Platform Terms of Service

In these Platform Terms, the following definitions apply:

• "Agreement" — these Platform Terms of Service together with the Privacy Policy and any Order Form or subscription confirmation.
• "Customer" / "You" — the individual or organisation that creates a Zephra account and accepts this Agreement.
• "Zephra" / "We" / "Us" — Growthsynth LLP, a Limited Liability Partnership incorporated in India, operating the Zephra platform.
• "Platform" — the Zephra AI marketing intelligence and automation software accessible at app.zephraai.com, including all APIs, sub-processors, and related services.
• "Customer Data" — all data you input, connect, or generate within the Platform, including campaign data, brand assets, and third-party platform credentials.
• "End-User Data" — personal data of your website visitors or customers collected via sdk.js at your direction.
• "Tokens" — Zephra's usage-based credits consumed by AI processing operations within the Platform.
• "Connected Platform" — any third-party advertising or analytics platform you connect to Zephra via OAuth (e.g. Meta Ads, Google Ads, YouTube, Google Analytics).
• "sdk.js" — Zephra's server-side tracking script, installed on Customer websites at the Customer's direction for conversion event forwarding.
• "AI Output" — any content, recommendation, strategy, or analysis generated by Zephra's AI features.
• "DPA" — the Data Processing Agreement at Annex 1 of these terms.

2.1 Account Creation

You must create an account using Google OAuth 2.0. By creating an account, you represent that:

• You are at least 18 years old and have legal capacity to enter a binding contract
• If registering on behalf of an organisation, you have authority to bind that organisation
• The information you provide at registration is accurate and current
• You have read and accepted the Privacy Policy and these Platform Terms (evidenced by your consent at signup)

2.2 Account Security

You are responsible for all activity that occurs under your account. You must:

• Protect your Google account credentials and enable MFA on your Google account
• Notify us immediately at hello@zephraai.com if you suspect unauthorised access
• Not share account credentials with third parties

2.3 One Account Per Person

Each account is for use by a single individual or organisation. Sharing a single account across multiple people or organisations is not permitted without a Multi-User plan. Team plans are available — contact hello@zephraai.com.

3.1 Token Model

Zephra operates on a token-based usage model. Tokens are consumed when you use AI processing features. Token consumption rates are displayed within the Platform. We reserve the right to adjust token consumption rates with 30 days' notice. Tokens allocated under a subscription do not roll over and expire at the end of each billing period. Ad-hoc purchased tokens expire 12 months after purchase.

3.2 Free Tier

A free tier is available with limited tokens per billing period. We may modify or discontinue the free tier at any time with 30 days' notice.

3.3 Paid Plans

Paid subscriptions are billed in advance on a monthly or annual cycle. All prices are exclusive of applicable taxes (GST, VAT, or equivalent) unless stated otherwise.

3.4 Payment

Payment is processed by our PCI-DSS-compliant payment processor. We do not store your card details. If payment fails, access to paid features may be suspended until payment is resolved.

3.5 Refunds

Token purchases and subscription fees are non-refundable except where required by applicable consumer protection law, or where the Platform fails to provide contracted functionality due to our fault. Refund requests: hello@zephraai.com.

3.6 Price Changes

We will give existing subscribers 60 days' notice of price increases. You may cancel before the new price takes effect if you do not accept the change.

Subject to your compliance with this Agreement and payment of applicable fees, Growthsynth LLP grants you a limited, non-exclusive, non-transferable, non-sublicensable licence to access and use the Platform for your internal business purposes during the subscription term.

This licence does not include the right to:

• Copy, modify, adapt, or create derivative works of the Platform software
• Reverse engineer, disassemble, or decompile the Platform
• Sublicence, resell, or offer Platform access to third parties as a service (white-labelling requires a separate Partner Agreement)
• Remove or alter any proprietary notices or labels on the Platform
• Use the Platform to build a competing product

You agree to:

• Use the Platform only for lawful business purposes in compliance with applicable laws
• Ensure that any connected advertising accounts, campaigns, and creatives comply with the policies of the respective platforms (including Meta's Business Tools Terms, Google's API Services User Data Policy)
• Review and take responsibility for all AI-generated recommendations and actions before they are executed on Connected Platforms
• Maintain appropriate consents and legal bases for any personal data you process through sdk.js (see Annex 1 — DPA)
• sdk.js consent obligation: Before deploying the Zephra tracking pixel on any website, you must: (a) obtain valid consent from your website visitors; (b) include Zephra (Growthsynth LLP) as a named data processor in your privacy policy and cookie consent banner; and (c) provide visitors with a clear description of the data collected and the ad platforms to which conversion data is forwarded.
• Keep your account information accurate and promptly update it if it changes
• Comply with all applicable export control, anti-corruption, and sanctions laws

You must not use the Platform to:

• Generate, distribute, or promote illegal, harmful, deceptive, fraudulent, or misleading advertising content
• Target advertising at minors in violation of applicable laws (COPPA, GDPR Article 8, etc.)
• Violate the terms of service or advertising policies of any Connected Platform (Meta, Google, YouTube, LinkedIn)
• Process sensitive personal data (health, financial, biometric, etc.) through sdk.js without explicit legal basis and appropriate safeguards
• Circumvent, disable, or interfere with Platform security features, rate limits, or access controls
• Attempt to access another customer's data or accounts
• Use the Platform in a way that could damage, overburden, or impair our infrastructure
• Send, facilitate, or enable unsolicited commercial electronic messages (spam) in violation of CAN-SPAM, CASL, PECR, or equivalent anti-spam laws
• Advertise, promote, or facilitate illegal products or services
• Violate any applicable law, regulation, or third-party rights

Violation of these prohibitions may result in immediate account suspension without refund.

When you connect a third-party platform (Meta Ads, Google Ads, YouTube, Google Analytics, or others), you:

• Authorise Zephra to access, read, and act on those accounts according to the permissions you grant via OAuth
• Confirm you have authority to grant such access (either as the account owner or an authorised administrator)
• Remain solely responsible for compliance with the Connected Platform's terms of service, advertising standards, and policies
• Accept that Zephra cannot guarantee uninterrupted access to Connected Platforms and is not responsible for their availability, API changes, or policy changes

Google API Services: Zephra's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services: Zephra uses YouTube API Services, and by using Zephra's YouTube-connected features you agree to be bound by the YouTube Terms of Service. These obligations are set out in full in the dedicated Section 22 — YouTube API Services below.

You can revoke Zephra's access to any Connected Platform at any time from your account settings or directly from the Connected Platform's settings page.

8.1 AI Output

Zephra's AI features generate recommendations, strategies, copy, and creative assets. AI Output is provided as a starting point to assist your decision-making. You are solely responsible for reviewing, approving, and taking responsibility for any AI Output before it is used, published, or acted upon.

8.2 Automated Actions

Some Zephra features can execute actions on your Connected Platforms (e.g. bid adjustments, budget changes, campaign status changes). Automated actions:

• Are executed only within parameters and rules you configure and approve
• Are logged in full in your account's audit trail
• Can be paused, reviewed, or reverted from your dashboard at any time

You remain the decision-maker. Zephra does not make autonomous business decisions. You bear full responsibility for outcomes arising from automated actions you have configured and approved.

8.3 No Performance Guarantee

Zephra makes no warranty regarding advertising performance, ROAS, conversion rates, revenue outcomes, or any other business metric.

8.4 EU AI Act Compliance

Zephra is committed to compliance with the EU AI Act. We provide transparency about our AI systems' operation and capabilities. See our Privacy Policy §6 for full AI disclosure.

9.1 Zephra IP

All rights in the Platform, including underlying software, algorithms, models, interfaces, brand assets, and documentation, are owned by or licensed to Growthsynth LLP. Nothing in this Agreement transfers any intellectual property rights to you.

9.2 Your IP and AI Output

You retain all intellectual property rights in your Customer Data, brand assets, and input content. As between you and Zephra, you own all AI Output generated by the Platform using your data and prompts, subject to any third-party rights in AI foundation models (see §9.3).

9.3 Third-Party Model Notices

Zephra may use third-party AI foundation models to produce AI Output. The terms of those model providers may impose restrictions on the use of generated content. You are responsible for ensuring your use of AI Output complies with applicable laws.

9.4 Licence Grant to Zephra

You grant Growthsynth LLP a limited, non-exclusive licence to use your Customer Data solely to provide and improve the Platform services described in this Agreement.

You represent and warrant that:

• You have all rights, licences, and consents necessary to upload, connect, or use the Customer Data and brand assets you provide to Zephra
• Customer Data does not infringe any third-party intellectual property, privacy, or other rights
• You have lawful authority to connect the third-party advertising accounts you link to Zephra
• If you utilise Zephra's features to fetch, analyse, or cache content from third-party websites or competitors, you represent and warrant that you have the lawful right to do so, and you assume full liability for any claims of unauthorised scraping or Terms of Service violations brought by those third parties

Data handling, retention, and deletion terms are set out in our Privacy Policy and the DPA at Annex 1.

Each party may receive confidential information of the other party in the course of this Agreement. Each party agrees to:

• Keep the other party's Confidential Information strictly confidential
• Use Confidential Information only for purposes permitted under this Agreement
• Limit disclosure to employees, contractors, and sub-processors with a need to know, bound by equivalent confidentiality obligations
• Notify the other party promptly upon becoming aware of any unauthorised disclosure

Confidentiality obligations do not apply to information that is publicly known through no breach of this Agreement, or that is required to be disclosed by law or court order.

Customer Data is your Confidential Information. We treat it accordingly and our Privacy Policy and DPA set out the technical and organisational measures we apply to protect it.

12.1 Our Warranties

Growthsynth LLP warrants that:

• We have the authority to enter this Agreement
• We will provide the Platform with reasonable skill and care
• We will implement and maintain reasonable security measures as described in the Privacy Policy
• We will process personal data in accordance with the DPA and applicable data protection law

12.2 No Service Level Agreement

Zephra does not commit to any service level agreement (SLA) during the beta period. We make no representations regarding uptime, latency, or availability. Availability targets will be published when General Availability (GA) is declared.

12.3 Disclaimer

Except as expressly stated in §12.1, the Platform is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all implied warranties including merchantability, fitness for a particular purpose, and non-infringement.

Exclusion of consequential loss: To the maximum extent permitted by applicable law, Growthsynth LLP shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profit, revenue, business opportunity, data, or goodwill.

Cap on liability: Growthsynth LLP's total cumulative liability to you for all claims shall not exceed the greater of: (a) the total fees paid by you in the two (2) months preceding the claim, or (b) USD 100. For users of the Free tier or Beta services, Growthsynth LLP's maximum aggregate liability shall be USD 0.

Ad spend liability: We are not responsible for ad spend committed, wasted, or misallocated on Connected Platforms, whether through automated actions configured by you or otherwise.

Exceptions: Nothing in this clause limits liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any liability that cannot be excluded under applicable law.

You agree to indemnify, defend, and hold harmless Growthsynth LLP, its directors, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable legal fees) arising from or relating to:

• Your breach of this Agreement
• Your violation of applicable law (including advertising standards, data protection laws, and intellectual property law)
• Your Customer Data or the content of your advertising campaigns
• Your use of the Platform in a manner not authorised by this Agreement
• Your failure to obtain appropriate consents for End-User Data processed via sdk.js

15.1 Term

This Agreement begins on the date you create your account and continues until terminated by either party.

15.2 Termination by You

You may terminate your account at any time by deleting it from account settings or emailing hello@zephraai.com. Termination takes effect at the end of the current billing period. Prepaid fees are non-refundable.

15.3 Termination by Us

We may terminate or suspend your account immediately if you breach this Agreement, or with 30 days' notice for any other reason. If we terminate without cause, we will refund any prepaid fees for unused subscription periods.

15.4 Effect of Termination

Upon termination: access to the Platform ceases immediately. Any licences granted under this Agreement terminate immediately. Clauses that by their nature survive termination (§9, §11, §13, §14, and Annex 1 DPA) will continue in force.

15.5 Customer Data on Termination

Data export before closure. You may request a full export of your Customer Data at any time before account closure by emailing hello@zephraai.com. We will deliver your data in JSON or CSV format within 30 days.

Data deletion after closure. All Customer Data will be permanently deleted within 30 days of the account closure date, except billing records required by law (7 years), data subject to a legal hold, and anonymised aggregate data. You will receive a deletion confirmation email when the process completes.

Reactivation window. If you reactivate your account within 1 year of closure, your Customer Data will be available for full restoration. After this window, all personal data will have been permanently deleted and restoration is not possible.

We may update these Platform Terms from time to time. For material changes, we will:

• Email you at least 30 days before the change takes effect
• Post the updated terms with a new effective date
• Require your re-acceptance for changes that significantly alter the terms

Continued use of the Platform after the effective date constitutes acceptance. If you do not accept material changes, you may terminate your account before they take effect and receive a pro-rated refund of prepaid fees.

These Platform Terms are governed by the laws of India. Any dispute arising from this Agreement shall first be subject to good-faith negotiation. If unresolved within 30 days, disputes shall be referred to binding arbitration under the Arbitration and Conciliation Act, 1996 (India), with a single arbitrator, conducted in Bengaluru, Karnataka, India, in English.

Notwithstanding the above, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent imminent harm.

• Entire Agreement: This Agreement (including the Privacy Policy and Annex 1 DPA) constitutes the entire agreement between the parties regarding the Platform and supersedes all prior agreements.
• Severability: If any provision is found unenforceable, the remainder of the Agreement continues in force.
• Waiver: Failure to enforce a provision does not constitute a waiver of future enforcement rights.
• Assignment: You may not assign this Agreement without our prior written consent. We may assign this Agreement in connection with a merger, acquisition, or asset sale.
• Force Majeure: Neither party is liable for delays or failures caused by circumstances outside reasonable control.
• Notices: Legal notices to Zephra must be sent to hello@zephraai.com with subject "Legal Notice". We will send notices to the email address associated with your account.
• Language: This Agreement is in English. In case of conflict between translated versions and the English original, the English version prevails.

Entity: Growthsynth LLP · Contact: hello@zephraai.com

© 2026 Growthsynth LLP · Effective: April 2026 · Version 2.0

This section sets out your legally binding obligations as a data controller when you deploy sdk.js on any website. These obligations exist in addition to those in Annex 1 (DPA) and §5 (Your Obligations).

19.1 Consent Before Deployment

You must not deploy sdk.js on any website unless you have implemented a consent mechanism that:

• Identifies Zephra (Growthsynth LLP) as a named third-party processor and describes the purpose of data collection
• Provides a mechanism for visitors to withdraw consent
• Does not fire sdk.js until the visitor has granted consent, where consent is the applicable legal basis

19.2 Required Disclosures in Your Privacy Policy

Your website's privacy policy must include: the identity and contact details of Growthsynth LLP as a data processor; the categories of data collected via sdk.js; the ad platforms to which conversion data is forwarded; and a link to Zephra's privacy policy at zephraai.com/privacy.html.

19.3 Indemnity for Non-Compliance

You agree to indemnify and hold harmless Growthsynth LLP from any regulatory fines, claims, or losses arising from your failure to obtain valid consent or make the required disclosures before deploying sdk.js.

Where Zephra provides features that allow you to send email communications to your own customers or prospects, you represent, warrant, and agree that:

• Consent: You have obtained valid, documented consent from each recipient to receive commercial electronic messages from you, in compliance with all applicable laws including CAN-SPAM, CASL, GDPR, PECR, and India's DPDP Act 2023
• Unsubscribe mechanism: Every email must contain a clear, functional unsubscribe link. Recipients must be able to opt out within 10 business days (CAN-SPAM) or immediately (CASL/GDPR)
• Sender identification: Every email must clearly identify you as the sender, include your physical mailing address, and not use deceptive subject lines or headers
• Suppression list compliance: You must honour all unsubscribe requests immediately. You may not re-add opted-out contacts without new, independently obtained consent
• List provenance: You may not use purchased, scraped, or harvested email lists

21.1 Scope

When you connect a social media account (Instagram, Twitter/X, TikTok, LinkedIn, or others) to Zephra, you authorise Zephra to publish content to that account on your behalf, within the permissions you grant via OAuth.

21.2 Minimal API Scopes

Zephra will request only the minimum API permissions required to publish content. We will not request access to read follower data, direct messages, or audience analytics unless those features are explicitly offered and you separately opt in.

21.3 Your Responsibilities

• You are solely responsible for all content published through Zephra to your social media accounts
• You must comply with the terms of service, community standards, and advertising policies of each connected platform
• You must have rights to all content you instruct Zephra to publish
• Zephra is not responsible for account suspensions, content removals, or penalties imposed by social media platforms

21.4 Token Security

OAuth refresh tokens issued by social media platforms will be encrypted at rest using AES-256 symmetric encryption. You can revoke Zephra's access at any time from your account settings or from the relevant platform's connected apps page.

22.1 Use of YouTube API Services

Zephra uses YouTube API Services (including the YouTube Data API) to upload the video creatives you generate to your connected YouTube channel so they can run in your Google Ads and YouTube advertising campaigns. Zephra requests only the youtube.upload scope.

22.2 Agreement to YouTube's Terms of Service

By using Zephra and its YouTube-connected features, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms).

22.3 Google Privacy Policy

YouTube API Services rely on Google services and data. Google's handling of that data is governed by the Google Privacy Policy at http://www.google.com/policies/privacy.

22.4 Revoking Access and Deleting Data

You can revoke Zephra's access to your YouTube and Google data at any time via the Google security settings page at https://myaccount.google.com/connections?filters=3,4&hl=en, by disconnecting YouTube in your Zephra account settings, or by emailing hello@zephraai.com. How Zephra stores, refreshes, and deletes YouTube API data is described in Section 13 of our Privacy Policy.

A1.1 Parties and Roles

This DPA is entered into between:

• Data Controller / Customer: You, the Zephra platform customer identified by your account
• Data Processor / Zephra: Growthsynth LLP

This DPA applies where Zephra processes personal data on your behalf — specifically End-User Data collected via sdk.js from your website visitors.

A1.2 Subject Matter and Duration

Growthsynth LLP, as data processor, undertakes to:

• Process End-User Data only on documented instructions from you (the controller), as set out in the Platform configuration and these terms, unless required to do so by applicable law
• Ensure that persons authorised to process End-User Data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures as described in the Privacy Policy §11
• Assist you in responding to Data Subject Rights requests from your website visitors, by providing relevant data within 72 hours of request
• Delete or return all End-User Data upon termination of the agreement or on written request, within 90 days
• Notify you without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach involving End-User Data

A1.3 Sub-processors

You hereby grant general authorisation for Growthsynth LLP to engage the sub-processors listed in Privacy Policy §7.2. We will notify you of any material changes to sub-processors with 30 days' notice, during which you may object.

A1.4 International Transfers

Where End-User Data of EU/UK residents is transferred to countries without an adequacy decision, the transfer is protected by EU Standard Contractual Clauses (Module 2: Controller to Processor), Commission Decision 2021/914, incorporated into this DPA by reference.

You may request a copy of the applicable SCCs at hello@zephraai.com.

As data controller for End-User Data, you agree to:

• Ensure you have a lawful basis for processing your website visitors' data via sdk.js — this includes obtaining appropriate consent where required (e.g. GDPR, PECR, ePrivacy Directive) or establishing a valid legitimate interests basis
• Maintain a privacy notice on your website that discloses the use of Zephra's server-side tracking
• Provide instructions to Zephra regarding processing through your sdk.js configuration settings
• Respond to data subject rights requests from your website visitors
• Ensure that any personal data you instruct us to forward to Meta CAPI or Google Ads Enhanced Conversions is done in compliance with those platforms' data policies and your own privacy notice
• Not instruct Zephra to process special category personal data (health, financial, biometric, etc.) via sdk.js