Terms & Conditions

3.1 Eligible Users

Access to the Service is restricted exclusively to:

• Organizations that own, operate, or are contracted to audit online proctoring or assessment platforms
• Certified security researchers and penetration testers holding a valid written authorization from the platform owner
• QA professionals and software engineers engaged by a platform owner under a professional services agreement
• Academic institutions conducting approved cybersecurity research with institutional ethics board approval
• The Company itself, for internal demos, sales demonstrations, and product development

3.2 Expressly Excluded Users

3.3 Written Authorization Requirement

Prior to activating any testing or QA features, Clients must provide written proof of authorization from the target platform owner. This includes: (a) name of the platform, (b) scope of permitted testing, (c) duration of authorization, and (d) authorized signatory from the platform organization. The Company reserves the right to suspend access if authorization cannot be verified.

3.4 Age Verification

By registering, you confirm you are at least 18 years of age and legally competent to enter into a binding contract. The Company does not knowingly onboard minors. Under the Digital Personal Data Protection Act, 2023, children's data (persons under 18) is subject to special protections and parental/guardian consent requirements, which the Company cannot facilitate in a B2B context.

5.1 Absolutely Prohibited Activities

• Using the Service without prior written authorization from the target platform owner
• Use by individual students, candidates, or job seekers during any examination, test, or interview
• Facilitating cheating, impersonation, or unauthorized assistance in any academic or recruitment assessment
• Reverse-engineering, selling, sub-licensing, or redistributing the Service or its outputs
• Using the Service to access, alter, or exfiltrate candidate personal data without authorization
• Deploying the Service against any platform without a signed authorization agreement

5.2 Specific Academic & Recruitment Prohibition

5.3 Criminal Liability Warning

Unauthorized use may attract liability under:

• Public Examinations (Prevention of Unfair Means) Act, 2024 — imprisonment up to 3-10 years and fines
• Bharatiya Nyaya Sanhita (BNS) 2023, Section 318 — cheating, punishable with imprisonment up to 7 years
• Information Technology Act, 2000, Section 66D — cheating by personation using computer resources
• IT Act 2000, Section 43 & 66 — unauthorized access to computer systems

5.4 Zero-Tolerance Enforcement

Upon receiving credible information or attaining "actual knowledge" (as defined under Section 79 of the IT Act, 2000) of unauthorized use, the Company will immediately suspend the account, preserve logs, and may report the incident to the relevant law enforcement authority and the institution or organization affected.

6.1 Reporting Vulnerabilities Found During Testing

If a Client discovers a critical vulnerability in a third-party platform during authorized testing, they must:

• Report the finding to the platform owner in writing within 72 hours of discovery
• Provide a detailed technical write-up including proof-of-concept, severity rating, and suggested remediation
• Not publicly disclose the vulnerability for a minimum of 90 days (standard responsible disclosure window) unless the platform owner waives this
• Notify the Company at security@ghostai.one for record-keeping purposes

6.2 Vulnerabilities in GhOst AI Itself

If you discover a security vulnerability in the GhOst AI platform itself, report it to security@ghostai.one. The Company will acknowledge within 48 hours and aim to resolve critical issues within 30 days. The Company follows a coordinated vulnerability disclosure framework consistent with CERT-In guidelines.

7.1 Intermediary Status

GhOst AI operates as an "intermediary" as defined under Section 2(1)(w) of the Information Technology Act, 2000. The Company does not initiate, select, or modify data transmissions generated by Clients during authorized security testing.

7.2 Due Diligence Obligations

The Company maintains safe harbour under Section 79 of the IT Act by:

• Publishing and enforcing these Terms prohibiting unauthorized use
• Requiring written authorization from platform owners before activating testing features
• Maintaining access logs for a minimum of 180 days as required by applicable rules
• Cooperating with law enforcement and designated authorities upon lawful request
• Appointing a Grievance Officer (see Section 8)

7.3 Loss of Safe Harbour

Safe harbour protection shall not apply if the Company has actual knowledge of ongoing misuse and fails to act expeditiously. Upon receiving a valid notice of misuse (including from CERT-In, a law enforcement authority, or an affected institution), the Company will act within 36 hours to disable access.

7.4 Takedown & Notice Procedure

To report misuse or request takedown, send a written notice to admin@ghostai.one containing: (a) identity of the complainant, (b) nature of the complaint, (c) evidence of misuse, and (d) relief sought. The Company will acknowledge within 24 hours and resolve within 15 days per Rule 4 of the IT (Intermediary Guidelines) Rules, 2021.

9.1 Data Fiduciary Status

The Company acts as a "Data Fiduciary" as defined under Section 2(i) of the Digital Personal Data Protection Act, 2023 ("DPDP Act") with respect to personal data collected from Client representatives during onboarding and account management.

9.2 Lawful Basis for Processing

The Company processes personal data on the following lawful bases under the DPDP Act:

• Consent: Freely given, specific, informed, and unambiguous consent obtained at registration
• Contractual Necessity: Processing necessary to fulfil the B2B service agreement
• Legitimate Interest: Security logging, fraud prevention, and service integrity
• Legal Obligation: Compliance with lawful orders from competent authorities

9.3 Data Principal Rights

Client representatives (as Data Principals) have the right to:

• Access personal data held by the Company (Section 11, DPDP Act)
• Correct inaccurate or incomplete data (Section 12, DPDP Act)
• Erasure of data no longer necessary for the stated purpose (Section 12, DPDP Act)
• Nominate a representative for data rights in case of death or incapacity (Section 14, DPDP Act)
• Grievance redressal through the Grievance Officer and, thereafter, the Data Protection Board of India

9.4 Data Breach Notification

In the event of a personal data breach, the Company shall notify affected Data Principals and the Data Protection Board of India within 72 hours of becoming aware, in the manner prescribed under the DPDP Act, 2023.

9.5 Data Storage & Localisation

Primary data for Indian Clients is stored on servers located within India. Where data is processed by third-party sub-processors outside India (e.g., AI model inference providers), the Company ensures adequate contractual safeguards, including standard contractual clauses, consistent with DPDP Act provisions on cross-border data transfer. Clients may request details of sub-processors by writing to the Grievance Officer.

10.1 B2B Subscription Agreements

Commercial access to the Service is governed by a Master Service Agreement ("MSA") executed between the Company and the Client organization. Pricing, billing cycles, and payment terms are set forth in the applicable Order Form.

10.2 Auto-Renewal

Subscriptions auto-renew at the end of each billing period unless the Client provides written notice of non-renewal at least 30 days before the renewal date. The Company will send a pre-renewal reminder at least 7 days prior.

10.3 RBI Recurring Payment Compliance

For Indian payment methods, the Company complies with the Reserve Bank of India's framework on recurring payments:

• e-Mandate Registration: Clients will complete e-mandate registration per RBI circular DPSS.CO.PD No.1210/02.14.003/2019-20
• Pre-Debit Notification: Clients will receive a notification at least 24 hours before each auto-debit
• UPI AutoPay: Where payment is via UPI, UPI AutoPay mandate rules apply and Clients may revoke the mandate at any time through their UPI app

11.1 B2B Refunds — Master Service Agreement

Refunds for enterprise Clients are primarily governed by the executed MSA. In the absence of specific MSA terms, the following apply.

11.2 7-Day Satisfaction Window for New Clients

New organizational Clients who have not previously subscribed may request a full refund within 7 calendar days of their first payment if the Service was not delivered as described. Requests must be submitted to billing@ghostai.one with reasons stated.

11.3 Refund Eligibility Criteria

• Service was materially unavailable for more than 72 continuous hours due to Company-side failure
• Core features advertised were not functional at the time of purchase
• Client cancels within the 7-day window (first subscription only)

11.4 Non-Refundable Situations

• Cancellations after 7 days from first payment (unless MSA provides otherwise)
• Partial usage of a billing period
• Suspension or termination due to policy violation by the Client

11.5 Consumer Forum Rights

Without prejudice to arbitration rights under Section 13, individual Client representatives who are consumers under the Consumer Protection Act, 2019 retain the right to approach the District Consumer Disputes Redressal Commission having jurisdiction. The Company will cooperate with any such proceedings.

14.1 Informal Resolution

Parties shall first attempt to resolve any dispute through good-faith negotiation for a period of 30 days from written notice of the dispute.

14.2 Arbitration Clause

If the dispute is not resolved informally, it shall be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act, 1996 (as amended by the 2019 Amendment Act):

• Seat & Venue: Bangalore, Karnataka, India
• Number of Arbitrators: Sole Arbitrator mutually appointed by the parties
• Language: English
• Governing Rules: Arbitration and Conciliation Act, 1996
• Award: Final and binding on both parties

14.3 Emergency Relief

Either party may seek urgent interim or injunctive relief from courts in Bangalore, Karnataka, without waiving the right to arbitration.