This Privacy Policy explains how Naksha (“Naksha,” “we,” “us”) collects, uses, shares, and protects personal data when you use the Platform. It forms part of the Naksha Terms. Capitalised terms not defined here have the meaning given in the Terms of Service. Naksha is designed to minimise data. We host only short Clips of unreleased music, we do not process payments for Artists, and analytics shown to Artists are aggregated and de-identified. This Policy is written to align with the Digital Personal Data Protection Act, 2023 (India) and other applicable law. 1. Data Fiduciary and Scope For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Naksha is the Data Fiduciary in respect of personal data it determines the purpose and means of processing. This Policy applies to personal data processed through the Naksha mobile applications, website, and services. It does not apply to third-party services (including DSPs and detection providers) that operate under their own policies. 2. Personal Data We Collect We collect personal data in the following categories. We collect only what is reasonably necessary for the purposes described in Clause 3. 2.1 Information you provide Account data: name or artist name, email address, phone number (if provided), password, and, for Artists, profile and biographical information you choose to add. Content and metadata: Clips you upload (maximum sixty seconds), cover art, artwork, lyrics, descriptions, story content, and associated metadata. Note: the full-length recording is not collected. Eligibility declarations: your representations that Content is unreleased, independent, Indian-origin, and that you hold the necessary rights. Communications: messages, support requests, and feedback you send us, and your participation in any community channel operated by Naksha. 2.2 Information collected automatically Usage and engagement data: listens, replays, skips, reactions, saves, time spent, and other interactions used to generate Feedback Data and analytics. Device and log data: IP address, device type and identifiers, operating system, app version, browser type, access times, and pages or screens viewed. Approximate location: derived from IP address or device settings, used to support the Indian-origin focus of the Platform and for security; we do not collect precise GPS location unless you expressly permit it. Cookies and similar technologies: as described in the Cookie section below. 2.3 Pre-Save authorisation data If you use the Pre-Save feature, the relevant third-party DSP may, through an authorisation (OAuth) flow, provide Naksha with a limited authorisation token and basic account identifiers necessary to effect the pre-save. Naksha uses this solely to facilitate the pre-save you requested. Naksha does not receive your DSP password, does not access your library beyond the scope you authorise, and does not process any payment. You may revoke this authorisation at any time through your DSP account settings. 3. Purposes and Legal Bases for Processing We process personal data only where we have a lawful basis under the DPDP Act, principally your consent and, where applicable, legitimate uses permitted by law. Our purposes are: a. to create and administer your account and provide the Platform's core features; b. to host and display Clips and to generate Feedback Data and analytics for Artists, presented in aggregated, deidentified form; c. to operate the graduation flow, including detecting whether an underlying recording has been released (which may involve audio-fingerprinting via third-party providers) so that Clips can be disabled on release; d. to facilitate Pre-Save authorisations you request; e. to communicate with you about the Platform, respond to support and grievance requests, and send service messages; f. to maintain the security and integrity of the Platform, prevent and detect fraud, manipulation, infringement, and abuse, and enforce the Naksha Terms; g. for internal analytics, research, and improvement of the Platform, using aggregated and de-identified data wherever practicable; and h. to comply with legal obligations and to establish, exercise, or defend legal claims. Where we rely on your consent, you may withdraw it at any time as described in Clause 7, without affecting the lawfulness of processing before withdrawal. Withdrawing certain consents may limit or prevent your use of the Platform. 4. Marketing Communications We will send you marketing communications only where permitted by law or with your consent. You may opt out at any time using the unsubscribe mechanism in the communication or by contacting us. Service and transactional messages necessary to operate the Platform are not marketing and may still be sent. 5. How We Share Personal Data We do not sell your personal data. We share personal data only as described below: a. Service providers (Data Processors): hosting, storage, content-delivery, analytics, audio-fingerprinting/detection, authentication, and communication providers who process data on our behalf, under contractual obligations to protect it and to use it only for the services they provide to us. b. DSPs for Pre-Save: the specific DSP you authorise, limited to the data necessary to effect the pre-save you requested. c. Other Users, in de-identified form: Artists receive aggregated, de-identified Feedback Data; individual Listener identities are not disclosed to Artists, save where a Listener expressly chooses to make an interaction attributable. d. Legal and safety: courts, regulators, law-enforcement, or other authorities where required by law or where reasonably necessary to protect rights, safety, or the integrity of the Platform, or to respond to a valid legal request. e. Business transfers: an acquirer or successor in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to this Policy or a successor policy offering equivalent protection. 6. Audio Detection and Automated Processing To operate the graduation feature, Naksha may apply automated audio-fingerprinting and detection (including via thirdparty providers such as ACRCloud) to determine whether an underlying recording has been publicly released. This processing is directed at the recording, not at profiling you, and its outcome is the automated disabling of a Clip on release. Where you believe a detection outcome is incorrect, you may contact us as described in Clause 7. 7. Your Rights as a Data Principal Subject to the DPDP Act and applicable law, you have the following rights in respect of your personal data: a. Access: to obtain a summary of the personal data we process about you and the processing activities. b. Correction and updating: to have inaccurate or incomplete personal data corrected, completed, or updated. c. Erasure: to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements. d. Withdrawal of consent: to withdraw consent at any time, as easily as it was given. e. Grievance redressal: to readily access a means of grievance redressal, as described in Clause 12. f. Nomination: to nominate another individual to exercise your rights in the event of your death or incapacity, in accordance with the DPDP Act. To exercise any right, contact us using the details in Clause 12. We may need to verify your identity before responding. We will respond within the timelines required by applicable law. 8. Data Retention a. We retain personal data only for as long as necessary for the purposes described in this Policy, to comply with legal, accounting, or regulatory obligations, to resolve disputes, and to enforce our agreements. b. Clips are retained only while genuinely unreleased and are removed on graduation; once a Clip is disabled, it is not retained for public access. c. Aggregated, de-identified Feedback Data and analytics, which do not identify you, may be retained for longer to operate and improve the Platform. d. On deletion of your account, we will delete or anonymise your personal data within a reasonable period not exceeding one hundred and eighty (180) days, except where retention is required by law or for the establishment or defence of legal claims. Backups are overwritten in the ordinary course. 9. Security We implement reasonable technical and organisational security safeguards designed to protect personal data against unauthorised access, disclosure, alteration, and loss, appropriate to the nature of the data and the risk. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential. In the event of a personal data breach, we will comply with our notification obligations under applicable law. 10. Children's Data The Platform is intended for Users aged eighteen (18) or older, and Users under eighteen (18) may use it only with verifiable parental or guardian consent and supervision. We do not knowingly collect personal data of children below thirteen (13). Consistent with the DPDP Act, where we process the personal data of a child, we will obtain verifiable consent of the parent or lawful guardian and will not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe we have collected a child's data without appropriate consent, contact us and we will take steps to delete it. 11. Storage and International Transfers Personal data is stored and processed in India and may be processed by service providers located in other countries. Where personal data is transferred outside India, such transfer will be undertaken in accordance with the DPDP Act and applicable law, including any restrictions notified by the Central Government, and we will take steps to ensure an appropriate level of protection. 12. Grievance Officer and Contact In accordance with the DPDP Act and the Information Technology Act, 2000 and rules thereunder, we have designated a Grievance Officer to address questions, requests, and complaints regarding personal data and this Policy. Grievance Officer: [Insert name] Email: [Insert grievance/privacy email, e.g. privacy@…] Address: [Insert registered address], Mumbai, Maharashtra, India Response timeline: as prescribed by applicable law If you are not satisfied with our response, you may have the right to complain to the Data Protection Board of India or other competent authority. 13. Cookies and Similar Technologies We use cookies and similar technologies to operate the Platform, remember your preferences, understand usage, and improve performance and security. These include: essential cookies (required for core functionality such as login and security), performance/analytics cookies (to understand aggregated usage), and functionality cookies (to remember settings). You can control cookies through your browser or device settings; disabling certain cookies may affect functionality. Where required by law, we will seek your consent for non-essential cookies. Further detail is set out in our separate Cookie Policy. 14. Changes to this Policy We may update this Policy from time to time to reflect changes in our practices or the law. We will post the updated Policy on the Platform and, where the change is material or required by law, notify you. Your continued use after the effective date constitutes acceptance of the updated Policy. This Policy should be read together with the Terms of Service, Cookie Policy, and the other Naksha Terms.