DPDP Compliance Notice

DPDP COMPLIANCE NOTICE

Data Principal Rights Policy

1 WHO WE ARE - THE DATA FIDUCIARY

1.1.Under the Digital Personal Data Protection Act, 2023, the entity that collects and processes your personal data and determines the purpose and means of that processing is called a "Data Fiduciary". The Data Fiduciary for the GrowStart AI platform is:

1.2.You, as a user of the Platform, are a "Data Principal" under the DPDP Act — meaning you are the individual to whom the personal data we collect relates. This Notice explains your rights as a Data Principal and how to exercise them.

2 SCOPE OF THIS NOTICE

2.1.This DPDP Compliance Notice applies to:

•all registered users of the GrowStart AI Platform, whether on the Free, Growth, or Pro plan;

•individuals who interact with the Platform's marketing communications or public-facing pages;

•any individual whose personal data is submitted to the Platform by a User (for example, individuals whose data appears in a customer list uploaded to the Email Campaign Builder or Lead Manager).

2.2.This Notice does not apply to:

•the personal data of a User's own customers or leads that is processed by the Company as a Data Processor on the User's behalf, those individuals' rights are the primary responsibility of the User as Data Fiduciary. However, if any such individual contacts the Company directly, we will refer their request to the relevant User.

•data that is fully anonymised and cannot be used to identify any individual.

3 WHAT PERSONAL DATA WE COLLECT AND WHY

We only collect the personal data that is necessary to provide you with the GrowStart AI Platform and its features. We do not sell your personal data to third parties.

3.1.The following table provides a complete overview of the personal data we collect about you as a registered User, the purpose of processing, and the lawful basis under the DPDP Act:

3.2.AI Processing: When you use any AI-powered feature of the Platform, your inputs including business descriptions, prompts, and any content you submit are transmitted to Anthropic, PBC (the developer of the Claude AI model) in the United States for processing. This is necessary to generate the AI output you have requested. Full details are set out in Section 5 of this Notice.

3.3.Data We Do Not Collect. We do not intentionally collect:

•sensitive personal data, including health information, biometric data, financial account details, government identification numbers, or caste or religious affiliation, in the ordinary course of Platform use;

•personal data from children under the age of 18 years.

4 HOW WE SHARE YOUR PERSONAL DATA

We share your personal data only in the following circumstances and only to the extent necessary for the stated purpose:

4.1.Anthropic, PBC (AI Model Provider)

When you use AI-powered features, your inputs are transmitted to Anthropic's Claude API for processing. Anthropic is located in the United States. This constitutes a cross-border transfer. We share only the content of your prompt not your account credentials, payment data, or other unrelated personal data.

4.2.Razorpay Software Private Limited (Payment Gateway)

When you make a payment, your transaction is processed by Razorpay. Razorpay operates in India. We share only the transaction metadata required for subscription management. Your card or bank details are held exclusively by Razorpay and are not shared with us.

4.3.Cloud Infrastructure Provider

Your data is stored on managed cloud infrastructure located in Mumbai, India. The infrastructure provider processes data solely to provide storage and hosting services.

4.4.Google LLC (GBP Integration)

If you use the GBP Optimizer or GBP auto-post feature and grant OAuth access to your Google Business Profile, we access your GBP data through Google's API to deliver those features. This involves cross-border data access.

4.5.Legal and Regulatory Authorities

We may share personal data with government authorities, regulators, courts, or law enforcement where required to do so by applicable Indian law or a lawful court order. We will notify you of such disclosure where permitted.

We do not sell, rent, or trade your personal data to any third party for commercial purposes. Data shared with Anthropic is shared solely for AI processing to deliver the features you use not for Anthropic's own commercial purposes

5 CROSS-BORDER TRANSFER OF PERSONAL DATA

5.1.The DPDP Act recognises that personal data may need to be transferred outside India for certain processing purposes. The following cross-border transfers occur in connection with your use of the Platform:

5.2.All cross-border transfers are processed on the basis of your consent, which is obtained at the time of account creation and confirmed by your use of the relevant features. You may withdraw consent to cross-border transfers by discontinuing use of the relevant feature and contacting grievance@growstart.ai.

5.3.The Company will comply with any restrictions on cross-border transfers that may be imposed by the Central Government under Section 16 of the DPDP Act, as and when such restrictions take effect.

6 YOUR RIGHTS AS A DATA PRINCIPAL

Under the Digital Personal Data Protection Act, 2023, you have six rights with respect to your personal data. These rights are set out below in plain language. We are committed to helping you exercise these rights easily and without unnecessary delay

7 HOW TO EXERCISE YOUR RIGHTS - STEP BY STEP

7.1.You may exercise any of your rights under the DPDP Act by following the process below:

7.2.No Fee: We will not charge you a fee for exercising your rights in ordinary circumstances. However, if a request is manifestly unfounded, excessive, or repetitive, we reserve the right to charge a reasonable administrative fee or decline to act, after notifying you of the reason.

7.3.What We Will Need From You: To process your request efficiently, please include in your email:

•your full name as registered on the Platform;

•the email address associated with your GrowStart AI account;

•the specific right you wish to exercise (e.g. erasure, correction, information);

•if a correction request: the specific data that is incorrect and the correct version;

•if an erasure request: a brief reason (optional but helpful);

•any additional context that will help us locate and process the relevant data.

8 CONSENT - GIVING, MANAGING, AND WITHDRAWING

8.1.How We Obtain Consent

We obtain your consent to process your personal data in the following ways:

•At registration: by your acceptance of the Terms and Conditions and this DPDP Compliance Notice, which together constitute your informed consent to data collection and processing as described herein.

•For AI processing: by your use of any AI-powered feature of the Platform, which constitutes consent to the transmission of your input to Anthropic's API for processing.

•For cookies: through the cookie consent banner displayed on your first visit to the Platform.

•For marketing communications: through an opt-in mechanism at registration or a separate consent request.

8.2.Withdrawing Consent

You may withdraw consent to any specific processing activity at any time. The consequences of withdrawal depend on the processing activity:

Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal. It also does not entitle you to a refund of any Subscription Fees paid for the period prior to withdrawal.

9 GRIEVANCE OFFICER AND ESCALATION TO DATA PROTECTION BOARD

9.1. Our Grievance Officer

We have appointed a Grievance Officer in accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. You may contact our Grievance Officer for any privacy-related concern, data rights request, or complaint:

9.2.Escalation to the Data Protection Board of India

If you are not satisfied with the response of our Grievance Officer, you have the right under Section 13 of the DPDP Act to file a complaint with the Data Protection Board of India ("the Board") once it is constituted under the Act. The Board has the authority to investigate complaints, award compensation to affected Data Principals, and impose penalties on Data Fiduciaries.

The Data Protection Board of India will be accessible once constituted under the DPDP Act. Information about the Board's complaint process will be made available at the official government portal. At the time of publication of this Notice, the Board has not yet been formally constituted. We will update this section with the Board's contact details once available.

10 HOW WE PROTECT YOUR DATA

10.1.We implement appropriate technical and organisational security measures to protect your personal data. These include:

•encryption of all data in transit using TLS 1.2 or higher;

•encryption of data stored on our servers using industry-standard encryption;

•access controls restricting access to personal data to authorised personnel only;

•secure, hashed storage of passwords;

•regular security assessments and vulnerability monitoring;

•physical and environmental security measures at our cloud data centre in Mumbai, India.

10.2.In the event of a personal data breach that is likely to result in harm to you, we will notify you and the Data Protection Board of India in accordance with the requirements of the DPDP Act.

11 CHILDREN AND MINORS

11.1.The GrowStart AI Platform is not intended for use by individuals under the age of 18 years. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has registered on the Platform, please contact grievance@growstart.ai immediately and we will delete the account and associated data without undue delay.

12 CHANGES TO THIS NOTICE

12.1.We may update this DPDP Compliance Notice from time to time to reflect changes in the DPDP Act, Platform features, or our data processing practices. When we make material changes, we will:

•publish the updated Notice on the Platform with a new effective date;

•notify you by email to your registered email address; and

•where required by the DPDP Act, seek fresh consent before processing data in any materially different way.

12.2.We recommend that you review this Notice periodically. Continued use of the Platform after notification of changes constitutes your acceptance of the updated Notice.