Legal & Policies

1. Parties & Nature of Service

ThinkOnline.IN is a web hosting reseller. We source and deliver shared web hosting infrastructure from Tier-1 upstream data centre partners operating out of Singapore. We are your sole point of contact for all billing, technical support, account management, and contractual matters. You have no direct contractual relationship with our upstream infrastructure partners. Our platform is powered by the StackCP hosting control panel and the Upmind client billing and support portal.

2. Eligibility

To subscribe to our services, you must:

• Be at least 18 years of age (see Clause 11 for minors);
• Possess full legal capacity to enter into binding contracts under Indian law;
• Provide accurate, current, and complete registration details;
• Not be subject to any legal prohibition on receiving services of this nature under any applicable law.

3. Account Registration & Credentials

You must maintain the security and confidentiality of your client portal credentials at my.thinkonline.co.in and your hosting control panel credentials at cp.thinkonline.co.in. You are fully responsible for all activities occurring under your account. Notify us immediately at support@thinkonline.co.in if you suspect unauthorised access.

4. Service Description & Plans

ThinkOnline.IN provides shared web hosting via StackCP, including web space, bandwidth, email hosting (10 GB per mailbox), MySQL databases, SSL certificates, CDN, malware scanning, and related features as described in your chosen plan.

5. Billing, Payment & GST

All fees are quoted in Indian Rupees (INR), billed annually, and are due in full in advance. GST at the applicable rate is added to all invoices (GSTIN: 10CREPS5144Q1ZF). Accepted payment methods include UPI, Net Banking, Credit/Debit Cards, and digital wallets as listed in the billing portal. Invoices are issued through our Upmind billing system. Accounts with overdue invoices beyond the grace period of 7 days from the invoice date may be suspended.

6. Auto-Renewal

Services renew automatically on an annual basis unless cancelled at least 7 days before the renewal date via the billing portal at my.thinkonline.co.in. Annual renewal invoices are sent 14 days in advance to your registered email address.

7. Fair Use Policy

"Unlimited" resources on the Unlimited plan are subject to reasonable fair use. Shared hosting is a shared environment and is not designed for: file-distribution networks, high-CPU or persistent automated scripts, cryptocurrency mining, or resource-intensive processes that degrade the experience of other customers. Accounts in material breach of fair use will be asked to upgrade or may be suspended.

8. Intellectual Property

All ThinkOnline.IN branding, website content, platform configurations, and marketing materials are our intellectual property. Your hosted content remains entirely your own. By hosting content on our servers, you grant ThinkOnline.IN a limited, non-exclusive, royalty-free licence to host, store, and deliver your content solely to provide the agreed hosting service. This licence terminates upon account closure.

9. Termination

Either party may terminate with 7 days' written notice. We may immediately suspend or terminate for: material breach of these Terms or the Acceptable Use Policy; non-payment after the grace period; illegal activity; or sustained resource abuse. Upon termination, your data may be retained for up to 30 days before being securely deleted. We strongly recommend maintaining independent backups of your data at all times.

10. Limitation of Liability

To the maximum extent permitted under Indian law, ThinkOnline.IN's total aggregate liability shall not exceed the total hosting fees paid by you in the three (3) calendar months immediately preceding the event giving rise to the claim. We are not liable for indirect, special, incidental, punitive, or consequential damages; loss of data, profits, or goodwill; business interruption; or third-party actions.

11. Children & Minors (DPDP Act 2023, Section 9)

Our services are not directed at persons under 18. Where a minor seeks to use our services under parental guidance, verifiable parental or guardian consent is required as mandated by Section 9 of the DPDP Act 2023. We do not knowingly collect personal data from minors without verified parental consent.

12. Governing Law & Dispute Resolution

These Terms are governed by the laws of India. Any dispute shall be subject to the exclusive jurisdiction of courts at Saran, Bihar. Both parties agree to attempt good-faith resolution within 30 days of written notice of a dispute before initiating formal proceedings.

13. Amendments

We may update these Terms at any time. Material changes will be communicated via email to your registered address at least 14 days before taking effect. Continued use of our services after that date constitutes acceptance of the revised Terms.

1. Personal Data We Collect

A. Data You Provide Directly

• Full name, email address, phone number, and billing address at registration or order placement;
• GSTIN or PAN for business invoicing (only with your explicit consent);
• Support queries, tickets, and communications;
• Payment details — entered directly on our PCI DSS-certified payment gateway; ThinkOnline.IN does not receive, store, or process raw cardholder data (see PCI SAQ A Statement).

B. Data Collected Automatically

• IP address (hashed/anonymised for analytics purposes);
• Browser type, device type, and operating system;
• Pages visited, session duration, and referring URLs;
• Server access and error logs (retained for 90 days);
• Consent records: consent ID, timestamp, categories consented, IP hash, and user agent (stored under DPDP Act requirements);
• Cookies and similar technologies (see Cookie Policy).

2. Purpose Limitation & Legal Basis (DPDP Act 2023, Sections 4–6)

• Service delivery: Provisioning and maintaining hosting services — Consent + contractual performance;
• Billing & invoicing: Processing payments and issuing GST-compliant invoices — Consent + legal obligation (CGST Act);
• Transactional communications: Account confirmations, renewals, security alerts — Consent;
• Customer support: Responding via Upmind ticketing — Consent + legitimate interest;
• Security: Fraud detection and threat mitigation — Legitimate interest;
• Legal compliance: GST, tax law, court orders — Legal obligation;
• Marketing: Only with explicit, freely-given, separately obtained consent — withdrawable at any time.

3. Consent Management (DPDP Act 2023, Section 6)

Consent is obtained through clear, affirmative action using non-pre-ticked checkboxes at first visit and at account registration. Consent is granular — you may accept or decline each category (Necessary / Functional / Analytics / Marketing) separately. Consent records are logged with a unique Consent ID, timestamp, and HMAC-sealed proof. You may withdraw any consent at any time via our Data Rights Portal or by emailing support@thinkonline.co.in. Withdrawal does not affect the lawfulness of prior processing.

4. Data Sharing & Processors (DPDP Act 2023, Section 8)

We share data only with:

• Infrastructure partners: Singapore Tier-1 data centre operators, under strict confidentiality and data processing agreements;
• Payment processors: RBI-authorised payment aggregators under their own PCI DSS certifications; we receive only transaction tokens;
• Billing platform: Upmind, which stores account, subscription, and support data under a Data Processing Agreement;
• Legal authorities: As required by valid Indian court orders, government directions, or applicable law;
• Business succession: In the event of a merger, acquisition, or business transfer, with prior written notice to affected Data Principals.

No overseas transfer occurs outside India and Singapore (a permissible jurisdiction under DPDP Act Section 16) without contractual safeguards equivalent to DPDP Act protections.

5. Data Principal Rights (DPDP Act 2023, Sections 11–14)

To exercise any right, visit our Data Rights Portal or email support@thinkonline.co.in with subject "DPDP Rights Request". We acknowledge within 48 hours and respond fully within 30 days. Unresolved complaints may be escalated to the Data Protection Board of India at dpboard.gov.in.

6. Grievance Officer (DPDP Act 2023, Section 13)

• Name: Pranav Sharma
• Email: pranav@thinkonline.in
• Address: PARSA, SARAN, BIHAR, INDIA
• Response: Acknowledgement within 48 hours; full resolution within 30 days.

7. Data Retention (DPDP Act 2023, Section 8(7))

• Active account data (name, contact, billing): subscription duration + 5 years (GST/legal compliance);
• Support tickets and communications: 12 months from closure;
• Server access and error logs: 90 days;
• Consent records: duration of service + 1 year audit trail;
• Marketing consent records: until withdrawal + 1 year audit trail;
• DSAR (Data Rights Request) records: 3 years from resolution.

Data is securely deleted or anonymised at the end of the applicable retention period.

8. Cross-Border Transfers (DPDP Act 2023, Section 16)

Primary data processing occurs within India and Singapore. Transfers to Singapore Tier-1 data centres are made under contractual safeguards equivalent to DPDP Act protections, in jurisdictions notified or permissible under Section 16 of the Act.

9. Security Safeguards (DPDP Act 2023, Section 8(5))

• TLS 1.2+ encryption for all data in transit;
• Bcrypt-hashed and salted password storage;
• Role-based access controls (admin, support, viewer);
• CSRF protection on all form submissions;
• 1 Tbps+ DDoS protection at the network layer;
• Automated malware scanning;
• HMAC-sealed consent logs for tamper detection;
• Breach notification to affected Data Principals and the Data Protection Board of India within 72 hours of becoming aware of a personal data breach.

10. Children's Data (DPDP Act 2023, Section 9)

ThinkOnline.IN's services are not directed at persons under 18 years of age. We do not knowingly process personal data of minors without verifiable parental or guardian consent as required by Section 9 of the DPDP Act 2023. An age verification mechanism is in place at service entry points. If you believe a minor has provided personal data without appropriate consent, contact us immediately at support@thinkonline.co.in.

11. Policy Updates

We review this Privacy Policy at least annually. Material changes will be communicated via email at least 14 days before they take effect.

1. The 24-Hour Money-Back Guarantee

New customers may claim a full refund within 24 calendar hours of the precise date and time of hosting account activation, as recorded in our Upmind billing system, provided:

• The refund request is submitted within the 24-hour window via support ticket at my.thinkonline.co.in or by email to support@thinkonline.co.in;
• The account has not violated our Acceptable Use Policy;
• The request relates to the initial hosting plan purchase only — plan renewals, upgrades, and add-ons are excluded.

2. Non-Refundable Items

• Domain name registrations, transfers, renewals, or redemptions;
• Third-party SSL certificates (beyond the free SSL included in all plans);
• Plan renewal payments (annual or monthly);
• Promotional, discounted, or free-trial plans where non-refundable terms were stated at purchase;
• One-time migration fees, setup fees, or professional services charges;
• Add-on services, software licences, and third-party integrations.

3. Exceptional Post-Guarantee Refunds

The following items are strictly non-refundable once provisioned:

• Domain name registrations, transfers, and renewals (governed by registry policies; non-reversible);
• Custom setup fees or dedicated migration charges (if applicable);
• SSL certificates issued as standalone products;
• Any service terminated due to a violation of our Acceptable Use Policy.

3. Renewal Refunds

Hosting renewals are non-refundable once processed. We send advance reminder notices via email 14 days and 3 days prior to renewal so you have ample time to cancel if you do not wish to continue.

4. How to Request a Refund

1. Submit a support ticket from your client portal at my.thinkonline.co.in, or email support@thinkonline.co.in with subject "Refund Request – [Your Account Email]";
2. State the reason (optional, but helps us improve) and your registered email address;
3. Refunds are processed to the original payment method within 5–10 business days.

5. GST Treatment

Refunded amounts include applicable GST. A credit note under Section 34 of the CGST Act, 2017 will be issued for the cancelled supply.

6. Chargebacks

Please contact us before raising a chargeback with your bank or card issuer. Unauthorised chargebacks may result in immediate account suspension and recovery proceedings. We commit to resolving all legitimate billing disputes promptly, fairly, and transparently.

7. Data After Refund

Upon successful refund and account cancellation, your data will be retained for 30 days (allowing for reactivation if needed) and then securely deleted in accordance with our Privacy Policy and DPDP Act 2023 retention obligations.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us remember your preferences, understand how you use our site, and deliver relevant content. Cookies do not access other files on your device.

1. Strictly Necessary (No Consent Required)

These cookies are essential for the website to function. They cannot be disabled via our consent panel.

• Session cookie — maintains your logged-in state in the client portal; duration: session;
• XSRF-TOKEN — CSRF protection for all form submissions; duration: session;
• consent_id — stores your unique consent reference ID; duration: 1 year;
• Load-balancer cookie — routes requests to the correct server; duration: session.

2. Functional (Consent Required)

These cookies enhance your experience by remembering your preferences.

• Language preference — remembers your preferred language; duration: 1 year;
• Currency preference — remembers your preferred currency display; duration: 1 year;
• Form pre-fill — stores partially completed form data temporarily; duration: session.

3. Analytics (Consent Required)

These cookies help us understand how visitors interact with our website, with all personal data anonymised.

• Google Analytics (_ga, _gid) — page views and session duration with anonymised IPs; duration: up to 2 years;
• Internal analytics — platform usage metrics; duration: 90 days.

4. Marketing (Consent Required)

These cookies enable personalised advertising and are only set when you explicitly consent.

• Google Ads (_gcl_*) — conversion tracking for ad campaigns; duration: 90 days;
• Retargeting pixel — personalised ad delivery; duration: 90 days.

5. Managing Your Consent

You may update or withdraw your cookie consent at any time by clicking the buttons below or visiting our Data Rights Portal. You can also opt out of specific third-party services: Google Analytics opt-out · Google Ads settings.

6. Third-Party Cookies

Some cookies are set by third parties (Google Analytics, Google Ads). These parties operate under their own privacy policies. ThinkOnline.IN does not control third-party cookies and is not responsible for their content or practices.

7. Managing Cookies in Your Browser

You may also control cookies through your browser settings: Chrome · Firefox · Safari · Edge. Note: disabling strictly necessary cookies may prevent our website from functioning correctly.

1. Services Provided "As Is"

ThinkOnline.IN provides hosting services on an "as is" and "as available" basis. Except as expressly stated in our SLA, we make no representations or warranties — express, implied, or statutory — regarding fitness for purpose, uninterrupted availability, accuracy, or completeness of our services or website content.

2. Uptime & Continuity

We target ≥99.9% monthly uptime per our SLA. Service interruptions may arise from: scheduled maintenance (notified ≥48 hours in advance); force majeure events (natural disasters, power grid failures, government-directed shutdowns, pandemics); third-party infrastructure failures beyond our control; or DDoS attacks exceeding our mitigation capacity at the time. Our liability in such cases is limited to the SLA credit remedies described in the SLA & Uptime document.

3. Third-Party Applications & Software

Applications available via the one-click installer in StackCP (WordPress, Joomla, Magento, PrestaShop, WooCommerce, and others) are developed, maintained, and licensed by their respective owners. ThinkOnline.IN provides the installation infrastructure only and assumes no responsibility for third-party software vulnerabilities, bugs, security exploits, data loss arising from third-party applications, or licensing obligations. Clients are responsible for keeping all installed software updated and properly configured.

4. Security Responsibility

Despite our 1 Tbps+ DDoS protection, free SSL, Web Application Firewall (WAF), and automated malware scanning, no digital system is absolutely impenetrable. You remain responsible for: keeping your installed software (WordPress, plugins, themes, etc.) updated to the latest versions; maintaining strong, unique passwords; and maintaining independent, off-server backups of your data. Our automated server-side snapshots are provided on a best-effort basis and do not constitute a complete backup solution.

5. Payment Processing

All online payments are processed by RBI-authorised, PCI DSS-compliant payment gateways. ThinkOnline.IN does not collect or store full payment card numbers or banking passwords. We are not liable for payment gateway outages, banking network failures, or unauthorised transactions originating from client-side credential compromise.

6. Pricing & Content Accuracy

All prices are subject to change without prior notice. GST is additional at applicable rates. We are not bound by typographical or other pricing errors on our website. Promotional prices are subject to the specific terms and availability periods stated at promotion launch. Website content is provided for informational purposes only and may not always reflect real-time product availability.

7. Professional Advice

Nothing on thinkonline.co.in constitutes legal, financial, technical, or professional advice. For legal compliance of your own hosted website or business, consult a qualified professional.

1. Scope

This AUP applies to all accounts, hosting plans, email services, and any resources accessed through ThinkOnline.IN's infrastructure, including resources provisioned via StackCP.

2. Permitted Uses

Our hosting infrastructure is intended for:

• Hosting legitimate websites, web applications, blogs, portfolios, and business portals;
• Running lawful e-commerce stores selling legal products and services;
• Sending transactional and legitimately opted-in marketing emails responsibly;
• Personal, educational, and non-profit website hosting;
• Using databases, storage, and email hosting in the normal course of operating a hosted website.

3. Prohibited Content

• Content illegal under Indian law, including the Information Technology Act 2000, Indian Penal Code, POCSO Act 2012, and IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021;
• Child Sexual Abuse Material (CSAM) — zero tolerance; immediately reported to NCPCR and Cyber Crime Cell;
• Malware, ransomware, spyware, phishing pages, credential-harvesting sites, or command-and-control servers;
• Pirated software, cracked tools, or copyright-infringing content in violation of the Copyright Act 1957;
• Hate speech, terrorist recruitment content, or material inciting communal violence or sectarian hatred;
• Online gambling or betting services without a valid and applicable licence;
• Cryptocurrency mining scripts consuming shared server resources.

4. Prohibited Activities

• Sending unsolicited bulk email (spam) or operating open mail relays;
• Launching or facilitating DDoS or DoS attacks against any system from our network;
• Unauthorised port scanning, exploitation, or vulnerability probing of third-party systems;
• Operating open proxy servers or anonymising relays used for illicit traffic;
• Excessive CPU, RAM, disk I/O, or bandwidth consumption that materially degrades shared hosting performance for other customers;
• Attempting to circumvent, disable, or interfere with our security controls or abuse detection systems;
• Reselling ThinkOnline.IN hosting services without prior written consent.

5. Email Standards

All email communications must comply with:

• The Telecom Commercial Communications Customer Preference Regulations (TCCCPR), TRAI;
• CAN-SPAM equivalent principles: functional unsubscribe links, accurate sender identity, non-deceptive subject lines;
• Recipients must have explicitly opted in to receive bulk or commercial communications;
• Mass sending exceeding 500 emails per hour per shared hosting account is throttled. Upgrade to VPS or a dedicated mail solution for high-volume email.

6. Resource Fair Use

"Unlimited" resources are subject to reasonable fair use. Scripts or processes that monopolise server resources — such as CPU-intensive crawlers, persistent server-side processes, or sustained high memory usage — are not permitted on shared hosting. We will notify you of excessive usage and may request an upgrade or impose temporary throttling.

7. Enforcement

1. Written warning via email explaining the breach and required corrective action;
2. Temporary suspension of the offending service or resource;
3. Permanent termination of the account without refund;
4. Referral to CERT-In, Cyber Crime Cell, NCPCR, or other relevant authorities as appropriate.

We reserve the right to skip steps 1–2 for severe breaches (CSAM, active malware distribution, DDoS origination).

1. Uptime Commitment & Measurement

We guarantee ≥99.9% availability per calendar month — equating to a maximum permitted downtime of approximately 43.8 minutes per month. Uptime is measured at 1-minute intervals from our automated monitoring infrastructure. Downtime is defined as consecutive periods of ≥5 minutes during which your hosted service is completely unreachable due to infrastructure issues within our control.

2. Infrastructure

All services are hosted on Singapore-based Tier-1 data centres with: redundant power (dual UPS + generator backup); redundant network uplinks; 1 Tbps+ DDoS mitigation at the network edge; physical security (biometric access, 24/7 CCTV); and automated monitoring at 1-minute intervals.

3. Excluded from Downtime Calculation

• Scheduled maintenance windows communicated ≥48 hours in advance via email and website notification;
• Outages caused by the Client's own code, configuration errors, or resource abuse;
• Third-party failures not under our control: domain registrars, DNS propagation, external payment gateways, CDN edge nodes;
• DDoS attacks that exceed our mitigation capacity at the time of the attack;
• Force majeure events: natural disasters, fires, floods, power grid failures, government-mandated shutdowns, or pandemics.

4. SLA Credit Schedule

• 99.0%–99.89% uptime → 10% credit on that month's hosting fee;
• 95.0%–98.99% uptime → 25% credit on that month's hosting fee;
• Below 95.0% uptime → 50% credit on that month's hosting fee.

5. Claiming SLA Credits

1. Submit within 14 calendar days of the end of the affected month via your billing portal at my.thinkonline.co.in, or email support@thinkonline.co.in;
2. Include supporting evidence (screenshots, monitoring logs, or incident references);
3. We will review and respond within 7 business days.

6. Scheduled Maintenance

Scheduled maintenance is communicated via email and website banner at least 48 hours in advance. Maintenance is typically scheduled between 12:00 AM – 6:00 AM IST on weekday nights to minimise disruption. Emergency security patching may be deployed with shorter notice and communicated as soon as practically possible.

7. Support Response Targets

• Critical (site completely down): 15-minute acknowledgement; 2-hour resolution target;
• High (partial service degradation): 1-hour acknowledgement; 8-hour resolution target;
• Normal (general queries, non-urgent): 4-hour acknowledgement; 24-hour resolution target.

What PCI SAQ A Means

The Payment Card Industry Data Security Standard Self-Assessment Questionnaire A (PCI DSS SAQ A) applies to merchants who: accept card payments exclusively via redirect or iFrame to a PCI DSS-certified payment processor; do not receive, store, process, or transmit cardholder data (card numbers, CVV, expiry dates) on their own systems at any point; and have confirmed their payment service provider's current annual PCI DSS certification. ThinkOnline.IN meets all three criteria.

What This Means for Your Payments

• When you pay for ThinkOnline.IN services, you are redirected to our PCI DSS-certified payment gateway partner's secure environment to complete the transaction;
• Your card number, CVV, expiry date, and billing details are entered directly on the gateway's certified, encrypted environment — not on ThinkOnline.IN systems;
• ThinkOnline.IN receives only a transaction confirmation token — no card data whatsoever;
• This architecture completely eliminates cardholder data exposure risk from our own systems.

Our Compliance Controls

• Annual self-assessment against all applicable PCI SAQ A requirements;
• Payment pages served exclusively over HTTPS with TLS 1.2+;
• Regular review of our payment service provider's PCI DSS certification status;
• Verification that no cardholder data is logged, cached, or stored anywhere in our systems;
• Prompt security patching of all web-facing systems;
• Access controls restricting admin system access to authorised personnel only.

For Ecommerce Clients Hosted on ThinkOnline.IN

If you host an e-commerce website (WooCommerce, Magento, PrestaShop, OpenCart, etc.) on ThinkOnline.IN, your own PCI compliance obligations depend on your payment integration method:

• Full redirect to gateway (e.g., Razorpay Hosted Page) → SAQ A — minimal scope;
• Hosted payment fields / iFrame (Razorpay, PayU, Cashfree) → SAQ A — minimal scope;
• Custom card form on your own server → SAQ D — highest scope (not recommended).

We strongly recommend using hosted payment fields, iFrames, or full redirect integrations with RBI-authorised payment aggregators (Razorpay, PayU, Cashfree, CCAvenue) so that card data never passes through your hosting server. Our shared hosting infrastructure supports these integrations and is PCI SAQ A compliant at the infrastructure level. We cannot and do not certify your ecommerce application's own PCI compliance.