Terms of Service

1. About these Terms

These Terms of Service ("Terms") are the agreement between you and the operator of MandateRoom for your use of the MandateRoom virtual data room (the "Service"). MandateRoom is operated by Aniket Raj, an individual trading as MandateRoom, a sole proprietor registered under the MSME Udyam framework in India (Udyam Registration No. UDYAM-UP-29-0238002), of Delhi NCR, India ("MandateRoom", "we", "us" or "our"). We are not a company. When you contract with us you are contracting with an individual. Section 21 explains what happens if the business later moves into a company.

"Customer" means the business that buys a Room, being the person or organisation named on the invoice or Order Form. "Authorised User" means any individual who uses a Room by invitation of a Customer or its Room administrators: administrators and reviewers on the seller side, and bidders and their advisers on the buyer side. "You" means whichever of them is using the Service. "Customer Content" means the documents, data, questions, answers and other material that a Customer or its Authorised Users upload to or create in a Room. "Room" means a single deal room, which is subscribed to separately. "Plan" means the Starter, Pro or Enterprise plan described on our pricing page. "Order Form" means a document signed or accepted by both of us that describes a purchase and refers to these Terms.

By creating an account, ticking the acceptance box, accepting an invitation or using the Service, you agree to these Terms. If you accept on behalf of an organisation, you confirm that you have authority to bind it. If you do not agree, do not use the Service.

2. The documents that make up the agreement

These Terms are supplemented by the following documents, each published on our website and each incorporated into these Terms: the Acceptable Use Policy; the Data Processing Addendum (which applies to personal data in Customer Content); the Refund Policy; the Data Return, Retention, Deletion and Legal Hold Policy; and the list of sub-processors. Our Privacy Policy and Cookie Notice explain how we handle personal data about you and are not part of this contract.

If these documents conflict, the order of precedence is: (1) an Order Form, but only for a special term that says it overrides these Terms; (2) the Data Processing Addendum; (3) these Terms; (4) the other documents listed above. If a Customer has signed a separate master services agreement with us, that agreement prevails over these Terms as between the Customer and us. An Authorised User who is not the Customer accepts these Terms individually when creating an account.

3. Who may use the Service

The Service is for business use only. You confirm that you are acting in a business capacity and not as a consumer, that you are at least 18 years old, and that you have legal capacity to enter into a contract.

You must give accurate information when you register, including your organisation's name and your role, and you must use a business email address. We may refuse or close an account if we cannot verify who you are or whom you act for, including where a paid Plan is requested from a free personal email address.

You are responsible for your credentials and for everything done under your account. Do not share an account between people. Room administrators must enrol a second factor, such as a passkey or an authenticator app, for their authority to take effect. We do not offer SMS codes as a second factor. Tell us promptly at hello@mandateroom.com if you suspect that your account has been accessed without permission.

4. What the Service is, and what it is not

The Service is a hosted platform for sharing confidential documents with chosen people in connection with transactions such as mergers, acquisitions, financings and similar due-diligence processes. Depending on your Plan, it provides:

• staged disclosure: Room administrators define named, ordered disclosure stages, each of which can require its own NDA before content behind it opens;
• document rendering as page images, with the viewer's identity applied as a watermark. Every download is watermarked to the individual by default, and so is every view beyond the first (teaser) disclosure stage. Views in the teaser stage are served without a watermark by design. On a Plan with native download, a Room administrator can grant the original file, which carries no watermark;
• granular folder-level and document-level permissions that can be changed or withdrawn at any time;
• an append-only, hash-chained audit ledger of security-relevant actions, sealed daily;
• question-and-answer, annotation, due-diligence request and engagement-analytics tools, and, on higher Plans, an API, audit-trail export and legal export.

The pricing page and your Order Form say which features your Plan includes. Certificates of non-disclosure and non-engagement are a preview feature. Their signatures are not yet backed by an independent key-management service or a third-party timestamp authority, so they can be verified within MandateRoom but are not suitable as standalone legal evidence. You must not present a certificate to anyone as independently signed evidence until we tell you in writing that the feature is generally available. Single sign-on (SSO) is offered only as a Custom Integration upon request, under a separate written statement of work.

We provide software and nothing else. We are a technology provider. We do not act as a broker, finder, agent, adviser or fiduciary, and we do not give legal, tax, financial, investment, valuation or regulatory advice. We do not introduce buyers to sellers, run or manage any transaction, or hold, receive or move deal funds. Our fees depend on the Plan and the term you choose and never on the size, price or outcome of a transaction. You are solely responsible for complying with the securities, broker-dealer, licensing, competition, anti-money-laundering and other laws that apply to your transaction and your activities.

You alone decide what to disclose, to whom and when. We are not a party to any NDA or other agreement between you and another person. Where you use our NDA step, we keep a record of who accepted which text, when, and from which IP address, as evidence for you; you remain responsible for the text you publish and for its legal effect.

No tool can guarantee that information will not leak. Watermarks, view-only settings and the audit ledger deter and trace unauthorised redistribution. They cannot stop a person from photographing a screen or from remembering what they have seen.

5. Rooms, invitations and what you are responsible for

A Customer decides whom to invite, and buyer-side users are invited only by the Customer's Room administrators. The Customer is responsible for: inviting the right people at the right addresses; the authority to disclose each document; the NDAs and other conditions it requires; the conduct of its Authorised Users; and the accuracy and lawfulness of everything it uploads. We act on the instructions of a Room's administrators, including permission changes, and we are not responsible for a disclosure that an administrator authorised.

The Customer confirms that it has the right to upload Customer Content and to share it with its Authorised Users, that it has given any notices and obtained any consents the law requires for sharing personal data in the transaction, and that it will remove or mask personal data that is not needed for the purpose. Buyer-side Authorised Users are not our customers and have no rights against us under the Customer's contract. Nothing in these Terms gives anyone other than the parties, and our successors under Section 21, a right to enforce them.

6. Acceptable use and prohibited content

You must follow the Acceptable Use Policy. In summary, you must not use the Service to break the law or another person's rights; to upload material you have no right to share; to upload protected health information, export-controlled technical data, classified or controlled unclassified information, or payment-card data without our prior written agreement; to upload malware; to attack, probe, bypass or reverse-engineer the Service's controls; to impersonate a person or run a deceptive "deal room"; to scrape or benchmark the Service or build a competing service from it; or to overload it.

If you or your Authorised Users do not comply with these Terms, the Acceptable Use Policy or the Privacy Policy, we may suspend or end access immediately and remove non-compliant content, as Section 9 explains.

7. Customer Content

You own your Customer Content. You give us a limited, non-exclusive licence to store, copy, render, secure, back up and transmit it, and to make it available to the people you choose, only as needed to provide and support the Service.

We will not access, read or disclose Customer Content except: (a) as technically necessary to operate, secure and support the Service, including automated processing of uploaded files to check their type and size, to compute a cryptographic hash of their contents, and to convert them into the page images and extracted text that the viewer and search use (these steps do not scan for malware: see the Acceptable Use Policy); (b) where you ask us to, or give us permission, for example to resolve a support request; (c) where we reasonably believe it is necessary to stop abuse, a security threat or unlawful content, in which case we limit access to what is needed; or (d) where the law or a valid legal process requires it (Section 17). We do not sell Customer Content, do not use it to train or improve any artificial-intelligence model, and do not analyse it for advertising or for our own purposes. Any artificial-intelligence feature we add later will be switched off unless a Customer enables it for a Room.

Keep your own copies. The Service is a disclosure and sharing tool and is not your system of record or an archive. What happens to Customer Content when a Room ends is set out in the Data Return, Retention, Deletion and Legal Hold Policy.

8. Fees, payment and taxes

Pricing. Pricing is per Room per month, at the rates on our pricing page or in your Order Form, in United States dollars. A Room is bought for a term of 3, 6 or 12 months (the minimum is 3 months). The fee for the whole term is payable in advance. We do not charge per user, per document or for overage, and fees never depend on the outcome or size of a transaction.

Invoices and payment. We invoice the fee. Payment is due within 14 days of the invoice date, unless the invoice says otherwise, by bank transfer to the account shown on the invoice, quoting the payment reference. You bear your own bank charges and those of any intermediary bank, and we must receive the full invoiced amount. A Room is activated, and its term starts, when we confirm receipt of cleared funds, unless the Order Form gives a fixed start date. We aim to activate within two business days of cleared funds. Fees are exclusive of taxes.

No automatic renewal. A term does not renew automatically. A Room can be extended only by a further purchase at our rate then in force. We aim to remind you about 14 days before a term ends. If a term ends without an extension, or an invoice is overdue, the Room becomes read-only for a grace period of 14 days, with no new uploads, permission grants or invitations, after which the subscription ends and Section 9 applies.

Taxes. You are responsible for all sales, use, value-added, goods-and-services and similar taxes, duties and levies in your own country, and for any tax you are required to withhold. If the law requires you to withhold tax from a payment, you will pay the extra amount needed so that we receive the full invoiced sum, and will give us the official receipt for the tax withheld. If you are outside India we invoice the Service as an export of services and charge no Indian goods and services tax. If you are in India, goods and services tax is added at the applicable rate. If we become required to collect a tax in your jurisdiction we will add it to the invoice, and you may give us a valid exemption certificate.

Limits and price changes. Each Plan has limits, such as storage, members, buyer groups and active Rooms. When a limit is reached, the Service refuses further additions but does not delete existing content. We may change list prices for new purchases and extensions on at least 30 days' notice by email. A change does not affect a Room that is already activated for the rest of its term.

Refunds. Fees are for access to the platform and are not contingent on the outcome of any transaction. They are non-refundable once a Room is activated, whether or not a deal closes, is abandoned or is cancelled, and whether or not you use the whole term, subject only to the credit and the refund described in our Refund Policy.

9. Term, expiry, suspension and termination

These Terms apply from when you first accept them and for as long as you use the Service or any Room is subscribed.

You may stop using the Service at any time and may ask us to close your account by writing to hello@mandateroom.com. Closing an account does not entitle you to a refund of fees already paid, except as the Refund Policy says.

Either of us may end a Room's subscription by written notice if the other materially breaches these Terms and does not remedy the breach within 30 days of notice, or if the other becomes insolvent or makes an arrangement with its creditors.

We may suspend or end access immediately, to a Room, an account or the Service, where the law requires, where continued access creates a material risk to the Service, to other users or to a Room's security, where we reasonably believe the Acceptable Use Policy or Section 18 has been breached, or where an invoice remains unpaid after the grace period. We will give notice where we can lawfully and practicably do so, and we will restore access when the cause is resolved. Where we remove or disable content, we limit the action to what is needed.

What happens afterwards. When access ends, the Data Return, Retention, Deletion and Legal Hold Policy applies. In outline: we keep Customer Content for 30 days so that you can ask for a copy, and then delete it, except where a legal hold or a legal requirement applies and except for the evidentiary records that policy describes. If we stop providing the Service altogether, we will give at least 30 days' notice and refund, pro rata, prepaid fees for the unexpired part of each term. Sections 7 (as to ownership), 12 to 17, 20 to 22 and any sum due survive the end of the agreement.

10. Personal data

For personal data in Customer Content, the Customer is the controller (or the processor acting for its own client) and we are its processor; the Data Processing Addendum applies. For personal data about account holders and Authorised Users, such as their names, work email addresses, sign-in and security records and the records we keep of their views and acceptances, we are a controller; our Privacy Policy explains what we do with it and the rights you have.

Customer Content is stored mainly on infrastructure located in the United States. We operate from India, so the person who administers the Service accesses it from India. Our sub-processors are listed on our website. Where the law requires a transfer mechanism, the Data Processing Addendum provides it.

If we confirm that a security incident has affected Customer Content, we will tell the affected Customer without undue delay and in any event within 72 hours after we confirm it, with the information then available, and keep it informed. Do not upload protected health information or other categories listed in the Acceptable Use Policy without our prior written agreement.

11. Security

We have built the Service around the following measures, each of which is described in more detail on our security page:

• tenant isolation that is enforced by the database itself and not only by application code;
• a tamper-evident, append-only, hash-chained audit ledger, sealed daily;
• watermarking, by default, of every download and of every view beyond the first (teaser) disclosure stage, to the individual viewer (an original file, where a Plan includes native download and a Room administrator grants it, carries none);
• dual control: turning off a room's watermarking or narrowing its scope, turning off multi-factor authentication, or clearing an IP allow-list requires a second, independent administrator's approval on every Plan, enforced by the database;
• access decisions that resolve to a fixed set of specific, named reasons, with access that can be withdrawn at once;
• encryption in transit using TLS, and encryption at rest as provided by our storage providers;
• a review step before any redaction is applied to a served page; and
• no SMS-based second factor, because it is a weak factor.

What we do not have. We are not SOC 2 certified, not ISO 27001 certified, and not certified under any other information-security standard; our architecture is built around the control objectives those frameworks assess, and certification is on our roadmap. We have no dedicated security team, no formal incident-response team and no round-the-clock monitoring. We give no guaranteed recovery-time or recovery-point objective. We do not represent that we carry insurance that would respond to a claim by you; if an Order Form states that we carry insurance, that statement applies as written. Our statements about the security properties of our providers' infrastructure rest on their published documentation and may change if their configurations change.

No system is perfectly secure. We cannot guarantee that the Service will be free from breaches, unauthorised access or loss of data. You are responsible for the security of your own devices, networks and accounts, for choosing strong second factors, for reviewing invitations before you send them, and for giving Authorised Users only the access they need.

12. Confidentiality

"Confidential Information" means non-public information that one of us discloses to the other and that is marked confidential or that a reasonable person would understand to be confidential. For the Customer, it includes all Customer Content. For us, it includes the non-public design and security architecture of the Service.

The recipient will use Confidential Information only to perform or receive the Service, protect it with at least reasonable care, and disclose it only to personnel, advisers and, for us, sub-processors who need to know it and are bound by equivalent duties. These duties do not apply to information that is or becomes public through no breach, was lawfully known to the recipient, is independently developed, or is lawfully received from a third party without a duty of confidence. A recipient may disclose Confidential Information where the law or a court or authority requires it, giving the discloser prompt notice where lawful and disclosing only what is required. These duties last for five years after the agreement ends and, for Customer Content and trade secrets, for as long as the information remains confidential.

13. Intellectual property

We and our licensors own the Service, its software, design and documentation. We give you a non-exclusive, non-transferable right to use the Service for your Rooms during their terms. You must not copy, sell, sublicense or reverse-engineer the Service, or use it to build a competing service. If you give us feedback we may use it without obligation, provided we do not disclose your Confidential Information. We will not use your name, logo or any statement of yours publicly without your written consent. Nothing in these Terms transfers to us ownership of Customer Content.

14. Disclaimers

EXCEPT AS THESE TERMS EXPRESSLY STATE, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT THE LAW PERMITS, WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE OR FREE OF SECURITY VULNERABILITIES, OR THAT WATERMARKS, VIEW-ONLY SETTINGS OR ANY OTHER CONTROL WILL PREVENT A LEAK.

We warrant that we will provide the Service with reasonable skill and care. We do not guarantee any level of availability. The Service may be unavailable because of maintenance, outages at our providers or events beyond our control, and the only remedy for downtime is the credit described in the Refund Policy.

MandateRoom is early-stage software run by one person. You accept that it may contain defects, that you use it with that risk in mind, and that any claim about a defect or downtime is subject to Section 15 like any other claim.

15. Limitation of liability

TO THE FULLEST EXTENT THE LAW PERMITS, NEITHER OF US IS LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFIT, REVENUE, GOODWILL, OPPORTUNITY, BUSINESS INTERRUPTION OR DATA, OR FOR THE LOSS OF, OR A REDUCTION IN THE VALUE OF, ANY TRANSACTION OR DEAL, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, WHATEVER THE CAUSE OF ACTION AND EVEN IF ADVISED OF THE POSSIBILITY OF THE LOSS.

OUR TOTAL AGGREGATE LIABILITY TO YOU, FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, WILL NOT EXCEED THE GREATER OF (A) THE FEES YOU PAID US IN THE TWELVE (12) MONTHS BEFORE THE EVENT THAT GAVE RISE TO THE FIRST CLAIM AND (B) USD 500.

Nothing in these Terms limits liability for fraud, for wilful misconduct, for death or personal injury caused by negligence, for gross negligence to the extent the applicable law does not permit it to be limited, or for anything else that the law does not allow to be limited.

In plain English: documents in a data room can be worth far more than any subscription fee, and we are one individual with no company, legal team or insurance that we promise you. We cannot accept unlimited liability for the value of a transaction. If your organisation requires it, MandateRoom may not be the right product for you at this stage. A Customer that needs different liability terms can ask us for them in an Order Form; the cap in this Section applies unless an Order Form we have signed says otherwise.

16. Indemnification

The Customer will indemnify and hold us harmless against claims, losses and expenses, including reasonable legal fees, that arise from: (a) its breach of these Terms or the Acceptable Use Policy; (b) its Customer Content, including any claim that the Customer had no right to upload or share it; (c) its use of the Service in breach of applicable law; or (d) a dispute between the Customer and another user of its Room. We will tell the Customer promptly of a claim. The Customer may control the defence, with our reasonable co-operation at its cost, but may not settle in a way that admits fault by us or imposes an obligation on us without our consent.

17. Legal requests from authorities

If we receive a valid order, subpoena or demand from a court or authority requiring disclosure of Customer Content or of data about you, we will: review it for validity, scope and jurisdiction; refer the requester to the Customer where lawful; tell the affected Customer before disclosing, unless the law prohibits it; challenge a request that we reasonably believe is overbroad or unlawful; and disclose only what is required. We do not disclose data in response to informal requests that lack legal authority. We are an operator in India, and our policy on requests, including requests from other countries, is published on our website. We may recover our reasonable costs of responding to the extent the law permits.

18. Sanctions, export controls and compliance

You confirm that you, and each person you invite, are not the subject of sanctions or an embargo under applicable law, are not located in a country or territory that is the target of comprehensive sanctions, and will not use the Service to evade sanctions, export controls or anti-corruption laws. You must not upload technical data controlled under export-control laws, or classified or controlled unclassified information, without our prior written agreement. We may screen account holders and invited addresses against sanctions lists, may block or suspend access where a check fails, and may decline a customer or a country at our discretion.

19. Changes to the Service and to these Terms

We may improve or change the Service. We will not materially reduce the core functions of a Plan during a term you have paid for. We may update these Terms. For a material change we will give at least 30 days' notice by email or in the Service. For a Room that is already activated, a change that reduces your rights applies from the start of its next term, unless the law requires it sooner. Continuing to use the Service after a change takes effect means you accept it. If you do not accept a change, you may stop using the Service before it takes effect.

20. Governing law and disputes

These Terms, and any dispute arising out of or related to them or the Service, are governed by the laws of India, without regard to its conflict-of-laws rules.

Talk first. Before starting formal proceedings, each of us will try in good faith to resolve a dispute by negotiation for 30 days after written notice of it, sent to the contacts in Section 23.

Customers and users outside India. A dispute that is not resolved by negotiation will be finally resolved by binding arbitration administered by the Singapore International Arbitration Centre ("SIAC") under its Arbitration Rules in force when the arbitration is commenced. The seat of arbitration is Singapore. The tribunal will be one arbitrator and the language will be English. The parties agree that the SIAC Expedited Procedure applies, whatever the amount in dispute, so that the dispute is decided quickly and at proportionate cost. The arbitration agreement is governed by the laws of Singapore. The award is final and binding, and judgment on it may be entered in any court that has jurisdiction. The proceedings and the award are confidential, except as needed to enforce or challenge the award or as the law requires. Each of us may bring claims only in our individual capacity and not as a plaintiff or class member in a class, collective or representative action.

Customers and users in India. The courts at Ghaziabad, Uttar Pradesh, India have exclusive jurisdiction.

Urgent relief. Either of us may ask a court of competent jurisdiction for urgent injunctive relief to protect Confidential Information or intellectual property.

Mandatory law. Nothing in these Terms removes a right that you have under mandatory law that cannot be excluded by contract, including, for a customer in the European Union or the United Kingdom, mandatory business-protection law.

21. Succession: if the business moves into a company

We expect to move this business into a company, and we may do so without your consent, but only on the following terms. We may assign or novate these Terms and any Order Form, and delegate performance, to an affiliate or to any person or entity that succeeds to the business of providing the Service, including a company formed by or for us, such as a private limited company in India or a corporation organised in a state of the United States (each a "Successor").

We will give you written notice at least 30 days before the change takes effect, stating the Successor's legal name, jurisdiction, registration number, address and the effective date. On that date the Successor becomes "we" under these Terms and every Order Form and assumes our obligations in writing, and every Order Form continues without re-signing. The change will not alter the Plan, term, Rooms or fees of a Room already activated, reduce the security and data-protection commitments in these Terms and the Data Processing Addendum, move Customer Content to a sub-processor that has not been disclosed, or change the governing law and dispute provisions in Section 20. On request, we will give you reasonable evidence of the succession and updated tax forms and invoices in the Successor's name.

Payment details safeguard. We will change the bank account to which you pay only by a written notice under this Section or a notice signed by us, and you may confirm it by telephoning us on a number you already hold, not one in the notice. We will never change bank details by email alone. You are not in breach if you pay into the original account until you have completed that confirmation.

22. General terms

Notices. We may give you notice by email to your account address or the address on your Order Form, or in the Service. You may give us notice at hello@mandateroom.com. For a notice of breach, termination, assignment or a claim, you must also send a copy by courier to our address in Section 23. An email notice is given when sent, unless the sender receives a delivery failure.

Electronic agreement. You agree that these Terms, Order Forms and notices may be made and accepted electronically. Our records of your acceptance, which show the version of the Terms, the time and the IP address, are evidence of it.

The rest. Neither of us is liable for delay or failure caused by events beyond our reasonable control, other than a failure to pay. These Terms and the documents listed in Section 2 are the whole agreement about their subject and replace earlier proposals and discussions. Neither of us relies on a statement that is not in them, but that does not limit liability for fraud. If a provision is invalid, the rest continues and the provision is enforced as far as the law permits. A failure to enforce a right is not a waiver. The parties are independent contractors. You may not assign these Terms without our written consent, except to a successor to all or substantially all of your business that is not our competitor, on written notice and if it assumes your obligations in writing. The English text of these Terms prevails over any translation.

23. Contact, notices and grievances

• Email: hello@mandateroom.com
• Operator: Aniket Raj, trading as MandateRoom, sole proprietorship, India
• Udyam Registration No.: UDYAM-UP-29-0238002
• Address: Delhi NCR, India

Our Grievance Officer is Aniket Raj. How to send a grievance, and how we deal with it, is published on our website. To report a security vulnerability, follow our vulnerability disclosure policy.