FLOWLITH
Terms and Conditions
Flowlith and IRIS AI
Version date 1 October 2026
These Terms govern access to Flowlith and its IRIS AI agent interface, monthly subscriptions, prepaid usage and automated actions. They identify the service provider, explain each party's responsibilities, and include a business data-processing schedule. Mandatory consumer and data-protection rights remain unaffected.
Flowlith provides the Services through its IRIS AI agent interface. In these Terms, 'Flowlith', 'we', 'us' and 'our' mean the contracting legal operator identified in section 13. Our correspondence address is 1/266, THAMARASSERY VIA, Kudathai, Kozhikode, Kerala 673573, India. Contact: jubsan@flowlith.com. Website: www.flowlith.com.
You accept these Terms when you affirmatively agree during registration, checkout or another recorded acceptance process. Mere receipt of an automated call or message does not make its recipient a party to these Terms. If you act for an organisation, you must be authorised to bind it. 'Customer' and 'you' mean that organisation or the individual purchasing the Services. Account holders must be at least 18 years old and legally capable of entering a contract.
The plan and pricing information presented before purchase, the Refund Policy and any expressly agreed order form form part of the contract. The Privacy Policy explains personal-data handling; accepting these Terms is not blanket consent to every processing purpose. Schedule A applies where we process personal data on a business Customer's behalf. A 'Consumer' means a person entitled to mandatory consumer protection under the law applicable to that transaction, not every individual account holder.
The Services are hosted software for configuring AI agents and automating connected workflows. Depending on the enabled features and integrations, agents may handle calls or messages, analyse content, schedule appointments, update records, execute code and initiate actions in connected systems. Only features included in your purchased plan or otherwise expressly agreed are promised. The Services are hosted by us through our infrastructure providers; customer-hosted deployment is outside their scope.
Businesses from any industry may subscribe, as may eligible individuals. Particular features may be unavailable or restricted by country, provider rules or applicable law. Availability is not a representation that every use is lawful in every jurisdiction or that the Services hold sector-specific licences or certifications.
Provide accurate account information, protect your email account and one-time passwords, and control access by your authorised users. Promptly tell us about suspected account misuse. You are responsible for actions of users you authorise and for maintaining appropriate permissions in connected services. This does not transfer responsibility for our own security failures to you.
You authorise IRIS to process your instructions and perform actions within the permissions, integrations, limits and approval rules you configure. Where an action is designated as requiring approval, it must remain pending until the configured approval is given. Changing those rules changes the scope of your authorisation. An approval requirement must not be treated as satisfied merely because an agent generated a recommendation.
Review permissions and approval rules before enabling a workflow, particularly for communications to others, payments or refunds, deletion of records, changes to access permissions and other consequential actions. Maintain appropriate human oversight and lawful authority. Customer-controlled automatic actions remain subject to the safeguards and restrictions required by applicable law.
AI outputs may be inaccurate, incomplete, biased or unsuitable. Review important outputs and verify information before relying on it. The Services are not an emergency response service and do not replace a qualified professional where one is required. Access by a medical, financial, legal or other regulated business does not itself authorise unlawful professional practice or a regulated decision without required safeguards.
You can change enabled workflows and permissions using available controls and revoke connected-service access through the relevant provider. Revocation stops future authorised access when effective; it cannot undo messages already sent, completed payments or other actions already executed. We remain responsible for complying with agreed approval rules and for providing the Services with reasonable care and skill.
Monthly subscription fees are payable upfront for the billing period shown at checkout. Pay-as-you-go usage is charged separately unless expressly included in the plan. Before payment, checkout must identify the subscription price, taxes or their calculation, billing period, included usage, metering units, usage rates, any initial prepaid usage amount and any renewal arrangement. Subscription payments and usage-credit purchases must be distinguishable in the billing record.
Payments are processed through Razorpay or another payment method expressly identified before payment and accepted by you. A subscription renews automatically only where recurring billing is disclosed and you authorise it through the payment process. Automatic credit top-ups likewise require separate disclosure and authorisation. Merely adding a payment method does not authorise unspecified charges.
If recurring billing is not authorised, payment is needed to continue into the next period. We may pause chargeable usage when available credit is exhausted or payment fails. Reasonably incurred usage already authorised and actually supplied remains payable, subject to billing corrections and the Refund Policy. No arbitrary administrative penalty or undisclosed late fee applies.
For existing subscriptions, price increases take effect no earlier than the next renewal following at least 30 days' notice. We will obtain any additional consent required by law or the payment mandate. Changes to usage rates apply prospectively after clear notice; material increases will receive at least 30 days' notice unless you expressly accept them sooner. You may stop renewal or affected usage before the change takes effect.
The small initial amount described as a deposit or top-up is an advance payment toward use of Flowlith, to the extent identified as usage credit at checkout. It is not a separate setup fee. It is intended solely for purchasing the Services and is not offered as an interest-bearing investment, transferable money balance or general payment facility. The actual treatment of a payment follows its itemised description and applicable law.
Usage credits are deducted for metered services at the disclosed rates. Unused credits expire at the expiry date, or after the validity period, clearly disclosed before the relevant purchase and recorded with that credit balance. Included monthly allowances may reset at the end of the billing period where the plan says so. Promotional credits may have separately disclosed conditions.
We will not apply an undisclosed expiry period, shorten the validity of already purchased credits retrospectively or forfeit a balance contrary to mandatory law. If no expiry was disclosed before a credit purchase, we will not rely on an expiry term for that purchase. Cancellation of subscription renewal does not itself change the previously disclosed credit expiry. Use of credits may require an active subscription where that condition was disclosed before purchase.
A genuine voluntary cancellation or decision not to use the Services does not ordinarily entitle you to a cash refund of consumed usage, a commenced subscription period or prepaid credits subject to valid disclosed conditions. This is subject to the Refund Policy, statutory withdrawal rights, billing corrections and remedies for our failure to supply. Expiry cannot be used to remove a valid refund entitlement.
You may stop subscription renewal through the dashboard or by emailing jubsan@flowlith.com. Email cancellation takes effect on receipt, not when we choose to acknowledge it. There is no 30-day cancellation-notice requirement or early-termination penalty. Unless you request immediate closure, access continues until the end of the paid period. We will not charge a renewal falling after an effective cancellation; tell us if a pending charge is nevertheless collected so it can be corrected.
Account deletion is a separate request for immediate account closure. When you confirm deletion in the dashboard, future renewals and top-ups must stop, account access and future agent activity must be disabled, and ordinary Customer Content is scheduled for deletion within seven days. The Privacy Policy explains narrow legal-retention and provider exceptions. Export or request the return of content you need before confirming deletion. If an available export cannot reasonably be completed, contact us before confirming deletion. Statutory rights to recover content remain unaffected.
We may suspend the affected account or feature where reasonably necessary to address unlawful use, a material security threat, abuse, a material breach or non-payment. Where practicable, we will explain the reason and allow a reasonable opportunity to resolve it. Immediate action is permitted where delay creates a real legal or security risk. A suspected breach does not automatically establish wrongdoing or justify confiscating money.
For a material breach that can be remedied, either party may terminate if it remains unremedied 14 days after written notice. We may discontinue a paid service or terminate for convenience on at least 30 days' notice where practicable. If we end access without your breach, we will refund the unused prepaid subscription period and unexpired purchased credits attributable to services we will not supply. Mandatory and additional contractual remedies remain available.
After termination, authorisation to use the Services ends, properly incurred unpaid charges remain due, and data return/deletion follows the Privacy Policy and Schedule A. Confidentiality, accrued payment and refund rights, dispute provisions and obligations that by their nature continue survive termination. Suspension does not automatically require immediate destruction of data needed for a lawful investigation or a data-return request.
'Customer Content' means content submitted to or generated for your account, including prompts, files, messages, recordings, transcripts, connected records and agent memory. You retain your rights in it. You grant us a limited licence to host, transmit, process and reproduce it only as needed to provide, secure and support your configured Services, comply with law and carry out your lawful instructions. This includes necessary processing by authorised service providers.
These Terms do not grant us a right to sell identifiable Customer Content, use it for unrelated advertising or train general-purpose models with it. Any separate identifiable-content training or other independent reuse requires a clearly disclosed purpose and separate lawful authorisation, including consent where required. Operational troubleshooting and testing to deliver your own configured service must be limited to what is necessary and subject to confidentiality. Provider access and applicable restrictions are addressed in the Privacy Policy and Schedule A.
You must have lawful authority for the content and connected accounts you make available, and provide appropriate notices and permissions to affected people. Do not supply unnecessary sensitive data. Where a workflow involves health data, financial information, children's data or other specially protected information, you and we must first ensure the relevant lawful basis, safeguards and any required contractual arrangements are in place. An adult account holder can still upload information about a child; the age limit does not waive the child's protections.
For calls, messages and campaigns you direct, you are responsible for having the required authority to contact recipients and for lawful content, recipient preferences and suppression lists. Permission to record a call is separate from permission to place an automated or marketing call. Configure required AI disclosures, recording notices, consent collection, opt-outs, calling-time limits and human escalation. Your obligations do not remove ours where the law imposes duties directly on us.
Do not use the Services for unlawful communications, fraud, deceptive impersonation, unlawful discrimination, harassment, infringement, unauthorised access, malicious code or interference with another person's systems or rights. Do not bypass safeguards, evade usage metering or access another customer's data. Reverse engineering is prohibited only to the extent permitted by law, and statutory rights and authorised security testing are not excluded.
Use of Meta platforms, GitHub and other integrations must comply with their applicable terms. You remain responsible for the permissions you grant and instructions you give. We remain responsible for selecting and managing our own service providers and meeting obligations that apply to our processing.
We use Cloudflare for application, infrastructure and related enabled services; Modal for AI workloads; OpenRouter and authorised downstream model providers for model inference; GitHub and GitHub Actions for relevant development or connected workflows; Meta for enabled messaging/social integrations; and Razorpay for payments. A provider receives data only to the extent relevant to its role and your configured use. Models and routes may change, subject to applicable data-processing commitments and notice or authorisation requirements.
Some integrations require your own third-party account and may carry separately disclosed third-party charges. Changes or outages at external providers can affect availability. We will use reasonable efforts to address service problems, but do not guarantee uninterrupted operation, a particular model forever or a result from an external system that we do not control. This does not exclude our responsibility for our own breach or mandatory service-quality obligations.
Support is available by email at jubsan@flowlith.com on a best-effort basis. Support response times and any availability commitments are those expressly agreed in writing. Statutory complaint-response deadlines remain applicable. Material removal of paid core functionality will receive at least 30 days' notice where practicable, with an appropriate cancellation and refund remedy if we cannot supply what was purchased. Security and legally required changes may need to take effect sooner.
We retain our rights in the Flowlith platform, our software, interface, workflow tools, documentation, branding and proprietary configurations. Third-party models, software and services remain owned by their respective rights holders. Subject to payment and these Terms, you receive a non-exclusive, non-transferable right to use the Services for your permitted purposes during the subscription, including access by your authorised users.
You retain your pre-existing materials and rights in Customer Content. To the extent we have transferable rights in outputs generated specifically for you, we assign those rights to you, excluding our underlying tools and third-party materials. Outputs may not be unique or eligible for intellectual-property protection. You are responsible for reviewing their intended use; we do not claim ownership of third-party rights or warrant that every output is non-infringing.
Each party must protect the other's non-public business and technical information and use it only for the engagement. Disclosure is limited to people and providers who need it for that purpose and are bound by suitable confidentiality obligations, or as legally required. Where lawful and practicable, give notice of compelled disclosure. Confidentiality continues while information remains confidential; personal-data protections continue for as long as data is retained. Information independently developed, lawfully received without restriction or publicly available without breach is excluded.
We will provide the Services with reasonable care and skill and substantially as described at purchase. We do not promise error-free AI output or a particular commercial outcome. Disclaimers do not excuse a failure to follow agreed approval controls, meet binding data-protection obligations or honour mandatory consumer remedies.
For business Customers, to the extent permitted by law, neither party is liable to the other for indirect or consequential loss, or loss of anticipated profit, arising from the Services. Our aggregate liability for claims connected with the Services is limited to the total subscription and usage fees paid or payable by you for the three months immediately preceding the event giving rise to liability. Where your paid service has operated for less than three months, the cap is at least the amount paid or payable for that service to the date of the event. The cap does not limit our obligation to return amounts refundable under the Refund Policy.
No term excludes or limits liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any other liability that cannot lawfully be excluded or limited. These limits do not restrict a regulator's powers, an individual's statutory data-protection rights, or liabilities under binding transfer clauses where a cap would conflict with them.
For Consumers, the business liability cap and business indemnity do not apply. Subject to mandatory law, we are responsible for loss that is a reasonably foreseeable result of our breach or failure to use reasonable care and skill. We do not exclude mandatory rights concerning service quality, unfair terms, refunds, compensation, privacy or access to courts and consumer authorities.
A business Customer will indemnify us against third-party claims to the extent caused by its unlawful instructions, infringement in content it supplies, or material violation of the acceptable-use obligations. This does not cover claims caused by our negligence, unlawful conduct, breach of these Terms or processing outside lawful instructions. We must notify you promptly, permit reasonable control of the defence and provide cooperation. No settlement may impose an admission, non-monetary obligation or unreimbursed payment on the other party without consent. This section does not apply to Consumers.
Send service, payment, privacy or legal complaints to Jubsan, Customer and Privacy Grievance Contact, at jubsan@flowlith.com or the company address in section 1. We will acknowledge consumer complaints within 48 hours, provide a copy of the recorded complaint where required, and address them within one month, or any shorter applicable legal period. Using this process does not prevent lawful contact with a bank, regulator, consumer forum or court and is not a condition for exercising mandatory rights.
Indian law governs this contract, without depriving Consumers of mandatory protections of the law that otherwise applies to them. For business disputes, courts of competent jurisdiction in Kozhikode, Kerala, have exclusive jurisdiction. Consumers retain any mandatory right to bring proceedings in their place of residence or another competent forum. There is no mandatory pre-dispute arbitration clause. The parties may agree to mediation or arbitration after a dispute arises.
We will give at least 30 days' notice of material adverse contractual changes where practicable and obtain consent where required. You can stop renewal before those changes apply. Changes cannot retrospectively remove accrued rights, shorten purchased-credit validity or authorise a new personal-data use merely through continued use. Urgent legal or security changes may take effect sooner, with prompt explanation. A material reduction in already paid Services carries the remedies in the Refund Policy.
Events genuinely outside a party's reasonable control may excuse the affected performance while the event continues, to the extent permitted by law. The affected party must mitigate and notify the other. This does not excuse inadequate security, erase refund rights for undelivered Services or permit indefinite retention of payments for a service permanently discontinued.
Mandatory law prevails. Binding international-transfer clauses and Schedule A prevail on their data-protection subject matter. The Refund Policy prevails on cancellation, credits and refunds. An expressly agreed order form prevails on its identified commercial details but cannot reduce mandatory rights or override Schedule A without an express compliant amendment. These Terms apply otherwise. Invalid terms are severable without rewriting the bargain unfairly. Neither party's failure to enforce a right waives it. Assignment must not reduce your accrued rights or data protections. The legal operator is the contracting provider; these Terms do not create a personal guarantee by its founder, employees or contributors.
Legal operator: Mantiq Private Limited, trading as Flowlith, CIN U62020KL2026PTC102848, incorporated in India on 28 April 2026.
This Schedule forms part of the accepted Terms whenever Flowlith processes personal data on a business Customer's behalf. It supplements, and does not replace, any legally required international-transfer instrument. Applicable data-protection law means the law actually applicable to the processing, including Indian law and the EU or UK GDPR where their scope requirements are met. Statutory provisions apply from their respective commencement dates. The contractual obligations in this Schedule apply on acceptance.
The Customer is the controller/data fiduciary, or an authorised processor instructing a subprocessor, for Customer Content processed on its instructions. Flowlith is its processor/subprocessor for that processing. Flowlith acts independently for its own account administration, billing, legal compliance and other separately disclosed purposes. A contractual label does not determine a role contrary to the actual processing.
Processing element | Scope |
|---|---|
Subject and purpose | Hosted AI-agent services, connected workflows, authorised communications, support, security and fulfilment of the Customer's documented instructions. |
Operations | Collection, hosting, retrieval, inference, transcription where enabled, transmission to approved providers, generation of outputs, authorised updates, export and deletion. |
Individuals | Customer personnel, prospects, customers, suppliers, contacts, message/call participants and other people whose information is lawfully supplied. |
Data categories | Contact and account details, messages, prompts, files, call content where enabled, transcripts, connected records, agent memory, activity metadata and permissions. Sensitive information only where lawfully authorised with the required safeguards. |
Duration | While the relevant service and instructions remain active, followed by the seven-day account-deletion process and only justified legal-retention exceptions. More specific lawful instructions can be agreed. |
Instructions | These Terms, the selected plan, connected permissions, configured workflows and approvals, and additional instructions agreed in a durable written form. |
We will process the covered data only on documented lawful instructions, including instructions concerning transfers, unless applicable law requires otherwise. We will inform you of a conflicting legal requirement unless prohibited and promptly flag an instruction we reasonably believe infringes applicable data-protection law. No independent model training, sale or unrelated advertising use is authorised by this Schedule. Access by founders, contributors, contractors and staff must be limited to need-to-know duties and subject to confidentiality obligations that survive their engagement.
We must maintain technical and organisational measures appropriate to the data and risk. These include account authentication, restricted administrative access, management of connected credentials, suitable protections for data in transit and storage, separation of customer access, and procedures for incident response and deletion. The required measures must be implemented before the relevant processing begins. Any additional security specification expressly agreed in writing also applies.
On becoming aware of a personal-data breach affecting covered Customer data, we will notify the Customer without undue delay and, in any event, within 24 hours, with information available at that time. We will not wait for a significant-risk finding or complete investigation. Updates will follow as facts emerge. We will assist with containment, investigation and required notifications, preserve relevant evidence lawfully and meet any shorter reporting duty applicable directly to us. The Customer remains responsible for notifications it must make, unless law requires us to make them directly.
The Customer gives general written authorisation for subprocessors identified with sufficient information before processing. We must provide the relevant provider identities, roles and processing locations on request and before processing wherever needed for valid authorisation. Infrastructure may include Cloudflare, Modal and OpenRouter; downstream inference providers depend on the approved route. GitHub/Meta integrations may be customer-directed recipients or subprocessors according to the actual arrangement. Razorpay's independent payment processing is governed by its own role.
A change of model version does not remove obligations concerning the legal entity receiving data. Before adding or replacing a subprocessor we will give at least 15 days' notice and a reasonable opportunity to object on data-protection grounds, or longer where required by an agreed transfer instrument. If an urgent change is necessary, the applicable notice/authorisation requirements still control; affected processing can be paused until they are met. We will seek a workable alternative to a justified objection. If none is available, the Customer may terminate the affected service and receive a proportionate refund of unused prepaid amounts for services we cannot supply.
We must impose written data-protection obligations on subprocessors at least as protective as required for the delegated processing and remain responsible for their performance as required by applicable law. We will not route covered data to an undisclosed provider where doing so would breach authorisation, confidentiality, retention, training or transfer restrictions. Proprietary model details need not be disclosed unless required by law, but necessary recipient information cannot be withheld on that basis.
Processing may occur in India and other locations identified for the authorised providers. Where a restricted international transfer requires standard contractual clauses, a UK transfer instrument, assessments or supplementary safeguards, the parties must establish the appropriate arrangement before that transfer. We will assist with the necessary information, and conflicting commercial restrictions will not override those instruments.
We will promptly forward requests relating to covered Customer data and assist with access, correction, deletion, portability or other applicable rights. We will not respond on the Customer's behalf except on instructions or as legally required. We will provide reasonable assistance with impact assessments, security obligations and regulatory consultations, taking account of the nature of processing and information available.
We will make available information reasonably needed to demonstrate compliance with this Schedule and allow appropriate audits or inspections by the Customer or a qualified independent auditor. Reasonable notice, confidentiality and safeguards for other customers' data apply, without obstructing a regulator, urgent incident review or mandatory audit right. Routine remote evidence review should be used where adequate. Any charge for exceptional assistance must be reasonable and agreed in advance; we will not charge to remedy our own breach.
On ending covered processing, the Customer may choose return or deletion of the personal data, subject to mandatory retention. A confirmed dashboard account-deletion request is an instruction to delete ordinary Customer Content within seven days, including copies under our control, and to instruct relevant subprocessors to delete covered copies. The Customer should request return before confirming deletion. We will explain any legally required retention, keep retained data isolated from ordinary use and delete it when the justification ends.
We will use provider arrangements that support the agreed deletion instructions. Any necessary provider-specific retention beyond seven days must be identified before the affected processing, with its reason and duration, and be lawfully agreed. It cannot silently replace the seven-day commitment. We will provide reasonable confirmation of deletion on request. Security, confidentiality and applicable statutory duties continue for all retained data.