0. Status
This is a drafted document, not legal advice, and it has not been reviewed by a qualified lawyer.
It was written against what the software actually does, which makes it a far better starting point than a template — but the enforceability of a limitation of liability, the validity of an arbitration clause, and the correct consumer-law carve-outs are all jurisdiction-specific questions this document cannot settle. Have a lawyer qualified in India review it before you rely on it commercially.
Several clauses below describe controls the platform does not yet enforce in code. Those are marked. A term you do not enforce is a term a regulator will read against you, so the gap register in the project book, chapter 13, tracks each one.
1. Who we are and what this covers
Nebulora ("the Service", "the Platform") is a lead-generation and outreach CRM operated by the NebulaForge Team ("NebulaForge", "we", "us"), reachable at the address in section 20.
These Terms are a binding agreement between NebulaForge and the person or entity that registers an account ("you", "the Customer"). By registering, activating an account, or using the Service you accept them. If you do not accept them, do not use the Service.
These Terms cover business use only. The Service is sold to web agencies, freelancers and businesses. It is not offered to consumers for personal use, and it is not offered to anyone under 18.
2. Eligibility and authority
You confirm that you are at least 18 years old, that you have the legal capacity to enter this agreement, and that where you register on behalf of a company you have authority to bind that company.
Not currently enforced in code: there is no age gate or entity verification at registration.
3. What the Service does
The Service:
- finds businesses by city and niche through third-party data connectors;
- fetches and grades a business's public website against automated checks, and compares it with nearby businesses;
- generates a concept homepage ("Demo Site") for a prospect from public information;
- drafts and sends outreach by email through your own mailbox, and prepares WhatsApp and LinkedIn messages for you to send by hand;
- reads your own mailbox over IMAP to capture replies to that outreach;
- re-checks tracked domains on a schedule and reports changes;
- provides an embeddable website-checker widget you may place on your own website.
The Service is provided on an "as is" and "as available" basis. We may add, change or remove features.
4. Accounts and security
You are responsible for everything done under your account. Keep your password and any app passwords confidential and tell us promptly if you suspect unauthorised access.
Accounts carry roles — MEMBER, PARTNER and ADMIN. ADMIN accounts can see and act on other accounts' billing, plans and audit trail. Do not grant ADMIN to anyone you would not trust with that access.
Team accounts (ADMIN and PARTNER) run without credit metering, without the sending warm-up ramp and without the daily send cap. That is a deliberate trust decision, not an oversight: those accounts send as the company domain and their sending behaviour affects the company's own deliverability. Use it accordingly.
5. Plans, credits and payment
| Free | 30 credits granted once per account lifetime. This never refills. Google Places connector only, capped lead volume, no website grading, contact details masked |
| Pro | ₹1,999 per 31-day period. 500 credits released as 125 per week. Unused weekly credits do not carry forward. All connectors, full reports, unmasked contacts |
| Top-up | ₹499 for 50 credits. These carry forward and are spent only after the tier allowance is exhausted |
Credits are consumed per action at the rates published in the app. A credit is a licence to perform an action; it is not currency, has no cash value, and cannot be transferred, resold or redeemed.
Expiry is a term of the plan, not a penalty. Weekly Pro credits expire at the end of their week. The Free grant does not renew. You are buying access for a period, not a stockpile.
No automatic renewal. A Pro period does not renew itself. It ends unless you pay again.
Payments are currently approved manually. No payment processor is live. Upgrades and top-ups are requested in the app and approved by an administrator. Until a processor is live we do not store card details, and we do not issue automated tax invoices. Applicable taxes, including Indian GST, are your responsibility to account for unless we state otherwise on an invoice we issue.
Refunds. Except where a non-waivable law requires otherwise, fees are non-refundable, including for unused credits and for a period ended early by suspension for breach.
6. Acceptable use — outreach
This section is the most important one in this document. The Service sends messages on your behalf, from your mailbox, to people who did not ask to hear from you.
You are the sender. You alone are responsible for the legality of every message the Service sends or prepares for you, in the jurisdiction of every recipient.
You must:
- have a lawful basis for contacting each recipient, and be able to demonstrate it;
- honour every opt-out immediately and permanently;
- identify yourself and your business truthfully in every message;
- comply with the anti-spam and telemarketing laws that apply to your recipients — including but not limited to India's Digital Personal Data Protection Act 2023 and TRAI's commercial-communication regulations, the UAE's Federal Decree-Law 45/2021 and its anti-spam rules, the EU/UK GDPR and PECR where an EU or UK recipient is involved, the US CAN-SPAM Act, and Canada's CASL;
- comply with WhatsApp's and LinkedIn's own terms when using those channels. Automated sending on those platforms is not provided by the Service and you must not build it.
You must not use the Service to:
- send messages to anyone who has opted out, through this Service or any other;
- send unsolicited commercial mail into jurisdictions where you have no lawful basis;
- send content that is deceptive, defamatory, harassing, obscene or unlawful;
- impersonate any person or organisation, or misrepresent the origin of a message;
- promote adult content, gambling, weapons, illegal drugs, or fraudulent financial products;
- scrape, harvest, or contact individuals in their personal capacity rather than businesses in their business capacity;
- circumvent the sending limits, the suppression list, or any other control in the Service.
Every outreach email carries an unsubscribe link and one-click headers. They are appended by the Service, in the send path, so they cannot be edited out of a template or omitted by a new sending feature. A recipient who uses either is added to your suppression list immediately, and every outreach route then refuses to contact them.
You must not defeat this — by removing the footer, by sending the same prospect through another tool after they opted out here, or by re-adding them as a new lead.
Set your postal address in Profile → Your branding. US anti-spam law requires a valid physical mailing address in commercial email; the footer prints the one you set and omits the line if you set none. Supplying it is your responsibility, and it must be real.
7. Prospect data and your role as controller
Data about the businesses and people you research, store and contact through the Service ("Prospect Data") is yours. In data-protection terms:
- You are the controller. You decide who to research, what to collect, and why.
- We are the processor. We process Prospect Data on your instructions in order to provide the Service.
You warrant that you have a lawful basis for collecting and using Prospect Data, and that your use complies with applicable law. You will respond to any request from a data subject about Prospect Data; we will assist you where the law requires.
Not currently offered: a signed Data Processing Agreement satisfying Article 28 GDPR. If you process EU or UK personal data through the Service, ask us — you need one and we owe it to you.
8. Your mailbox
To send outreach and capture replies you may connect your own mailbox over SMTP and IMAP. By doing so you authorise us to:
- send messages you compose or schedule, from your address;
- connect to your mailbox and read messages for the purpose of identifying replies to outreach sent through the Service.
We store the mailbox password encrypted (AES-256-GCM). We store a short extract of a captured reply — enough to show you what was said and to classify it — and not the full message; your correspondence stays in your mailbox.
Use an app-specific password wherever your provider offers one. You can disconnect the mailbox at any time in the app.
9. Demo Sites and generated content
The Service generates a concept homepage for a prospect using that prospect's publicly available business information, and publishes it at an unguessable public URL.
You are responsible for that page. In particular:
- it uses the prospect's business name, and may reference their trade dress. You must have a legitimate purpose for doing so, must not present the page as the prospect's official website, and must take it down promptly if they ask;
- content generated by the language model is a draft. It may be inaccurate. Review it before it reaches a prospect;
- you are responsible for any claim made in a message or page you send.
Not currently enforced in code: there is no review gate before generated copy is sent, and no in-product takedown request route for a prospect.
10. Audit reports and benchmarks
Audit reports are automated measurements of a public web page, not professional advice, and not a certification. They are produced from a single fetch of the page, execute no JavaScript, and are measured from a server in Singapore.
Reports name and grade other businesses near your prospect. You are responsible for what you do with a document that grades a third party. The engine is deliberately built to refuse claims it has not established — a site it could not reach is never reported as beaten — but it is your decision to send the document, and your risk if you misrepresent it.
11. Third-party services
The Service depends on third parties, including Google Maps Platform, Apify, Apollo.io, NVIDIA, Vapi, Cal.com, Razorpay, Neon and Render. Your use of data obtained through them is also subject to their terms.
You should be specifically aware that the Google Maps Platform Terms restrict the caching, storage and display of Places content. Data the Service stores about businesses sourced from Google Places may be subject to those restrictions.
We are not responsible for a third party's availability, accuracy, or changes to their terms or pricing.
12. Intellectual property
We own the Service — the software, design, documentation and brand. You get a non-exclusive, non-transferable right to use it for the duration of your plan.
You own your data, your brand assets, and the outreach content you send. You grant us only the licence needed to host and process it in order to run the Service.
Whitelabel. When you configure your brand, reports you generate carry your name and logo instead of ours. You warrant you have the right to those assets, and you are responsible for the claims made in a document that carries your name.
13. Suspension and termination
We may suspend or terminate an account immediately for breach of section 6, for non-payment, for conduct that endangers the Platform or other customers, or where required by law. Where circumstances allow we will warn you first.
You may stop using the Service at any time. Deletion of your data on termination is described in the Privacy Policy.
14. Availability
We do not promise uninterrupted service and we offer no SLA. Scheduled jobs run on a hosting plan whose cron frequency is limited; reply capture may therefore be delayed by up to 24 hours unless you sync on demand.
15. Disclaimers
To the fullest extent permitted by law, the Service is provided without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.
We do not warrant that data from third-party connectors is accurate, complete or current, that outreach will be delivered, that any particular deliverability outcome will be achieved, or that generated content is accurate or suitable to send.
16. Limitation of liability
To the fullest extent permitted by law:
- neither party is liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, goodwill or data;
- our total aggregate liability arising out of or relating to the Service is limited to the greater of (a) the fees you paid us in the 12 months before the event giving rise to the claim, and (b) ₹5,000.
Nothing here limits liability that cannot be limited by law, including for fraud or for death or personal injury caused by negligence.
17. Indemnity
You will indemnify and hold us harmless against claims, damages and reasonable costs arising from:
- outreach you sent or prepared through the Service;
- your collection or use of Prospect Data;
- a Demo Site or report you published or sent;
- your breach of these Terms or of applicable law.
18. Changes to these Terms
We may update these Terms. Material changes will be notified in the app or by email at least 14 days before they take effect. Continuing to use the Service after that constitutes acceptance.
19. Governing law and disputes
These Terms are governed by the laws of India. The courts at Bengaluru, Karnataka have exclusive jurisdiction, subject to any non-waivable right you have to bring proceedings elsewhere.
20. Contact
NebulaForge Team — nebulaforge.dev Written and maintained by VamsiKrishna & the NebulaForge Team.
For legal notices, data-protection requests and grievances, use the contact address published on the website. A named grievance officer is required under India's DPDP Act 2023 and must be appointed before commercial launch.