From e1774b672d313402d2448bfabe3b14ebbdca123a Mon Sep 17 00:00:00 2001 From: DrDead0 <112349103+DrDead0@users.noreply.github.com> Date: Sat, 31 Oct 2026 20:50:16 +0530 Subject: [PATCH 1/2] Ensure production redirect URI falls back to public web URL and polish marketing forms card --- apps/web/app/(marketing)/page.tsx | 10 +- .../components/marketing/forms-table-card.tsx | 188 +++++++++++------- .../scheduling/internal/calendar/google.go | 10 +- services/shared/config/config.go | 10 +- 4 files changed, 134 insertions(+), 84 deletions(-) diff --git a/apps/web/app/(marketing)/page.tsx b/apps/web/app/(marketing)/page.tsx index 118d194..06a181a 100644 --- a/apps/web/app/(marketing)/page.tsx +++ b/apps/web/app/(marketing)/page.tsx @@ -412,19 +412,19 @@ function Dashboard() { function FormsTable() { return (
-
+
-

+

Embed forms anywhere with secure access keys.

-

- Drop custom forms into your portfolio, Framer, Webflow, or Next.js app in seconds. Submissions are spam-filtered, securely stored, and delivered directly to your inbox with zero server maintenance. +

+ Drop custom HTML forms into your portfolio, Framer, Webflow, or React app in seconds. Submissions are verified, spam-checked, and delivered straight to your email without maintaining a backend.

diff --git a/apps/web/components/marketing/forms-table-card.tsx b/apps/web/components/marketing/forms-table-card.tsx index 770514e..3a17cb8 100644 --- a/apps/web/components/marketing/forms-table-card.tsx +++ b/apps/web/components/marketing/forms-table-card.tsx @@ -1,88 +1,134 @@ "use client"; -import { ArrowDown, ArrowUp, Inbox } from "lucide-react"; import { useState } from "react"; import { Card } from "@/components/ui/card"; -type Row = { slug: string; messages: number; spam: number; lastMin: number }; +type FormEndpoint = { + slug: string; + name: string; + submissions: number; + cleanRate: string; + lastActive: string; + key: string; +}; -const ROWS: Row[] = [ - { slug: "portfolio-contact", messages: 142, spam: 0.1, lastMin: 2 }, - { slug: "client-inquiry", messages: 84, spam: 0.2, lastMin: 14 }, - { slug: "book-meeting", messages: 56, spam: 0.0, lastMin: 32 }, - { slug: "newsletter", messages: 320, spam: 0.4, lastMin: 5 }, - { slug: "product-feedback", messages: 48, spam: 0.0, lastMin: 80 }, +const FORMS: FormEndpoint[] = [ + { + slug: "portfolio-contact", + name: "Portfolio Contact", + submissions: 142, + cleanRate: "99.8%", + lastActive: "2m ago", + key: "hl_forms_9a2b71c", + }, + { + slug: "client-inquiry", + name: "Client Inquiries", + submissions: 84, + cleanRate: "100%", + lastActive: "14m ago", + key: "hl_forms_4f1c83e", + }, + { + slug: "newsletter", + name: "Newsletter Signup", + submissions: 320, + cleanRate: "99.4%", + lastActive: "5m ago", + key: "hl_forms_7e8d24a", + }, + { + slug: "book-meeting", + name: "Discovery Bookings", + submissions: 56, + cleanRate: "100%", + lastActive: "32m ago", + key: "hl_forms_1b3a90f", + }, + { + slug: "product-feedback", + name: "User Feedback", + submissions: 48, + cleanRate: "100%", + lastActive: "1h ago", + key: "hl_forms_5c9e62b", + }, ]; -const COLUMNS: { key: SortKey; label: string; align: string }[] = [ - { key: "slug", label: "Form", align: "text-left" }, - { key: "messages", label: "Messages", align: "text-right" }, - { key: "spam", label: "Spam", align: "text-right" }, - { key: "lastMin", label: "Last", align: "text-right" }, -]; - -type SortKey = "slug" | "messages" | "spam" | "lastMin"; - -function ago(min: number) { - return min < 60 ? `${min}m ago` : `${Math.round(min / 60)}h ago`; -} - -/** Demo forms table: sortable columns, hover + selectable rows. */ export function FormsTableCard() { - const [sort, setSort] = useState<{ key: SortKey; dir: 1 | -1 }>({ key: "messages", dir: -1 }); - const [selected, setSelected] = useState(null); + const [activeSlug, setActiveSlug] = useState("portfolio-contact"); + const selected = FORMS.find((f) => f.slug === activeSlug) || FORMS[0]; - const rows = [...ROWS].sort((a, b) => { - const va = a[sort.key]; - const vb = b[sort.key]; - const cmp = typeof va === "string" ? va.localeCompare(vb as string) : (va as number) - (vb as number); - return cmp * sort.dir; - }); + return ( + + {/* Top Header Bar */} +
+
+ form_endpoints + / + production +
+
+ + 5 active keys +
+
- const toggleSort = (key: SortKey) => - setSort((s) => (s.key === key ? { key, dir: s.dir === 1 ? -1 : 1 } : { key, dir: key === "slug" ? 1 : -1 })); + {/* Table Head */} +
+ Endpoint + Submissions + Clean + Activity +
- return ( - -
- {COLUMNS.map((c) => ( - - ))} + > +
+ /{r.slug} +
+ + {r.submissions.toLocaleString()} + + + {r.cleanRate} + + + {r.lastActive} + + + ); + })} +
+ + {/* Embed snippet footer for the selected form */} +
+
+ Live HTML Embed + POST /submit +
+ 
+          {`

+  
+  
+  
+  
+
`}
+
- {rows.map((r) => ( - - ))} ); } diff --git a/services/scheduling/internal/calendar/google.go b/services/scheduling/internal/calendar/google.go index 46d4c40..5d396b4 100644 --- a/services/scheduling/internal/calendar/google.go +++ b/services/scheduling/internal/calendar/google.go @@ -40,11 +40,11 @@ type Google struct { func New(pool *pgxpool.Pool, settings config.OAuth, key, webURL string) *Google { redirectURL := strings.TrimSpace(settings.RedirectURL) - if redirectURL == "" || strings.Contains(redirectURL, "/v1/oauth/google/callback") { - cleanWeb := strings.TrimRight(strings.TrimSpace(webURL), "/") - if cleanWeb == "" { - cleanWeb = "http://localhost:3000" - } + cleanWeb := strings.TrimRight(strings.TrimSpace(webURL), "/") + if cleanWeb == "" { + cleanWeb = "http://localhost:3000" + } + if redirectURL == "" || strings.Contains(redirectURL, "/v1/oauth/google/callback") || (strings.HasPrefix(cleanWeb, "https://") && strings.Contains(redirectURL, "localhost")) { redirectURL = cleanWeb + "/api/calendar/callback" } return &Google{ diff --git a/services/shared/config/config.go b/services/shared/config/config.go index e2e2571..44e6c5b 100644 --- a/services/shared/config/config.go +++ b/services/shared/config/config.go @@ -142,11 +142,15 @@ func Load() (*Config, error) { cfg.App.PublicAPIURL = "https://halomailapi.zeroaxiis.tech" } } - if strings.TrimSpace(cfg.Google.RedirectURL) == "" || strings.Contains(cfg.Google.RedirectURL, "/v1/oauth/google/callback") { - cleanWeb := strings.TrimRight(strings.TrimSpace(cfg.App.PublicWebURL), "/") - if cleanWeb == "" { + cleanWeb := strings.TrimRight(strings.TrimSpace(cfg.App.PublicWebURL), "/") + if cleanWeb == "" { + if cfg.App.IsProd() { + cleanWeb = "https://halomail.zeroaxiis.tech" + } else { cleanWeb = "http://localhost:3000" } + } + if strings.TrimSpace(cfg.Google.RedirectURL) == "" || strings.Contains(cfg.Google.RedirectURL, "/v1/oauth/google/callback") || (cfg.App.IsProd() && strings.Contains(cfg.Google.RedirectURL, "localhost")) { cfg.Google.RedirectURL = cleanWeb + "/api/calendar/callback" } return cfg, nil From d9b6049dc13a2429e0e41142c58f6ec3347d6d23 Mon Sep 17 00:00:00 2001 From: DrDead0 <112349103+DrDead0@users.noreply.github.com> Date: Sat, 31 Oct 2026 23:00:38 +0530 Subject: [PATCH 2/2] feat(legal): add comprehensive data protection compliance, liability shields, and OWASP security headers --- apps/web/app/(marketing)/privacy/page.tsx | 127 ++++++++++++++++++---- apps/web/app/(marketing)/terms/page.tsx | 117 +++++++++++++++----- apps/web/next.config.mjs | 21 ++++ 3 files changed, 215 insertions(+), 50 deletions(-) diff --git a/apps/web/app/(marketing)/privacy/page.tsx b/apps/web/app/(marketing)/privacy/page.tsx index 73164e1..c030391 100644 --- a/apps/web/app/(marketing)/privacy/page.tsx +++ b/apps/web/app/(marketing)/privacy/page.tsx @@ -2,60 +2,143 @@ import { Metadata } from "next"; export const metadata: Metadata = { title: "Privacy Policy | HaloMail", - description: "HaloMail privacy policy and data handling procedures.", + description: "HaloMail global privacy policy, data protection disclosures, and Google API compliance.", }; export default function PrivacyPage() { return ( -
-

- Privacy Policy -

-
+
+
+

Legal Compliance

+

+ Global Privacy Policy +

+

+ Effective Date: October 31, 2026 • Last Updated: October 31, 2026 +

+
+ +
-

1. Information We Collect

+

1. Overview & Commitments

- When you use HaloMail, we may collect personal information that you provide to us directly, such as your name, email address, and payment information (processed securely by Razorpay). We also collect diagnostic data regarding the emails you send via our API (such as delivery status) to provide our service. + HaloMail ("we", "us", or "our", operated by zeroaxiis) provides high-performance transactional email delivery, secure embeddable contact forms, and automated calendar scheduling infrastructure. We are committed to safeguarding personal information and complying with global privacy laws, including the European Union and United Kingdom General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act and California Privacy Rights Act (CCPA / CPRA), the Indian Digital Personal Data Protection Act (DPDP Act 2023), Brazil's Lei Geral de Proteção de Dados (LGPD), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

-

2. How We Use Your Information

-

We use the collected information for various purposes:

+

2. Data Controller vs. Data Processor

+

+ To ensure complete clarity under international privacy frameworks: +

    -
  • To provide and maintain our Service.
    • -
  • To notify you about changes to our Service.
    • -
  • To provide customer support.
    • -
  • To monitor the usage of our Service and prevent abuse (e.g., spam).
    • +
  • + HaloMail as a Data Controller: We act as the Data Controller with respect to account management details, billing information, and direct communications regarding your HaloMail account. +
    • +
  • + HaloMail as a Data Processor: When you embed forms on your website, receive contact messages, or host calendar booking slots, you are the Data Controller for your end-users' data, and HaloMail acts strictly as a Data Processor following your configurations and instructions. You are responsible for ensuring that your collection of data through HaloMail complies with applicable local laws and that proper notices are provided to your visitors. +
-

3. Data Security and Privacy

+

3. Information We Collect

+
+

We collect only the minimum personal information necessary to deliver and secure our platform:

+
    +
  • Account Credentials: Name, verified email address, hashed passwords, and cryptographic session identifiers. One-time login codes (OTP) are generated server-side and never exposed to the client.
    • +
  • Billing & Payment Information: Subscription tiers and payment records. Sensitive payment details (e.g., credit card numbers, UPI handles) are tokenized and processed directly by our PCI-DSS compliant payment gateway (Razorpay); HaloMail never stores raw payment card numbers.
    • +
  • Form Submissions & Booking Records: Form input fields, submission timestamps, attendee names, attendee email addresses, meeting notes, and selected time slots.
    • +
  • Technical Diagnostics: IP addresses, browser user-agent strings, rate-limiting telemetry, and outbox delivery statuses used strictly to prevent spam, detect bot attacks, and ensure network security.
    • +
+
+
+ +
+

4. Google API Services & Limited Use Policy

+

+ HaloMail allows users to connect their Google Calendar and generate Google Meet video conferencing links. Our use of Google user data is strictly bounded: +

+
    +
  • Calendar Scopes: We request access to calendar.events and calendar.readonly solely to calculate real-time scheduling availability, prevent double bookings, and insert confirmed calendar invites.
    • +
  • Cryptographic Storage: Google OAuth tokens (access and refresh tokens) are encrypted at rest in our databases using AES-256-GCM authenticated encryption.
    • +
  • Zero Commercial Exploitation: We will never sell Google user data to any third party, use Google user data for advertising, or use Google user data to train generalized artificial intelligence or machine learning models.
    • +
  • Human Review Prohibition: HaloMail employees and contractors are strictly prohibited from reading or viewing your connected Google Calendar data, except where you have provided explicit consent for debugging a specific support ticket, or where required by law.
    • +
+

+ HaloMail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. +

+
+ +
+

5. Legal Bases for Processing (GDPR & International Law)

+

We process personal information under the following lawful grounds:

+
    +
  • Performance of a Contract: Processing necessary to provide form routing, deliver notifications, sync appointments, and fulfill our Terms of Service.
    • +
  • Legitimate Interests: Securing our infrastructure, enforcing rate limits, preventing automated spam, and diagnosing platform outages.
    • +
  • Compliance with Legal Obligations: Retaining tax and transactional records required by applicable financial authorities.
    • +
  • Consent: Where you have expressly consented to an integration (such as connecting Google Calendar or subscribing to product updates). Consent may be revoked at any time.
    • +
+
+ +
+

6. "Do Not Sell or Share My Information" (CCPA / CPRA)

- The security of your data is important to us. We implement strict security measures to protect your personal information. We do not sell your personal information or the email addresses of your recipients to third parties. Email contents transmitted through our API are processed securely and deleted from our active transactional databases in accordance with our retention policies. + We do not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate personal information or recipient contact data to third parties in exchange for monetary or other valuable consideration. Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to know what personal information is collected, request deletion, and not receive discriminatory treatment for exercising privacy rights.

-

4. Third-Party Services

+

7. Your Global Privacy Rights & How to Exercise Them

+

Regardless of your jurisdiction, HaloMail grants users comprehensive data rights:

+
+
+

Right to Access & Portability

+

Request a machine-readable copy (JSON/CSV) of your stored profile, form submissions, and meeting bookings.

+
+
+

Right to Erasure (Right to be Forgotten)

+

Permanently delete your account, forms, API keys, and stored submissions at any time from your dashboard or via API.

+
+
+

Right to Rectification

+

Correct inaccurate or incomplete profile details directly in your account settings.

+
+
+

Right to Revoke Integrations

+

Disconnect Google Calendar with 1-click in your Meetings settings, which immediately purges your stored OAuth tokens.

+
+

- We may employ third-party companies (such as payment processors like Razorpay and email delivery partners) to facilitate our Service. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. + To submit an inquiry or exercise any statutory rights, email our team at privacy@zeroaxiis.tech or legal@zeroaxiis.tech. We respond to all verified requests within thirty (30) days without charge.

-

5. Your Rights

+

8. Security Architecture & Safeguards

- You have the right to access, update, or delete the personal information we hold about you. You can do this from your account dashboard or by contacting our support team at support@zeroaxiis.tech. + We implement industry-grade technical and organizational security controls:

+
    +
  • End-to-end transport layer encryption (TLS 1.2+ and TLS 1.3) with HSTS enforcement.
    • +
  • AES-256-GCM symmetric encryption for all calendar credentials and third-party tokens.
    • +
  • Cryptographic SHA-256 hashing for all issued API keys (keys are shown once upon creation and cannot be retrieved plaintext).
    • +
  • Strict Content-Security-Policy (CSP), Clickjacking defense (X-Frame-Options: DENY), and MIME-sniffing protection.
    • +
  • Continuous automated vulnerability scanning and database isolation.
    • +
-

6. Changes to This Privacy Policy

+

9. Data Protection Officer & Grievance Redressal

- We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "effective date". You are advised to review this Privacy Policy periodically for any changes. + In compliance with international data regulations and Section 8(9) of the Indian Digital Personal Data Protection Act 2023, you may contact our designated Data Protection & Grievance Officer:

+
+

Entity: zeroaxiis (HaloMail Platform)

+

Designation: Data Protection Officer / Grievance Redressal Officer

+

Email: legal@zeroaxiis.tech / support@zeroaxiis.tech

+

Address: Uttar Pradesh, 273004, India

+
diff --git a/apps/web/app/(marketing)/terms/page.tsx b/apps/web/app/(marketing)/terms/page.tsx index e125986..a6a5b35 100644 --- a/apps/web/app/(marketing)/terms/page.tsx +++ b/apps/web/app/(marketing)/terms/page.tsx @@ -1,71 +1,132 @@ import { Metadata } from "next"; export const metadata: Metadata = { - title: "Terms and Conditions | HaloMail", - description: "HaloMail terms of service and usage conditions.", + title: "Terms of Service | HaloMail", + description: "HaloMail terms of service, acceptable use conditions, liability limits, and legal protections.", }; export default function TermsPage() { return ( -
-

- Terms and Conditions -

-
+
+
+

Legal Terms

+

+ Terms of Service +

+

+ Effective Date: October 31, 2026 • Last Updated: October 31, 2026 +

+
+ +
-

1. Acceptance of Terms

+

1. Acceptance of Terms & Binding Agreement

- By accessing and using HaloMail (the "Service"), you accept and agree to be bound by the terms and provision of this agreement. If you do not agree to abide by these terms, please do not use this Service. + By creating an account, accessing, embedding, or using HaloMail (the "Service", operated by zeroaxiis), you enter into a legally binding agreement and accept all terms contained herein. If you are using the Service on behalf of an entity, organization, or company, you represent and warrant that you have full legal authority to bind that entity to these Terms. If you do not agree to these Terms, you must immediately cease all access and use of the Service.

-

2. Provision of Services

+

2. Description of Services & Evolution

- HaloMail provides email delivery and API infrastructure. We reserve the right to modify, suspend, or discontinue any aspect of the service at any time without prior notice. + HaloMail provides developer-first contact form endpoints, transactional email infrastructure, and automated calendar scheduling. We reserve the absolute right to modify, upgrade, deprecate, or suspend any feature or endpoint at any time with or without notice. We shall not be liable to you or any third party for any modification, suspension, or discontinuance of the Service. +

+
+ +
+

3. Acceptable Use Policy & Zero-Tolerance Anti-Spam

+

+ You agree to use HaloMail in strict compliance with all applicable domestic and international laws, including CAN-SPAM (US), CASL (Canada), GDPR (EU), and the Indian Information Technology Act. You explicitly represent and warrant that you will NOT: +

+
    +
  • Transmit unsolicited bulk email (spam), phishing attempts, deceptive headers, or fraudulent messages.
    • +
  • Use the Service to transmit malicious code, malware, viruses, or exploit kits.
    • +
  • Collect, harvest, or solicit passwords, financial credentials, or sensitive health data through forms without explicit, lawful authorization.
    • +
  • Interfere with, disrupt, or place an unreasonable load on our infrastructure (such as DDoS or bypassing rate limits).
    • +
  • Attempt to reverse engineer, decompile, or extract the source code of our proprietary routing and anti-abuse systems.
    • +
+

+ Any violation of this section entitles HaloMail to terminate your account immediately without warning, notice, or refund.

-

3. User Responsibilities

-

As a user of HaloMail, you agree to:

+

4. Customer Data & End-User Consent Responsibility

+

+ When you embed HaloMail forms or calendar booking links on your websites, you act as the independent Data Controller for the personal data of your website visitors and meeting attendees. You agree, represent, and warrant that: +

    -
  • Provide accurate and complete registration information.
    • -
  • Never use the Service to send unsolicited spam, phishing emails, or malicious content.
    • -
  • Maintain the security of your account and API keys.
    • -
  • Comply with all applicable local and international laws regarding email communication.
    • +
  • You have obtained all necessary consents, authorizations, and legal permissions from your visitors before collecting or transmitting their data through HaloMail.
    • +
  • You maintain a conspicuous, legally compliant Privacy Policy on your own digital properties that accurately informs end-users regarding how their information is collected, processed, and routed.
    • +
  • HaloMail is merely a technological conduit and processor acting under your direction; HaloMail disclaims all liability for the content, lawfulness, or legitimacy of submissions captured via your access keys.
-

4. Account Termination

+

5. Third-Party Integrations (Google, Resend, Razorpay)

- We may terminate or suspend access to our Service immediately, without prior notice or liability, for any reason whatsoever, including without limitation if you breach the Terms. Any violation related to spam or abuse will result in immediate permanent suspension without a refund. + HaloMail integrates with external third-party services, including Google (for Calendar and Meet conferencing), Resend (for SMTP email transport), and Razorpay (for payment billing). Your use of those integrations is subject to each respective third-party's terms and policies. HaloMail is not responsible for any downtime, API changes, account suspensions, or service failures originating from third-party platforms.

+
+

+ 6. Conspicuous Disclaimer of Warranties ("AS IS") +

+

+ TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE, APIS, SOFTWARE, AND DOCUMENTATION ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. HALOMAIL AND ZEROAXIIS SPECIFICALLY DISCLAIM ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL OPERATE UNINTERRUPTED, SECURE, OR ERROR-FREE, OR THAT ANY EMAILS, NOTIFICATIONS, OR SUBMISSIONS WILL BE DELIVERED WITHOUT LOSS OR DELAY. +

+
+ +
+

+ 7. Absolute Limitation of Liability +

+

+ TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL HALOMAIL, ZEROAXIIS, ITS FOUNDERS, DIRECTORS, EMPLOYEES, AFFILIATES, OR SUPPLIERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF PROFITS, REVENUE, GOODWILL, DATA, WORK STOPPAGE, OR BUSINESS INTERRUPTION, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OR INABILITY TO USE THE SERVICE. +

+

+ UNDER NO CIRCUMSTANCES SHALL HALOMAIL'S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT, UNDER ANY LEGAL OR EQUITABLE THEORY (WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE), EXCEED THE GREATER OF FIFTY UNITED STATES DOLLARS ($50.00 USD) OR THE TOTAL AMOUNT ACTUALLY PAID BY YOU TO HALOMAIL IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. +

+
+ +
+

8. Comprehensive User Indemnification

+

+ You agree to defend, indemnify, and hold harmless HaloMail, zeroaxiis, and its officers, directors, employees, contractors, and agents from and against any and all claims, liabilities, damages, losses, expenses, judgments, fines, and reasonable attorney's fees arising out of or related to: +

+
    +
  • Your access to, use of, or misuse of the Service.
    • +
  • Your violation of any provision of these Terms or Acceptable Use Policy.
    • +
  • Any content, message, or personal data submitted, processed, or distributed through your form endpoints or API keys.
    • +
  • Your violation of any law, regulation, or third-party right (including privacy, publicity, or intellectual property rights).
    • +
+
+
-

5. Payments and Billing

+

9. Class Action Waiver & Binding Dispute Resolution

- Payments are processed securely via our payment partners (Razorpay). By subscribing to a paid tier, you agree to pay all applicable fees. Refunds are strictly governed by our Refund Policy, and are generally limited to specific conditions within 7 days of purchase. + YOU AND HALOMAIL AGREE THAT ALL DISPUTES MUST BE RESOLVED ON AN INDIVIDUAL BASIS. YOU WAIVE ANY RIGHT TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS ACTION, COLLECTIVE ACTION, PRIVATE ATTORNEY GENERAL ACTION, OR REPRESENTATIVE PROCEEDING AGAINST HALOMAIL OR ZEROAXIIS.

-

6. Limitation of Liability

+

10. Governing Law & Exclusive Jurisdiction

- In no event shall HaloMail, nor its directors, employees, partners, agents, suppliers, or affiliates, be liable for any indirect, incidental, special, consequential or punitive damages, including without limitation, loss of profits, data, use, goodwill, or other intangible losses, resulting from your access to or use of or inability to access or use the Service. + These Terms and any dispute or claim arising out of or in connection with them shall be governed by and construed in accordance with the laws of India, without giving effect to any conflict of law principles. You agree that any legal action or proceeding shall be brought exclusively in the competent courts located in Uttar Pradesh, India.

-

7. Contact Information

+

11. Legal Inquiries & Notices

- If you have any questions regarding these Terms, please contact us at support@zeroaxiis.tech or legal@zeroaxiis.tech.

- zeroaxiis
- Uttar Pradesh, 273004
- India + Notices under these Terms should be sent electronically to:

+
+

Legal & Compliance Department: zeroaxiis (HaloMail)

+

Email: legal@zeroaxiis.tech / support@zeroaxiis.tech

+

Location: Uttar Pradesh, 273004, India

+
diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs index 55d6e86..d017cb8 100644 --- a/apps/web/next.config.mjs +++ b/apps/web/next.config.mjs @@ -37,6 +37,27 @@ const nextConfig = { // strict lock: only allow fetch/xhr to itself, the backend API, and Razorpay value: "connect-src 'self' https://halomailapi.zeroaxiis.tech http://localhost:8080 http://127.0.0.1:8080 https://api.razorpay.com https://*.razorpay.com;", }, + { + key: "X-Content-Type-Options", + value: "nosniff", + }, + { + key: "Referrer-Policy", + value: "strict-origin-when-cross-origin", + }, + { + key: "Permissions-Policy", + value: "camera=(), microphone=(), geolocation=()", + }, + ], + }, + { + source: "/((?!book).*)", + headers: [ + { + key: "X-Frame-Options", + value: "DENY", + }, ], }, ];