Terms of Service

1 About these terms

1.1

These Terms of Service ("Terms") form a legal agreement between you and LabNexa Technologies ("Lab Nexa", "we", "us") governing your use of the Lab Nexa web platform, NFC tap-in system, and related services (together, the "Service").

1.2

By creating an account, tapping an NFC tag, or otherwise using the Service, you confirm that you have read and accept these Terms. If you are accepting on behalf of an institution, you confirm you are authorised to do so.

1.3

If your institution has signed a separate master agreement or order form with us, that document takes precedence over these Terms wherever the two conflict. For everyone else, these Terms apply in full.

Why this exists: Some universities sign contracts with us directly, and those contracts sometimes override bits of these terms. This clause just says which document wins if they disagree.

2 Accounts & registration

2.1

Most accounts are created by your institution's administrator rather than by you. Guest accounts are created through the guest request flow and expire automatically after a short, fixed period.

2.2

You must provide accurate information — including your IC number where requested — and keep it up to date. Deliberately false registration details are a breach of these Terms.

2.3

You are responsible for all activity that occurs under your account. If you suspect your password or NFC card has been lost, stolen, or misused, tell us or your institution as soon as you can so the credential can be revoked.

2.4

Do not share your password or your NFC card, and do not use anyone else's. Because sessions double as attendance records, sharing a card or account undermines the integrity of those records and may be treated as misconduct by your institution.

The honest part: We can't stop you from sharing a card with a friend, but we can detect it — two people tapping in from different places in quick succession, or a session that moves between labs impossibly fast. The audit log exists for exactly this reason.

3 NFC cards & session records

3.1

Tapping an NFC tag starts a session; tapping again ends it. Each session record includes the PC used, the lab, the login and logout times, and the method of login. This is the core function of the Service.

3.2

Authorised staff — lecturers running a class, supervisors, and administrators — can view current occupancy and session details for the labs they are responsible for. This visibility is intentional and is limited to each role's scope.

3.3

Sessions may end automatically (for example, after a period of inactivity or at the end of a class) or may be ended by staff with the appropriate authority. Where a session is ended by someone else, the reason is recorded.

3.4

Session records are retained according to the schedule in our Privacy Policy, after which they are deleted or irreversibly anonymised.

What we never do: Lab Nexa records that a seat was occupied. It does not monitor screens, read files, log keystrokes, inspect browser history, or listen to microphones. There is no surveillance agent on lab PCs, because we never built one.

4 Acceptable use

You agree not to, and not to help anyone else to:

bypass access controls, or use another person's account or NFC card without authority;
interfere with, disrupt, or overload the Service, the lab computers, or the network;
scrape, bulk-download, or resell data from the Service;
upload malicious code, or attempt to gain unauthorised access to any part of the Service;
tamper with, falsify, or misrepresent session or attendance records;
use the Service for anything unlawful, or to harass, impersonate, or mislead others;
reverse-engineer or attempt to derive the source code of the Service, except where the law expressly permits it.

If you breach this clause we may suspend or terminate your access and, where appropriate, inform your institution. We keep logs that allow us to investigate such incidents.

About security research: If you find a vulnerability, we want to hear from you — see our Security Policy for how to report it responsibly. Good-faith research is welcome; abuse is not.

5 Institutional administration

5.1

Lecturers, supervisors, and administrators hold powers appropriate to their role: viewing sessions within their scope, ending individual sessions, deactivating a lab, and managing PCs and NFC cards.

5.2

These powers exist to keep labs running and are logged in full. Staff must exercise them for legitimate operational purposes only.

5.3

If you believe an administrative power has been misused against you, raise it with your institution in the first instance, or with us. The audit trail exists precisely so that such questions can be answered factually.

Why this matters: Power without accountability is just power. Every force-logout, every session ended, every permission change is written to the audit log — and the act of reading that log is itself the kind of thing that gets questioned.

6 Guest access

6.1

Guest passes are short-lived, single-purpose, and intended for supervised use. They confer limited functionality and do not create a standing account.

6.2

The staff member or institution that sponsors a guest is responsible for that guest's use of the Service. Guest data is handled as described in our Privacy Policy.

Guest sessions expire after 4 hours. That's deliberate — a visit is a visit, and access should close with it.

7 Fees & billing

7.1

Where your institution subscribes to a paid plan, fees are as quoted in the applicable order form or invoice, in Ringgit Malaysia unless otherwise stated.

7.2

Invoices are payable within thirty (30) days. If payment is overdue we may, after reasonable written notice, suspend the affected subscription until payment is received.

7.3

Fees are exclusive of taxes. You are responsible for applicable sales, service, or similar taxes, other than taxes on our own income.

7.4

We may change our prices at renewal, giving at least thirty (30) days' notice before the change takes effect.

7.5

Fees for periods already used are non-refundable, except where a refund is required by law or where we agree otherwise in writing.

The honest part: We'd rather earn your renewal than lock you in. If you're unhappy, tell us before the next billing cycle and we'll work with you — or part ways cleanly.

8 Intellectual property

8.1

The Service — including its software, interface, design, documentation, and branding — is owned by Lab Nexa or its licensors and is protected by copyright and other intellectual property laws.

8.2

We grant you a limited, non-exclusive, non-transferable licence to use the Service for its intended purpose while your account is active. This licence ends when your account ends.

8.3

If you send us suggestions or feedback, we may use them without obligation to you. You keep ownership of anything you create using the Service.

About your work: The attendance records, complaints, and data you create while using Lab Nexa belong to you (or your institution). We don't claim ownership of anything you put into the system.

9 Your data & ownership

9.1

Your institution owns the data that it and its users put into the Service ("Customer Data"). We do not claim ownership of Customer Data.

9.2

We process Customer Data only to provide and maintain the Service, and as instructed by your institution, in line with our Privacy Policy and any applicable data processing agreement.

9.3

On termination, your institution may export its Customer Data for thirty (30) days, after which we delete it in accordance with our retention schedule.

9.4

We may compile aggregated, anonymised statistics from usage of the Service. These contain no personal data and may be used to improve the platform.

What "aggregated, anonymised" means: Counts like "Lab A averages 42 sessions per day" or "73% of complaints are resolved within 24 hours" — with the personal details stripped out first. We never sell even this data.

10 Privacy

Our collection and use of personal information is described in our Privacy Policy, which is incorporated into these Terms by reference. By using the Service you consent to the practices described there.

The short version: We collect what a lab logbook would collect, we keep it only as long as it's useful, we don't sell it or hand it to advertisers, and you can ask us for a copy or the delete button at any time.

11 Security

11.1

We protect the Service with industry-standard measures, including encryption in transit and at rest, hashed passwords, role-based access control, and comprehensive audit logging.

11.2

No system is perfectly secure, and we do not guarantee absolute security. What we do guarantee is that we will respond promptly and honestly to any incident that affects your data.

11.3

You contribute to security by keeping your credentials confidential, not sharing NFC cards, and reporting suspected incidents to us or your institution without delay.

The honest part: We're a small team and we say so in our Security Policy, including what we haven't built yet. We'd rather be honest about the gaps than impressive on paper.

12 Availability & maintenance

12.1

We aim for high availability, but the Service is provided on an "as available" basis and we do not promise uninterrupted or error-free operation.

12.2

We schedule maintenance where possible outside lab hours and give reasonable notice. Emergency maintenance may occur without notice if needed to protect the Service or its data.

12.3

We may add, change, or retire features over time. If a change materially reduces the functionality of a paid plan, we will give affected customers reasonable notice.

What "reasonable notice" means: At least 7 days for planned maintenance, and an email or in-app notice for feature changes that affect your workflow. We won't pull the rug out from under you.

13 Third-party services

The Service may link to, or integrate with, third-party services that we do not control. Those services are governed by their own terms and privacy policies, and we are not responsible for their content or conduct.

The honest part: We don't embed third-party trackers, analytics, or advertising in Lab Nexa. If we ever integrate with an external service (like a payment processor), we'll tell you which one and why.

14 Suspension & termination

14.1

You may stop using the Service at any time. Your institution may deactivate or delete accounts it manages, subject to its own policies and applicable law.

14.2

We may suspend or terminate access where required by law, where we reasonably believe there is a security risk, or where these Terms are breached. Where practicable we will give notice first.

14.3

On termination your licence ends and your data is handled as described in clauses 9 and 10. Clauses that by their nature should survive — including ownership, disclaimers, liability, and governing law — continue to apply.

What happens to your data: You get 30 days to export it, then we delete it (except rows the law forces us to keep, and we'll name those rows rather than hide behind "legal reasons").

15 Disclaimers

To the maximum extent permitted by law, the Service is provided "as is" and "as available", and we disclaim all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Service will meet your requirements, or that every defect will be corrected.

Translation: We build Lab Nexa carefully and fix bugs when we find them, but we can't promise it's perfect or that it will do exactly what you need. If it doesn't work for your use case, tell us — we might be able to help, or we might honestly say "this isn't the right tool for you."

16 Limitation of liability

16.1

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded — including for fraud, or for death or personal injury caused by negligence.

16.2

Subject to 16.1, neither party is liable for indirect, incidental, or consequential losses, or for loss of profit, revenue, or goodwill, arising out of or connected with these Terms.

16.3

Our total aggregate liability arising out of or in connection with the Service is capped at the fees paid (or payable) for the Service in the twelve (12) months preceding the event giving rise to the claim. Where the Service is provided free of charge, the cap is a nominal amount.

16.4

We are not liable for losses caused by your breach of these Terms, or by unauthorised access resulting from your failure to safeguard your credentials or NFC card.

Why this exists: We're a small company. If something goes catastrophically wrong, we can't afford to bet the company on it — and neither could you, if the roles were reversed. This clause keeps both sides' risk proportional to what's actually at stake.

17 Indemnity

To the extent permitted by law, you will indemnify and hold us harmless against third-party claims, damages, and reasonable costs arising from your breach of these Terms or your unlawful use of the Service.

Translation: If you break the rules and someone sues us because of it, you cover our legal costs. This is standard in almost every software agreement, and it's fair — we shouldn't pay for your mistakes.

18 Governing law & disputes

18.1

These Terms are governed by the laws of Malaysia.

18.2

If a dispute arises, both sides will first try in good faith to resolve it by discussion within thirty (30) days. Failing that, the courts of Malaysia have exclusive jurisdiction.

18.3

Either party may seek injunctive relief at any time to protect intellectual property or the security of the Service.

The honest part: We'd rather talk than litigate. If something goes wrong, email us first and we'll try to fix it. Courts are expensive, slow, and nobody wins — they're the last resort, not the first.

19 General provisions

19.1

These Terms, together with the Privacy Policy and any signed order form, are the entire agreement between you and us on this subject.

19.2

If any provision is held unenforceable, the rest continues in full force, and the offending provision is read down to the minimum extent necessary.

19.3

Our failure to enforce a right on one occasion is not a waiver of that right on any other occasion.

19.4

You may not assign these Terms. We may assign them to an affiliate or to a successor in a merger or sale, with notice to you.

19.5

Neither party is liable for delay or failure caused by events genuinely outside its reasonable control.

19.6

Notices under these Terms may be sent by email to the address on your account, or posted to your account dashboard.

Why these exist: These are boilerplate clauses that lawyers insist on, and they're mostly common sense. "Force majeure" means we're not liable if a flood takes out our servers; "no waiver" means if we let you slide once, we can still enforce the rule next time.

20 Changes to these terms

We may update these Terms from time to time. For material changes we will give reasonable notice — by email or an in-app notice — before they take effect, and we will update the date at the top of this page. Continued use of the Service after changes take effect means you accept the revised Terms. Previous versions are available on request.

The honest part: A privacy policy or terms of service that quietly grows new paragraphs is one you shouldn't trust. If we change something material, we'll tell you plainly and let you decide — not assume consent by silence.

21 Contact

Questions about these Terms, or a request to speak to someone about them? There's no support desk with a phone tree and hold music. There's one inbox, and the small team that builds this system reads it. Write at 2am and you'll get a reply at nine the next working morning, from a person, not an auto-responder pretending to be awake.

Legal & everything else

LabNexa Technologies · Registration No. 060419020751 · Registered in Malaysia, working remotely

labnexatechnologies@gmail.com Contact form +60 11 2749 5334

We aim to respond to all legitimate requests within 30 days at the outside; in practice it's days, not weeks. If we ever need longer, we'll say so in writing before the deadline, not after.