Terms of Service

These Terms of Service (version 0.9.0-draft, last updated 2026-10-02) are a binding contract between you ("you", "user") and Zdefence — sole proprietorship of Nilkanth Thanth, GSFC University, Vadodara, Gujarat, India, India ("Zdefence", "we", "us"). By accessing the website, joining the waitlist, creating an account, or using the mobile application you accept these terms. If you do not accept them, do not use the service.

If you accept on behalf of an organisation (for example a small business or team), you represent that you are authorised to bind that organisation and 'you' includes that organisation. Future business use is governed additionally by the Data Processing Addendum (/legal/dpa) and Service Level Agreement (/legal/sla) once offered — both are placeholders today and must not be presented as executed contracts.

These terms are implementation drafts for legal review (LEGAL REVIEW REQUIRED). They do not waive mandatory consumer, privacy or product-safety rights in your country: where this contract is less protective than your local law, your local law prevails.

You must be old enough to enter a binding contract in your country and meet the minimum age in /legal/age-policy. [PLACEHOLDER — minimum age to be confirmed with the children's-data decision — OWNER INPUT REQUIRED. Current website has no age gate; product copy references families/kids, so this is blocking.]

Where parental consent is required (for example EU GDPR Art.8 under-16, US COPPA under-13 with verifiable parental consent, India DPDP s.9, China PIPL under-14 guardian consent), the account or safety-session cannot be created without it. We may ask for the minimum information needed to verify age/consent and delete it once verified.

Corporate/team use: each end user must individually accept these terms and the Privacy Policy; the organisation is responsible for its users' compliance.

Website accounts use Clerk (email + verification, password reset, optional MFA). You must provide accurate information, keep credentials confidential, use a unique strong password with a password manager, enable MFA where offered (mandatory for administrators), and notify us immediately of unauthorised use via security@zdefence.com.

Session controls: expiry, invalidation on password change and on account closure, device/session management, brute-force throttling, risk-based step-up (new device/country/IP, velocity, recent password change, sensitive action). We log authentication events without storing passwords.

You are responsible for activity under your account. We may suspend for material breach after notice where the law requires it. Account enumeration is mitigated: signup and password-reset responses do not reveal whether an email exists where that would create risk.

Today the service is a marketing website plus an early-access waitlist. Joining reserves a queue position (slot number + timestamp); it does not guarantee a date, access, price or feature set. 'Disclose soon' pricing in src/lib/pricing.ts is not an offer. No payment is taken, no subscription is created, and no checkout disclosures are triggered.

Instrument panels on this site are deterministic client-side simulations (docs/reference-analysis.md §6), not live product telemetry. Threat statistics shown (for example '1,284,930 threats blocked') are illustrative and tracked in claims-registry.json — they must be substantiated or removed before launch (currently FAIL).

Once released, the app provides: multi-mode scanning (Quick/Deep/Complete/Custom) across nine modules; device-side firewall (monitor/strict/lockdown) with threat-intel blocklists; WireGuard full-tunnel VPN with kill-switch/split-tunnel; URL inspection (VirusTotal/Safe Browsing/AI assessment with redirect-chain exposure); live IOC feeds (URLhaus/ThreatFox/OpenPhish/PhishStats/Feodo/MalwareBazaar); password manager (AES-256-GCM, k-anonymity breach checks); secure vault (AES-256-GCM, hardware-backed keys, opt-in backup); privacy shield (clipboard/camera/mic monitoring with auto-clear); zero-trust device posture; Her Safety Hub (SOS, live location sessions, journeys, guardians, safe places).

Beta/early-access features may change, break or be withdrawn. Availability, maintenance windows and support targets are described in the SLA once offered (currently NOT APPLICABLE — do not publish uptime guarantees we cannot measure).

Human confirmation is required for destructive actions (uninstall, vault deletion, SOS dispatch confirmation). Offline behaviour: on-device engine continues locally; sync resumes on connectivity.

We grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the service for its intended personal or authorised business purpose, subject to these terms and the Acceptable Use Policy. No ownership is transferred. You may not copy, modify, distribute, reverse engineer or circumvent technical measures except where the law says that restriction is unenforceable (for example EU Software Directive interoperability, or fair-use/security-research exceptions as narrowed by the Vulnerability Disclosure Policy).

Feedback you provide may be used without compensation unless agreed otherwise. Open-source components remain under their licences (see /legal/third-party-notices); nothing here removes required notices.

You retain ownership of content you provide (waitlist details, contact messages, vault items, safety contacts, feedback). You grant us only the narrow licence needed to provide the service (store, encrypt, transmit, display to you/your guardians where you direct). The website has no public UGC surface; the User Content Policy (/legal/content-policy) and Community Guidelines are dormant until a community/marketplace feature ships.

Vault content is end-encrypted; we cannot read it. Safety-session location is shared only with guardians you choose, only during an active session. AI prompts you submit to future AI features are processed only to provide the feature, per the AI Policy.

Incorporates the Acceptable Use Policy. Prohibited: using the service against devices you do not own or have permission to administer; probing/scanning our systems without written authorisation; circumventing authentication, rate limits or security controls; committing fraud, harassment or crime; abusing SOS/safety features (false emergencies); reverse engineering beyond legal allowances; violating export/sanctions rules. Consequences: warning, suspension or termination for material breach, with notice and remedy opportunity where required; repeat-infringer handling for copyright where relevant.

AI assists classification and phishing assessment as decision support. Output can be wrong; it is not a guarantee of safety, accuracy or unbiasedness — we claim no accuracy percentages. Where you interact with an AI system we disclose it (EU AI Act Art.50 from 2 Aug 2026). Machine-readable marking of synthetic content (Art.50(2)) applies to generative outputs; grace for pre-2-Aug-2026 systems to 2 Dec 2026. See the AI Policy for providers, payload limits, retention, human review, training non-use, and deletion. [LEGAL REVIEW REQUIRED on high-risk classification.]

The service integrates Clerk, Supabase and hosting/CDN (see Subprocessors). Threat feeds, Have I Been Pwned, and (once integrated) AI providers, payment/tax providers and email providers each have their own terms; we are not responsible for their services, but we remain responsible for our choice and configuration of them. No third-party script may be added without a vendor review and tracker-gate pass.

Beta features are provided as-is for testing. We aim for high availability but make no uptime commitment until the SLA is published. Maintenance may cause downtime; we give advance notice where feasible. Support: support@zdefence.com; response targets are in the SLA once offered. Security issues: security@zdefence.com (see Vulnerability Disclosure Policy).

No paid plan is offered today. When paid plans launch, the Pricing & Billing Terms, Cancellation Policy and Refund Policy govern. Before you pay we will disclose: product/service, total price, currency, whether tax/VAT/GST/sales tax is included or added, billing interval, renewal behaviour and price, trial duration and conversion, cancellation method, refund rules, delivery/access conditions, support contact and legal links. The payment button will clearly state the paid obligation (for example 'Pay ₹X / month, renews automatically until cancelled'). Prices are handled by a qualified payment/tax provider (none integrated today — PLACEHOLDER); we do not build custom global tax logic and never store raw card data or CVV.

Cancel as easily as you subscribed: in-app/web control, no forced calls, no retention dark patterns. Access continues to the end of the paid period; confirmation states the end date; no further charge. Refunds: statutory rights per your country are never excluded; voluntary goodwill window [PLACEHOLDER — decide, e.g. 14 days where not materially used]; duplicates, post-cancellation charges and undelivered service are refunded. See Cancellation and Refund Policies for the engine (trial/conversion/renewal/failed-payment/grace/downgrade/upgrade/pause/termination).

You may stop using and delete your account at any time via /privacy-center (self-service, confirmation-gated, session revocation on closure). We may suspend/terminate for material breach, fraud, safety abuse or legal requirement, with notice and appeal where required. On termination, access ends, subscriptions stop renewing per the Cancellation Policy, and data is deleted per the Privacy Policy Section 17 (primary, replicas, storage, CRM, email, support, analytics, marketing/suppression, AI/vector, caches, logs, backups lifecycle, exports, third parties). Consent proof and legal-hold records are retained as disclosed.

The service improves security posture but cannot guarantee prevention of all threats, malware, phishing, breaches or losses. Scores, verdicts and recommendations are advisory. No security product is 100% effective. Nothing here excludes liability that cannot lawfully be excluded (statutory consumer guarantees, product-safety duties, privacy rights). Subject to that, the beta is provided without warranties beyond those the law implies. [LEGAL REVIEW REQUIRED on warranty disclaimer per market.]

Regulated-product note: this is not financial, health, insurance, legal or gambling advice; SOS/safety features are not a substitute for emergency services — always contact local emergency numbers first. See Disclaimer and Regulated-Product Disclaimer.

[LEGAL REVIEW REQUIRED — blocking.] No cap is agreed until counsel confirms enforceability per market (EU/UK unfair-terms, Australian consumer guarantees, Indian consumer law, Brazilian CDC, etc.). Draft position (not final): to the maximum permitted, we are not liable for indirect/consequential loss; direct liability is limited as agreed at paid launch. You indemnify us for misuse in breach of these terms, to the extent the law permits.

Confidential information received through the service must not be disclosed except to provide the service or as required by law. Export/sanctions: the service (including encryption, VPN and threat-intel technology) may be subject to export-control and sanctions rules. You must not use it in/for embargoed destinations, restricted parties or prohibited end-uses. Geographic availability is set by documented legal/product requirements, never by discriminatory assumption. [LEGAL REVIEW REQUIRED on encryption-export and sanctions applicability before global VPN distribution.]

Governing law: India [PLACEHOLDER — must match the legal entity and be legally reviewed — OWNER INPUT REQUIRED]. Nothing here removes mandatory consumer protections, the right to bring proceedings in your local courts where the law preserves it, or the right to complain to your regulator. Dispute steps: contact support/legal first; good-faith resolution; then the forum stated in the governing-law clause. Force majeure applies where appropriate. Notices: legal@zdefence.com and your account email; changes per Section 19.

We version these terms (legal-versions.ts, append-only). Material changes are announced before they take effect; where required we ask for renewed acceptance (clickwrap with un-prechecked box, separate from marketing consent, storing terms version + timestamp + source + text reference — never a full copy per user). Continued use after the effective date is acceptance where the law permits it. Prior versions are preserved.

Legal: legal@zdefence.com. Privacy: privacy@zdefence.com. Security: security@zdefence.com. Support: support@zdefence.com. Zdefence — sole proprietorship of Nilkanth Thanth, GSFC University, Vadodara, Gujarat, India, India. These terms plus incorporated policies are the entire agreement for the service. If any provision is unenforceable, the remainder continues. No waiver by delay. Assignment only with consent except corporate reorganisation with notice.