Terms of Service

The parties, and what you are agreeing to

This agreement is between Mallah Software Services Private Limited (CIN U62011MH2026PTC475385, registered office Plot No. 347, Flat No. 301, Status-2 CHSL, Santacruz (East), Mumbai 400055, Maharashtra, India) and the organisation that subscribes to CertNotify, Regulane, Lawzer or MADBOT. In these terms we are “Mallah Software” and that organisation is the “Customer”.

You accept these terms by subscribing, by paying an invoice, or by using the product — whichever happens first. If you are accepting on behalf of a company, LLP, firm or trust, you are confirming that you have the authority to bind it. If you do not, do not accept them.

Individual people who log in are “Users”. Users are bound by the acceptable-use rules in section 5, but the contract is with the Customer, and the Customer answers for what its Users do.

What we will do

• Provide the product the Customer has subscribed to, at the plan level it has paid for, for the subscription term.
• Keep the statutory and technical content in the product current to the best of our ability, and correct it when it is wrong.
• Keep the Customer’s data available to it throughout the term, and exportable on the way out.
• Apply the security measures described on the security page, and tell the Customer about a breach affecting its data without waiting to be asked.
• Answer support requests within the times on the plan the Customer bought.

We may change how a product works, add to it, or retire a feature. If we remove something material that the Customer is relying on, we will give at least thirty days’ notice by email to its account contacts, and the Customer may cancel and take a pro-rata refund of the unused term.

What the software does not do

Specifically, and without dressing it up:

• Lawzer models the standing statutory position so a practice can plan against it. It does not file anything, does not log into MCA V3, GSTN, TRACES or any other government portal on the Customer’s behalf, and cannot waive or argue down a penalty. Due dates and penalty figures are planning estimates and the product labels them as such.
• Regulane detects and scores regulatory change and collects evidence. Whether a change applies to the Customer, and what to do about it, remains a judgement for the Customer’s own advisers.
• CertNotify reports what it can observe from the public internet and from what the Customer connects to it. A clean report is not a warranty that the Customer is secure, and an absence of findings is not an absence of risk.
• MADBOT acts on the Customer’s website within the autonomy level and the guardrails the Customer sets. The Customer remains the publisher of anything that goes live and is responsible for its accuracy, its advertising compliance and its consequences.

The Customer is responsible for its own statutory compliance. Using our software does not transfer that to us, and officer liability under the Companies Act, the Income-tax Act or any other statute stays exactly where the statute puts it.

Fees, taxes and invoicing

Prices are as published on the relevant product’s own website on the day of purchase, in Indian rupees unless stated otherwise. Subscriptions are billed in advance, monthly or yearly as chosen.

The company has not been allotted a GSTIN. Until it is registered, invoices are raised without GST and are not tax invoices, and no input tax credit arises on them. Once registration is granted we will begin charging GST at the applicable rate on future invoices, and the price shown at renewal will say so. Any other statutory levy that applies is the Customer’s to bear.

An invoice not paid within fifteen days of its due date lets us suspend access after seven days’ written notice. We would rather email you than switch you off, and we will do the former first.

Cancellation and refunds are dealt with separately, on the Refunds & Cancellation page, which forms part of these terms.

Acceptable use

The Customer and its Users must not:

• break any Indian law using the product, or use it to help someone else do so;
• upload content that infringes another person’s intellectual property, or that is obscene, defamatory, or unlawful on its face — the categories in rule 3(1)(b) of the IT Rules, 2021 apply here in full;
• probe, scan or load-test our systems without written permission, or try to get at another Customer’s data;
• resell, sublicense or white-label the product without a written agreement saying they may;
• use CertNotify to scan infrastructure they do not own or have documented authority to test;
• use MADBOT to send unsolicited bulk email, to impersonate anyone, or to publish claims about a business that are not true;
• attempt to reverse-engineer the software, except to the extent Indian law says a contract cannot stop you.

We may suspend an account immediately where continuing would break the law, endanger other Customers, or where an authority orders it. Otherwise we give notice and a chance to fix it. Where content has to come down, we act within the timelines in rule 3(1)(d) and 3(2)(b) of the IT Rules, 2021, and we log what we removed and why.

Who owns what

We own the software, the statutory rule catalogues, the models, the interfaces and everything else we made. The Customer gets a non-exclusive, non-transferable right to use it for the term, and nothing more.

The Customer owns its own data. Everything it uploads, and everything the product generates from it, remains the Customer’s and stays the Customer’s after the agreement ends. We claim no licence over it beyond what is needed to run the service for the Customer.

If the Customer tells us how to make the product better, we may act on it without owing anything for the suggestion. That is the only thing in this section that runs in our favour, and we mention it so it is not a surprise.

Personal data

Where we process personal data for our own purposes — an enquiry, an account contact, a server log — we are a Data Fiduciary and the Privacy Policy governs it.

Where we process personal data that the Customer has put into its workspace, the Customer is the Data Fiduciary and we are a Data Processor acting on its instruction. That arrangement is required by section 8(2) of the DPDP Act, 2023 to be under a valid contract, and these terms are that contract. We will process such data only to provide the service, keep it confidential, apply the security measures on the security page, assist the Customer with a Data Principal’s request, notify the Customer of a breach affecting its data without undue delay, and delete or return it on termination as section 9 below sets out.

Liability

Nothing here limits liability for fraud, for wilful misconduct, or for anything Indian law does not permit to be limited.

Subject to that, our total liability for all claims in any twelve-month period is capped at the fees the Customer actually paid us in the twelve months before the claim arose. We are not liable for indirect or consequential loss, and specifically not for a statutory penalty, interest, late fee or prosecution imposed on the Customer by an authority — including one that the Customer says it incurred because our software showed the wrong date. That is why every date in Lawzer carries its statutory reference and is labelled an estimate: so it can be checked before it is relied on.

The products are provided as they are. We do not warrant that they will be uninterrupted or error-free, and where a plan carries a service-level commitment, the credits in that commitment are the remedy for missing it.

Term, termination and what happens to the data

The agreement runs for the subscription term and renews unless cancelled. Either side may terminate for a material breach the other has not fixed within thirty days of being told about it in writing. We may terminate immediately for non-payment after the notice in section 4, or where required by law.

On termination the Customer may export its data for sixty days. Registers, reports and evidence export to PDF and CSV. After sixty days we delete Customer data from live systems, and from backups within a further thirty days, except anything we are required to keep — and if that applies we will say what and why.

Force majeure

Neither side is liable for a failure caused by something genuinely outside its control: an act of God, war, civil unrest, a government order, a nationwide network or power failure, or the failure of a government portal we depend on. We will tell the Customer what has happened and what we are doing. If it lasts more than sixty days, either side may terminate and we will refund the unused term.

Disputes

Talk to us first, at contact@mallahsoftware.com. Most things end there and it costs neither side anything.

If that fails, a dispute is referred to arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996. The seat is Mumbai, the proceedings are in English, and each side bears its own costs unless the arbitrator says otherwise. This agreement is governed by the laws of India, and the courts at Mumbai have exclusive jurisdiction subject to the arbitration clause.

None of this displaces a consumer’s right to approach a Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019, or to use the free routes on the grievance page.

The usual closing clauses

• Changes. We may amend these terms. Material changes are emailed to account contacts at least thirty days ahead and take effect at the next renewal; a Customer that does not accept them may cancel before then and take a pro-rata refund.
• Assignment. Neither side may assign without the other’s written consent, except to a successor of substantially the whole business.
• Severability. If a clause is unenforceable, the rest stands.
• Entire agreement. These terms, the Refunds & Cancellation page, the Privacy Policy and any order form are the whole agreement, and replace anything said in a sales conversation.
• No waiver. Not enforcing something once does not mean giving it up.
• Notices. To us at the registered office or contact@mallahsoftware.com; to the Customer at its account contact addresses.