A NOTE ON HOW TO READ THIS

Two different groups of people read this document. If you are a GYBPro subscriber, almost all of it applies to you directly. If you are a customer of a business that uses GYBPro and you have arrived here from a message or a website, Section 3 and Section 17 are the ones that matter — in short, that business decides how your data is used, and you should approach it first. Section 3 explains which of the two positions you are in.

AT A GLANCE

This table is a convenience summary. It is not a substitute for the full Policy and has no independent legal effect. Where the summary and the full Policy differ, the full Policy prevails.

1. INTRODUCTION AND SCOPE

1.1 GYBPro AI Techh Private Limited ("GYBPro", "we", "us", "our") provides an integrated marketing, sales and growth platform for small and independent businesses. This Privacy Policy explains what personal data we handle, why we handle it, who we share it with, how long we keep it and what rights you have.

1.2 This Policy applies to: (a) our website at www.gybpro.com and our marketing pages; (b) the GYBPro platform, mobile applications and admin interfaces; (c) our sales, onboarding, support and billing operations; and (d) personal data we process on behalf of our subscribers when they use the platform to run their own businesses.

1.3 This Policy forms part of, and should be read with, our Terms of Service. Capitalised terms not defined here have the meaning given in the Terms of Service. Where the Terms of Service and this Policy conflict on a data protection matter, this Policy prevails.

1.4 We handle personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, the Information Technology Act, 2000 and, where applicable to a specific business profile, comparable laws in other jurisdictions.

1.5 This Policy does not apply to the websites, social channels or messaging accounts of our subscribers, or to any third-party platform you connect to the platform. Those are governed by the privacy notices of the businesses and platforms concerned.

2. WHO WE ARE AND HOW TO REACH US

2.1 We are not currently notified as a Significant Data Fiduciary under Section 10 of the DPDP Act. If we are so notified, we will appoint a Data Protection Officer based in India and update this Policy accordingly.

3. THE TWO ROLES WE PLAY

3.1 It matters which role we are in, because it determines who you should approach about your data. There are two:

3.2 Where we act as a Data Processor, our subscriber is the Data Fiduciary. We do not use data held on their behalf for our own purposes, do not sell it, and do not use it to market to their customers.

4. PERSONAL DATA WE COLLECT

4.1 Data we collect as Data Fiduciary — about subscribers and their team members.

4.2 Data we process as Data Processor — about our subscribers' End Customers. When a subscriber uses the platform, we process data about their customers and contacts on their instructions. This typically includes:

4.3 We do not seek to collect sensitive categories of information such as health records, biometric identifiers, caste, religion, sexual orientation, political affiliation or government identifiers, except where a specific feature is designed to receive them or where a document is submitted to us for verification. Subscribers must not upload such information to the platform without a lawful basis, and must not upload it at all where the platform has no feature designed to receive it.

5. HOW WE COLLECT PERSONAL DATA

5.1 Directly from you — when you sign up, verify your number, complete onboarding, configure your business profile, upload content, connect channels, purchase a plan, contact support or respond to a survey.

5.2 Automatically — through cookies and similar technologies on our website, and through logs, diagnostics and audit records generated as you use the platform.

5.3 From third parties — from single sign-on providers when you choose to sign in with them, from connected channels through the permissions you grant, from our payment gateway in relation to transaction outcomes, and from partners or referrers who introduce you to us.

5.4 From publicly accessible sources — from your own website and public business listings during onboarding, and from public business directories where we verify business details.

5.5 From our subscribers — where they upload or import contact records into the platform. In that case the subscriber is responsible for having a lawful basis for the transfer, and we act only as processor.

6. WHY WE USE PERSONAL DATA, AND ON WHAT BASIS

6.1 We process personal data on the basis of your consent, and on the basis of the legitimate uses recognised under Section 7 of the DPDP Act, including where you have voluntarily provided your personal data to us for a specified purpose and have not indicated that you object to its use for that purpose, and where processing is necessary to comply with a legal obligation or an order of a court or authority.

6.2 We do not sell personal data. We do not share personal data with advertisers or data brokers for their own purposes. Our products are not funded by advertising to you.

7. CONSENT AND HOW TO WITHDRAW IT

7.1 Where we rely on consent, we ask for it in clear terms at the point of collection and record what you agreed to, when and in what version. Consent given during onboarding covers the Terms of Service, this Policy and the use of AI models to generate content for you, and is recorded with a timestamp.

7.2 You may withdraw consent at any time by writing to contactus@gybpro.com or through the settings available in the platform. Withdrawal is as easy as giving consent.

7.3 Withdrawing consent does not affect processing carried out before the withdrawal, and does not affect processing we are required to continue by law. If you withdraw consent for processing that is necessary to provide the platform, we may not be able to continue providing it, and your subscription may need to be cancelled.

7.4 We may make consent requests available in English and in the languages specified in the Eighth Schedule to the Constitution of India, as required under the DPDP Act.

8. ARTIFICIAL INTELLIGENCE AND YOUR DATA

8.1 The platform uses artificial intelligence to generate copy, images, layouts, brand assets, strategy and recommendations. To do this, we send inputs — such as your business profile, brief, prompts and selected media — to AI model providers acting as our processors.

8.2 We do not use your content to train third-party foundation models. Our agreements with model providers restrict the use of our inputs and outputs to generating the response requested.

8.3 We analyse usage patterns, performance signals and de-identified structural characteristics of content to improve our own templates, prompts and vertical libraries. This uses anonymised patterns rather than raw customer content, and produces material that does not identify you, your business or any individual.

8.4 You should not enter personal data into AI briefs, prompts or free-text fields unless it is necessary for the output you want. Anything you enter is treated as your content and is processed as described in this Policy.

8.5 AI-generated output may be inaccurate. Nothing produced by the platform should be treated as a statement of fact about any identifiable person without your own verification.

9. COOKIES AND SIMILAR TECHNOLOGIES

9.1 On www.gybpro.com we use cookies and similar technologies that are strictly necessary for the site to work, together with analytics and marketing cookies that we set only where you consent through our cookie banner. You can change your preferences at any time from the cookie settings link in the footer, and through your browser controls.

9.2 Within the platform we use strictly necessary cookies and local storage for authentication, session continuity, trusted device recognition and security. These cannot be disabled while you remain signed in.

9.3 A summary of the cookies we use is at Annexure B.

9.4 Websites we build for our subscribers. Every website generated through the platform includes an automatically generated cookie banner with essential, analytics and marketing categories, and per-visitor consent storage. These settings and the accompanying privacy notice belong to the subscriber, who is responsible for their accuracy and adequacy. Visitors to those websites should read the notice published on the website itself.

10. WHEN WE SHARE PERSONAL DATA

10.1 We share personal data only in the circumstances below, and only to the extent necessary.

10.2 A current list of our principal processors and service providers is at Annexure A. We impose contractual obligations on each of them to process data only on our instructions, to keep it confidential and to apply appropriate security safeguards. We remain responsible to you for their performance.

10.3 We may share aggregated, de-identified and statistical information that cannot reasonably be used to identify you, your business or any individual, including market and category-level insights.

11. WHERE YOUR DATA IS STORED

11.1 Our primary cloud facilities are located in India. Backups are held redundantly across multiple regions to protect against loss.

11.2 Some of our processors — in particular AI model providers, communication providers and analytics providers — operate infrastructure outside India, and personal data may be processed there. Such transfers are made as permitted under Section 16 of the DPDP Act and are not made to any country restricted by the Central Government.

11.3 Where a business profile is established outside India, additional or different arrangements may apply to reflect local law. Full data residency by region is on our roadmap and is not implemented in the current release.

12. HOW LONG WE KEEP PERSONAL DATA

12.1 We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as we are required to keep it by law. A summary is at Annexure C, and the retention rules for content and media in the Terms of Service apply in addition.

12.2 In outline: while your subscription is active, your data is retained; after cancellation or termination, content, media and website backups are retained for the subscription period plus thirty (30) days; deleted assets sit in a recycle bin for thirty (30) days and can be restored during that window; and warnings are issued before anything is permanently removed. No automated irreversible deletion takes place without human review.

12.3 Accounts that remain unpaid and inactive for more than ninety (90) days may be terminated and the associated data deleted, after notice and an opportunity to export.

12.4 Some records are kept for longer because the law requires it, including invoices and accounting records, tax records, consent and opt-out evidence, audit logs and records relating to an actual or anticipated dispute.

13. HOW WE PROTECT PERSONAL DATA

13.1 We apply administrative, technical and physical safeguards designed to prevent unauthorised access, disclosure, alteration and loss. These include encryption of data in transit, access controls based on role and least privilege, logical separation of customer data, one-time password authentication with attempt limits and account lockout, device trust management, tamper-proof audit logging, and periodic review of access rights.

13.2 No system is perfectly secure. You also have a part to play: keep your registered mobile number and email secure, do not share one-time passwords, remove team members who leave promptly, review trusted devices, and grant only the permissions each person needs.

13.3 If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals in the form and within the timelines required under the DPDP Act. Where we act as processor, we will notify the subscriber concerned without undue delay so that it can meet its own obligations.

14. YOUR RIGHTS

14.1 Where we are the Data Fiduciary, you have the following rights under the DPDP Act:

Access. To obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of other Data Fiduciaries and processors with whom it has been shared.

Correction and completion. To have inaccurate or misleading data corrected, and incomplete data completed or updated.

Erasure. To have your personal data erased, unless retention is necessary for the purpose it was collected for or is required by law.

Withdrawal of consent. To withdraw consent at any time, as described in Section 7.

Grievance redressal. To complain to us about how we have handled your data or your request, using the process in Section 21.

Nomination. To nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

14.2 To exercise a right, write to contactus@gybpro.com from your registered email address, or use the account settings in the platform. We may ask for information to verify your identity before acting, and we will not use that information for any other purpose.

14.3 We will respond within thirty (30) days. If a request is complex or we need more time, we will tell you why and when we expect to respond.

14.4 We may decline a request where it is manifestly unfounded or excessive, where acting on it would prejudice the rights of another person, or where we are required by law to retain the data. We will explain our reasons.

14.5 You are required by the DPDP Act to provide authentic information, not to impersonate another person, not to suppress material information, and not to raise false or frivolous grievances.

15. CHILDREN AND PERSONS WITH A LAWFUL GUARDIAN

15.1 The platform is a business tool and is not directed at children. We do not knowingly collect personal data of anyone under 18 as a subscriber or team member. If we become aware that we have, we will delete it.

15.2 We do not carry out tracking, behavioural monitoring or targeted advertising directed at children.

15.3 If a subscriber processes data relating to a child, or to a person with a disability who has a lawful guardian, through the platform — for example a coaching centre, paediatric clinic or children's activity business — that subscriber is responsible for obtaining verifiable consent from the parent or lawful guardian, and warrants to us that it has done so.

16. YOUR RESPONSIBILITIES WHEN YOU USE GYBPRO

16.1 When you use the platform to hold and message your own customers, you are the Data Fiduciary for that data. That carries obligations you must meet independently of us.

16.2 In particular you must: publish your own privacy notice and keep it accurate; obtain and record valid consent before sending marketing communications; honour opt-outs and erasure requests; use contact data only for the purpose it was given for; refrain from uploading purchased, rented or scraped lists; and respond to your customers' data requests yourself.

16.3 The privacy notice and cookie banner generated automatically for your website are generic templates. They are a starting point, not legal advice, and not tailored to your business. Review and adapt them.

16.4 We will assist you, so far as reasonably practicable, in responding to a request or a breach affecting data we hold for you. Where the assistance is substantial we may charge for it.

17. IF YOU ARE A CUSTOMER OF A BUSINESS THAT USES GYBPRO

17.1 If you received a message, booking confirmation, invoice or review request generated through GYBPro, or your details are held in a business's records on our platform, that business — not GYBPro — decides how your data is used.

17.2 Please contact that business directly to access, correct or delete your data, or to stop receiving messages. Replying with STOP, UNSUBSCRIBE or an equivalent instruction on a messaging channel registers an opt-out immediately and permanently, and the platform blocks further marketing messages to you from that business.

17.3 If you cannot identify or reach the business, write to contactus@gybpro.com with the message you received and we will route your request to the business concerned and, where we are able to, act on it ourselves.

18. THIRD-PARTY PLATFORMS AND LINKS

18.1 The platform connects to services we do not control, including social platforms, messaging platforms, search and listing services, payment providers and domain registrars. Once data reaches those platforms it is governed by their own privacy notices and settings.

18.2 Our website and generated websites may contain links to other sites. We are not responsible for their content or privacy practices.

19. MARKETING FROM US

19.1 We send marketing communications about our own products only with your consent, or where you are an existing customer and the message concerns a similar product. Every marketing message includes a way to opt out.

19.2 Opting out of marketing does not stop service and transactional messages such as verification codes, billing notices, security alerts and deactivation warnings, which are necessary to operate your account.

19.3 You can manage your preferences from your profile settings or by writing to contactus@gybpro.com.

20. CHANGES TO THIS POLICY

20.1 We may update this Policy to reflect changes to the platform, our processors, or the law. The current version and its effective date are published at www.gybpro.com/privacy.

20.2 Where a change is material — for example a new purpose of processing, a new category of recipient, or a change in retention — we will give at least fifteen (15) days' notice by email or in-product notice before it takes effect, and will seek fresh consent where the law requires it.

20.3 Superseded versions are archived and available on request.

21. GRIEVANCE REDRESSAL AND COMPLAINTS

21.1 If you are unhappy with how we have handled your personal data or your request, contact our Grievance Officer:

21.2 We will acknowledge your grievance within twenty-four (24) hours and resolve it within fifteen (15) days, or such shorter period as may be prescribed.

21.3 If you remain dissatisfied after exhausting this process, you may complain to the Data Protection Board of India in the manner prescribed under the DPDP Act.

22. CONTACT US

ANNEXURE A — COOKIES ON WWW.GYBPRO.COM

A full, itemised cookie table listing each cookie by name, provider and duration must be published alongside this Policy before launch and kept in step with the actual tags deployed.

ANNEXURE B — RETENTION SUMMARY