PRIVACY POLICY

1. Introduction and Scope

This Privacy Policy ("Policy") describes how Algorion Research and Analysis Private Limited ("Algorion", "Company", "we", "us", or "our"), the owner and operator of the mobile and web application providing fundamental analysis, technical analysis, scorecards, AI-generated forecasts, an "Ask Intelligence" conversational research tool, an IPO explorer, trending-stocks data, and related financial research and information services (collectively, the "App" or "Services"), collects, uses, discloses, stores, transfers, and protects personal data and other information of users ("you", "your", or "User") who access or use the App.

This Policy applies to all Users of the App, including registered account holders, visitors browsing public sections of the App, and any person whose information we receive in connection with the operation of the App. By creating an account, accessing, browsing, downloading, installing, or otherwise using the App, you acknowledge that you have read, understood, and agree to be bound by this Policy and consent to the collection, use, storage, processing, and disclosure of your information as described herein. If you do not agree with any part of this Policy, you must immediately discontinue use of the App.

This Policy is published with reference to applicable Indian law governing data protection and electronic commerce, including: the Information Technology Act, 2000 and the rules notified thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); and the Digital Personal Data Protection Act, 2023 ("DPDP Act") together with the Digital Personal Data Protection Rules, 2025 notified by the Ministry of Electronics and Information Technology. We note, for transparency, that the DPDP Act and DPDP Rules are being brought into force in phases: provisions relating to the establishment of the Data Protection Board of India took effect from the date of notification, provisions relating to Consent Managers are scheduled to take effect approximately twelve months from notification, and the substantive data-fiduciary compliance obligations of the DPDP Act (including detailed notice, consent, and data-principal-rights provisions) are scheduled to take effect approximately eighteen months from notification. Until the relevant provisions of the DPDP Act are brought fully into force, the IT Act and the SPDI Rules continue to constitute the primary operative data protection framework governing our processing of your personal data, and we have framed our practices to align with both the current regime and our anticipated obligations under the DPDP Act as its provisions come into force. Where this Policy refers to DPDP Act rights or obligations, such references describe our intended compliance posture and do not assert that every such provision is presently in force. Where you access the App from outside India, you are responsible for compliance with local laws, and by using the App you consent to the transfer and processing of your information in India and in the jurisdictions where our service providers operate, as described in this Policy.

This Policy should be read together with our Terms and Conditions and our Cancellation and Refund Policy, each of which is incorporated herein by reference. In the event of any conflict between this Policy and the Terms and Conditions specifically as to data handling, this Policy shall govern.

2. Regulatory Status Disclosure

Important Notice Regarding SEBI Registration Status

Algorion is presently in the process of applying for registration with the Securities and Exchange Board of India ("SEBI") as a Research Analyst under the Securities and Exchange Board of India (Research Analysts) Regulations, 2014 ("RA Regulations") and/or as an Investment Adviser under the Securities and Exchange Board of India (Investment Advisers) Regulations, 2013 ("IA Regulations"), each issued by SEBI under the Securities and Exchange Board of India Act, 1992, as applicable to the nature of the relevant features of the App. As of the date of this Policy, Algorion does not hold a valid Certificate of Registration as a Research Analyst or Investment Adviser issued by SEBI. Until such registration is obtained, no content, score, forecast, signal, rating, or output generated within the App — including but not limited to the Fundamental Analysis module, Technical Analysis module, Scorecard, Summary, AI Forecast, Ask Intelligence, IPO Explorer, or Trending Stocks features — constitutes "investment advice" or a "research report" within the meaning of the IA Regulations or RA Regulations respectively, and Algorion does not hold itself out as a Research Analyst or Investment Adviser in providing such content. All such outputs are provided strictly for informational, educational, and analytical purposes and must not be relied upon for making investment decisions. This disclosure is incorporated into, and forms an inseparable part of, this Privacy Policy and the Terms and Conditions. Personal and financial data collected in connection with these features is processed on the same basis: as data supporting an informational tool, not a registered advisory relationship, unless and until Algorion notifies Users that registration has been obtained and advisory status has changed.

3. Information We Collect

We collect information in the following categories, through the methods, plugins, SDKs, and APIs described below. The table summarises the categories; detailed descriptions follow.

4. Purposes of Processing

We process personal data for the following purposes, each grounded in a lawful basis such as your consent, performance of a contract with you, our legitimate interests, or compliance with legal obligations:

1. Account creation, authentication, OTP verification, and ongoing identity management.
2. Provision of core App features, including Fundamental Analysis, Technical Analysis, Scorecard, Summary, AI Forecast, Ask Intelligence, IPO Explorer, and Trending Stocks modules.
3. Processing payments, subscriptions, renewals, and refunds through Cashfree, and maintaining transaction and billing records as required by law.
4. Facilitating physical delivery of any goods or printed/physical materials associated with the Service, using precise location and address data.
5. Personalising your experience, including tailoring dashboards, watchlists, alerts, and AI-generated outputs based on your usage history and preferences.
6. Operating, maintaining, debugging, and securing the App, including fraud detection, abuse prevention, and enforcement of our Terms and Conditions.
7. Sending administrative communications, including transactional emails/SMS, OTPs, security alerts, policy updates, and service notices.
8. With your consent, sending marketing, promotional, and product-update communications, which you may opt out of at any time.
9. Complying with applicable law, regulatory requests, court orders, and obligations that may arise from our pending and, when granted, completed SEBI registration as a Research Analyst/Investment Adviser, including record-keeping obligations that may apply to research-related communications.
10. Conducting internal analytics, product research, and AI model evaluation to improve the relevance and accuracy of forecasts and recommendations generated by the App, including outputs generated using the Groq API.

5. AI-Generated Content and Automated Processing

Certain features of the App — including AI Forecast, Ask Intelligence, and elements of the Scorecard and Summary modules — rely on automated processing and large language model inference, including inference performed via the Groq API and other AI infrastructure providers we may engage from time to time. When you interact with these features, your queries, selected instruments, and relevant contextual data may be transmitted to such AI infrastructure providers to generate a response. We take reasonable steps to minimise the personal data included in such transmissions and to use anonymised or pseudonymised inputs where feasible. However, you should avoid entering sensitive personal information (such as government identification numbers, full bank account details, or health information) into any free-text field, including the Ask Intelligence interface, as such information is not required for the Service to function and we disclaim responsibility for voluntary disclosure of such data by you.

Outputs generated by AI Forecast, Ask Intelligence, Scorecard, and Summary are generated algorithmically and may be inaccurate, incomplete, or unsuitable for your circumstances. As stated in Section 2 above, given our pending SEBI registration status, such outputs do not constitute investment advice or research analysis and should be independently verified before being relied upon in any manner.

6. Third-Party Data Processors and Disclosure of Information

We engage the following categories of third-party service providers, sub-processors, and data recipients to operate the App. Each operates under its own privacy policy and, where required, under data processing agreements with us:

We do not sell your personal data to third parties for monetary consideration. We may share information with the above processors strictly to the extent necessary for them to perform services on our behalf, and we require such processors to maintain the confidentiality and security of your information consistent with this Policy and applicable law. We may also disclose information: (a) to comply with a legal obligation, court order, or governmental/regulatory request, including any request from SEBI in connection with our registration process; (b) to enforce our Terms and Conditions; (c) to protect the rights, property, or safety of Algorion, our Users, or the public; (d) in connection with a merger, acquisition, restructuring, or sale of assets, subject to confidentiality obligations; and (e) with your explicit consent for any other purpose.

Payment processing is conducted through Cashfree Payments India Private Limited, which operates as a Payment Aggregator regulated by the Reserve Bank of India ("RBI") under the Payment and Settlement Systems Act, 2007 and the RBI's consolidated Master Direction on the Regulation of Payment Aggregators. Algorion itself is a merchant/platform using Cashfree's payment aggregation services and is not separately licensed or regulated by the RBI as a Payment Aggregator or Payment System Operator. Card, UPI, and net-banking credentials are collected, stored, and tokenised directly by Cashfree in accordance with RBI's data storage and tokenisation norms applicable to payment aggregators; Algorion does not store full card or bank account credentials on its own servers.

7. Cookies, SDKs, and Tracking Technologies

The App and any associated website may use cookies, mobile SDK identifiers, local storage (via shared_preferences and sqflite), and similar tracking technologies to remember your preferences, maintain session state, analyse usage trends, and improve performance. Firebase Analytics and similar third-party analytics tools may set their own identifiers in accordance with their respective privacy policies. You may control cookie and tracking preferences through your device or browser settings; however, disabling certain technologies may impair core functionality of the App, including authentication and personalisation features.

8. Data Storage, Security, and Retention

Your data is primarily stored on infrastructure provided by Supabase Inc. and Firebase (Google LLC), which may store and process data on servers located within or outside India. We implement reasonable security practices and procedures, including encryption in transit (TLS/SSL), access controls, authentication safeguards, and periodic security reviews, in line with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. No method of electronic storage or transmission is completely secure, and while we strive to protect your personal data, we cannot guarantee absolute security.

We retain personal data for as long as necessary to fulfil the purposes outlined in this Policy, including to comply with legal, accounting, or reporting obligations, to resolve disputes, and to enforce our agreements. Transaction and payment records may be retained for the period mandated under applicable Indian tax, accounting, and payment regulations. Upon expiry of applicable retention periods, we will securely delete or anonymise your data, except where retention is required by law, including any record-keeping requirements that may apply to us as a SEBI-registered entity once registration is granted.

9. Cross-Border Data Transfers

Given that several of our processors, including Firebase (Google LLC) and certain market data and AI infrastructure providers, operate global infrastructure, your personal data may be transferred to, stored in, and processed in countries outside India, including the United States and other jurisdictions where these providers maintain servers. We take reasonable steps to ensure that any such transfer is subject to appropriate safeguards consistent with the DPDP Act and other applicable law, including contractual protections with our processors. By using the App, you consent to such cross-border transfer and processing of your information.

10. Your Rights

Subject to applicable law, including the DPDP Act, you have the following rights in relation to your personal data:

• Right to access a copy of the personal data we hold about you.
• Right to correction of inaccurate or incomplete personal data.
• Right to erasure of personal data that is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to withdraw consent for processing that is based on consent, including marketing communications, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to grievance redressal through our designated Grievance Officer, as set out in Section 13 below.
• Right to nominate another individual to exercise your rights in the event of death or incapacity, in accordance with the DPDP Act.

To exercise any of these rights, please contact us using the details in Section 14. We may require you to verify your identity before acting on a request and may decline requests that are manifestly unfounded, excessive, or that conflict with our legal obligations.

11. Children's Privacy

The App is intended for use by individuals who are at least 18 years of age and legally capable of entering into binding contracts under the Indian Contract Act, 1872, including for the purpose of making financial decisions and transacting through Cashfree. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take steps to delete such information promptly. Parents or guardians who believe their child has provided personal data to us should contact us using the details in Section 14.

12. Marketing Communications and Opt-Out

Where you have consented to receive marketing or promotional communications, we may contact you via email, SMS, push notification, or other channels regarding new features, offers, market updates, or promotional content. You may withdraw your consent and opt out of marketing communications at any time by using the unsubscribe link provided in such communications, adjusting your in-app notification settings, or contacting us directly. Please note that you cannot opt out of essential transactional or service communications, including OTPs, security alerts, and policy updates, which are necessary for the operation of your account.

13. Grievance Redressal

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, we have designated a Grievance Officer to address any complaints, queries, or concerns regarding the processing of your personal data or compliance with this Policy.

We will acknowledge and seek to resolve grievances within the timelines prescribed under applicable law.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or the regulatory status of Algorion (including upon grant of SEBI registration). The updated Policy will be posted within the App with a revised effective date. Your continued use of the App following any update constitutes your acceptance of the revised Policy. For material changes affecting how we process your personal data, we will provide additional notice, such as an in-app notification or email, where required by law.

15. Data Localisation and Government Access Requests

We recognise that financial and payment-related data carries heightened sensitivity. Where feasible and consistent with the architecture of our processors, we encourage and configure our infrastructure providers to store transaction and authentication data in data centres located in India. However, because Firebase (Google LLC) and certain AI infrastructure providers including the Groq API operate on global, multi-region infrastructure, complete data localisation cannot always be guaranteed, and your data may be processed in multiple jurisdictions as described in Section 9.

If we receive a legally valid request from an Indian governmental, judicial, or regulatory authority, including SEBI in connection with our registration application or, subsequently, our obligations as a registered Research Analyst or Investment Adviser, the Reserve Bank of India in connection with payment data, or law enforcement authorities, to disclose personal data, we will review such requests for legal validity and may disclose the minimum data necessary to comply, while seeking to notify you of such disclosure where legally permitted to do so.

16. Data Minimisation and Purpose Limitation

We are committed to collecting only the personal data reasonably necessary to provide the Services described in this Policy. Where a feature can be provided without collecting precise location, financial identifiers, or other sensitive data, we aim to design the App accordingly, or to request such permissions only at the point they become relevant, for example requesting location access only when a delivery-dependent feature is invoked rather than at first app launch. You may decline optional permissions, such as location access, subject to the understanding that certain features dependent on that data, such as physical delivery tracking, may not function correctly without it.

We do not use your financial or transaction data collected via Cashfree for purposes unrelated to processing your payments, billing support, fraud prevention, and legally mandated record-keeping, unless we obtain your separate, explicit consent for an additional purpose.

17. Security Incident Notification

In the event of a personal data breach that is likely to result in harm to you, we will, to the extent required under the DPDP Act and other applicable law, notify the Data Protection Board of India and affected Users without undue delay, and will take reasonable remedial measures to contain and investigate the breach. We maintain incident response procedures with our key infrastructure and payment processors, including Supabase Inc., Firebase (Google LLC), and Cashfree Payments India Private Limited, to support timely detection and escalation of security incidents affecting your data.

18. Automated Decision-Making and Profiling

Certain features of the App, including the Scorecard and AI Forecast modules, involve automated processing of market and usage data to generate a numerical score, rating, or forecast output that is presented to you. This automated processing applies to financial instrument data and your interaction history within the App, such as which sectors or stocks you follow, and does not involve automated decisions that produce legal effects concerning you or similarly significantly affect you, such as automated denial of service or automated financial decisions made on your behalf. You always retain the ability to disregard, question, or seek human clarification regarding any AI-generated output through our support channels.

19. Third-Party Links and External Content

The App may contain links to third-party websites, IPO prospectuses, company investor-relations pages, news articles sourced via RSS feeds, or other external content for your convenience. We do not control and are not responsible for the privacy practices or content of such third-party websites. We encourage you to review the privacy policy of any third-party website before providing any personal data to it.