Terms, kept clear.
Last updated 2026-07-26
Agreement and business use
These terms apply to services supplied by GattyWorks Private Limited, CIN U58201KA2025PTC204259, unless a signed quote, statement of work, or data processing agreement says something different. The signed document controls where terms conflict. Our services are intended for business use. Any consumer rights that cannot legally be limited still apply.
Brief and scope
Every brief gets a substantive written reply within 24 hours. When the brief is complete, we include a fixed price and delivery date. When it is not, we send the specific questions needed to quote it. The signed scope states the products, repositories, cloud accounts, user roles, integrations, environments, tests, deliverables, assumptions, and exclusions. Changes are quoted separately.
Audit authorisation
You confirm that you own the target or have written authority to let us access and test it. We do not perform destructive tests, denial-of-service tests, social engineering, or third-party penetration testing unless a signed Rules of Engagement expressly allows it. Send only the URL and your concerns by email. Credentials and secrets use the secure handoff we provide after signing.
Audit limits
An audit is a point-in-time, scope-limited review of available evidence. Findings depend on the access, environments, records, and samples supplied. We evidence-test claims and report confirmed controls, gaps, and unknowns, but we cannot guarantee that every vulnerability, data flow, outage, fraud, or legal issue is found. A DPDPA, GDPR, or UK GDPR review is a technical readiness and gap assessment, not certification or legal advice. Regulated or high-risk systems may also need qualified legal counsel or an authorised specialist. Technology-cost findings depend on the bills, contracts, and usage data supplied. Savings, runway, and payback figures are estimates, not guarantees, and may involve tradeoffs in reliability, security, support, performance, migration effort, or commitment terms.
Timelines
Delivery clocks start when the scope is signed, the due payment has cleared, required decisions and materials are complete, and secure access works. Client or vendor delays pause the clock. Estimated audit times are 48 hours for Surface, one week for Deep, and two weeks for Full. Build times are 24 hours for a marketing site and 48 hours for an MVP where the signed scope qualifies for that sprint.
Data handling
Each side protects the other's confidential information and uses it only for the project. If we process personal data for you, the signed scope or data processing agreement sets our instructions, security measures, subprocessors, retention, and incident process. Restricted EEA or UK data is not accessed from India until the required transfer terms are signed.
Payment and split schedules
Unless the quote says otherwise, payment is 50% on sign-off and 50% before handover, with invoices due in 7 days. Eligible growing teams may agree a milestone-based split schedule in the quote, such as 40/30/30. This is staged project billing, not a loan or credit product. Work and access may pause while an invoice is overdue. Applicable taxes and non-refundable third-party costs are shown separately.
Ownership
You keep ownership of material you provide. After full payment, you own the custom deliverables identified in the signed scope. GattyWorks keeps its pre-existing tools, audit methods, templates, reusable components, and general know-how. Open-source and third-party material remains under its own licence. We may name and link to public work unless the signed scope says it is confidential.
Findings and remediation
Audit findings stand on their evidence whether or not you hire us to fix them. You are free to use your current vendor, another provider, or your own team for remediation. Fixes are separately scoped. A re-audit checks the agreed fixes and does not turn the report into a certification.
Using an audit report
The report is prepared for the client and the authorised stakeholders named in the scope. You may share it with your vendor, counsel, insurer, investor, or buyer for the stated purpose, subject to confidentiality and after removing secrets or personal data they do not need. It must not be presented as a certification or public endorsement. No other party may rely on it without our written agreement.
Liability
To the extent law permits, neither side is liable for indirect, special, or consequential loss. GattyWorks' total liability for a claim is limited to the fees paid for the project that caused it. Nothing here limits liability that cannot legally be limited, including fraud, wilful misconduct, or rights that applicable consumer law makes mandatory.
Law and contact
Unless the signed scope says otherwise, these terms are governed by the laws of India and disputes are subject to the courts in Bengaluru, Karnataka. Questions can be sent to hello@gattyworks.com.