Terms of Service

Last updated 20 August 2026 · Oynayo Pty Ltd · ACN 691 113 514 · ABN 69 691 113 514

These terms form a binding agreement between you and Oynayo Pty Ltd, the Australian company that operates Nectazo. Please read them — in particular clause 8 (your permission obligations), clause 11 (we cannot guarantee email delivery) and clauses 18 to 20 (liability and indemnity), which allocate risk between us.

1.Who we are and what these terms cover

Nectazo is an email marketing and customer engagement platform operated by Oynayo Pty Ltd (ACN 691 113 514), a company incorporated in Australia (we, us, our).

By creating an account, accessing the Service, or clicking to accept these terms, you agree to them. If you do not agree, do not use the Service.

If you accept these terms on behalf of a company or other organisation, you warrant that you have authority to bind it, and you in these terms means that organisation.

2.Definitions

  • Service — the Nectazo platform, websites, APIs, integrations and plugins we make available.
  • Account — your billing tenancy with us, which may contain one or more Brands.
  • Brand (also called a workspace) — a separate sending identity within your Account, with its own contacts, lists, campaigns and reporting.
  • Customer Data — all data you upload, import, create, sync or otherwise submit to the Service, including Contact records, campaign content, templates and product data.
  • Contact — an individual whose personal information you store in the Service.
  • Recipient — a person to whom a message is sent through the Service.
  • Campaign — a marketing message sent to more than one Recipient.
  • Transactional Email — an individual message sent in response to a Recipient's own action or an existing relationship, such as a password reset or order confirmation.
  • Hosted Page — a landing page you build in the Service and publish, which we serve to the public at an address on a domain we control or, if you connect one, at a domain of your own.
  • Visitor — a person who views a Hosted Page or a hosted form. A Visitor is not a Contact unless and until they give you their details.
  • Plan — the subscription tier you select, with the inclusions and limits published on our pricing page.

3.Eligibility and your account

  • You must be at least 18 years old and legally able to enter into contracts.
  • You must provide accurate registration information and keep it current.
  • You are responsible for keeping your password and API keys confidential, and for all activity that occurs under your Account or those keys, whether or not you authorised it.
  • You must notify us at support@nectazo.com promptly if you suspect unauthorised access.
  • You are responsible for the acts and omissions of anyone you give access to your Account.

4.Licence and changes to the Service

Subject to these terms and payment of applicable fees, we grant you a non-exclusive, non-transferable, revocable right to access and use the Service during your subscription, for your own business purposes.

We develop the Service continuously and may add, change or remove features. Where a change materially reduces core functionality you rely on, we will give you at least 30 days' notice by email or in-app, and you may cancel and receive a pro-rata refund of prepaid fees for the unused remainder of your term.

Features identified as beta, preview or experimental are provided as-is, may be withdrawn without notice, and are excluded from any service commitments.

5.Fees, billing and renewal

  • Plan inclusions and prices are published on our pricing page. Prices are stated in US dollars unless we state otherwise.
  • Payments are processed by Stripe. We do not collect, store or have access to your full card details.
  • Subscriptions are billed in advance, monthly or annually as you select, and renew automatically until cancelled.
  • Annual plans are charged at ten months' equivalent of the monthly price for a twelve month term, paid up front.
  • You may cancel at any time through the billing portal. Cancellation takes effect at the end of the current paid period; you retain access until then.
  • Except where required by law, or where we materially breach these terms, fees already paid are non-refundable and we do not provide pro-rata refunds for partial periods or for unused capacity.
  • Prices are exclusive of taxes. Where GST or an equivalent tax applies, it will be added. You are responsible for any withholding or other taxes arising in your jurisdiction.
  • We may change prices on 30 days' notice, taking effect from your next renewal. If you do not accept a price change you may cancel before it takes effect.
  • If a payment fails, Stripe will retry. We may suspend the Service if an Account remains unpaid, after giving you notice and a reasonable opportunity to fix it.

Plan limits are enforced as hard caps: when you reach a limit we block the action and tell you which Plan covers it. We do not bill you for overage you did not choose.

6.Free plan

We offer a free Plan with the limits published on our pricing page. Messages sent on the free Plan include a Nectazo attribution in the footer, which you must not remove, obscure or alter. We may change or withdraw the free Plan on 30 days' notice.

7.Customer Data and ownership

As between you and us, you own your Customer Data. We claim no ownership of it.

You grant us a worldwide, non-exclusive, royalty-free licence to host, store, copy, transmit, display, adapt (for formatting and delivery) and back up Customer Data, solely to: provide and support the Service; comply with your instructions; enforce these terms; and comply with law. This licence ends when the data is deleted, except for backup copies until they expire in the ordinary course.

We commit that:

  • we do not sell Customer Data;
  • we do not use your Contacts to market our own products to them;
  • we do not use your Customer Data to train artificial intelligence models, and our AI provider does not use content submitted through its API to train its models; and
  • we access Customer Data only to operate the Service, to provide support you request, to investigate abuse or a security incident, or where required by law.

We may generate and use aggregated, de-identified statistics about use of the Service (for example, aggregate delivery rates across the platform) to operate, secure and improve it. Such statistics never identify you, your Contacts or your Customer Data, and we will not attempt to re-identify them.

8.Permission, consent and your responsibilities as sender

You are the sender of every message you send through Nectazo. We provide the tools; you decide what is sent and to whom, and you are solely responsible for that decision and its consequences.

8.1 Consent warranty

You represent and warrant, on a continuing basis, that:

  • every Contact you send marketing messages to has given consent that is valid under all laws applicable to that Contact, or you have another lawful basis to send to them;
  • you keep records evidencing that consent, including its source and date, and will produce them to us on reasonable request; and
  • you will promptly stop sending to any person who withdraws consent, unsubscribes or complains.

Applicable laws include, without limitation, the Spam Act 2003 (Cth) and the Privacy Act 1988 (Cth) in Australia, the CAN-SPAM Act in the United States, Canada's Anti-Spam Legislation (CASL), and the UK and EU General Data Protection Regulation and ePrivacy rules — whichever apply to you and to each Recipient.

8.2 Prohibited list practices

You must not send through the Service to any address that was:

  • purchased, rented, leased or otherwise obtained from a third-party list vendor;
  • scraped, harvested or otherwise collected from websites, directories or social media without consent;
  • appended or enriched from a third-party source without the individual's consent; or
  • obtained from a co-registration or lead-sharing arrangement that did not clearly disclose you as a sender.

8.3 Message requirements

  • Every marketing message must identify you accurately as the sender and include a valid physical postal address.
  • Every marketing message must contain a functioning unsubscribe mechanism. You must not remove, disable, obscure or interfere with the unsubscribe link the Service inserts, or with suppression handling.
  • You must not use false or misleading headers, sender names, reply-to addresses or subject lines.
  • You must honour unsubscribe requests promptly and must not re-add, re-import or otherwise circumvent a suppressed address, including by moving it to another Brand or Account.

8.4 Your own compliance

You are responsible for your own compliance obligations to your Contacts, including giving them a privacy notice, responding to their access, correction and erasure requests, and notifying them and any regulator of a data breach affecting them. We assist as described in clause 22 and Schedule 1, but the obligations are yours.

9.Acceptable use

You must not use the Service to send, store or facilitate:

  • unlawful, defamatory, harassing, abusive, deceptive or fraudulent content;
  • phishing, credential harvesting, malware, spyware or any malicious code;
  • unsolicited bulk messages, or messages that breach clause 8;
  • content that infringes any intellectual property, privacy or other right;
  • sexually explicit material, or content that sexualises minors;
  • content promoting hate, violence or discrimination against any group;
  • illegal drugs or controlled substances, weapons, or unlawful gambling;
  • pyramid schemes, chain letters, multi-level marketing recruitment, get-rich-quick schemes, or unlicensed financial or investment advice; or
  • content that a mailbox provider or anti-abuse organisation would reasonably classify as abusive.

You also must not:

  • reverse engineer, decompile or attempt to derive source code from the Service, except to the extent that restriction is prohibited by law;
  • circumvent or attempt to circumvent Plan limits, rate limits, authentication or billing;
  • conduct penetration testing, vulnerability scanning or load testing without our prior written consent;
  • resell, sublicense or provide the Service to third parties as a service bureau, except under a written reseller agreement with us; or
  • use the Service to build or assist in building a competing product.

We may apply rate limits, sending throttles or volume ramping to protect the stability and sending reputation of the platform, including for Accounts whose bounce or complaint rates exceed the thresholds mailbox providers tolerate.

9.1 Hosted Pages

Everything above applies to a Hosted Page as it does to a message. A Hosted Page is served from our infrastructure and, unless you connect a domain of your own, published at an address on our domain — which means the content you put on it reflects on every other customer of the Service. A page reported as deceptive can affect the sending reputation that every Brand on the platform relies on, whichever address it was reached at.

In particular, you must not publish a Hosted Page that:

  • impersonates another business, brand, product or person, or presents itself as operated by someone other than you;
  • collects passwords, payment card details, government identifiers or other credentials;
  • misrepresents who is collecting the information entered into it, or what it will be used for;
  • exists primarily to manipulate search rankings, or to host content unrelated to your own business; or
  • would breach clause 9 if it were sent as a message.

You are responsible for the content of your Hosted Pages, for any personal information you collect through them, and for any notice or consent the law requires you to give the people who enter it. We provide the page; the relationship with the Visitor is yours.

If you connect a domain of your own so that Hosted Pages are served from it, you warrant that you control that domain and are entitled to direct it to us, and you remain responsible for its DNS. We may stop serving a connected domain, or remove it, where it no longer resolves to us, where you cease to be entitled to use it, or on the grounds in clause 10. Removing a connected domain does not unpublish your pages: they continue to be served at their address on our domain.

10.Suspension for abuse or risk

We may suspend or limit your Account, a Brand, or a specific send, immediately and without prior notice, where we reasonably believe it is necessary to: prevent harm to Recipients, to us or to other customers; respond to a suspected breach of clause 8 or 9; protect platform sending reputation; or comply with law or the requirements of our own providers.

We will tell you as soon as reasonably practicable and, where the issue can be fixed, give you a reasonable opportunity to fix it. Suspension does not relieve you of the obligation to pay fees for the period of suspension where the suspension arose from your breach.

We may also withdraw an individual Hosted Page from public view without suspending your Account, on the same grounds. We do this in preference to suspending an Account wherever the problem is confined to one page. Withdrawing a page does not delete it: it stops being served, it stays in your Account, and you can edit it. We will tell you which page and why.

11.Deliverability — what we do not promise

We do not guarantee that any message will be delivered, will reach an inbox rather than a spam or promotions folder, or will be opened. Nobody in this industry can honestly promise that, and we do not.

Delivery depends on factors outside our control, including the receiving mailbox provider's filtering, your domain and IP reputation, your content, your list quality, Recipient behaviour, DNS configuration, and third-party blocklists.

You are responsible for authenticating your sending domain (SPF, DKIM and DMARC records) and for maintaining your own sending reputation. We provide tools and diagnostics to help, but the underlying records and reputation are yours.

The Service does not include a service level agreement or uptime guarantee unless we have agreed one with you in a separate signed document.

12.Transactional email

The Service can route transactional messages from your own systems, including through our WordPress plugin. You remain responsible for the content of those messages and for ensuring they are genuinely transactional rather than marketing presented as transactional.

Transactional volume counts toward your Plan's monthly message allowance, but we do not block it when a limit is reached, because refusing to deliver a password reset would be a worse outcome than exceeding a quota. We may still suspend transactional sending under clause 10 for abuse.

Clause 11 applies to transactional email. Because transactional messages are often operationally critical, you should maintain an independent fallback delivery path and must not rely on the Service as your sole means of delivering critical messages.

13.Third-party integrations

The Service integrates with third-party platforms including WooCommerce, Shopify, WordPress and Stripe. Those platforms are operated by third parties under their own terms and privacy policies. We are not responsible for their availability, accuracy, security, changes to their APIs, or their acts or omissions.

Where you supply credentials or install our plugin to connect a platform, you authorise us to access, retrieve and store data from it as needed to provide the Service. You are responsible for ensuring you have the right to grant that access, for scoping credentials to the minimum permission required (read-only where the integration allows it), and for revoking them when you disconnect.

14.AI features

The Service includes optional AI features that generate suggested subject lines, copy, segment definitions, automation sequences and insights.

  • AI output is a suggestion, not advice, and may be inaccurate, incomplete, misleading or unsuitable. You must review it before use.
  • You are solely responsible for every message you send, including any part generated or assisted by AI.
  • When you use these features, the text you provide and relevant context from your Account is transmitted to our AI provider to generate the output. That provider does not use it to train its models.
  • Similar prompts may produce similar output for different customers. We make no representation that AI output is original or that it does not resemble output provided to others.
  • AI usage is metered per Plan.

15.Intellectual property

We and our licensors own all intellectual property rights in the Service, including its software, design, documentation, and the Nectazo name and marks. Except for the licence in clause 4, no rights are granted to you.

If you send us feedback, suggestions or ideas about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use them without restriction or obligation to you. You are not required to give us feedback.

16.Confidentiality

Each party may receive non-public information from the other. Each party will use the other's confidential information only to perform under these terms, will protect it with at least reasonable care, and will not disclose it except to personnel and contractors who need it and are bound by confidentiality obligations, or where required by law (in which case, where lawful, it will give the other party notice).

17.Term, termination and what happens to your data

  • These terms apply from when you first use the Service until your Account is closed.
  • You may terminate at any time by cancelling in the billing portal and closing your Account.
  • We may terminate for your material breach if it is not fixed within 14 days of written notice, or immediately where the breach cannot be fixed, involves clause 8 or 9, or exposes us to legal or reputational risk.
  • We may terminate a free Account that has been inactive for more than 12 months, on 30 days' notice.

On termination your right to use the Service ends. You should export your Customer Data before terminating. We retain Customer Data for 30 days after termination so it can be recovered, then delete it from live systems; residual copies in encrypted backups are overwritten in the ordinary backup cycle within a further 90 days.

We may retain suppression records (addresses that unsubscribed or complained) indefinitely and in a minimised form, because deleting them would destroy the record that a person asked not to be contacted.

Clauses 7, 15, 16, 18, 19, 20, 24 and 25 survive termination, along with any other clause that by its nature should survive.

18.Warranties and disclaimers

Each party warrants that it has the legal power and authority to enter into these terms.

Subject to clause 18.1, and to the maximum extent permitted by law, the Service is provided “as is” and “as available”, and we exclude all warranties, conditions, guarantees and representations not expressly set out in these terms, whether express, implied, statutory or otherwise, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Service will be uninterrupted, timely, secure or error-free, that defects will be corrected, or that it will meet your requirements or produce any particular commercial result.

18.1 Australian Consumer Law

Nothing in these terms excludes, restricts or modifies any guarantee, warranty, right or remedy that applies to you under the Australian Consumer Law or any other law where it cannot lawfully be excluded, restricted or modified. If you are a consumer under the Australian Consumer Law, you have guarantees that cannot be excluded, including a right to a replacement or refund for a major failure.

To the extent we are permitted to limit our liability for breach of a non-excludable guarantee, and it is fair and reasonable to do so, our liability is limited at our option to resupplying the Service or paying the cost of having it resupplied.

19.Limitation of liability

Subject to clauses 18.1 and 19.3, and to the maximum extent permitted by law:

19.1 Excluded loss

Neither party is liable to the other for any indirect, incidental, special, punitive or consequential loss, or for any loss of profit, revenue, anticipated savings, business opportunity, goodwill, reputation, or corruption or loss of data, however arising and whether or not the party was advised of the possibility.

19.2 Liability cap

Our total aggregate liability arising out of or in connection with these terms and the Service, whether in contract, tort (including negligence), statute or otherwise, is limited to the total fees you paid us in the twelve months immediately before the event giving rise to the liability, or AUD $100 if you are on the free Plan.

19.3 What is never limited

Nothing in these terms limits either party's liability for:

  • death or personal injury caused by its negligence;
  • fraud or fraudulent misrepresentation;
  • wilful misconduct;
  • your obligation to pay fees; or
  • anything else that cannot lawfully be limited or excluded.

19.4 Contribution

Our liability is reduced to the extent that your act, omission or breach of these terms caused or contributed to the loss.

20.Indemnity

You indemnify us, and our officers, employees and contractors, against all liabilities, losses, damages, penalties, fines and reasonable legal costs arising out of or in connection with a third-party claim, regulatory investigation or blocklisting, to the extent it arises from:

  • your Customer Data, or the content of any message you send through the Service;
  • your breach of clause 8 (permission and consent) or clause 9 (acceptable use);
  • your breach of any law, including spam, privacy, consumer or advertising law;
  • a claim by any of your Contacts or Recipients relating to your use of the Service; or
  • your breach of these terms.

We will notify you promptly of any claim, allow you to control the defence with counsel reasonably acceptable to us, and provide reasonable assistance at your cost. You must not settle a claim in a way that admits our liability or imposes an obligation on us without our written consent. This indemnity is reduced to the extent our negligence or breach caused the loss.

21.Force majeure

Neither party is liable for failure or delay caused by an event beyond its reasonable control, including natural disaster, fire, flood, war, terrorism, epidemic, industrial action, failure of telecommunications or internet infrastructure, denial-of-service attack, or failure of a third-party provider. The affected party must notify the other and use reasonable efforts to mitigate. If the event continues for more than 30 days, either party may terminate without liability.

22.Privacy and data protection

Our Privacy Policy forms part of these terms and explains how we handle personal information.

Where we process personal information contained in Customer Data, we do so on your behalf and on your instructions. For the purposes of the GDPR and equivalent laws, you are the controller and we are the processor of that data. In relation to your own account and billing information, we are the controller. Schedule 1 sets out our processor obligations and forms part of these terms.

23.Changes to these terms

We may update these terms. For changes that materially affect your rights or obligations we will give at least 30 days' notice by email to your account address or by prominent in-app notice, and the change takes effect at the end of that period. Other changes take effect when published. Continuing to use the Service after a change takes effect means you accept it; if you do not, you may cancel before it takes effect.

24.General

  • Assignment — you may not assign these terms without our written consent. We may assign them to a related body corporate or in connection with a merger, acquisition or sale of substantially all our assets, on notice to you.
  • Entire agreement — these terms, the Privacy Policy and Schedule 1 are the entire agreement between us on their subject matter and supersede all prior discussions and representations.
  • Severability — if any provision is unenforceable, it is severed or read down to the minimum extent necessary and the rest continues in force.
  • Waiver — a failure or delay in exercising a right is not a waiver of it.
  • Relationship — nothing creates a partnership, joint venture, agency or employment relationship.
  • Notices — we may give notice by email to your account address or in-app. You may give notice to us at the addresses in clause 26.
  • No third-party rights — nobody other than you and us has any right to enforce these terms.

25.Governing law and jurisdiction

These terms are governed by the laws of Queensland, Australia. Each party submits to the non-exclusive jurisdiction of the courts of Queensland and the courts competent to hear appeals from them. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before commencing proceedings (other than for urgent interlocutory relief), a party must give the other written notice of the dispute, and the parties must negotiate in good faith for 14 days.

26.How to contact us

S1.Schedule 1 — Data processing terms

This Schedule applies where we process personal data contained in Customer Data on your behalf, and is intended to satisfy Article 28 of the GDPR and equivalent requirements.

1. Subject matter and details of processing

  • Subject matter and duration — provision of the Service, for the term of your Account plus the retention periods in clause 17.
  • Nature and purpose — storing contact records; segmenting and targeting; composing, sending and delivering email; recording delivery, open, click, bounce, complaint and unsubscribe events; synchronising product catalogues; generating reports.
  • Types of personal data — email address, first and last name, phone number, company, job title, postal address, tags, notes, custom fields you define, subscription status and source, list membership, suppression records, and message engagement events including timestamps and clicked URLs.
  • Categories of data subjects — your contacts, subscribers, customers and prospects, and recipients of your transactional email.
  • Special category data — the Service is not designed for, and you must not submit, special category data as defined in GDPR Article 9, or government identifiers, financial account numbers, or health information.

2. Our obligations

  • We process personal data only on your documented instructions, which comprise these terms and your use of the Service, unless required otherwise by law (in which case we will tell you unless the law forbids it).
  • We ensure personnel authorised to process personal data are bound by confidentiality.
  • We implement appropriate technical and organisational measures as described in our Privacy Policy, including encryption in transit, encryption at rest for connected-store credentials, hashed passwords and hashed API keys, and access controls.
  • We assist you, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights.
  • We assist you with data protection impact assessments and consultations with supervisory authorities, to the extent reasonably required and taking into account the information available to us.
  • We notify you without undue delay after becoming aware of a personal data breach affecting your Customer Data, with the information reasonably available to us.
  • On termination we delete Customer Data in accordance with clause 17 or, on your written request made within the 30 day window, return it to you.
  • We make available the information reasonably necessary to demonstrate compliance with this Schedule and allow for audits, no more than once in any twelve month period unless required by a regulator, on reasonable notice, at your cost, and subject to confidentiality.

3. Subprocessors

You give general authorisation for us to engage the subprocessors listed below. We impose data protection obligations on each of them no less protective than those in this Schedule, and remain liable to you for their performance.

SubprocessorPurposeLocation
Vercel Inc.Application hosting and content deliveryUnited States
Neon Inc.Managed PostgreSQL database (all account and contact records)United States (AWS us-east-1)
Amazon Web Services, Inc.Email delivery (SES) and file storage (S3) for uploaded images, files offered as form downloads, and videos while they are being convertedUnited States (us-east-1)
Trigger.dev LtdBackground job execution for campaign sending, automations and store syncUnited States
Anthropic PBCAI text generation for the optional AI writing featuresUnited States
OpenAI, L.L.C.AI image generation for the optional image generation featureUnited States
Fly.io, Inc.Video-to-GIF conversion for the optional animated GIF toolUnited States
Stripe, Inc.Subscription billing and payment processingUnited States

We will give at least 30 days' notice before adding or replacing a subprocessor. If you reasonably object on data protection grounds within that period, we will work with you in good faith to find an alternative; if we cannot, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.

4. International transfers

Customer Data is stored and processed in the United States. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to us or our subprocessors, that transfer is made under the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated into this Schedule by reference, or another lawful transfer mechanism.

5. Your obligations

You warrant that you have a lawful basis for the processing you instruct, that you have provided all required notices and obtained all required consents from data subjects, and that your instructions will not cause us to breach any applicable data protection law.

Terms of Service — Nectazo