Terms of Service

These Terms of Service (the "Terms"), together with the Kostrix Disclaimer and the Privacy Policy, each incorporated by reference, form a binding agreement (the "Agreement") between Whizzy Geeks Internet Services Private Limited ("WhizzyGeeks", "we", "us", "our") and the person or entity that registers for or uses Kostrix ("you", "your", the "Customer").

You accept the Agreement by ticking the acceptance box presented during registration, or by accessing or using the service, whichever occurs first. If you do not accept it, do not register for or use the service.

If you accept the Agreement on behalf of a company or other legal entity, you represent that you are authorised to bind that entity, and "you" refers to that entity. If you lack that authority, you must not accept the Agreement.

We record the version of the Terms and of the Disclaimer that you accepted, together with the date, time and the network address from which acceptance was made. That record is evidence of acceptance.

You must be at least 18 years of age and competent to contract under the Indian Contract Act, 1872. The service is offered for business and professional use and is not directed at consumers acting outside the course of a trade, business, craft or profession.

Kostrix is a hosted software service that reads billing, configuration, inventory, tagging and utilisation data from one or more Amazon Web Services ("AWS") accounts that you connect to it, and produces cost-optimisation findings, estimates, reports and dashboards from that data.

The service is a read-only analytical tool. It is designed not to call any AWS API that creates, modifies, deletes or otherwise changes the state of any resource in your AWS account, and the permissions it requests are limited accordingly. The IAM policy it runs under is published in full and you may inspect it before connecting any account.

The service does not act on your AWS account. It identifies opportunities and describes the action a person might take. Any change to your AWS environment is made by you, by your personnel, or by tooling you control.

Kostrix is at the date of these Terms offered as a beta service. Features may change, be added or be withdrawn. We do not offer a service level agreement, an uptime commitment or a support response time unless we have agreed one with you in a separate signed writing.

You must provide accurate registration information and keep it current. You are responsible for all activity that occurs under your account.

You are responsible for maintaining the confidentiality of your password, any multi-factor authentication device or recovery method, and any API key issued to you. You must notify us without undue delay at the address in clause 21 if you know or suspect that any of them has been compromised.

You must not share a single user account between individuals. Each person who uses the service must have their own credentials.

We may refuse registration, or suspend or close an account, where registration is restricted by invitation, allow-list or plan, or where we reasonably believe the account is being used in breach of this Agreement.

To use the service you connect one or more AWS accounts, either by creating a cross-account IAM role that trusts our service role, or by supplying a read-only access key. You represent and warrant that you are authorised to grant that access for every AWS account you connect.

You are solely responsible for:

• deploying, configuring and maintaining the IAM role or user, and the permissions attached to it;
• reviewing the published IAM policy before granting access, and satisfying yourself that the permissions it requests are acceptable to your organisation;
• revoking that access at any time you choose, including on termination;
• your AWS account itself, the resources in it, its configuration, its security posture and every charge AWS levies against it;
• your own compliance with your agreement with AWS, and with any policy, regulation or contractual obligation that applies to your AWS environment.

Nothing in this Agreement makes us a party to your agreement with AWS, an agent of AWS, or responsible for any act or omission of AWS. AWS operates under a shared responsibility model; our access to your account does not transfer any part of your responsibility under it to us.

Connecting an AWS account is your instruction to us to read from it. You may withdraw that instruction at any time by removing the account in the application or by revoking the role or key in AWS. Revoking access in AWS takes effect immediately regardless of anything in the application.

Every finding, recommendation, saving figure, forecast, coverage percentage and report the service produces is advisory and informational only. It is not an instruction, not professional advice, and not a representation that any stated outcome will occur.

Savings figures are ESTIMATES. They are derived from data read from your AWS account at a point in time, from published or observed pricing, and from assumptions about future usage that may not hold. An estimate may differ, materially, from the amount by which your AWS bill actually changes if you act on it. Reasons include, without limitation: pricing changes by AWS; private pricing, credits, discounts or Enterprise Discount Program terms we cannot see; usage patterns that change after measurement; reserved capacity or savings plans already held; data that AWS did not return, returned late, or returned incompletely; regions, accounts or services not connected to the service; and the ordinary limits of measurement.

YOU MUST INDEPENDENTLY VALIDATE EVERY FINDING BEFORE ACTING ON IT. A resource that appears idle, unused, oversized, orphaned or redundant to an automated analysis may be none of those things. It may serve a purpose the service cannot observe — disaster recovery, compliance retention, a scheduled or seasonal workload, a dependency of another system, a legal hold, or a business reason known only to you.

You acknowledge that deleting, resizing, downgrading, reconfiguring, releasing or purchasing any AWS resource is your decision alone, taken by you, and that you are solely responsible for its consequences, including service interruption, data loss, loss of redundancy, breach of your own obligations to third parties, and any resulting cost.

We do not guarantee that you will achieve any saving, or any particular saving, or any saving at all.

The service is offered on the plans published on our pricing page. A plan determines the number of AWS accounts you may connect and the price. Plan features and prices may change; a change to the price of a plan you are subscribed to takes effect at your next renewal and not during a period already paid for.

Fees are stated exclusive of taxes unless the page says otherwise. Where the place of supply is in India, Goods and Services Tax is charged at the applicable rate and is shown separately on the invoice. Where the place of supply is outside India, the supply is treated as an export of services and is invoiced accordingly; you are responsible for any tax, withholding, duty or levy imposed in your own jurisdiction.

Payment is taken through our payment processor. We do not receive, hold or store your card number, CVV or any full payment instrument; those are handled by the processor under its own terms and its own security certifications.

Free trial. Where the pricing page offers a free period, a new subscription on a paid plan begins with that period (currently thirty days), during which the plan's monthly fee is not charged. The free period is available once per customer, on a customer's first subscription only; it is not available on a subsequent subscription, on a change of plan, or to a person or entity that has previously held a subscription. You must provide a valid payment instrument to start the free period.

Mandate registration charge. To start the free period we register a recurring payment mandate on your payment instrument, and a nominal one-off charge (currently one rupee for a customer billed in India, or one US dollar otherwise, plus any applicable tax) is collected at that moment. That charge is the consideration for registering the mandate; it is not an advance on the plan fee, it is not refundable, and it is the only amount charged before the free period ends. It is invoiced like any other charge.

First charge. Unless you cancel before the free period ends, the plan's monthly fee is charged on the day after the free period ends and on the same day of each month after that. Cancelling before that day means no plan fee is ever charged; the mandate registration charge is not returned.

No refunds. Fees already paid are non-refundable except where refund is required by law or where we agree otherwise in writing. There is no money-back period. Cancelling a subscription stops future charges; it does not refund the period already paid for, and your access continues to the end of that period.

A free or preview plan, and the free period itself, may be changed, limited or withdrawn at any time for new subscriptions without liability; a free period already started runs to its end.

A paid subscription begins when the payment mandate is authorised at checkout - with the free period, where one is offered, running from that day - and continues for the period stated at checkout. Unless cancelled, it renews automatically for successive periods at the then-current price, charged to the payment instrument you have authorised.

You may cancel at any time from the billing page in the application. Cancellation takes effect at the end of the period already paid for.

Where you subscribe through the AWS Marketplace, the entitlement, the billing and the cancellation are governed additionally by the AWS Marketplace terms and by your agreement with AWS, and those terms prevail over this clause to the extent of any conflict.

You must not, and must not permit any person to:

• connect an AWS account you are not authorised to grant access to;
• use the service to access, analyse or derive information about any account, resource or data you are not entitled to;
• attempt to gain unauthorised access to the service, to another customer's data, or to any system or network connected to it;
• probe, scan or test the vulnerability of the service, or breach or circumvent any security or authentication measure, except under a written authorisation from us;
• reverse engineer, decompile or disassemble any part of the service, except to the extent that restriction is prohibited by law;
• resell, sublicense, rent, lease or provide the service to a third party as a service bureau, except under a written agreement with us;
• use the service in violation of any applicable law, or of your agreement with AWS or any other third party;
• interfere with or disrupt the integrity or performance of the service, including by automated request volume beyond documented limits.

We may investigate a suspected breach of this clause and may suspend access where we reasonably believe suspension is necessary to protect the service, other customers or any third party.

As between the parties, WhizzyGeeks owns all intellectual property rights in Kostrix, including its software, detection rules, methodologies, interfaces, documentation and branding. Nothing in this Agreement transfers any of those rights to you.

Subject to the Agreement and to payment of applicable fees, we grant you a non-exclusive, non-transferable, revocable right to access and use the service for your own internal business purposes during the term.

As between the parties, you own your Customer Data, defined as the data read from your AWS accounts and the configuration, settings and content you supply. You grant us a non-exclusive licence to host, process, transmit and display Customer Data solely to provide, secure, support and improve the service, and to comply with law.

We may compile aggregated and de-identified statistics from use of the service, provided they do not identify you, your organisation, any individual, or any AWS account or resource. We own those statistics and may use them without restriction.

Feedback you give us about the service may be used by us freely and without obligation to you.

We will not sell Customer Data. We will not disclose it to a third party except to a sub-processor engaged to provide the service under written confidentiality obligations, where you direct us to, or where disclosure is required by law or by a competent authority.

Each party will keep the other's confidential information confidential and will use it only for the purposes of this Agreement. This obligation survives termination.

Personal data is processed as described in the Privacy Policy at https://www.kostrix.com/privacy. Where the Digital Personal Data Protection Act, 2023 applies, we act as a Data Fiduciary in respect of the account and contact data of your personnel, and process it on the lawful basis stated in that policy. Requests from data principals may be addressed to contactus@whizzygeeks.com.

You are responsible for ensuring that you are entitled to grant us access to the data we read from your AWS accounts, and that doing so does not breach any obligation you owe to a third party.

On termination we will delete or return Customer Data in accordance with the retention periods stated in the Privacy Policy, except where retention is required by law.

We implement and maintain reasonable security safeguards appropriate to the nature of the service and the data it holds. These include, as at the date of these Terms: encryption of data in transit using industry-standard transport security; encryption of data at rest; encryption of stored AWS credentials with a key held separately from the data; hashing of passwords with a deliberately slow algorithm; mandatory multi-factor authentication on administrative access; least-privilege, read-only access to your AWS account; network isolation; rate limiting and lockout on authentication; audit logging; and a published, externally reviewable IAM policy.

You acknowledge and agree, however, that NO SOFTWARE, SYSTEM, NETWORK OR ORGANISATION IS PERFECTLY SECURE. Software contains defects. New classes of vulnerability are discovered in operating systems, libraries, protocols, cryptographic primitives, cloud platforms and hardware after they have been deployed and believed safe. Encryption protects data against some attacks and not others, and does not protect data that is legitimately decrypted in order to be used. Determined, well-resourced or novel attacks may defeat safeguards that were reasonable when they were chosen.

Accordingly, while we take our security obligations seriously and work to meet them, WE DO NOT AND CANNOT WARRANT THAT THE SERVICE, ITS INFRASTRUCTURE, OR THE DATA HELD IN IT WILL NOT BE COMPROMISED, that any defect or vulnerability will be discovered before it is exploited, or that any safeguard will be effective against every attack. You accept that risk as an inherent characteristic of all networked software, including this service.

You are responsible for the security measures within your own control, including the strength and secrecy of your credentials, your multi-factor authentication, the security of the devices and mail accounts you use to access the service and to receive account e-mail, the permissions you grant in your AWS account, and the promptness with which you revoke access you no longer intend to give.

Where a personal data breach occurs, we will notify affected persons and the competent authority as and within the time required by applicable law, and will tell you what we know, what we do not yet know, what the likely consequences are, and what we are doing about it. Nothing in this Agreement limits or excludes any obligation we have under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, or any other law that may not be limited or excluded by contract.

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". To the maximum extent permitted by applicable law, and subject to the paragraph below, we disclaim all warranties, conditions, representations and terms of any kind, whether express, implied, statutory or otherwise, including any implied warranty of merchantability, fitness for a particular purpose, quiet enjoyment, accuracy, or non-infringement.

Without limiting that, we do not warrant that:

• the service will be uninterrupted, timely, available at any particular moment, or free of error or defect;
• any finding, estimate, saving figure, forecast or report is accurate, complete, current or suitable for any purpose of yours;
• acting on any recommendation will produce any saving, or any particular result, or will not cause loss;
• any defect will be corrected, or corrected within any period;
• the service, or the infrastructure on which it runs, is free of vulnerabilities or will not be compromised.

Nothing in this Agreement excludes, restricts or modifies any guarantee, warranty, right or remedy that applicable law confers on you and that may not lawfully be excluded, restricted or modified. Where such a right applies and cannot be excluded, our liability for breach of it is limited, where the law permits that limitation, to re-supplying the service or paying the cost of having it re-supplied.

THIS CLAUSE ALLOCATES RISK BETWEEN THE PARTIES AND IS A BASIS OF THE BARGAIN. The fees charged for the service reflect that allocation; a different allocation would command a different price.

Subject to the carve-outs below, and to the maximum extent permitted by applicable law, neither party is liable to the other for any indirect, incidental, special, consequential, exemplary or punitive loss, or for any of the following however arising, whether or not foreseeable and whether in contract, tort (including negligence), statute or otherwise:

• loss of profit, revenue, anticipated saving or business opportunity, including any saving that a finding estimated and that did not materialise;
• loss of, corruption of, or inability to access data;
• loss of goodwill or reputation;
• business interruption, or the cost of procuring substitute goods or services;
• any increase in your AWS charges, or any charge arising from a change you made to your AWS environment;
• any loss arising from the deletion, resizing, reconfiguration, release or purchase of any resource.

Subject to the carve-outs below, and to the maximum extent permitted by applicable law, our total aggregate liability arising out of or in connection with this Agreement and the service, in any twelve-month period, whether in contract, tort (including negligence), statute or otherwise, is limited to the greater of (a) the fees you actually paid to us for the service in the twelve months immediately preceding the first event giving rise to the liability, and (b) INR 5,000 (five thousand Indian Rupees).

THE CARVE-OUTS. Nothing in this Agreement limits or excludes either party's liability for: fraud or fraudulent misrepresentation; wilful misconduct; gross negligence; death or personal injury caused by negligence; breach of confidentiality obligations; a party's indemnity obligations under clause 14; your obligation to pay fees due; infringement of the other party's intellectual property rights; or any other liability that applicable law does not permit to be limited or excluded, including liability under the Digital Personal Data Protection Act, 2023 and sections 43A and 72A of the Information Technology Act, 2000.

Each provision of this clause operates separately. If any part of it is held unenforceable, the remaining parts continue to apply.

No claim may be brought more than twelve months after the claimant first knew, or ought reasonably to have known, of the facts giving rise to it, except where a longer period is required by law.

You will indemnify, defend and hold harmless Whizzy Geeks Internet Services Private Limited, its directors, officers, employees and agents against any claim, demand, proceeding, loss, liability, damage, cost and expense (including reasonable legal fees) arising out of or in connection with:

• your breach of this Agreement or of any applicable law;
• your grant of access to an AWS account you were not authorised to grant access to;
• any act taken, or omitted, in your AWS environment, whether or not in reliance on a finding;
• any claim by a third party — including any customer, regulator, auditor or counterparty of yours — arising from your use of the service or from a change you made following it;
• Customer Data, including any claim that our processing of it at your instruction infringed a right of a third party.

We will indemnify you against any third-party claim that the service, as provided by us and used in accordance with this Agreement, infringes that third party's intellectual property rights, and will pay damages finally awarded or agreed in settlement. This indemnity does not apply to a claim arising from Customer Data, from use in breach of this Agreement, or from combination of the service with anything not supplied by us.

The party seeking indemnity must notify the other promptly, allow it to control the defence and settlement, and give reasonable assistance at the indemnifying party's cost. No settlement that admits liability or imposes an obligation on the indemnified party may be made without its consent.

The service depends on third parties, including Amazon Web Services, our payment processor, our e-mail delivery provider and the AWS Marketplace. Those parties operate under their own terms and their own privacy and security practices, over which we have no control.

We are not liable for any act, omission, outage, change, error, pricing decision, data loss or security incident of any third party, nor for any consequence to you of one. Where a third party's service is unavailable or behaves unexpectedly, the service may be unavailable, incomplete or wrong for as long as that lasts.

Any link from the service or our website to a third party's site or resource is provided for convenience and is not an endorsement.

You may terminate at any time by cancelling your subscription and closing your account. Termination does not entitle you to a refund of fees already paid, except as stated in clause 6.

We may suspend or terminate your access, in whole or in part, where: you are in material breach of this Agreement and have not cured it within fifteen days of written notice, where it is capable of cure; you fail to pay a fee when due; we reasonably believe suspension is necessary to protect the service, another customer or a third party from imminent harm; or we are required to do so by law.

We may discontinue the service, or any plan, on sixty days' notice to you, in which case we will refund the unused portion of any fee paid in advance for a period after the discontinuation date.

On termination: your right to use the service ends immediately; you should revoke the IAM role or access key in your AWS account, and we will cease to use it in any event; and clauses 5, 9, 10, 11, 12, 13, 14, 19 and 22 survive, together with any other clause that by its nature is intended to survive.

We may modify the service, including by adding, changing or removing features. We will not materially reduce the core functionality of a paid plan during a period you have already paid for without offering you a pro-rata refund of the unused portion.

We may amend this Agreement. Where an amendment is material, we will give notice by e-mail to the address on your account, or by a notice in the application, at least fifteen days before it takes effect, and will publish the amended version with a new version number and effective date.

Continuing to use the service after an amendment takes effect is acceptance of it. If you do not accept an amendment, your remedy is to stop using the service and cancel before it takes effect; where you have paid in advance for a period extending beyond that date, we will refund the unused portion.

Each version of these Terms remains available at https://www.kostrix.com/terms so that you can see what you accepted and what has changed.

Neither party is liable for any failure or delay in performing an obligation (other than an obligation to pay money) caused by an event beyond its reasonable control, including act of God, flood, fire, earthquake, epidemic, war, terrorism, civil disorder, industrial action, governmental or regulatory action, failure of a public telecommunications network, failure of a cloud infrastructure provider, and widespread failure of the internet.

The affected party must notify the other and use reasonable efforts to mitigate. If the event continues for more than thirty days, either party may terminate on notice without liability, and we will refund the unused portion of any fee paid in advance.

This Agreement and any dispute arising out of or in connection with it, including a dispute about its existence, validity or termination, is governed by the laws of India, without regard to conflict of law rules.

Before commencing any proceeding, the parties will attempt in good faith to resolve the dispute by discussion between senior representatives for a period of thirty days from written notice of the dispute.

If the dispute is not resolved, it will be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act, 1996, by a sole arbitrator appointed by agreement between the parties. The seat and venue of arbitration is New Delhi, India, and the language is English. The award is final and binding.

Subject to the arbitration provision, the courts at New Delhi have exclusive jurisdiction. Nothing prevents either party from seeking urgent interim or injunctive relief from a court of competent jurisdiction.

The United Nations Convention on Contracts for the International Sale of Goods does not apply.

If you have a complaint about the service, write to the Grievance Officer: Vibhor Agarwal, Grievance Officer, Whizzy Geeks Internet Services Private Limited, GH-4/32, Meera Bagh Apartment, Block GH-4, SFS Flats, Paschim Vihar, West Delhi, Delhi 110063, contactus@whizzygeeks.com.

We will acknowledge a complaint within forty-eight hours of receipt and will endeavour to resolve it within one month, in accordance with the Consumer Protection (E-Commerce) Rules, 2020.

A request or complaint about personal data may instead be addressed to contactus@whizzygeeks.com, and, if you are not satisfied with our response, to the Data Protection Board of India.

Notices to us must be sent to support@kostrix.com and, where the notice concerns a legal claim, also by post to Whizzy Geeks Internet Services Private Limited, GH-4/32, Meera Bagh Apartment, Block GH-4, SFS Flats, Paschim Vihar, West Delhi, Delhi 110063.

Notices to you are given by e-mail to the address on your account, or by a notice in the application. You are responsible for keeping that address current and for ensuring that mail from us is not blocked or filtered.

A notice by e-mail is treated as received on the day it is sent, unless the sender receives a delivery failure.

Entire agreement. This Agreement, together with the Disclaimer and the Privacy Policy, is the entire agreement between the parties about the service and supersedes all prior discussions, representations and understandings. Neither party relies on any statement not set out in it, save that nothing excludes liability for fraudulent misrepresentation.

Order of precedence. Where there is a conflict, a separately signed written agreement prevails over these Terms, and these Terms prevail over the Disclaimer and over any other page of our website.

Severability. If any provision is held invalid or unenforceable, it is severed or read down to the minimum extent necessary, and the remainder continues in full force.

Waiver. A failure or delay in exercising a right is not a waiver of it, and a single or partial exercise does not prevent further exercise.

Assignment. You may not assign or transfer this Agreement without our prior written consent, except to a successor of your business by merger or acquisition of substantially all assets, on notice to us. We may assign it to an affiliate or to a successor of our business.

No partnership. Nothing creates a partnership, joint venture, agency or employment relationship between the parties.

Third parties. A person who is not a party has no right to enforce any term of this Agreement.

Publicity. We will not use your name or logo as a customer reference without your prior written consent.

Language. This Agreement is made in English, and English governs its interpretation.