine-readable format.

4.3 Deletion on exit. After the export window, Upkiva deletes your workspace data from live systems within 30 days, and from backups as they rotate (currently up to 12 months; monthly snapshots; backups are never restored for normal use). Keeping invoices and books for the statutory period after you leave is your responsibility as the taxpayer: take the full export (including Tally XML and invoice PDFs) before the export window closes. Upkiva does not keep your records after exit unless a law or an order of an authority requires it. On request Upkiva confirms the deletion in writing.

4.4 Aggregated data. Upkiva may use de-identified, aggregated statistics (e.g. average jobs per technician across all tenants) to improve the Service. These never identify you, a person or a customer.

5. Availability, backups and security

5.1 Target availability [99.5] % a month, excluding planned maintenance announced in advance and third-party outages [CONFIRM whether an SLA with credits is offered]. 5.2 Daily encrypted backups. Upkiva tests restores periodically. 5.3 Security measures are in Schedule A. Upkiva keeps its server logs for 180 days, keeps its clocks synchronised, and reports cyber incidents to CERT-In within 6 hours, as the CERT-In directions of 28 April 2022 require.

6. Confidentiality

Each party keeps the other's non-public information confidential and uses it only for this agreement. This survives termination for [3] years (personal data: indefinitely).

7. Warranties and disclaimers

7.1 Upkiva will provide the Service with reasonable skill and care. 7.2 Otherwise the Service is provided "as is". Upkiva does not guarantee that GPS, geofence, OTP delivery or offline sync will be accurate or available in every location or network condition. Fraud-detection features (audit flags, QC call-backs, anti-leakage checks) support your controls but do not replace them.

8. Liability

8.1 Neither party is liable for indirect or consequential loss, or for loss of profit, revenue or goodwill (loss that does not arise naturally from the breach and was not in the parties' contemplation when they contracted; Indian Contract Act, 1872, s.73). 8.2 Each party's total liability under these Terms is limited to the fees paid and payable in the 12 months before the event giving rise to the claim [CONFIRM cap; for a free pilot, a fixed amount such as ₹[1,00,000]]. 8.3 For a breach of clause 6 (confidentiality) or of Schedule A (data processing), the limit in 8.2 is [two] times that amount [CONFIRM]. 8.4 The limits do not apply to fraud, wilful misconduct, a party's indemnity obligations under clause 9, your payment obligations, or any liability that cannot be limited by law.

9. Indemnity

You indemnify Upkiva against third-party claims arising from your data, your instructions, your users' misuse, or your failure to give notices or obtain consents. Upkiva indemnifies you against third-party claims that the Service infringes their Indian intellectual-property rights [CONFIRM]. The party claiming must tell the other promptly, let it control the defence, and help reasonably.

9A. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control (for example natural disaster, epidemic, war, government action, or a widespread internet, power or cloud-provider failure), except for payment obligations. The affected party will tell the other and resume as soon as it can.

10. Term and termination

10.1 The term is as in the Order, renewing automatically unless either party gives [30] days' notice. 10.2 Either party may terminate for material breach not cured within [30] days of notice. 10.3 On termination, access ends and clause 4.2–4.3 applies.

11. General

11.1 Governing law: the laws of India. 11.2 Disputes: the parties will first try to settle a dispute by talking, for 30 days after written notice. If not settled, it is finally resolved by arbitration by a sole arbitrator appointed by the parties under the Arbitration and Conciliation Act, 1996. The seat and venue is Surat, Gujarat; the language is English [CONFIRM: arbitration or courts only; any institutional rules]. 11.3 Courts: subject to 11.2, the courts at Surat, Gujarat have exclusive jurisdiction, including for interim relief (s.9 of that Act). 11.4 No assignment without consent, except to a successor of the whole business. Notices by email to the addresses in the Order. Accepting these Terms electronically forms a valid contract (IT Act, 2000, s.10A). If any clause is invalid, the rest continues. These Terms and the Order are the whole agreement.

Schedule A: Data processing terms (DPDP Act)

A1. Roles. For the personal data of the Business's customers, technicians and staff ("Business Personal Data"), the Business is the data fiduciary and Upkiva is the data processor. This Schedule is the valid contract under which the Business engages Upkiva (DPDP s.8(2)). Upkiva processes Business Personal Data only on the Business's documented instructions. These Terms, the Business's settings in the Service, and its users' actions are those instructions. Upkiva tells the Business if it believes an instruction breaks the law.

A2. Categories.

• Data principals: customers, customers' contacts, technicians (employees, freelancers, agency staff), office staff.
• Data: identity and contact data, addresses and map locations, appliance data, job photos (time / GPS stamped), signatures, OTP verification records, ratings and complaints, payment references, call logs and recordings (if enabled), technician attendance selfies, location points and journeys, device audit data, cash and incentive ledgers, and ID-document numbers (encrypted).

A3. Upkiva's obligations.

1. Confidentiality of personnel with access.
2. Reasonable security safeguards (DPDP s.8(5); DPDP Rules, Rule 6; until 13 May 2027 also IT Act s.43A and the SPDI Rules, 2011, rule 8): encryption in transit (TLS) and of backups; hashed credentials and OTPs; encrypted ID numbers; role-based access and least-privilege production access; signed short-lived media URLs; audit logs of access and changes; server logs kept 180 days and processing logs at least 1 year (Rule 8(3)); daily backups to keep the data available; NTP-synced clocks.
3. Use only the sub-processors listed in the Privacy Policy section C, each under a written contract with data-protection terms no less protective than this Schedule. Give 30 days' notice of a new one, during which the Business may object and, if unresolved, terminate.
4. Assist the Business with data-principal requests (access, correction, completion, erasure, nomination) within 7 working days of a request. The Service already gives the Business customer export and erasure tools (Settings → Data & privacy).
5. Report cyber incidents to CERT-In within 6 hours of noticing them, and notify the Business of a personal data breach affecting its data within 6 hours (initial notice) and with full details within 24 hours of becoming aware, with the information the Business needs for its intimation to the Board (without delay, detailed report within 72 hours) and to the affected people (Rule 7).
6. Apply the retention settings the Business chooses (see data-retention-and-deletion.md): technician location history is purged automatically after 90 days; job-photo and invoice-document purges run once the Business switches them on; erase Business Personal Data on the Business's instruction, and when the purpose is served or consent is withdrawn (s.8(7)), and at the end of the agreement as in clause 4.3, and make sub-processors do the same.
7. Make available the information needed to show compliance, and allow one audit a year on 30 days' notice (or provide a recent third-party report) [CONFIRM].
8. Not use Business Personal Data for its own purposes, sell it, or combine it with another Business's data, except de-identified aggregates as in clause 4.4.

A4. Cross-border. Business Personal Data is hosted in Germany (EU) (Hetzner), with media and encrypted backups in Cloudflare R2 [CONFIRM R2 jurisdiction], and some sub-processors operate globally. The DPDP Act allows this unless the Government of India restricts a country by notification (s.16(1)); as of October 2026 none is restricted. Upkiva will not transfer data to a restricted country, will follow any requirement under Rule 15, and will give the Business notice and a migration plan if a country it uses is restricted. Stricter sector rules (s.16(2), for example RBI rules on payment data) continue to apply.

Part 2: Service terms for customers (template for the Business)

TV Palace (or another Business) adopts these for its end customers, e.g. printed on the job card and linked from WhatsApp messages and the customer portal "My TV Palace". The Business is the contracting party, not Upkiva.

[Business name] ("we") provides AC and appliance service, AMC contracts and installation. By booking a service or buying an AMC you agree to these terms.

1. Bookings and visits. We give you a time slot. Our technician's name and photo come on WhatsApp / SMS. Please share the start code (OTP) only with the technician who has arrived at your premises, and the closing code only when you are satisfied the work is done.
2. Proof of work. The technician takes before and after photos of the appliance and work area, and records readings. These are shared with you with the invoice and used to resolve complaints.
3. Charges. Visit, diagnosis, labour, parts, gas and accessories are charged as per our rate card and your AMC plan's coverage. Chargeable parts and any extra items are fitted only after you approve the price on your own phone (WhatsApp or portal). Do not pay anything not shown on the invoice. If a technician asks for extra cash, report it to [office number]. We call back a sample of customers to check.
4. Payment. Pay by UPI QR, payment link, card or cash against a GST invoice. Cash payments must be reflected in the invoice. Refunds, if due, go to the UPI / bank account on file.
5. AMC. The plan's period, number of services, covered parts, gas and response times are as in your contract. The AMC covers the listed units only. Renewals are offered 30 / 15 / 7 days before expiry. [Pre-AMC inspection for units not bought from us or out of warranty, with possible refusal.] Cancellation: you may cancel an AMC at any time. We refund the unused part of the price on a pro-rata basis, less our standard charge for services and parts already provided, to the account you paid from, within [7] working days [CONFIRM refund rule]. If we cancel, we refund the unused part in full.
6. Warranty on our work. Repeat fault on the same unit within 15 days → free revisit. Installation workmanship warranty 90 days. Parts carry the warranty stated on the invoice. Brand warranties are given by the manufacturer.
7. Customer not available. If nobody is available at the booked time, we record calls and a door photo. [If a visit charge applies, state the amount here and in the booking message: ₹[●]. CONFIRM.] No charge is made unless you were told about it before the visit.
8. Ratings and complaints. You receive a rating link after each visit. A low rating opens a complaint review, and we contact you within 4 working hours.
9. Liability. We are responsible for loss or damage caused by our negligence or deficiency in service during the visit. We are not responsible for pre-existing faults, power-supply problems, or the brand's manufacturing defects. [CONFIRM: any cap must be reasonable; a term that unreasonably limits our liability to you may be an unfair contract term under the Consumer Protection Act, 2019, s.2(46).]
10. Privacy. See our privacy notice: [link]. Calls through our office number may be recorded.
11. Prices. All prices are shown with GST before you approve them. Nothing is added after you approve, apart from items you approve separately on your own phone.
12. Complaints and disputes. Contact [office number, WhatsApp, email] or our Grievance Officer [name, phone, email]. We acknowledge a complaint within 48 hours and resolve it within one month. These terms are governed by Indian law and the courts at Surat, Gujarat have jurisdiction, but this does not limit your rights under the Consumer Protection Act, 2019, including filing a complaint before the Consumer Commission where you live or work (s.34 and s.35), also online through e-Daakhil.