Terms of Service

1. Who we are

iris-insight is operated by Levonata Pte Ltd, a company registered in Singapore and trading as Otonata. These Terms of Service govern your use of the iris-insight service available at iris.otonata.com.

By confirming your email and using the service, you agree to these terms.

2. What iris-insight is

iris-insight monitors publicly disclosed security vulnerabilities (CVEs) and privacy incidents for devices you register. When a new CVE or privacy incident is published for one of your registered vendors, we send you an alert.

iris-insight is a monitoring and alerting service. It is not a security guarantee. Receiving no alert does not mean your devices are free from risk. Alert accuracy depends on how well your self-reported device information matches our database.

3. Your account

Your email address is your identity on iris-insight. No password is required for the free tier. You confirm your account by clicking a single-use link sent to your email.

You are responsible for ensuring your email address is accurate and accessible. If you lose access to your email, contact us at helpme@otonata.com.

4. Service tiers

iris-insight is offered on the following tiers:

• Free — Up to 5 self-reported devices; alerts for CVSS 9.0+ (critical) vulnerabilities only; delivered as a weekly email digest. No payment required.
• Free+ — Granted by Otonata at our discretion to existing clients and partners. Equivalent to Watchlist. No payment.
• Watchlist — Up to 20 devices; CVSS 7.0+ (high and critical); alerts on publication; $5/month via Stripe.
• Shield — Unlimited devices (including auto-import from a full Otonata scan); CVSS 5.0+ (all material); email + optional Slack webhook; $15/month via Stripe.

Tier features may change with notice (see section 11).

5. Your devices

You may only register devices that you own or have explicit authorisation to monitor. By registering a device, you confirm it is on a network under your control.

iris-insight does not perform any scanning of your network. The free tier relies entirely on information you provide (vendor and model). Accuracy of alerts depends on how closely your input matches records in the NIST National Vulnerability Database.

6. Data accuracy and limitations

CVE data is sourced from the NIST National Vulnerability Database (NVD), a public US government database. New CVEs may take up to 24 hours to appear after NVD publication.

Vulnerability matching is based on CPE (Common Platform Enumeration) strings. Match quality varies — some device models have precise CPE entries; others do not. We will indicate when a match is approximate.

Levonata Pte Ltd is not liable for:

• False positive alerts (a CVE flagged that does not affect your specific device firmware version)
• Missed alerts (a CVE that exists but was not matched due to imprecise product data in NVD)
• Any security incident that occurs on your network, regardless of whether an alert was sent

7. Acceptable use

You agree not to:

• Register devices for networks you do not own or control
• Submit false, misleading, or fabricated device information
• Use iris-insight for commercial resale or to provide monitoring services to third parties without our written consent
• Attempt to reverse-engineer, scrape, or abuse the iris-insight API or registration endpoints
• Use the service in any way that violates applicable law

We reserve the right to suspend or terminate accounts that violate these conditions.

8. Subscription and billing

Paid tiers (Watchlist and Shield) are billed monthly via Stripe. By subscribing, you authorise Stripe to charge your payment method on a recurring basis. Stripe's own terms and privacy policy govern the handling of your payment details — we do not store card numbers.

You may cancel your subscription at any time. Cancellation takes effect at the end of the current billing period. We do not offer refunds for partial months.

If a payment fails, we will attempt to contact you and may downgrade your account to the free tier after a 7-day grace period.

9. Termination and deletion

You may delete your iris-insight account at any time by emailing helpme@otonata.com with subject line "Delete my iris-insight account". We will delete your email address and registered device data within 14 days.

We may suspend or terminate accounts that violate these terms, with or without notice depending on severity.

10. Limitation of liability

iris-insight is provided "as is" without warranties of any kind. Levonata Pte Ltd's total liability to you for any claim arising from the use of iris-insight is capped at the total fees you have paid in the three months preceding the claim. For free-tier users, this cap is SGD 0.

We are not liable for indirect, incidental, or consequential damages, including but not limited to loss of data, loss of revenue, or harm resulting from a security incident on your network.

11. Changes to these terms

We may update these Terms of Service from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you by email at least 14 days before the change takes effect. Continued use of iris-insight after that date constitutes acceptance of the updated terms.

If you do not agree to updated terms, you may delete your account before the effective date.

12. Governing law

These terms are governed by the laws of the Republic of Singapore. Any dispute that cannot be resolved by good-faith negotiation will be referred to the Singapore International Arbitration Centre (SIAC) for final resolution by a single arbitrator, with the seat in Singapore and proceedings in English.

13. Contact

For questions about these terms, contact us at helpme@otonata.com.

Levonata Pte Ltd
Singapore