Terms of Service

These Terms are a contract between Flincbyte [TODO: full legal name, e.g. “Flincbyte Technologies Private Limited”] (“Flincbyte”, “we”) and the business that creates a connectotp account (“Customer”, “you”). They are an electronic record under Section 10A of the Information Technology Act, 2000, and are accepted when you create an account or use the API.

connectotp is for business use only. The person accepting these Terms confirms they are 18 or older and authorised to bind the Customer. The Privacy Policy and the Data Processing Addendum (“DPA”) form part of these Terms.

connectotp is an HTTPS API that delivers one-time passwords (OTPs) that you generate to mobile numbers in India. With the “smart” channel we try WhatsApp first, and if the message isn’t delivered within about 12 seconds we send the same code by SMS. You can also choose WhatsApp-only or SMS-only.

You generate the code, and you decide whether a code the user types is correct. We only deliver messages and report delivery; we do not verify anyone’s identity.

Delivery depends on telecom operators, DLT systems and Meta, which are outside our control, so we do not guarantee that any particular message is delivered or how fast. No uptime or service-level commitment applies unless it is in a signed Enterprise agreement.

Keep your secret key confidential and use it only from your servers, never in a browser or mobile app. You are responsible for all activity under your account and keys.

Tell us at once at hello@connectotp.com if you suspect a key has been compromised. We may rotate or disable keys to protect you or the service.

You may send only verification and one-time-password messages to people who asked for them. You must not:

• Send promotional, marketing or unrelated content through the OTP templates.
• Send messages to numbers that didn’t request a code, or generate artificial traffic (including SMS pumping).
• Break the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 or DLT requirements, including the rules on registered headers, templates and whitelisted URLs and call-back numbers.
• Break the WhatsApp Business Messaging and Commerce Policies.
• Break the IT Act, 2000, the DPDP Act, 2023 or any other applicable law, or send unlawful, deceptive or harmful content.
• Get around rate limits, spend caps or fraud controls, or probe or disrupt the service.
• Reverse engineer the service, or resell it without a written agreement with us.

Operators and Meta may block messages that don’t comply. We may refuse or stop any message we reasonably believe breaks this section.

For the personal data of the people you send OTPs to, you are the Data Fiduciary and we are your Data Processor under the DPDP Act. You are responsible for giving them notice and having a valid basis (consent or a legitimate use) to process their numbers.

The DPA sets out how we process that data on your behalf.

By default, SMS goes out on connectotp’s DLT-registered headers and templates.

On Enterprise you can use your own header. That requires your own Principal Entity registration on a DLT platform, and you are responsible for the accuracy of what you register.

• connectotp is prepaid. You buy credit packs at the prices on our pricing page. Prices are exclusive of GST, which is charged at the applicable rate (currently 18%). We issue GST-compliant tax invoices.
• Usage is deducted per message: SMS at your pack’s per-SMS rate; WhatsApp at ₹0.18 per message; “smart” at ₹0.22 flat per OTP request, whichever channel delivers.
• Messages our fraud controls block before sending are not charged.
• Credits are valid for 12 months from purchase and then expire. There is no monthly fee.
• Credits are non-refundable and non-transferable, except where the law requires a refund or we end these Terms without cause, in which case we refund unused, unexpired credits.
• We may change prices with 30 days’ notice. Credits you have already bought keep their purchase price.
• Spend caps and low-balance alerts are tools we provide; you remain responsible for usage under your account.

We may suspend the service, with notice where practicable, if you breach these Terms, if your usage threatens the security or integrity of the service, or if a regulator, operator or court requires it.

You may close your account at any time. We may end these Terms on 30 days’ notice, or immediately for a material breach that isn’t fixed within 7 days of notice.

After termination, API access stops and data is deleted as described in the DPA and the Privacy Policy. Sections 9 to 14 survive termination.

We own the service, the API, our documentation and the brand. You own your data and content.

If you give us feedback, we may use it freely.

Each side will keep the other’s non-public information confidential and use it only for this agreement.

To the extent the law allows, the service is provided “as is” and “as available”. We make no warranty of merchantability, fitness for a particular purpose, or uninterrupted or error-free operation.

To the extent the law allows, neither side is liable for indirect, incidental, special or consequential loss, or for lost profits, revenue or goodwill.

Our total liability under these Terms is limited to the fees you paid us in the 12 months before the event giving rise to the claim.

These limits don’t apply to fraud, wilful misconduct, your payment obligations, or your indemnity under section 12.

You will indemnify Flincbyte against third-party claims, regulatory penalties and reasonable costs arising from:

• Your messages.
• Your breach of section 4.
• Your obligations as Data Fiduciary.
• Any misuse of your API keys.

Neither side is liable for delay or failure caused by events beyond its reasonable control. These include operator or Meta outages, network failures, government or regulatory directions, natural disasters and civil unrest. Payment obligations are not excused.

These Terms are governed by the laws of India.

Disputes will first be negotiated in good faith for 30 days. If they aren’t resolved, they go to arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996.

The seat of arbitration is [TODO: city, e.g. Bengaluru] and the language is English. Subject to arbitration, the courts at [TODO: city, e.g. Bengaluru] have exclusive jurisdiction, including for interim relief.

We may update these Terms. We will give you 30 days’ notice of material changes by email or in the dashboard. Continuing to use the service after that means you accept the change.

These Terms, the Privacy Policy, the DPA and any signed Enterprise agreement are the entire agreement; a signed Enterprise agreement prevails if they conflict.

You may not assign these Terms without our consent. If a provision is unenforceable, the rest still applies. Not enforcing a right is not a waiver of it.

We send notices to your account email; you send them to us by email.

Grievance Officer: [TODO: name of Grievance Officer], grievance@connectotp.com, [TODO: registered office address].

We acknowledge complaints within 24 hours and resolve them within 15 days, as required by the IT Intermediary Rules, 2021.