DPDP Act Compliance Statement

This statement describes how Criyo AI complies with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). It supplements our Privacy Policy at criyo.ai/privacy with India specific detail. Where this statement and the Privacy Policy describe the same thing, the Privacy Policy is the governing document.

1. Our Role Under the DPDP Act

Criyo AI acts in two distinct capacities:

• As a Data Fiduciary, in relation to the personal data of our own account holders. We determine the purpose and means of processing that data.
• As a Data Processor, in relation to the personal data of our users' audiences. When you use CRIYO AI to communicate with your followers and leads, you are the Data Fiduciary for that data and we process it only on your instructions.

This distinction matters. If a follower asks us to erase data captured through your account, we will act on it and will also notify you, because the primary obligation to that individual is yours.

2. Principles We Apply

3. Consent

3.1 How We Obtain Consent

• Account creation. By registering, you consent to our Privacy Policy and Terms and Conditions, which are presented before you complete signup.
• Connecting a social account. Meta's own OAuth flow obtains your explicit, granular consent for each permission we request. You see exactly what you are granting before you approve it.
• Marketing communications. A separate opt in, distinct from your account consent.
• Cookies. We set only strictly necessary and functional cookies, and we operate no analytics, advertising, or tracking technology. Because these cookies do not involve tracking or profiling, no consent banner is presented. If we introduce any technology that requires consent, we will obtain it before that technology loads. See our Cookie Policy at criyo.ai/cookies.

3.2 Withdrawing Consent

You may withdraw consent at any time, with the same ease with which it was given:

• Disconnect a social account through Settings, then Instagram Connection
• Unsubscribe from marketing email using the link in any such email
• Delete your account through Settings, then Account, then Delete My Account

Withdrawal does not affect the lawfulness of processing carried out before it, but stops further processing.

4. Your Rights as a Data Principal

Under the DPDP Act you have the right to access a summary of your data and our processing of it, the right to correction and erasure, the right to grievance redressal, and the right to nominate another individual to exercise your rights in the event of your death or incapacity.

These rights, and the additional rights available under the GDPR and UK GDPR where those apply, are set out in full in Privacy Policy Section 15.

How to Exercise Your Rights

Email support@criyo.ai from your registered address with the subject line "DPDP Data Principal Request", stating your full name, registered email address, and the right you wish to exercise.

We verify your identity before acting on any request, and respond within 30 days, free of charge.

To nominate an individual under Section 14 of the DPDP Act, email us with the nominee's name, relationship to you, and contact details, together with a signed declaration.

5. Children's Data

In line with Section 9 of the DPDP Act:

• CRIYO AI is a business tool and is not intended for anyone under 18
• We do not knowingly collect the personal data of a child
• We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children
• Where we become aware that an account holder is under 18, we delete the associated data and close the account

6. Cross Border Data Transfers

The DPDP Act permits transfer of personal data outside India except to territories restricted by the Government of India.

Personal data is processed and stored in India on Amazon Web Services infrastructure in the Asia Pacific (Mumbai) ap-south-1 region.

A limited number of service providers necessary to operate the Services are located outside India. These are named in Privacy Policy Section 9 and comprise Google (authentication), Meta Platforms (API integration), and Resend (transactional email). Razorpay, our payment processor, is located in India.

Where personal data is transferred outside India we rely on contractual data protection terms with each provider, and, where the GDPR applies to the individual concerned, on Standard Contractual Clauses or another lawful transfer mechanism. We will comply with any future restriction issued by the Government of India on transfers to specific territories.

7. Personal Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without undue delay, in the form and within the timelines prescribed under the DPDP Act and rules made under it.

Our notification will describe the nature of the breach, its likely consequences, and the steps taken to mitigate harm.

Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours and affected individuals where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Articles 33 and 34.

8. Grievance Officer

As required under the DPDP Act, we have appointed a Grievance Officer to address complaints relating to the processing of personal data.

The Grievance Officer is responsible for responding to Data Principal requests, handling grievances, and liaising with the Data Protection Board of India.

9. Grievance Redressal Process

• Email support@criyo.ai with the subject line "Grievance" and a description of the issue
• We acknowledge receipt within 48 hours
• We provide a substantive response within 30 days

If your grievance is unresolved, or you are not satisfied with our response, you may approach the Data Protection Board of India through its official channels.

10. Significant Data Fiduciary Status

The Government of India may designate an entity as a Significant Data Fiduciary based on the volume and sensitivity of the personal data it processes and other factors set out in the DPDP Act.

Criyo AI has not been designated a Significant Data Fiduciary. The additional obligations that attach to that status, including the mandatory appointment of a Data Protection Officer based in India, independent data auditors, and periodic Data Protection Impact Assessments, do not currently apply to us.

We have nonetheless appointed a named Grievance Officer, maintain records of our processing activities, apply defined retention periods, and review our security practices as our platform develops. Should we be designated a Significant Data Fiduciary, we will implement the full set of obligations within the prescribed timelines and update this statement accordingly.

11. Updates to This Statement

The DPDP Act's implementing rules continue to develop. We will update this statement in response to new rules issued by the Government of India, guidance from the Data Protection Board, and material changes to our own data practices. The Last Updated date above reflects the most recent revision.

12. Contact

This DPDP Act Compliance Statement was last updated on 25 August 2026.