Karma ← Back to site
Legal

Terms of Service

These Terms govern your use of Karma, the reputation-based bot detection service operated by File Master LLC. By creating an account or installing the snippet, you agree to them.

Version 1.0 · Effective 26 August 2026 · Governing language: English

1. Who you are contracting with

Karma is operated by File Master LLC ("we", "us"), a company registered in Bulgaria, VAT number 180842207, with its registered office at Serena app., office C13, Golden Sands, Varna 9007, Bulgaria. "You" means the individual or legal entity that accepts these Terms.

If you accept these Terms on behalf of an organisation, you confirm that you have authority to bind that organisation, and "you" refers to that organisation.

Where we process personal data on your behalf, the Data Processing Agreement forms part of these Terms and governs that processing. It is incorporated by reference and you do not need to sign it separately.

2. The service

Karma consists of a hosted control panel, a browser snippet you place on sites you control, and a collector that receives signals from that snippet and from your gateway. From those signals Karma reaches a verdict on each session and makes it available to your gateway, which decides what to do with the request.

Karma does not itself block anything on your site. Enforcement happens in your own infrastructure, under your own configuration. A verdict is information; what you do with it is your decision and your responsibility.

We may change, add or remove features. Where a change materially reduces functionality on a paid plan, we will give you at least 30 days' notice by email and you may cancel under clause 5.

3. Accounts and organisations

  1. You must provide accurate registration details and keep them current.
  2. You are responsible for everything done under your account, including by team members you invite, and for keeping credentials and API keys confidential.
  3. Accounts are held by an organisation. An administrator may invite, change the role of and remove members. Removing the last administrator is not possible.
  4. You must be at least 18 years old, or the age of majority where you live, whichever is higher.
  5. Tell us promptly at the address in clause 17 if you believe your account is compromised.

4. Plans, verdicts and billing

  1. The billing unit is a verdict: one completed session on which Karma reached a decision. It is not a request and not a page view. Confirmed legitimate crawlers are not counted, and neither are sessions where the signals were insufficient to decide. Our count is authoritative for billing.
  2. Free plan. The Detect plan is free, does not expire and does not require a card. It provides verdicts without gateway enforcement. We may change its limits on 30 days' notice.
  3. Paid plans are billed in advance for the chosen period, monthly or yearly, at the price shown at checkout. A yearly term is billed as a single payment.
  4. Overage. Exceeding your monthly verdict allowance does not switch protection off. The excess is billed at your plan's published per-10,000 rate. We publish these rates on the pricing page and may change them on 30 days' notice, effective from your next renewal.
  5. Top-ups. Verdict packs bought in advance are added to the current billing period's allowance, are consumed before overage is charged, and expire at the end of that period. They are not refundable once the period has begun, and they do not carry over.
  6. Currency and rate. Prices are set in US dollars. The rouble price list is derived at a fixed internal rate rounded up to whole hundreds of roubles; it is a price, not a live exchange rate, and does not follow the market. The amount shown at checkout is the amount charged.
  7. Renewal. Where auto-renewal is on and a payment method is stored, we charge the then-current price at the end of each period. You can switch auto-renewal off at any time from the billing page and keep the service until the period ends.
  8. Taxes. Prices exclude VAT and other applicable taxes unless stated at checkout. Where a payment provider acts as merchant of record, its tax handling applies.
  9. Failed payment. If a renewal fails we retry and notify you. After the grace period shown in your panel, the subscription lapses to the free plan; your data is retained under the Privacy Policy.

5. Refunds and cancellation

  1. You may cancel at any time from the billing page. Cancellation stops future renewals; it does not end the current period.
  2. 14-day refund on a first paid period. If Karma does not work for you, ask within 14 days of your first paid purchase and we will refund it in full. This does not apply to renewals, to verdict top-ups already consumed, or where the account has been suspended under clause 14.
  3. Consumers in the EU keep their statutory right of withdrawal. By starting to use a paid plan during the withdrawal period you ask us to begin performance immediately, and you may be charged pro rata for what was used if you then withdraw.
  4. Refunds go back to the original payment method, in the original currency.

6. Acceptable use

You must not:

  1. install the snippet on a site you do not control, or configure a gateway to act on verdicts for traffic you are not entitled to inspect;
  2. use Karma to profile, track or build a dossier on identified individuals for any purpose other than protecting your own site from automated abuse;
  3. use verdicts to discriminate against visitors on any basis prohibited by applicable law;
  4. resell, sublicense or expose the verdict API to third parties as a service of your own without a written agreement with us;
  5. probe, load-test or attempt to circumvent the platform's own limits, or submit fabricated signals to influence the shared reputation pool;
  6. use the service to break the law, infringe rights, or send unsolicited mail.

Automated testing of your own sites is expected and permitted; add your own tooling to your allow list so it is not scored against you.

7. Your sites and your visitors

  1. You confirm you control each site on which you install the snippet, and that you have a lawful basis to have its traffic analysed by a processor.
  2. Telling your visitors is your job, not ours. Karma is invisible; that does not make it exempt. Your own privacy notice must disclose that a bot-detection processor receives visitor signals, and identify us where your law requires naming processors. We give you the wording you need in the Privacy Policy and the DPA.
  3. You are the controller of your visitors' personal data and we are your processor. You instruct the processing by configuring your account.
  4. Verdicts are probabilistic. They will sometimes be wrong in both directions. You must keep an allow list, keep a route for a wrongly blocked visitor to reach you, and not use a verdict alone as the basis for a decision producing legal or similarly significant effects on an individual.

8. Field capture

On plans that include it, you may configure Karma to observe form fields on your own pages by CSS selector, in one of three modes: not at all, presence only (whether the field was filled), or the value itself.

  1. Value mode is yours to justify. You choose the selector; we cannot tell from a selector what a field contains. Do not point value mode at passwords, payment details, government identifiers, health information or any other special-category data.
  2. The snippet does not transmit password fields. Values that pass a Luhn check and look like a payment card number are replaced with a redaction marker before storage. These are safety nets, not a substitute for choosing selectors responsibly.
  3. Anything captured is personal data of your visitors, processed under the DPA on your instructions, and counts towards what your own privacy notice must disclose.
  4. We may disable field capture on your account, after notice where practicable, if we have reasonable grounds to believe a selector is collecting data it should not.

9. The shared reputation pool

Karma keeps a reputation base for each account, and a pool shared across accounts. Read this clause carefully: it describes data leaving your tenant.

  1. Contribution is on by default. Observations about network addresses seen on your sites — the address, what it did in signal terms, and when — are contributed to the shared pool unless you turn contribution off. You can turn it off at any time from your Karma settings, on any plan including the free one, and doing so does not degrade detection on your own account.
  2. Reading the pool is a separate switch and is off by default. It is available from the Protect+ plan upwards. Turning it on lets your sites benefit from what other accounts observed; turning it off does not stop your contribution, and vice versa. The two are independent.
  3. What is contributed. Network addresses and the signal-level facts about their behaviour. Not your URLs, not your content, not your customers' identities, not anything captured under clause 8, and nothing that identifies you as the source of an observation to any other account.
  4. Contributed observations are aggregated with those of other accounts. Once aggregated they cannot be attributed back to you or extracted on your behalf, so a deletion request under clause 10 of the DPA covers your own tenant's records rather than the pool's aggregate state.
  5. You grant us a non-exclusive, worldwide, royalty-free licence to use contributed observations to operate and improve detection for all customers, for as long as they are retained.

10. Availability and support

  1. We aim for high availability and publish no uptime commitment except on the Enterprise plan, where an SLA may be agreed in writing.
  2. Design for our absence. If the collector is unreachable, your gateway should fail open — pass traffic — rather than fail closed. An outage of ours must not be able to take your site down. Your own deny list is different: it is your explicit instruction and should survive.
  3. We may perform maintenance, ordinarily with notice for anything expected to be disruptive.
  4. Support is by email at the address in clause 17. Response times are best-effort except where an SLA says otherwise.

11. Intellectual property

  1. Karma, its panel, snippet, collector, models, documentation and brand remain ours. Nothing here transfers ownership.
  2. We grant you a non-exclusive, non-transferable, revocable licence to use the service and to embed the snippet on sites you control, for the term of your subscription.
  3. Your data — your account details, configuration, sites, verdicts and anything captured — remains yours. Clause 9 describes the one narrow licence we take.
  4. You may not decompile or reverse-engineer the service except to the extent that applicable law says you may.
  5. If you send us feedback, we may use it without obligation or compensation.

12. Disclaimer of warranties

The service is provided "as is" and "as available". To the fullest extent permitted by law we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement.

Karma reduces automated abuse; it does not eliminate it, and it is not a guarantee that your site will not be attacked, scraped or compromised. It is one control among several. It is not a firewall, not a WAF and not a substitute for multi-factor authentication, patching or rate limiting on the operations that matter.

13. Limitation of liability

  1. Neither party excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be excluded by law.
  2. Subject to that, our total aggregate liability arising out of or in connection with these Terms is limited to the greater of the amounts you paid us in the 12 months before the event, or EUR 100.
  3. We are not liable for indirect or consequential loss, loss of profit, revenue, goodwill, business or data, or for losses arising from a verdict that was wrong in either direction, from your enforcement configuration, or from your gateway failing closed during an outage of ours.
  4. You will indemnify us against third-party claims arising from your breach of clause 6, 7 or 8, including claims by your own visitors about data you instructed us to collect.

14. Suspension and termination

  1. You may terminate at any time by cancelling and deleting your account.
  2. We may suspend or terminate an account that breaches these Terms, that is used unlawfully, that submits fabricated signals to the shared pool, or that has an unpaid balance after the grace period. Where practicable and lawful we will give notice and a chance to fix it.
  3. We may suspend immediately, without notice, where continuing would expose us or others to material legal or security risk.
  4. On termination your licence ends and you must remove the snippet. Data is deleted under clause 10 of the DPA. Clauses 11 to 13, 15 and 16 survive.

15. Changes to these Terms

We may update these Terms. For material changes we will give at least 30 days' notice by email or in the panel; continuing to use the service after they take effect means you accept them. If you do not, cancel before the effective date and we will refund the unused part of a prepaid period.

16. Governing law and disputes

  1. These Terms are governed by the law of Bulgaria, without regard to conflict-of-law rules.
  2. Disputes are subject to the exclusive jurisdiction of the competent courts of Varna, Bulgaria.
  3. A consumer resident in the EU keeps the protection of the mandatory rules of their own country and may bring proceedings there.
  4. Please contact us first; most disagreements are settled faster by email than by court.

17. Contact

File Master LLC · Serena app., office C13, Golden Sands, Varna 9007, Bulgaria · VAT 180842207
Email: tech.support@recoverytoolbox.com

See also the Privacy Policy and the Data Processing Agreement.