Terms of Service

Effective date: 5 October 2026 · Version: 1.0

Summary

This summary is not a substitute for the terms below.

• InfraInbox Cloud is run by INNOVA SOFTWARE S.R.L., a Romanian company. Romanian law applies. If you are a consumer, you keep the protection of the law where you live.
• Cloud is free during the beta. We never charge you unless you choose a paid plan yourself.
• Your workspace content stays yours. We process it only to run the service.
• It is a beta: no uptime promise, features change, and a serious failure could lose up to a day of data. Keep a second channel for alerts that really matter.
• The service has daily limits, so one leaked key or runaway script can’t flood it. Over a notification limit, notifications are recorded but not sent, and owners are told.
• You can export a workspace, or delete your account, at any time.
• Before a change that is bad for you, we give you at least 30 days’ notice, and you can leave first. If we ever close Cloud, you get 90 days.

1. Who we are and what these Terms cover

1.1. We are INNOVA SOFTWARE S.R.L., a limited liability company registered in Romania, Trade Register no. J30/1284/2021, sole registration code (CUI) 45402130 (“InfraInbox”, “we”, “us”). You reach us at contact@innovasoftware.ro; our legal notice has our company details.

1.2. These Terms govern your use of InfraInbox Cloud: the hosted service at https://dash.infrainbox.app and any address that replaces it, its API, and the InfraInbox mobile apps while they are paired with InfraInbox Cloud (together, the “Service”).

1.3. What these Terms don’t cover:

• The self-hosted software. Its open-source licence governs it: AGPL-3.0 for the server and web app; Apache-2.0 for the watcher, the API contracts and the SDKs. These Terms don’t limit any right those licences give you.
• The push relay used by self-hosted servers. Our relay terms apply.
• Our documentation, which is licensed under CC BY 4.0.

1.4. Other documents:

• Businesses: our Data Processing Agreement (“DPA”) is part of these Terms and applies to personal data in your workspace content. If the DPA and these Terms conflict on personal data, the DPA prevails.
• Our Privacy Policy explains how we handle personal data. It is information, not a contract term.

1.5. Language. These Terms and the DPA are published in English and in Romanian, and both versions are equally binding. If they differ, a consumer gets the version more favourable to them (Law 193/2000, Art. 1(2)); otherwise the Romanian version prevails.

2. Consumers and businesses

2.1. You are a consumer if you use the Service for purposes outside your trade, business, craft or profession. A homelab you run for yourself or your household is consumer use. If you also use the Service for your work, you count as a consumer only if the work use is negligible.

2.2. Everyone else is a business, including anyone who uses the Service for a company, public body, association or freelance activity. If you use the Service for a business, you confirm that you may bind it, and “you” then means that business.

2.3. Clauses marked Consumers: apply only to consumers, and clauses marked Businesses: only to businesses. Everything else applies to both.

3. Your account

3.1. Age. You must be at least 16 years old. If you are under 18, a parent or guardian must agree to these Terms for you.

3.2. Sign-up. You sign up with an email address and a password, or with Google or GitHub where we offer it. Signing up takes three steps: enter your details; tick the box that confirms your age and accepts these Terms; press “Sign up”. You can correct what you typed until you press it. The contract is concluded at that moment, and the confirmation email we send at once acknowledges it. The box also records your express acceptance of sections 9, 10, 16, 17 and 21, which let us suspend or end the Service, limit our liability, and choose the law and courts (Romanian Civil Code, Art. 1203). We keep a record of the version you accepted and when. You can save or print these Terms from this page. We subscribe to no code of conduct.

3.3. Confirming your address. Until you confirm your email address, you can set up the Service, but it sends no notifications.

3.4. Accurate details. Give accurate details and keep your email address current. We send important notices there.

3.5. Security. Keep your password, recovery codes, API keys and webhook URLs secret. Workspace owners must use a second factor. Tell us straight away at contact@innovasoftware.ro if you think someone has misused your account or keys. You are responsible for what happens under your account until you tell us, unless the misuse was our fault.

3.6. Workspaces and members. An account may own up to 3 workspaces. A workspace’s owners decide who joins it and with which role, and are responsible for their members’ use of it. Businesses: you are responsible for the people you invite, and for having a lawful basis for the personal data you send to the Service.

4. The Service

4.1. What it does. The Service receives events from your systems (“sources”), groups them into incidents according to your rules, and sends notifications to the destinations you choose: InfraInbox Push to the iPhone app, Telegram, Slack, Discord and webhooks. It also runs heartbeat checks that watch your systems from outside. The user guide at https://infrainbox.app/docs/ describes the current features.

4.2. An aid, not a safety system. The Service helps you notice problems. It does not fix them, and it does not replace backups, redundancy or monitoring of your own. A notification can be late or lost because of:

• a third party: your internet connection, Apple’s push service, Telegram, Slack, Discord;
• your own settings: rules, quiet hours, silences, a disabled destination;
• the limits in section 5;
• an outage of the Service.

For anything where a missed alert could cause serious harm, set up at least two independent destinations, and keep a way to notice if InfraInbox itself goes quiet.

4.3. Not for critical systems. The Service is not designed for life-, health- or safety-critical systems, such as medical devices or emergency services, or for systems where a missed notification could on its own cause death, injury or major environmental damage. Do not rely on it for these.

4.4. Third-party services. Some features depend on services we don’t control, used under their own terms: Apple delivers push notifications; Google and GitHub sign you in if you choose them; destination providers deliver your messages. We pass your content to them only as your settings require. Push notifications are end-to-end encrypted: our push relay and Apple see encrypted bytes, not their content.

4.5. Changes to the Service. We keep the Service up to date and secure, and may improve or change it. If a change removes a feature you use or makes the Service materially worse for you, we tell you at least 30 days in advance, and you can export your data and delete your account before it applies. During the beta, section 14.3 applies instead. Urgent security or legal fixes may apply sooner; we tell you as soon as we can.

4.6. Availability. We aim to keep the Service available and announce planned maintenance in advance where we can. We make no uptime commitment.

5. Fair use and limits

5.1. Why limits exist. InfraInbox Cloud is a shared service. Its limits stop one runaway script, leaked key or abusive account from flooding it or turning it into a spam relay. Your workspace’s Settings › Usage and data page shows your usage against them.

5.2. Current limits, per workspace:

What	Limit	When it is reached
Events accepted	10,000 per UTC day	The ingest API answers HTTP 429 until midnight UTC, so the sender knows. Nothing is dropped silently
Notifications sent	1,000 per UTC day for the workspace; 500 per destination; 100 per day in the workspace’s first 7 days	The notification is recorded, not sent: it shows in History as skipped with the reason quota. The incident still opens and shows in the inbox
Sources / checks / destinations (not counting InfraInbox Push) / members	50 / 200 / 20 / 10	Creating one more is refused, and the dashboard says why
Workspaces you own	3 per account	Creating one more is refused

The first time in a UTC day that a workspace reaches the event or notification limit, its owners get one push notification and one email saying so. Repeat notifications, escalations and recovery messages each count as one notification. Reaching a limit never deletes data and never closes an incident.

5.3. Outbound protection. Nothing is sent until a workspace owner has confirmed their email address. A webhook destination that keeps failing permanently may be marked broken and stop sending; the dashboard says so.

5.4. Changing limits. We may raise a limit at any time. We give at least 30 days’ notice before lowering a limit for everyone (section 19). We may lower one workspace’s limits without notice where we reasonably suspect abuse, a compromised key, or a risk to the Service or to others (section 9); we then tell the owners why.

6. Acceptable use

6.1. Use the Service only lawfully and for its purpose: notifications about infrastructure and applications that you operate or are authorised to monitor.

6.2. You must not:

1. send, store or route content that is illegal, or that infringes anyone’s rights;
2. use the Service to send spam, marketing or bulk messages to people who did not ask for them;
3. route notifications to people, chats or channels without their permission;
4. monitor, probe or send events about systems you are not authorised to monitor;
5. attack, overload, scan or test the security of the Service, except under our security policy;
6. get around a limit, for example by opening many accounts or workspaces to multiply quotas;
7. access other customers’ data, or try to;
8. resell the Service, or offer it to others as your own service, without our written agreement. Inviting your household or team is fine;
9. upload malware, or use the Service to control malware;
10. use the Service in breach of EU or UN sanctions.

6.3. Content you should not send. Events describe the state of systems. Don’t send passwords, private keys or payment card data, special categories of personal data such as health data, or large amounts of other people’s personal data. We automatically remove some common secrets from stored raw payloads; that is a safety net, not a guarantee.

7. Your content

7.1. You own your content: the events, payloads, rules, settings and other data that you or your systems put into the Service (“Your Content”).

7.2. What you let us do with it. You give us a non-exclusive, worldwide, royalty-free permission to host, copy, process, transmit and display Your Content, only to provide the Service to you (including sending notifications where your settings say), to keep it secure and running, and to comply with the law. The permission ends when Your Content is deleted under section 11.

7.3. What we don’t do with it. We don’t sell Your Content, use it for advertising or use it to train AI models. We don’t read it except to support you at your request, to keep the Service secure, or to comply with the law.

7.4. Feedback. If you send us ideas or suggestions, we may use them freely and without paying you. We won’t name you without your permission. Please don’t put other people’s personal data or secrets from your systems in feedback.

8. Illegal content: notices and our decisions

The Service stores information you provide, which makes it a hosting service under the Digital Services Act (Regulation (EU) 2022/2065, “DSA”).

8.1. Points of contact (DSA Arts. 11–12). Authorities, users of the Service and anyone else can reach us at contact@innovasoftware.ro. We accept messages in English and Romanian. A person reads every message.

8.2. Reporting illegal content (DSA Art. 16). Anyone may report content in the Service that they believe is illegal by email to contact@innovasoftware.ro, with the subject “DSA notice”. Include:

• why you believe the content is illegal;
• where it is: for example the workspace, the notification, or a screenshot of one you received;
• your name and email address (not needed for a report of child sexual abuse material);
• a statement that you believe in good faith that the report is accurate and complete.

We confirm receipt, decide promptly, carefully and objectively, and tell you our decision and how to challenge it.

8.3. How we moderate. We don’t scan the content of your events to judge it. Automatic measures apply only to volume: the limits in section 5, rate limits, and marking broken destinations. A person decides every suspension, every removal of content and every action on a notice. We act diligently, objectively and proportionately (DSA Art. 14(4)).

8.4. Statement of reasons (DSA Art. 17). If we remove or disable your content, or suspend or end your access, we tell you by email, at the latest when the measure starts: what we did and how far it goes, the facts and the rule it rests on, whether automated means were involved, and how to challenge it.

8.5. Challenging a decision. Reply to our email. Someone who took no part in the original decision reviews it, and we tell you the outcome without undue delay. You can also go to court, and consumers can use the routes in section 21.3.

8.6. Serious crimes (DSA Art. 18). If we become aware of information suggesting a criminal offence that threatens someone’s life or safety, we must tell the competent authorities.

9. Suspension

9.1. We may suspend all or part of your access (for example one source, one destination, one workspace, or your account) where reasonably necessary because:

1. you seriously or repeatedly breach these Terms, especially section 6;
2. your account, keys or systems appear compromised, or are being used to flood or attack the Service or others;
3. continuing would put the Service, other customers or third parties at risk; or
4. the law, a court or an authority requires it.

9.2. Least intrusive first. For example, we disable a leaked key or lower one workspace’s limits before we suspend an account.

9.3. Notice. Usually we tell you before we suspend, with our reasons, and give you a reasonable chance to fix the problem: for an ordinary breach, at least 7 days. In urgent cases (security, ongoing abuse, legal orders) we may act first and tell you straight away afterwards. Every suspension comes with a statement of reasons (section 8.4).

9.4. What a suspension means. It lasts only as long as its reason. We keep Your Content during a suspension, and you can still export it unless the reason prevents that, for example a court order.

10. Ending the contract

10.1. By you. You may delete your account at any time under Settings › Profile › Delete account. That ends this contract.

10.2. By us, with notice. We may end the contract for any reason with at least 60 days’ notice. If we stop offering InfraInbox Cloud altogether, section 14.5 applies.

10.3. By us, for cause. We may end the contract with 14 days’ written notice if you breach these Terms seriously or repeatedly and don’t fix the breach in that time. Where the breach is serious and can’t be fixed, such as deliberate abuse, criminal use or a court order, we may end it immediately. You get a statement of reasons either way.

10.4. Inactive accounts. We may close an account that nobody has signed in to, and whose workspaces have received no events, for 12 months. We warn you by email at least 30 days before. Signing in keeps the account.

10.5. After the contract ends: you can still export Your Content for 30 days, unless you deleted the account yourself (section 11.2) or a legal reason prevents it. Your Content is then deleted as section 11 says. Sections 7.4, 11, 16, 17, 21 and 22 continue to apply.

11. Export, retention and deletion

11.1. Export. A workspace owner can download a JSON export of a workspace at any time under Settings › Usage and data, free of charge. It contains the workspace’s sites, sources and checks, rules and destinations, silences, incidents and events. For your security it contains no keys, credentials or push endpoints. Consumers: this is how you retrieve your content when the contract ends.

11.2. Deleting a workspace or your account. You confirm it’s you, then type the workspace name (or your email address). Sources stop accepting events at once, and anything queued is cancelled. There is no undo, so export first if you want the data. Deleting your account erases your personal data at once (the Privacy Policy §9 lists it), and closes the workspaces you own alone. Workspace data is removed from the live system within 30 days. Backup copies age out within 35 days. Your last workspace can’t be deleted on its own: delete your account instead.

11.3. Retention while you use the Service. By default the Service keeps events for 30 days; incidents for 90 days after they are resolved (open incidents are never purged); delivery records for 30 days; and raw payloads, the last 20 per source, for 7 days. A workspace owner can choose shorter periods. The Privacy Policy lists every period. Before we shorten a default period, we give you 30 days’ notice so you can export first.

11.4. When we must keep data longer. We keep data longer only where the law requires it, or to establish or defend legal claims.

12. Our software and name

12.1. The Service, its design, the mobile apps and the push relay belong to us or our licensors. You get a personal, non-transferable right to use them under these Terms while the contract lasts.

12.2. Nothing in these Terms limits your rights under an open-source licence for software we publish under one.

12.3. “InfraInbox” and its logo are our trade names. Please don’t use them in a way that suggests we endorse you. Saying truthfully that you use InfraInbox, or that your software works with it, is fine.

13. Personal data

13.1. For your account data we are the controller; the Privacy Policy explains how we handle it.

13.2. For personal data in Your Content we act as your processor (GDPR Art. 28). Businesses: the DPA applies. Consumers who use the Service purely for personal or household purposes are outside the GDPR for that use (GDPR Art. 2(2)(c)); we apply the same safeguards anyway.

14. The beta

14.1. Free. The Service costs nothing during the beta, and we don’t ask for payment details. We will never move you to a paid plan or charge you automatically: a charge requires you to choose a paid plan, read its terms and confirm the payment yourself.

14.2. Capacity. During the beta we may cap the number of accounts or workspaces across the Service. When the beta is full, sign-up or creating a workspace says so.

14.3. What is different in a beta. The Service is still being built, so:

• No uptime commitment. There is no service level agreement. Outages and maintenance at short notice can happen.
• Features change. We may add, change or remove features and change how the dashboard and API work. We tell you in advance about changes that matter, aiming for 14 days’ notice before we remove a feature or make an incompatible API change. A security fix may apply at once.
• Delivery is not guaranteed. Notifications may be delayed, duplicated or lost (section 4.2).
• iPhone only. The mobile app is available for iPhone; an Android app may follow.
• Backups. Our hosting provider backs up the whole Cloud server automatically once a day, and keeps the copies for 30 days. Because the backup runs once a day, a serious failure could lose up to 24 hours of data: events, incidents and settings changed since the last backup. Export your workspaces regularly (section 11.1).
• Support is best effort, by email to contact@innovasoftware.ro, in English or Romanian. We aim to answer within 3 working days but don’t promise a response time.
• No crash reports. We don’t collect crash reports from the app or the Service. If something goes wrong, tell us.

14.4. When paid plans start. Before any paid plan or new limit applies to a workspace created during the beta, we email every account owner at least 30 days in advance, with the plans and prices, what changes for your workspaces, and what happens if you do nothing.

• Doing nothing never costs money. If you don’t choose a paid plan, your beta workspaces move to the free Founder tier on the date in the notice.
• The Founder tier is reserved for accounts that existed during the beta. It is free for as long as we offer InfraInbox Cloud and your account stays active (section 10.4), and its limits are never lower than our regular free plan’s. If you buy a paid plan and later cancel it, you return to the Founder tier.
• Over the Founder limits. We delete nothing when a workspace moves. The owner chooses which sources, checks and destinations stay active; if they don’t choose during the notice period, the oldest stay active up to the limit and the rest are paused (a paused source refuses new events with an error, so the sender notices). If the Founder tier keeps history for less time than the beta did, older data is deleted only after the notice period, so you can export it first.

14.5. Ending the beta, or closing Cloud. We announce the end of the beta at least 30 days in advance; the Service then continues under these Terms. If we close InfraInbox Cloud altogether, we give at least 90 days’ notice by email and in the dashboard. During that time the Service keeps running, export stays available, and we publish a guide to moving to a self-hosted InfraInbox server, which runs the same core software. After the closing date we delete your data as section 11 says.

14.6. No reset. We will not wipe or reset beta workspaces because the beta ends or billing starts. If we ever have to delete data for a technical reason, we tell you at least 30 days in advance so you can export it. A loss caused by an incident, such as a hardware failure, is different: we tell you without undue delay what was lost and why.

14.7. Promises that only get better. No change to these Terms may shorten the notice periods in sections 14.4 and 14.5, the export right in section 11.1, or the Founder tier in section 14.4.

15. Conformity

15.1. Consumers: where the law on digital services (Directive (EU) 2019/770; in Romania, OUG 141/2021) applies to your use, you have its legal guarantee of conformity, and these Terms don’t limit it (OUG 141/2021, Art. 24). Where it doesn’t apply, because the Service is free and your data is used only to provide it, the Service is provided as these Terms describe, including the beta differences in section 14.3.

15.2. Businesses: the Service is provided as the user guide and these Terms describe, with no other warranty, as far as the law allows. In particular we don’t guarantee that the Service will be uninterrupted or error-free, that every notification will be delivered, or that it will meet requirements you have not agreed with us in writing.

16. Liability

16.1. Liability we never exclude or limit: loss caused by our intent or gross negligence (Romanian Civil Code, Art. 1355(1)); harm to life, body or health (Art. 1355(3)); liability under product-liability law; liability to data subjects under GDPR Art. 82; and any other liability the law does not allow us to exclude or limit.

16.2. Consumers:

• We are liable under the law for loss we cause by breaching our obligations. Where we are only slightly negligent, we are liable only for loss that was foreseeable when the contract was made (Civil Code, Art. 1533).
• Because the beta is free and experimental, and as far as the law allows, we are not liable for damage to your property, including data, caused only by our slight negligence (Civil Code, Art. 1355(2)).
• An alerting service can miss an alert, so section 4.2 asks you to keep an independent fallback for critical alerts. If you didn’t follow a reasonable precaution we told you about, and that contributed to your loss, compensation may be reduced (Civil Code, Art. 1534).
• Nothing in this section restricts your statutory rights as a consumer.

16.3. Businesses: subject to section 16.1:

• We are not liable for indirect or consequential loss; loss of profit, revenue, business, goodwill or anticipated savings; the cost of substitute services; loss caused by a notification that was late, skipped under section 5, or not delivered; or loss of or damage to data or systems outside the Service, including the systems you monitor.
• Our total liability for all claims arising during the free beta is limited to EUR 100.
• You must tell us about a claim in writing within 12 months of becoming aware of it, as far as the law allows.

17. Indemnity (businesses only)

Businesses: you will compensate us for third-party claims, fines and reasonable costs, including legal fees, that arise because Your Content or your use of the Service breaches these Terms or the law. This applies only if we tell you about the claim promptly, let you control the defence and cooperate reasonably, and not to the extent we caused the claim.

18. Events outside our control

We are not liable for a failure or delay caused by force majeure (Civil Code, Art. 1351): an unforeseeable and unavoidable event outside our reasonable control, such as a natural disaster, war, a widespread internet or power failure, an act of an authority, or a large-scale attack we could not reasonably prevent. We tell you as soon as we can and do what we reasonably can to limit the effects. If the event lasts more than 30 days, either of us may end the contract.

19. Changes to these Terms

19.1. Why we may change them. Only for valid reasons: a change in the law or a decision of a court or authority; a new feature or a change to the Service; protecting the Service and its users from abuse or security risks; a change in our providers or costs; or making the Terms clearer.

19.2. Notice. We tell you about a change at least 30 days before it applies, by email and in the dashboard, and explain what changes and why. A change that only clarifies, or only benefits you, may apply sooner. A change the law requires, or one needed against an immediate security threat, may also apply sooner; we tell you as soon as we can.

19.3. If you don’t agree, you may delete your account before the change applies, at no cost. If you keep using the Service after it applies, the new Terms apply to you.

19.4. Earlier versions of these Terms are available on request at contact@innovasoftware.ro.

20. How we communicate

20.1. To you: we send notices to your account’s email address and show them in the dashboard. An email notice counts as received when we send it to the address you gave us, unless we learn it was not delivered.

20.2. To us: write to contact@innovasoftware.ro. Report security vulnerabilities as our security policy says.

21. Law and disputes

21.1. Law. Romanian law governs these Terms (Regulation (EC) 593/2008, “Rome I”, Art. 3). Consumers: this does not take away the protection of the mandatory rules of the country where you normally live (Rome I, Art. 6(2)).

21.2. Courts.

• Consumers: you may bring proceedings in the courts of the EU country where you live, or in Romania. We may bring proceedings against you only in the courts of the country where you live (Regulation (EU) 1215/2012, “Brussels I bis”, Arts. 18–19).
• Businesses: the competent courts of Romania for our registered office have exclusive jurisdiction (Brussels I bis, Art. 25). Either of us may still seek urgent interim measures from any competent court.

21.3. Complaints. Please write to us first at contact@innovasoftware.ro; we answer within 15 days. Consumers can also use the alternative dispute resolution service (SAL) of Romania’s National Authority for Consumer Protection at https://reclamatiisal.anpc.ro, and we agree to take part.

22. General

22.1. Whole agreement. These Terms, with the DPA for businesses, are the whole agreement between us about the Service.

22.2. Invalid clauses. If a court finds a clause invalid or unfair, the rest stays in force. Businesses: the invalid clause is replaced by a valid one that comes as close as possible to its purpose.

22.3. Transfer. We may transfer the contract to a company that takes over the Service, provided your rights are not reduced; we tell you at least 30 days in advance, and you may delete your account before the transfer. You need our written consent to transfer the contract.

22.4. No waiver. If we don’t enforce a right straight away, we haven’t given it up.

22.5. Third parties. No one else can enforce these Terms. Apple is not a party to them.

23. Contact

INNOVA SOFTWARE S.R.L., Romania · Trade Register J30/1284/2021 · CUI 45402130 · contact@innovasoftware.ro · legal notice

---

Version 1.0, effective 5 October 2026.