Terms of Service

These Terms are an agreement between [Legal entity name] (AnsaFlow) and the organization that creates or uses an AnsaFlow workspace, whether it supports the people it serves (its customers, students or members) or is a partner support provider serving other organizations. The person who accepts them confirms that they are authorised to act for the organization.

The agreement consists of these Terms, the Data Processing Agreement (DPA) and any order form. The order form prevails on commercial matters and the DPA on personal data [counsel to confirm order of precedence].

AnsaFlow lets the people you serve (your customers, students or members) and your other contacts raise tickets and exchange messages and attachments with your staff, through a web app, an installable app and a website chat widget. It includes a staff console, routing and assignment, reports, a knowledge base, single sign-on, optional AI features and partner engagements.

We may improve and change the service, but will give notice before materially reducing core features during a paid term. SMS and browser push delivery depend on third parties we do not control. [Service levels and support hours — to be confirmed.]

• People sign in with a mobile number and a one-time code sent by SMS, or through single sign-on from your website. Nobody chats without signing in, on your website too.
• Each person must use their own account and never share a one-time code. Our staff will never ask for one.
• Your administrators control access to your workspace and should remove it promptly when someone leaves.
• You are responsible for activity through your accounts and API keys. Keep secret keys confidential, limit widget keys to your own websites, and tell us promptly at [Security contact email] about suspected unauthorised access.

For the personal data of the people you serve, prospective customers and your other contacts, you are the Data Fiduciary and AnsaFlow is your Data Processor. You are responsible for your obligations under the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 and, while they remain relevant, section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011 [confirm commencement dates with counsel]. In particular, you will:

• Give the people you serve and your other contacts the notice the law requires, and make your own privacy notice available in your app, website and widget.
• Have a lawful basis, such as consent or a legitimate use under section 7 of the DPDP Act, for each purpose.
• Obtain verifiable consent from a parent or lawful guardian before processing a child's data, where required [counsel to confirm any exemptions for educational institutions under the Rules]. AnsaFlow does not verify ages or parental consent.
• Keep contact data accurate. A phone number decides who can sign in and read a ticket, so make sure the numbers you import or send through single sign-on belong to the right person.
• Collect only what you need, and keep sensitive details, such as health or financial information, out of custom fields.
• Publish a contact for data questions, run a grievance process and respond to requests from the people you serve, with our help.
• Make the breach intimations the law requires of a Data Fiduciary, with our assistance.
• Give us only lawful instructions.

When you create an organization on AnsaFlow, you accept these Terms and the Data Processing Agreement (DPA) in the version then in effect. The current DPA version is [version]. We record the version, who accepted it and when.

A partner engagement links an organization with a support-provider organization. Both accept the DPA version recorded on the engagement: the organization when it requests the engagement, and the provider when it accepts it.

• The provider acts as a further processor for the organization. It sees only the tickets routed to it, only while the engagement is active, and may use that data only to work on those tickets.
• The organization remains the Data Fiduciary for the data of the people it serves.
• Commercial terms between the two organizations are for them to agree; AnsaFlow is not a party to them.
• Either organization can pause or end an engagement in the product.

You and your users must not use AnsaFlow to:

• Break any law, including the Information Technology Act, 2000 and rules made under it.
• Send spam, unsolicited bulk messages or marketing to people who have not agreed to receive it.
• Harass or harm anyone, or share content that is unlawful, obscene or harmful to children.
• Upload malware, interfere with the service, or access data or workspaces you are not authorised to see.
• Bypass rate limits, or test our security without our written permission.
• Use one-time codes or SMS for anything other than signing in, or impersonate any person or organization.

We may remove content or restrict access that breaches these rules, and will tell you unless the law prevents it.

AI features are off by default and run only if your administrator turns them on. By turning them on, you instruct us to send message text and related ticket context to the AI providers listed in the DPA, for ticket routing, clarifying questions and reply suggestions.

AI output can be wrong; your staff remain responsible for decisions and replies. You decide whether AI features suit your users, including children, and can turn them off at any time. Usage limits apply.

• Fees: [Fees — per order form].
• Fees exclude GST and other applicable taxes.
• Payment terms: [Payment terms — to be confirmed].
• We will give [Notice period — to be confirmed] notice of fee changes, which apply from your next billing period.
• We may suspend the service if undisputed fees remain unpaid [X days — to be confirmed] after a written reminder.

We own AnsaFlow, including its software, design and documentation, and grant you a non-exclusive, non-transferable right to use it for your organization during the term. You must not copy, resell, reverse engineer or build a competing service from it, except as the law expressly allows.

You own your content and the personal data you provide (Customer Data). You grant us a limited licence to host, copy, transmit and display Customer Data only to provide and support the service, as described in the DPA.

Each party will keep the other's non-public information confidential and use it only for this agreement, except information that is public, already known, independently developed or required by law to be disclosed.

We may suspend access, in whole or in part, where needed to address a security threat, a serious breach of these Terms, non-payment or a legal requirement. We will give notice where practicable and restore access once the issue is resolved.

Either party may end the agreement on [Notice period — to be confirmed] notice, or for a material breach not remedied within [30 days — to be confirmed] of written notice.

Your administrators can export all your data at any time (Settings → Danger zone), including contact lists and ticket history. When you close your account, they can still export it, and cancel, for 30 days [counsel to confirm]; we will then delete Customer Data within one day, and remove it from backups within [Backup retention period — to be confirmed], unless the law requires us to keep it. On request, we will confirm deletion in writing.

We will provide the service with reasonable skill and care. Otherwise, to the extent the law allows, the service is provided as is and as available. We do not promise that it will be uninterrupted or error-free, that every SMS or notification will be delivered, or that AI suggestions will be accurate.

Neither party is liable for indirect or consequential loss, or loss of profits, revenue or goodwill. Each party's total liability is limited to [Liability cap — to be confirmed], except for [exclusions — to be confirmed].

You will indemnify us against third-party claims, penalties and reasonable costs arising from your Customer Data, your instructions, your users' misuse or your obligations as a Data Fiduciary, including notices and parental consent. We will indemnify you against third-party claims that the service infringes their intellectual property rights [scope — to be confirmed].

These Terms are governed by the laws of India. The parties will first try to resolve any dispute through good-faith discussion. The courts at [Governing-law city — to be confirmed] have exclusive jurisdiction.

These Terms are version [version]. Each change gets a new version number. We will notify your administrators at least [Notice period — to be confirmed] before a material change takes effect, and we record the version your organization accepted.

Contact [Legal entity name], [Registered office address], at [Legal notices email]. Our grievance officer is [Grievance officer name], [Grievance officer email].

The Data Processing Agreement (DPA) is between the organization that accepts it, acting as Data Fiduciary (the Customer), and [Legal entity name], which operates AnsaFlow and acts as Data Processor. This page summarises DPA version [version]; the full text is available on request [confirm where the full text will be published].

An organization accepts the DPA when it is created. For a partner engagement, the Customer accepts the DPA version recorded on the engagement when it requests it, and the provider when it accepts it. AnsaFlow records the version, who accepted it and when. The DPA prevails over the Terms of Service on the processing of personal data.

AnsaFlow processes Customer Personal Data only to provide its support service to the Customer: sign-in, the website widget, ticket routing and assignment, delivery of messages, attachments and notifications, malware scanning, service reports and, only if the Customer enables them, AI routing and reply suggestions.

Processing lasts for the term of the Terms of Service and ends when the data has been returned or deleted. AnsaFlow acts only on the Customer's documented instructions: the Terms, the DPA and the settings its administrators choose in the product.

Data principals: the people the Customer serves (its customers, students or members), including children under 18 where it serves them; their parents or guardians, where involved; prospective customers and website visitors, including widget guests; and the Customer's staff as they appear in its workspace.

Personal data: names, phone numbers and reference numbers; fields the Customer adds, such as groups, plans and dates; messages and attachments; ticket metadata, internal notes and feedback ratings; staff activity records; guest names; single sign-on details; push-subscription endpoints; and one-time-code records (stored hashed), IP addresses, security logs and audit records.

AnsaFlow will:

• Process Customer Personal Data only on the Customer's documented instructions.
• Give access only to personnel who need it and are bound by confidentiality.
• Maintain reasonable security safeguards, including the measures summarised below.
• Give [X days — to be confirmed] notice before adding or replacing a sub-processor, and let the Customer object.
• Pass on requests and grievances from data principals, and help the Customer respond to requests for access, correction, completion, updating, erasure and nomination.
• Notify the Customer of a personal data breach without undue delay, and within [X hours — confirm], and help with its intimations to the Data Protection Board of India and affected individuals.
• Let the Customer's administrators erase a person's data themselves, export all its data at any time, and, when it closes its account, export and cancel for 30 days [counsel to confirm]; then delete the data within one day, unless the law requires it to be kept.
• Provide the information needed to show it meets the DPA, and allow reasonable audits.
• Not sell Customer Personal Data, or use it for advertising, AI model training or any purpose of its own.
• Not use children's data for tracking, behavioural monitoring or targeted advertising.

When the Customer engages a partner support provider, it instructs AnsaFlow to make the tickets it routes to that partner available to the partner's staff. The partner accepts the DPA version recorded on the engagement and acts as a further processor for the Customer.

The partner sees only the tickets routed to it, only while the engagement is active. It may use that data only to work on those tickets, on the Customer's instructions, and must keep it confidential and secure.

AnsaFlow uses the following sub-processors to run the service.

AnsaFlow will give advance notice before adding or replacing a sub-processor, as described above.

Some sub-processors process data outside India. AnsaFlow will not transfer Customer Personal Data to a country restricted by the Central Government under section 16 of the DPDP Act. The Customer can limit transfers by choosing an India-based SMS provider and keeping AI features off.

Security measures include encryption in transit; access controls by organization, role and ticket; hashed one-time codes and keys; malware scanning of attachments; time-limited download links; audit logs; encrypted backups [confirm before publication]; and least-privilege access for AnsaFlow personnel. These measures are described without any claim of certification.

Liability under the DPA follows the limits in the Terms of Service [Liability cap — to be confirmed]. The DPA lasts as long as the Terms and continues while AnsaFlow holds Customer Personal Data. New versions are notified to administrators [X days — to be confirmed] in advance.