Graciax Books — Master Service Agreement (v1.0)

Effective: This version becomes effective on the date you accept it.

Provider: Keyakash Technologies Private Limited ("Keyakash", "we", "us", "our"), a company incorporated in India.

Product: Graciax Books ("Service"). Graciax and Graciax Books are trademarks of Keyakash Technologies Private Limited.

This Master Service Agreement ("Agreement") is a binding contract between you and Keyakash governing your access to and use of Graciax Books, including any related websites, mobile applications, APIs, and documentation. By creating an account, accepting an invitation, or using the Service, you confirm you have read, understood and agreed to be bound by this Agreement.

If you accept on behalf of an organisation, you represent that you have authority to bind that organisation, and "you" refers to that organisation.

---

1. Definitions

• "Account" — your individual login (email + credentials) for the Service.
• "Customer Data" — all data, content, ledgers, invoices, statements, and files you submit to or generate through the Service.
• "Organisation" / "Tenant" — the workspace that holds your books inside the Service.
• "Subscription" — a paid or trial plan associated with an Organisation (Trial / Basic / Pro / Business / Enterprise).
• "User" — any natural person granted access to an Organisation, including admins, accountants, members and viewers.
• "Fees" — the amounts payable for a Subscription, listed on the in-app billing page or in an order form.

2. Licence to use the Service

Subject to your compliance with this Agreement and payment of applicable Fees, Keyakash grants you a non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Service for your internal bookkeeping, accounting, invoicing, compliance, and related business operations during the subscription term.

You may not: (a) reverse engineer, decompile, or attempt to extract source code, except to the extent expressly permitted by applicable law; (b) resell, sublicense, or provide the Service to any third party as a hosted service; (c) use the Service to build a competing product; (d) circumvent usage limits or security features; or (e) remove or obscure proprietary notices.

3. Your account

You are responsible for: (a) maintaining the confidentiality of your credentials and second-factor secrets; (b) all activity that occurs under your Account; (c) immediately notifying us at security@graciax.com of any suspected unauthorised access; (d) ensuring users in your Organisation comply with this Agreement.

We strongly recommend enabling multi-factor authentication (TOTP or a passkey). The Service supports both and offers configurable session policies in Settings → Security.

4. Acceptable use

You agree not to use the Service to: (a) violate any law, regulation, or third-party right; (b) upload content that is unlawful, infringing, defamatory, obscene, or harmful; (c) transmit malware, phishing content, or unsolicited bulk communication; (d) interfere with the integrity or performance of the Service; (e) attempt to access another tenant's data; (f) commit tax fraud or knowingly file inaccurate statutory returns; (g) launder funds, evade sanctions, or finance terrorism. Violations of this section are grounds for immediate suspension.

5. Customer Data and ownership

You own your Customer Data. Keyakash claims no rights to it except the limited rights necessary to provide, secure, and improve the Service.

You grant Keyakash a worldwide, royalty-free, non-exclusive licence to host, process, transmit, display, and copy Customer Data solely for the purpose of providing and improving the Service, complying with law, and enforcing this Agreement.

We will not access, use, or disclose Customer Data except: (a) as needed to provide and support the Service; (b) at your direction (including via your users); (c) as required by law; or (d) where strictly necessary to protect rights, property, or safety.

6. Data portability and deletion

At any time during an active Subscription, you may export your books — full general ledger, journals, invoices, party records, attachments — as CSV / JSON / PDF from the relevant screens.

Upon termination, we will make Customer Data available for export for 30 days, after which we may permanently delete it from production systems. Backups age out per our retention schedule (no longer than 90 days from termination), after which deletion is irreversible.

7. Privacy and DPDP / GDPR compliance

We process personal data in accordance with our Privacy Notice and applicable data-protection laws, including India's Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, the EU/UK GDPR.

For EU/UK personal data we process as your processor, the Standard Contractual Clauses (Module 2) are incorporated by reference and govern any cross-border transfer to India.

You are the data controller / data fiduciary of Customer Data and remain responsible for: (a) lawful basis for processing; (b) informing data principals / data subjects; (c) honouring rights requests; (d) configuring access and retention appropriately within the Service.

8. Security

We maintain administrative, physical, and technical safeguards designed to protect Customer Data, including: row-level security across every tenant table, encryption in transit (TLS 1.2+) and at rest, per-request Content Security Policy nonces, optional WebAuthn passkeys, SMTP credential encryption at rest using pgp_sym_encrypt, hash-chained tamper-evident audit logs, and least-privilege role-based access (admin / accountant / member / viewer).

If we become aware of a personal data breach affecting Customer Data, we will notify the affected Organisation's billing-contact admin without undue delay and, in any event, within 72 hours of confirming the incident, providing the information required by applicable law.

9. Books integrity and audit trail (MCA Rule 11(g))

For Organisations that are Indian companies subject to the Companies (Accounts) Rules, the Service maintains an audit trail that records who created, modified, or deleted each entry in the books of account, with date and timestamp, and that cannot be disabled by Customer users (only Keyakash engineering may rotate signing keys, and such rotations are themselves logged).

The audit trail is hash-chained with SHA-256: each record incorporates the hash of the previous record so any tampering breaks the chain and is detectable by the verify_audit_chain() integrity check available on the Audit Log screen.

10. Service levels and support

Target uptime: 99.5% monthly availability of the production Service, measured over a calendar month, excluding (a) scheduled maintenance announced at least 24 hours in advance, (b) outages caused by your acts/omissions or third-party services you elect to integrate, and (c) force majeure events.

Service credits for Business and Enterprise plans, applied as account credits against the next invoice:

Service credits are your sole and exclusive remedy for availability shortfalls. To claim, write to support@graciax.com within 30 days of the affected month.

Support response targets (during India business hours, IST 09:00–19:00 Mon–Fri unless otherwise stated for Enterprise):

11. Fees, taxes, billing

Fees are listed in-app under Settings → Billing & plan. Fees are exclusive of GST/VAT/sales tax, which will be added at the prevailing rate where applicable. You authorise us to charge the payment method on file for recurring Fees.

We may revise Fees with at least 30 days' notice, applied at the start of your next renewal term. Continued use after the change takes effect constitutes acceptance.

Trial Organisations may be downgraded at the end of the trial period if no paid plan is selected. We will retain your books in a read-only state for 30 days before deletion as described in §6.

12. Suspension

We may suspend Account or Organisation access immediately if: (a) you fail to pay undisputed Fees within 14 days of due date; (b) you materially breach §4 (Acceptable use); (c) we reasonably believe ongoing operation creates a security or legal risk for us or other customers. We will provide notice and, where reasonable, an opportunity to cure non-emergency suspensions.

13. Term, termination, effect

This Agreement begins when you accept it and continues until terminated. Either party may terminate for convenience by closing the Organisation (you) or providing 30 days' notice (us). Either party may terminate for material breach if uncured for 30 days after notice.

Upon termination: (a) all rights to use the Service end immediately; (b) you may export Customer Data for 30 days per §6; (c) accrued Fees remain payable; (d) prepaid Fees for unused periods are non-refundable except where required by law or where termination is for our uncured material breach.

Sections that by their nature should survive termination (Customer Data ownership, confidentiality, payment of accrued amounts, disclaimers, limitations of liability, indemnification, governing law) survive.

14. Warranties and disclaimers

We warrant that we will provide the Service in a professional manner consistent with generally accepted industry practice.

Tax-advice disclaimer. The Service performs tax calculations (GST, VAT, sales tax, withholding) based on the rates, rules, and place-of-supply logic in effect at the time, and on the data you enter. It is a tool to assist your accountants — it is not professional tax advice. You remain solely responsible for the accuracy, completeness, and lawful filing of your returns. Verify all numbers with a qualified Chartered Accountant or licensed tax practitioner before filing.

EXCEPT FOR THE EXPRESS WARRANTY ABOVE, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". WE EXPRESSLY DISCLAIM ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ACCURACY.

15. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

• Neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, goodwill, data, or business opportunity, even if advised of the possibility.
• Each party's total aggregate liability arising out of or related to this Agreement is capped at the Fees paid or payable by you to Keyakash for the Service in the twelve (12) months immediately preceding the event giving rise to the claim, or ₹10,000, whichever is greater.

These caps do not apply to: (a) breach of §4 (Acceptable use) or §16 (Confidentiality); (b) infringement of the other party's intellectual property; (c) §17 indemnification obligations; (d) gross negligence, fraud, or wilful misconduct; (e) amounts owed to taxing authorities or by reason of statutory non-waivable liability.

16. Confidentiality

Each party may receive information of the other ("Confidential Information") that is non-public, including business plans, technology, pricing, and Customer Data. The recipient will: (a) use Confidential Information only to perform under this Agreement; (b) protect it with the same care it uses for its own (and no less than reasonable care); (c) disclose it only to employees, contractors and advisors with a need to know and equivalent confidentiality obligations.

This obligation survives for 3 years after termination, except trade secrets, which remain protected as long as they qualify under law.

17. Indemnification

By us. We will defend you against any third-party claim alleging that the Service, used in accordance with this Agreement, infringes a third-party intellectual-property right in India, and we will pay damages and costs finally awarded or agreed in settlement.

By you. You will defend us against any third-party claim arising from: (a) your Customer Data; (b) your breach of §4 (Acceptable use); (c) your violation of law or third-party rights.

Each indemnity is conditioned on the indemnified party (i) promptly notifying the indemnifier in writing, (ii) granting sole control of the defence and settlement, and (iii) reasonably cooperating.

18. Force majeure

Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond reasonable control — including acts of God, war, terrorism, civil unrest, governmental action, internet/utility outages, cyber-attacks of the nature against which industry-standard protections are usually ineffective, and pandemics.

19. Modifications to this Agreement

We may revise this Agreement from time to time. We will notify you of material changes by email and / or an in-app prompt at least 30 days before the new version takes effect, except where changes are required by law (in which case shorter notice may apply).

When a new version becomes current, you'll be asked to accept it on next sign-in. Refusing to accept means your access ends at the effective date. Acceptances are recorded against the specific version you accepted; nothing in this section retroactively changes a prior accepted version.

20. Governing law, jurisdiction, dispute resolution

This Agreement is governed by the laws of India, without regard to conflict-of-laws principles.

Exclusive jurisdiction: courts in Bengaluru, Karnataka, India, for disputes that the parties cannot resolve through good-faith negotiation. Either party may pursue urgent injunctive relief in any court of competent jurisdiction.

Arbitration (optional). If both parties agree in writing, disputes may be referred to arbitration in Bengaluru under the Arbitration and Conciliation Act, 1996, with a sole arbitrator and proceedings in English. Each side bears its own costs unless the arbitrator orders otherwise.

21. General

• Assignment. You may not assign this Agreement without our prior written consent (not unreasonably withheld), except to an affiliate or successor in a merger / acquisition that does not result in a competitor of Keyakash holding your Subscription. We may assign freely.
• Notices. To you: via the email on your Account. To us: legal@graciax.com with a copy to Keyakash Technologies Private Limited, India.
• Independent contractors. No joint venture, partnership, or agency is created.
• Severability. If a provision is unenforceable, the remainder remains in effect.
• No waiver. Failure to enforce is not a waiver.
• Entire agreement. This Agreement, together with the Privacy Notice and any in-app order forms, is the entire agreement between the parties for the Service and supersedes prior agreements on this subject.

22. Trademark notice

Graciax, Graciax Books, and the Graciax mark and logo are trademarks of Keyakash Technologies Private Limited. All other trademarks are the property of their respective owners. Nothing in this Agreement grants you a right to use any Keyakash mark except to factually identify the Service.

23. Contact

---

By clicking Accept I acknowledge that I have read this Master Service Agreement, that I have authority to bind any organisation I represent, and that I agree to its terms.