Cookies & Data

Platform: hisaabwala.org Operator: Simply Five Studio, a sole proprietorship of Mr. Mohamed Jamnagarwala Principal place of business: 22 Josier Street, Nungambakkam, Chennai 600034, Tamil Nadu, India GSTIN: 33DCGPM7210H1ZT Contact / Grievance Officer: Mr. Mohamed Jamnagarwala, [email protected]

Version: 1.0 Effective Date: 26 July 2026 Last Reviewed: 26 July 2026

PREAMBLE

This Cookies & Data notice ("Notice") explains the cookies and similar technologies used on hisaabwala.org, and restates, in the specific context of client-side storage and data handling, the position of the Operator in relation to data on the Platform.

This Notice forms an integral and inseparable part of the Terms & Conditions and must be read together with them, with the Privacy Policy and with the Cancellations & Refund Policy. Capitalised terms not defined here bear the meanings given in the Terms & Conditions. In the event of any inconsistency, the provision more protective of the Operator shall prevail.

This Notice is published in compliance with the Information Technology Act, 2000 and the rules made thereunder, the Digital Personal Data Protection Act, 2023, and all other Applicable Law, and is an electronic record requiring no physical or digital signature.

BY ACCESSING OR CONTINUING TO USE THE PLATFORM, OR BY SETTING YOUR BROWSER OR DEVICE TO ACCEPT COOKIES, YOU CONSENT TO THE USE OF COOKIES AND SIMILAR TECHNOLOGIES AS DESCRIBED IN THIS NOTICE. IF YOU DO NOT CONSENT, YOU MUST NOT USE THE PLATFORM.

1. FUNDAMENTAL POSITION ON DATA

1.1 The Platform is a data-entry and data-processing utility only. Everything the Platform does with any data, whether stored on the Operator's servers or in Your browser or device, is a data-entry, data-storage, data-arrangement, data-formatting and data-processing operation performed mechanically at Your instruction, and nothing more.

1.2 The Platform is NOT compliance software, regulatory software, accounting software, book-keeping software, audit software or taxation software. It is NOT associated with, approved by, backed by, linked to, integrated with or endorsed by GST, any Government, any Governmental Authority, any regulator, any professional institute or any official portal.

1.3 No data held on the Platform, and no Output derived from it, is or shall ever be treated, construed, held out, relied upon, tendered, produced, filed or represented as an official, statutory, regulatory, evidentiary, fiscal or authoritative record of any business transaction, invoice, e-invoice, book of account, ledger, register, financial statement, audit record or compliance document.

1.4 Clause 2 of the Terms & Conditions applies in full to this Notice, and governs the character of all data and Output on the Platform.

2. WHAT COOKIES AND SIMILAR TECHNOLOGIES ARE

2.1 A cookie is a small text file placed on Your device by a website, which is returned to that website on subsequent requests. Cookies are widely used to keep users signed in, to remember preferences, and to keep sessions secure.

2.2 "Similar technologies" in this Notice means and includes: localStorage and sessionStorage, IndexedDB, Web SQL, the Cache API and service-worker caches, HTTP cache directives, ETag and other cache validators, HTTP-header-based state, pixels, clear GIFs and web beacons, embedded scripts, device and browser fingerprinting signals, and any other client-side or passive mechanism for storing, reading or inferring state.

2.3 References in this Notice to "cookies" include all such similar technologies, unless the context requires otherwise.

3. CATEGORIES OF COOKIES USED

3.1 Strictly Necessary (Essential) Cookies

Purpose: These are indispensable to the operation, integrity and security of the Platform. They enable authentication, maintain Your logged-in session, preserve state across page navigation, protect against cross-site request forgery and session-fixation attacks, enforce rate limits and abuse protections, route requests correctly, and remember whether You have acknowledged notices.

Typical contents: an opaque session identifier or signed session token; a cross-site request forgery token; a security or anti-abuse token; a load-balancing or routing hint; a notice-acknowledgement flag.

Duration: Session cookies expire when the browser session ends. Persistent security and preference cookies expire after a defined period, or on logout, or on expiry or revocation of the session, whichever is earliest.

Consent: These cookies are essential and cannot be disabled through the Platform. They are used because they are strictly necessary to provide a service You have expressly requested, and no separate consent is sought for them. If You block them in Your browser, the Platform will not function: You will be unable to log in, to remain logged in, to submit data, or to use any Module. That is a direct and unavoidable consequence of blocking them, and gives rise to no claim, refund, credit or compensation of any kind.

3.2 Functional and Preference Cookies

Purpose: To remember choices You make, so that the Platform behaves consistently for You. For example: interface theme (light or dark), language, timezone, date and number format, sidebar and panel layout, table column widths and sort order, Workspace last opened, dismissed hints and tooltips, and remembered login identifier where You have asked for it.

Duration: Typically persistent, for a period the Operator considers appropriate for continuity of experience.

Consent: Used with Your consent, given by continued use. Blocking or clearing them will cause the Platform to forget Your preferences, requiring You to set them again. That is a consequence of Your own choice and gives rise to no claim.

3.3 Performance, Diagnostic and Security-Analytics Cookies

Purpose: To keep the Platform working and secure. Strictly limited to: measuring page and request performance, identifying slow or failing operations, capturing error and crash diagnostics, detecting anomalous or automated access patterns, detecting and preventing fraud and abuse, and understanding aggregate feature usage so that the Platform can be maintained and improved.

Basis and scope: Data collected through these technologies is used in aggregated, de-identified form for operation, security and improvement of the Platform. It is never used for advertising, ad targeting, ad profiling, cross-site tracking or retargeting, and is never sold, rented, traded or shared with any advertising network, data broker, marketing agency or list vendor.

Duration: For such period as the Operator considers necessary for diagnostic, security and forensic purposes.

3.4 Payment and Third-Party Cookies

3.4.1 Where You make a payment, You may be directed to, or interact with an interface hosted or scripted by, a third-party payment gateway, aggregator, processor, card network, bank, wallet or unified payments interface provider. Such providers may set their own cookies and use their own technologies for payment processing, session integrity, fraud prevention and regulatory compliance.

3.4.2 Those cookies are set by, controlled by, read by and governed exclusively by the relevant third party and its own privacy and cookie policies. The Operator does not set them, does not control them, cannot read them, cannot configure them and cannot delete them.

3.4.3 The Operator bears no responsibility and no liability whatsoever for any third-party cookie, technology, script, data collection, retention, disclosure, transfer, security practice or incident. Clause 11 of the Terms & Conditions and Clauses 3.4 and 5.2 of the Privacy Policy apply in full.

3.5 What Is NOT Used

The Operator does not use, and does not permit any third party to use on the Platform:

(a) advertising, ad-serving, ad-network, ad-exchange, real-time-bidding or ad-attribution cookies; (b) behavioural advertising, ad profiling, interest-based targeting, retargeting or remarketing technologies; (c) cross-site or cross-application tracking, identity-graph, data-onboarding or audience-matching technologies; (d) social media tracking pixels, "like" or "share" trackers, or conversion pixels for advertising purposes; (e) data-broker, list-vendor or lead-generation technologies; (f) any technology that collects data for the purpose of training, fine-tuning, evaluating or developing any machine learning model or artificial intelligence system; (g) any tracking, behavioural monitoring or targeted advertising directed at children.

The Operator may add, alter, replace or withdraw specific technologies within the permitted categories in Clauses 3.1 to 3.4 at any time in accordance with Clause 8 of this Notice. Nothing in Clause 3 constitutes a warranty, guarantee or service level as to any particular technology, vendor, configuration or duration.

4. LOCAL STORAGE ON YOUR OWN DEVICE

4.1 For performance, resilience and usability, the Platform may store certain data in Your browser or device using localStorage, sessionStorage, IndexedDB, service-worker caches or similar mechanisms. This may include: interface preferences; cached reference lists and lookups; draft or partially entered form data not yet submitted; queued operations pending network availability; and cached assets such as scripts, stylesheets and fonts.

4.2 THIS DATA RESIDES ON YOUR OWN DEVICE, WITHIN YOUR OWN BROWSER PROFILE, AND IS ENTIRELY WITHIN YOUR OWN CONTROL AND YOUR OWN RESPONSIBILITY. The Operator has no control over, no visibility of, and no responsibility or liability whatsoever for:

(a) the physical or logical security of Your device, disk, browser profile, browser account, browser sync or device backup; (b) any other person who has access to Your device, browser profile, browser account or unlocked screen; (c) any browser extension, add-on, developer tool, automation, script, agent, artificial intelligence agent, personal assistant agent or other software installed on or granted permission over Your device or browser, all of which may be able to read, alter, exfiltrate or delete such data; (d) any malware, spyware, keylogger, infostealer, ransomware or other malicious software on Your device; (e) any theft, loss, sale, disposal, repair, servicing, resale or transfer of Your device; (f) the synchronisation, cloud backup, replication or export of Your browser profile or device data to any cloud account or other device; (g) any loss of such locally stored data, including on clearing browsing data, using private or incognito mode, switching browser or device, browser or operating system updates, profile corruption, storage-quota eviction, or automatic browser cleanup, and including any consequent loss of unsubmitted drafts or queued operations.

4.3 You should clear site data and log out when using a shared, public or untrusted device. Failure to do so is entirely Your own risk.

4.4 No loss, disclosure, alteration or unrecoverability of any locally stored data shall give rise to any claim, refund, credit, adjustment, compensation or liability of any nature against the Operator.

5. YOUR CONTROL OVER COOKIES

5.1 Browser and Device Controls

You have full and independent control over cookies through Your own browser or device settings. Every mainstream browser allows You to view, block, restrict, allow, delete and clear cookies and site data, in whole or by site, to block third-party cookies, to clear data on exit, and to browse in a private or incognito mode. Consult Your browser's own help documentation for the exact steps, which vary by browser and by version. You may also use Your operating system's or device's privacy controls.

5.2 Do Not Track and Global Privacy Control

There is no accepted or uniform industry standard for responding to "Do Not Track" or "Global Privacy Control" signals. The Operator does not respond to such signals. This is of no practical consequence, because the Operator does not engage in any cross-site tracking, behavioural advertising or ad profiling in the first place, as stated in Clause 3.5.

5.3 Consequences of Blocking: Entirely Your Own Risk

5.3.1 IF YOU BLOCK, RESTRICT, DELETE OR CLEAR COOKIES OR SITE DATA:

(a) blocking strictly necessary cookies will render the Platform completely unusable. You will be unable to log in, to remain logged in, to submit any data, or to use any Module; (b) You may be logged out unexpectedly, repeatedly or mid-operation, and may lose any unsaved or unsubmitted work; (c) Your preferences, layouts, settings and dismissed notices will be forgotten; (d) security protections including cross-site request forgery protection and anti-abuse measures may be weakened or defeated, increasing Your own exposure to risk; (e) performance may degrade and errors may occur; (f) queued or pending operations may be lost.

5.3.2 ALL SUCH CONSEQUENCES ARE THE DIRECT AND FORESEEABLE RESULT OF YOUR OWN CHOICE, ARE ENTIRELY AT YOUR OWN RISK, AND SHALL NEVER GIVE RISE TO ANY CLAIM, REFUND, CREDIT, PRO-RATA ADJUSTMENT, EXTENSION, COMPENSATION, DAMAGES OR LIABILITY OF ANY NATURE AGAINST THE OPERATOR. Clause 2 of the Cancellations & Refund Policy and Clauses 13 and 14 of the Terms & Conditions apply in full.

6. DATA HANDLING: RESTATEMENT OF KEY POSITIONS

The following positions, set out at length in the Terms & Conditions and the Privacy Policy, are restated here for clarity and apply in full to this Notice.

6.1 Roles

6.1.1 In respect of Account Data, that is, the data of the person who signs up, the Operator is the Data Fiduciary.

6.1.2 In respect of all User Content and in particular all Third-Party Data, meaning data relating to any person other than the User, including the User's own customers, clients, suppliers, vendors, distributors, agents, employees, contractors, debtors, creditors, tenants, members, counterparties or any other person:

THE USER IS THE DATA FIDUCIARY. THE OPERATOR IS MERELY A DATA PROCESSOR, PROCESSING SUCH DATA SOLELY ON THE USER'S INSTRUCTIONS, ON THE USER'S BEHALF, AND FOR NO INDEPENDENT PURPOSE OF ITS OWN.

6.1.3 The User alone is responsible for every notice, consent, lawful basis, accuracy requirement, retention limit, rights request and grievance in respect of Third-Party Data, and shall fully indemnify the Operator in respect of every consequence. Clause 7.3 of the Terms & Conditions and Clause 2 of the Privacy Policy apply in full.

6.1.4 Any person whose data appears within a User's Account must approach that User directly. The Operator has no relationship with, no notice to, no means of contacting, and no authority or obligation in respect of, any such person.

6.2 Security Is Reasonable, Never Absolute

6.2.1 The Operator maintains reasonable technical, organisational and administrative security measures within its own systems, as described in Clause 8.1 of the Privacy Policy, consistent with the standard of reasonable security practices contemplated by the Information Technology Act, 2000 and the obligation of reasonable security safeguards under the Digital Personal Data Protection Act, 2023.

6.2.2 NO SYSTEM, NETWORK, PROTOCOL, CRYPTOGRAPHIC SCHEME, CONTROL, HOSTING ARRANGEMENT, DEVICE OR HUMAN PROCESS IS OR CAN BE MADE ABSOLUTELY SECURE, IMPENETRABLE OR INVULNERABLE. THE OPERATOR GIVES NO WARRANTY, GUARANTEE OR ASSURANCE OF ABSOLUTE SECURITY.

6.2.3 The Operator's responsibility in respect of data security is limited strictly to maintaining reasonable security practices in respect of infrastructure and systems directly and exclusively within the Operator's own operational control, and extends to nothing whatsoever beyond that. It does not extend to any data once that data has left the Operator's systems by any means, howsoever occasioned.

6.3 Attacks and Exfiltration: No Liability

THE OPERATOR SHALL BEAR NO LIABILITY WHATSOEVER, AND YOU SHALL HAVE NO CLAIM OF ANY KIND, IN RESPECT OF ANY UNAUTHORISED ACCESS TO, OR ACQUISITION, DISCLOSURE, ALTERATION, DESTRUCTION, EXFILTRATION OR MISUSE OF, ANY DATA ARISING FROM OR IN CONNECTION WITH:

(a) any brute-force, credential-stuffing, dictionary, password-spraying or similar attack on any server, service, account or credential; (b) any hacking, cracking, intrusion, penetration, exploitation of any vulnerability (whether known, unknown, zero-day, or residing in any third-party dependency, library, operating system, hypervisor, firmware or hardware), malware, ransomware, supply-chain compromise, denial-of-service attack, side-channel attack or any other cyber attack, whether perpetrated by a criminal, an insider, a competitor, an activist, an organised group, or a state or state-sponsored actor; (c) any phishing, vishing, smishing, social engineering, business e-mail compromise, SIM swap, session hijacking, man-in-the-middle attack or interception directed at You or Your personnel; (d) any compromise, loss, theft, sharing, weakness, reuse or negligent handling of credentials by You or by any person to whom You granted access; (e) any compromise, infection, theft, loss or misconfiguration of Your own devices, browsers, browser profiles, extensions, networks, e-mail accounts, cloud accounts, integrations, automations or artificial intelligence agents; (f) any act, omission, breach, outage or failure of any third-party hosting, cloud, network, payment, e-mail, monitoring, backup or other service provider; (g) ANY WILFUL, DELIBERATE, NEGLIGENT, INADVERTENT, UNAUTHORISED OR MISTAKEN EXPORT, DOWNLOAD, PRINT, SCREENSHOT, SCREEN RECORDING, PHOTOGRAPH, COPY, TRANSCRIPTION, FORWARDING, TRANSMISSION, PUBLICATION, SHARING, SALE, LEAK, DISCLOSURE OR ONWARD CIRCULATION OF ANY DATA, IN ANY FORM OR MEDIUM, BY YOU, BY ANY PERSON AUTHORISED OR PERMITTED BY YOU, BY ANY OF YOUR EMPLOYEES, AGENTS, CONTRACTORS, CONSULTANTS, FAMILY MEMBERS OR FORMER PERSONNEL, BY ANY PERSON OBTAINING ACCESS THROUGH YOUR CREDENTIALS OR DEVICES, OR BY ANY THIRD PARTY, INTEGRATION, AUTOMATION OR ARTIFICIAL INTELLIGENCE AGENT CONNECTED BY YOU; (h) any downstream republication, aggregation, indexing, resale, scraping, dark-web circulation or other dissemination following any event described in this Clause 6.3; (i) any act of God, Force Majeure Event, government-mandated access, lawful interception or compelled disclosure.

Clause 15 of the Terms & Conditions and Clause 8.3 of the Privacy Policy apply in full.

6.4 Export, Retention and Backups Are Your Responsibility

6.4.1 The Platform is not a backup, archival, disaster-recovery or record-keeping service. No retention period, preservation, integrity, recoverability or restorability of any data, whether server-side or client-side, is warranted, guaranteed or assured.

6.4.2 IT IS ENTIRELY AND EXCLUSIVELY YOUR RESPONSIBILITY TO MAINTAIN YOUR OWN INDEPENDENT, COMPLETE, CURRENT AND SEPARATELY STORED BACKUPS AND RECORDS OUTSIDE THE PLATFORM, AND TO EXPORT AND DOWNLOAD ALL DATA OF IMPORTANCE TO YOU WELL BEFORE ANY EXPIRY, CLOSURE OR TERMINATION.

6.4.3 Any export You take leaves the Operator's control the moment it is generated. From that moment, its security, storage, transmission, disclosure, retention, deletion and every consequence of its existence are entirely Your own responsibility and liability.

6.4.4 Clauses 7.6 and 12.3 of the Terms & Conditions and Clause 7 of the Privacy Policy apply in full.

6.5 Automated Access, Agents and Artificial Intelligence

6.5.1 Where You authorise or connect any third-party service, integration, automation, script, bot, API client, browser extension, artificial intelligence agent, personal assistant agent, large language model or autonomous agent to Your Account or data, You do so entirely at Your own election, discretion, risk and liability.

6.5.2 Any instruction, request, read, write, export or deletion effected through such means is conclusively deemed to be Your own instruction, given with full authority, under Clause 4.3.3 of the Terms & Conditions.

6.5.3 Every consequence of such access, including any transmission, disclosure, reproduction, retention, training upon, aggregation, alteration, deletion or exfiltration of data by such third party or agent, is Your sole responsibility and liability, and gives rise to no claim against the Operator of any nature whatsoever.

6.5.4 Unauthorised scraping, crawling, harvesting, mining or automated extraction of the Platform is a prohibited act under Clause 9.2 of the Terms & Conditions and will be pursued accordingly.

7. LEGAL BASIS, RIGHTS AND GRIEVANCES

7.1 Strictly necessary cookies are used because they are indispensable to providing a service You have expressly requested. All other cookies within the permitted categories are used with Your consent, given by continued use of the Platform, and may be controlled by You through Your own browser and device settings as described in Clause 5.

7.2 Your rights in respect of Personal Data, the manner of exercising them, and the grounds on which a request may be refused or deferred, are set out in Clause 9 of the Privacy Policy. Withdrawal of consent operates prospectively only, will ordinarily render the Platform unusable, and gives rise to no refund, credit or compensation of any kind.

7.3 Grievance Officer / Nodal Officer / Data Protection Contact:

Name: Mr. Mohamed Jamnagarwala Designation: Proprietor, Simply Five Studio Address: 22 Josier Street, Nungambakkam, Chennai 600034, Tamil Nadu, India E-mail: [email protected]

7.4 Exhaustion of the grievance mechanism in Clause 10 of the Privacy Policy, and compliance with Clause 18.1 of the Terms & Conditions (mandatory sixty-day written notice of dispute), are conditions precedent to the initiation of any proceeding against the Operator or any Protected Person, before any forum whatsoever. Clause 18 of the Terms & Conditions applies in full to every dispute arising out of or relating to this Notice, including its provisions on arbitration seated at Chennai, the governing law of India, the sole and exclusive jurisdiction of the courts and tribunals at Chennai, Tamil Nadu, the waiver of class, collective and representative proceedings, and the consequences of frivolous, vexatious, coercive and retaliatory claims.

8. CHANGES AND GENERAL

8.1 Changes. The Operator may amend, vary, supplement, restate or replace this Notice at any time, at its sole discretion, and may add, alter, replace or withdraw any cookie or similar technology within the permitted categories in Clause 3, by publishing the revised Notice on the Platform with an updated Effective Date. Your continued access to or use of the Platform after publication constitutes Your unconditional acceptance. If You do not accept a revision, You must cease all use immediately; no refund shall arise on that account. The version published on the Platform at any time is the operative version.

8.2 No warranty. Nothing in this Notice creates or shall be construed as creating any warranty, guarantee, assurance, service level, certification or obligation, nor does anything in this Notice enlarge, qualify, dilute or override any disclaimer, exclusion, limitation, cap, indemnity, time bar or dispute-resolution provision of the Terms & Conditions.

8.3 Limitation of liability. Clauses 13 (Disclaimer of Warranties), 14 (Exclusion and Limitation of Liability, including the aggregate financial cap and the thirty-day notification and six-month limitation bar), 15 (Security and Attribution of Risk), 16 (Indemnity) and 18 (Dispute Resolution) of the Terms & Conditions apply in full to this Notice.

8.4 No liability across any medium. Neither hisaabwala.org nor Simply Five Studio nor its proprietor nor any Protected Person shall bear any responsibility or liability whatsoever for any loss, damage, harm, cost, expense, penalty, claim, risk, prejudice or consequence of any nature, direct or indirect, arising out of or relating to any cookie, any similar technology, any client-side or server-side storage, any data, any export, any deletion, any loss, any breach or any onward circulation, arising from the use of the Platform by any means and through any medium, including via the web, any website, any browser or browser extension, any desktop or laptop computer, any mobile device, tablet, wearable or smart device, any embedded or Internet-of-Things device, any kiosk or terminal, any API or webhook, any automation or script, any artificial intelligence agent, any personal assistant agent, any autonomous agent, or any other means, technology or medium now known or hereafter devised.

8.5 Severability and reading down. If any provision of this Notice is held invalid, illegal, void, unenforceable or contrary to public policy by any court, tribunal or authority of competent jurisdiction, it shall first be read down, narrowed, limited or modified to the minimum extent necessary to render it valid and enforceable while preserving the maximum protection to the Operator that Applicable Law permits; only if that is impossible shall it be severed, and then only as to the offending part and only in the jurisdiction concerned. All remaining provisions shall continue in full force and effect.

8.6 Statutory savings. Nothing in this Notice purports to exclude or restrict any right or liability which cannot lawfully be excluded or restricted under Applicable Law. Every exclusion and limitation herein applies only to the maximum extent that Applicable Law permits.

8.7 No waiver. No failure, delay, forbearance, indulgence or partial exercise by the Operator of any right or remedy shall operate as a waiver thereof or preclude any further exercise. No waiver is effective unless made expressly in writing and signed by the Operator.

8.8 Language. This Notice is made in English. Any translation is for convenience only, and in the event of any discrepancy, ambiguity or conflict, the English version shall prevail absolutely for all purposes.

8.9 Precedence. In the event of any inconsistency between this Notice and the Terms & Conditions, the provision more protective of the Operator shall prevail.

9. FINAL ACKNOWLEDGEMENT

BY ACCESSING OR CONTINUING TO USE THE PLATFORM, YOU CONFIRM THAT YOU HAVE READ, UNDERSTOOD AND UNCONDITIONALLY ACCEPTED THIS NOTICE IN FULL, AND IN PARTICULAR THAT:

Strictly necessary cookies are indispensable and cannot be disabled; blocking them renders the Platform unusable, entirely at Your own risk and with no refund or claim.
No advertising, ad-targeting, ad-profiling, cross-site-tracking or data-broker technologies are used, and no data is ever sold, rented or traded.
All data stored on Your own device is within Your own control and Your own responsibility, and the Operator bears no liability for it.
The Platform is a data-entry and data-processing utility only, is not compliance, regulatory, accounting, audit or taxation software, and is not associated with, approved by, backed by or linked to GST, any Government, any Governmental Authority or any official portal; no data or Output on it is an official or statutory record of any business transaction.
In respect of all Third-Party Data, You are the Data Fiduciary and the Operator is merely a Data Processor acting on Your instructions, and You bear all consequent responsibility and indemnity.
The Operator's security obligation is limited to reasonable security practices within its own systems, and the Operator bears no liability for brute-force or other attacks, or for any wilful, negligent or inadvertent export, disclosure or onward circulation of data by You or by any other party.
You alone are responsible for exporting and retaining Your own data and for maintaining independent backups outside the Platform.
All disputes are subject to the mandatory notice, arbitration, individual-basis and exclusive Chennai jurisdiction provisions of Clause 18 of the Terms & Conditions.

Related documents: Terms & Conditions · Privacy Policy · Cancellations & Refund Policy